Add bash checkpoint support and tool filtering in agent presets

[svarlamov]

Add bash checkpoint support and move tool filtering to checkpoint-time

Summary

Previously, git-ai only captured file changes made through explicit file-edit tools (e.g. Write, edit, write_file). Changes made via bash/shell commands were invisible. This PR:

1. Moves tool filtering from install-time to checkpoint-time: Agent hook installers now register for all tool events. Each agent preset classifies the tool at checkpoint time into FileEdit, Bash, or Skip via a new classify_tool() function.

2. Adds a shared bash_checkpoint module (src/commands/checkpoint_agent/bash_checkpoint.rs): Provides tool classification, bash command blacklist evaluation, command extraction from tool input, and scoped path parsing for common shell patterns. Includes an 800ms timeout kill switch.

3. Updates all 6 agent presets (Claude, Gemini, Continue CLI, Droid, Amp, OpenCode) with bash tool handling that follows pre-command → human checkpoint, post-command → AI checkpoint semantics.

4. Updates the OpenCode TypeScript plugin to forward all tool events (not just file-edit tools) and include tool_name in hook input.

5. Fixes all tests to include the now-required tool_name field in hook_input JSON, using the correct tool name per agent.

Review & Testing Checklist for Human

• Verify tool name mappings in classify_tool() against each agent's actual documentation — if a mapping is wrong, checkpoints will be silently skipped for that tool. Check: Claude (Write/Edit/MultiEdit/Bash), Gemini (write_file/shell), Continue (edit/terminal), Droid (ApplyPatch/Bash), Amp (Write/Edit/Bash), OpenCode (edit/bash/shell).
• Review the bash command blacklist in bash_checkpoint.rs — commands like ls, cat, echo, pwd are blacklisted (no checkpoint). Verify this list is complete and doesn't accidentally skip commands that modify files (e.g. sed, awk, tee should NOT be blacklisted).
• Check for duplicated bash handling blocks across all 6 presets — the bash checkpoint logic is copy-pasted into each preset's run() method. Consider whether this should be extracted into a shared helper to reduce maintenance burden.
• Spot-check test changes — the bulk of test file changes are mechanical additions of "tool_name": "..." to existing hook_input JSON. Verify a few examples use the correct tool name for that agent.
• Test locally with a real agent making bash changes (e.g. Claude running echo "foo" > bar.txt) to verify end-to-end checkpoint creation works. CI passing is necessary but insufficient for this type of integration.

Notes

• All existing tests pass. Full test suite (1,200+ tests) ran successfully.
• The 800ms timeout kill switch for bash checkpoint scanning is implemented in bash_checkpoint.rs but not exercised by tests.
• OpenCode plugin changes handle edge cases: bash tools may not have filePath, so we fall back to cwd or process cwd when finding the git repo.
• Error path: Bash commands on the blacklist return PresetError("Bash command blacklisted..."), which skips the checkpoint but doesn't fail the tool execution.

---

Link to Devin Session: https://app.devin.ai/sessions/3018cc9b74db4a56a06ed5cc39c42766
Requested by: @svarlamov

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[git-ai-cloud-dev]

No AI authorship found for these commits. Please install git-ai to start tracking AI generated code in your commits.

[devin-ai-integration]

All 4 bugs identified have been fixed in 0589d42:

1. OpenCode tool_input_raw — Changed OpenCodeHookInput.tool_input from typed ToolInput struct to raw serde_json::Value, so the command field is preserved for bash command extraction.
2. Redirection detection — Added has_output_redirection() that checks for > / >> outside quotes before the blacklist lookup. echo "foo" > bar.txt now correctly triggers a checkpoint.
3. awk removed from blacklist — Removed since it can modify files with -i inplace or output redirection.
4. "stash list" dead code — Removed from GIT_READONLY_SUBCOMMANDS since the multi-word string could never match the single-token comparison.

[git-ai-bot-svarlamov-dev]

No AI authorship found for these commits. Please install git-ai to start tracking AI generated code in your commits.

[svarlamov]

closing outdated/superseded

[jwiegley]

Now superceded by #798