feat(checkpoint): filesystem checkpointing and rollback before destructive operations

[alireza78a]

Closes #452

What changed

Added filesystem checkpointing using a shadow git repository before any destructive operation (delete, overwrite, move).

How it works

• Shadow git repo at ~/.hermes/checkpoints/{dir-hash}/
• Automatic snapshot before rm, mv, and file overwrite
• restore and list commands via checkpoint tool
• Uses GIT_DIR env var — never conflicts with project git
• Nested git repo detection — checkpointing disabled if .git exists in working dir
• Concurrency guard — threading.Lock() per directory prevents duplicate snapshots
• Configurable timeout via HERMES_CHECKPOINT_TIMEOUT (10–60s, default 30s)
• Respects project .gitignore via shadow repo core.excludesFile

Files changed

• tools/checkpoint_tool.py — new tool
• tools/patch_parser.py — checkpoint before delete/move
• tools/file_operations.py — checkpoint before overwrite
• model_tools.py — register new tool
• tests/tools/test_checkpoint_tool.py — 50 tests, all passing

Tested on

macOS

[teknium1]

Thanks for this PR @alireza78a! We loved the concept and the quality of your CheckpointStore implementation. We've taken your core approach (shadow git repos via GIT_DIR + GIT_WORK_TREE, deterministic path hashing, exclude patterns) and built it into a proper integration.

What we changed from your approach:

1. Not a tool — checkpoints are transparent infrastructure. The LLM never sees it, no prompt tokens consumed, no tool schema overhead.

2. Once per turn, not per write — instead of hooking into every write_file call, we checkpoint lazily on the first file-mutating operation per conversation turn. This avoids the performance overhead of running git add -A && git commit on every single write.

3. Opt-in — enabled via --checkpoints CLI flag or checkpoints: { enabled: true } in config.yaml. No mandatory overhead for users who don't want it.

4. /rollback command — user-facing restore via slash command in both CLI and gateway (Telegram/Discord/etc.). Lists checkpoints with timestamps, restore by number.

5. No injection into file_operations.py or patch_parser.py — trigger lives in run_agent.py's tool dispatch loop, keeping core file tools clean and decoupled.

Your shadow git approach was the right design — we just adjusted the integration points. Thanks for the inspiration and the solid foundation! 🎉