add confirm-destructive, git-checkpoint, notify extensions

AGENTS.md

@@ -18,6 +18,9 @@ This file is for agents modifying the repo.
 ```
 extensions/
   ssh-controlmaster.ts    # ControlMaster SSH remote execution (see below)
+  confirm-destructive.ts  # Confirm before dangerous bash commands and session actions
+  git-checkpoint.ts       # Git stash checkpoint per turn, restorable on /fork
+  notify.ts               # Native terminal notification when agent finishes
 install.sh                # Idempotent installer — symlinks extensions/ into ~/.pi/agent/extensions/
 package.json              # pi package manifest — enables `pi install /path` as an alternative
 README.md                 # User-facing docs.
@@ -115,7 +118,46 @@ on a remote machine via SSH when `--ssh user@host` is passed.
   `--ssh-ask-pass` is silently ignored — the system master handles auth
   independently and the socket is just reused.
 
-## Testing
+### `confirm-destructive.ts`
+
+Always-on (no flag). Two layers:
+
+1. **Bash gate** — intercepts `tool_call` for `bash` and checks the command
+   against a pattern list. On match, shows a `select` dialog. Blocks in
+   non-interactive mode by default.
+   Patterns: recursive `rm`, `sudo`, `chmod/chown 777`, `dd if=`, `mkfs`,
+   `git push --force`, writes to `/dev/*`, `truncate --size 0`.
+
+2. **Session gate** — hooks `session_before_switch` and `session_before_fork`.
+   Confirms before `/new` (clear) and `/resume` (switch, only if there are
+   unsaved messages). Always confirms before `/fork`.
+
+When adding new patterns, add to the `DANGEROUS` array at the top of the file.
+Each entry has a `pattern` (RegExp) and a `label` shown in the dialog.
+
+### `git-checkpoint.ts`
+
+Always-on. Silently skips when the `cwd` is not inside a git repo.
+
+- At `turn_start`: runs `git stash create` (non-destructive — creates a stash
+  object without touching the working tree). Stores the stash ref keyed to
+  the current session entry ID. Empty output (nothing to stash) is silently
+  ignored.
+- At `session_before_fork`: if a checkpoint exists for the selected entry,
+  offers to `git stash apply` it.
+- Status bar shows `⎇ N checkpoints` when checkpoints are present.
+- Checkpoints are in-memory only — they do not survive a pi restart, but stash
+  objects remain in the git repo and can be applied manually.
+
+### `notify.ts`
+
+Always-on. Records `agent_start` timestamp; on `agent_end` checks if elapsed
+time exceeds `--notify-min-secs` (default 8). Silently skips short responses.
+
+Terminal detection order: `KITTY_WINDOW_ID` → OSC 99 (Kitty) →
+`WT_SESSION` → Windows toast → OSC 777 (iTerm2, WezTerm, Ghostty).
+
+Notification text: `Pi — Done (Ns)` where N is the rounded elapsed seconds.
 
 No framework. Manual: