tree eaa6cac6a052a02a97a94a62a2fc13adadd50a6e
parent 2be768e4f4d28dc56c7e0b10df342c607ef04833
author banksean <banksean@gmail.com> 1752863371 +0000
committer banksean <banksean@gmail.com> 1752865471 -0700

claudetool/bashkit: add sketch-wip branch protection with process-level tracking

Add a best-effort check to reject git commands that would change the
container-side 'sketch-wip' git branch. The protection prevents:

1. Branch renaming: git branch -m sketch-wip newname
2. Branch switching: git checkout otherbranch, git switch otherbranch
3. Force branch renaming: git branch -M sketch-wip newname

The check allows legitimate operations like:
- File checkout: git checkout -- file.txt
- Path operations: git checkout src/main.go
- Branch creation: git switch -c newbranch
- Standard git operations: git commit, git status, etc.

Key features:
- Process-level tracking: Shows warning only once per process
- Informative error message explaining why it's blocked
- Suggests using 'set-slug' tool for external branch naming
- Tells user they can repeat the command if really needed

Implementation:
- Added process-aware check alongside existing static checks
- Process-level tracking via mutex-protected boolean
- Comprehensive test coverage including edge cases
- Maintains backward compatibility with existing Check() function

This prevents agents from inadvertently breaking the outie's ability
to detect and push changes to GitHub by changing the expected branch name.

Co-Authored-By: sketch <hello@sketch.dev>
Change-ID: s3bb00ecac8a4badek