refactor(hooks): replace flat backend flags with hooks.scm category-scoped infrastructure

[aaight]

Summary

• Replace flat backend flags (enableStopHooks, blockGitPush, requiresPR) with category-scoped hook infrastructure (hooks.scm.*)
• Add ScmHooksSchema and HooksSchema to schema.ts with backward-compat flat flags marked deprecated
• Add resolveScmHooks() helper that merges legacy flat flags with new hooks.scm format (new wins)
• Migrate all 10 YAML agent definitions to hooks.scm format; add requiresReview to review.yaml and requiresPushedChanges to PR-response agents
• Refactor validateFinish() to be hook-driven (hooks.requiresPR, hooks.requiresReview, hooks.requiresPushedChanges) instead of hardcoded agent-type string checks
• Thread resolved hooks through adapter to llmist backend to initSessionState() to validateFinish()
• Update dashboard BackendSection: split into SCM Hooks card + Backend Settings, add setHook() helper for nested hooks.scm state
• Update all related tests to use new hook-driven API

Card: https://trello.com/c/69a59cdcad0376266f527504

Test plan

• All unit tests pass (3720 passed)
• TypeScript type checking passes (backend + web)
• Linting passes (biome)
• Backward compatibility preserved: resolveScmHooks() merges legacy flat flags + new hooks.scm (new wins)
• Schema validation works for both old format (flat flags) and new format (hooks.scm)
• All 10 YAML definitions migrated to new format
• validateFinish() is now hook-driven, no more hardcoded agent-type strings

Generated with Claude Code

[nhopeatall]

✨ On it — checking the hooks infrastructure changes

---

Progress: [░░░░░░░░░░] 4% (iteration 3/70)

🔍 Code Review Update (1 min)

I've completed reviewing the provided files, /workspace/cascade-cascade-1772463949572/src/agents/definitions/profiles.ts and /workspace/cascade-cascade-1772463949572/web/src/components/settings/agent-definition-editor.tsx, to understand the context of the changes. I'm now systematically analyzing the PR, focusing on the strategic implications of replacing flat backend flags with a more structured approach. My next step is to delve into the specifics of the implementation.

_{Last updated: iteration 3 · review}

[nhopeatall]

🔍 Reviewing PR #606...

[nhopeatall]

✅ Review complete — Approved

Clean refactoring that replaces agent-type string matching with a data-driven hooks.scm system. Backward-compatible, well-tested, and extensible. See full review for observations.

[nhopeatall]

Summary

Clean, well-structured refactoring that replaces brittle agent-type string matching with a data-driven hook system. The implementation is correct, backward-compatible, and well-tested. Approved.

Architecture & Design

The PR makes a solid architectural improvement:

• Hook-driven validation eliminates the coupling between validateFinish() and specific agent type strings. New agent types get finish validation "for free" by declaring hooks in their YAML definition — no code changes needed.
• Category-scoped design (hooks.scm) is extensible for future hook categories (e.g., hooks.pm, hooks.email) without polluting the flat namespace.
• resolveScmHooks() merge strategy is clean: legacy flat flags spread first, then hooks.scm overrides — simple, predictable, and well-documented.
• Threading path is straightforward: YAML → resolveScmHooks() → profile → llmist backend → createConfiguredBuilder() → initSessionState() → Finish gadget → validateFinish().

Observations (non-blocking)

1. respond-to-pr-comment gains requiresPushedChanges: true — this is a new behavioral constraint that wasn't previously enforced (the old code only checked respond-to-review and respond-to-ci). This seems intentional given the agent's purpose ("make the changes, commit, and push"), but worth noting as a behavioral change beyond pure refactoring.

2. debug.yaml changed from enableStopHooks: true to no hooks — defaults to false. Correct for a read-only agent (only fs:read capability), so the original true was likely a misconfiguration.

3. CLI finish.ts passes hooks: {} — meaning CLI-driven finish bypasses all hook validation. This is the right call since CLI users manage their own workflow, but it's worth documenting this design decision for future maintainers.