fix turn-end hook chain for opencode checkpoints

[peyton-alt]

OpenCode checkpoints weren't being created because the turn-end hook chain failed in two places:

1. ParseHookEvent ran opencode export as a subprocess — if it failed (binary not on PATH, DB locked), the hook died
2. fileExists was checked before PrepareTranscript had a chance to create the file

No checkpoints meant empty sessions (#490) and wrong badge (#488).

Changes

• Defer opencode export from ParseHookEvent to PrepareTranscript
• Call PrepareTranscript before fileExists check
• Add session ID validation against path traversal
• Fall back to tracked currentSessionID in plugin when event omits it

[cursor]

PR Summary

Medium Risk
Changes lifecycle ordering and OpenCode turn-end handling to lazily materialize transcripts and validate session IDs; bugs here could prevent checkpoints from being created or cause missing/stale transcript data.

Overview
Fixes OpenCode turn-end checkpointing by ensuring the transcript is materialized before handleLifecycleTurnEnd checks for file existence (calling TranscriptPreparer.PrepareTranscript first), enabling lazy opencode export-backed transcripts to work reliably.

OpenCode hook parsing no longer runs opencode export during turn-end; it now computes the expected .entire/tmp/<session>.json path, adds validateSessionID/sessionTranscriptPath to prevent path traversal, and updates the OpenCode plugin to fall back to currentSessionID when session.status idle events omit sessionID. Tests are expanded/updated to cover the new behavior and validation.

^{Written by Cursor Bugbot for commit 6b064d3. Configure here.}

[Copilot]

Pull request overview

This PR fixes a critical bug in the OpenCode agent's turn-end hook chain where the transcript file existence check occurred before the file was created, causing "transcript file not found" errors.

Changes:

• Fixed hook chain order: PrepareTranscript now runs before fileExists check in turn-end handler
• Added security validation (validateSessionID) to prevent path traversal attacks in OpenCode session IDs
• Refactored OpenCode's ParseHookEvent to defer export to PrepareTranscript (removed duplicate export call)
• Added comprehensive tests for the preparer pattern and session ID validation
• Added sessionID fallback in TypeScript plugin for session.status events

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
cmd/entire/cli/lifecycle.go	Moved PrepareTranscript call before fileExists check to support OpenCode's lazy transcript fetch
cmd/entire/cli/lifecycle_test.go	Added test verifying PrepareTranscript is called before fileExists validation
cmd/entire/cli/agent/opencode/lifecycle.go	Removed duplicate export from ParseHookEvent, added sessionTranscriptPath helper and validateSessionID security check
cmd/entire/cli/agent/opencode/lifecycle_test.go	Unskipped TurnEnd test, added validation tests for path traversal and malformed session IDs, updated PrepareTranscript test expectations
cmd/entire/cli/agent/opencode/entire_plugin.ts	Added fallback to currentSessionID when props.sessionID is undefined in session.status events

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR