Instead of implementing your own command loop, why not just have a command that prompts the LLM, and uses the result to edit and commit a file (using hard-coded logic for the commit rather than parsing a tool request)? Then you're always in "stay at the terminal" mode anyway and you can use Git normally to "restore". If you want to loop anyway to re-use a process (and avoid persisting context between queries, or whatever), experienced terminal users can just background the process anyway. For me, everything aside from the actual prompt interface here is window dressing.

Anyway, safety for these tools is only minimally about having backups. The much more important part is the amount of agency extended to the tool. The LLM part itself can only generate instructions; it's up to the rest of the agent to actually follow them. So really all depends on what commands you recognize (is there anything beyond a "write text X to file Y" command?) and what is hard-coded (e.g. invoking `git commit` after each write).