Checkpoint restore (git clean -fd) permanently deletes all untracked files

[barucoh]

Describe the bug

Describe the bug

When using "restore to checkpoint" (triggered by pressing Escape during an agent run and choosing to restore), the SnapshotManager.rollbackToSnapshot() method runs git clean -fd on the repository root. This permanently deletes all untracked files and directories in the repo — including large output files generated by external processes that the agent never touched.

In my case, this destroyed ~1GB+ of evaluation output data (.jsonl and .xlsx files) across multiple directories under output/ that were generated by a Python script the agent ran. The agent only read these files — it never created or modified them — yet they were all deleted by the checkpoint restore.

Root cause (from source analysis)

The rollback flow in rollbackToSnapshot() calls:

1. trr(gitRoot, gitCommit, gitBranch) → runs git checkout --force + git reset --hard
2. qnr(gitRoot) → runs git clean -fd ← this is the destructive operation

git clean -fd removes all untracked files and directories. The snapshot system only backs up files that the agent itself created/modified. Any files created by external processes (scripts, builds, test output, data pipelines) that happen to be untracked are silently and permanently deleted.

Affected version

0.0.417 (but the code is present in earlier versions too — at least 0.0.411+)

Steps to reproduce

1. Have a git repo with untracked files/directories not in .gitignore (e.g., output/ with large data files)
2. Start a Copilot CLI session in that repo
3. Have the agent run a command that generates output files (e.g., uv run python script.py that writes to output/)
4. Press Escape twice to cancel the agent mid-run
5. Choose "Restore to this checkpoint" when prompted
6. All untracked files/directories are now deleted — including the output files from step 3

Expected behavior

Checkpoint restore should not delete untracked files that the agent didn't create. Possible fixes:

1. Only clean files the agent created: Track which files were created by agent tool calls and only remove those
2. Skip git clean entirely: The snapshot already tracks and restores individual files — the git clean is a blunt hammer on top
3. Warn the user: At minimum, show "This will delete X untracked files (Y MB). Proceed?" before running git clean -fd
4. Move to trash instead of delete: Use OS trash/recycle bin so files can be recovered

Additional context

• The output/ directory was not in .gitignore (user's mistake, now fixed), but even repos with proper .gitignore could lose untracked files in directories that aren't ignored
• The data loss is permanent — git clean -fd doesn't use the recycle bin
• This is especially dangerous for repos that generate large output artifacts (ML training, data pipelines, evaluation benchmarks)
• The SESSION_CLEANUP feature flag is set to "staff-or-experimental", suggesting this is still being refined

Affected version

0.0.417

Steps to reproduce the behavior

No response

Expected behavior

No response

Additional context

No response