#621 land: batch-1019e-land

Accepted agent delivery; branch-keyed search descriptor included.

Summary by cubic

Lands the next agent-facing batch: a new aft_safety purge operation, git-revision reads, configurable bash environment, and clearer command output, plus review-driven fixes for symlink-safe purge behavior, durable purge failures, and revision-read authorization.

New Features

• aft_safety gains a purge op that permanently removes the calling session's undo backups and checkpoint copies of a file or of everything under a directory (up to the project root); a preview op lists every saved path so each is permission-checked, saved paths are matched by resolved location, a final directory symlink is purged as its own entry without following it to its target, and a checkpoint emptied by the purge is dropped and named while untouched empty checkpoints are kept (#603, #621).
• read, aft_outline, and aft_zoom take a ref argument to read a file as it is at a git revision from the object store without touching the working tree; gated by revision_reads (off by default), and toggling that key on or off live refreshes the offered schemas and refusals (#602).
• Revision-read symbol caches are evicted when the request ends rather than persisting across calls.
• bash accepts a user-configured env map (blocked keys such as NODE_OPTIONS are rejected) and warns when a matching command is already running, with notices placed above the reply's final trailer (#607, #610).
• Named safety checkpoints persist on disk for 14 days across restarts and may contain secrets.

Bug Fixes

• Hashline edits preserve file permissions and refuse planted temporary-file symlinks.
• Cargo test output shows aggregate totals across completed binaries and marks incomplete runs (#605).
• Edit not-found errors report whether the replacement is already present and at which line (#605).
• Zoom call-graph annotations cap at 15 entries and label same-file callers (#605).
• Historical reads check the verbatim path lexically against the project root, so a path that is a symlink today cannot redirect a read at an older commit.
• Purge compares undo-backup keys as stored instead of re-resolving them, so a directory replaced by a symlink no longer purges a different location; it records a durable pending-purge map and the checkpoint-drop intent before unlinking blobs, so a restart or later failure keeps failed checkpoints restorable and preserves already-completed removal counts. Purge reports resolve checkpoint spellings at the reporting boundary, deduplicate preview/removal lists, and strip Windows verbatim prefixes without re-keying storage (#621).
• safety and zoom now use the canonical path argument; filePath is no longer accepted.

Confidence Score: 5/5

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Agent requests purge] --> B[Validate requested location]
  B --> C[List matching saved locations]
  C --> D[Plugin checks permissions]
  D --> E[Remove session undo backups]
  E --> F[Save checkpoint deletion intent]
  F --> G[Remove selected checkpoint copies]
  G --> H[Report removals and failures]

_{Reviews (11) · Last reviewed commit: "mason: normalize purge reports and resto..." · Reviewed by Greptile}