Rewind file tracking backs up gitignored secret files; add an exclude or an off switch #5172

Version: Copilot CLI 1.0.91, Linux x64, interactive mode.

What happens

Since /rewind became git-free (1.0.78), the CLI saves the earlier content of every file that a turn changes under the session's working directory into session-state/<session-id>/rewind-file-snapshots/backups/. Gitignored files are included. When the agent edits a .env file in a turn (for example to rotate an API token), the old file, with every secret in it, stays in session state as a plain file at mode 644. It stays there after the session ends.

A session with one long autonomous turn has one snapshot, so every file that turn changes is held in that snapshot.

What I checked

• copilot help config, copilot help environment and copilot --help name no setting, flag or variable for rewind file tracking. respectGitignore covers only the @ file picker.
• The interactive CLI starts each session with enableFileChangeTracking set to true as a constant. Only SDK clients can pass the option.
• The tracker skips a file only for its size, a non-regular file or an unverifiable identity. It does not skip files that .gitignore excludes or files that hold secrets.

Steps to reproduce

1. In a git repository, put .env.local in .gitignore and give it a line such as EXAMPLE_TOKEN=old-value.
2. Start copilot in that repository and ask it to change the value to new-value with a shell command.
3. List session-state/<session-id>/rewind-file-snapshots/backups/. One file holds EXAMPLE_TOKEN=old-value, and index.json maps it to .env.local.

Expected

A secret file that Copilot edits does not stay copied in session state. Any one of these would do:

1. Skip files that .gitignore excludes, or files that match .env*, when the tracker saves earlier content. /rewind then lists them as not restorable.
2. A setting, for example rewind.excludePatterns, that takes path patterns the tracker skips.
3. A setting or flag that turns off file tracking, leaving conversation-only rewind.

Also: write the backups at mode 600, the same as the other session files.