Blast radius limit
Cleaner now supports an optional blastRadiusLimit field that aborts a Delete/Transform run if too many resources would be affected. A guard against a bad label filter or Lua evaluate/aggregatedSelection script matching far more than intended. Set maxCount to abort past a fixed number of matches, maxPercentage to abort once matches exceed a share of everything the resourceSelectors considered, or both. Either one tripping aborts the run.
Scan is unaffected since it never acts. When the limit trips, nothing is deleted or updated, but notifications and storeResourcePath still report the full matched set so you can see what would have happened, and the abort reason surfaces through Cleaner.status.failureMessage, same as any other run failure.
blastRadiusLimit:
maxCount: 50
maxPercentage: 25Rollback for Delete/Transform
An opt-in rollback field on Cleaner captures each resource's pre-action state before it's deleted or transformed, and a new dashboard action replays that state back, reverting the most recent Delete or Transform run.
It requires a CleanerReport notification to be configured, since that's what persists the captured state; without one, Cleaner refuses to run rather than act with nowhere to record a way back. The snapshot is written before any resource is touched, so a write failure aborts the run before anything changes. Per-resource captures are capped at 256KB to keep the Report bounded, and captured bodies never leave the Report.
Readable Slack, Teams, and Discord notifications
Slack, Teams, and Discord notifications previously sent the raw ReportSpec JSON as message text, unreadable past a handful of resources. All three now get a formatted, color-coded message instead: Slack gets a color-coded attachment (red/yellow/green by action) with the Cleaner name as the author line and one bullet per resource; Teams gets an Adaptive Card with a matching colored container; Discord gets a proper embed instead of the report being written to a temp file and uploaded as an attachment. All three cap the resource list at 20 lines with "...and N more" so a large match doesn't flood the channel.