Masks background task completion previews and watch push text so credentials never reach OpenCode or Pi; raw output files and bash_status results are unchanged.
Details
Captures secret-named environment values from the child environment and redacts them along with common credential formats before any preview edge cut.
Restarted tasks withhold previews, returning a pointer to the output file, because secret values are never persisted.
Restores pipeline failure warnings and recovery markers after masking a completion body.
Fixes watch panics at Unicode scan boundaries by mapping offsets against the full lossy decoding and aligning to character boundaries.
Watch matching still scans raw bytes; only presented match text/context is masked, including matches split at chunk boundaries.
Tightens sk- redaction to length-qualified keys so ordinary sk- words remain visible.
Confidence Score: 5/5
The changes appear safe to merge; no new actionable issues were found.
Summary
Masks background completion previews and watch text before shortening them. Raw output files and bash_status results remain unchanged.
Background completion notices hide credentials from printed output.
Watch notifications hide credentials in matched text and context.
