Restores background task completion and watch previews after a daemon restart when the child environment's only secret is AFT's own gh-shim ticket. Watch previews now mask whole lines over a bounded window, so truncated output can no longer expose credential tails, and chained preview redactions are preserved end-to-end.
Persists a BLAKE3 digest of the gh-shim ticket, never the ticket itself, plus a flag for non-ticket secrets.
Watch previews redact whole lines read from a bounded window around a match; previews are withheld when lines exceed 8 KiB, a JSON secret value stays open past the window, or key-body-shaped lines lack a visible BEGIN/END marker.
Completion previews track which source bytes each line came from, so ticket candidates are checked at their exact positions and repeated hex-edged lines keep their previews.
Tasks with caller-provided secret environment values, and older records lacking the new fields, still withhold previews after restart.
Confidence Score: 5/5
The changes since the last review appear safe to merge; no new actionable issue was established.
Summary
Restores completion and watch previews after restart for tasks whose only secret was AFT’s revoked ticket.
Ticket-only background tasks keep their completion previews after a restart.
Watch matches show nearby output without rereading the whole capture.
All five earlier threads were marked resolved by ualtinok without explanatory replies. None supplied a Comment number.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Task restored after restart] --> B{Other secret values needed?}
B -->|Yes or unknown| C[Withhold new preview]
B -->|No| D[Read output for preview]
D --> E[Mask known credential formats]
E --> F[Mask ticket using saved digest]
F --> G{Safe within limits?}
G -->|Yes| H[Save and deliver preview]
G -->|No| C
