@moretea-labs/forge 1.7.2 → 1.8.0

package/src/cli/repositories/structured-git.ts

@@ -1,4 +1,7 @@
 import { spawnSync } from 'child_process';
+import { randomUUID } from 'crypto';
+import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from 'fs';
+import { isAbsolute, resolve } from 'path';
 import { capProcessOutput, redactProcessOutput } from '../../effects/process-runner';
 import { executeRepositoryGitCommand, type RepositoryGitExecution } from './git-command-executor';
 import { validateBranchName } from './branch-name-policy';
@@ -51,6 +54,11 @@ export interface RepositoryGitCommitResult {
   error?: { code: string; message: string };
 }
 
+export interface RepositoryGitCommitScope {
+  source: 'explicit_paths' | 'staged_index';
+  paths: string[];
+}
+
 export interface RepositoryGitFinishResult {
   repoId: string;
   checkoutId: string;
@@ -114,6 +122,28 @@ function normalizePaths(input: unknown): string[] {
   return [...new Set(input.map((entry) => String(entry ?? '').trim().replace(/\\/g, '/')).filter(Boolean))].sort();
 }
 
+export function repositoryGitStagedPaths(repository: RepositoryRecord): string[] {
+  const staged = runGit(repository, ['diff', '--cached', '--name-only', '-z'], 128 * 1024);
+  if (!staged.ok) {
+    throw new Error(`GIT_COMMIT_SCOPE_INSPECTION_FAILED: ${staged.stderr || 'Unable to inspect the staged Git index.'}`);
+  }
+  return staged.stdout.split('\0').map((path) => path.trim()).filter(Boolean).sort();
+}
+
+/**
+ * Commit scope has one repository authority. Explicit pathspecs narrow the
+ * transaction; otherwise the exact staged Git index is the scope. Callers do
+ * not need to restate the same staged paths merely to satisfy routing policy.
+ */
+export function resolveRepositoryGitCommitScope(
+  repository: RepositoryRecord,
+  input: { paths?: unknown },
+): RepositoryGitCommitScope {
+  const explicitPaths = normalizePaths(input.paths);
+  if (explicitPaths.length > 0) return { source: 'explicit_paths', paths: explicitPaths };
+  return { source: 'staged_index', paths: repositoryGitStagedPaths(repository) };
+}
+
 function splitStatus(porcelain: string): { staged: string[]; unstaged: string[]; untracked: string[] } {
   const staged: string[] = [];
   const unstaged: string[] = [];
@@ -262,57 +292,108 @@ export function repositoryGitDeleteBranch(controllerHome: string, repository: Re
 export function repositoryGitCommit(controllerHome: string, repository: RepositoryRecord, input: { message: unknown; paths?: unknown; allowEmpty?: unknown; authorizationDecision?: AuthorizationDecision; sessionId?: string; principalId?: string; workId?: string; goalId?: string }): RepositoryGitCommitResult {
   const before = repositoryGitStatus(repository);
   const message = normalizeCommitMessage(input.message);
-  const paths = normalizePaths(input.paths);
+  const scope = resolveRepositoryGitCommitScope(repository, { paths: input.paths });
+  const paths = scope.source === 'explicit_paths' ? scope.paths : [];
   let stage: RepositoryGitExecution | undefined;
-  if (paths.length > 0) {
+  let explicitIndexSnapshot: { path: string; existed: boolean; contents?: Buffer } | undefined;
+  const restoreExplicitIndex = (): { ok: boolean; message?: string } => {
+    if (!explicitIndexSnapshot) return { ok: true };
+    const restorePath = `${explicitIndexSnapshot.path}.forge-restore-${randomUUID()}`;
+    try {
+      if (!explicitIndexSnapshot.existed) {
+        rmSync(explicitIndexSnapshot.path, { force: true });
+        return { ok: true };
+      }
+      if (!explicitIndexSnapshot.contents) return { ok: false, message: 'pre-stage index contents are unavailable' };
+      writeFileSync(restorePath, explicitIndexSnapshot.contents);
+      renameSync(restorePath, explicitIndexSnapshot.path);
+      return { ok: true };
+    } catch (error) {
+      rmSync(restorePath, { force: true });
+      return { ok: false, message: error instanceof Error ? error.message : String(error) };
+    }
+  };
+  const failedAfterExplicitStage = (code: string, message: string, commit?: RepositoryGitExecution): RepositoryGitCommitResult => {
+    const restored = restoreExplicitIndex();
+    return {
+      repoId: repository.repoId,
+      checkoutId: repository.activeCheckoutId,
+      before,
+      ...(stage ? { stage } : {}),
+      ...(commit ? { commit } : {}),
+      after: repositoryGitStatus(repository),
+      committed: false,
+      error: restored.ok
+        ? { code, message }
+        : { code: `${code}_INDEX_RESTORE_FAILED`, message: `${message}; failed to restore the exact pre-stage index: ${restored.message}` },
+    };
+  };
+  if (scope.source === 'explicit_paths') {
+    const rawIndexPath = gitText(repository, ['rev-parse', '--git-path', 'index']);
+    if (!rawIndexPath) {
+      return {
+        repoId: repository.repoId,
+        checkoutId: repository.activeCheckoutId,
+        before,
+        after: repositoryGitStatus(repository),
+        committed: false,
+        error: { code: 'GIT_INDEX_SNAPSHOT_FAILED', message: 'Unable to resolve the Git index path before an explicit-path commit.' },
+      };
+    }
+    const indexPath = isAbsolute(rawIndexPath) ? rawIndexPath : resolve(repository.canonicalRoot, rawIndexPath);
+    try {
+      const existed = existsSync(indexPath);
+      explicitIndexSnapshot = {
+        path: indexPath,
+        existed,
+        ...(existed ? { contents: readFileSync(indexPath) } : {}),
+      };
+    } catch (error) {
+      return {
+        repoId: repository.repoId,
+        checkoutId: repository.activeCheckoutId,
+        before,
+        after: repositoryGitStatus(repository),
+        committed: false,
+        error: { code: 'GIT_INDEX_SNAPSHOT_FAILED', message: error instanceof Error ? error.message : String(error) },
+      };
+    }
     stage = executeRepositoryGitCommand(controllerHome, repository, { args: ['add', '--all', '--', ...paths], authorization: 'explicit_user_request', ...input });
     if (stage.status !== 'executed' || stage.ok !== true) {
-      return { repoId: repository.repoId, checkoutId: repository.activeCheckoutId, before, stage, after: repositoryGitStatus(repository), committed: false, error: { code: 'GIT_STAGE_FAILED', message: stage.stderr || 'git add failed' } };
+      return failedAfterExplicitStage('GIT_STAGE_FAILED', stage.stderr || 'git add failed');
     }
   }
   const diffCheck = runGit(repository, ['diff', '--cached', '--quiet'], 64 * 1024);
   if (diffCheck.status === 0 && input.allowEmpty !== true) {
-    return { repoId: repository.repoId, checkoutId: repository.activeCheckoutId, before, stage, after: repositoryGitStatus(repository), committed: false, error: { code: 'GIT_NOTHING_STAGED', message: 'No staged changes to commit. Pass paths to stage, or allow_empty=true for an empty commit.' } };
+    return failedAfterExplicitStage('GIT_NOTHING_STAGED', 'No staged changes to commit. Pass paths to stage, or allow_empty=true for an empty commit.');
   }
   const mergeInProgress = runGit(repository, ['rev-parse', '--verify', 'MERGE_HEAD'], 64 * 1024).ok;
   if (mergeInProgress) {
     const unresolved = runGit(repository, ['diff', '--name-only', '--diff-filter=U', '-z'], 128 * 1024);
     const unresolvedPaths = unresolved.stdout.split('\0').map((path) => path.trim()).filter(Boolean);
     if (!unresolved.ok || unresolvedPaths.length > 0) {
-      return {
-        repoId: repository.repoId,
-        checkoutId: repository.activeCheckoutId,
-        before,
-        stage,
-        after: repositoryGitStatus(repository),
-        committed: false,
-        error: { code: 'GIT_MERGE_UNRESOLVED', message: unresolvedPaths.length > 0 ? `Merge still has unresolved path(s): ${unresolvedPaths.join(', ')}` : unresolved.stderr || 'Unable to inspect unresolved merge paths.' },
-      };
+      return failedAfterExplicitStage(
+        'GIT_MERGE_UNRESOLVED',
+        unresolvedPaths.length > 0 ? `Merge still has unresolved path(s): ${unresolvedPaths.join(', ')}` : unresolved.stderr || 'Unable to inspect unresolved merge paths.',
+      );
     }
     if (paths.length > 0) {
       const stagedNames = runGit(repository, ['diff', '--cached', '--name-only', '-z'], 128 * 1024);
       if (!stagedNames.ok) {
-        return { repoId: repository.repoId, checkoutId: repository.activeCheckoutId, before, stage, after: repositoryGitStatus(repository), committed: false, error: { code: 'GIT_MERGE_STAGED_SCOPE_INSPECTION_FAILED', message: stagedNames.stderr || 'Unable to inspect the merge index.' } };
+        return failedAfterExplicitStage('GIT_MERGE_STAGED_SCOPE_INSPECTION_FAILED', stagedNames.stderr || 'Unable to inspect the merge index.');
       }
       const allowed = new Set(paths);
       const stagedPaths = stagedNames.stdout.split('\0').map((path) => path.trim()).filter(Boolean);
       const outsideScope = stagedPaths.filter((path) => !allowed.has(path));
       if (outsideScope.length > 0) {
-        return {
-          repoId: repository.repoId,
-          checkoutId: repository.activeCheckoutId,
-          before,
-          stage,
-          after: repositoryGitStatus(repository),
-          committed: false,
-          error: { code: 'GIT_MERGE_STAGED_SCOPE_MISMATCH', message: `Resolved merge index contains staged path(s) outside the requested commit scope: ${outsideScope.join(', ')}` },
-        };
+        return failedAfterExplicitStage('GIT_MERGE_STAGED_SCOPE_MISMATCH', `Resolved merge index contains staged path(s) outside the requested commit scope: ${outsideScope.join(', ')}`);
       }
     }
   }
   const commitArgs = ['commit', '-m', message, ...(input.allowEmpty === true ? ['--allow-empty'] : []), ...(!mergeInProgress && paths.length > 0 ? ['--only', '--', ...paths] : [])];
   const commit = executeRepositoryGitCommand(controllerHome, repository, { args: commitArgs, authorization: 'explicit_user_request', ...input });
   const ok = commit.status === 'executed' && commit.ok === true;
+  if (!ok) return failedAfterExplicitStage('GIT_COMMIT_FAILED', commit.stderr || 'git commit failed', commit);
   return {
     repoId: repository.repoId,
     checkoutId: repository.activeCheckoutId,
@@ -320,8 +401,7 @@ export function repositoryGitCommit(controllerHome: string, repository: Reposito
     ...(stage ? { stage } : {}),
     commit,
     after: repositoryGitStatus(repository),
-    committed: ok,
-    ...(ok ? {} : { error: { code: 'GIT_COMMIT_FAILED', message: commit.stderr || 'git commit failed' } }),
+    committed: true,
   };
 }
 

package/src/cli/runtime/helper-runner.ts

@@ -7,6 +7,12 @@ const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
 const PACKAGE_ROOT = resolve(SCRIPT_DIR, '..', '..', '..');
 const PACKAGE_HELPERS_ROOT = join(PACKAGE_ROOT, 'assets', 'templates', 'helpers');
 const PACKAGE_CONTRACT = join(PACKAGE_ROOT, 'assets', 'workflow-contract.v1.json');
+const HELPER_OUTPUT_REDACTIONS = [
+  {
+    pattern: /(\b(?:proxy-)?authorization\s*[:=]\s*)(?:bearer|basic)\s+[^\s,;]+/gi,
+    replacement: '$1[redacted]',
+  },
+] as const;
 
 export type HelperSource = 'env' | 'repo-pin' | 'package' | 'repo-fallback';
 
@@ -149,6 +155,7 @@ export function runHelper(opts: RunHelperOptions): RunHelperResult {
     stdio: opts.stdio ?? 'inherit',
     timeoutMs: opts.timeoutMs,
     maxOutputBytes: opts.maxOutputBytes,
+    redactions: HELPER_OUTPUT_REDACTIONS,
   });
 
   if (child.error) {

package/src/cli/runtime-invocation.ts

@@ -36,6 +36,8 @@ export interface CliChildInvocationOptions {
   env?: NodeJS.ProcessEnv;
   /** Explicit package/global shim entry. Never inferred from a file extension. */
   launcherEntry?: string;
+  /** Explicit Node ESM loader for TypeScript source children. Never inferred from the entry extension. */
+  nodeSourceLoaderEntry?: string;
 }
 
 export interface CurrentCliRuntimeOptions extends CliChildInvocationOptions {
@@ -151,7 +153,12 @@ export function resolveCliChildInvocation(
   } else {
     const entry = cliEntry.trim();
     if (!entry) throw new CliRuntimeResolutionError([`${kind} requires a source entry`]);
-    childArgs = [entry, ...args];
+    if (kind === 'node_source' && options.nodeSourceLoaderEntry?.trim()) {
+      childArgs = ['--loader', options.nodeSourceLoaderEntry.trim(), entry, ...args];
+      diagnostics.push('explicit Node source loader supplied');
+    } else {
+      childArgs = [entry, ...args];
+    }
   }
 
   const diagnostic = [

package/src/cli/tools/codegraph.ts

@@ -1,7 +1,9 @@
-import { mkdirSync, readFileSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { dirname, join, resolve } from "path";
 import { fileURLToPath } from "url";
 import { runProcess as runBoundedProcess } from "../../effects/process-runner";
+import { resolveControllerHome } from "../repositories/controller-home";
+import { createCodegraphCacheLocator, migrateLegacyCodegraphCache } from "../../runtime/context/codegraph-cache-boundary";
 
 const CLAUDE_CODEGRAPH_ALLOWED_TOOLS_PATTERN = "mcp__codegraph__*";
 const CLAUDE_CODEGRAPH_SERVER_NAME = "codegraph";
@@ -158,13 +160,24 @@ function normalize(raw: Record<string, any>): CodegraphCheckResult {
 }
 
 export function checkCodegraph(opts: CodegraphResolveOptions): CodegraphCheckResult {
-  return normalize(readToolingReport(opts.repoRoot, opts.env, opts.host));
+  const locator = createCodegraphCacheLocator(opts.repoRoot, resolveControllerHome(), { createTarget: false });
+  if (!locator) return normalize(readToolingReport(opts.repoRoot, opts.env, opts.host));
+  try {
+    return normalize(readToolingReport(opts.repoRoot, { ...opts.env, CODEGRAPH_DIR: locator.name }, opts.host));
+  } finally {
+    locator.release();
+  }
 }
 
 export function resolveCodegraph(opts: CodegraphResolveOptions): CodegraphResolution {
   return checkCodegraph(opts).resolution;
 }
 
+/** @deprecated Compatibility name retained for callers; no persistent repo symlink is created. */
+export function ensureCodegraphCacheCompatibilityLink(repoRoot: string, controllerHome = resolveControllerHome()): string {
+  return migrateLegacyCodegraphCache(repoRoot, controllerHome);
+}
+
 export function ensureCodegraph(opts: CodegraphEnsureOptions): CodegraphEnsureResult {
   const actions: CodegraphAction[] = [];
 
@@ -177,31 +190,37 @@ export function ensureCodegraph(opts: CodegraphEnsureOptions): CodegraphEnsureRe
     };
   }
 
-  let codegraph = readToolingReport(opts.repoRoot, opts.env, opts.host);
-  if (opts.installDeps !== false && hasCodegraphDependency(opts.repoRoot) && !codegraph.local_bin_path) {
-    appendAction(actions, "install-deps", ["bun", "install"], run("bun", ["install"], opts.repoRoot, opts.env));
-    codegraph = readToolingReport(opts.repoRoot, opts.env, opts.host);
-  }
+  const locator = createCodegraphCacheLocator(opts.repoRoot, resolveControllerHome(), { migrateLegacy: true, createTarget: true });
+  if (!locator) throw new Error('CODEGRAPH_LOCATOR_UNAVAILABLE');
+  const env = { ...opts.env, CODEGRAPH_DIR: locator.name };
+  try {
+    let codegraph = readToolingReport(opts.repoRoot, env, opts.host);
+    if (opts.installDeps !== false && hasCodegraphDependency(opts.repoRoot) && !codegraph.local_bin_path) {
+      appendAction(actions, "install-deps", ["bun", "install"], run("bun", ["install"], opts.repoRoot, env));
+      codegraph = readToolingReport(opts.repoRoot, env, opts.host);
+    }
 
-  const binPath = codegraph.bin_path;
-  if (binPath && opts.init && codegraph.project_index?.status === "not-initialized") {
-    appendAction(actions, "init-index", [binPath, "init", "-i", "."], run(binPath, ["init", "-i", "."], opts.repoRoot, opts.env));
-    codegraph = readToolingReport(opts.repoRoot, opts.env, opts.host);
-  }
+    const binPath = codegraph.bin_path;
+    if (binPath && opts.init && codegraph.project_index?.status === "not-initialized") {
+      appendAction(actions, "init-index", [binPath, "init", "-i", "."], run(binPath, ["init", "-i", "."], opts.repoRoot, env));
+      codegraph = readToolingReport(opts.repoRoot, env, opts.host);
+    }
 
-  if (binPath && opts.sync) {
-    mkdirSync(join(opts.repoRoot, ".codegraph"), { recursive: true });
-    appendAction(actions, "sync-index", [binPath, "sync", "."], run(binPath, ["sync", "."], opts.repoRoot, opts.env));
-    codegraph = readToolingReport(opts.repoRoot, opts.env, opts.host);
-  }
+    if (binPath && opts.sync) {
+      appendAction(actions, "sync-index", [binPath, "sync", "."], run(binPath, ["sync", "."], opts.repoRoot, env));
+      codegraph = readToolingReport(opts.repoRoot, env, opts.host);
+    }
 
-  const normalized = normalize(codegraph);
-  return {
-    ...normalized,
-    changed: actions.some((entry) => entry.status === "changed"),
-    readOnly: false,
-    actions,
-  };
+    const normalized = normalize(codegraph);
+    return {
+      ...normalized,
+      changed: actions.some((entry) => entry.status === "changed"),
+      readOnly: false,
+      actions,
+    };
+  } finally {
+    locator.release();
+  }
 }
 
 function configureTargets(target: CodegraphHostTarget): Array<"codex" | "claude"> {

package/src/core/adoption/manifest-templates.ts

@@ -1,7 +1,7 @@
 import { basename, resolve } from "path";
 import { loadWorkflowContractAsset } from "./workflow-contract-asset";
 
-export type AdoptionTemplateKey = "spec" | "currentStatus" | "deferredGoalLedger" | "lessonsLog";
+export type AdoptionTemplateKey = "spec" | "deferredGoalLedger" | "lessonsLog";
 
 export interface AdoptionTemplateFile {
   readonly path: string;

package/src/core/adoption/plan.ts

@@ -8,7 +8,6 @@ import { summarizeOperations } from "./summary";
 import { managedBlockNeedsUpdate } from "../../effects/managed-block";
 import { workflowContractInstallOperation } from "./workflow-contract-plan";
 import { adoptionTemplateFile } from "./manifest-templates";
-import { helperWrapperGitignoreContent, helperWrapperOperations } from "./helper-wrapper-plan";
 import { withRollbackMetadata } from "./rollback";
 
 export interface PlanAdoptionOptions {
@@ -18,33 +17,13 @@ export interface PlanAdoptionOptions {
 }
 
 const MINIMAL_DIRS = [
-  "plans",
-  "tasks",
-  "tasks/issues",
-  "tasks/contracts",
-  "tasks/reviews",
-  "tasks/notes",
   "docs",
-  ".ai/harness/checks",
-  ".ai/harness/session",
-  ".ai/harness/controller/packets",
-  ".ai/harness/projections",
-  ".ai/harness/transfers",
+  "tasks",
 ] as const;
 
 const STANDARD_EXTRA_DIRS = [
-  "plans/archive",
-  "plans/prds",
-  "plans/sprints",
-  "tasks/workstreams",
   "docs/reference-configs",
-  ".ai/context",
-  ".ai/harness/failures",
-  ".ai/harness/architecture",
-  ".ai/harness/runs",
-  ".ai/harness/worktrees",
-  ".ai/harness/jobs",
-  ".ai/harness/edit-sessions",
+  "docs/researches",
 ] as const;
 
 function directoryPaths(mode: AdoptionMode): readonly string[] {
@@ -64,7 +43,6 @@ function writeIfMissingOperations(repoRoot: string): AdoptionOperation[] {
   const files = [
     adoptionTemplateFile(repoRoot, "spec"),
     adoptionTemplateFile(repoRoot, "deferredGoalLedger"),
-    adoptionTemplateFile(repoRoot, "currentStatus"),
     adoptionTemplateFile(repoRoot, "lessonsLog"),
   ] as const;
 
@@ -123,11 +101,10 @@ export function planAdoption(opts: PlanAdoptionOptions): AdoptionPlan {
     })),
     ...writeIfMissingOperations(repoRoot),
     ...workflowContractOperations(repoRoot),
-    ...helperWrapperOperations(repoRoot, mode),
   ];
 
   const gitignorePath = resolve(repoRoot, ".gitignore");
-  const gitignoreExtraContent = helperWrapperGitignoreContent(repoRoot, mode);
+  const gitignoreExtraContent = "";
   const plannedGitignoreOperation = gitignoreManagedBlockOperation("planned", gitignoreExtraContent);
   const gitignoreOperation = gitignoreManagedBlockOperation(
     managedBlockNeedsUpdate(existsSync(gitignorePath) ? readFileSync(gitignorePath, "utf-8") : "", plannedGitignoreOperation)

package/src/core/adoption/workflow-contract-plan.ts

@@ -2,27 +2,35 @@ import { existsSync, readFileSync } from "fs";
 import { resolve } from "path";
 import type { WriteFileOperation } from "./operations";
 import { makeOperationId } from "./operations";
-import { readWorkflowContractAsset } from "./workflow-contract-asset";
 
-export const WORKFLOW_CONTRACT_RUNTIME_PATH = ".ai/harness/workflow-contract.json";
-const WORKFLOW_CONTRACT_OPERATION_ID = makeOperationId("writeFile", WORKFLOW_CONTRACT_RUNTIME_PATH, "workflow-contract");
+/**
+ * Repository opt-in is declarative source configuration. Runtime state belongs
+ * in Controller Home; the historical .ai/harness/workflow-contract.json path is
+ * migration input only.
+ */
+export const WORKFLOW_CONTRACT_RUNTIME_PATH = "forge.config.json";
+const WORKFLOW_CONTRACT_OPERATION_ID = makeOperationId("writeFile", WORKFLOW_CONTRACT_RUNTIME_PATH, "forge-project-config");
+const PROJECT_CONFIG = `${JSON.stringify({
+  schemaVersion: 1,
+  forge: { enabled: true },
+  runtimeState: "controller-home",
+}, null, 2)}\n`;
 
-function workflowContractStatus(repoRoot: string, content: string): WriteFileOperation["status"] {
+function projectConfigStatus(repoRoot: string): WriteFileOperation["status"] {
   const target = resolve(repoRoot, WORKFLOW_CONTRACT_RUNTIME_PATH);
   if (!existsSync(target)) return "planned";
-  return readFileSync(target, "utf-8") === content ? "skipped" : "planned";
+  return readFileSync(target, "utf-8") === PROJECT_CONFIG ? "skipped" : "planned";
 }
 
 export function workflowContractInstallOperation(repoRoot: string): WriteFileOperation {
-  const content = readWorkflowContractAsset();
   return {
     id: WORKFLOW_CONTRACT_OPERATION_ID,
     kind: "writeFile",
     path: WORKFLOW_CONTRACT_RUNTIME_PATH,
-    content,
-    reason: "Install canonical forge workflow contract manifest",
+    content: PROJECT_CONFIG,
+    reason: "Install the declarative Forge project marker; mutable Runtime state stays in Controller Home",
     risk: "low",
-    status: workflowContractStatus(repoRoot, content),
+    status: projectConfigStatus(repoRoot),
   };
 }
 

package/src/effects/process-runner.ts

@@ -1,6 +1,7 @@
 import { existsSync, statSync } from "fs";
 import { delimiter, extname, isAbsolute, join } from "path";
 import { spawnSync } from "child_process";
+import { redactSensitiveText } from "../runtime/evidence/sensitive-output";
 
 export interface ProcessOutputRedaction {
   readonly pattern: RegExp;
@@ -44,26 +45,19 @@ export const DEFAULT_PROCESS_TIMEOUT_MS = 120_000;
 export const DEFAULT_PROCESS_MAX_OUTPUT_BYTES = 64 * 1024;
 export const DEFAULT_PROCESS_MAX_BUFFER_BYTES = 1024 * 1024;
 
-const DEFAULT_REDACTIONS: readonly ProcessOutputRedaction[] = [
-  {
-    pattern: /(Bearer\s+)[A-Za-z0-9._~+/=-]+/gi,
-    replacement: "$1[redacted]",
-  },
-  {
-    pattern: /((?:api[_-]?key|token|secret|password|authorization)\s*[:=]\s*)(?:"[^"\s]+"|'[^'\s]+'|[^\s]+)/gi,
-    replacement: "$1[redacted]",
-  },
-];
-
 function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error ?? "");
 }
 
 export function redactProcessOutput(
   value: string,
-  redactions: readonly ProcessOutputRedaction[] = DEFAULT_REDACTIONS,
+  redactions: readonly ProcessOutputRedaction[] = [],
 ): string {
-  return redactions.reduce((current, redaction) => current.replace(redaction.pattern, redaction.replacement), value);
+  const customRedacted = redactions.reduce(
+    (current, redaction) => current.replace(redaction.pattern, redaction.replacement),
+    value,
+  );
+  return redactSensitiveText(customRedacted).text.replace(/\[REDACTED\]/g, '[redacted]');
 }
 
 export function capProcessOutput(value: string, maxBytes = DEFAULT_PROCESS_MAX_OUTPUT_BYTES): string {
@@ -157,7 +151,7 @@ export function prepareProcessInvocation(
 export function runProcess(command: string, args: readonly string[], opts: RunProcessOptions = {}): ProcessRunResult {
   const timeoutMs = opts.timeoutMs ?? DEFAULT_PROCESS_TIMEOUT_MS;
   const maxOutputBytes = opts.maxOutputBytes ?? DEFAULT_PROCESS_MAX_OUTPUT_BYTES;
-  const redactions = opts.redactions ?? DEFAULT_REDACTIONS;
+  const redactions = opts.redactions ?? [];
   const childEnv = opts.replaceEnv ? { ...(opts.env ?? {}) } : { ...process.env, ...(opts.env ?? {}) };
   const invocation = prepareProcessInvocation(command, args, childEnv, opts.platform ?? process.platform);
   const redactedCommand = [invocation.resolvedCommand, ...args].map((part) => redactProcessOutput(part, redactions));