@moretea-labs/forge 1.8.1 → 1.8.2

package/src/cli/repository/inspector.ts

@@ -1,11 +1,9 @@
 import { createHash } from 'crypto';
-import { execFile } from 'child_process';
 import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, statSync } from 'fs';
-import { lstat as lstatAsync, readFile as readFileAsync, readdir as readdirAsync, stat as statAsync } from 'fs/promises';
-import { join, resolve } from 'path';
+import { delimiter, join, resolve } from 'path';
 import { runProcess } from '../../effects/process-runner';
-import { globMatches, resolveMcpPath } from '../mcp/paths';
-import type { McpPolicy } from '../mcp/types';
+import { globMatches, resolveMcpPath } from '../../../adapters/mcp/paths';
+import type { McpPolicy } from '../../../adapters/mcp/types';
 import {
   collectSessionIdentity,
   getOrCreateSessionCache,
@@ -306,28 +304,6 @@ function gitSearchFileInventory(repoRoot: string): string[] | null {
   }
 }
 
-function gitSearchFileInventoryAsync(repoRoot: string): Promise<string[] | null> {
-  return new Promise((resolve) => {
-    execFile(
-      'git',
-      ['ls-files', '-z', '--cached', '--others', '--exclude-standard'],
-      {
-        cwd: repoRoot,
-        timeout: 10_000,
-        maxBuffer: SEARCH_GIT_INVENTORY_MAX_OUTPUT_BYTES,
-        encoding: 'utf8',
-      },
-      (error, stdout) => {
-        if (error || typeof stdout !== 'string') {
-          resolve(null);
-          return;
-        }
-        resolve(parseGitSearchFileInventory(stdout));
-      },
-    );
-  });
-}
-
 function binary(bytes: Buffer): boolean {
   return bytes.subarray(0, Math.min(bytes.length, 8000)).includes(0);
 }
@@ -352,36 +328,6 @@ function walk(repoRoot: string, root: string, maxFiles: number, excludes: string
   }
 }
 
-async function walkAsync(repoRoot: string, root: string, maxFiles: number, excludes: string[], output: string[]): Promise<void> {
-  if (output.length >= maxFiles) return;
-  const absolute = join(repoRoot, root);
-  let info;
-  try {
-    info = await lstatAsync(absolute);
-  } catch {
-    return;
-  }
-  if (info.isSymbolicLink()) return;
-  if (info.isFile()) {
-    output.push(root);
-    return;
-  }
-  if (!info.isDirectory()) return;
-  let entries;
-  try {
-    entries = await readdirAsync(absolute, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-    if (output.length >= maxFiles) break;
-    const child = root ? `${root}/${entry.name}` : entry.name;
-    if (isExcluded(child, excludes) || isExcluded(`${child}/`, excludes)) continue;
-    if (entry.isDirectory()) await walkAsync(repoRoot, child, maxFiles, excludes, output);
-    else if (entry.isFile()) output.push(child);
-  }
-}
-
 export interface SearchRepositoryOptions {
   query: string;
   includeGlobs?: string[];
@@ -499,7 +445,6 @@ function searchInventory(
   repoRoot: string,
   includes: string[],
   excludes: string[],
-  maxFiles: number,
   cacheKey?: string,
 ): { files: string[]; candidateCount: number; cacheHit: boolean } {
   const inventoryKey = JSON.stringify({ repoRoot, excludes, cacheKey });
@@ -519,36 +464,10 @@ function searchInventory(
       return files;
     })();
   const candidates = inventory.filter((path) => isIncluded(path, includes) && !isExcluded(path, excludes));
-  return { files: candidates.slice(0, maxFiles), candidateCount: candidates.length, cacheHit };
-}
-
-async function searchInventoryAsync(
-  repoRoot: string,
-  includes: string[],
-  excludes: string[],
-  maxFiles: number,
-  cacheKey?: string,
-): Promise<{ files: string[]; candidateCount: number; cacheHit: boolean }> {
-  const inventoryKey = JSON.stringify({ repoRoot, excludes, cacheKey });
-  const now = Date.now();
-  const cachedInventory = searchFileInventoryCache.get(inventoryKey);
-  const cacheHit = Boolean(cachedInventory && now - cachedInventory.createdAt < SEARCH_FILE_INVENTORY_CACHE_TTL_MS);
-  let inventory: string[];
-  if (cacheHit) {
-    inventory = cachedInventory!.files;
-  } else {
-    const gitFiles = await gitSearchFileInventoryAsync(repoRoot);
-    if (gitFiles) {
-      inventory = gitFiles;
-    } else {
-      const walked: string[] = [];
-      await walkAsync(repoRoot, '', 20_000, excludes, walked);
-      inventory = walked;
-    }
-    searchFileInventoryCache.set(inventoryKey, { createdAt: now, files: inventory });
-  }
-  const candidates = inventory.filter((path) => isIncluded(path, includes) && !isExcluded(path, excludes));
-  return { files: candidates.slice(0, maxFiles), candidateCount: candidates.length, cacheHit };
+  // A lexical hit beyond the first N alphabetic Git paths is not optional.
+  // The bounded rg matcher owns result limits; inventory must retain all
+  // eligible source paths rather than silently losing the rest of the repo.
+  return { files: candidates, candidateCount: candidates.length, cacheHit };
 }
 
 interface SearchManyMatchState {
@@ -607,29 +526,17 @@ function exactCodeNeedleMatches(haystack: string, needle: string): boolean {
   return new RegExp(`(?:^|[^\\p{L}\\p{N}_$])${escaped}(?=$|[^\\p{L}\\p{N}_$])`, 'u').test(haystack);
 }
 
-function matchSearchManySource(state: SearchManyMatchState, path: string, bytes: Buffer): void {
-  const raw = bytes.toString('utf-8');
-  const searchable = state.caseSensitive ? raw : raw.toLowerCase();
-  const activeNeedles = state.needles.filter(({ query, needle }) =>
-    (state.counts.get(query) ?? 0) < state.maxResultsPerQuery
-      && (state.requiredQueries.includes(query)
-        ? exactCodeNeedleMatches(searchable, needle)
-        : searchable.includes(needle)));
-  if (activeNeedles.length === 0) return;
-
-  const lines = raw.split(/\r?\n/);
-  for (let index = 0; index < lines.length; index += 1) {
-    const text = lines[index]!;
-    const haystack = state.caseSensitive ? text : text.toLowerCase();
-    for (const { query, needle } of activeNeedles) {
-      const matches = state.requiredQueries.includes(query)
-        ? exactCodeNeedleMatches(haystack, needle)
-        : haystack.includes(needle);
-      if ((state.counts.get(query) ?? 0) >= state.maxResultsPerQuery || !matches) continue;
-      state.results.push({ query, path, line: index + 1, text: text.slice(0, 500) });
-      state.matchedPaths.add(path);
-      state.counts.set(query, (state.counts.get(query) ?? 0) + 1);
-    }
+function matchSearchManyLine(state: SearchManyMatchState, path: string, line: number, text: string): void {
+  const haystack = state.caseSensitive ? text : text.toLowerCase();
+  for (const { query, needle } of state.needles) {
+    if ((state.counts.get(query) ?? 0) >= state.maxResultsPerQuery) continue;
+    const matches = state.requiredQueries.includes(query)
+      ? exactCodeNeedleMatches(haystack, needle)
+      : haystack.includes(needle);
+    if (!matches) continue;
+    state.results.push({ query, path, line, text: text.slice(0, 500) });
+    state.matchedPaths.add(path);
+    state.counts.set(query, (state.counts.get(query) ?? 0) + 1);
   }
 }
 
@@ -674,9 +581,89 @@ function finalizeSearchManyResult(input: {
 }
 
 /**
- * Internal Context Plane batch search. Every candidate file is policy-checked
- * and read at most once while all lexical terms are matched in the same pass.
- * The public search_repository tool remains the simpler single-query primitive.
+ * ripgrep owns literal matching and returns line-addressed evidence directly.
+ * The caller supplies only policy-checked paths; neither a repository-wide
+ * scan nor a second JavaScript file-content scan is permitted.
+ */
+function ripgrepCandidateLines(
+  repoRoot: string,
+  allowedPaths: readonly string[],
+  queries: readonly string[],
+  caseSensitive: boolean,
+  maxResultsPerQuery: number,
+  skippedBinaryPaths?: Set<string>,
+): Map<string, Array<{ line: number; text: string }>> {
+  const found = new Map<string, Array<{ line: number; text: string }>>();
+  const searchDeadline = Date.now() + 15_000;
+  for (let offset = 0; offset < allowedPaths.length; offset += 128) {
+    const paths = allowedPaths.slice(offset, offset + 128);
+    const remainingMs = searchDeadline - Date.now();
+    if (remainingMs <= 0) throw new Error('RIPGREP_SEARCH_TIMEOUT: source discovery exceeded 15s total budget');
+    const result = runProcess('rg', [
+      '--null', '--with-filename', '--line-number', '--no-heading', '--color', 'never', '--fixed-strings', '--no-ignore', '--no-config', '--no-messages',
+      '--max-count', String(Math.min(Math.max(maxResultsPerQuery, 32), 500)),
+      ...(caseSensitive ? [] : ['--ignore-case']),
+      ...queries.flatMap((query) => ['-e', query]),
+      '--', ...paths,
+    ], {
+      cwd: repoRoot,
+      // launchd/systemd often omit package-manager bins from PATH. A missing
+      // executable must never masquerade as rg exit 1 (no matches).
+      env: { PATH: [process.env.PATH, ...(process.platform === 'darwin' ? ['/opt/homebrew/bin', '/usr/local/bin'] : [])].filter(Boolean).join(delimiter) },
+      timeoutMs: Math.min(remainingMs, 5_000),
+      maxOutputBytes: 16 * 1024 * 1024,
+    });
+    if (result.error || (result.status !== 0 && result.status !== 1) || result.timedOut
+      || result.stdout.endsWith('\n[output truncated after 16777216 bytes]')) {
+      throw new Error('RIPGREP_SEARCH_FAILED: ' + (result.error || result.stderr || String(result.status)));
+    }
+    // NUL-framed paths survive the shared process redactor. JSON-lines did
+    // not: masking source text inside a JSON string invalidated its syntax.
+    let cursor = 0;
+    while (cursor < result.stdout.length) {
+      const filenameEnd = result.stdout.indexOf('\0', cursor);
+      const firstLineEnd = result.stdout.indexOf('\n', cursor);
+      // Ripgrep prints a plain-text "path: binary file matches" notice when
+      // a candidate contains NUL bytes. This notice has no NUL-framed path
+      // or line number; discard only notices naming an exact authorized path.
+      // One binary match must not invalidate unrelated valid source evidence.
+      if (firstLineEnd >= cursor && (filenameEnd < 0 || firstLineEnd < filenameEnd)) {
+        const notice = result.stdout.slice(cursor, firstLineEnd);
+        const marker = ': binary file matches';
+        const markerAt = notice.lastIndexOf(marker);
+        const binaryPath = markerAt > 0 ? notice.slice(0, markerAt) : '';
+        const suffix = markerAt >= 0 ? notice.slice(markerAt + marker.length) : '';
+        if (!paths.includes(binaryPath) || (suffix !== '' && !/^ \(found "\\0" byte around offset \d+\)$/.test(suffix))) {
+          throw new Error('RIPGREP_SEARCH_INVALID_OUTPUT: malformed NUL/line-framed match');
+        }
+        skippedBinaryPaths?.add(binaryPath);
+        cursor = firstLineEnd + 1;
+        continue;
+      }
+      const lineEnd = result.stdout.indexOf('\n', filenameEnd + 1);
+      const numberEnd = result.stdout.indexOf(':', filenameEnd + 1);
+      if (filenameEnd < cursor || lineEnd < 0 || numberEnd <= filenameEnd || numberEnd >= lineEnd) {
+        throw new Error('RIPGREP_SEARCH_INVALID_OUTPUT: malformed NUL/line-framed match');
+      }
+      const path = result.stdout.slice(cursor, filenameEnd);
+      const line = Number(result.stdout.slice(filenameEnd + 1, numberEnd));
+      if (!Number.isSafeInteger(line) || line <= 0) {
+        throw new Error('RIPGREP_SEARCH_INVALID_OUTPUT: malformed source line number');
+      }
+      const text = result.stdout.slice(numberEnd + 1, lineEnd).replace(/\r$/, '');
+      const lines = found.get(path) ?? [];
+      lines.push({ line, text });
+      found.set(path, lines);
+      cursor = lineEnd + 1;
+    }
+  }
+  for (const lines of found.values()) lines.sort((a, b) => a.line - b.line);
+  return found;
+}
+
+/**
+ * Internal Context Plane discovery: ripgrep selects matching authorized files,
+ * then bounded source materialization owns line-level evidence and ranking.
  */
 export function searchRepositoryMany(
   repoRoot: string,
@@ -704,13 +691,9 @@ export function searchRepositoryMany(
       return { ...(cached.result as SearchRepositoryManyResult), cacheHit: true };
     }
   }
-  const inventory = directCandidates && directCandidates.length > 0
-    ? {
-        files: directCandidates.slice(0, maxFiles),
-        candidateCount: directCandidates.length,
-        cacheHit: false,
-      }
-    : searchInventory(repoRoot, includes, excludes, maxFiles, opts.cacheKey);
+  const inventory = directCandidates !== undefined
+    ? { files: directCandidates.slice(0, maxFiles), candidateCount: directCandidates.length, cacheHit: false }
+    : searchInventory(repoRoot, includes, excludes, opts.cacheKey);
   const matchState = createSearchManyMatchState(
     queries,
     maxResultsPerQuery,
@@ -723,30 +706,74 @@ export function searchRepositoryMany(
   let scannedFiles = 0;
   let policyDeniedFiles = 0;
   let skippedLargeFiles = 0;
-  let skippedBinaryFiles = 0;
+  const skippedBinaryPaths = new Set<string>();
   const canonicalRepoRoot = realpathSync(repoRoot);
 
+  const authorizedCandidatePaths: string[] = [];
+  // No external search process may inspect a file before MCP read authorization.
   for (const path of inventory.files) {
-    if (searchManyComplete(matchState)) break;
     const decision = resolveMcpPath(repoRoot, path, policy, 'read', canonicalRepoRoot);
-    if (!decision.ok || !decision.absolutePath) {
-      policyDeniedFiles += 1;
-      continue;
-    }
+    if (!decision.ok || !decision.absolutePath) { policyDeniedFiles += 1; continue; }
     const info = statSync(decision.absolutePath);
     if (!info.isFile()) continue;
-    const size = info.size;
-    if (size > policy.maxFileBytes) {
-      skippedLargeFiles += 1;
-      continue;
-    }
-    const bytes = readFileSync(decision.absolutePath);
-    if (binary(bytes)) {
-      skippedBinaryFiles += 1;
-      continue;
+    if (info.size > policy.maxFileBytes) { skippedLargeFiles += 1; continue; }
+    authorizedCandidatePaths.push(path);
+  }
+  const exactHits = authorizedCandidatePaths.length && requiredQueries.length
+    ? ripgrepCandidateLines(repoRoot, authorizedCandidatePaths, requiredQueries, opts.caseSensitive === true, maxResultsPerQuery, skippedBinaryPaths)
+    : null;
+  const hasRequiredHit = (needle: string): boolean => exactHits !== null
+    && [...exactHits.values()].some((lines) => lines.some(({ text }) => exactCodeNeedleMatches(
+      opts.caseSensitive ? text : text.toLowerCase(),
+      opts.caseSensitive ? needle : needle.toLowerCase(),
+    )));
+  // A complete exact-symbol answer needs no broad recall-token pass. If an
+  // explicitly requested symbol is absent, fall back to ordinary discovery.
+  const hitsByPath = exactHits && requiredQueries.every(hasRequiredHit)
+    ? exactHits
+    : authorizedCandidatePaths.length
+      ? ripgrepCandidateLines(repoRoot, authorizedCandidatePaths, queries, opts.caseSensitive === true, maxResultsPerQuery, skippedBinaryPaths)
+      : new Map<string, Array<{ line: number; text: string }>>();
+  // Exact symbol needles must not lose to broad recall-token matches that
+  // occur in earlier alphabetic paths.
+  const exactHit = (path: string): boolean => requiredQueries.some((needle) =>
+    (hitsByPath.get(path) ?? []).some((hit) => exactCodeNeedleMatches(
+      opts.caseSensitive ? hit.text : hit.text.toLowerCase(),
+      opts.caseSensitive ? needle : needle.toLowerCase(),
+    )));
+  // Prefer the public source owner over same-named local wrappers. A bare
+  // declaration and an exported declaration are both exact hits, but they
+  // are not equally useful when only a few source files can be returned.
+  const declarationRankCache = new Map<string, number>();
+  const declarationRank = (path: string): number => {
+    const cached = declarationRankCache.get(path);
+    if (cached !== undefined) return cached;
+    let rank = 0;
+    for (const hit of hitsByPath.get(path) ?? []) {
+      const source = hit.text.trimStart();
+      const declared = /^(?:(?:export|declare|default|async)\s+)*(?:function|class|interface|type|const|let|enum)\s+([\w$]+)/.exec(source)?.[1];
+      if (declared === undefined || !requiredQueries.some((needle) =>
+        opts.caseSensitive ? declared === needle : declared.toLowerCase() === needle.toLowerCase())) continue;
+      rank = Math.max(rank, source.startsWith('export ') ? 2 : 1);
+      if (rank === 2) break;
     }
-    scannedFiles += 1;
-    matchSearchManySource(matchState, path, bytes);
+    declarationRankCache.set(path, rank);
+    return rank;
+  };
+  // Sorting only paths with evidence preserves the authorized inventory order
+  // while avoiding comparisons across thousands of guaranteed no-hit files.
+  const pathsWithHits = authorizedCandidatePaths.filter((path) => hitsByPath.has(path));
+  const orderedPaths = requiredQueries.length
+    ? pathsWithHits.sort((left, right) =>
+        declarationRank(right) - declarationRank(left)
+        || Number(exactHit(right)) - Number(exactHit(left)))
+    : pathsWithHits;
+  for (const path of orderedPaths) {
+    if (searchManyComplete(matchState) || matchState.matchedPaths.size >= maxFiles) break;
+    const hits = hitsByPath.get(path);
+    if (!hits) continue;
+    for (const hit of hits) matchSearchManyLine(matchState, path, hit.line, hit.text);
+    if (matchState.matchedPaths.has(path)) scannedFiles += 1;
   }
 
   // Consumers may bound distinct candidate files after this call. Preserve the
@@ -757,7 +784,7 @@ export function searchRepositoryMany(
     scannedFiles,
     policyDeniedFiles,
     skippedLargeFiles,
-    skippedBinaryFiles,
+    skippedBinaryFiles: skippedBinaryPaths.size,
     candidateCount: inventory.candidateCount,
     inventoryFileCount: inventory.files.length,
     inventoryCacheHit: inventory.cacheHit,
@@ -773,138 +800,20 @@ export function searchRepositoryMany(
   return payload;
 }
 
-// File reads are already bounded by policy/maxFiles. A wider batch keeps broad
-// Context scans from serializing dozens of filesystem waves while still
-// preserving original-order matching and early-stop semantics below.
-const ASYNC_SEARCH_READ_BATCH_SIZE = 64;
-
-type AsyncSearchCandidate =
-  | { path: string; kind: 'denied' }
-  | { path: string; kind: 'large' }
-  | { path: string; kind: 'binary' }
-  | { path: string; kind: 'nonfile' }
-  | { path: string; kind: 'source'; bytes: Buffer }
-  | { path: string; kind: 'error'; error: unknown };
-
-async function readSearchCandidateAsync(
-  repoRoot: string,
-  policy: McpPolicy,
-  canonicalRepoRoot: string,
-  path: string,
-): Promise<AsyncSearchCandidate> {
-  try {
-    const decision = resolveMcpPath(repoRoot, path, policy, 'read', canonicalRepoRoot);
-    if (!decision.ok || !decision.absolutePath) return { path, kind: 'denied' };
-    const info = await statAsync(decision.absolutePath);
-    if (!info.isFile()) return { path, kind: 'nonfile' };
-    const size = info.size;
-    if (size > policy.maxFileBytes) return { path, kind: 'large' };
-    const bytes = await readFileAsync(decision.absolutePath);
-    if (binary(bytes)) return { path, kind: 'binary' };
-    return { path, kind: 'source', bytes };
-  } catch (error) {
-    return { path, kind: 'error', error };
-  }
-}
-
 /**
- * Async Context Plane batch search with result semantics matching
- * searchRepositoryMany. Candidate reads happen in bounded batches, while policy
- * accounting, early-stop behavior, matching, and result ordering are consumed in
- * original repository order on the caller thread.
+ * Async Context Pack uses the same canonical ripgrep-backed search implementation.
+ * A second filesystem scanning implementation would diverge in policy, matching
+ * and ranking; this short-lived sidecar does not own a separate search engine.
  */
 export async function searchRepositoryManyAsync(
   repoRoot: string,
   policy: McpPolicy,
   opts: SearchRepositoryManyOptions,
 ): Promise<SearchRepositoryManyResult> {
-  const {
-    queries,
-    maxResultsPerQuery,
-    maxFiles,
-    includes,
-    excludes,
-    directCandidates,
-    completionMode,
-    discoveryTargetFiles,
-    discoveryMinQueryCoverage,
-    requiredQueries,
-    includeKey,
-    batchQueryKey,
-  } = searchRepositoryManyCacheIdentity(opts);
-  const sessionCache = bindSessionCache(repoRoot, opts.session);
-  if (sessionCache) {
-    const cached = sessionCache.getSearch(batchQueryKey, includeKey);
-    if (cached?.result && typeof cached.result === 'object') {
-      return { ...(cached.result as SearchRepositoryManyResult), cacheHit: true };
-    }
-  }
-  const inventory = directCandidates && directCandidates.length > 0
-    ? {
-        files: directCandidates.slice(0, maxFiles),
-        candidateCount: directCandidates.length,
-        cacheHit: false,
-      }
-    : await searchInventoryAsync(repoRoot, includes, excludes, maxFiles, opts.cacheKey);
-  const matchState = createSearchManyMatchState(
-    queries,
-    maxResultsPerQuery,
-    completionMode,
-    discoveryTargetFiles,
-    discoveryMinQueryCoverage,
-    requiredQueries,
-    opts.caseSensitive === true,
-  );
-  let scannedFiles = 0;
-  let policyDeniedFiles = 0;
-  let skippedLargeFiles = 0;
-  let skippedBinaryFiles = 0;
-  const canonicalRepoRoot = realpathSync(repoRoot);
-  for (let offset = 0; offset < inventory.files.length && !searchManyComplete(matchState); offset += ASYNC_SEARCH_READ_BATCH_SIZE) {
-    const batchPaths = inventory.files.slice(offset, offset + ASYNC_SEARCH_READ_BATCH_SIZE);
-    const batch = await Promise.all(batchPaths.map((path) => readSearchCandidateAsync(repoRoot, policy, canonicalRepoRoot, path)));
-    for (const candidate of batch) {
-      if (searchManyComplete(matchState)) break;
-      if (candidate.kind === 'denied') {
-        policyDeniedFiles += 1;
-        continue;
-      }
-      if (candidate.kind === 'large') {
-        skippedLargeFiles += 1;
-        continue;
-      }
-      if (candidate.kind === 'binary') {
-        skippedBinaryFiles += 1;
-        continue;
-      }
-      if (candidate.kind === 'nonfile') continue;
-      if (candidate.kind === 'error') throw candidate.error;
-      scannedFiles += 1;
-      matchSearchManySource(matchState, candidate.path, candidate.bytes);
-    }
-  }
-
-  const payload = finalizeSearchManyResult({
-    state: matchState,
-    scannedFiles,
-    policyDeniedFiles,
-    skippedLargeFiles,
-    skippedBinaryFiles,
-    candidateCount: inventory.candidateCount,
-    inventoryFileCount: inventory.files.length,
-    inventoryCacheHit: inventory.cacheHit,
-  });
-  if (sessionCache) {
-    sessionCache.putSearch({
-      query: batchQueryKey,
-      includeKey,
-      result: payload,
-      scannedFiles,
-    });
-  }
-  return payload;
+  return searchRepositoryMany(repoRoot, policy, opts);
 }
 
+/** Single-query facade delegates to the canonical policy-checked rg engine. */
 export function searchRepository(repoRoot: string, policy: McpPolicy, opts: SearchRepositoryOptions & {
   session?: RepositoryReadSession;
 }): {
@@ -915,92 +824,25 @@ export function searchRepository(repoRoot: string, policy: McpPolicy, opts: Sear
   skippedLargeFiles: number;
   skippedBinaryFiles: number;
   truncated: boolean;
-  truncationReason?: "max_results" | "max_files";
+  truncationReason?: 'max_results' | 'max_files';
   cacheHit?: boolean;
 } {
-  const query = opts.query;
-  if (!query.trim()) throw new Error('search query is required');
-  const maxResults = Math.min(Math.max(opts.maxResults ?? 100, 1), 500);
-  const maxFiles = Math.min(Math.max(opts.maxFiles ?? 5000, 1), 20_000);
-  const includes = opts.includeGlobs ?? [];
-  // Explicit include globs opt into a targeted scan; MCP read policy remains the single authority.
-  const excludes = [...(includes.length === 0 ? DEFAULT_EXCLUDES : []), ...(opts.excludeGlobs ?? [])];
-  const includeKey = JSON.stringify({
-    includes,
-    excludes,
-    maxResults,
-    maxFiles,
-    caseSensitive: opts.caseSensitive === true,
+  const results = searchRepositoryMany(repoRoot, policy, {
+    queries: [opts.query],
+    includeGlobs: opts.includeGlobs,
+    excludeGlobs: opts.excludeGlobs,
+    maxResultsPerQuery: opts.maxResults,
+    maxFiles: opts.maxFiles,
+    caseSensitive: opts.caseSensitive,
     cacheKey: opts.cacheKey,
+    session: opts.session,
   });
-  const sessionCache = bindSessionCache(repoRoot, opts.session);
-  if (sessionCache) {
-    const cached = sessionCache.getSearch(query, includeKey);
-    if (cached && cached.result && typeof cached.result === 'object') {
-      return { ...(cached.result as ReturnType<typeof searchRepository>), cacheHit: true };
-    }
-  }
-  const inventory = searchInventory(repoRoot, includes, excludes, maxFiles, opts.cacheKey);
-  const files = inventory.files;
-  const needle = opts.caseSensitive ? query : query.toLowerCase();
-  const results: Array<{ path: string; line: number; text: string }> = [];
-  let scannedFiles = 0;
-  let policyDeniedFiles = 0;
-  let skippedLargeFiles = 0;
-  let skippedBinaryFiles = 0;
-  for (const path of files) {
-    if (results.length >= maxResults) break;
-    if (!isIncluded(path, includes) || isExcluded(path, excludes)) continue;
-    const decision = resolveMcpPath(repoRoot, path, policy, 'read');
-    if (!decision.ok || !decision.absolutePath) {
-      policyDeniedFiles += 1;
-      continue;
-    }
-    const info = statSync(decision.absolutePath);
-    if (!info.isFile()) continue;
-    const size = info.size;
-    if (size > policy.maxFileBytes) {
-      skippedLargeFiles += 1;
-      continue;
-    }
-    const bytes = readFileSync(decision.absolutePath);
-    if (binary(bytes)) {
-      skippedBinaryFiles += 1;
-      continue;
-    }
-    scannedFiles += 1;
-    const raw = bytes.toString('utf-8');
-    const lines = raw.split(/\r?\n/);
-    for (let index = 0; index < lines.length && results.length < maxResults; index += 1) {
-      const haystack = opts.caseSensitive ? lines[index] : lines[index].toLowerCase();
-      if (haystack.includes(needle)) results.push({ path, line: index + 1, text: lines[index].slice(0, 500) });
-    }
-  }
-  const truncationReason = results.length >= maxResults
-    ? 'max_results' as const
-    : inventory.candidateCount > files.length
-      ? 'max_files' as const
-      : undefined;
-  const payload = {
-    query,
-    results,
-    scannedFiles,
-    policyDeniedFiles,
-    skippedLargeFiles,
-    skippedBinaryFiles,
-    truncated: Boolean(truncationReason),
-    truncationReason,
-    cacheHit: inventory.cacheHit,
+  return {
+    ...results,
+    query: opts.query,
+    results: results.results.map(({ path, line, text }) => ({ path, line, text })),
+    truncationReason: results.truncationReason === 'discovery_budget' ? undefined : results.truncationReason,
   };
-  if (sessionCache) {
-    sessionCache.putSearch({
-      query,
-      includeKey,
-      result: payload,
-      scannedFiles,
-    });
-  }
-  return payload;
 }
 
 export function clearSearchFileInventoryCacheForTest(): void {

package/src/effects/process-runner.ts

@@ -1,7 +1,7 @@
 import { existsSync, statSync } from "fs";
 import { delimiter, extname, isAbsolute, join } from "path";
 import { spawnSync } from "child_process";
-import { redactSensitiveText } from "../runtime/evidence/sensitive-output";
+import { redactSensitiveText, redactSensitiveValue } from "../runtime/evidence/sensitive-output";
 
 export interface ProcessOutputRedaction {
   readonly pattern: RegExp;
@@ -53,6 +53,22 @@ export function redactProcessOutput(
   value: string,
   redactions: readonly ProcessOutputRedaction[] = [],
 ): string {
+  // CLI JSON is a structured protocol, not free-form log text. Regex redaction
+  // can replace an array/object value with a bare [REDACTED] marker, destroying
+  // the JSON and causing an otherwise successful CoreDevice action to fail.
+  // Redact parsed values first, then reserialize so secrets stay hidden and
+  // downstream machine-readable contracts remain valid.
+  if (redactions.length === 0) {
+    try {
+      const parsed = JSON.parse(value);
+      if (parsed !== null && typeof parsed === "object") {
+        const structured = redactSensitiveValue(parsed);
+        if (structured.changed) return JSON.stringify(structured.value);
+      }
+    } catch {
+      // Ordinary command output is text, not necessarily JSON.
+    }
+  }
   const customRedacted = redactions.reduce(
     (current, redaction) => current.replace(redaction.pattern, redaction.replacement),
     value,

package/src/runtime/context/generic-lsp-provider.ts

@@ -266,7 +266,7 @@ export class GenericLspSemanticProvider implements SemanticNavigationProvider {
       return requests.map(() => ({
         ok: false,
         code: 'LSP_SEMANTIC_READ_SCOPE_UNSUPPORTED',
-        message: `External ${this.descriptor.id} navigation is restricted to the controller read profile; use lexical/CodeGraph evidence under narrower read policies.`,
+        message: `External ${this.descriptor.id} navigation is restricted to the controller read profile; use bounded lexical/raw source evidence under narrower read policies.`,
       }));
     }
     const outcomes: Array<SemanticNavigationOutcome | undefined> = new Array(requests.length);