jobLogRedactor property
At-rest redaction merged into every job start (issue #1408 AC2) —
typically RedactionPipeline.redact. Secret-shaped output becomes
[REDACTED:<kind>] markers in the log FILE; null keeps raw bytes
(hosts that run no pipeline). A caller's per-call
ShellExecOptions.jobLogRedactor wins over this session default.
Implementation
final String Function(String text)? jobLogRedactor;