@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/discovery/helpers.ts

@@ -202,14 +202,24 @@ export function getProjectPath(ctx: LoadContext, source: SourceId, subpath: stri
 }
 
 /** Build the filesystem authority for a provider read. */
-export function getReadOptions(
-	ctx: Pick<
-		LoadContext,
-		"home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity" | "bypassCache"
-	>,
-	scope: ReadScope,
-): ReadFileOptions | undefined {
-	if (!ctx.isolatedHome) return ctx.bypassCache ? { bypassCache: true } : undefined;
+type DiscoveryReadContext = Pick<
+	LoadContext,
+	"home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity" | "bypassCache"
+> & {
+	repoRoot?: string | null;
+	cwd?: string;
+};
+
+export function getReadOptions(ctx: DiscoveryReadContext, scope: ReadScope): ReadFileOptions | undefined {
+	if (!ctx.isolatedHome) {
+		const boundary = scope === "project" ? (ctx.repoRoot ?? ctx.cwd) : undefined;
+		if (!boundary) return ctx.bypassCache ? { bypassCache: true } : undefined;
+		return {
+			...(ctx.bypassCache ? { bypassCache: true as const } : {}),
+			containmentRoot: boundary,
+			scope,
+		};
+	}
 	return {
 		isolatedHome: true,
 		home: ctx.home,
@@ -222,15 +232,14 @@ export function getReadOptions(
 }
 
 export async function getReadOptionsForContainment(
-	ctx: Pick<
-		LoadContext,
-		"home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity" | "bypassCache"
-	>,
+	ctx: DiscoveryReadContext,
 	scope: ReadScope,
 	containmentRoot?: string,
 ): Promise<ReadFileOptions | undefined> {
 	const options = getReadOptions(ctx, scope);
-	if (!options || !containmentRoot) return options;
+	// Ordinary reads keep the repository boundary from getReadOptions. The extra
+	// root is an isolated-home constraint and was not applied on this path before.
+	if (!ctx.isolatedHome || !options || !containmentRoot) return options;
 	const containmentRootIdentity = await capturePathIdentity(containmentRoot);
 	if (!containmentRootIdentity) return undefined;
 	return { ...options, containmentRoot, containmentRootIdentity };
@@ -298,7 +307,7 @@ export function buildRuleFromMarkdown(
 	},
 ): Rule {
 	const { frontmatter, body } = parseFrontmatter(content, { source: filePath });
-	const { condition, scope } = parseRuleConditionAndScope(frontmatter as RuleFrontmatter);
+	const { condition, astCondition, scope } = parseRuleConditionAndScope(frontmatter as RuleFrontmatter);
 
 	let globs: string[] | undefined;
 	if (Array.isArray(frontmatter.globs)) {
@@ -329,6 +338,7 @@ export function buildRuleFromMarkdown(
 		alwaysApply: frontmatter.alwaysApply === true,
 		description: typeof frontmatter.description === "string" ? frontmatter.description : undefined,
 		condition,
+		astCondition,
 		scope,
 		interruptMode,
 		repeatMode,

package/src/edit/index.ts

@@ -3,9 +3,12 @@ import { prompt } from "@gajae-code/utils";
 import type * as z from "zod/v4";
 import {
 	executeHashlineSingle,
+	type HashlineEdit,
 	HashlineMismatchError,
 	type HashlineParams,
 	hashlineEditParamsSchema,
+	parseHashline,
+	splitHashlineInputs,
 } from "../hashline";
 import hashlineGrammarTemplate from "../hashline/grammar.lark" with { type: "text" };
 import { resolveHashlineGrammarPlaceholders } from "../hashline/hash";
@@ -21,12 +24,27 @@ import hashlineDescription from "../prompts/tools/hashline.md" with { type: "tex
 import patchDescription from "../prompts/tools/patch.md" with { type: "text" };
 import replaceDescription from "../prompts/tools/replace.md" with { type: "text" };
 import type { ToolSession } from "../tools";
+import { assertEditableFile } from "../tools/auto-generated-guard";
+import { resolvePlanPath } from "../tools/plan-mode-guard";
 import { VimTool, vimSchema } from "../tools/vim";
 import { type EditMode, resolveEditMode, resolveForcedEnvEditMode } from "../utils/edit-mode";
 import type { VimToolDetails } from "../vim/types";
-import { type ApplyPatchParams, applyPatchSchema, expandApplyPatchToEntries } from "./modes/apply-patch";
+import { normalizeCreateContent } from "./diff";
+import {
+	type ApplyPatchEntry,
+	type ApplyPatchParams,
+	applyPatchSchema,
+	expandApplyPatchToEntries,
+	expandApplyPatchToPreviewEntries,
+} from "./modes/apply-patch";
 import applyPatchGrammar from "./modes/apply-patch.lark" with { type: "text" };
-import { executePatchSingle, type PatchEditEntry, type PatchParams, patchEditSchema } from "./modes/patch";
+import {
+	executePatchSingle,
+	type PatchEditEntry,
+	type PatchParams,
+	patchEditEntrySchema,
+	patchEditSchema,
+} from "./modes/patch";
 import { executeReplaceEntries, type ReplaceEditEntry, type ReplaceParams, replaceEditSchema } from "./modes/replace";
 import { type EditToolDetails, type EditToolPerFileResult, getLspBatchRequest, type LspBatchRequest } from "./renderer";
 
@@ -57,6 +75,12 @@ type VimParams = z.infer<typeof vimSchema>;
 type EditParams = ReplaceParams | PatchParams | HashlineParams | VimParams | ApplyPatchParams;
 type EditToolResultDetails = EditToolDetails | VimToolDetails;
 
+/** Diff bodies introduce only `+` rows, not unified-diff file headers. */
+function addedPatchDigest(diff: string): string | undefined {
+	const added = diff.split("\n").filter(line => line.startsWith("+") && !line.startsWith("+++ "));
+	return added.length > 0 ? added.map(line => line.slice(1)).join("\n") : undefined;
+}
+
 const UNSAFE_EDIT_SUMMARY_PATH =
 	/(?:\b(?:https?|wss?):\/\/|\b(?:api[-_ ]?key|access[-_ ]?token|bearer|secret|password)\b|\b(?:sk|pk|rk)-[A-Za-z0-9_-]{12,})/i;
 
@@ -167,6 +191,56 @@ function createEditWritethrough(session: ToolSession): WritethroughCallback {
 	return enableLsp ? createLspWritethrough(session.cwd, { enableFormat, enableDiagnostics }) : writethroughNoop;
 }
 
+type PatchGuardFailure = { path: string; errorText: string };
+
+/**
+ * Refuse a generated source or rename destination before any entry writes.
+ * A single entry still throws. Several entries return the per-entry errors
+ * the patch aggregators already use, and the caller writes nothing.
+ */
+async function collectPatchGuardFailures(
+	session: ToolSession,
+	entries: { path: string; rename?: string }[],
+	signal?: AbortSignal,
+): Promise<PatchGuardFailure[] | undefined> {
+	const failures: PatchGuardFailure[] = [];
+	const aggregate = entries.length > 1;
+	for (const entry of entries) {
+		signal?.throwIfAborted();
+		try {
+			const resolvedPath = resolvePlanPath(session, entry.path);
+			await assertEditableFile(resolvedPath, entry.path, session.settings);
+			signal?.throwIfAborted();
+			if (!entry.rename) continue;
+			const resolvedRename = resolvePlanPath(session, entry.rename);
+			if (resolvedRename === resolvedPath) continue;
+			await assertEditableFile(resolvedRename, entry.rename, session.settings);
+			signal?.throwIfAborted();
+		} catch (err) {
+			signal?.throwIfAborted();
+			if (!aggregate || (err instanceof Error && err.name === "AbortError")) throw err;
+			failures.push({ path: entry.path, errorText: err instanceof Error ? err.message : String(err) });
+		}
+	}
+	return failures.length > 0 ? failures : undefined;
+}
+
+function refusedPatchEntriesResult(
+	failures: PatchGuardFailure[],
+	details: { path?: string; perFileResults?: EditToolPerFileResult[] },
+): AgentToolResult<EditToolDetails, TInput> {
+	return {
+		content: [
+			{
+				type: "text",
+				text: failures.map(failure => `Error editing ${failure.path}: ${failure.errorText}`).join("\n"),
+			},
+		],
+		details: { diff: "", ...details },
+		isError: true,
+	};
+}
+
 /** Run apply_patch file operations and aggregate their multi-file result. */
 async function executeApplyPatchPerFile(
 	fileEntries: {
@@ -364,6 +438,96 @@ export class EditTool implements AgentTool<TInput> {
 		return this.#getModeDefinition().parameters;
 	}
 
+	matcherDigest(args: unknown): string | undefined {
+		const digest = this.matcherEntries(args)
+			?.map(entry => entry.digest)
+			.filter(Boolean)
+			.join("\n");
+		return digest || undefined;
+	}
+
+	matcherEntries(args: unknown): readonly { path: string; digest: string }[] | undefined {
+		try {
+			if (!args || typeof args !== "object" || Array.isArray(args)) return undefined;
+			const record = args as Record<string, unknown>;
+			const digests = new Map<string, string>();
+			const add = (path: string, digest: string | undefined) => {
+				if (!path || digest === undefined) return;
+				const current = digests.get(path);
+				digests.set(path, current === undefined ? digest : `${current}\n${digest}`);
+			};
+
+			switch (this.mode) {
+				case "replace": {
+					if (typeof record.path !== "string" || !Array.isArray(record.edits)) return undefined;
+					for (const entry of record.edits) {
+						if (!entry || typeof entry !== "object" || Array.isArray(entry)) return undefined;
+						const text = (entry as Record<string, unknown>).new_text;
+						if (text !== undefined && typeof text !== "string") return undefined;
+						add(record.path, text);
+					}
+					break;
+				}
+				case "patch": {
+					if (typeof record.path !== "string" || !Array.isArray(record.edits)) return undefined;
+					for (const entry of record.edits) {
+						const parsed = patchEditEntrySchema.safeParse(entry);
+						if (!parsed.success) return undefined;
+						const { diff, op, rename } = parsed.data;
+						if (op === "delete" || diff === undefined) continue;
+						// A create body is digested exactly as the writer will persist it.
+						add(rename ?? record.path, op === "create" ? normalizeCreateContent(diff) : addedPatchDigest(diff));
+					}
+					break;
+				}
+				case "hashline": {
+					const parsed = hashlineEditParamsSchema.safeParse(args);
+					if (!parsed.success) return undefined;
+					for (const section of splitHashlineInputs(parsed.data.input, {
+						path: parsed.data.path,
+						cwd: this.session.cwd,
+					})) {
+						// A section still streaming (e.g. a trailing op with no anchor yet)
+						// does not parse; it contributes nothing, but earlier complete
+						// sections keep their entries (as pi-edit's hashline inspect does).
+						let edits: HashlineEdit[];
+						try {
+							edits = parseHashline(section.diff);
+						} catch {
+							continue;
+						}
+						const inserted = edits.filter(edit => edit.kind === "insert");
+						if (inserted.length > 0) add(section.path, inserted.map(edit => edit.text).join("\n"));
+					}
+					break;
+				}
+				case "apply_patch": {
+					const parsed = applyPatchSchema.safeParse(args);
+					if (!parsed.success) return undefined;
+					let entries: ApplyPatchEntry[];
+					try {
+						entries = expandApplyPatchToEntries(parsed.data);
+					} catch {
+						entries = expandApplyPatchToPreviewEntries(parsed.data);
+					}
+					for (const entry of entries) {
+						if (entry.op === "delete" || entry.diff === undefined) continue;
+						// The envelope parser already strips Add File prefixes.
+						add(entry.rename ?? entry.path, entry.op === "create" ? entry.diff : addedPatchDigest(entry.diff));
+					}
+					break;
+				}
+				case "vim":
+					return undefined;
+			}
+
+			return digests.size > 0 ? Array.from(digests, ([path, digest]) => ({ path, digest })) : undefined;
+		} catch {
+			// Streamed arguments can be incomplete or malformed in any mode.
+			return undefined;
+		}
+	}
+
 	/**
 	 * When in `apply_patch` mode, expose the OpenAI code backend Lark grammar so providers
 	 * that support OpenAI-style custom tools can emit a grammar-constrained
@@ -403,7 +567,7 @@ export class EditTool implements AgentTool<TInput> {
 			patch: {
 				description: () => prompt.render(patchDescription),
 				parameters: patchEditSchema,
-				execute: (
+				execute: async (
 					tool: EditTool,
 					params: EditParams,
 					signal: AbortSignal | undefined,
@@ -411,7 +575,14 @@ export class EditTool implements AgentTool<TInput> {
 					onUpdate?: (partialResult: AgentToolResult<EditToolDetails, TInput>) => void,
 				) => {
 					const { edits, path } = params as PatchParams;
-					const runs = (edits as PatchEditEntry[]).map(
+					const patchEdits = edits as PatchEditEntry[];
+					const guardFailures = await collectPatchGuardFailures(
+						tool.session,
+						patchEdits.map(entry => ({ path, rename: entry.rename })),
+						signal,
+					);
+					if (guardFailures) return refusedPatchEntriesResult(guardFailures, { path });
+					const runs = patchEdits.map(
 						entry => (br: LspBatchRequest | undefined) =>
 							executePatchSingle({
 								session: tool.session,
@@ -431,7 +602,7 @@ export class EditTool implements AgentTool<TInput> {
 			apply_patch: {
 				description: () => prompt.render(applyPatchDescription),
 				parameters: applyPatchSchema,
-				execute: (
+				execute: async (
 					tool: EditTool,
 					params: EditParams,
 					signal: AbortSignal | undefined,
@@ -439,6 +610,21 @@ export class EditTool implements AgentTool<TInput> {
 					onUpdate?: (partialResult: AgentToolResult<EditToolDetails, TInput>) => void,
 				) => {
 					const entries = expandApplyPatchToEntries(params as ApplyPatchParams);
+					const guardFailures = await collectPatchGuardFailures(
+						tool.session,
+						entries.map(entry => ({ path: entry.path, rename: entry.rename })),
+						signal,
+					);
+					if (guardFailures) {
+						return refusedPatchEntriesResult(guardFailures, {
+							perFileResults: guardFailures.map(failure => ({
+								path: failure.path,
+								diff: "",
+								isError: true,
+								errorText: failure.errorText,
+							})),
+						});
+					}
 					const perFile = entries.map(entry => {
 						const { path, ...patchParams } = entry;
 						return {

package/src/edit/modes/patch.ts

@@ -11,6 +11,7 @@ import * as path from "node:path";
 import type { AgentToolResult } from "@gajae-code/agent-core";
 import { isEnoent } from "@gajae-code/utils";
 import * as z from "zod/v4";
+import type { Settings } from "../../config/settings";
 import {
 	type FileDiagnosticsResult,
 	flushLspWritethroughBatch,
@@ -84,6 +85,14 @@ export interface ApplyPatchOptions {
 	/** Explicit artifacts `local` root for this call. The caller session owns it. */
 	localRoot?: string;
 	signal?: AbortSignal;
+	/**
+	 * Recheck a rename destination while this call holds the path mutation lock.
+	 * The request preflight runs before that lock.
+	 */
+	destinationGuard?: {
+		settings: Pick<Settings, "get">;
+		displayPath: string;
+	};
 }
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -444,6 +453,13 @@ async function applyNormalizedPatch(input: PatchInput, options: ApplyPatchOption
 			throw new ApplyPatchError(`concurrent edit conflict: file changed since read: ${input.path}`);
 		}
 		if (isMove) {
+			// Preflight can pass, then another writer holding this lock can
+			// turn a handwritten destination into a generated file.
+			if (options.destinationGuard) {
+				signal?.throwIfAborted();
+				await assertEditableFile(destPath, options.destinationGuard.displayPath, options.destinationGuard.settings);
+				signal?.throwIfAborted();
+			}
 			if (moveParent) {
 				signal?.throwIfAborted();
 				await fs.mkdir(moveParent);
@@ -643,7 +659,15 @@ export async function executePatchSingle(
 	const resolvedPath = resolvePlanPath(session, path);
 	const resolvedRename = rename ? resolvePlanPath(session, rename) : undefined;
 
+	signal?.throwIfAborted();
 	await assertEditableFile(resolvedPath, path, session.settings);
+	// The rename destination is the path that is written. The source call above
+	// already uses this helper, including generated names that do not exist yet.
+	signal?.throwIfAborted();
+	if (resolvedRename && rename && resolvedRename !== resolvedPath) {
+		await assertEditableFile(resolvedRename, rename, session.settings);
+		signal?.throwIfAborted();
+	}
 
 	// Capture pre-edit content so we can verify the write actually hit disk.
 	// `LspFileSystem.writeFile` delegates to a writethrough callback that, in
@@ -678,6 +702,9 @@ export async function executePatchSingle(
 		crossProcessLock: true,
 		localRoot,
 		signal,
+		...(op === "update" && resolvedRename && rename && resolvedRename !== resolvedPath
+			? { destinationGuard: { settings: session.settings, displayPath: rename } }
+			: {}),
 	});
 
 	// Post-write verification: only meaningful for in-place updates where the

package/src/eval/py/runtime.ts

@@ -7,8 +7,9 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { $env, $which, getPythonEnvDir, WhichCachePolicy } from "@gajae-code/utils";
+import { $env, $which, getPythonEnvDir, relativePathEscapesRoot, WhichCachePolicy } from "@gajae-code/utils";
 import { withFileLock } from "../../config/file-lock";
+import { isProjectControlledPath } from "../../lsp/path-trust";
 
 export const RLM_MANAGED_PYTHON_PACKAGES: readonly string[] = ["numpy", "pandas", "matplotlib", "polars"];
 
@@ -133,6 +134,47 @@ function resolvePythonCandidateInVenv(venvPath: string): { venvPath: string; pyt
 	return { venvPath, pythonPath, binDir };
 }
 
+/**
+ * A workspace `.venv` or `venv` directory is repository content. Use it only when
+ * it is a real virtualenv (`pyvenv.cfg`) whose interpreter file resolves outside
+ * the project. An in-tree script or binary is not an interpreter.
+ *
+ * True when `candidate` is `root` or a descendant after `path.resolve`.
+ * A name such as `..payload` stays inside. Only `..` and a parent segment escape.
+ */
+export function workspacePathContained(root: string, candidate: string): boolean {
+	const normalize = (value: string): string => {
+		const resolved = path.resolve(value);
+		return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+	};
+	return !relativePathEscapesRoot(path.relative(normalize(root), normalize(candidate)));
+}
+
+function isAutoDetectedWorkspaceVenv(candidate: string, cwd: string): boolean {
+	try {
+		if (!fs.statSync(path.join(candidate, "pyvenv.cfg")).isFile()) return false;
+	} catch {
+		return false;
+	}
+	let canonicalPython: string;
+	try {
+		canonicalPython = fs.realpathSync(resolvePythonCandidateInVenv(candidate).pythonPath);
+	} catch {
+		return false;
+	}
+	// HOME stops project-root discovery, so a workspace that is the home directory
+	// is not project-controlled. Refuse an interpreter that still resolves inside
+	// cwd, including a file whose name is `..payload`.
+	let canonicalCwd = path.resolve(cwd);
+	try {
+		canonicalCwd = fs.realpathSync(cwd);
+	} catch {
+		// Missing cwd keeps the resolved path.
+	}
+	if (workspacePathContained(canonicalCwd, canonicalPython)) return false;
+	return !isProjectControlledPath(canonicalPython, cwd);
+}
+
 function resolveManagedPythonCandidate(): { venvPath: string; pythonPath: string; binDir: string } {
 	return resolvePythonCandidateInVenv(resolveGlobalManagedPythonEnv());
 }
@@ -197,9 +239,7 @@ export function resolveVenvPath(cwd: string): string | undefined {
 	if ($env.CONDA_PREFIX) return $env.CONDA_PREFIX;
 	const candidates = [path.join(cwd, ".venv"), path.join(cwd, "venv")];
 	for (const candidate of candidates) {
-		if (fs.existsSync(candidate)) {
-			return candidate;
-		}
+		if (isAutoDetectedWorkspaceVenv(candidate, cwd)) return candidate;
 	}
 	return undefined;
 }

package/src/exec/non-interactive-env.ts

@@ -24,7 +24,6 @@ export const NON_INTERACTIVE_ENV: Readonly<Record<string, string>> = {
 	EDITOR: "true",
 	GIT_TERMINAL_PROMPT: "0",
 	SSH_ASKPASS: "/usr/bin/false",
-	CI: "1",
 	// Package manager defaults for unattended execution.
 	npm_config_yes: "true",
 	npm_config_update_notifier: "false",

package/src/export/html/index.ts

@@ -2,7 +2,7 @@ import * as syncFs from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { AgentState } from "@gajae-code/agent-core";
-import { APP_NAME, isEnoent, redactCrashSecrets } from "@gajae-code/utils";
+import { APP_NAME, isCredentialKey, isEnoent, redactCrashSecrets } from "@gajae-code/utils";
 import { getResolvedThemeColors, getThemeExportColors } from "../../modes/theme/theme";
 import { SessionManager } from "../../session/session-manager";
 // Pre-generated template (created by scripts/generate-template.ts at publish time)
@@ -255,38 +255,78 @@ async function writeSessionHtml(
 
 /**
  * Own `__proto__` stays a data property; a normal object would turn that assignment into the prototype.
- * Each field is redacted together with its key. A detached leaf such as `abcdefgh1234` under `password`
- * would otherwise miss the key-aware rule. If that serialized field does not parse, the value is
- * redacted on its own so a quotation mark inside a labeled secret cannot break the export.
+ * Credential keys mask every JSON value, and string values are scrubbed directly so JSON escaping
+ * cannot turn ordinary quote characters into credential-value delimiters.
  */
 function redactJsonValue(value: unknown): unknown {
 	if (typeof value === "string") return redactCrashSecrets(value);
-	if (Array.isArray(value)) return value.map(item => redactJsonValue(item));
+	if (Array.isArray(value)) {
+		const isFlatKeyValueArray =
+			value.length > 0 &&
+			value.length % 2 === 0 &&
+			value.every((item, index) => index % 2 === 1 || typeof item === "string");
+		if (isFlatKeyValueArray) {
+			return value.map((item, index) => {
+				if (index % 2 === 1) {
+					const key = value[index - 1];
+					if (typeof key === "string" && isCredentialKey(key)) return "«redacted»";
+				}
+				return redactJsonValue(item);
+			});
+		}
+		return value.map(item => redactJsonValue(item));
+	}
 	if (value === null || typeof value !== "object") return value;
 	const source = value as Record<string, unknown>;
+	const sourceKeys = Object.keys(source);
+	let hasCredentialHeaderName = false;
+	let hasHeaderValue = false;
+	for (const key of sourceKeys) {
+		const field = key.toLowerCase();
+		if (field === "value" || field === "values") hasHeaderValue = true;
+		if (field !== "name" && field !== "key") continue;
+		const headerName = source[key];
+		if (typeof headerName === "string" && isCredentialKey(headerName)) hasCredentialHeaderName = true;
+	}
+	const redactHeaderValue = hasCredentialHeaderName && hasHeaderValue;
 	const redacted = Object.create(null) as Record<string, unknown>;
-	for (const key of Object.keys(source)) redacted[key] = redactKeyedValue(key, source[key]);
+	const nextSuffixByKey = new Map<string, number>();
+	for (const key of sourceKeys) {
+		const redactedKey = uniqueJsonObjectKey(redacted, redactCrashSecrets(key), nextSuffixByKey);
+		const field = key.toLowerCase();
+		if (redactHeaderValue && (field === "value" || field === "values")) {
+			const headerValue = source[key];
+			redacted[redactedKey] =
+				field === "values" && Array.isArray(headerValue) ? headerValue.map(() => "«redacted»") : "«redacted»";
+		} else {
+			redacted[redactedKey] = redactKeyedValue(key, source[key]);
+		}
+	}
 	return redacted;
 }
 
-const CREDENTIAL_JSON_KEY =
-	/^(?:api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?id|session[_-]?token|client[_-]?secret|secret[_-]?key|aws[_-]?secret[_-]?access[_-]?key|secret[_-]?access[_-]?key|password|passwd|authorization)$/i;
+// Resume after the last collision for this base key rather than rescanning prior suffixes.
+function uniqueJsonObjectKey(
+	target: Record<string, unknown>,
+	key: string,
+	nextSuffixByKey: Map<string, number>,
+): string {
+	if (!Object.hasOwn(target, key)) return key;
+	let suffix = nextSuffixByKey.get(key) ?? 2;
+	let candidate = `${key}#${suffix}`;
+	while (Object.hasOwn(target, candidate)) {
+		suffix += 1;
+		candidate = `${key}#${suffix}`;
+	}
+	nextSuffixByKey.set(key, suffix + 1);
+	return candidate;
+}
 
 function redactKeyedValue(key: string, value: unknown): unknown {
 	// A recognized key is authoritative for every JSON type, including a short
 	// string, a number, an array, or a nested object.
-	if (CREDENTIAL_JSON_KEY.test(key)) return "«redacted»";
-	if (typeof value !== "string") return redactJsonValue(value);
-	const encoded = JSON.stringify({ [key]: value });
-	try {
-		const parsed = JSON.parse(redactCrashSecrets(encoded)) as Record<string, unknown>;
-		if (parsed !== null && typeof parsed === "object" && Object.hasOwn(parsed, key)) return parsed[key];
-	} catch {
-		// A quote inside a credential field can make the redacted JSON invalid.
-		// Mask that field instead of exporting the raw value without its key.
-		if (CREDENTIAL_JSON_KEY.test(key)) return "«redacted»";
-	}
-	return redactCrashSecrets(value);
+	if (isCredentialKey(key)) return "«redacted»";
+	return typeof value === "string" ? redactCrashSecrets(value) : redactJsonValue(value);
 }
 
 function sessionEmbedJson(value: unknown): string {