@gajae-code/coding-agent 0.4.5 → 0.5.0

package/src/modes/components/tool-execution.ts

@@ -152,6 +152,7 @@ export class ToolExecutionComponent extends Container {
 		isError?: boolean;
 		details?: any;
 	};
+	#textOutputCache?: { content: unknown; showImages: boolean; terminalImageProtocol: unknown; output: string };
 	// Edit preview state
 	#editMode?: EditMode;
 	#editDiffPreview?: PerFileDiffPreview[];
@@ -197,9 +198,11 @@ export class ToolExecutionComponent extends Container {
 
 		this.addChild(new Spacer(1));
 
-		// Always create both - contentBox for custom tools/bash/tools with renderers, contentText for other built-ins
-		this.#contentBox = new Box(1, 1, (text: string) => theme.bg("toolPendingBg", text));
-		this.#contentText = new Text("", 1, 1, (text: string) => theme.bg("toolPendingBg", text));
+		// Always create both - contentBox for custom tools/bash/tools with renderers, contentText for other built-ins.
+		// Vertical padding is 0: block separation comes solely from the leading Spacer
+		// (1 blank line above each block), matching reference TUIs (083.2).
+		this.#contentBox = new Box(1, 0, (text: string) => theme.bg("toolPendingBg", text));
+		this.#contentText = new Text("", 1, 0, (text: string) => theme.bg("toolPendingBg", text));
 
 		// Use Box for custom tools or built-in tools that have renderers
 		const hasRenderer = toolName in toolRenderers;
@@ -295,6 +298,7 @@ export class ToolExecutionComponent extends Container {
 		isPartial = false,
 		_toolCallId?: string,
 	): void {
+		this.#textOutputCache = undefined;
 		this.#result = result;
 		this.#isPartial = isPartial;
 		// When tool is complete, ensure args are marked complete so spinner stops
@@ -397,6 +401,7 @@ export class ToolExecutionComponent extends Container {
 
 	setShowImages(show: boolean): void {
 		this.#showImages = show;
+		this.#textOutputCache = undefined;
 		this.#updateDisplay();
 	}
 
@@ -514,7 +519,7 @@ export class ToolExecutionComponent extends Container {
 					const fileBgFn = fileResult.isError
 						? (text: string) => theme.bg("toolErrorBg", text)
 						: (text: string) => theme.bg("toolSuccessBg", text);
-					const fileBox = new Box(1, 1, fileBgFn);
+					const fileBox = new Box(1, 0, fileBgFn);
 					try {
 						const resultComponent = renderer.renderResult(
 							{ content: [], details: fileResult, isError: fileResult.isError },
@@ -540,7 +545,7 @@ export class ToolExecutionComponent extends Container {
 					const pendingSpacer = new Spacer(1);
 					this.#multiFileBoxes.push(pendingSpacer);
 					this.addChild(pendingSpacer);
-					const pendingBox = new Box(1, 1, (text: string) => theme.bg("toolPendingBg", text));
+					const pendingBox = new Box(1, 0, (text: string) => theme.bg("toolPendingBg", text));
 					const pendingText = renderStatusLine(
 						{
 							icon: "pending",
@@ -723,16 +728,27 @@ export class ToolExecutionComponent extends Container {
 	#getTextOutput(): string {
 		if (!this.#result) return "";
 
-		const textBlocks = this.#result.content?.filter((c: any) => c.type === "text") || [];
-		const imageBlocks = this.#getAllImageBlocks();
+		const content = this.#result.content;
+		const terminalImageProtocol = TERMINAL.imageProtocol;
+		const cached = this.#textOutputCache;
+		if (
+			cached?.content === content &&
+			cached.showImages === this.#showImages &&
+			cached.terminalImageProtocol === terminalImageProtocol
+		) {
+			return cached.output;
+		}
 
-		let output = textBlocks
-			.map((c: any) => {
-				return sanitizeWithOptionalSixelPassthrough(c.text || "", sanitizeText);
-			})
-			.join("\n");
+		const textParts: string[] = [];
+		for (const block of content ?? []) {
+			if (block.type !== "text") continue;
+			const text = block.text || "";
+			textParts.push(sanitizeWithOptionalSixelPassthrough(text, sanitizeText));
+		}
+		let output = textParts.join("\n");
 
-		if (imageBlocks.length > 0 && (!TERMINAL.imageProtocol || !this.#showImages)) {
+		const imageBlocks = this.#getAllImageBlocks();
+		if (imageBlocks.length > 0 && (!terminalImageProtocol || !this.#showImages)) {
 			const imageIndicators = imageBlocks
 				.map((img: any) => {
 					const dims = img.data ? (getImageDimensions(img.data, img.mimeType) ?? undefined) : undefined;
@@ -742,6 +758,7 @@ export class ToolExecutionComponent extends Container {
 			output = output ? `${output}\n${imageIndicators}` : imageIndicators;
 		}
 
+		this.#textOutputCache = { content, showImages: this.#showImages, terminalImageProtocol, output };
 		return output;
 	}
 

package/src/modes/controllers/selector-controller.ts

@@ -5,6 +5,7 @@ import type { Component, OverlayHandle } from "@gajae-code/tui";
 import { Input, Loader, Spacer, Text } from "@gajae-code/tui";
 import { getAgentDbPath, getProjectDir } from "@gajae-code/utils";
 import { activateModelProfile } from "../../config/model-profile-activation";
+import { recommendModelProfileForProvider } from "../../config/model-profiles";
 import { settings } from "../../config/settings";
 import { DebugSelectorComponent } from "../../debug";
 import { disableProvider, enableProvider } from "../../discovery";
@@ -45,7 +46,7 @@ import { CustomProviderWizardComponent, type CustomProviderWizardSubmit } from "
 import { ExtensionDashboard } from "../components/extensions";
 import { HistorySearchComponent } from "../components/history-search";
 import { JobsOverlayComponent } from "../components/jobs-overlay";
-import { ModelSelectorComponent, type ModelSelectorSelection } from "../components/model-selector";
+import { ModelSelectorComponent } from "../components/model-selector";
 import { OAuthSelectorComponent } from "../components/oauth-selector";
 import { PluginSelectorComponent } from "../components/plugin-selector";
 import {
@@ -537,12 +538,6 @@ export class SelectorController {
 				this.ctx.session.scopedModels,
 				async selection => {
 					try {
-						if (selection.kind === "preset") {
-							await this.#applyModelAssignmentPreset(selection);
-							done();
-							this.ctx.ui.requestRender();
-							return;
-						}
 						if (selection.kind === "profile") {
 							await activateModelProfile(
 								{
@@ -609,45 +604,12 @@ export class SelectorController {
 					done();
 					this.ctx.ui.requestRender();
 				},
-				options,
+				{ ...options, sessionId: this.ctx.session.sessionId },
 			);
 			return { component: selector, focus: selector };
 		});
 	}
 
-	async #applyModelAssignmentPreset(selection: Extract<ModelSelectorSelection, { kind: "preset" }>): Promise<void> {
-		const { assignments, model, preset, selector } = selection;
-		const apiKey = await this.ctx.session.modelRegistry.getApiKey(model, this.ctx.session.sessionId);
-		if (!apiKey) {
-			throw new Error(`No API key for ${model.provider}/${model.id}`);
-		}
-
-		const defaultThinkingLevel = assignments.default;
-		await this.ctx.session.setModel(model, "default", {
-			selector,
-			thinkingLevel: defaultThinkingLevel,
-		});
-		if (defaultThinkingLevel && defaultThinkingLevel !== ThinkingLevel.Inherit) {
-			this.ctx.session.setThinkingLevel(defaultThinkingLevel);
-		}
-
-		const overrides = this.ctx.settings.get("task.agentModelOverrides");
-		const nextOverrides = { ...overrides };
-		for (const [targetRole, presetThinkingLevel] of Object.entries(assignments) as [
-			keyof Extract<ModelSelectorSelection, { kind: "preset" }>["assignments"],
-			ThinkingLevel,
-		][]) {
-			if (!targetRole || targetRole === "default") continue;
-			nextOverrides[targetRole] =
-				presetThinkingLevel === ThinkingLevel.Inherit ? selector : `${selector}:${presetThinkingLevel}`;
-		}
-		this.ctx.settings.set("task.agentModelOverrides", nextOverrides);
-		this.ctx.settings.getStorage()?.recordModelUsage(`${model.provider}/${model.id}`);
-		this.ctx.statusLine.invalidate();
-		this.ctx.updateEditorBorderColor();
-		this.ctx.showStatus(`${preset.label}: ${selector}`);
-	}
-
 	async showPluginSelector(mode: "install" | "uninstall" = "install"): Promise<void> {
 		const mgr = new MarketplaceManager({
 			marketplacesRegistryPath: getMarketplacesRegistryPath(),
@@ -1034,6 +996,34 @@ export class SelectorController {
 		await this.showSessionSelector();
 	}
 
+	async #handlePostLoginModelProfileRecommendation(providerId: string): Promise<void> {
+		const recommendedProfile = recommendModelProfileForProvider(
+			providerId,
+			this.ctx.session.modelRegistry.getModelProfiles(),
+		);
+		if (!recommendedProfile) {
+			return;
+		}
+
+		const activeProfile = this.ctx.session.getActiveModelProfile?.() ?? this.ctx.settings.get("modelProfile.default");
+		if (activeProfile) {
+			this.ctx.showStatus(`Preset ${recommendedProfile.name} is available in /model.`);
+			return;
+		}
+
+		const confirmed = await this.ctx.showHookConfirm(`Apply ${recommendedProfile.name} now?`, "");
+		if (!confirmed) {
+			return;
+		}
+
+		await activateModelProfile({
+			session: this.ctx.session,
+			modelRegistry: this.ctx.session.modelRegistry,
+			settings: this.ctx.settings,
+			profileName: recommendedProfile.name,
+		});
+	}
+
 	async #handleOAuthLogin(providerId: string): Promise<void> {
 		this.ctx.showStatus(`Logging in to ${providerId}…`);
 		const manualInput = this.ctx.oauthManualInput;
@@ -1090,6 +1080,7 @@ export class SelectorController {
 				new Text(theme.fg("success", `${theme.status.success} Successfully logged in to ${providerId}`), 1, 0),
 			);
 			this.ctx.chatContainer.addChild(new Text(theme.fg("dim", `Credentials saved to ${getAgentDbPath()}`), 1, 0));
+			await this.#handlePostLoginModelProfileRecommendation(providerId);
 			this.ctx.ui.requestRender();
 		} catch (error: unknown) {
 			this.ctx.showError(`Login failed: ${error instanceof Error ? error.message : String(error)}`);
@@ -1120,7 +1111,7 @@ export class SelectorController {
 	async showOAuthSelector(mode: "login" | "logout", providerId?: string): Promise<void> {
 		if (providerId) {
 			const oauthProvider = getOAuthProviders().find(provider => provider.id === providerId);
-			if (!oauthProvider) {
+			if (!oauthProvider && !this.ctx.session.modelRegistry.getModelProfiles().has(providerId)) {
 				this.ctx.showError(`Unknown OAuth provider: ${providerId}`);
 				return;
 			}

package/src/modes/rpc/rpc-client.ts

@@ -12,6 +12,7 @@ import type { SessionStats } from "../../session/agent-session";
 import type {
 	RpcCommand,
 	RpcExtensionUIRequest,
+	RpcGetStateInclude,
 	RpcHandoffResult,
 	RpcHostToolCallRequest,
 	RpcHostToolCancelRequest,
@@ -442,8 +443,8 @@ export class RpcClient {
 	/**
 	 * Get current session state.
 	 */
-	async getState(): Promise<RpcSessionState> {
-		const response = await this.#send({ type: "get_state" });
+	async getState(include?: RpcGetStateInclude[]): Promise<RpcSessionState> {
+		const response = await this.#send(include ? { type: "get_state", include } : { type: "get_state" });
 		return this.#getData(response);
 	}
 

package/src/modes/rpc/rpc-mode.ts

@@ -11,7 +11,7 @@
  * - Extension UI: Extension UI requests are emitted, client responds with extension_ui_response
  */
 import * as path from "node:path";
-import { $env, readJsonl, Snowflake } from "@gajae-code/utils";
+import { $env, readLines, Snowflake } from "@gajae-code/utils";
 import type {
 	ExtensionUIContext,
 	ExtensionUIDialogOptions,
@@ -169,6 +169,7 @@ export async function runRpcMode(
 		process.stdout.write(`${JSON.stringify(obj)}\n`);
 	};
 	const emitRpcTitles = shouldEmitRpcTitles();
+	const decodeError = (err: unknown): string => (err instanceof Error ? err.message : String(err));
 
 	const pendingExtensionRequests = new Map<string, PendingExtensionRequest>();
 	const hostToolBridge = new RpcHostToolBridge(output);
@@ -229,6 +230,28 @@ export async function runRpcMode(
 
 	// Shutdown request flag (wrapped in object to allow mutation with const)
 	const shutdownState = { requested: false };
+	let shutdownStarted = false;
+	async function shutdown(exitCode: number, reason: string): Promise<never> {
+		if (shutdownStarted) {
+			process.exit(exitCode);
+		}
+		shutdownStarted = true;
+		hostToolBridge.rejectAllPending(`${reason} before host tool execution completed`);
+		hostUriBridge.clear(`${reason} before host URI request completed`);
+		try {
+			await session.sessionManager.ensureOnDisk();
+		} catch (err) {
+			output(error(undefined, "shutdown", decodeError(err)));
+			process.exit(1);
+		}
+		try {
+			await session.dispose();
+		} catch (err) {
+			output(error(undefined, "shutdown", decodeError(err)));
+			process.exit(1);
+		}
+		process.exit(exitCode);
+	}
 
 	/**
 	 * Extension UI context that uses the RPC protocol.
@@ -497,16 +520,24 @@ export async function runRpcMode(
 	 */
 	async function checkShutdownRequested(): Promise<void> {
 		if (!shutdownState.requested) return;
+		await shutdown(0, "RPC shutdown requested");
+	}
 
-		if (session.extensionRunner?.hasHandlers("session_shutdown")) {
-			await session.extensionRunner.emit({ type: "session_shutdown" });
-		}
+	// Listen for JSONL input using Bun's stdin. Parse frame-by-frame so a malformed
+	// command reports a parse error without poisoning the whole long-lived RPC session.
+	const inputDecoder = new TextDecoder("utf-8", { fatal: false });
+	for await (const line of readLines(Bun.stdin.stream())) {
+		const text = inputDecoder.decode(line).trim();
+		if (!text) continue;
 
-		process.exit(0);
-	}
+		let parsed: unknown;
+		try {
+			parsed = JSON.parse(text);
+		} catch (err) {
+			output(error(undefined, "parse", `Failed to parse command: ${decodeError(err)}`));
+			continue;
+		}
 
-	// Listen for JSON input using Bun's stdin
-	for await (const parsed of readJsonl(Bun.stdin.stream())) {
 		try {
 			// Handle extension UI responses
 			if ((parsed as RpcExtensionUIResponse).type === "extension_ui_response") {
@@ -540,13 +571,12 @@ export async function runRpcMode(
 
 			// Check for deferred shutdown request (idle between commands)
 			await checkShutdownRequested();
-		} catch (e: any) {
-			output(error(undefined, "parse", `Failed to parse command: ${e.message}`));
+		} catch (err) {
+			output(error(undefined, "parse", `Failed to parse command: ${decodeError(err)}`));
 		}
 	}
 
-	// stdin closed — RPC client is gone, exit cleanly
-	hostToolBridge.rejectAllPending("RPC client disconnected before host tool execution completed");
-	hostUriBridge.clear("RPC client disconnected before host URI request completed");
-	process.exit(0);
+	// stdin closed — RPC client is gone, flush durable state and exit cleanly
+	await shutdown(0, "RPC client disconnected");
+	throw new Error("RPC shutdown returned unexpectedly");
 }

package/src/modes/rpc/rpc-types.ts

@@ -12,6 +12,8 @@ import type { ContextUsage } from "../../extensibility/extensions/types";
 import type { SessionStats } from "../../session/agent-session";
 import type { TodoPhase } from "../../tools/todo-write";
 
+export type RpcGetStateInclude = "tools" | "dumpTools" | "systemPrompt";
+
 // ============================================================================
 // RPC Commands (stdin)
 // ============================================================================
@@ -26,7 +28,7 @@ export type RpcCommand =
 	| { id?: string; type: "new_session"; parentSession?: string }
 
 	// State
-	| { id?: string; type: "get_state" }
+	| { id?: string; type: "get_state"; include?: RpcGetStateInclude[] }
 	| { id?: string; type: "set_todos"; phases: TodoPhase[] }
 	| { id?: string; type: "set_host_tools"; tools: RpcHostToolDefinition[] }
 	| { id?: string; type: "set_host_uri_schemes"; schemes: RpcHostUriSchemeDefinition[] }
@@ -99,8 +101,9 @@ export interface RpcSessionState {
 	messageCount: number;
 	queuedMessageCount: number;
 	todoPhases: TodoPhase[];
-	/** For session dump / export (plain-text parity with /dump). */
+	/** Optional static system prompt blocks. Omitted by default; request with get_state include ["systemPrompt"]. */
 	systemPrompt?: string[];
+	/** Optional static tool schemas. Omitted by default; request with get_state include ["tools"]. */
 	dumpTools?: Array<{ name: string; description: string; parameters: unknown }>;
 	/** Current context window usage. Null tokens/percent when unknown (e.g. right after compaction). */
 	contextUsage?: ContextUsage;

package/src/modes/shared/agent-wire/command-dispatch.ts

@@ -183,14 +183,19 @@ export async function dispatchRpcCommand(
 				messageCount: session.messages.length,
 				queuedMessageCount: session.queuedMessageCount,
 				todoPhases: session.getTodoPhases(),
-				systemPrompt: session.systemPrompt,
-				dumpTools: session.agent.state.tools.map(tool => ({
+				contextUsage: session.getContextUsage(),
+			};
+			const include = new Set(command.include ?? []);
+			if (include.has("systemPrompt")) {
+				state.systemPrompt = session.systemPrompt;
+			}
+			if (include.has("tools") || include.has("dumpTools")) {
+				state.dumpTools = session.agent.state.tools.map(tool => ({
 					name: tool.name,
 					description: tool.description,
 					parameters: tool.parameters,
-				})),
-				contextUsage: session.getContextUsage(),
-			};
+				}));
+			}
 			return rpcSuccess(id, "get_state", state);
 		}
 

package/src/modes/shared/agent-wire/command-validation.ts

@@ -28,6 +28,15 @@ function stringArray(value: unknown): value is string[] {
 	return Array.isArray(value) && value.every(item => typeof item === "string");
 }
 
+const GET_STATE_INCLUDES = new Set(["tools", "dumpTools", "systemPrompt"]);
+
+function optionalGetStateInclude(value: unknown): boolean {
+	return (
+		value === undefined ||
+		(Array.isArray(value) && value.every(item => typeof item === "string" && GET_STATE_INCLUDES.has(item)))
+	);
+}
+
 function todoPhase(value: unknown): boolean {
 	if (!isRecord(value) || typeof value.name !== "string" || !Array.isArray(value.tasks)) return false;
 	return value.tasks.every(
@@ -96,7 +105,9 @@ export function isRpcCommand(value: unknown): value is RpcCommand {
 		case "follow_up":
 			return stringField(value, "message") && optionalArray(value.images);
 		case "abort":
+			return true;
 		case "get_state":
+			return optionalGetStateInclude(value.include);
 		case "cycle_model":
 		case "get_available_models":
 		case "cycle_thinking_level":

package/src/sdk.ts

@@ -133,7 +133,7 @@ import { ToolContextStore } from "./tools/context";
 import { getImageGenTools } from "./tools/image-gen";
 import { wrapToolWithMetaNotice } from "./tools/output-meta";
 import { EventBus } from "./utils/event-bus";
-import { buildNamedToolChoice } from "./utils/tool-choice";
+import { buildNamedToolChoice, buildNamedToolChoiceResult } from "./utils/tool-choice";
 import { buildWorkspaceTree, type WorkspaceTree } from "./workspace-tree";
 
 type AsyncResultEntry = {
@@ -234,6 +234,8 @@ export interface CreateAgentSessionOptions {
 	modelPattern?: string;
 	/** Thinking selector. Default: from settings, else unset */
 	thinkingLevel?: ThinkingLevel;
+	/** Runtime substitution metadata for the initial model_change session event. */
+	modelSubstitution?: { requestedModel: Model; reason: string };
 	/** Models available for cycling (Ctrl+P in interactive mode) */
 	scopedModels?: ScopedModelSelection[];
 
@@ -1212,6 +1214,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				const m = session.model;
 				return m ? buildNamedToolChoice(name, m) : undefined;
 			},
+			buildToolChoiceResult: name => buildNamedToolChoiceResult(name, session.model),
 			steer: msg =>
 				session.agent.steer({
 					role: "custom",
@@ -1898,6 +1901,19 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				}
 				return result;
 			},
+			onToolChoiceIncapability: event => {
+				const droppedLabel = session?.toolChoiceQueue.degradeInFlight(event.reason);
+				logger.debug("Dropped in-flight tool choice after runtime incapability", {
+					droppedLabel,
+					api: event.api,
+					provider: event.provider,
+					model: event.model,
+					requestedLevel: event.requestedLevel,
+					resolvedLevel: event.resolvedLevel,
+					reason: event.reason,
+					registryKey: event.registryKey,
+				});
+			},
 			intentTracing: !!intentField,
 			getToolChoice: () => session?.nextToolChoice(),
 			telemetry: options.telemetry,
@@ -1912,7 +1928,18 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		} else {
 			// Save initial model, thinking level, and service tier for new sessions so they can be restored on resume.
 			if (model) {
-				sessionManager.appendModelChange(`${model.provider}/${model.id}`);
+				const substitution = options.modelSubstitution;
+				sessionManager.appendModelChange(
+					`${model.provider}/${model.id}`,
+					undefined,
+					substitution
+						? {
+								previousModel: `${substitution.requestedModel.provider}/${substitution.requestedModel.id}`,
+								reason: substitution.reason,
+								thinkingLevel: thinkingLevel ?? null,
+							}
+						: undefined,
+				);
 			}
 			sessionManager.appendThinkingLevelChange(thinkingLevel);
 			if (initialServiceTier) {

package/src/secrets/obfuscator.ts

@@ -73,9 +73,24 @@ export class SecretObfuscator {
 	/** Replace-mode plain mappings: secret → replacement */
 	#replaceMappings = new Map<string, string>();
 
+	/** Replace-mode plain mappings sorted longest-first for deterministic longest-match replacement. */
+	#sortedReplaceMappings: Array<{ secret: string; replacement: string }> = [];
+
+	/** Obfuscate-mode plain and regex-discovered mappings sorted longest-first. */
+	#sortedObfuscateMappings: Array<{ secret: string; index: number; placeholder: string }> = [];
+
+	/** Reverse lookup for obfuscate-mode secrets to avoid scanning mappings. */
+	#obfuscateIndexBySecret = new Map<string, number>();
+
 	/** Reverse lookup for deobfuscation: placeholder → secret */
 	#deobfuscateMap = new Map<string, string>();
 
+	/** Combined plain-secret regex cache for single-pass replacement. */
+	#combinedPlainRegex: RegExp | undefined;
+	#combinedPlainReplacementBySecret = new Map<string, string>();
+	#combinedPlainRegexDirty = true;
+	#useSequentialPlainReplacement = false;
+
 	/** Next available index for regex match discoveries */
 	#nextIndex: number;
 
@@ -93,6 +108,7 @@ export class SecretObfuscator {
 					this.#plainMappings.set(entry.content, index);
 					this.#obfuscateMappings.set(index, { secret: entry.content, placeholder });
 					this.#deobfuscateMap.set(placeholder, entry.content);
+					this.#obfuscateIndexBySecret.set(entry.content, index);
 					index++;
 				} else {
 					// replace mode
@@ -111,6 +127,16 @@ export class SecretObfuscator {
 		}
 
 		this.#nextIndex = index;
+		this.#sortedReplaceMappings = [...this.#replaceMappings]
+			.sort((a, b) => b[0].length - a[0].length)
+			.map(([secret, replacement]) => ({ secret, replacement }));
+		this.#sortedObfuscateMappings = [...this.#plainMappings]
+			.sort((a, b) => b[0].length - a[0].length)
+			.map(([secret, mappingIndex]) => ({
+				secret,
+				index: mappingIndex,
+				placeholder: this.#obfuscateMappings.get(mappingIndex)!.placeholder,
+			}));
 		this.#hasAny = entries.length > 0;
 	}
 
@@ -121,18 +147,7 @@ export class SecretObfuscator {
 	/** Obfuscate all secrets in text. Bidirectional placeholders for obfuscate mode, one-way for replace. */
 	obfuscate(text: string): string {
 		if (!this.#hasAny) return text;
-		let result = text;
-
-		// 1. Process replace-mode plain secrets
-		for (const [secret, replacement] of [...this.#replaceMappings].sort((a, b) => b[0].length - a[0].length)) {
-			result = replaceAll(result, secret, replacement);
-		}
-
-		// 2. Process obfuscate-mode plain secrets
-		for (const [secret, index] of [...this.#plainMappings].sort((a, b) => b[0].length - a[0].length)) {
-			const mapping = this.#obfuscateMappings.get(index)!;
-			result = replaceAll(result, secret, mapping.placeholder);
-		}
+		let result = this.#obfuscatePlainMappings(text);
 
 		// 3. Process regex entries — discover new matches
 		for (const entry of this.#regexEntries) {
@@ -160,6 +175,9 @@ export class SecretObfuscator {
 						const placeholder = buildPlaceholder(index);
 						this.#obfuscateMappings.set(index, { secret: matchValue, placeholder });
 						this.#deobfuscateMap.set(placeholder, matchValue);
+						this.#obfuscateIndexBySecret.set(matchValue, index);
+						this.#insertSortedObfuscateMapping({ secret: matchValue, index, placeholder });
+						this.#combinedPlainRegexDirty = true;
 					}
 					const mapping = this.#obfuscateMappings.get(index)!;
 					result = replaceAll(result, matchValue, mapping.placeholder);
@@ -186,15 +204,74 @@ export class SecretObfuscator {
 
 	/** Find the obfuscate index for a known secret value. */
 	#findObfuscateIndex(secret: string): number | undefined {
-		// Check plain mappings first
-		const plainIndex = this.#plainMappings.get(secret);
-		if (plainIndex !== undefined) return plainIndex;
+		return this.#obfuscateIndexBySecret.get(secret);
+	}
+
+	#insertSortedObfuscateMapping(mapping: { secret: string; index: number; placeholder: string }): void {
+		let lo = 0;
+		let hi = this.#sortedObfuscateMappings.length;
+		while (lo < hi) {
+			const mid = (lo + hi) >> 1;
+			if (this.#sortedObfuscateMappings[mid]!.secret.length < mapping.secret.length) {
+				hi = mid;
+			} else {
+				lo = mid + 1;
+			}
+		}
+		this.#sortedObfuscateMappings.splice(lo, 0, mapping);
+	}
+
+	#obfuscatePlainMappings(text: string): string {
+		this.#ensureCombinedPlainRegex();
+		if (this.#useSequentialPlainReplacement) return this.#obfuscatePlainMappingsSequential(text);
+		if (!this.#combinedPlainRegex) return text;
+		return text.replace(
+			this.#combinedPlainRegex,
+			match => this.#combinedPlainReplacementBySecret.get(match) ?? match,
+		);
+	}
 
-		// Check regex-discovered mappings
-		for (const [index, mapping] of this.#obfuscateMappings) {
-			if (mapping.secret === secret) return index;
+	#obfuscatePlainMappingsSequential(text: string): string {
+		let result = text;
+		for (const mapping of this.#sortedReplaceMappings) {
+			result = replaceAll(result, mapping.secret, mapping.replacement);
+		}
+		for (const mapping of this.#sortedObfuscateMappings) {
+			result = replaceAll(result, mapping.secret, mapping.placeholder);
 		}
-		return undefined;
+		return result;
+	}
+
+	#ensureCombinedPlainRegex(): void {
+		if (!this.#combinedPlainRegexDirty) return;
+		this.#combinedPlainRegexDirty = false;
+		this.#combinedPlainReplacementBySecret = new Map<string, string>();
+
+		const mappings = [
+			...this.#sortedReplaceMappings.map(mapping => ({ secret: mapping.secret, replacement: mapping.replacement })),
+			...this.#sortedObfuscateMappings.map(mapping => ({
+				secret: mapping.secret,
+				replacement: mapping.placeholder,
+			})),
+		];
+
+		this.#useSequentialPlainReplacement = mappings.some((mapping, index) =>
+			mappings.some(
+				(other, otherIndex) =>
+					other.secret.length > 0 &&
+					(mapping.replacement.includes(other.secret) ||
+						(index !== otherIndex &&
+							(mapping.secret.includes(other.secret) || other.secret.includes(mapping.secret)))),
+			),
+		);
+		for (const mapping of mappings) {
+			if (!this.#combinedPlainReplacementBySecret.has(mapping.secret))
+				this.#combinedPlainReplacementBySecret.set(mapping.secret, mapping.replacement);
+		}
+		this.#combinedPlainRegex =
+			mappings.length > 0
+				? new RegExp(mappings.map(mapping => escapeRegex(mapping.secret)).join("|"), "g")
+				: undefined;
 	}
 }
 
@@ -238,14 +315,12 @@ export function obfuscateMessages(obfuscator: SecretObfuscator, messages: Messag
 
 /** Replace all occurrences of `search` in `text` with `replacement`. */
 function replaceAll(text: string, search: string, replacement: string): string {
-	if (search.length === 0) return text;
-	let result = text;
-	let idx = result.indexOf(search);
-	while (idx !== -1) {
-		result = result.slice(0, idx) + replacement + result.slice(idx + search.length);
-		idx = result.indexOf(search, idx + replacement.length);
-	}
-	return result;
+	if (search.length === 0 || !text.includes(search)) return text;
+	return text.split(search).join(replacement);
+}
+
+function escapeRegex(value: string): string {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
 /** Deep-walk an object, transforming all string values. */