fix(llm): trust control escapes in JSON strings that escape backslashes

ly-wang19 · claude · ly-wang19 · commit 1cbdeab3f3a9 · 2026-06-28T13:16:55.000+08:00
repairJson has a Windows-path heuristic: inside a string, a backslash before a
control-escape letter (b/f/n/r/t) whose decoded prefix looks like a Windows path
is treated as an unescaped path separator and doubled, so a model that emits a
raw path like {"path":"C:\new\file"} is repaired to the literal path instead of
a newline/formfeed. That bet is deliberate and test-pinned for unescaped paths.

But the heuristic inspected only the DECODED prefix, which is identical whether
the wire used escaped "\\" (valid) or raw "\" (malformed). So for a string that
properly escapes its path — e.g. JSON.stringify({text:"C:\\Users\\me\nDone."}),
where the path uses "\\" and the \n is a genuine newline — it still fired and
turned the real newline into a literal backslash-n. OpenAI/Azure/ChatGPT
Responses transports feed parseStreamingJson straight into tool calls with no
JSON.parse-first guard, so a model emitting a Bash/Write/Edit argument with a
properly escaped Windows path plus multi-line content ran a corrupted command.

Fix: once a string contains a properly escaped backslash ("\\"), the model
demonstrably escapes backslashes, so its later \n/\t/etc. are genuine control
escapes — skip the path heuristic for the rest of that string. Strings with no
escaped backslash (the pinned unescaped-path cases) repair exactly as before;
this only adds positive escaping evidence as a suppression signal. Add a
regression test asserting an escaped path followed by a real newline/tab
round-trips to JSON.parse.

Co-Authored-By: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/src/llm/utils/json-parse.test.ts b/src/llm/utils/json-parse.test.ts
@@ -31,6 +31,20 @@ describe("json-parse repairJson invalid \\u escapes", () => {
     });
   });
 
+  it("preserves a real control escape after an escaped Windows path", () => {
+    // Valid JSON whose path uses escaped \\ separators and whose \n is a genuine
+    // newline. The Windows-path repair heuristic must not fire here — doing so
+    // turned the real newline into a literal backslash-n, corrupting tool-call
+    // arguments (e.g. a multi-line shell command containing a Windows path).
+    const wire = JSON.stringify({ text: "Saved to C:\\Users\\me\nDone." });
+    expect(parseJsonWithRepair(wire)).toEqual(JSON.parse(wire));
+    expect((parseJsonWithRepair(wire) as { text: string }).text).toContain("\n");
+    expect((parseStreamingJson(wire) as { text: string }).text).toContain("\n");
+    // A real tab after an escaped path is likewise a genuine control escape.
+    const tabbed = JSON.stringify({ p: "D:\\a\\b\tEND" });
+    expect(parseJsonWithRepair(tabbed)).toEqual(JSON.parse(tabbed));
+  });
+
   it("recovers streaming tool-call arguments instead of dropping them to {}", () => {
     // LaTeX-style \u (\underline) is a valid string value the model may emit in args.
     const args = '{"cmd":"\\underline{x}"}';
diff --git a/src/llm/utils/json-parse.ts b/src/llm/utils/json-parse.ts
@@ -35,6 +35,11 @@ export function repairJson(json: string): string {
   let repaired = "";
   let inString = false;
   let stringValuePrefix = "";
+  // Once a string contains a properly escaped backslash, the model demonstrably
+  // escapes correctly, so later \n/\t/etc. are genuine control escapes — not
+  // unescaped Windows path separators. Tracking this stops the path heuristic
+  // below from corrupting a real newline that follows an escaped path.
+  let sawEscapedBackslash = false;
 
   for (let index = 0; index < json.length; index++) {
     const char = json[index];
@@ -44,6 +49,7 @@ export function repairJson(json: string): string {
       if (char === '"') {
         inString = true;
         stringValuePrefix = "";
+        sawEscapedBackslash = false;
       }
       continue;
     }
@@ -52,6 +58,7 @@ export function repairJson(json: string): string {
       repaired += char;
       inString = false;
       stringValuePrefix = "";
+      sawEscapedBackslash = false;
       continue;
     }
 
@@ -79,15 +86,24 @@ export function repairJson(json: string): string {
         continue;
       }
 
-      if (JSON_CONTROL_ESCAPES.has(nextChar) && looksLikeWindowsPathPrefix(stringValuePrefix)) {
+      if (
+        JSON_CONTROL_ESCAPES.has(nextChar) &&
+        !sawEscapedBackslash &&
+        looksLikeWindowsPathPrefix(stringValuePrefix)
+      ) {
         repaired += "\\\\";
         stringValuePrefix += "\\";
         continue;
       }
 
       if (VALID_JSON_ESCAPES.has(nextChar)) {
         repaired += `\\${nextChar}`;
-        stringValuePrefix += nextChar === "\\" ? "\\" : `\\${nextChar}`;
+        if (nextChar === "\\") {
+          stringValuePrefix += "\\";
+          sawEscapedBackslash = true;
+        } else {
+          stringValuePrefix += `\\${nextChar}`;
+        }
         index += 1;
         continue;
       }
