fix(json-parse): exclude code-context tails from Windows-path heuristic

louria · louria · commit bf74d346f3f5 · 2026-06-23T13:29:14.000+08:00
The repairJson helper detects unescaped backslashes in Windows path strings (\bin, \users) and preserves them as literal characters instead of rewriting them as JSON escape sequences. The detector keys off a tail ending in `<non-alphanum><letter>:`, which matches genuine drive letters like `C:` but also matches Python block openers like `if x:`, `for x:`, `try:`, `def foo(x):`. When the next character was a real newline, the model output got rewritten so the shell saw a literal `\n` instead of an actual newline. This broke any agent tool call that carried multi-line Python in a heredoc, with the symptom that the shell parser threw `SyntaxError: unexpected character after line continuation character` and the cron agent burned thousands of output tokens trying to work around the corruption. Fix: reject any tail that contains code-context markers like parens, braces, equals, semicolons, single-quotes, commas, shell redirects, or pipes. Real Windows path tails do not contain those characters, but nearly every Python/JS/shell block opener does. Adds regression tests for the failing patterns and a mixed-content test that confirms a Windows path adjacent to code still survives. Refs #93139
diff --git a/src/llm/utils/json-parse.test.ts b/src/llm/utils/json-parse.test.ts
@@ -44,3 +44,54 @@ describe("json-parse repairJson invalid \\u escapes", () => {
     },
   );
 });
+
+describe("json-parse repairJson Windows-path false positives (issue #93139)", () => {
+  // Before the code-context guard, the Windows-path heuristic matched any
+  // tail ending in `<non-alphanum><letter>:` — which also matches Python
+  // block openers like `if x:`, `for x:`, `try:`, `def foo(x):` — and the
+  // newline immediately after the colon got rewritten as a literal `\\n`
+  // instead of an actual newline. That broke any agent tool call carrying
+  // multi-line Python in a heredoc, with the symptom that the shell saw a
+  // line-continuation character and refused to run the script.
+
+  it.each([
+    [
+      "Python if-block in a heredoc",
+      '{"command": "python3 << EOF\\nif x:\\n    print(1)\\nEOF"}',
+      "python3 << EOF\nif x:\n    print(1)\nEOF",
+    ],
+    [
+      "Python try/except",
+      '{"command": "try:\\n    foo()\\nexcept Exception as e:\\n    bar()"}',
+      "try:\n    foo()\nexcept Exception as e:\n    bar()",
+    ],
+    [
+      "Python def with parens in the signature",
+      '{"command": "def foo(x):\\n    return x"}',
+      "def foo(x):\n    return x",
+    ],
+    ["Python while-True loop", '{"command": "while True:\\n    break"}', "while True:\n    break"],
+    [
+      "reproducer reported in #93139 (if r:)",
+      '{"command": "r = re.match(p, s)\\nif r:\\n    print(r)"}',
+      "r = re.match(p, s)\nif r:\n    print(r)",
+    ],
+    [
+      "bash for-loop with shell redirect in prior context",
+      '{"command": "for f in *.py:\\n  echo $f"}',
+      "for f in *.py:\n  echo $f",
+    ],
+  ])("preserves real newlines after Python/shell block openers: %s", (_name, input, expected) => {
+    expect(parseJsonWithRepair(input)).toEqual({ command: expected });
+    expect(parseStreamingJson(input)).toEqual({ command: expected });
+  });
+
+  it("still preserves a Windows path that appears alongside code", () => {
+    // Confirms the guard is scoped: the path part stays escaped, the code
+    // part gets real newlines. Both parts of the same string survive.
+    const input = '{"text": "see C:\\\\Users for path; if x:\\n    do_stuff()"}';
+    expect(parseJsonWithRepair(input)).toEqual({
+      text: "see C:\\Users for path; if x:\n    do_stuff()",
+    });
+  });
+});
diff --git a/src/llm/utils/json-parse.ts b/src/llm/utils/json-parse.ts
@@ -114,6 +114,15 @@ export function parseJsonWithRepair(json: string): unknown {
 
 function looksLikeWindowsPathPrefix(prefix: string): boolean {
   const tail = prefix.slice(-160);
+  // Reject obvious code-context markers (parentheses, braces, equals,
+  // semicolons, single-quotes, commas, shell redirects/pipes). A Windows
+  // path tail will not contain these, but a Python/JS/shell block opener
+  // like "if x:" or "for x:" or "def foo(x):" will — and without this
+  // guard we treat the next \n as a path separator and emit a literal
+  // backslash-n instead of a real newline. See issue #93139.
+  if (/[()=;{}',<>|]/.test(tail)) {
+    return false;
+  }
   return /(?:^|[^A-Za-z0-9])[A-Za-z]:(?:[\\/][^"\\/:*?<>|\r\n]*)*$/.test(tail);
 }
 
