fix(redact): a name-shaped literal inside a call is not a secret (GST-1064)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

test/pregate-secrets-source-context.test.ts

@@ -54,6 +54,15 @@ describe('pregate secrets: source context and diff integrity', () => {
     expect([...parseAddedLines(diff)]).toEqual([['a.ts', ['one', '++two']], ['b.env', ['three']]]);
   });
 
+  test('a Python call that reads key.json is code; the same key name holding a literal key still fails (GST-1064)', () => {
+    expect(repo({ 'attach.py': 'import json\nkey = json.loads(files.get("key.json", ""))\n' }).secrets().status).toBe('pass');
+    const fake = 'Zx9Q' + 'w8Er7Ty6Ui5Op4As3Df2';
+    const r = repo({ 'attach.py': `key = json.loads(files.get("key.json")) or "${fake}"\n`, '.env': `KEY=${fake}\n` }).secrets();
+    expect(r.status).toBe('fail');
+    expect(r.lines.join('\n')).toContain('attach.py');
+    expect(r.lines.join('\n')).toContain('.env');
+  });
+
   test('a TS object property that reads a credential at runtime is code, not a secret (#3211)', () => {
     const f = repo({ 'app.ts': 'const cfg = {\n  token: credentials.token,\n  apiKey: settings.apiKey,\n};\n' });
     expect(f.secrets().status).toBe('pass');

test/redact-context-exemptions.test.ts

@@ -106,6 +106,29 @@ describe("env.kv: a function call assigned to a credential name is code (#2899)"
   );
 });
 
+describe("env.kv: a name-shaped literal inside a call is a file or dict key, not a secret (GST-1064)", () => {
+  const FAKE_KEY = "Zx9Qw8Er7Ty6Ui5Op4As3Df2";
+  const FAKE_STRIPE_TAIL = "4eC39HqLyjWDarjtT1zdp7dc";
+  table(
+    "env.kv",
+    "MEDIUM",
+    [
+      String.raw`key = json.loads(files.get("key.json", ""))`,
+      String.raw`token = resp.json().get("access_token")`,
+      String.raw`    session = store.load('session.cookie')`,
+      String.raw`password = os.getenv("DB_PASSWORD", "change-me-later")`,
+    ],
+    [
+      String.raw`key = "${FAKE_KEY}"`,
+      String.raw`KEY=${FAKE_KEY}`,
+      String.raw`key = json.loads("sk_live_${FAKE_STRIPE_TAIL}")`,
+      String.raw`token = resp.json().get("access_token", "${FAKE_KEY}")`,
+      String.raw`password = os.getenv("DB_PASSWORD", "hunter2.Zx9Qw8")`,
+      String.raw`key = json.loads(files.get("key.json")) or "${FAKE_KEY}"`,
+    ],
+  );
+});
+
 describe("internal.hostname: per-machine config filenames are not hosts (#2962, #2740)", () => {
   table(
     "internal.hostname",