File-mention resolver expands stray "@\" in prompt content to a C:\ drive-root attachment (Windows)

Description

On Windows, OpenCode's server-side prompt file-mention resolver (SessionPrompt.resolvePromptParts) scans the entire prompt text for @ mentions and can resolve a stray @\ byte sequence to the drive root C:\, then attaches the whole drive-root directory listing to the model context.

The mention extractor uses:

FILE_REGEX = /(?<![\w`])@(\.?[^\s`,.]*(?:\.[^\s`,.]+)*)/g

The character class [^\s,.]**includes backslash**, so an@` sequence anywhere in the prompt — including inside a binary blob or a diff that was embedded as text — is captured as mention X = "\". Then, in resolvePromptParts:

// X === "\\"
j = X.startsWith("~/") ? join(homedir(), X.slice(2))
                       : path.resolve(worktree, X);   // path.resolve(worktree, "\\") === "C:\\" on Windows
he = stat(j);                                          // Directory
parts.push({
  type: "file",
  url: "file:///C:/",          // Wy(j).href
  filename: "\\",              // raw mention X
  mime: "application/x-directory",
});

OpenCode then injects a synthetic Called the Read tool with the following input: {"filePath":"C:\\"} plus the full C:\ directory listing into the message. This also fires for subagents whose tools are disabled (e.g. "*": false), which contradicts their tool policy — they never called a tool, yet a Read of C:\ appears in their transcript.

Impact: not a data leak (only top-level directory names are listed), but it wastes context, pollutes prompts, and produces misleading synthetic tool calls. It reproduces deterministically whenever a prompt carries binary/diff payload containing @\.

Steps to reproduce

1. On Windows, send any prompt (or a task-tool subagent prompt) whose text contains the two bytes @\ where @ is not preceded by a word character. Minimal example: a prompt containing foo @\` bar. Any embedded binary/diff payload naturally contains such bytes.
2. Inspect the resulting user message parts. It gains:
   • a file part {"type":"file","url":"file:///C:/","filename":"\\","mime":"application/x-directory"},
   • a synthetic text part Called the Read tool with the following input: {"filePath":"C:\\"},
   • a text part with the full C:\ root directory listing.

OpenCode version

1.18.18

Operating System

Windows 11

Expected behavior

The file-mention resolver should not treat a lone \ (or /) as an attachable mention. A capture whose path.resolve(worktree, X) lands on a filesystem/drive root, or that escapes the worktree (path.relative(worktree, j) starts with .. or is empty), should be rejected. Mention scanning should also avoid matching inside binary payloads / fenced code blocks.

Actual behavior

A lone \ captured by FILE_REGEX resolves to C:\, stats as a directory, and is attached with a synthetic Read of the drive root, injecting the root listing into context.

Evidence

The regex and resolvePromptParts code above were extracted from the shipped 1.18.18 Windows binary. The behavior reproduced identically across 5 independent real sessions (each produced a byte-identical {"url":"file:///C:/","filename":"\\","mime":"application/x-directory"} attachment). Related but distinct code path (TUI autocomplete): #35330.