anomalyco / anomalyco/opencode

edit: newString dollar patterns are expanded, silently corrupting files

Open
#45,892 0 comments 0 reactions 1 assignee View on GitHub

@nexxeln is already working on this.

Since Aug 28, 2026.

Dominant language
TypeScript
Stars
209k
Forks
27.5k
PR merge metrics
PR metrics pending

Description

Describe the bug

The edit tool passes the model's newString directly as the replacement string to String.prototype.replace/replaceAll. A string replacement interprets $\&, $```, $', $n, and $$` as special patterns.

So an edit whose replacement contains a dollar pattern silently corrupts the file. $\& and $1/shell positional params / sed``awk snippets and JS template literals are extremely common in code, and the preview patch in the tool result does not show it: the tool reports success and the corruption lands on disk with content the model never wrote.

Steps to reproduce

File contains:

log("done");

Edit: oldString: 'log("done");', newString: 'log("$& ok");'

Expected: log("$& ok");
Actual: log("log("done"); ok"); ($& expanded to the matched text)

Affected code
  • V2: packages/core/src/tool/edit.ts (replaceAll and replace)
  • V1: packages/opencode/src/tool/edit.ts (replaceAll path only)

Fix is to use a function replacer (() => newString) so the replacement is inserted verbatim.

Environment
  • opencode version: latest dev
  • OS: any

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.