anomalyco / anomalyco/opencode
edit: newString dollar patterns are expanded, silently corrupting files
@nexxeln is already working on this.
Since Aug 28, 2026.
- Dominant language
- TypeScript
- Stars
- 209k
- Forks
- 27.5k
- PR merge metrics
- PR metrics pending
Description
Describe the bug
The edit tool passes the model's newString directly as the replacement string to String.prototype.replace/replaceAll. A string replacement interprets $\&, $```, $', $n, and $$` as special patterns.
So an edit whose replacement contains a dollar pattern silently corrupts the file. $\& and $1/shell positional params / sed``awk snippets and JS template literals are extremely common in code, and the preview patch in the tool result does not show it: the tool reports success and the corruption lands on disk with content the model never wrote.
Steps to reproduce
File contains:
log("done");
Edit: oldString: 'log("done");', newString: 'log("$& ok");'
Expected: log("$& ok");
Actual: log("log("done"); ok"); ($& expanded to the matched text)
Affected code
- V2:
packages/core/src/tool/edit.ts(replaceAllandreplace) - V1:
packages/opencode/src/tool/edit.ts(replaceAllpath only)
Fix is to use a function replacer (() => newString) so the replacement is inserted verbatim.
Environment
- opencode version: latest dev
- OS: any
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.