Skip to content

fix(opencode): escape {env:} substitutions to keep config JSON valid#32786

Open
ozpool wants to merge 1 commit into
anomalyco:devfrom
ozpool:env-var-escape
Open

fix(opencode): escape {env:} substitutions to keep config JSON valid#32786
ozpool wants to merge 1 commit into
anomalyco:devfrom
ozpool:env-var-escape

Conversation

@ozpool

@ozpool ozpool commented Jun 18, 2026

Copy link
Copy Markdown

Issue for this PR

Closes #32695

Type of change

  • Bug fix
  • New feature
  • Refactor / code improvement
  • Documentation

What does this PR do?

{env:VAR} substitution in config text inserted the raw environment value directly into the JSON source before parsing. When the value contains characters that are significant inside a JSON string — most commonly backslashes in a native Windows path (C:\Users\me\...), but also quotes or newlines — the result was invalid JSON and the config failed to load on startup.

The sibling {file:...} substitution in the same function already guards against this by emitting JSON.stringify(content).slice(1, -1). This change applies the same escaping to the {env:VAR} value so the substituted string is always valid inside its surrounding JSON string. Plain values (tokens, usernames, URLs) are unaffected since escaping a string with no special characters returns it unchanged.

How did you verify your code works?

Added a unit test in packages/opencode/test/config/config.test.ts that sets an env var to a Windows-style path containing backslashes, references it via {env:VAR}, and asserts the config loads with the value intact. The test fails on the previous code (config parse error) and passes with the fix. bun test test/config/config.test.ts, tsgo --noEmit for the package, and Prettier all pass.

Screenshots / recordings

Not a UI change.

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

Env var substitution injected the raw value into the config text before
parsing, so a value containing backslashes (e.g. a native Windows path)
or quotes produced invalid JSON and failed to load. Mirror the {file:}
branch and JSON-escape the substituted value.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

{env:VAR} in permission keys expands to native Windows backslashes, producing invalid JSON on Windows

1 participant