{env:} substitution breaks on Windows paths due to unescaped backslashes in JSON #35536

Activity

1. github-actions

   assigned

   Hona

   on Jul 6, 2026
2. github-actions commented on Jul 6, 2026

   

   github-actionsBot

   on Jul 6, 2026 – with GitHub Actions

   Contributor

   More actions

   This issue might be a duplicate of an existing issue. Please check:

   • {env:VAR} substitutions break on Windows (backslashes in paths produce InvalidEscapeCharacter) #20640: Same {env:VAR} substitution breaking on Windows with backslash paths causing InvalidEscapeCharacter. That issue was closed with a different proposed fix (forward-slash replacement), but the symptom and affected code path are the same.

   If your issue is distinct from #20640 (e.g., you believe the correct fix is JSON.stringify()-based escaping rather than the slash-replacement workaround), please clarify the difference in this issue so maintainers can evaluate it separately.
3. licat2023 commented on Jul 6, 2026

   

   licat2023

   on Jul 6, 2026

   Author

   More actions

   #20640 was closed by the author as "incorrect root cause attribution" (it cited a non-existent file paths.ts). The corrected issue was never filed, so the bug still exists.

   This report differs in two ways:

   1. Correct file path: the actual code is in packages/opencode/src/config/variable.ts, not paths.ts.

   2. Correct fix: {env:VAR} substitutions break on Windows (backslashes in paths produce InvalidEscapeCharacter) #20640 proposed replaceAll("\", "/") as a fix, but that is a workaround that only papers over the real problem. The right fix is to make {env:} consistent with {file:} — the latter already wraps with JSON.stringify() to escape backslashes properly. The {env:} path should do the same.

   // variable.ts - current (broken)
   text.replace(/\{env:([^}]+)\}/g, (_, v) => process.env[v] || '')
   
   // should be (like {file:} already does)
   text.replace(/\{env:([^}]+)\}/g, (_, v) => JSON.stringify(process.env[v] || '').slice(1, -1))

   The slash-replacement approach would also break cases where a literal backslash is intentional in a non-path context.
4. licat2023 commented on Jul 6, 2026

   

   licat2023

   on Jul 6, 2026

   Author

   More actions

   Duplicate of #32695 — same underlying bug in variable.ts: unescaped {env:} values producing invalid JSON on Windows. #32695 has an open PR with the fix (#32786).
5. licat2023

   closed this as duplicateon Jul 6, 2026