fix(config): decode JSON string escapes in {file:...} config references

[weiconghe]

Issue for this PR

Closes #51148

Type of change

• Bug fix

What does this PR do?

substitute() (packages/core/src/config/variable.ts) runs on raw JSON(C) config text before parsing and passes the {file:...} body straight to the filesystem without decoding JSON string escapes. In a JSON string value every backslash is doubled, so a UNC path like \\server\share\mcp.json reaches readFileString as \\\\server\\share\\mcp.json and fails with bad file reference ... does not exist. The substituted file content is re-escaped on the way out (JSON.stringify(...).slice(1, -1)), which confirms these tokens live inside JSON strings — the escapes just were not decoded on the way in.

Windows users writing configs through any JSON serializer hit this for every {file:...} reference with a backslash path. Forward-slash paths work, which is why it hides depending on which tool wrote the config.

Fix: after extracting the token body, decode it with JSON.parse, falling back to the raw path when the body is not valid JSON string content (preserving behavior for hand-written configs). All three v2 call sites (loadFile, well-known configs, OPENCODE_CONFIG_CONTENT) substitute pre-parse JSON(C) text, so no opt-in flag is needed. This is the fix from #51163 (closed: it targeted the v1 dev branch) reworked for v2, where the logic was rewritten into packages/core — the v1 version used a flag because the v1 tree also had call sites receiving already-decoded strings; v2 has none.

How did you verify your code works?

New tests in packages/core/test/config/variable.test.ts use a spy FS layer recording the exact path handed to the filesystem:

• UNC and Windows paths written as JSON (\\server\share\..., C:\Users\...) decode before resolution
• plain relative paths still resolve against the config directory
• invalid escape bodies fall back to the raw path
• ~\/ decodes before ~ expansion

Before the fix, the UNC / Windows-path / ~\/ tests fail on the undecoded literal; after, all 5 pass. A real UNC server isn't available locally or in CI, hence the spy layer. bun test test/config/: 207 pass, and the 6 failing tests (home-dir .claude/.agents discovery) fail identically on a clean checkout of v2 — unrelated to this change. Typecheck reports no diagnostics in the touched files.

Screenshots / recordings

N/A (no UI change)

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[github-actions]

The following comment was made by an LLM, it may be inaccurate: