[BUG] opencode-push install may corrupt JSONC config files

[kiosvantra]

Bug: opencode-push install Corrupts JSONC Config Files

Severity: Medium
Component: opencode-push install command

Description

The opencode-push install command writes the plugin entry to OpenCode's config file using standard JSON.stringify instead of a JSONC (JSON with Comments) parser.

OpenCode's config file (opencode.json) typically contains comments for structure and documentation. Using JSON.parse/stringify round-trip destroys these comments.

Evidence

From cmd.js:

// cmd.js line 31-32
const list = merge(cfg.data.plugin ?? [], opts.plugin);
// ...
await write(cfg.src, cfg.text, list);  // Writes back with JSON.stringify

The read() function in config.js uses jsonc-parser to parse the config, but write() does not use it to preserve comments when serializing.

From config.js (read operation uses jsonc-parser):

import { parse } from "jsonc-parser";
const data = parse(text, { tolerance: 100 });  // Parses correctly with jsonc

But write uses standard JSON:

await fs.writeFile(file, JSON.stringify(data, null, 2) + "\n");

Impact

• After running opencode-push install, comments in opencode.json are lost
• Subsequent manual edits to the config become harder (no contextual comments)
• Users may be surprised by the format change

Recommendation

Use jsonc-parser for writing back the config, or at minimum, detect if the original file was JSONC (contains comments) and warn the user before destructive rewrite.

References

• File: dist/src/cmd.js (install function)
• File: dist/src/config.js (read/write functions)