Description

decodeDataUrl in packages/opencode/src/util/data-url.ts decodes non-base64 data: URLs with decodeURIComponent(body). When the body contains an unescaped % (for example file text such as 50% off), decodeURIComponent throws URIError: URI malformed, and the error is uncaught.

This helper runs during prompt assembly (session/prompt.ts, text/plain parts) and ACP content conversion, on data: URLs that can originate from external sources such as MCP resources and plugins. A single malformed URL therefore crashes the whole request instead of degrading gracefully. Base64 data URLs and correctly percent-encoded bodies are unaffected.

Plugins

None

OpenCode version

dev (appears to affect all versions)

Steps to reproduce

1. Have a non-base64 text/plain data URL with a literal % get processed (e.g. an MCP resource or attachment whose body is data:text/plain,100%off).
2. Send a prompt that includes it.
3. The request fails with URIError: URI malformed.

Minimal helper repro:

bun -e 'const {decodeDataUrl}=await import("./packages/opencode/src/util/data-url.ts"); decodeDataUrl("data:text/plain,100%off")'
# URIError: URI malformed

Screenshot and/or share link

N/A

Operating System

Any

Terminal

Any