fix(opencode): sanitize preview database filenames (#16430)

2 files changed, 19 insertions, 5 deletions

diff --git a/packages/opencode/src/storage/db.ts b/packages/opencode/src/storage/db.ts
index d7538dc70..d6f8b2ab5 100644
--- a/packages/opencode/src/storage/db.ts
+++ b/packages/opencode/src/storage/db.ts
@@ -27,12 +27,14 @@ export const NotFoundError = NamedError.create(
 const log = Log.create({ service: "db" })
 
 export namespace Database {
+  export function file(channel: string) {
+    if (channel === "latest" || Flag.OPENCODE_DISABLE_CHANNEL_DB) return "opencode.db"
+    const safe = channel.replace(/[^a-zA-Z0-9._-]/g, "-")
+    return `opencode-${safe}.db`
+  }
+
   export const Path = (() => {
-    const name =
-      Installation.CHANNEL !== "latest" && !Flag.OPENCODE_DISABLE_CHANNEL_DB
-        ? `opencode-${Installation.CHANNEL}.db`
-        : "opencode.db"
-    return path.join(Global.Path.data, name)
+    return path.join(Global.Path.data, file(Installation.CHANNEL))
   })()
 
   type Schema = typeof schema
diff --git a/packages/opencode/test/storage/db.test.ts b/packages/opencode/test/storage/db.test.ts
new file mode 100644
index 000000000..47908e281
--- /dev/null
+++ b/packages/opencode/test/storage/db.test.ts
@@ -0,0 +1,12 @@
+import { describe, expect, test } from "bun:test"
+import { Database } from "../../src/storage/db"
+
+describe("Database.file", () => {
+  test("uses the shared database for latest", () => {
+    expect(Database.file("latest")).toBe("opencode.db")
+  })
+
+  test("sanitizes preview channels for filenames", () => {
+    expect(Database.file("fix/windows-modified-files-tracking")).toBe("opencode-fix-windows-modified-files-tracking.db")
+  })
+})