Summary

applyDiff (worker/agents/output-formats/diff-formats/udiff.ts) applies hunks with:

return content.replace(beforeBlock, afterBlock);

where afterBlock is the LLM-generated replacement code. String.prototype.replace with a string replacement interprets $ sequences specially — $& → the whole match, $$ → $, $`/$'/$1 → surrounding/captured text. So whenever generated code contains those tokens (extremely common in a webapp builder: text.replace(/x/g, '[$&]'), price strings like "$$5", jQuery $$, regex escaping, etc.), the applied diff silently corrupts the file.

applyDiff is the diff applier consumed by scof.ts and re-exported as applyUnifiedDiff, so this affects real generated edits. Three replacement sites are affected (the exact-match, indentation-normalized, and fuzzy-match paths).

Reproduction against the current applyDiff:

input replacement: const label = text.replace(/x/g, '[$&]');
got:               const label = text.replace(/x/g, '[const a = 1;\nconst label = old;\nconst b = 2;]');   // $& expanded to the whole match
input replacement: const price = "$$5";
got:               const price = "$5";                                                                      // $$ collapsed to $

Fix

Pass a replacer function at the three sites so the replacement is inserted verbatim (a function return value is never $-interpreted):

-return content.replace(beforeBlock, afterBlock);
+return content.replace(beforeBlock, () => afterBlock);

(same change for matchedText/replacementText and searchBlock/replaceBlock).

Testing

Added two regression tests to udiff.test.ts ($& and $$ in replacement content). They fail on main (the two new cases) and pass with the fix:

vitest run worker/agents/output-formats/diff-formats/udiff.test.ts
✓ 15 passed | 1 skipped

(All pre-existing udiff tests still pass; the two new cases fail without the fix.)