fix(logs): match copilot log-grep patterns with RE2 (linear time) (#5987)

* fix(logs): match copilot log-grep patterns literally, never as a regex

`grepSpans` compiled a caller-supplied pattern with a bare `new RegExp`, whose
only guard was a `catch` for syntax errors. Trace text is attacker-influenced —
a workflow can emit arbitrarily long uniform runs into its own block outputs —
and matching runs synchronously on the shared event loop, so an authenticated
caller could choose both the pattern and the input and stall every request on
the instance.

Patterns are now matched as an escaped, case-insensitive literal. Screening was
implemented first and abandoned, because each rule only excludes the shapes
someone thought to enumerate:

- `safe-regex2` (already used by the guardrails validator) documents itself as
  having false negatives. It screens star height only, so it passes `(a|a)*b`,
  measured >61s on V8 at 30 characters.
- Rejecting quantified groups on top of that catches `(a|a)*b`, and every
  attack `safe-regex2` catches, but still passes `a*a*b` — adjacent quantifiers
  over overlapping character sets — measured 213s on JSC and 132s on V8 over a
  10k-character run, well inside what a block output can hold.

An escaped literal is linear on every engine, needs no dependency, and does not
depend on which runtime serves the request. `safe-regex2` stays a dependency for
its existing guardrails/PII callers; it is simply not relied on here.

`query_logs` loses regex matching. Its catalog entry describes `pattern` as
"greps" rather than promising regex, but it is generated from a contract in
another repository and cannot be updated here, so a `patternNotice` is returned
whenever a pattern contains regex syntax — the caller is told the pattern was
taken literally instead of reading zero matches as "not in the trace".

Two bounds are kept as backstops: a cumulative match-time budget charging only
time inside `test`/`exec` (never the blob-store reads the scan awaits between
matches, which would truncate slow-but-legitimate greps under load), and a
total scanned-character cap.

* improvement(logs): only flag genuine regex intent, document the truncated invariant

Review follow-ups on the literal log-grep.

The `patternNotice` fired on any regex metacharacter, which includes `.` — so
ordinary literal searches (`example.com`, `file.pdf`, `v1.2.3`,
`block_1.output`) were told their pattern "was not interpreted as a regex",
inviting the agent to retry a search that had in fact worked. Measured 10 false
notices across 19 realistic literal searches. `REGEX_INTENT` now keys on actual
regex intent — escape classes, character class, group, alternation, a
leading/trailing anchor, or a repetition quantifier — which drops that to 0/19
while still flagging all 10 regex attempts tested.

`truncated` gains a TSDoc block stating its invariant: it reports that trace was
left unread, not that a budget was reached. Every point that skips work goes
through `done()`, which sets it, so a budget exhausted by the final match
correctly reports `false`. Raised by Cursor Bugbot; behavior is right, the
contract was just implicit.

Also drops `snippetAround`'s `maxChars` parameter, which every caller passed
from the state object it already receives.

* fix(logs): match log-grep patterns with RE2 instead of dropping regex support

Restores full regex support on copilot log-grep, which the previous commits in
this PR had removed to close the ReDoS. Deleting the capability was the wrong
trade: RE2JS is a port of RE2 that matches in time linear in the input, so no
pattern can blow up regardless of the text, and callers keep their regexes.

Measured through the real compile path, against a 100k-character adversarial
input — 10x the run that took 213s on JSC / 132s on V8:

  (a+)+$      13.0ms      (\w+\s?)*$   10.7ms
  (a|a)*b      6.7ms      (x+x+)+y      4.0ms
  a*a*b        8.1ms      ^(\d+)*$      0.0ms

Two escape hatches keep this honest:

- A pattern with no regex metacharacter takes the built-in engine. Semantics are
  identical when there is nothing to interpret, and RE2JS costs ~100x more per
  byte (~25ms/MB), so the common plain-text search stays native.
- Lookaround and backreferences are not in RE2. RE2JS rejects them at compile
  time, so those fall back to a literal and return a `patternNotice` naming the
  constructs — a narrow, reported gap rather than a silent behavior change.

The match-time and scanned-character budgets stop being formalities: RE2JS's
throughput is what they now bound, not backtracking.

Also collapses the old test-then-exec double scan — `compilePattern` returns a
single `find` returning a match index, which `recordIfMatch` passes straight to
`snippetAround`, so each field is scanned once instead of twice.

re2js@2.8.6 is MIT, pure JavaScript (no native addon, so nothing changes for the
oven/bun image), server-only, and published 2026-07-05 — clearing the 7-day
bunfig minimumReleaseAge gate without an exclusion.

* fix(security): route every caller-supplied regex through the linear-time engine

Extends the RE2 fix to the three other places that compiled a caller-supplied
pattern and ran it on the shared event loop, behind one shared helper —
`lib/core/security/linear-regex.ts` — rather than four local copies.

- `lib/copilot/vfs/operations.ts` — copilot VFS grep took a caller pattern over
  caller-supplied file content with no screen at all.
- `lib/guardrails/validate_regex.ts` (`validateRegex`) — a guardrail rule's
  pattern matched against LLM output, screened only by `safe-regex2`.
- `lib/chunkers/regex-chunker.ts` — the KB chunker's split pattern. This one
  screened for catastrophic backtracking by running the pattern against six
  probes including `'a'.repeat(10000)` and rejecting anything over 50ms — but
  it measured elapsed time *after* the match returned, so the screen was the
  denial of service it existed to prevent (`a*a*b` on that probe: 213s). The
  probe is deleted rather than repaired.

Deliberately unchanged: `validateRegexPattern`. Those patterns are persisted for
Presidio, a separate service where a slow pattern times out instead of stalling
this loop, and Presidio's Python engine accepts constructs RE2 does not — so
narrowing it to the RE2 subset would reject patterns that work. Its TSDoc now
says plainly that its `safe-regex2` screen is a courtesy, not a ReDoS defense,
and points in-process callers at `compileLinearRegex`. `safe-regex2` therefore
stays a dependency, used only there.

Lookaround is the standard way to split while keeping the delimiter (`(?=#\s)`)
and RE2 cannot represent it, so the chunker keeps the built-in engine for those
patterns — the only remaining path that can backtrack, bounded by the existing
500-character cap. RE2JS `split` was verified identical to `String.split` across
six representative chunking patterns.

Adds 27 tests for the shared helper (every catastrophic pattern asserted linear
over a 50k-character input) plus regression tests at each site, plus the first
tests for `validateRegex`. Also removes the now-duplicated `escapeRegExp` and
literal-finder locals from `log-views.ts`.

* fix(security): drop safe-regex2, keep lookaround splits on the linear engine

Audit follow-ups, plus the Cursor round-4 finding.

Removes `safe-regex2` entirely. Its last caller was `validateRegexPattern`, the
PII custom-pattern boundary, where it was pure cost: it screens star height
alone and passes `(a|a)*b` and `a*a*b`, while rejecting patterns that work —
lookbehind and optional groups could not be saved as custom PII rules at all.
Nor could any screen be sound there: those patterns execute in Presidio's Python
engine, which backtracks on shapes RE2 accepts, so RE2-representability says
nothing about their runtime. Validation is now syntax-only and the dependency is
gone.

Cursor flagged the chunker's lookaround fallback as reintroducing backtracking,
which was correct. The fallback is removed. Verified first that no bounded probe
can replace it: at a probe size small enough to survive an exponential pattern
(24 chars), `(?=a*a*b)` completes in 0.0ms and passes, because polynomial blowup
only shows on long input — small probes miss it and large probes hang, the same
trap as the original guard.

Instead `compileLookaroundSplit` puts the two idioms that actually need
lookaround onto RE2: splitting on `(?=X)` is slicing at every match start of X,
and on `(?<=X)` at every match end, neither of which needs the assertion. Both
`(?=#\s)` and the pre-existing `(?<=</section>)` case keep working, now in
linear time; anything else RE2 cannot represent is rejected with an actionable
message rather than run on the backtracking engine.

Also from the audit:

- `literalRegex` recompiled its `RegExp` on every call to dodge `lastIndex`
  state from the `g` flag. VFS grep calls it per line, so that was a compile per
  line. It now keeps one non-global instance for `test`/`find` and a global one
  for `split`.
- `validateRegex` and VFS grep log a warning when a pattern degrades. A
  guardrail rule that used lookaround now fails closed, which reads as the
  guardrail tripping on every input, and VFS grep's return shape has nowhere to
  report that a pattern was taken literally — both need to be findable in logs.

Measured: RE2 costs 6-13x native on per-line matching (20k-line, 1.66MB file
greps in 7ms), against ~100x on single multi-megabyte strings.

* test(pii): drop the custom-pattern editor's backtracking-screen assertion

CI caught this; my local runs only covered `lib/**` and missed the `.tsx`
counterpart of removing `safe-regex2`.

The editor asserted that `(a+)+$` renders "potentially unsafe". That screen is
gone, so the assertion is inverted: the test now pins that `(a+)+$`, lookbehind
and optional groups all render cleanly, which is the point of the removal —
they are valid Presidio patterns that could not be saved before. Syntactically
invalid patterns still surface "Invalid regex".

* fix(chunkers): support lookaround with an affix, and keep JS whitespace semantics

Three independent reviewers with no shared context audited the RE2 migration.
Two found the same high-severity regression, and one found the divergence that
silently rewrites stored data. Both are fixed here.

**Lookaround with an affix threw.** `compileLookaroundSplit` only accepted a
pattern that was *entirely* one assertion, so `(?<=\.)\s+` — split after the
period — and `(?<=[.!?])\s+(?=[A-Z])` — the textbook sentence splitter — fell
through to the chunker's `throw`. Those are persisted KB configs, and the
compile runs in the constructor, so an existing knowledge base would stop
re-ingesting with a hard error. The TSDoc claiming the bare assertions "cover
the reason a split pattern reaches for lookaround" was simply wrong.

Fixed generally rather than by adding another special case: splitting never
needs the assertion, only the span the delimiter consumes, so `(?<=X)Y(?=Z)`
compiles to `(?:X)(Y)(?:Z)` and group 1's span is exactly what `String.split`
removes. One rule now covers every combination, and the four shapes above match
`String.prototype.split` output exactly.

**`\s` silently lost 14 codepoints.** RE2's `\s` is ASCII-only; ECMAScript's
also covers `\v`, NBSP, U+2028/9, U+202F, U+3000, U+FEFF and the rest of
`\p{Zs}`. A reviewer measured 9 of 35 realistic pattern/document pairs chunking
differently through the real `RegexChunker` — NBSP from PDF/DOCX/HTML
extraction, U+3000 in CJK, U+202F in French text. That rewrites stored chunk
boundaries and embeddings for a document that never changed, with nothing
thrown and nothing logged. `translateToRe2` now rewrites `\s`/`\S` to the
verified-equivalent RE2 class, and `\uXXXX` to `\x{XXXX}` (RE2 rejects the
former outright, turning a non-ASCII delimiter into a hard failure).

Also from the audit:

- `truncated`'s new TSDoc asserted an invariant the code violates — reaching
  `maxMatches` sets it even when nothing was left unread. Reworded to what it
  actually means.
- The chunker's rejection message blamed "backreferences and lookaround" for
  repeat-count and `\uXXXX` rejections too.
- `escapeRegExp` was a byte-identical copy of `executor/constants.ts:472` and
  exported for nobody; now module-private.
- The guardrails wand prompt told the LLM to emit "valid JavaScript regex",
  which reliably produces `(?=.*\d)`-style patterns that now fail every check.
- The PII editor's TSDoc still described the removed backtracking screen.
- VFS grep's TSDoc omitted that invalid patterns now match literally.

Test gaps the audit exposed: the match-time budget's only mechanism was
unguarded (deleting the accumulation left every test green) — now covered by a
mutation-verified test; the escape test survived dropping `.` from the class;
the split-parity test dodged the one real divergence; and two test names
described the built-in engine that no longer runs.

* fix(security): correct three defects in the lookaround split decomposition

A fourth reviewer, given no context beyond "these scanners are new and
unreviewed", differential-tested them against the built-in engine over ~62k
comparisons and found three real defects in code added an hour earlier. All
were reachable through RegexChunker with plausible patterns, and all silently
produced different chunks rather than failing.

1. **Top-level alternation was reshaped into a different pattern.**
   `(?<=\.)\s+|\n\n` means `((?<=\.)\s+)|(\n\n)`, but decomposing it produced
   `(?:\.)(\s+|\n\n)` — demanding the period before *both* branches. It could
   lose boundaries (`"Heading\n\nAlpha beta.\nGamma delta."` split in 2, not 3)
   and invent them. No grouping recovers the original meaning, so patterns whose
   middle alternates at the top level are now declined outright, which also
   removes an asymmetry: `\n\n|(?<=\.)\s` already threw.

2. **A capturing group inside the lookbehind stole group 1.** `(?<=(a))b` cut at
   the assertion instead of the delimiter, and where the group did not
   participate `start(1)` was -1, so `find` and `test` contradicted each other.
   The middle is now captured by name, immune to numbering.

3. **Consuming the assertion text swallowed every other boundary.** The compiled
   form matched `behind + middle + ahead`, so any boundary whose lookahead
   doubles as the next one's lookbehind was skipped: `(?<=\w)\s+(?=[A-Z])` over
   `"A B C D"` split 2 of 3 gaps. Each iteration now resumes at the end of the
   delimiter rather than the end of the match. This was documented as affecting
   only self-overlapping delimiters; that was wrong and far too narrow.

The reviewer confirmed `translateToRe2` and `closingParen` clean across
exhaustive escape-state, character-class, and paren-matching probes, and that
nothing added is superlinear.

One divergence remains and is now documented rather than overstated: when
delimiters themselves overlap (a single-character middle whose matches abut, as
in `(?<=\w).(?=\w)`), a match starting behind the cursor is dropped instead of
emitting the empty segment the built-in engine produces. Splitters that consume
whitespace or punctuation between tokens do not overlap and match exactly.

* test(security): pin engine parity with a differential suite

Every defect in this module has been a silent semantic divergence rather than a
crash, and each was found by comparing engines over a corpus in a throwaway
script. That comparison now lives in the suite: ~700 pattern/document pairs plus
match/index/ignore-case parity, checked against the built-in engine on every
run, with the accepted divergences enumerated and individually pinned.

It earned its place immediately by falsifying my own documentation. The
"self-overlapping delimiter" caveat was stale — fixing the boundary-advance in
the previous commit also made `(?=#{1,6}\s)`, `(?=aa)` and `(?=##)` exact, so
the entry asserting they still diverge failed. One real divergence remains and
is now stated precisely: a lookbehind whose body self-overlaps (`(?<=aa)` over
`aaaaa`). Making that exact means restarting the scan one character past each
match start, which is quadratic on a multi-megabyte document and forfeits the
linear guarantee — so it is a deliberate trade, not an oversight.

Mutation-verified against the three bugs that actually escaped review:
disabling the `\s` translation fails 12 tests, changing the boundary-advance
fails 2, and removing the top-level-alternation guard fails 3. That last one
initially passed, because the corpus had no alternation pattern in it — the gap
is closed and the mutation now fails as it should.

Author: waleedlatif1

apps/sim/blocks/blocks/guardrails.ts

@@ -76,7 +76,11 @@ export const GuardrailsBlock: BlockConfig<GuardrailsResponse> = {
         enabled: true,
         prompt: `Generate a regular expression pattern based on the user's description.
 The regex should be:
-- Valid JavaScript regex syntax
+- Valid RE2 syntax: no lookahead ((?=...), (?!...)), no lookbehind ((?<=...), (?<!...)),
+  no backreferences (\\1), and no \\uXXXX escapes (use \\x41 or the literal character).
+  Patterns are matched by a linear-time engine that does not implement these, and one
+  that uses them fails every check. To express "must NOT contain X", match X and invert
+  the result downstream with a Condition block instead of using negative lookahead.
 - Properly escaped for special characters
 - Optimized for the use case
 

apps/sim/components/pii/custom-patterns-editor.test.tsx

@@ -49,10 +49,18 @@ describe('CustomPatternsEditor', () => {
     expect(container.textContent).toMatch(/Invalid regex/)
   })
 
-  it('shows an inline error for a catastrophic-backtracking pattern', () => {
-    renderEditor([row('(a+)+$')], vi.fn())
-    expect(container.textContent).toMatch(/potentially unsafe/)
-  })
+  it.each(['(a+)+$', '(?<=id: )\\w+', '(?:https?://)?example\\.com'])(
+    'accepts %s, which the removed safe-regex2 screen rejected',
+    (pattern) => {
+      // The editor no longer runs a catastrophic-backtracking screen. It caught
+      // `(a+)+$` but passed `a*a*b`, so it deterred only the obvious spelling
+      // while blocking valid Presidio patterns like lookbehind. These patterns
+      // run in Presidio, not in this process.
+      renderEditor([row(pattern)], vi.fn())
+      expect(container.textContent).not.toMatch(/potentially unsafe/)
+      expect(container.textContent).not.toMatch(/Invalid regex/)
+    }
+  )
 
   it('appends an empty row when "Add pattern" is clicked', () => {
     const onChange = vi.fn()

apps/sim/components/pii/custom-patterns-editor.tsx

@@ -15,9 +15,13 @@ interface CustomPatternsEditorProps {
 
 /**
  * Editor for user-supplied custom regex patterns. Each row is a name label, the
- * regex (validated inline for syntax + catastrophic-backtracking safety), and the
- * verbatim replacement token that matches are redacted to. Shared by the Data
- * Retention settings and any other PII-policy surface.
+ * regex (validated inline for syntax only), and the verbatim replacement token
+ * that matches are redacted to. Shared by the Data Retention settings and any
+ * other PII-policy surface.
+ *
+ * Syntax is the only check because these patterns execute in Presidio, not in
+ * this process — see `validateRegexPattern` for why a backtracking screen here
+ * was removed rather than kept.
  */
 export function CustomPatternsEditor({ patterns, onChange }: CustomPatternsEditorProps) {
   function updateRow(index: number, patch: Partial<CustomPiiPattern>) {

apps/sim/lib/api/contracts/primitives.test.ts

@@ -35,10 +35,22 @@ describe('customPatternSchema', () => {
     }
   })
 
-  it('rejects a catastrophic-backtracking regex at the boundary', () => {
-    expect(
-      customPatternSchema.safeParse({ name: 'evil', regex: '(a+)+$', replacement: '' }).success
-    ).toBe(false)
+  it('no longer screens for catastrophic backtracking, which never worked here', () => {
+    // This used to reject `(a+)+$` via `safe-regex2`. The screen was removed:
+    // it caught that shape but passed `a*a*b`, which is just as catastrophic,
+    // so it only ever deterred the obvious spelling of a misconfiguration a
+    // user can inflict on their own workspace. It also rejected valid patterns
+    // (lookbehind, optional groups) that Presidio accepts.
+    //
+    // These patterns run in Presidio, not in this process, so they cannot
+    // stall this event loop; Presidio's own timeout is the bound. In-process
+    // matching uses `compileLinearRegex`, which cannot backtrack at all.
+    for (const regex of ['(a+)+$', 'a*a*b', '(?<=id: )\\w+']) {
+      expect(
+        customPatternSchema.safeParse({ name: 'p', regex, replacement: '' }).success,
+        `pattern ${regex} should be accepted`
+      ).toBe(true)
+    }
   })
 })
 

apps/sim/lib/chunkers/regex-chunker.test.ts

@@ -387,5 +387,39 @@ describe('RegexChunker', () => {
         )
       }
     })
+    it.concurrent(
+      'chunks with a catastrophic pattern without hanging',
+      async () => {
+        // `a*a*b` defeats every syntactic backtracking screen. The previous
+        // guard probed it against 'a'.repeat(10000) and measured the elapsed
+        // time only after the match returned, so the guard itself hung for
+        // ~213s. RE2 has no backtracking, so this simply completes.
+        const chunker = new RegexChunker({ pattern: 'a*a*b', chunkSize: 100, chunkOverlap: 0 })
+
+        const start = Date.now()
+        await chunker.chunk(`${'a'.repeat(10000)}!`)
+
+        expect(Date.now() - start).toBeLessThan(2000)
+      },
+      10000
+    )
+
+    it.concurrent('still supports lookahead split patterns', async () => {
+      // RE2 has no lookaround; compileLookaroundSplit expresses this as slicing
+      // at each match start, so the idiom keeps working on the linear engine.
+      // (No `m` flag is applied, so anchor the lookahead on the delimiter
+      // itself rather than on `^`.)
+      const chunker = new RegexChunker({
+        pattern: '(?=#\\s)',
+        chunkSize: 1024,
+        chunkOverlap: 0,
+        strictBoundaries: true,
+      })
+      const chunks = await chunker.chunk('# One\nalpha\n# Two\nbeta')
+
+      expect(chunks.length).toBe(2)
+      expect(chunks[0].text).toContain('# One')
+      expect(chunks[1].text).toContain('# Two')
+    })
   })
 })

apps/sim/lib/chunkers/regex-chunker.ts

@@ -10,6 +10,11 @@ import {
   splitAtWordBoundaries,
   tokensToChars,
 } from '@/lib/chunkers/utils'
+import {
+  compileLinearRegex,
+  compileLookaroundSplit,
+  type LinearRegex,
+} from '@/lib/core/security/linear-regex'
 
 const logger = createLogger('RegexChunker')
 
@@ -56,7 +61,7 @@ function toNonCapturing(pattern: string): string {
 export class RegexChunker {
   private readonly chunkSize: number
   private readonly chunkOverlap: number
-  private readonly regex: RegExp
+  private readonly regex: LinearRegex
   private readonly strictBoundaries: boolean
 
   constructor(options: RegexChunkerOptions) {
@@ -67,7 +72,24 @@ export class RegexChunker {
     this.strictBoundaries = options.strictBoundaries ?? false
   }
 
-  private compilePattern(pattern: string): RegExp {
+  /**
+   * Compile the caller's split pattern on an engine that cannot backtrack.
+   *
+   * This previously screened for catastrophic backtracking by running the
+   * pattern against six probe strings — including `'a'.repeat(10000)` — and
+   * rejecting anything slower than 50ms. It measured the elapsed time *after*
+   * the match returned, so the screen was the denial of service it existed to
+   * prevent: `a*a*b` against that probe measured 213s on JSC. RE2 removes the
+   * failure mode outright, so the probe is gone rather than repaired.
+   *
+   * Keeping the delimiter — `(?=X)` before a chunk, `(?<=X)` after one — is the
+   * reason a split pattern reaches for lookaround, and `compileLookaroundSplit`
+   * runs both on RE2 without it. Anything else RE2 cannot represent is rejected
+   * rather than run on the built-in engine: no probe can tell a safe pattern
+   * from an unsafe one without running it, which is what made the old guard
+   * hang, so there is nothing to fall back *to*.
+   */
+  private compilePattern(pattern: string): LinearRegex {
     if (!pattern) {
       throw new Error('Regex pattern is required')
     }
@@ -77,34 +99,18 @@ export class RegexChunker {
     }
 
     try {
-      const regex = new RegExp(toNonCapturing(pattern), 'g')
-
-      const testStrings = [
-        'a'.repeat(10000),
-        ' '.repeat(10000),
-        'a '.repeat(5000),
-        'aB1 xY2\n'.repeat(1250),
-        `${'a'.repeat(30)}!`,
-        `${'a b '.repeat(25)}!`,
-      ]
-      for (const testStr of testStrings) {
-        regex.lastIndex = 0
-        const start = Date.now()
-        regex.test(testStr)
-        const elapsed = Date.now() - start
-        if (elapsed > 50) {
-          throw new Error('Regex pattern appears to have catastrophic backtracking')
-        }
-      }
-
-      regex.lastIndex = 0
-      return regex
+      new RegExp(pattern)
     } catch (error) {
-      if (error instanceof Error && error.message.includes('catastrophic')) {
-        throw error
-      }
       throw new Error(`Invalid regex pattern "${pattern}": ${toError(error).message}`)
     }
+
+    const source = toNonCapturing(pattern)
+    const compiled = compileLinearRegex(source) ?? compileLookaroundSplit(source)
+    if (compiled) return compiled
+
+    throw new Error(
+      `Regex pattern "${pattern}" uses syntax that cannot be evaluated safely. Unsupported: negative lookaround ("(?!...)", "(?<!...)"), backreferences, and repeat counts above 1000. Positive lookaround is supported — "(?=X)" splits before a delimiter, "(?<=X)" after one, and "(?<=X)Y(?=Z)" consumes Y between them.`
+    )
   }
 
   async chunk(content: string): Promise<Chunk[]> {
@@ -119,8 +125,7 @@ export class RegexChunker {
       return buildChunks([cleaned], 0)
     }
 
-    this.regex.lastIndex = 0
-    const segments = cleaned.split(this.regex).filter((s) => s.trim().length > 0)
+    const segments = this.regex.split(cleaned).filter((s) => s.trim().length > 0)
 
     if (segments.length <= 1) {
       if (this.strictBoundaries) {

apps/sim/lib/copilot/tools/server/workflow/query-logs.ts

@@ -145,12 +145,17 @@ export const queryLogsServerTool: BaseServerTool<QueryLogsArgs, unknown> = {
 
     if (args.pattern) {
       logger.info('query_logs grep', { workspaceId, executionId: args.executionId })
-      const { matches, truncated } = await grepSpans(traceSpans, args.pattern, viewCtx)
+      const { matches, truncated, patternNotice } = await grepSpans(
+        traceSpans,
+        args.pattern,
+        viewCtx
+      )
       return {
         executionId: detail.executionId,
         workflowId: detail.workflowId,
         status: detail.status,
         pattern: args.pattern,
+        ...(patternNotice ? { patternNotice } : {}),
         matches,
         truncated,
       }

apps/sim/lib/copilot/vfs/operations.test.ts

@@ -138,3 +138,35 @@ describe('grep', () => {
     expect(hits).toHaveLength(1)
   })
 })
+
+describe('grep regex safety', () => {
+  it('runs a catastrophic pattern in linear time', () => {
+    // `a*a*b` takes minutes on a backtracking engine against this content;
+    // both the pattern and the file content are caller-supplied.
+    const files = vfsFromEntries([['notes.md', `${'a'.repeat(10000)}!`]])
+
+    const start = Date.now()
+    grep(files, 'a*a*b')
+
+    expect(Date.now() - start).toBeLessThan(2000)
+  })
+
+  it('still interprets regex syntax', () => {
+    const files = vfsFromEntries([['log.txt', 'req finished status=503']])
+    expect(grep(files, 'status=\\d+')).toHaveLength(1)
+    expect(grep(files, 'status=\\d+', undefined, { outputMode: 'count' })).toEqual([
+      { path: 'log.txt', count: 1 },
+    ])
+  })
+
+  it('matches syntax RE2 cannot represent literally instead of not at all', () => {
+    const files = vfsFromEntries([['log.txt', 'contains (?=x) verbatim']])
+    expect(grep(files, '(?=x)')).toHaveLength(1)
+  })
+
+  it('honours ignoreCase across repeated line tests', () => {
+    const files = vfsFromEntries([['log.txt', 'Alpha\nALPHA\nalpha']])
+    expect(grep(files, 'alpha', undefined, { ignoreCase: true })).toHaveLength(3)
+    expect(grep(files, 'alpha')).toHaveLength(1)
+  })
+})

apps/sim/lib/copilot/vfs/operations.ts

@@ -1,4 +1,13 @@
+import { createLogger } from '@sim/logger'
 import micromatch from 'micromatch'
+import {
+  compileLinearRegex,
+  isPlainText,
+  type LinearRegex,
+  literalRegex,
+} from '@/lib/core/security/linear-regex'
+
+const logger = createLogger('VfsOperations')
 
 export interface GrepMatch {
   path: string
@@ -125,7 +134,16 @@ export function pathWithinGrepScope(filePath: string, scope: string): boolean {
 }
 
 /**
- * Regex search over VFS file contents using ECMAScript `RegExp` syntax.
+ * Regex search over VFS file contents using RE2 syntax — a subset of
+ * ECMAScript `RegExp` (see `@/lib/core/security/linear-regex`).
+ *
+ * A pattern RE2 cannot represent — negative lookaround, backreferences — is
+ * matched as a literal instead of on the backtracking engine, as is a pattern
+ * that does not compile at all (which previously returned no results). Both
+ * cases log a warning: the return shape carries results only, so there is
+ * nowhere to tell the caller inline, and a literal fallback can match the
+ * pattern's own text when grepping source that contains regexes.
+ *
  * `content` and `count` are line-oriented (split on newline, CR stripped per line).
  * `files_with_matches` tests the entire file string once, so multiline patterns can match there
  * but not in line modes.
@@ -142,19 +160,27 @@ export function grep(
   const showLineNumbers = opts?.lineNumbers ?? true
   const contextLines = opts?.context ?? 0
 
-  const flags = ignoreCase ? 'gi' : 'g'
-  let regex: RegExp
-  try {
-    regex = new RegExp(pattern, flags)
-  } catch {
-    return []
+  // Caller-supplied pattern over caller-supplied file content on the shared
+  // event loop — matched by RE2 so it cannot backtrack. Syntax RE2 cannot
+  // represent degrades to a literal rather than to the backtracking engine.
+  let regex: LinearRegex
+  if (isPlainText(pattern)) {
+    regex = literalRegex(pattern, { ignoreCase })
+  } else {
+    const linear = compileLinearRegex(pattern, { ignoreCase })
+    if (!linear) {
+      // The return shape carries results only, so the caller cannot be told
+      // inline that its regex was taken literally — log it, since silently
+      // returning "no matches" reads as "not in the file".
+      logger.warn('Grep pattern is not RE2-representable; matching it literally', { pattern })
+    }
+    regex = linear ?? literalRegex(pattern, { ignoreCase })
   }
 
   if (outputMode === 'files_with_matches') {
     const matchingFiles: string[] = []
     for (const [filePath, content] of files) {
       if (path && !pathWithinGrepScope(filePath, path)) continue
-      regex.lastIndex = 0
       if (regex.test(content)) {
         matchingFiles.push(filePath)
         if (matchingFiles.length >= maxResults) break
@@ -170,7 +196,6 @@ export function grep(
       const lines = splitLinesForGrep(content)
       let count = 0
       for (const line of lines) {
-        regex.lastIndex = 0
         if (regex.test(line)) count++
       }
       if (count > 0) {
@@ -188,7 +213,6 @@ export function grep(
 
     const lines = splitLinesForGrep(content)
     for (let i = 0; i < lines.length; i++) {
-      regex.lastIndex = 0
       if (regex.test(lines[i])) {
         if (contextLines > 0) {
           const start = Math.max(0, i - contextLines)