@remnic/core 9.3.725 → 9.3.727

package/src/extraction-faithfulness.test.ts

@@ -26,6 +26,7 @@ import type { FaithfulnessResult } from "./extraction-faithfulness.js";
 import type { FallbackLlmClient } from "./fallback-llm.js";
 import type { LocalLlmClient } from "./local-llm.js";
 import type { MemoryFrontmatter } from "./types.js";
+import { callOpenAiCompatibleChat } from "./local-model-endpoint.js";
 
 // ---------------------------------------------------------------------------
 // Helpers — stub LLM clients
@@ -1429,3 +1430,242 @@ test("checkFaithfulnessBatch: local-endpoint failure does NOT leak the local mod
   );
   assert.equal(result.results[0]?.ok, true);
 });
+
+// ---------------------------------------------------------------------------
+// Issue #1700 nits #5 + #6: probe signal forwarding + local parse-fallback
+// ---------------------------------------------------------------------------
+
+test("callOpenAiCompatibleChat: a pre-aborted batch signal aborts the probe immediately, not after timeoutMs (#1700 nit #5)", async () => {
+  // The batch signal is ALREADY aborted when the probe starts. With nit #5 the
+  // probe forwards it and aborts instantly; without it the probe would wait for
+  // its own timeoutMs (5000ms here). Assert the probe returns null fast.
+  const endpoint = { baseUrl: "http://localhost:11434/v1", model: "remnic-faithfulness-gate-v1" };
+  const batchController = new AbortController();
+  batchController.abort();
+  const spy = ((_url: string, init: RequestInit) =>
+    new Promise<Response>((_resolve, reject) => {
+      const sig = init.signal;
+      if (!sig) return reject(new Error("no signal"));
+      if (sig.aborted) return reject(new Error("aborted"));
+      sig.addEventListener("abort", () => reject(new Error("aborted")), { once: true });
+    })) as unknown as typeof fetch;
+  const start = Date.now();
+  const result = await callOpenAiCompatibleChat(
+    endpoint,
+    [{ role: "user", content: "hi" }],
+    { timeoutMs: 5000, signal: batchController.signal },
+    spy,
+  );
+  const elapsed = Date.now() - start;
+  assert.equal(result, null, "a pre-aborted signal must fail the probe closed (null)");
+  assert.ok(
+    elapsed < 1000,
+    `probe must abort immediately on a pre-aborted signal (${elapsed}ms), not wait timeoutMs`,
+  );
+});
+
+test("checkFaithfulnessBatch: default surfaces malformed_output for a 200-with-garbage local response (#1700 nit #6)", async () => {
+  // extractionFaithfulnessLocalParseFallback unset (default false): a local
+  // endpoint returning 200 with non-verdict JSON surfaces malformed_output so a
+  // misconfigured endpoint is visible. The configured chain must NOT run.
+  const inputs = [{ factText: "Fact", quote: "Quote" }];
+  const config = parseConfig({
+    extractionFaithfulnessModel: "remnic-faithfulness-gate-v1",
+    extractionFaithfulnessBaseUrl: "http://localhost:11434/v1",
+    extractionFaithfulnessTimeoutMs: 5000,
+  });
+  const fallbackCalls: Array<{ messages: unknown; options: unknown }> = [];
+  const { fetch: garbageFetch } = fakeFetchFor("http://localhost:11434/v1", () => ({
+    model: "remnic-faithfulness-gate-v1",
+    choices: [{ message: { content: "this is not a verdict array" } }],
+  }));
+  const result = await checkFaithfulnessBatch(
+    inputs,
+    config,
+    null,
+    stubFallbackLlm(JSON.stringify([{ index: 0, verdict: "entailed" }]), fallbackCalls),
+    garbageFetch,
+  );
+  assert.equal(fallbackCalls.length, 0, "chain must NOT run when flag is off — garbage surfaces loudly");
+  assert.equal(result.results[0]?.ok, false);
+  if (!result.results[0]?.ok) {
+    assert.equal(result.results[0].error.code, "malformed_output");
+  }
+});
+
+test("checkFaithfulnessBatch: extractionFaithfulnessLocalParseFallback falls back to the chain on local parse failure (#1700 nit #6)", async () => {
+  // Flag ON: the same 200-with-garbage local response now falls through to the
+  // configured chain instead of surfacing malformed_output (resilient fallback).
+  const inputs = [{ factText: "Fact", quote: "Quote" }];
+  const config = parseConfig({
+    extractionFaithfulnessModel: "remnic-faithfulness-gate-v1",
+    extractionFaithfulnessBaseUrl: "http://localhost:11434/v1",
+    extractionFaithfulnessTimeoutMs: 5000,
+    extractionFaithfulnessLocalParseFallback: true,
+  });
+  const fallbackCalls: Array<{ messages: unknown; options: unknown }> = [];
+  const { fetch: garbageFetch } = fakeFetchFor("http://localhost:11434/v1", () => ({
+    model: "remnic-faithfulness-gate-v1",
+    choices: [{ message: { content: "this is not a verdict array" } }],
+  }));
+  const result = await checkFaithfulnessBatch(
+    inputs,
+    config,
+    null,
+    stubFallbackLlm(JSON.stringify([{ index: 0, verdict: "entailed" }]), fallbackCalls),
+    garbageFetch,
+  );
+  assert.equal(
+    fallbackCalls.length,
+    1,
+    "chain MUST run when flag is on and the local response is unparseable",
+  );
+  assert.equal(result.results[0]?.ok, true);
+  if (result.results[0]?.ok) {
+    assert.equal(result.results[0].verdict, "entailed", "fallback chain verdict is used");
+  }
+});
+
+test("checkFaithfulnessBatch: extractionFaithfulnessLocalParseFallback does NOT fall back when the local response is valid (#1700 nit #6 regression)", async () => {
+  // Flag ON but the local response IS a valid verdict array → use it, do not
+  // call the chain. Guards against the flag over-triggering on good responses.
+  const inputs = [{ factText: "Fact", quote: "Quote" }];
+  const config = parseConfig({
+    extractionFaithfulnessModel: "remnic-faithfulness-gate-v1",
+    extractionFaithfulnessBaseUrl: "http://localhost:11434/v1",
+    extractionFaithfulnessTimeoutMs: 5000,
+    extractionFaithfulnessLocalParseFallback: true,
+  });
+  const fallbackCalls: Array<{ messages: unknown; options: unknown }> = [];
+  const { fetch: goodFetch } = fakeFetchFor("http://localhost:11434/v1", () => ({
+    model: "remnic-faithfulness-gate-v1",
+    choices: [{ message: { content: JSON.stringify([{ index: 0, verdict: "contradicted" }]) } }],
+  }));
+  const result = await checkFaithfulnessBatch(
+    inputs,
+    config,
+    null,
+    stubFallbackLlm(JSON.stringify([{ index: 0, verdict: "entailed" }]), fallbackCalls),
+    goodFetch,
+  );
+  assert.equal(fallbackCalls.length, 0, "chain must NOT run when the local response is valid, even with the flag on");
+  assert.equal(result.results[0]?.ok, true);
+  if (result.results[0]?.ok) {
+    assert.equal(result.results[0].verdict, "contradicted", "valid local verdict is used");
+  }
+});
+
+test("checkFaithfulnessBatch: extractionFaithfulnessLocalParseFallback falls back when the local response is a PARTIAL verdict array (codex P2 PRRT_kwDORJXyws6O6zwZ)", async () => {
+  // Flag ON: a local endpoint that returns a valid-but-INCOMPLETE verdict
+  // array (1 of N entries) must fall through to the configured chain, NOT be
+  // accepted as-is. parseFaithfulnessResponse is truthy as soon as ONE entry
+  // is valid, so the previous guard accepted the partial response and the
+  // missing indexes surfaced as malformed_output downstream -- defeating the
+  // resilient fallback. Accept the local response only when it covers every
+  // expected index.
+  const inputs = [
+    { factText: "Fact A", quote: "Quote A" },
+    { factText: "Fact B", quote: "Quote B" },
+  ];
+  const config = parseConfig({
+    extractionFaithfulnessModel: "remnic-faithfulness-gate-v1",
+    extractionFaithfulnessBaseUrl: "http://localhost:11434/v1",
+    extractionFaithfulnessTimeoutMs: 5000,
+    extractionFaithfulnessLocalParseFallback: true,
+  });
+  const fallbackCalls: Array<{ messages: unknown; options: unknown }> = [];
+  // Local endpoint returns only index 0 -- index 1 is missing (partial).
+  const { fetch: partialFetch } = fakeFetchFor("http://localhost:11434/v1", () => ({
+    model: "remnic-faithfulness-gate-v1",
+    choices: [{ message: { content: JSON.stringify([{ index: 0, verdict: "contradicted" }]) } }],
+  }));
+  const result = await checkFaithfulnessBatch(
+    inputs,
+    config,
+    null,
+    stubFallbackLlm(
+      JSON.stringify([
+        { index: 0, verdict: "entailed" },
+        { index: 1, verdict: "unsupported" },
+      ]),
+      fallbackCalls,
+    ),
+    partialFetch,
+  );
+  assert.equal(
+    fallbackCalls.length,
+    1,
+    "a partial local verdict array must fall through to the configured chain",
+  );
+  // The chain's complete verdict array is used for both indexes.
+  assert.equal(result.results[0]?.ok && result.results[0].verdict, "entailed");
+  assert.equal(result.results[1]?.ok && result.results[1].verdict, "unsupported");
+});
+
+test("checkFaithfulnessBatch: extractionFaithfulnessLocalParseFallback falls back when local indexes are fractional/non-contiguous (codex P2 PRRT_kwDORJXyws6O7PfY)", async () => {
+  // Flag ON: a malformed local response with expectedCount distinct but
+  // NON-INTEGER indexes (e.g. 0 and 0.5 for a two-item batch) must NOT be
+  // accepted. parseFaithfulnessResponse used to admit any numeric index, so a
+  // size-only check passed while index 1 stayed missing -> malformed_output.
+  // parseEntries now rejects non-integer indexes, and the gate requires every
+  // integer key 0..N-1 before accepting the local response.
+  const inputs = [
+    { factText: "Fact A", quote: "Quote A" },
+    { factText: "Fact B", quote: "Quote B" },
+  ];
+  const config = parseConfig({
+    extractionFaithfulnessModel: "remnic-faithfulness-gate-v1",
+    extractionFaithfulnessBaseUrl: "http://localhost:11434/v1",
+    extractionFaithfulnessTimeoutMs: 5000,
+    extractionFaithfulnessLocalParseFallback: true,
+  });
+  const fallbackCalls: Array<{ messages: unknown; options: unknown }> = [];
+  // Local endpoint returns indexes 0 and 0.5 -- two distinct keys, but index 1
+  // is missing (fractional index is invalid).
+  const { fetch: fracFetch } = fakeFetchFor("http://localhost:11434/v1", () => ({
+    model: "remnic-faithfulness-gate-v1",
+    choices: [{ message: { content: JSON.stringify([
+      { index: 0, verdict: "contradicted" },
+      { index: 0.5, verdict: "entailed" },
+    ]) } }],
+  }));
+  const result = await checkFaithfulnessBatch(
+    inputs,
+    config,
+    null,
+    stubFallbackLlm(
+      JSON.stringify([
+        { index: 0, verdict: "entailed" },
+        { index: 1, verdict: "unsupported" },
+      ]),
+      fallbackCalls,
+    ),
+    fracFetch,
+  );
+  assert.equal(
+    fallbackCalls.length,
+    1,
+    "a fractional/non-contiguous local response must fall through to the chain",
+  );
+  assert.equal(result.results[0]?.ok && result.results[0].verdict, "entailed");
+  assert.equal(result.results[1]?.ok && result.results[1].verdict, "unsupported");
+});
+
+test('parseConfig: extractionFaithfulnessLocalParseFallback coerces CLI string "true" (#1700 review — coerceBool parity)', () => {
+  // A CLI override reaches the parser as the string "true"; === true would
+  // silently leave the flag disabled. coerceBool must turn it on (gotcha 36).
+  const onByString = parseConfig({
+    extractionFaithfulnessLocalParseFallback: "true",
+  });
+  assert.equal(onByString.extractionFaithfulnessLocalParseFallback, true);
+  const onByBool = parseConfig({
+    extractionFaithfulnessLocalParseFallback: true,
+  });
+  assert.equal(onByBool.extractionFaithfulnessLocalParseFallback, true);
+  const offDefault = parseConfig({});
+  assert.equal(offDefault.extractionFaithfulnessLocalParseFallback, false);
+  const offByString = parseConfig({
+    extractionFaithfulnessLocalParseFallback: "false",
+  });
+  assert.equal(offByString.extractionFaithfulnessLocalParseFallback, false);
+});

package/src/extraction-faithfulness.ts

@@ -220,6 +220,27 @@ export function parseFaithfulnessResponse(
   return null;
 }
 
+/**
+ * True when `map` contains an entry for every integer index in
+ * [0, expectedCount). The local parse-fallback gate uses this to accept a
+ * local model-lab response only when it is COMPLETE: size alone is
+ * insufficient because a malformed response with duplicate/fractional indexes
+ * can yield expectedCount distinct map keys without covering index 0..N-1
+ * (codex P2 PRRT_kwDORJXyws6O7PfY). parseEntries now rejects non-integer
+ * indexes so the two checks agree, but the explicit coverage loop documents
+ * the invariant and stays robust to any future parser relaxation.
+ */
+function coversAllIndexes(
+  map: Map<number, ParsedFaithfulnessEntry>,
+  expectedCount: number,
+): boolean {
+  if (map.size < expectedCount) return false;
+  for (let i = 0; i < expectedCount; i++) {
+    if (!map.has(i)) return false;
+  }
+  return true;
+}
+
 function parseEntries(
   data: unknown,
   expectedCount: number,
@@ -243,7 +264,7 @@ function parseEntries(
     if (!entry || typeof entry !== "object") continue;
     const obj = entry as Record<string, unknown>;
     const idx = typeof obj.index === "number" ? obj.index : undefined;
-    if (idx === undefined || idx < 0 || idx >= expectedCount) continue;
+    if (idx === undefined || !Number.isInteger(idx) || idx < 0 || idx >= expectedCount) continue;
     const verdictRaw = typeof obj.verdict === "string" ? obj.verdict : undefined;
     if (!verdictRaw || !VALID_VERDICTS.has(verdictRaw)) continue;
     const rationale =
@@ -279,6 +300,7 @@ interface LlmCallResult {
 async function callFaithfulnessLlm(
   systemPrompt: string,
   userPrompt: string,
+  expectedCount: number,
   config: PluginConfig,
   localLlm: LocalLlmClient | null,
   fallbackLlm: FallbackLlmClient | null,
@@ -311,15 +333,44 @@ async function callFaithfulnessLlm(
     const result = await callOpenAiCompatibleChat(
       localEndpoint,
       messages,
-      { temperature: 0.1, maxTokens: 2048, responseFormatJson: true, timeoutMs: probeBudgetMs },
+      {
+        temperature: 0.1,
+        maxTokens: 2048,
+        responseFormatJson: true,
+        timeoutMs: probeBudgetMs,
+        // Forward the batch signal so the probe aborts the instant the batch
+        // budget elapses, not after probeBudgetMs (issue #1700 nit #5).
+        ...(signal ? { signal } : {}),
+      },
       fetchImpl,
     );
     if (result?.content) {
-      return { content: result.content, modelUsed: result.modelUsed };
+      // Issue #1700 nit #6: pre-validate the local endpoint response shape.
+      // Default (extractionFaithfulnessLocalParseFallback=false) returns the
+      // content as-is -- a 200-with-garbage local response surfaces
+      // malformed_output, alerting the operator to a misconfigured endpoint.
+      // When the operator opts into resilient fallback, an unparseable OR
+      // PARTIAL local response falls through to the configured chain instead
+      // of surfacing. parseFaithfulnessResponse is truthy as soon as ONE entry
+      // is valid, so accept the local response only when the parsed verdict
+      // map covers every expected index -- otherwise the missing indexes would
+      // surface as malformed_output downstream, defeating the resilient
+      // fallback (codex P2 PRRT_kwDORJXyws6O6zwZ).
+      if (!config.extractionFaithfulnessLocalParseFallback) {
+        return { content: result.content, modelUsed: result.modelUsed };
+      }
+      const parsedLocal = parseFaithfulnessResponse(result.content, expectedCount);
+      if (parsedLocal && coversAllIndexes(parsedLocal, expectedCount)) {
+        return { content: result.content, modelUsed: result.modelUsed };
+      }
+      log.debug(
+        "extraction-faithfulness: local endpoint returned incomplete/unparseable output; falling back to configured chain",
+      );
+    } else {
+      log.debug(
+        "extraction-faithfulness: local model-lab endpoint unavailable, trying configured chain",
+      );
     }
-    log.debug(
-      "extraction-faithfulness: local model-lab endpoint unavailable, trying configured chain",
-    );
   }
 
   // extractionFaithfulnessModel is the LOCAL served model's name (e.g.
@@ -532,6 +583,7 @@ export async function checkFaithfulnessBatch(
     const callPromise = callFaithfulnessLlm(
       FAITHFULNESS_SYSTEM_PROMPT,
       userPrompt,
+      checkableInputs.length,
       config,
       localLlm,
       fallbackLlm,

package/src/extraction-redaction-rules.test.ts

@@ -0,0 +1,213 @@
+/**
+ * extraction-redaction-rules.test.ts — issue #1669 (#1580 follow-up).
+ *
+ * Proves the extraction-layer redaction-rule helper reads persisted
+ * `redaction_rule` patterns and withholds matching content. The orchestrator
+ * consults these rules before the storage write chokepoint so a never_store
+ * correction actually blocks future extraction of matching content.
+ */
+import { strict as assert } from "node:assert";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { test } from "node:test";
+import {
+  REDACTION_RULES_SUBDIR,
+  compileRedactionPattern,
+  contentMatchesRedactionRules,
+  loadRedactionRules,
+} from "./extraction-redaction-rules.js";
+import { validateRedactionPattern } from "./correction/correction-contract.js";
+
+async function withTempDir<T>(fn: (dir: string) => Promise<T>): Promise<T> {
+  const dir = await mkdtemp(path.join(tmpdir(), "remnic-redact-"));
+  try {
+    return await fn(dir);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+async function writeRule(stateDir: string, pattern: string): Promise<void> {
+  const dir = path.join(stateDir, REDACTION_RULES_SUBDIR);
+  await mkdir(dir, { recursive: true });
+  const slug = pattern.replace(/[^a-zA-Z0-9]+/g, "-").slice(0, 64) || "rule";
+  await writeFile(
+    path.join(dir, `${slug}.json`),
+    `${JSON.stringify({ pattern, namespace: "default", createdAt: "2026-07-06T00:00:00Z" })}\n`,
+    "utf-8",
+  );
+}
+
+test("compileRedactionPattern: literal pattern matches by substring", () => {
+  const rule = compileRedactionPattern("secret-token-123");
+  assert.ok(rule.matcher("the secret-token-123 leaked here"));
+  assert.ok(!rule.matcher("nothing here"));
+});
+
+test("compileRedactionPattern: regex-like pattern compiles to a RegExp", () => {
+  // Only /.../-wrapped patterns compile as RegExp (review thread P1).
+  const rule = compileRedactionPattern("/secret-token-\\d+/");
+  assert.ok(rule.matcher("found secret-token-999 in logs"));
+  assert.ok(!rule.matcher("found secret-token-abc in logs"));
+});
+
+test("compileRedactionPattern (P1): unwrapped pattern with metacharacters is literal", () => {
+  // abc+def must match the LITERAL string, not the regex abccccdef.
+  const rule = compileRedactionPattern("abc+def");
+  assert.ok(rule.matcher("the value is abc+def here"),
+    "unwrapped metachar pattern must match the literal substring");
+  assert.ok(!rule.matcher("abccccdef"),
+    "unwrapped metachar pattern must NOT be compiled as a regex");
+  // An API-token-shaped literal like foo(bar) also works.
+  const rule2 = compileRedactionPattern("foo(bar)");
+  assert.ok(rule2.matcher("contains foo(bar) text"));
+  assert.ok(!rule2.matcher("contains foobar text"));
+});
+
+test("compileRedactionPattern: /wrapped/ regex strips delimiters", () => {
+  const rule = compileRedactionPattern("/internal-only-[a-z]+/");
+  assert.ok(rule.matcher("this is internal-only-foo data"));
+  assert.ok(!rule.matcher("this is public data"));
+});
+
+test("compileRedactionPattern: malformed /wrapped/ regex falls back to literal", () => {
+  // /.../-wrapped with an unbalanced bracket — RegExp() throws, falls back
+  // to literal substring on the BODY (without delimiters).
+  const rule = compileRedactionPattern("/[unclosed/");
+  assert.ok(rule.matcher("contains [unclosed literally"));
+  assert.ok(!rule.matcher("no match"));
+});
+
+test("loadRedactionRules: empty when the dir does not exist (cold install)", async () => {
+  await withTempDir(async (dir) => {
+    const rules = await loadRedactionRules(dir);
+    assert.equal(rules.length, 0);
+  });
+});
+
+test("loadRedactionRules: reads persisted literal + regex patterns", async () => {
+  await withTempDir(async (dir) => {
+    await writeRule(dir, "secret-token-123");
+    await writeRule(dir, "/api-key-[a-f0-9]{8}/");
+    const rules = await loadRedactionRules(dir);
+    assert.equal(rules.length, 2);
+    assert.ok(contentMatchesRedactionRules("leaked secret-token-123 here", rules));
+    assert.ok(contentMatchesRedactionRules("api-key-deadbeef was used", rules));
+    assert.ok(!contentMatchesRedactionRules("clean content", rules));
+  });
+});
+
+test("loadRedactionRules: skips a corrupt rule file without failing the pass", async () => {
+  await withTempDir(async (dir) => {
+    await writeRule(dir, "good-pattern");
+    const dir2 = path.join(dir, REDACTION_RULES_SUBDIR);
+    // A non-JSON file masquerading as a rule.
+    await writeFile(path.join(dir2, "broken.json"), "{not valid json", "utf-8");
+    // A rule file missing the `pattern` field.
+    await writeFile(path.join(dir2, "nopattern.json"), JSON.stringify({ foo: "bar" }), "utf-8");
+    const rules = await loadRedactionRules(dir);
+    assert.equal(rules.length, 1, "only the well-formed rule compiles");
+    assert.ok(contentMatchesRedactionRules("good-pattern here", rules));
+  });
+});
+
+test("contentMatchesRedactionRules: empty rule set never matches", () => {
+  assert.equal(contentMatchesRedactionRules("anything", []), false);
+});
+
+test("regression (#1669): a persisted redaction rule blocks matching content", async () => {
+  await withTempDir(async (dir) => {
+    // Simulate a `redaction_rule` correction that persisted a never-store pattern.
+    await writeRule(dir, "do-not-store-this-exact-phrase");
+    const rules = await loadRedactionRules(dir);
+    // Content matching the persisted pattern is withheld.
+    assert.ok(
+      contentMatchesRedactionRules("a fact containing do-not-store-this-exact-phrase inside", rules),
+      "matching content must be withheld",
+    );
+    // Non-matching content passes through.
+    assert.ok(
+      !contentMatchesRedactionRules("a perfectly fine durable fact", rules),
+      "non-matching content must pass",
+    );
+  });
+});
+
+test("#1669 thread #3: catastrophic-backtracking regex falls back to literal (ReDoS guard)", () => {
+  // A pattern like (a+)+ is a classic ReDoS shape. It must NOT compile as a
+  // RegExp — it would hang persistExtraction on a near-miss fact. Instead it
+  // falls back to literal substring match.
+  const rule = compileRedactionPattern("(a+)+");
+  // The literal fallback matches when the exact string "(a+)+" appears:
+  assert.equal(rule.matcher("a fact with (a+)+ inside"), true,
+    "literal fallback must still match the pattern as a substring");
+  // A long near-miss string that would cause exponential backtracking on the
+  // regex must return quickly (literal match, no regex evaluation):
+  const nearMiss = "a".repeat(100) + "!";
+  assert.equal(rule.matcher(nearMiss), false,
+    "near-miss must not hang — literal fallback, not regex");
+});
+
+test("#1669 thread #3: safe regex pattern still compiles as RegExp", () => {
+  // A benign anchored pattern compiles normally.
+  const rule = compileRedactionPattern("/^secret-key-[a-f0-9]+$/");
+  assert.equal(rule.matcher("secret-key-deadbeef"), true);
+  assert.equal(rule.matcher("not-a-secret"), false);
+});
+
+test("#1669 cursor thread: overly broad /wrapped/ regex falls back to literal (not compiled)", () => {
+  // A hand-edited rule file with /.*/ must NOT compile — it would match every
+  // fact and withhold all extraction. isSafeRegex now rejects overly-broad
+  // bodies, so the rule falls back to literal substring on the body.
+  const rule = compileRedactionPattern("/.*/");
+  assert.ok(!rule.matcher("any fact content"),
+    "overly broad regex must not match arbitrary content");
+  assert.ok(rule.matcher("contains .* literally"),
+    "literal fallback on the body must still match the substring .*");
+});
+
+test("#1669 thread #3 (first-line guard): validateRedactionPattern rejects catastrophic-backtracking shapes", () => {
+  // Classic ReDoS shapes must be rejected at apply time — not just fall back
+  // to literal at extraction time. Each is a nested quantifier or overlapping
+  // alternation that would hang on a near-miss fact.
+  const pathological = ["/(a+)+/", "/(a*)*/", "/(a?)+/", "/(a|a)+/"];
+  for (const p of pathological) {
+    assert.throws(
+      () => validateRedactionPattern(p),
+      { message: /unsafe/ },
+      `validateRedactionPattern must reject catastrophic pattern: ${p}`,
+    );
+  }
+  // The overly-broad check still fires for /.../-wrapped .* / .+ patterns.
+  assert.throws(() => validateRedactionPattern("/.*/"));
+  assert.throws(() => validateRedactionPattern("/.+/"));
+  // A near-miss string that would cause exponential backtracking on the
+  // regex never reaches extraction — the plan is rejected at apply time.
+  const nearMiss = "a".repeat(100) + "!";
+  assert.ok(nearMiss.length === 101);
+});
+
+test("#1669 thread #3 (first-line guard): valid patterns still pass", () => {
+  // Bounded literal + benign anchored regex must NOT be rejected.
+  assert.equal(validateRedactionPattern("secret-token-\\d+"), "secret-token-\\d+");
+  assert.equal(validateRedactionPattern("(a|b)+"), "(a|b)+");
+  assert.equal(validateRedactionPattern("/^secret-key-[a-f0-9]+$/"), "/^secret-key-[a-f0-9]+$/");
+});
+
+test("#1669 P2: validateRedactionPattern rejects zero-width regex", () => {
+  // Empty body or regex that matches the empty string would withhold every fact.
+  assert.throws(() => validateRedactionPattern("//"));
+  assert.throws(() => validateRedactionPattern("/a?/"));
+  assert.throws(() => validateRedactionPattern("/a*/"));
+  assert.throws(() => validateRedactionPattern("/(a|)/"));
+  // A bounded non-zero-width regex still passes.
+  assert.equal(validateRedactionPattern("/^secret-[a-f]+$/"), "/^secret-[a-f]+$/");
+});
+
+test("#1669 P2: compileRedactionPattern empty body never matches", () => {
+  // A hand-edited // rule file must not withhold all extraction.
+  const rule = compileRedactionPattern("//");
+  assert.equal(rule.matcher("anything"), false);
+  assert.equal(rule.matcher(""), false);
+});