bareloop 0.6.0 → 0.8.0

package/types/validate.d.ts

@@ -62,4 +62,54 @@ export function redactSecrets(raw: unknown): string;
  * @param {(code: string, path: string, detail?: string) => void} red
  */
 export function sweepSecretLiterals(root: any, red: (code: string, path: string, detail?: string) => void): void;
+/**
+ * F49 — a heuristic reject for the catastrophic-backtracking footgun: an
+ * unbounded quantifier applied to a group whose body itself repeats unboundedly
+ * (`(a+)+`, `(\d*)*`, `([a-z]+){1,}`) — including through a redundant wrapping
+ * group (`((a+))+`, `(?:(a+))*`), which is the SAME exponential class as `(a+)+`
+ * and is caught by propagating the inner repeat up through the wrapper. Such a
+ * pattern can hang `RegExp.test` for seconds on a short crafted body, and THREE
+ * fields feed it to an evaluator with NO timeout — one per document:
+ *   - the AGENT's `artifact-written.pattern`, run by `evalExits` (F49, the
+ *     original site). Self-DoS only: the agent authors both the pattern and
+ *     (via the worker) the artifact, so a hang burns only its own run's
+ *     wall-clock, and there is no arbiter compromise — it cannot escape the
+ *     fence, forge a green, or leak a secret.
+ *   - the OPERATOR's `judged.pattern` (`runClose`) and `gapKeep` (`boundGap`),
+ *     compiled and run against close output in BARELOOP'S OWN PROCESS. These
+ *     are worse than an operator self-DoS, and the reason is F67's lesson: the
+ *     regex blocks the MAIN EVENT LOOP, so the in-process stall fuse — a timer
+ *     in that same loop — cannot fire. The run dies to the OUTSIDE watchdog and
+ *     is read as a model stall, so a bad regex in a SIGNED spec presents as a
+ *     provider problem. MEASURED: `boundGap(stream, '(a+)+$')` on a 40-char
+ *     body does not finish in 20s.
+ * So the reject targets the dominant exponential class and fails it as a
+ * mechanical gap at the validation gate, before any tokens burn. A full ReDoS
+ * analyzer needs a real regex engine (an external native dep we do not take for
+ * a LOW issue); exotic overlapping-alternation blowup is out of scope by
+ * decision (PARKED to the close-authoring rung — PRD v1.55).
+ *
+ * SCOPE IS ASYMMETRIC, both directions named on purpose:
+ *   - false NEGATIVE: overlapping-alternation blowup (`(a|ab)+`-class) is not
+ *     detected — there is no inner QUANTIFIER to find, so the shape scan cannot
+ *     see it; the blowup comes from overlapping alternation BRANCHES under a
+ *     repeat. A genuine limit of the approach, not a bug in it. Widening the
+ *     detector changes which SIGNED specs are admissible, which is
+ *     arbiter-adjacent — parked, not chased (PRD v1.55).
+ *   - false POSITIVE: a group whose repetitions are disambiguated by a literal
+ *     anchor/delimiter (`(?:^- .+$\n?)+`, `(?:CHANGELOG:.+\n)+`) is FLAGGED even
+ *     though a real engine runs it linearly — the scan sees the nested-quantifier
+ *     SHAPE, not the disambiguation. Rejecting it is the FAIL-SAFE direction (it
+ *     never admits an unsafe pattern), and the cost is bounded: the plan drafter
+ *     gets a mechanical gap and rewrites (drop the outer `+`, or match once).
+ *     Detecting "safe because anchored" needs the same real engine we declined,
+ *     and guessing it wrong would ADMIT an exponential pattern — so the shape
+ *     reject stands, and the over-rejection is a named, accepted limitation.
+ *
+ * The input is guaranteed to compile as a RegExp (checked first by the caller),
+ * so this scan assumes valid, balanced JS regex syntax.
+ * @param {string} src a compiled regex source string
+ * @returns {boolean} true iff a nested unbounded quantifier is present
+ */
+export function hasNestedQuantifier(src: string): boolean;
 export const SECRET_PATTERNS: RegExp[];