fix: clear the polynomial-redos class across main

[thymikee]

You flagged that the CodeQL finding on #1536 exists elsewhere already — correct, and this clears the whole class on main in one small PR:

• Alerts fix: set min iOS deployment target to 15.6 #27/iOS Snapshot not retrieve the password field #28 (packages/replay-test slug builders, from the merged refactor(replay-test): extract packages/replay-test (#1478 P3b) #1525): /^-+|-+$/g edge-trim backtracks polynomially on long dash runs derived from caller-supplied file paths/request ids. Replaced with a shared linear trimEdgeDashes (no import cycle; discovery already sits above artifacts).
• Main's copy of the annotation-line regex (src/replay/target-identity.ts:16) — the identical \s+(.*) ambiguity that alert fix: iOS snapshot not showing password fields #29 flagged on refactor: extract the .ad script codec into packages/ad-script (#1478) #1536's moved copy. Same fix as there: anchor the payload on \S so the split point is unique. Behavior-preserving (the only caller matches trimmed lines); when refactor: extract the .ad script codec into packages/ad-script (#1478) #1536 rebases, its already-fixed package copy supersedes this file wholesale, so no conflict of substance.

Gates: typecheck, lint, format, check:replay-compat (frozen corpus unchanged), fallow zero at main scope; 45/45 in the touched suites plus a 100k-char adversarial slug test asserting sub-second completion.

Refs #1478

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	1.92 MB	1.92 MB	-612 B
JS gzip	615.7 kB	615.5 kB	-230 B
npm tarball	733.8 kB	733.6 kB	-224 B
npm unpacked	2.57 MB	2.57 MB	-612 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	21.9 ms	21.9 ms	+0.1 ms
CLI --help	45.3 ms	45.1 ms	-0.2 ms

Top changed chunks:

Chunk	Raw diff	Gzip diff
dist/src/session.js	-614 B	-233 B
dist/src/sdk-selectors.js	+2 B	+3 B

[thymikee]

Re-reviewed 8807a9b. The production fix is clean: trimEdgeDashes is linear and output-compatible, the target-v1 \S boundary preserves trimmed-input semantics, and exact-head CodeQL plus all checks are green.

One blocking test-validity issue remains: the claimed adversarial test uses dashes only at the edges, which the old /^-+|-+$/g handles in one pass, so it passes before the fix. Use a non-terminal interior run such as x + '-'.repeat(n) + x, choose a size/bound that robustly fails the old implementation while remaining generous for O(n), assert the exact unchanged output, and pin the all-dash caller fallbacks (test, suite, and omitted empty session slug). Then this is ready.

[thymikee]

Fixed in 6aea6b483 — you were right that the edge-run input was a one-pass match for the old form. The test now feeds a 100k-char interior run (x + dashes + x) to trimEdgeDashes directly (the slug pipeline collapses runs before trimming, so only a direct call can carry the adversarial shape), asserts the exact byte-identical output, and bounds at a generous 1s. Counterfactually verified: with trimEdgeDashes reverted to the regex form the same test fails at 3201ms; at head it passes instantly, 13/13 in the file.

Generated by Claude Code

[thymikee]

Re-reviewed exact head 6aea6b4. The direct interior-run regression is now genuinely non-vacuous: the retired regex takes seconds on this exact shape while trimEdgeDashes returns it byte-identically well under the bound. Two blockers remain before readiness:

1. Remove or use the now-unused buildReplayTestInvocationId import—both Typecheck (TS6133) and Lint & Format fail on it at this head.
2. Add the requested all-dash fallback assertions for artifact slug (test), invocation ID (suite), and session-name slug omission.

Please rerun the exact-head gates after those changes.

[thymikee]

Both blockers addressed at 2ae86d93e: the orphaned import was dropped (Typecheck and Lint & Format green again), and the all-dash fallback assertions are added — buildReplayTestArtifactSlug → 'test' (input /tmp/####, since dots are legal slug characters and an all-dash filename legitimately slugs to its extension), buildReplayTestInvocationId → 'suite', and buildReplayTestSessionName omitting the slug segment entirely with no dangling separator. 14/14 in the file; typecheck/lint/format green at head.

Errata on my own process, in the spirit of this review thread: the first push of this commit carried a red version of the new test (my initial artifact-slug input wasn't actually all-dash after slugging — it returned '.ad') because a semicolon-chained local run let the commit proceed past the failure. Caught on the immediate re-run, fixed, amended — but the failure mode was exactly the one this PR's review has been policing.

Generated by Claude Code

[thymikee]

Re-review at 2ae86d93e is clean. The unused import is gone, all three fallback contracts are pinned, and the direct interior-run regression is genuinely counterfactual against the retired polynomial regex while asserting exact output preservation. The production slug helper and target-v1 regex fixes remain semantics-preserving, CodeQL is green, and all exact-head checks pass. Ready for human merge.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-08-01 13:11 UTC