Error Pattern Safety

Use these regex safety rules in agentic engines to prevent JavaScript infinite loops.

The Problem

With the JavaScript global flag (/pattern/g), zero-width matches can cause infinite loops because:

1. JavaScript’s regex.exec() with the g flag uses lastIndex to track position
2. When a pattern matches zero-width, lastIndex doesn’t advance
3. The same position is matched repeatedly, causing an infinite loop

Dangerous Pattern Examples

❌ NEVER USE THESE PATTERNS:

Safe Pattern Examples

✅ ALWAYS USE PATTERNS LIKE THESE:

Pattern Safety Rules

1. Always require at least one character match

   • Use .+ instead of .* when you need “something”
   • Ensure pattern has required prefix/suffix

2. Never use bare .* as the entire pattern

   • Always combine with required text: error.*
   • Never just .* or .*?

3. Test patterns against empty string

   javascriptCopy

   const regex = /your-pattern/g;
   if (regex.test("")) {
     throw new Error("Pattern matches empty string - DANGEROUS!");
   }

4. Use specific anchors when possible

   • Start: ^error.*
   • End: .*error$
   • Word boundaries: \berror\b

Validation Tests

All error patterns must pass the same safety checks used by the repo’s unit suite:

Go tests

Run the relevant package tests with make test-unit.

JavaScript tests

Use the relevant *.test.cjs suite under actions/setup/js/ or pkg/workflow/js/ for the area you changed, or run the repo’s JavaScript checks via make test-js.

Safety Mechanisms in the validation layer

The repo’s validation helpers include built-in protections for dangerous regex patterns:

1. Zero-width detection: Checks whether a regex stops advancing across iterations
2. Iteration warning: Warns when repeated runs approach a hang threshold
3. Hard limit: Stops execution before runaway loops can lock the process

Adding New Error Patterns

When adding new error patterns to engines:

1. Write the pattern with required content

   goCopy

   {
       Pattern:      `(?i)error.*permission.*denied`,
       LevelGroup:   0,
       MessageGroup: 0,
       Description:  "Permission denied error",
   }

2. Test against empty string

   • Run: make test-unit
   • Checks: TestAllEnginePatternsSafe

3. Test with actual log samples

   • Ensure it matches real errors
   • Ensure it doesn’t match informational text

4. Document the pattern

   • Add clear description
   • Note what it’s designed to catch

Pattern Conversion: Go to JavaScript

Patterns are converted from Go to JavaScript:

The (?i) prefix is removed because JavaScript uses the i flag instead.

Examples from Current Codebase

✅ Safe Patterns

How to Fix Unsafe Patterns

If you find a pattern that matches empty string:

Before (unsafe):

After (safe):

Testing Checklist

Before committing pattern changes:

• Not done: Run make test-unit
• Not done: Verify the relevant engine error-pattern tests still pass
• Not done: Run the JavaScript checks for the changed area with make test-js or the targeted Vitest suite
• Not done: Verify the pattern matches intended error messages
• Not done: Verify the pattern does not match informational text or empty-string edge cases

References

• Go regex syntax: https://pkg.go.dev/regexp/syntax (opens in a new tab)
• JavaScript regex: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions (opens in a new tab)
• Current repo validation: make test-unit and make test-js