fix(logs): match copilot log-grep patterns literally, never as a regex

`grepSpans` compiled a caller-supplied pattern with a bare `new RegExp`, whose
only guard was a `catch` for syntax errors. Trace text is attacker-influenced —
a workflow can emit arbitrarily long uniform runs into its own block outputs —
and matching runs synchronously on the shared event loop, so an authenticated
caller could choose both the pattern and the input and stall every request on
the instance.

Patterns are now matched as an escaped, case-insensitive literal. Screening was
implemented first and abandoned, because each rule only excludes the shapes
someone thought to enumerate:

- `safe-regex2` (already used by the guardrails validator) documents itself as
  having false negatives. It screens star height only, so it passes `(a|a)*b`,
  measured >61s on V8 at 30 characters.
- Rejecting quantified groups on top of that catches `(a|a)*b`, and every
  attack `safe-regex2` catches, but still passes `a*a*b` — adjacent quantifiers
  over overlapping character sets — measured 213s on JSC and 132s on V8 over a
  10k-character run, well inside what a block output can hold.

An escaped literal is linear on every engine, needs no dependency, and does not
depend on which runtime serves the request. `safe-regex2` stays a dependency for
its existing guardrails/PII callers; it is simply not relied on here.

`query_logs` loses regex matching. Its catalog entry describes `pattern` as
"greps" rather than promising regex, but it is generated from a contract in
another repository and cannot be updated here, so a `patternNotice` is returned
whenever a pattern contains regex syntax — the caller is told the pattern was
taken literally instead of reading zero matches as "not in the trace".

Two bounds are kept as backstops: a cumulative match-time budget charging only
time inside `test`/`exec` (never the blob-store reads the scan awaits between
matches, which would truncate slow-but-legitimate greps under load), and a
total scanned-character cap.

Author: waleedlatif1

apps/sim/lib/copilot/tools/server/workflow/query-logs.ts

@@ -145,12 +145,17 @@ export const queryLogsServerTool: BaseServerTool<QueryLogsArgs, unknown> = {
 
     if (args.pattern) {
       logger.info('query_logs grep', { workspaceId, executionId: args.executionId })
-      const { matches, truncated } = await grepSpans(traceSpans, args.pattern, viewCtx)
+      const { matches, truncated, patternNotice } = await grepSpans(
+        traceSpans,
+        args.pattern,
+        viewCtx
+      )
       return {
         executionId: detail.executionId,
         workflowId: detail.workflowId,
         status: detail.status,
         pattern: args.pattern,
+        ...(patternNotice ? { patternNotice } : {}),
         matches,
         truncated,
       }

apps/sim/lib/logs/log-views.test.ts

@@ -32,6 +32,7 @@ vi.mock('@/lib/execution/payloads/store', () => ({
   materializeLargeValueRef: materializeLargeValueRefMock,
 }))
 
+import { sleep } from '@sim/utils/helpers'
 import type { TraceSpan } from '@/lib/logs/types'
 import { grepSpans, type LogViewContext, toFull, toOverview } from './log-views'
 
@@ -169,10 +170,80 @@ describe('grepSpans', () => {
     expect(result.matches.some((m) => m.field === 'output')).toBe(true)
   })
 
-  it('falls back to literal substring on invalid regex', async () => {
+  it('matches regex syntax literally rather than interpreting it', async () => {
     const spans = [span({ output: { v: 'value a(b found' } })]
     const result = await grepSpans(spans, '(', ctx)
     expect(result.matches.some((m) => m.field === 'output')).toBe(true)
+    expect(result.patternNotice).toContain('literal')
+  })
+
+  it('does not interpret a regex pattern, and says so', async () => {
+    const spans = [span({ output: { v: 'status=503' } })]
+
+    // Literal 'status=\d+' is not present; the regex it denotes would have matched.
+    const asRegex = await grepSpans(spans, 'status=\\d+', ctx)
+    expect(asRegex.matches).toEqual([])
+    expect(asRegex.patternNotice).toContain('literal')
+
+    const asLiteral = await grepSpans(spans, 'status=503', ctx)
+    expect(asLiteral.matches.some((m) => m.field === 'output')).toBe(true)
+    expect(asLiteral.patternNotice).toBeUndefined()
+  })
+
+  it.each([
+    ['nested quantifier', '(a+)+$'],
+    ['duplicate alternation, passes safe-regex2', '(a|a)*b'],
+    ['adjacent quantifiers, passes every structural screen', 'a*a*b'],
+  ])('never executes a catastrophic pattern (%s)', async (_label, pattern) => {
+    // Each of these blocks the event loop for minutes if compiled as a regex:
+    // `a*a*b` measured 213s on JSC / 132s on V8 over a 10k-character run.
+    const spans = [span({ output: { v: `${'a'.repeat(5000)}!` } })]
+
+    const start = Date.now()
+    const result = await grepSpans(spans, pattern, ctx)
+    const elapsedMs = Date.now() - start
+
+    expect(elapsedMs).toBeLessThan(1000)
+    expect(result.matches).toEqual([])
+  })
+
+  it('matches a long pattern literally without a length cap', async () => {
+    const pattern = `${'x'.repeat(600)}needle`
+    const spans = [span({ output: { v: pattern } })]
+    const result = await grepSpans(spans, pattern, ctx)
+    expect(result.matches.some((m) => m.field === 'output')).toBe(true)
+  })
+
+  it('stops scanning and marks truncated once the character budget is exhausted', async () => {
+    const spans = [
+      span({ id: 'a', output: { v: 'x'.repeat(400) } }),
+      span({ id: 'b', output: { v: 'needle' } }),
+    ]
+    const result = await grepSpans(spans, 'needle', ctx, { maxScannedChars: 100 })
+    expect(result.matches).toEqual([])
+    expect(result.truncated).toBe(true)
+  })
+
+  it('stops scanning and marks truncated once the match-time budget is exhausted', async () => {
+    const spans = [span({ output: { v: 'needle' } })]
+    const result = await grepSpans(spans, 'needle', ctx, { matchTimeBudgetMs: 0 })
+    expect(result.matches).toEqual([])
+    expect(result.truncated).toBe(true)
+  })
+
+  it('does not charge blob-store I/O to the match-time budget', async () => {
+    // Each slice read sleeps well past the budget: only time spent matching
+    // counts, so a slow-but-legitimate grep must still return complete results.
+    readLargeArrayManifestSliceMock.mockImplementation(async (_m: unknown, start: number) => {
+      await sleep(30)
+      return start === 400 ? [{ v: 'found the needle here' }] : [{ v: 'nothing' }]
+    })
+    const spans = [span({ output: manifest(500) as any })]
+
+    const result = await grepSpans(spans, 'needle', ctx, { matchTimeBudgetMs: 50 })
+
+    expect(result.matches.some((m) => m.field === 'output')).toBe(true)
+    expect(result.truncated).toBe(false)
   })
 
   it('returns empty for empty traceSpans', async () => {

apps/sim/lib/logs/log-views.ts

@@ -23,6 +23,23 @@ const DEFAULT_MAX_MATCHES = 50
 const DEFAULT_MAX_SNIPPET_CHARS = 500
 const DEFAULT_MAX_SLICES_SCANNED = 200
 
+/**
+ * Cumulative time the pattern itself may spend matching, across all spans/fields.
+ *
+ * Deliberately counts only time inside `test`/`exec`, not the grep's wall clock:
+ * the scan awaits blob-store reads (array slices, large-value refs) between
+ * matches, and charging that I/O to the budget would truncate slow-but-legitimate
+ * greps under load. Matching is the only part that occupies the event loop, so
+ * it is the only part worth bounding.
+ */
+const DEFAULT_MATCH_TIME_BUDGET_MS = 5_000
+/**
+ * Total characters a single grep may run the pattern over. A backstop against a
+ * pattern that slips past the backtracking screen being amplified across every
+ * slice — set well above any realistic trace so normal greps never trip it.
+ */
+const DEFAULT_MAX_SCANNED_CHARS = 64 * 1024 * 1024
+
 // ---------------------------------------------------------------------------
 // Overview (Level 2): block tree with timing + cost, NO input/output.
 // ---------------------------------------------------------------------------
@@ -172,38 +189,85 @@ export interface GrepSpanMatch {
 export interface GrepSpansResult {
   matches: GrepSpanMatch[]
   truncated: boolean
+  /**
+   * Present when the pattern contained regex syntax, which is matched literally.
+   * The tool catalog cannot say so up front — it is generated from a contract in
+   * another repository — so the caller is told here instead of silently reading
+   * zero matches as "not present in the trace".
+   */
+  patternNotice?: string
 }
 
 export interface GrepSpansOptions {
   maxMatches?: number
   maxSnippetChars?: number
   maxSlicesScanned?: number
+  maxScannedChars?: number
+  matchTimeBudgetMs?: number
 }
 
 interface GrepState {
   matches: GrepSpanMatch[]
   slicesScanned: number
+  scannedChars: number
+  matchTimeMs: number
   truncated: boolean
   maxMatches: number
   maxSnippetChars: number
   maxSlicesScanned: number
+  maxScannedChars: number
+  matchTimeBudgetMs: number
   regex: RegExp
 }
 
 function escapeRegExp(input: string): string {
   return input.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
 }
 
-function buildRegex(pattern: string): RegExp {
+/** Regex syntax in a pattern signals the caller expected regex semantics. */
+const REGEX_METACHARACTERS = /[.*+?^${}()|[\]\\]/
+
+/**
+ * Compile a caller-supplied grep pattern as a case-insensitive literal.
+ *
+ * Caller patterns are deliberately never executed as regexes. Trace text is
+ * attacker-influenced — a workflow can emit arbitrarily long uniform runs into
+ * its own block outputs — and matching runs synchronously on the shared event
+ * loop, so a backtracking pattern stalls every request on the instance.
+ *
+ * Screening was tried and abandoned: `safe-regex2` (which the guardrails
+ * validator uses) documents itself as having false negatives and passes
+ * `(a|a)*b`; rejecting quantified groups on top of it still passes `a*a*b`,
+ * measured at 213s on JSC and 132s on V8 over a 10k-character run. Each rule
+ * only excludes the shapes someone thought to enumerate. An escaped literal is
+ * linear on every engine, which is the one property worth relying on here.
+ */
+function compilePattern(pattern: string): { regex: RegExp; notice?: string } {
+  const regex = new RegExp(escapeRegExp(pattern), 'i')
+  if (!REGEX_METACHARACTERS.test(pattern)) return { regex }
+  return {
+    regex,
+    notice:
+      'Matched as a literal, case-insensitive substring — regex syntax is not interpreted. Search for the literal text you expect to see in the trace.',
+  }
+}
+
+/**
+ * Charge the elapsed matching time to the grep's budget. Every `test`/`exec` on
+ * caller-supplied patterns goes through here.
+ */
+function runTimed<T>(state: GrepState, match: (regex: RegExp) => T): T {
+  const started = performance.now()
   try {
-    return new RegExp(pattern, 'i')
-  } catch {
-    return new RegExp(escapeRegExp(pattern), 'i')
+    state.regex.lastIndex = 0
+    return match(state.regex)
+  } finally {
+    state.matchTimeMs += performance.now() - started
   }
 }
 
-function snippetAround(text: string, regex: RegExp, maxChars: number): string {
-  const m = regex.exec(text)
+function snippetAround(text: string, state: GrepState, maxChars: number): string {
+  const m = runTimed(state, (regex) => regex.exec(text))
   const index = m ? m.index : 0
   const half = Math.floor(maxChars / 2)
   const start = Math.max(0, index - half)
@@ -214,7 +278,12 @@ function snippetAround(text: string, regex: RegExp, maxChars: number): string {
 }
 
 function done(state: GrepState): boolean {
-  return state.truncated || state.matches.length >= state.maxMatches
+  if (state.truncated || state.matches.length >= state.maxMatches) return true
+  if (state.matchTimeMs >= state.matchTimeBudgetMs) {
+    state.truncated = true
+    return true
+  }
+  return false
 }
 
 function recordIfMatch(
@@ -224,15 +293,18 @@ function recordIfMatch(
   state: GrepState
 ): void {
   if (done(state)) return
-  state.regex.lastIndex = 0
-  if (!state.regex.test(text)) return
-  state.regex.lastIndex = 0
+  if (state.scannedChars + text.length > state.maxScannedChars) {
+    state.truncated = true
+    return
+  }
+  state.scannedChars += text.length
+  if (!runTimed(state, (regex) => regex.test(text))) return
   state.matches.push({
     spanId: span.id,
     blockId: span.blockId,
     name: span.name,
     field,
-    snippet: snippetAround(text, state.regex, state.maxSnippetChars),
+    snippet: snippetAround(text, state, state.maxSnippetChars),
   })
   if (state.matches.length >= state.maxMatches) state.truncated = true
 }
@@ -305,21 +377,33 @@ function safeStringify(value: unknown): string {
  * directly; large-array I/O is streamed slice-by-slice (each released before the
  * next); single large refs are materialized under a byte cap (falling back to
  * the ref preview). Only bounded match snippets are accumulated.
+ *
+ * `pattern` is matched as a literal substring, never as a regex — see
+ * `compilePattern`. Two budgets bound the scan on top of that: a total
+ * character budget and a cumulative match-time budget. Neither counts the
+ * blob-store I/O this scan awaits, so a slow-but-legitimate grep is not
+ * truncated for being slow. With literal matching both are backstops rather
+ * than load-bearing, and they stay to bound total work per request.
  */
 export async function grepSpans(
   spans: TraceSpan[],
   pattern: string,
   ctx: LogViewContext,
   opts?: GrepSpansOptions
 ): Promise<GrepSpansResult> {
+  const compiled = compilePattern(pattern)
   const state: GrepState = {
     matches: [],
     slicesScanned: 0,
+    scannedChars: 0,
+    matchTimeMs: 0,
     truncated: false,
     maxMatches: opts?.maxMatches ?? DEFAULT_MAX_MATCHES,
     maxSnippetChars: opts?.maxSnippetChars ?? DEFAULT_MAX_SNIPPET_CHARS,
     maxSlicesScanned: opts?.maxSlicesScanned ?? DEFAULT_MAX_SLICES_SCANNED,
-    regex: buildRegex(pattern),
+    maxScannedChars: opts?.maxScannedChars ?? DEFAULT_MAX_SCANNED_CHARS,
+    matchTimeBudgetMs: opts?.matchTimeBudgetMs ?? DEFAULT_MATCH_TIME_BUDGET_MS,
+    regex: compiled.regex,
   }
 
   const walk = async (list: TraceSpan[]): Promise<void> => {
@@ -335,5 +419,9 @@ export async function grepSpans(
   }
 
   await walk(spans)
-  return { matches: state.matches, truncated: state.truncated }
+  return {
+    matches: state.matches,
+    truncated: state.truncated,
+    ...(compiled.notice ? { patternNotice: compiled.notice } : {}),
+  }
 }