[waleedlatif1]

Summary

CodeQL flagged js/polynomial-redos (high) on the v0.9.43 release PR (#9660) at packages/sim-cli/src/runtime/build.ts: looksLikeAnId tested an unknown-option token with /^-[A-Za-z0-9_-]*[A-Z0-9][A-Za-z0-9_-]*$/, whose two stars around the required character backtrack quadratically on a long token that fails at its end (-000…0!). The regex predates #9646/#9650 (#7176); CodeQL raised it now because those PRs rewrote the parse-error guidance around it.

• Replaces it with two linear checks of the same meaning: /^-[\w-]+$/ (a dash then only id characters) and /[A-Z0-9]/ (at least one uppercase letter or digit). \w without the u flag is exactly [A-Za-z0-9_].
• Input is the caller's own argv, so this was never a remote risk, but it was a real local stall (100k chars: ~6.5 s) and it fails the release's CodeQL gate.

Testing

• build.test.ts, three new cases in the parse-error guidance suite:
  • a dash-led id with an uppercase letter or digit gets Example: sim move -- -Ab3xYz;
  • a lowercase dash token stays a misspelt flag (option list, no -- example);
  • a 100,000-character -0…0! token is answered in under 1 s.
• Red → green: on the old regex the timing case fails (6,566 ms); the two behavior cases pass on both, pinning that the meaning did not change. Equivalence also checked over edge cases (-a, -ab, -A1, -ab-c, -_-_9, -9, -x!, --Foo, -é9).
• Whole build.test.ts: 64/64. tsc --noEmit -p packages/sim-cli: clean. biome check: clean.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 4, 2026 9:57am UTC

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Low impact] This PR appears safe to merge.

Summary

Replaces the overlapping repetitions in looksLikeAnId with two linear checks.

• Dash-led ID checks now reject long invalid tokens in linear time.

_{Reviews (1) · Last reviewed commit: "fix(cli): match a dash-led id in linear ..." · Reviewed by Greptile}