fix(faq-bot): reject catastrophic regex patterns + LRU fallback cooldown (v0.1.2) - #1
Merged
Merged
Conversation
…own (v0.1.2) - Validate regex rules at parse time for nested-quantifier backtracking risk (e.g. (a+)+, (\w+\s?)*); such patterns are skipped with a warning like any other unusable pattern. Accepted patterns run on the native engine unchanged, so lookahead and backreferences still work. - Fallback cooldown map now evicts least-recently-used entries (re-insert on touch) so an active chat's cooldown is preserved when the map hits its cap.
rmyndharis
added a commit
that referenced
this pull request
Jun 23, 2026
…ooting (#7) Expand the terse 4-line Setup into numbered steps, emphasizing "Enable the Google Sheets API" (off by default — the #1 cause of a 403 SERVICE_DISABLED), with the exact console path, the log symptom, propagation note, and the auto-retry behavior. Add the "share the sheet with client_email" step prominently (the other common 403) and a troubleshooting table. Also refresh stale v0.2.1 references to v0.2.2.
rmyndharis
added a commit
that referenced
this pull request
Jun 23, 2026
…eshooting (#8) Rewrite the Setup flow to a professional standard: a prerequisites line, an "at a glance" overview, six numbered steps with GitHub callouts, and the key insight that setup grants TWO independent authorizations (enable the Sheets API AND share the sheet) that each fail with a different 403 — the #1 source of confusion. Add a "Verify it works" section (health buffer count + log grep) and a Troubleshooting table covering both 403s, a partial JSON, a wrong sheet/tab, and the rotated-key case.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two robustness improvements to faq-bot, released as v0.1.2.
Regex rule safety
Operator-authored
regexrules are now screened for catastrophic-backtracking risk at parse time. A pattern that nests an unbounded quantifier inside another quantified group (e.g.(a+)+,(\w+\s?)*) can blow up exponentially on a short crafted input and stall message handling. Such patterns are now skipped with a warning, exactly like a syntactically invalid pattern — one bad rule never takes down the rest.Accepted patterns are compiled with the native engine unchanged, so ordinary regexes, lookahead, and backreferences keep working. The screen is conservative and fails closed.
Fallback cooldown eviction
The per-chat fallback cooldown map evicted by first-seen order, so a continuously-active chat could be evicted ahead of idle ones and have its cooldown reset under high chat volume. The map now evicts least-recently-used (re-inserting a chat on each touch), so an active chat's cooldown survives the cap.
Tests
{2,5},a*b*c*,(abc)+) are kept and still match.tsc --noEmitclean, bundle packages cleanly (no new dependency).