fix(skills_guard): pre-compile THREAT_PATTERNS at module load time - #32712
Closed
ErnestHysa wants to merge 3 commits into
Closed
fix(skills_guard): pre-compile THREAT_PATTERNS at module load time#32712ErnestHysa wants to merge 3 commits into
ErnestHysa wants to merge 3 commits into
Conversation
…her recovery N43 — Silent plugin/bundle errors: - Plugin command dispatch: logger.debug() -> logger.warning() - Bundle dispatch: logger.debug() -> logger.warning() Plugin/auth failures are no longer invisible to operators. N42 — O(n^2) pending_watchers recovery: - Both recovery loops (startup + per-message) used while+pop(0) which is O(n) per pop - Replaced with enumerate() over the list + periodic asyncio.sleep(0) yield points - Clears the list after iteration instead of per-pop - Batch size of 100 balances throughput vs event-loop responsiveness
THREAT_PATTERNS were used with re.search(pattern, line, re.IGNORECASE) inside two nested loops (for each pattern, for each line) on every scan_file() call. Pre-compile all patterns once at module load into _COMPILED_PATTERNS so scan_file() reuses the compiled objects instead of recompiling the same 100+ patterns on every file scan.
N15 agent_runtime_helpers.py (strip_think_blocks):
- Move inline re.sub() calls (11 patterns) to two module-level
compiled regexes: _STRIP_THINK_BLOCKS_THINK_PATTERNS and
_STRIP_THINK_BLOCKS_TOOL_CALL_PATTERNS.
- Eliminates per-call re.compile() overhead on every invocation.
N16 model_metadata.py (parse_context_limit_from_error,
parse_available_output_tokens_from_error):
- Compile the pattern lists once using func._patterns attrs
(lazy init on first call) instead of re-compiling on every call.
N17 cronjob_tools.py (_CRON_THREAT_PATTERNS,
_CRON_SKILL_ASSEMBLED_PATTERNS, _CRON_EXFIL_COMMAND_PATTERNS):
- Pre-compile all pattern+name tuples at module load time.
- Replace re.search(pattern, ...) calls with pattern.search(...).
N18 hermes_cli/voice.py (speak_text):
- Add 'import re'.
- Pre-compile 10 markdown-stripping regexes at module level.
- Replace 10 sequential re.sub() calls with compiled .sub() calls.
N19 hermes_cli/runtime_provider.py:
- Add _STRIP_V1_SUFFIX module-level compiled regex.
- Add _strip_v1_suffix() helper; replace 4 inline re.sub() calls.
alt-glitch
added
type/perf
Collaborator
14 tasks
Contributor
Author
|
Closing as duplicate — #32713 covers the same THREAT_PATTERNS pre-compilation fix as part of the broader N15-N19 batch. |
19 tasks
1 task
This was referenced Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes N14 — recompiled regex patterns inside nested loops.
Pain Before
called inside nested loops — 100+ threat patterns × N lines × M files = same patterns recompiled thousands of times per scan.
What Was Fixed
Added module-level list that pre-compiles all with once at import time. now iterates over pre-compiled pattern objects and calls directly.
Performance: O(1) pattern lookup per line instead of O(n) regex recompilation.