fix(lab): rewrite raw POSIX path regex without ambiguous alternation

[devin-ai-integration]

Summary

• src/lab/events/limits.ts: RAW_POSIX_PATH_RE flagged by code scanning (alert [WRONG BRANCH] fix(command-code): disable repository fsmonitor during git metadata collection #1, js/redos). The (?:\/|[^/\0\r\n]+)+ alternation lets a run of /-separated segments be repartitioned combinatorially — a client-controlled event detail field can stall the event-limits check for seconds on a few-KB input.
• Rewritten as an unambiguous [^/\0\r\n]+(?:\/+[^/\0\r\n]+)*\/* segment sequence — the match is linear, and the acceptance set is unchanged (validated against the old pattern by randomized fuzzing in fix(security): rewrite two ReDoS-able regular expressions flagged by code scanning #604, where the same fix originally shipped alongside the exec-side rewrite that has since landed on dev separately).
• This is the remaining half of closed PR fix(security): rewrite two ReDoS-able regular expressions flagged by code scanning #604; EMPTY_EXEC_OUTPUT_REGEX no longer needs changing (dev now uses a forward scan).

Verification

• bun test tests/lab/lab-post-merge-hardening.test.ts — 9/9 pass, including a new event privacy admission stays linear on pathological path strings regression test (long segment chains and slash-dense runs reject as raw_path promptly; a URL-shaped field still passes).
• Prior equivalence check in fix(security): rewrite two ReDoS-able regular expressions flagged by code scanning #604: 200k randomized + hand-written edge strings produced zero acceptance differences between old and new patterns.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed (regex internals only; no contract change).
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Link to Devin session: https://app.devin.ai/sessions/18173a51bcf04824a2e66ca1d2e42ccf
Open in Devin Desktop: https://app.devin.ai/desktop/session/18173a51bcf04824a2e66ca1d2e42ccf?variant=devin
Requested by: @luvs01

---

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b1760edb-fc12-4776-b4f4-7bf794eeb353

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

• ✅ Required local validation passed; commands, results, and any full-suite exception are documented.
• ✅ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request is already Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently.
Maintainers: @lidge-jun @Ingwannu

[devin-ai-integration]

Devin Review found 1 potential issue.

[luvs01]

Closing: submitted upstream as lidge-jun#5773, rebased onto current dev and verified — bun test tests/lab/lab-post-merge-hardening.test.ts 9 pass. Nothing left to merge here.