[lidge-jun]

Summary

• Replace the caller-controlled thinking/effort delimiter matcher in parseCursorVariantId with lastIndexOf("-thinking-") and one suffix validation, addressing CodeQL main alert [Roadmap] Centrally hosted multi-user OpenCodex with tenant isolation #95 (js/polynomial-redos).
• Replace the preceding Claude normalizer's equivalent wildcard matchers with numeric-base recognition and linear suffix parsing, so the same model-name input cannot reach an earlier backtracking expression. Preserve case/whitespace normalization, legacy marker precedence, source spelling, unknown-ID passthrough, and existing return object fields. No model-name length restriction is introduced.
• Add legacy-regex equivalence tables and repeated-delimiter regressions in the two existing test files, within the file-size budget. Update the Cursor structure contract. Branch starts from origin/dev at 9c33e4658b7b180ec8dd20f0e6a21daf3699f76e.

Verification

• bun install --frozen-lockfile — passed; 106 packages installed; lockfile unchanged.
• RED, before either source fix: OCX_TEST_NO_QUEUE=1 bun test tests/providers/cursor/cursor-catalog.test.ts tests/providers/cursor/cursor-claude-id.test.ts — 70 pass, 2 fail. Both new adversarial tests rejected unbounded wildcard matching before executing it.
• Additional mutation proof, with only the catalog regex restored: OCX_TEST_NO_QUEUE=1 bun test tests/providers/cursor/cursor-catalog.test.ts -t 'adversarial model ids' — 0 pass, 1 fail at catalog.ts:476. The linear implementation was then restored.
• GREEN, final code: OCX_TEST_NO_QUEUE=1 bun test tests/providers/cursor/cursor-catalog.test.ts tests/providers/cursor/cursor-claude-id.test.ts — 72 pass, 0 fail, 625 assertions. Tests run serially. Regressions parse 20,000 repeated delimiters and assert unchanged unknown-ID behavior; a temporary, finally-restored regex execution guard catches the old wildcard path deterministically without a wall-clock threshold. The equivalence table preserves the legacy distinction between thinking-extra-high and extra-high-thinking / extra-high-fast.
• bun run typecheck — passed; no type errors in 2,228 files.
• bun run privacy:scan — passed.
• git diff --check — passed. Changed source/test files remain below the 2,000-line ratchet threshold; no test-layout registration changes are needed.
• NOT RUN: full suite, test:changed, structure/file-size/test-layout executable gates, standalone timing probes, CodeQL, runtime/provider integration, and cross-platform validation. The host is under constrained/CRITICAL load; the requested resource exception limits local execution to the touched tests, typecheck, and privacy scan. Broader coverage is left to normal PR CI and independent review. No manual CI dispatch or rerun was performed.
• Security self-review: model names are caller-controlled; synchronous parser work shares the proxy event loop. Reviewed both parsing stages for bounded passes, exact legacy semantics, and secrets/auth/default changes. Independent patch security review remains pending; this PR is draft. No merge is requested by this implementation lane.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. Self-review complete; independent security review pending.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T02:52:00.235476Z	7a9faab	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.