Bounded portable regex provider rejects expr match descriptors

[kamilio]

Problem

safe-bash0.1.470 exposes portableAgentCommands({provider:createBoundedRegexProvider()}), registers expr, and injects the provider into its executor, but the package-owned bounded provider rejects every expr-match descriptor. Arithmetic works; regex matching does not.

Reproduction

Import Shell, portableAgentCommands, and createBoundedRegexProvider from @poe-platform/safe-bash/portable; instantiate a virtual filesystem-backed Shell and install the plugin. Execute:

expr 2 + 3
# stdout5, exit0
expr abc : 'a.*'
# expected stdout3, exit0
# actual exit2, stderr:
# expr: bounded regex unsupported: only grep and fixed rg selection descriptors are supported

Verified in real workerd using production Wrangler build, compatibility date2025-01-01 and nodejs_compat_v2. This is not a missing worker_threads module: the portable executor reaches the bounded provider and safely rejects the descriptor.

Requested API

Support conservative ASCII BRE expr-match descriptors, including anchored match-length semantics and bounded captures, through createBoundedRegexProvider with the same work/allocation/input caps. Keep unsupported syntax explicit and cancellation/disposal safe. Alternatively expose an environment-neutral bounded executor supporting this descriptor through a documented portable export. No native unbounded RegExp fallback or worker_threads shim.

[kamilio]

Concrete code path: bounded-provider.js descriptor() admits only kind === "grep" || "rg". The Node regex worker handles expr-match by calling internal commands/expr/bre-worker.js::matchExpr, which already tracks work, allocations, nodes, states, and parser depth. That module itself imports isMainThread from node:worker_threads, so it cannot simply be imported by the portable provider. Factor its bounded engine into an environment-neutral module and adapt the cooperative provider's expr-match reply protocol (anchored match length + capture offsets), keeping any thread-specific guard at the Node wrapper. There is no published low-level matching API that lets an application safely compose this today.

[kamilio]

Validated against the current installed public /portable artifact as well as a failing regression: expr abc : a.* returns exit 2 with the reported unsupported-descriptor diagnostic; arithmetic is unaffected. Implementing the existing bounded BRE engine as an environment-neutral resumable engine, retaining the explicit Node worker wrapper and adding portable cancellation/budget/capture tests. No native RegExp fallback or worker_threads shim. This issue will close only after the fix is validated and delivered to main.

[kamilio]

Verified remote-main delivery: 00a9182; this issue closed automatically on push. Portable expr now supports bounded non-NUL ASCII BRE lengths/captures and anchored nonmatches, retaining explicit unsupported syntax and resource/cancellation/disposal controls. RED→GREEN regressions, installed Node/Bun, strict types/lint, and real workerd default/injected provider checks pass. The full unit run identified a test-side null-export assumption after 20,242 shared and 22,325 SafeBash cases passed; its corrected committed-package check now passes. Final upstream strict-delete parser tests also pass 40/40. Publication remains separate: scoped run 34256413177 and root run 34256413380 are pending, being monitored.

[kamilio]

Scoped release verified separately from the earlier remote-main push: workflow run 34256413177 succeeded and published @poe-platform/safe-bash, safe-fs and safe-js version 0.1.482 on September 8, 2026. This confirms the bounded expr fix is published. The root poe-code release for that head was superseded/cancelled, so this is not a claim of a successful root release. Continuing the requested #672 priority without waiting for releases.

[poe-code-agent]

Issue was resolved by #fd9ba58

Update poe-code via npm install -g poe-code@14.0.93