From fbeaadf014f212de855f64292a3177f32cf67407 Mon Sep 17 00:00:00 2001
From: luvs01 <luvs01@hanmail.net>
Date: Mon, 17 Aug 2026 21:08:00 +0900
Subject: [PATCH] fix(codex): prevent TOML string regex backtracking

---
 src/codex/injected-marker.ts        |  2 +-
 tests/codex-injected-marker.test.ts | 17 +++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 tests/codex-injected-marker.test.ts

diff --git a/src/codex/injected-marker.ts b/src/codex/injected-marker.ts
index 0156363d30..39717d55a7 100644
--- a/src/codex/injected-marker.ts
+++ b/src/codex/injected-marker.ts
@@ -22,7 +22,7 @@ export function tomlStringPattern(key: string): RegExp {
   // A basic string escapes backslashes, so a Windows path is stored doubled; reading
   // the raw bytes back returned a path that matched nothing on disk and made the
   // journal's recorded catalog path un-restorable (#1798).
-  return new RegExp(`^\\s*${keyToken}\\s*=\\s*("(?:\\\\.|[^"])*"|'[^']*')\\s*(?:#.*)?$`);
+  return new RegExp(`^\\s*${keyToken}\\s*=\\s*("(?:\\\\.|[^"\\\\])*"|'[^']*')\\s*(?:#.*)?$`);
 }
 
 export function rootTomlString(content: string, key: string): string | null {
diff --git a/tests/codex-injected-marker.test.ts b/tests/codex-injected-marker.test.ts
new file mode 100644
index 0000000000..2d4dee47de
--- /dev/null
+++ b/tests/codex-injected-marker.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, test } from "bun:test";
+import { providerTableString, rootTomlString } from "../src/codex/injected-marker";
+
+describe("Codex injected marker TOML strings", () => {
+  test("decodes escaped basic strings", () => {
+    expect(rootTomlString('model_catalog_json = "C:\\\\Users\\\\ocx\\\\catalog.json"', "model_catalog_json"))
+      .toBe("C:\\Users\\ocx\\catalog.json");
+  });
+
+  test("rejects unterminated basic strings with long backslash runs", () => {
+    const malformed = `model_provider = "${"\\".repeat(10_000)}`;
+    expect(rootTomlString(malformed, "model_provider")).toBeNull();
+
+    const providerConfig = `[model_providers.opencodex]\nbase_url = "${"\\".repeat(10_000)}`;
+    expect(providerTableString(providerConfig, "opencodex", "base_url")).toBeNull();
+  });
+});