fix: remove polynomial-redos ambiguity from the target-v1 annotation line regex

CodeQL js/polynomial-redos flagged TARGET_ANNOTATION_LINE_RE
(packages/ad-script/src/internal/target-annotation-serde.ts): the payload
group's `\s+(.*)` let `\s+` and the unconstrained `.*` both match whitespace,
so a run of separator whitespace that ultimately fails to complete the match
has many `\s+`/`.*` splits to backtrack through before concluding failure.

Anchor the payload group on `\S` (the exact complement of `\s`), so the
mandatory `\s+` separator and the payload's first character can never
overlap — the split point becomes unique and no backtracking is possible.

Behavior-preserving: the only caller (parseTargetAnnotationCommentLine)
always matches against an already-.trim()-ed line, whose last character
(whenever the tag matches at all) is never whitespace — so a payload section
`\S.*` would reject (content that is entirely whitespace) can never reach
this regex through the real call path. Verified against the frozen
replay-compat corpus and the full serde/parser test suites, unmodified.

Added a regression test with the exact adversarial shape CodeQL/the reviewer
cited (many tab pairs after the version digits), asserting sub-second parse.

Refs #1478

Co-Authored-By: Claude <noreply@anthropic.com>

Author: thymikee

packages/ad-script/src/internal/__tests__/target-annotation-serde.test.ts

@@ -312,3 +312,31 @@ test('parser accepts an explicit empty-string role (writer-legal for typeless no
   assert.equal(parsed.role, '');
   assert.deepEqual(parsed.ancestry, [{ role: '' }]);
 });
+
+// ---------------------------------------------------------------------------
+// CodeQL js/polynomial-redos (#1536 review): the target-v1 comment-line regex
+// used to backtrack polynomially on a run of separator whitespace that never
+// resolves to a full match — `\s+` and a bare `.*` both accept whitespace, so
+// there were exponentially many ways to split the run between them before
+// concluding failure.
+// ---------------------------------------------------------------------------
+
+test('parseTargetAnnotationCommentLine resolves an adversarial whitespace-run line in well under a second', () => {
+  // A trailing non-whitespace character is deliberate: `parseTargetAnnotationCommentLine`
+  // trims the line before matching, so a purely-trailing whitespace run (the
+  // literal CodeQL-cited shape) would already be stripped before it ever
+  // reaches the regex. Appending one non-whitespace byte keeps the long tab
+  // run internal, so this test genuinely exercises the flagged pattern
+  // through the public entry point rather than being neutralized by trim().
+  const adversarial = `#agent-device:target-v0\t${'\t\t'.repeat(20_000)}x`;
+  const startedAt = Date.now();
+  const result = parseTargetAnnotationCommentLine(adversarial);
+  const elapsedMs = Date.now() - startedAt;
+  assert.ok(
+    elapsedMs < 1000,
+    `expected the adversarial line to parse quickly, took ${elapsedMs}ms`,
+  );
+  // v0 is a future-version comment to this (v1) reader — verifies the regex still
+  // matches the tag/version correctly, not just that it fails fast.
+  assert.deepEqual(result, { kind: 'future-version' });
+});

packages/ad-script/src/internal/target-annotation-serde.ts

@@ -17,7 +17,18 @@ import { AppError } from '@agent-device/kernel/errors';
 const TARGET_ANNOTATION_TAG = 'agent-device:target-v1';
 // Captures the rest of the line verbatim: a line claiming the tag with a
 // garbage payload is a malformed v1 annotation, never an ordinary comment.
-const TARGET_ANNOTATION_LINE_RE = /^#\s*agent-device:target-v(\d+)(?:\s+(.*))?$/;
+//
+// The payload group is anchored on `\S` (CodeQL js/polynomial-redos,
+// #1536 review): `\s+` and a bare `.*` both accept whitespace, so a run of
+// separator characters that ultimately fails to match `$` (e.g. many tabs
+// with no trailing content) has exponentially many `\s+`/`.*` splits to
+// backtrack through. `\S` is `\s`'s complement, so it can never overlap with
+// the mandatory `\s+` before it — the split point is unique, no backtracking
+// possible. Behavior-preserving: the only caller (below) always matches
+// against an already-`.trim()`-ed line, whose last character (when the tag
+// matches at all) is never whitespace, so a payload section that `\S.*`
+// would reject (all-whitespace) can never reach this regex in practice.
+const TARGET_ANNOTATION_LINE_RE = /^#\s*agent-device:target-v(\d+)(?:\s+(\S.*))?$/;
 
 export const TARGET_ANNOTATION_MAX_FIELD_BYTES = 256;
 export const TARGET_ANNOTATION_MAX_PAYLOAD_BYTES = 4096;