fix(executor): remove quadratic backtracking in env var reference patterns

apps/sim/app/workspace/[workspaceId]/settings/components/mcp/components/mcp-server-form-modal/mcp-server-form-modal.tsx

@@ -67,7 +67,7 @@ export interface McpServerFormModalProps {
   domainPolicyError?: string
 }
 
-const ENV_VAR_PATTERN = /\{\{[^}]+\}\}/
+const ENV_VAR_PATTERN = /\{\{[^{}]+\}\}/
 
 function hasEnvVarInHostname(url: string): boolean {
   const globalPattern = new RegExp(ENV_VAR_PATTERN.source, 'g')

apps/sim/app/workspace/[workspaceId]/w/components/preview/components/preview-editor/preview-editor.tsx

@@ -128,7 +128,7 @@ function extractAllReferencesFromSubBlocks(
         }
       }
 
-      const envMatches = value.match(/\{\{([^}]+)\}\}/g)
+      const envMatches = value.match(/\{\{([^{}]+)\}\}/g)
       if (envMatches) {
         envMatches.forEach((match) => envVars.add(match))
       }

apps/sim/executor/utils/reference-validation.differential.test.ts

@@ -0,0 +1,109 @@
+/**
+ * @vitest-environment node
+ *
+ * Differential test: narrowing the `{{ENV_VAR}}` body from `[^}]` to `[^{}]`
+ * must not change resolution for any name the product can represent.
+ *
+ * The narrowing exists to remove polynomial backtracking — a class admitting
+ * its own opening delimiter lets every offset in a run of `{` restart a full
+ * scan. That is a real change to the accepted language, not a refactor, and it
+ * runs on the execution path, so the divergence is pinned down here rather than
+ * argued in a review comment.
+ *
+ * The one accepted divergence is enumerated below: a reference whose name
+ * contains `{`. `PATTERNS.ENV_VAR_NAME` forbids that character, so no such name
+ * can be stored through the secrets manager, and the divergence is unreachable.
+ */
+
+import { describe, expect, it } from 'vitest'
+import { PATTERNS, REFERENCE } from '@/executor/constants'
+import { createEnvVarPattern, resolveEnvVarReferences } from '@/executor/utils/reference-validation'
+
+/** The pattern as it stood before the narrowing. */
+function createLegacyEnvVarPattern(): RegExp {
+  return new RegExp(`\\${REFERENCE.ENV_VAR_START}([^}]+)\\${REFERENCE.ENV_VAR_END}`, 'g')
+}
+
+function matchesOf(pattern: RegExp, text: string): string[] {
+  pattern.lastIndex = 0
+  const found: string[] = []
+  let match: RegExpExecArray | null
+  while ((match = pattern.exec(text)) !== null) found.push(`${match.index}:${match[0]}`)
+  return found
+}
+
+/**
+ * Complete up to character equivalence: `{`, `}`, `<`, `>` are the delimiters,
+ * and every other character behaves identically in both bodies. `_`, `A` and
+ * the space cover the name, trim and separator cases.
+ */
+const ALPHABET = ['{', '}', '<', '>', 'A', '_', ' ']
+const MAX_LEN = 6
+
+function* corpus(): Generator<string> {
+  let level = ['']
+  yield ''
+  for (let length = 1; length <= MAX_LEN; length++) {
+    const next: string[] = []
+    for (const prefix of level) {
+      for (const character of ALPHABET) {
+        const candidate = prefix + character
+        next.push(candidate)
+        yield candidate
+      }
+    }
+    level = next
+  }
+}
+
+/** The enumerated divergence: a `{{` whose body reaches a `{` before any `}`. */
+const NAME_CONTAINS_BRACE = /\{\{[^}]*\{/
+
+describe('env var pattern narrowing', () => {
+  it('diverges only where the reference name contains an opening brace', () => {
+    const legacy = createLegacyEnvVarPattern()
+    const current = createEnvVarPattern()
+    const unexplained: string[] = []
+    let differed = 0
+
+    for (const text of corpus()) {
+      const before = matchesOf(legacy, text)
+      const after = matchesOf(current, text)
+      if (before.join('|') === after.join('|')) continue
+      differed++
+      if (!NAME_CONTAINS_BRACE.test(text) && unexplained.length < 20) unexplained.push(text)
+    }
+
+    expect(unexplained).toEqual([])
+    expect(differed).toBeGreaterThan(0)
+  })
+
+  it('never diverges on a representable environment-variable name', () => {
+    const legacy = createLegacyEnvVarPattern()
+    const current = createEnvVarPattern()
+    const names = ['A', '_', 'API_KEY', 'a1', '_x9', 'X'.repeat(64)]
+    const surroundings = ['%s', 'a%sb', '%s%s', 'x {{%s}} y', '{{%s}} {{%s}}']
+
+    for (const name of names) {
+      expect(PATTERNS.ENV_VAR_NAME.test(name)).toBe(true)
+      for (const shape of surroundings) {
+        const text = shape.replaceAll('%s', `{{${name}}}`).replaceAll('{{{{', '{{')
+        expect(matchesOf(current, text)).toEqual(matchesOf(legacy, text))
+      }
+    }
+  })
+
+  it('still resolves references, including padded and embedded ones', () => {
+    const envVars = { API_KEY: 'secret', OTHER: 'value' }
+    expect(resolveEnvVarReferences('{{API_KEY}}', envVars)).toBe('secret')
+    expect(resolveEnvVarReferences('{{ API_KEY }}', envVars)).toBe('secret')
+    expect(resolveEnvVarReferences('a-{{API_KEY}}-b', envVars)).toBe('a-secret-b')
+    expect(resolveEnvVarReferences('{{API_KEY}}/{{OTHER}}', envVars)).toBe('secret/value')
+  })
+
+  it('scans an unterminated brace run in linear time', () => {
+    const started = performance.now()
+    resolveEnvVarReferences('{'.repeat(100_000), { API_KEY: 'secret' })
+    expect(performance.now() - started).toBeLessThan(1_000)
+  })
+})

apps/sim/executor/utils/reference-validation.ts

@@ -1,5 +1,15 @@
 import { REFERENCE } from '@/executor/constants'
 
+/**
+ * Body of an `{{ENV_VAR}}` reference. Excludes both braces for the same reason
+ * `createReferencePattern` excludes both angle brackets: a class that admits its
+ * own opening delimiter lets every offset in a run of `{` restart a full
+ * backtracking scan, which is quadratic in the length of the run. Env var names
+ * are `PATTERNS.ENV_VAR_NAME` (`[A-Za-z_][A-Za-z0-9_]*`), so no representable
+ * name is excluded by this.
+ */
+const ENV_VAR_BODY = '[^{}]+'
+
 /**
  * Creates a regex pattern for matching variable references.
  * Uses [^<>]+ to prevent matching across nested brackets (e.g., "<3 <real.ref>" matches separately).
@@ -15,7 +25,7 @@ export function createReferencePattern(): RegExp {
  * Creates a regex pattern for matching environment variables {{variable}}
  */
 export function createEnvVarPattern(): RegExp {
-  return new RegExp(`\\${REFERENCE.ENV_VAR_START}([^}]+)\\${REFERENCE.ENV_VAR_END}`, 'g')
+  return new RegExp(`\\${REFERENCE.ENV_VAR_START}(${ENV_VAR_BODY})\\${REFERENCE.ENV_VAR_END}`, 'g')
 }
 
 export interface EnvVarResolveOptions {
@@ -66,7 +76,7 @@ export function resolveEnvVarReferences(
   if (typeof value === 'string') {
     if (resolveExactMatch) {
       const exactMatchPattern = new RegExp(
-        `^\\${REFERENCE.ENV_VAR_START}([^}]+)\\${REFERENCE.ENV_VAR_END}$`
+        `^\\${REFERENCE.ENV_VAR_START}(${ENV_VAR_BODY})\\${REFERENCE.ENV_VAR_END}$`
       )
       const exactMatch = exactMatchPattern.exec(value)
       if (exactMatch) {
@@ -140,7 +150,7 @@ export function createWorkflowVariablePattern(): RegExp {
 export function createCombinedPattern(): RegExp {
   return new RegExp(
     `${REFERENCE.START}[^${REFERENCE.START}${REFERENCE.END}]+${REFERENCE.END}|` +
-      `\\${REFERENCE.ENV_VAR_START}[^}]+\\${REFERENCE.ENV_VAR_END}`,
+      `\\${REFERENCE.ENV_VAR_START}${ENV_VAR_BODY}\\${REFERENCE.ENV_VAR_END}`,
     'g'
   )
 }

apps/sim/lib/execution/code-placeholders/shared.ts

@@ -11,7 +11,7 @@ import type {
 } from '@/lib/execution/code-placeholders/types'
 
 const MAX_PLACEHOLDERS = 10_000
-const PLACEHOLDER_PATTERN = /\{\{([^}]+)\}\}/g
+const PLACEHOLDER_PATTERN = /\{\{([^{}]+)\}\}/g
 
 export class CodePlaceholderCompileError extends Error {
   readonly line?: number

apps/sim/lib/mcp/domain-check.test.ts

@@ -13,7 +13,7 @@ vi.mock('dns/promises', () => ({
 }))
 
 vi.mock('@/executor/utils/reference-validation', () => ({
-  createEnvVarPattern: () => /\{\{([^}]+)\}\}/g,
+  createEnvVarPattern: () => /\{\{([^{}]+)\}\}/g,
 }))
 
 import {