fix(audit): add 's' unit support to sleep-polling-loop detector (#522)

[AVPthegreat]

Summary

Fixes #522 by adding support for explicit s (seconds) unit suffixes in the sleep-polling-loop audit detector (e.g. sleep 30s).

---

❌ Root Cause Analysis

In src/audit/detectors/sleep-polling-loop.ts, the regex pattern used to detect standalone sleep commands was:

const match = /\bsleep\s+(\d+(?:\.\d+)?)(m|h|d)?\b/.exec(cmd);

Why it failed:

1. The regex unit group (m|h|d)? supported minutes (m), hours (h), and days (d), but omitted seconds (s).
2. When an agent executed sleep 30s (the most standard bash command format):
   • \bsleep\s+ matched sleep
   • (\d+(?:\.\d+)?) matched 30
   • (m|h|d)? matched empty string (because s is not m, h, or d)
   • The regex engine checked for \b (word boundary) right after 30. Because s immediately followed 30, s is a word character ([a-zA-Z0-9_]), so the word boundary check failed.
3. As a result, the match returned null, allowing long sleep 30s loops to bypass the audit detector silently.

---

✅ Fix Details

Updated the regex in src/audit/detectors/sleep-polling-loop.ts to include s in the optional unit capture group:

// Added 's' to unit group regex:
const match = /\bsleep\s+(\d+(?:\.\d+)?)(s|m|h|d)?\b/.exec(cmd);

---

🧪 Unit Tests & Verification

Added new test cases to __tests__/audit/detectors.test.ts:

it("matches `sleep 30s`", () => {
  expect(sleepPollingLoop.detect(bash("sleep 30s"), {})).not.toBeNull();
});

it("does not match `sleep 5s`", () => {
  expect(sleepPollingLoop.detect(bash("sleep 5s"), {})).toBeNull();
});

Test Results:

• Ran vitest run __tests__/audit/detectors.test.ts
• Result: ✓ 26 passed (26)

Summary by CodeRabbit

• Bug Fixes
  • Improved detection of long-running sleep commands that use explicit seconds, such as sleep 30s.
  • Short sleep commands, such as sleep 5s, continue to be excluded from detection.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: aea98477-e0ab-4700-a2e5-d0554612f6c8

📥 Commits

Reviewing files that changed from the base of the PR and between af74838 and b8ffeee.

📒 Files selected for processing (2)

• __tests__/audit/detectors.test.ts
• src/audit/detectors/sleep-polling-loop.ts

---

📝 Walkthrough

Walkthrough

The sleep-polling-loop detector now recognizes explicit seconds units, and tests cover both threshold-matching and below-threshold commands.

Changes

Sleep polling detector

Layer / File(s)	Summary
Support explicit seconds and validate thresholds src/audit/detectors/sleep-polling-loop.ts, __tests__/audit/detectors.test.ts	The parsing regex accepts s, with tests confirming sleep 30s is detected and sleep 5s is ignored.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• FailproofAI/failproofai#574: Updates the same detector regex and adds explicit-seconds coverage.
• FailproofAI/failproofai#588: Updates the same regex and detector tests for sleep 30s.

Suggested reviewers: copilot

Poem

I’m a rabbit with a timer bright,
sleep 30s now shines just right.
Five seconds? Hop, that’s far too small—
The detector catches long sleeps all! 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the sleep-polling-loop s-unit support fix.
Description check	✅ Passed	The description is detailed and relevant, but the Type of Change and Checklist sections from the template are not filled out.
Linked Issues check	✅ Passed	The PR implements #522 by recognizing explicit sleep Ns values and adding tests for sleep 30s behavior.
Out of Scope Changes check	✅ Passed	The changes stay scoped to the detector regex and its tests, with no unrelated modifications evident.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hermes-exosphere]

Your PR is awaiting review by a reviewer. Till then you can join the Discord for conversation: https://discord.befailproof.ai

[Copilot]

Pull request overview

Updates the audit detector for sleep-polling-loop so it correctly detects explicit seconds suffixes (e.g. sleep 30s), aligning behavior with the issue report and the detector’s intent (flagging long sleeps/polling loops).

Changes:

• Extend the standalone sleep regex to accept an explicit s unit suffix.
• Add unit tests covering sleep 30s (match) and sleep 5s (no match).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/audit/detectors/sleep-polling-loop.ts	Regex updated to recognize sleep <n>s so long sleeps with seconds suffix are detected.
tests/audit/detectors.test.ts	Adds coverage for sleep 30s and sleep 5s to prevent regression.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.