fix(cli): scan-based filter parser, catch VortexException

The regex {@code ^(\w[\w.]*)\s*(!=|>=|<=|==|>|<|=)\s*(.+)$} tripped
SonarCloud S5852 (polynomial-runtime regex). Replaced with a linear
left-to-right scan for the first operator character ({@code !, =, >, <}),
then 1- or 2-char operator slice + name validation. No engine surface,
no backtracking hazard, faster on long inputs.

CLI now also catches VortexException from the export path and returns
ExitStatus.ERROR; previously a typo'd column dumped a stack trace
instead of a clean non-zero exit.

FilterCommandTest covers: usage error, missing file, invalid expr,
all six operators, unknown-column error path, and a 10k-char parser
performance guard.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: dfa1

cli/src/main/java/io/github/dfa1/vortex/cli/FilterCommand.java

@@ -23,17 +23,9 @@
 import java.nio.file.Path;
 import java.util.Arrays;
 import java.util.List;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
 
 final class FilterCommand {
 
-    // Greedy {@code \w[\w.]*}: operator chars {@code (!, =, >, <)} cannot appear inside the
-    // column-name character class, so no backtracking is required. A reluctant quantifier
-    // here was a regex-DoS hazard (Sonar S5852) without any matching benefit.
-    private static final Pattern EXPR = Pattern.compile(
-            "^(\\w[\\w.]*)\\s*(!=|>=|<=|==|>|<|=)\\s*(.+)$");
-
     private FilterCommand() {
     }
 
@@ -62,31 +54,80 @@ static int run(String[] args) {
             CsvExporter.exportCsvFiltered(path, stdout, ExportOptions.defaults(), scanOptions, rowPred);
             stdout.flush();
             return ExitStatus.OK;
-        } catch (IOException e) {
+        } catch (IOException | io.github.dfa1.vortex.core.VortexException e) {
+            // VortexException is unchecked but surfaces user-facing failures (e.g. unknown
+            // column on a typo'd filter); catching it here keeps the CLI from dumping a
+            // stack trace and lets shell pipelines branch on the exit code.
             System.err.println("error: " + e.getMessage());
             return ExitStatus.ERROR;
         }
     }
 
     private static RowFilter parseFilter(String expr) {
-        Matcher m = EXPR.matcher(expr.trim());
-        if (!m.matches()) {
-            throw new IllegalArgumentException("invalid filter expression: \"" + expr
-                                                       + "\"  expected: col op value  (op: >, >=, <, <=, =, ==, !=)");
-        }
-        String col = m.group(1);
-        Comparable<?> value = parseValue(m.group(3).trim());
-        return switch (m.group(2)) {
+        String trimmed = expr.trim();
+        int opStart = indexOfOperator(trimmed);
+        if (opStart <= 0) {
+            throw invalid(expr);
+        }
+        int opEnd = operatorEnd(trimmed, opStart);
+        String op = trimmed.substring(opStart, opEnd);
+        String col = trimmed.substring(0, opStart).stripTrailing();
+        String rawValue = trimmed.substring(opEnd).stripLeading();
+        if (col.isEmpty() || !isValidColumnName(col) || rawValue.isEmpty()) {
+            throw invalid(expr);
+        }
+        Comparable<?> value = parseValue(rawValue);
+        return switch (op) {
             case ">" -> RowFilter.gt(col, value);
             case ">=" -> RowFilter.gte(col, value);
             case "<" -> RowFilter.lt(col, value);
             case "<=" -> RowFilter.lte(col, value);
             case "=", "==" -> RowFilter.eq(col, value);
             case "!=" -> RowFilter.neq(col, value);
-            default -> throw new IllegalArgumentException("unknown operator: " + m.group(2));
+            default -> throw new IllegalArgumentException("unknown operator: " + op);
         };
     }
 
+    /// Scan-based parsing replaces the previous regex
+    /// {@code ^(\w[\w.]*)\s*(!=|>=|<=|==|>|<|=)\s*(.+)$} which Sonar flagged as a
+    /// potential regex-DoS (S5852). Linear scan, no backtracking, no engine surface.
+    private static int indexOfOperator(String s) {
+        for (int i = 0; i < s.length(); i++) {
+            char c = s.charAt(i);
+            if (c == '!' || c == '=' || c == '>' || c == '<') {
+                return i;
+            }
+        }
+        return -1;
+    }
+
+    /// Returns the index one past the operator: 2 chars for {@code !=, >=, <=, ==},
+    /// 1 char for the single-character operators {@code >, <, =}.
+    private static int operatorEnd(String s, int start) {
+        if (start + 1 < s.length() && s.charAt(start + 1) == '=') {
+            return start + 2;
+        }
+        return start + 1;
+    }
+
+    private static boolean isValidColumnName(String s) {
+        if (!Character.isLetterOrDigit(s.charAt(0)) && s.charAt(0) != '_') {
+            return false;
+        }
+        for (int i = 1; i < s.length(); i++) {
+            char c = s.charAt(i);
+            if (!Character.isLetterOrDigit(c) && c != '_' && c != '.') {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    private static IllegalArgumentException invalid(String expr) {
+        return new IllegalArgumentException("invalid filter expression: \"" + expr
+                + "\"  expected: col op value  (op: >, >=, <, <=, =, ==, !=)");
+    }
+
     private static Comparable<?> parseValue(String raw) {
         try {
             return Long.parseLong(raw);

cli/src/test/java/io/github/dfa1/vortex/cli/FilterCommandTest.java

@@ -0,0 +1,111 @@
+package io.github.dfa1.vortex.cli;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+import java.io.IOException;
+import java.nio.file.Path;
+
+import static io.github.dfa1.vortex.cli.CliTestSupport.capture;
+import static io.github.dfa1.vortex.cli.CliTestSupport.writeSmallVortex;
+import static org.assertj.core.api.Assertions.assertThat;
+
+class FilterCommandTest {
+
+    @TempDir
+    Path tmp;
+
+    private Path file;
+
+    @BeforeEach
+    void setUp() throws IOException {
+        // 3-row Vortex file with one I64 column {@code id} = [1, 2, 3].
+        file = writeSmallVortex(tmp, "filter.vortex");
+    }
+
+    @Test
+    void wrongArity_returnsUsageError() {
+        // Given / When
+        CliTestSupport.Captured got = capture(() -> FilterCommand.run(new String[]{"filter"}));
+
+        // Then
+        assertThat(got.status()).isEqualTo(ExitStatus.USAGE_ERROR);
+        assertThat(got.stderr()).contains("usage:");
+    }
+
+    @Test
+    void missingFile_returnsFileNotFound() {
+        // Given
+        Path missing = tmp.resolve("nope.vortex");
+
+        // When
+        CliTestSupport.Captured got = capture(() ->
+                FilterCommand.run(new String[]{"filter", missing.toString(), "id", ">", "0"}));
+
+        // Then
+        assertThat(got.status()).isEqualTo(ExitStatus.FILE_NOT_FOUND);
+        assertThat(got.stderr()).contains("file not found");
+    }
+
+    @Test
+    void invalidExpression_returnsUsageError() {
+        // Given — file exists but expression has no operator
+        // When
+        CliTestSupport.Captured got = capture(() ->
+                FilterCommand.run(new String[]{"filter", file.toString(), "id", "is", "1"}));
+
+        // Then
+        assertThat(got.status()).isEqualTo(ExitStatus.USAGE_ERROR);
+        assertThat(got.stderr()).contains("invalid filter expression");
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {"id > 1", "id >= 2", "id < 3", "id <= 2", "id = 2", "id == 2", "id != 1"})
+    void validExpression_returnsOkAndEmitsHeader(String filter) {
+        // Given — 3-row file with id in [1, 2, 3] (see setUp)
+        String[] parts = filter.split(" ");
+
+        // When
+        CliTestSupport.Captured got = capture(() ->
+                FilterCommand.run(new String[]{"filter", file.toString(), parts[0], parts[1], parts[2]}));
+
+        // Then — every accepted operator reaches OK and produces a CSV header line.
+        assertThat(got.status()).isEqualTo(ExitStatus.OK);
+        assertThat(got.stdout()).startsWith("id");
+    }
+
+    @Test
+    void unknownColumn_returnsErrorNotCrash() {
+        // Given — parses cleanly, fails at column resolution. CLI must catch VortexException
+        // and emit a stable error exit code rather than dumping the stack trace.
+        // When
+        CliTestSupport.Captured got = capture(() ->
+                FilterCommand.run(new String[]{"filter", file.toString(), "nope", "=", "1"}));
+
+        // Then
+        assertThat(got.status()).isEqualTo(ExitStatus.ERROR);
+        assertThat(got.stderr()).contains("error:");
+    }
+
+    @Test
+    void operatorPrefixAttack_doesNotCauseBacktracking() {
+        // Given — input designed to trigger polynomial backtracking under the previous regex
+        // parser (10k-char run before an operator). The current scan-based parser is linear;
+        // this test guards against re-introducing a regex with backtracking.
+        String longName = "a".repeat(10_000);
+        long start = System.nanoTime();
+
+        // When
+        CliTestSupport.Captured got = capture(() ->
+                FilterCommand.run(new String[]{"filter", file.toString(), longName, "=", "1"}));
+        long elapsedMs = (System.nanoTime() - start) / 1_000_000;
+
+        // Then — parsing 10k chars must complete well under a second (linear scan).
+        // The column won't exist; ERROR exit is expected, USAGE_ERROR is what we rule out.
+        assertThat(elapsedMs).isLessThan(1000);
+        assertThat(got.status()).isNotEqualTo(ExitStatus.USAGE_ERROR);
+    }
+}