fix(run-engine): match Redis hash-tag semantics without a backtracking regex

The tag scan reproduced the first NON-empty brace pair, where Redis stops at
the first pair and treats an empty one as no tag at all. The two disagreed
about the slot for a key like wp:{}{a}. The pattern also backtracked
quadratically on a key made of many opening braces, which CodeQL flagged.

Replaces it with a two-indexOf scan that mirrors keyHashSlot exactly.

Author: d-cs

internal-packages/run-engine/src/engine/waitpointCoordinator/keys.test.ts

@@ -100,6 +100,27 @@ describe("assertSingleSlot", () => {
     expect(() => assertSingleSlot("bad", ["wp:{}"])).toThrow(WaitpointKeyTagError);
   });
 
+  it("rejects an empty first pair, matching Redis rather than skipping to a later one", () => {
+    // Redis stops at the first `{`/`}` pair. An empty one means no tag at all, so it hashes
+    // the whole key. A regex would have found `a` here and wrongly claimed a shared slot.
+    expect(() => assertSingleSlot("bad", ["wp:{}{a}", "wp:{}{a}"])).toThrow(
+      WaitpointKeyTagError
+    );
+  });
+
+  it("takes the first pair when several are present", () => {
+    expect(() => assertSingleSlot("ok", ["wp:{a}{b}", "wp:{a}:w"])).not.toThrow();
+    expect(() => assertSingleSlot("bad", ["wp:{a}{b}", "wp:{b}:w"])).toThrow(
+      WaitpointKeyTagError
+    );
+  });
+
+  it("does not degrade on a key made of many opening braces", () => {
+    const started = performance.now();
+    expect(() => assertSingleSlot("bad", ["{".repeat(50_000)])).toThrow(WaitpointKeyTagError);
+    expect(performance.now() - started).toBeLessThan(1_000);
+  });
+
   it("names the operation and the offending key in the error", () => {
     const wp = waitpointKeys("w_a");
     const run = runBlockKeys("run_abc");

internal-packages/run-engine/src/engine/waitpointCoordinator/keys.ts

@@ -64,7 +64,18 @@ export class WaitpointKeyTagError extends Error {
   }
 }
 
-const HASH_TAG = /\{([^}]+)\}/;
+// Redis's own keyHashSlot rule: the FIRST `{`, then the FIRST `}` after it. A missing brace
+// or an empty pair means no tag, and Redis hashes the whole key. A regex would instead find
+// the first NON-empty pair, disagreeing with Redis on `wp:{}{a}`.
+function hashTag(key: string): string | undefined {
+  const open = key.indexOf("{");
+  if (open === -1) return undefined;
+
+  const close = key.indexOf("}", open + 1);
+  if (close === -1 || close === open + 1) return undefined;
+
+  return key.slice(open + 1, close);
+}
 
 /**
  * Throw unless every key carries the same non-empty hash tag. Called on every script
@@ -74,8 +85,7 @@ export function assertSingleSlot(operation: string, keys: string[]): void {
   let tag: string | undefined;
 
   for (const key of keys) {
-    const match = HASH_TAG.exec(key);
-    const found = match?.[1];
+    const found = hashTag(key);
     if (!found) {
       throw new WaitpointKeyTagError(operation, keys, key);
     }