regex-tools/CHANGELOG.md

Changelog

Unreleased

0.4.0 — 2026-07-27

• Expand the workbench from four to twelve selectable execution profiles: JavaScript/ECMAScript, standalone PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, Rust, .NET and Scala/JVM compatibility.
• Add actual PHP 8.5.8 preg_* execution through the self-hosted @php-wasm/web-8-5 3.1.46 runtime. Preserve native UTF-8 byte ranges and identify PHP's embedded PCRE2 as 10.44, independently of the standalone PCRE2 10.47 pack.
• Add actual Perl 5.28.1 execution through unmodified WebPerl 0.09-beta assets as an explicitly legacy beta profile. Pass user values through a fixed data-only JSON request, stream pre-tokenized bounded replacement output into a separately verified MEMFS binary file, disable runtime regex evaluation, reject code assertions and retain the upstream loader's dormant interoperability eval site as a documented CSP caveat.
• Add actual CRuby 4.0.0 Regexp execution through a minimal ruby.wasm 2.9.3-2.9.4 pack. Native String#gsub/String#sub block iteration drives a fixed byte-bounded CRuby-compatible replacement expander. Use separate worker-local WASI request/output files and metadata-only inert JSON instead of output escaping or ruby.wasm's JavaScript-eval object conversion; reject lossy lone-surrogate requests and pass the strict-CSP browser gate.
• Add Emscripten 6.0.4 libc++ std::wregex execution with the modified ECMAScript default grammar, alternate standard grammars and a build configured with dynamic execution disabled. Stream a fixed bounded replacement formatter through the byte cap and verify its grammar against libc++ at load.
• Add Go 1.26.5 standard-library regexp and Rust regex crate 1.13.1 execution, preserving their native UTF-8 byte ranges and non-backtracking semantics. Use bounded streaming replacement expanders that are differentially checked against Regexp.ExpandString and Captures::expand, with predictable base64 output transport. Measure exact encoded request bytes and reserve native JSON limits for worst-case escaping so control-heavy inputs retain the documented decoded limits.
• Add .NET 10.0.10 System.Text.RegularExpressions in browser WebAssembly, with invariant-culture execution, native UTF-16 ranges and a bounded native regex timeout inside the killable worker. Stream bounded replacement tokens without materializing Match.Result, verify token semantics against native .NET at load, and transport output as bounded base64-encoded UTF-8.
• Add an explicitly labelled Scala/JVM compatibility profile backed by the verified TeaVM 0.15.0 java.util.regex engine. No Scala runtime, Scala wrapper API or OpenJDK runtime is claimed.
• Add partial application-owned lexical syntax and replacement providers, flavour-specific quick-reference content and capability labels for the eight new profiles while keeping each real runtime authoritative.
• Add deterministic, closed-file-set runtime packs, checksums, licences, notices, exact toolchain/source identities and release verification for the new self-hosted engines.
• Close the existing Pyodide pack's full base-runtime provenance: exact primary archive or Git tree identities, vendored JavaScript-port hashes, CPython/Emscripten patch and recipe hashes, a preferred-form HACL* route, independently anchored notices, and executable identity checks for the linked compression/database/parser components.
• Transport bounded Python replacement output as canonical base64 with strict declared-length, request-cap and UTF-8 validation instead of content-dependent JSON escaping.
• Close the PHP pack's complete native/source/legal inventory with exact package, binary, build-recipe, archive and Git identities; independently pin 38 legal assets; audit linked component versions; and explicitly exclude the GMP, libsodium, tidy, ICU/intl, FreeType, ImageMagick and adjacent AOM false-positive or unshipped detections.
• Bound retained heavyweight workers with least-recently-used eviction so selecting many profiles does not leave every runtime resident.

0.3.0 — 2026-07-27

• Add a self-hosted Pyodide 314.0.3 worker containing CPython 3.14.2 re, with runtime identity verification, bounded compilation/matching/replacement and exact code-point-to-editor-UTF-16 range normalization.
• Add TeaVM 0.15.0's java.util.regex class-library implementation as a verified self-hosted ES module, with bounded Pattern/Matcher execution, native replacement and exact UTF-16 ranges.
• Identify the Java engine as TeaVM class-library code rather than OpenJDK and report its documented UNICODE_CHARACTER_CLASS, single-digit replacement and unavailable named-replacement compatibility boundaries.
• Add partial application-owned Python and Java lexical syntax and replacement providers while keeping the selected runtime compiler authoritative.
• Separate heavyweight engine loading from the per-request execution deadline, retain worker recovery after timeout/crash/cancellation and keep every runtime local to the release.
• Add flavour-specific quick reference and capability content for all four executable engines.
• Keep comparison, generated cases, code generation, minimization, analysis and formatting behind their explicitly verified ECMAScript/PCRE2 boundaries; Python and Java are never routed through another flavour as a fallback.
• Extend deterministic engine-pack provenance, checksums, licence notices, release verification and nested-path delivery checks to the Python and Java runtime assets.

0.2.0 — 2026-07-27

• Open Quick reference and Capabilities as populated, accessible in-viewport dialogs with keyboard dismissal, focus handling and explicit empty states.
• Add flavour-neutral version, flag, option and execution-worker registries and expose only the ECMAScript and fully wired PCRE2 runtimes.
• Validate flavour/version/options consistently across workbench requests, projects and test suites, including legacy schema-v1 identities.
• Add a production local-first Corpus / Apply workspace with bounded UTF-8 multi-file and pasted-text input, sequential killable worker jobs, progress, cancellation, explicit whole-document/independent-line semantics, preserved line separators, bounded capture extraction and replacement previews, per-document exact/partial summaries, content-free JSON/CSV/NDJSON reports and privacy-gated exact-output downloads and bounded ZIP export.
• Keep corpus content and results ephemeral: project schema v1 stores only the selected workspace mode and rejects injected corpus payloads.
• Add a deterministic, offline PCRE2 10.47 WebAssembly runtime with pinned source/toolchain identities, provenance, licences and checksums.
• Add bounded PCRE2 compile, match and native-substitution ABI calls with match/depth/heap caps, copied caller-owned records, cleanup on every exit, UTF-8-to-UTF-16 range normalization and lone-surrogate rejection.
• Run PCRE2 in a dedicated killable/recoverable worker, expose its real flavour-specific flags and options, and add lexical syntax/replacement coverage, official quick reference, conformance and browser tests.
• Add an ABI-v3 PCRE2 automatic-callout operation with caller-owned event and mark buffers, dual event/byte caps, native truncation stop, exact UTF-8 and UTF-16 positions, a separate killable worker and a bounded viewer that keeps reported fields distinct from derived movement labels.
• Add ECMAScript-scoped advisory static risk diagnostics plus cancellable bounded growth probes and cold/warm native-engine benchmarks with median/p95, separate timing/outcome plots, runtime identity and strict input/output/wall limits.
• Add an ECMAScript/PCRE2 comparison orchestrator with exact per-side requests, independent worker timeout outcomes, normalized-range match/capture alignment, replacement differences and explicit non-comparable states.
• Add a reviewed PCRE2 10.47 8-bit C17 generator with exact UTF-8 byte arrays, native/host limits, error handling, deterministic source identities and compile/execute golden gates against the named toolchain.
• Add deterministic, cancellable failing-subject minimization for saved-test failures, capture ranges, exact engine timeouts and ECMAScript/PCRE2 mismatches, with real-worker verification, explicit budgets and honest transform-local minimality.
• Add deterministic, seed-addressed ECMAScript positive/negative case generation from the normalized AST, with bounded synthesis, actual-engine verification, explicit unsupported coverage, cancellable workers and provenance-preserving unit-test integration.
• Add an idempotent grammar-backed ECMAScript literal/control formatter with an exact preview, separate source/candidate syntax and engine workers, capture shape checks, applicable unit-test replay, explicit inconclusive states and a mandatory confirmation before apply.

0.1.0 — 2026-07-24

• Added the open-source ECMAScript 2025 syntax provider using regexpp 4.12.2.
• Added native browser RegExp execution in a killable, recoverable worker.
• Added deterministic explanation and actual extraction trees.
• Added exact capture indices, synchronized highlighting and bounded captures.
• Added replacement, list/extraction and unit-test workspaces.
• Added project import/export, optional local persistence and privacy controls.
• Added resource limits, real timeout termination and recovery tests.
• Added Toolbox SDK integration and deterministic release packaging.