[Query Builder] String escaping misses backslashes — trailing backslash breaks the query

[Exotic209093]

Severity

Low.

What happens

escapeSoqlString only escapes '. A WHERE value ending in \ (e.g. C:\data\) renders as 'C:\data\' — the trailing backslash escapes the closing quote → MALFORMED_QUERY. Inconsistent with queryParameters.ts:20, which correctly escapes \\ first.

Evidence

• src/ui/utils/soqlBuilder.ts:221-223; test gap at tests/unit/soqlBuilder.test.ts:231

Suggested fix

s.replace(/\\/g, '\\\\').replace(/'/g, "\\'") — mirror queryParameters.

Environment

Commit 74cf21b (main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified).

[Exotic209093]

Fixed in #122