Bound image-request matching to eliminate regex backtracking risk

[Copilot]

This addresses the code scanning alert on image-request detection in Slack message text. The matcher now rejects overly long inputs before applying the existing regex, removing the polynomial backtracking path without changing normal request handling.

• Matcher hardening

  • Add a strict input-length guard to isImageRequest in lib/responses.js
  • Preserve existing matching behavior for typical prompts such as “create an image”, “draw me a picture”, and “generate an illustration”

• Regression coverage

  • Extend test/responses.test.js with an overlong-input case to ensure large untrusted messages are rejected safely

• Change shape

  • Keep the existing pattern and behavior intact for normal-sized requests
  • Limit the fix to the alert location rather than refactoring surrounding response logic

export function isImageRequest(text) {
  if (!text) return false;
  return (
    text.length <= 240 &&
    /(?:can you |could you |please )?(?:create|generate|make|draw)\b.+\b(?:image|picture|drawing|illustration)\b/i.test(
      text
    )
  );
}