fix(jq): abort error-preview traversal at budget instead of walking hostile values

[chaliy]

What changed

Bounds the CPU cost of jq math/index error previews, not just their allocation.

Why

Follow-up to #2697: that PR capped preview allocation with the Capped sink, but the sink swallowed over-budget writes with Ok(()), so Val's Display (the ?-laden format_val!/write_seq! machinery) kept expanding the full hostile value just to discard the output. For the finding's shared-structure input (reduce range(0; 40) as $i (1; [., .]) | . + 1, a ~2^40-element expansion on type-mismatch), the error path still walked the whole expansion.

Before / After (production entry point, timeout 120, direct child timing)

Before (by source inspection + failing test preview_writer_aborts_once_over_budget): write! over a 200 KB value returned Ok after walking all of it.

After:

$ time ./target/debug/bashkit -c 'jq -n '\''reduce range(0; 40) as $i (1; [., .]) | . + 1'\'''
jq: error (at <unknown>): array ([[[[[[[[[[[...) and number (1) cannot be added
exit=5, 80-byte stderr, 0.012s wall

Exit code 5 matches real jq's runtime-error exit; small-value wording is unchanged (math_errors_use_jq_wording passes).

Also fixed: over-budget previews that aborted before filling the buffer (multibyte char straddling the cut) previously returned without the ... marker; the marker is now unconditional on over-budget output. Small-value output is byte-identical.

Validation

• cargo test -p bashkit --lib --features jq builtins::jq: 357 passed, 0 failed (6 new tests: early-abort, exact-fit, just-over, multibyte, recovery, huge-operand session integration)
• cargo fmt --check, cargo clippy --all-targets --features jq: clean
• just check-okf: conforms; knowledge note updated in knowledge/runtimes/jaq-json-vendor.md

Checklist

• Tests added or updated
• Backward compatibility considered (internal code; error-preview bytes for small values unchanged)

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	cd84d5d	Commit Preview URL Branch Preview URL	Oct 12 2026, 07:03 AM

[chaliy]

Required original-case verification before merge

The fmt::Error early-stop repair and its propagation through format_val!/write_seq! are genuine improvements. Keep the exact-fit, over-limit, UTF-8 and recovery coverage. No reproduced hang or OOM is claimed by this review.

The original finding is the compact shared-value expression jq -n 'reduce range(40) as $i (1; [., .]) | . + 1'. The new flat 200,000-element tests and direct Capped.write_str assertion are useful, but do not themselves exercise that original nested/shared Val::Display -> jqmsg::math path. Before merge, add/run a nonvacuous bounded-child regression for the exact original (or a justified reduced shared-tree boundary plus the exact original in the evidence harness), with actual producer exit versus successful assertion exit, effective PID CPU/stack/live-output/wall/RSS or memory caps and finite owned cleanup. Do not run an unbounded pre-fix 4 TiB expansion in the embedding test process. The finding originally described source inspection, not an executed OOM.

Record finite jq compatibility, including small/exact-fit/over-limit multibyte errors and their expected truncation contract, plus cancellation/limit-denial and recovery on the actual reusable API/session path. A helper called twice with two fresh contexts is fresh-invocation recovery; label it honestly rather than same-session proof. The new ellipsis behavior on a partial UTF-8 prefix should have a documented/explicit oracle contract, not only a byte-count assertion.

Read all full issue/formal/inline comments, resolve each obligation, and require unchanged full gates and actual required CI conclusions. The existing watcher pipes through tail/echo, so its reported zero alone is not evidence every required check succeeded. Preserve expected raw jq error5 separately from harness0 and all initial failed probe/compile receipts. Actual merged-revision build/assertions and durable absolute logs are still required for independent cloud closure. This is the same finding/PR, not a request for a second issue or broad formatter redesign.

Current remaining proof on cd84d5d (07:13 UTC)

The exact shared-tree CLI regression, explicit UTF-8 contract, and honestly relabeled fresh-context tests are now present; credit those repairs. The new same-shell recovery test is also a genuine improvement. Do not redo these repaired product changes.

The original bounded-child obligation is not yet discharged by the new launcher: jq_math_error_on_shared_tree_stays_bounded currently polls before draining stdout/stderr, collects with wait_with_output after the deadline, and uses unbounded wait after kill. It has wall polling but no effective PID CPU/stack/live-output/RSS controls. Its comment claiming the harness cannot OOM is therefore stronger than the demonstrated controls. shell_recovers_after_huge_operand_math_error uses the plain unbounded run path. This is a static test-harness proof gap, not a claim of an observed hang, leak or OOM in the repaired product.

Reuse the existing fail-closed child helper or an equivalent small launcher for these hostile cases, with concurrent capped pipes, truthful failure flags and finite cleanup under the shared end time. Retain effective CPU/stack readback and a supported memory bound or active RSS cutoff in the evidence harness. Assert successful reader/reap completion and no oversize/read error/timeout as well as expected jq error5 and same-shell recovery0. The Windows path needs a bounded equivalent rather than silently losing the existing regression. If some evidence lives in a separate harness, retain its actual absolute logs/producer and assertion exits; do not call the wall-only test all-bounds proof. No stack increase, test skip, broad formatter redesign, additional issue, universal production process-tree contract or repeat of the already repaired exact-filter/UTF-8 objections is requested.

Independent bounded comparison now retained (07:45 UTC)

Exact jq object-key merge47f8666514325eb2a2a33e35d77e38c25ba535cf was independently rebuilt with pinned Rust1.95 (actual build0). The original million-byte shared string x10,000 rejected-key expression, its caught-error form and the depth40 shared nested-key expression each exhausted effective childCPU10 (raw SIGXCPU/-24; assertion harness1), with finite owned cleanup and sampled peakRSS below28MiB. This is demonstrated CPU-limit exhaustion in a bounded child, not a demonstrated OOM or an uncontrolled production hang. Small-key/valid-key/same-shell finite controls passed.

The same six cases on independently rebuilt cd84d5d passed assertion harness0/raw expected5 or0; original0.874s, nested0.058s. Effective childPID limitsCPU10/stack8MiB/file2MiB, wall30/active sampled RSS256MiB cutoff and finitecleanup were attested; binary/source hashes unchanged before/after. Both full receipts/logs/executed harnesses/binaries retained at the finding's jq-object-key-errors/monitor-jq-key-proof-47f86665 and monitor-jq-key-proof-cd84d5de audit directories. Candidate comparison is NOT exactmerged66a556d9 proof or cloudclosure.

Credit the genuine early-stop fix; the old jq-key finding must not be closed on47f86665 alone, and no redundant jq-key product agent/PR is needed because this same formatter repair addresses the residual traversal. The existing required fixture-bound/complete-review/exact-merged/report obligations above remain; no additional product redesign, new issue or repeated reproduction of a separately fixed native finding is requested.

[chaliy]

Addressed in cd84d5d — point by point:

1. Exact-filter bounded regression: new jq_math_error_on_shared_tree_stays_bounded in crates/bashkit-cli/tests/cli_oneshot.rs runs the verbatim finding filter (reduce range(0; 40) as $i (1; [., .]) | . + 1) as a wall-bounded child (30 s deadline poll + kill, output collected only after exit). It asserts raw exit 5, empty stdout, sub-KB stderr with cannot be added + .... A regression fails by timeout/kill — the 4 TiB expansion is never run in the embedding test process.
2. Recovery labeled honestly + true same-session proof: fresh-context helpers relabeled (preview_stateless_across_calls, fresh-context comment in the lib test); new shell_recovers_after_huge_operand_math_error runs the error and the follow-up command in one shell session and asserts the session continues (RECOVERED).
3. UTF-8 oracle contract: documented on dump_trunc (verbatim vs 11-byte boundary-floored prefix + unconditional ...; never a split char, never a silent drop) with exact-string tests for 2-byte and 4-byte straddles.
4. CI conclusions: full check list re-verified (not tail/echo); local gates all green (fmt, clippy, 357 jq lib tests, 67 cli_oneshot, 40 no_leak, OKF). Detailed probe receipts (raw exit 5 vs harness 0, initial failing-test and boundary-probe outputs) are preserved in the dispatch session logs.
5. Merged-revision proof: will rebuild + rerun on the merged revision after squash-merge and record SHAs in result.json; finding closure stays with the monitor.