fix(awk): make expression format errors fatal (#2458)

## What changed

AWK formatting errors inside `sprintf` expressions now stop the AWK
program with exit 2 and a fatal diagnostic. Direct `printf` uses the
same error behavior. Scripts and agents no longer receive a successful
result after a rejected format width or precision.

Closes #2456.

## Why

`sprintf("%10001s", "x")` printed an error but yielded an empty string
and exit 0. A later calculation could look complete although the format
cap had been hit.

## Before / After

Before: `awk 'BEGIN { s=sprintf("%10001s","x"); print length(s) }'`
printed `0`, reported the width error, and exited 0.

After: the same command prints no stdout, reports `awk: fatal: format
width 10001 exceeds maximum (10000)`, and exits 2. The focused
`builtin_cap_security_tests::awk_format` suite passes all 3 tests; the
bash spec suite and 100 awk unit tests pass.

## Risk

- Low. Programs that relied on successful exit after an invalid AWK
format now receive exit 2. Formatting within the cap is unchanged.
- Local `just pre-pr` exposed two SQLite CSV differential failures
against macOS host `sqlite3`; this PR does not change SQLite. Required
Linux CI is the merge gate.

## Checklist

- [x] Tests added or updated
- [x] Backward compatibility considered

Author: chaliy

crates/bashkit/docs/threat-model.md

@@ -109,7 +109,7 @@ through configurable limits.
 | source self-recursion (TM-DOS-056) | Script that sources itself | Track source depth | **MITIGATED** |
 | sleep bypasses timeout (TM-DOS-057) | `sleep N` ignores `ExecutionLimits::timeout` | Implement tokio timeout wrapper | **PARTIAL** |
 | Unbounded builtin output (TM-DOS-058) | `seq 1 1000000` produces 1M lines | Add `max_stdout_bytes` limit | **MITIGATED** |
-| Silent truncation at builtin caps (TM-DOS-109) | `seq 200000` or an awk loop past its cap returns cut output with exit 0 | Caps report `<cmd>: <what> limit (<N>) exceeded` on stderr and exit non-zero; awk caps are fatal | **MITIGATED** |
+| Silent truncation at builtin caps (TM-DOS-109) | `seq 200000`, an awk loop past its cap, or an oversized `sprintf` expression returns incomplete output with exit 0 | Caps report `<cmd>: <what> limit (<N>) exceeded` on stderr and exit non-zero; awk caps and formatting errors are fatal | **MITIGATED** |
 | In-builtin memory growth (TM-DOS-110) | `awk 'BEGIN { s = "x"; while (1) s = s s }'` or `jq -n '"x" \| until(false; . + .)'` allocates until the host aborts | awk checks each string against a 16 MiB cap before allocating it, caps `$N` field indexes, and caps total variable memory at `max_live_intermediate_bytes` (fatal, exit 2). jq meters every live string, array and object against the same limit and fails before growing (exit 5); non-emitting jq loops stop at the timeout | **MITIGATED** |
 | Param expansion bomb (TM-DOS-059) | `${x//a/bigstring}` multiplicative amplification | `max_total_variable_bytes` + `max_stdout_bytes` | MITIGATED |
 | Sparse array huge-index (TM-DOS-060) | `arr[999999999]=x` | HashMap storage; `max_array_entries` | MITIGATED |

crates/bashkit/src/builtins/awk/interpreter.rs

@@ -840,12 +840,13 @@ impl AwkInterpreter {
                 }
                 let format = self.eval_expr(&args[0]).as_string();
                 let values: Vec<AwkValue> = args[1..].iter().map(|a| self.eval_expr(a)).collect();
+                // THREAT[TM-DOS-109]: expression errors must poison the run;
+                // returning an empty string with exit 0 hides a failed cap.
                 match self.format_string(&format, &values) {
                     Ok(s) => AwkValue::String(s),
                     Err(FormatError::Message(e)) => {
-                        self.stderr_output.push_str(&e);
-                        self.stderr_output.push('\n');
-                        AwkValue::String(String::new())
+                        self.fatal(&e);
+                        AwkValue::Uninitialized
                     }
                     Err(FormatError::TooLarge) => {
                         self.string_fits(usize::MAX);
@@ -1244,7 +1245,7 @@ impl AwkInterpreter {
                 {
                     if w_val > Self::MAX_FORMAT_WIDTH {
                         return Err(FormatError::Message(format!(
-                            "awk: format width {} exceeds maximum ({})",
+                            "format width {} exceeds maximum ({})",
                             w_val,
                             Self::MAX_FORMAT_WIDTH
                         )));
@@ -1269,7 +1270,7 @@ impl AwkInterpreter {
                     } else if let Ok(p_val) = p.parse::<usize>() {
                         if p_val > Self::MAX_FORMAT_WIDTH {
                             return Err(FormatError::Message(format!(
-                                "awk: format precision {} exceeds maximum ({})",
+                                "format precision {} exceeds maximum ({})",
                                 p_val,
                                 Self::MAX_FORMAT_WIDTH
                             )));
@@ -1542,11 +1543,7 @@ impl AwkInterpreter {
                         }
                         AwkFlow::Continue
                     }
-                    Err(FormatError::Message(e)) => {
-                        self.stderr_output.push_str(&e);
-                        self.stderr_output.push('\n');
-                        AwkFlow::Exit(Some(2))
-                    }
+                    Err(FormatError::Message(e)) => self.fatal(&e),
                     Err(FormatError::TooLarge) => {
                         self.string_fits(usize::MAX);
                         AwkFlow::Exit(Some(2))

crates/bashkit/tests/integration/builtin_cap_security_tests.rs

@@ -126,6 +126,55 @@ mod awk_loops {
     }
 }
 
+mod awk_format {
+    use super::*;
+
+    #[tokio::test]
+    async fn sprintf_error_in_expression_aborts_the_program() {
+        for body in [
+            "s = sprintf(\"%10001s\", \"x\"); print length(s)",
+            "print length(sprintf(\"%10001s\", \"x\"))",
+            "if (sprintf(\"%10001s\", \"x\")) print \"after\"",
+        ] {
+            let script = format!("awk 'BEGIN {{ {body} }} END {{ print \"end\" }}'");
+            let r = run(&script).await;
+            assert_eq!(r.exit_code, 2, "{body}: exit status");
+            assert_eq!(r.stdout, "", "{body}: no output after error");
+            assert_eq!(
+                r.stderr, "awk: fatal: format width 10001 exceeds maximum (10000)\n",
+                "{body}: diagnostic"
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn sprintf_width_at_cap_succeeds() {
+        let r = run("awk 'BEGIN { s = sprintf(\"%10000s\", \"x\"); print length(s) }'").await;
+        assert_eq!(r.exit_code, 0);
+        assert_eq!(r.stdout, "10000\n");
+        assert_eq!(r.stderr, "");
+    }
+
+    #[tokio::test]
+    async fn precision_and_printf_errors_are_fatal_too() {
+        for (body, diagnostic) in [
+            (
+                "print length(sprintf(\"%.10001s\", \"x\"))",
+                "awk: fatal: format precision 10001 exceeds maximum (10000)\n",
+            ),
+            (
+                "printf \"%10001s\", \"x\"",
+                "awk: fatal: format width 10001 exceeds maximum (10000)\n",
+            ),
+        ] {
+            let r = run(&format!("awk 'BEGIN {{ {body} }} END {{ print \"end\" }}'")).await;
+            assert_eq!(r.exit_code, 2, "{body}: exit status");
+            assert_eq!(r.stdout, "", "{body}: no output after error");
+            assert_eq!(r.stderr, diagnostic, "{body}: diagnostic");
+        }
+    }
+}
+
 mod awk_getline {
     use super::*;
 

crates/bashkit/tests/spec_cases/bash/awk-printf-width.test.sh

@@ -4,7 +4,7 @@
 echo "" | awk '{printf "%999999999d", 1}' 2>&1
 echo "exit: $?"
 ### expect
-awk: format width 999999999 exceeds maximum (10000)
+awk: fatal: format width 999999999 exceeds maximum (10000)
 exit: 2
 ### end
 
@@ -28,6 +28,6 @@ echo "" | awk '{printf "%10000d\n", 1}' | wc -c
 echo "" | awk '{printf "%.999999999f", 1}' 2>&1
 echo "exit: $?"
 ### expect
-awk: format precision 999999999 exceeds maximum (10000)
+awk: fatal: format precision 999999999 exceeds maximum (10000)
 exit: 2
 ### end

knowledge/security/threat-model.md

@@ -276,7 +276,7 @@ runaway scripts without permanently breaking the session.
 | TM-DOS-061 | Snapshot function restore bypasses parser/function limits | Crafted snapshot restores functions exceeding the tenant's parser depth or function memory budget | Restored function source re-parsed with current `ExecutionLimits`; function memory budget re-applied before insertion | **MITIGATED** |
 | TM-DOS-062 | jq file binding amplification | Repeated `--rawfile` / `--slurpfile` bindings to one max-sized VFS file multiply retained jq globals and `$ARGS.named` values without consuming more VFS quota | `MAX_FILE_VAR_REQUESTS` caps binding count; `MAX_FILE_VAR_BYTES` counts cumulative file bytes per binding before retaining globals | **MITIGATED** |
 | TM-DOS-063 | Persistent fd exhaustion | `exec N>/tmp/f` across many `N` values grows `exec_fd_table`/coproc fd buffers for the session | `ExecutionLimits::max_file_descriptors` (default 1024) caps persistent custom descriptors; reused fds and standard 0/1/2 don't count | **MITIGATED** |
-| TM-DOS-109 | Silent truncation at builtin caps | A builtin that stops at a resource cap but exits 0 with no diagnostic (awk loops/recursion/getline caps, `seq`, `yes`, `numfmt`, `history`) returns cut output that scripts and agents treat as complete (#2446, like sed #1005) | Reaching a builtin cap is never silent: `builtins::limits::cap_exceeded` keeps the partial output, writes `<cmd>: <what> limit (<N>) exceeded; output truncated` and exits 1; awk caps are gawk-style fatal errors (`awk: fatal: ...`, exit 2, END skipped). Regression tests: `builtin_cap_security_tests` | **MITIGATED** |
+| TM-DOS-109 | Silent truncation at builtin caps | A builtin that stops at a resource cap but exits 0 with no diagnostic (awk loops/recursion/getline caps, `seq`, `yes`, `numfmt`, `history`), or an awk `sprintf` expression that reports a format cap yet returns an empty value, gives scripts and agents incomplete output as success (#2446, #2456, like sed #1005) | Reaching a builtin cap is never silent: `builtins::limits::cap_exceeded` keeps the partial output, writes `<cmd>: <what> limit (<N>) exceeded; output truncated` and exits 1; awk caps and formatting errors are gawk-style fatal errors (`awk: fatal: ...`, exit 2, END skipped). Regression tests: `builtin_cap_security_tests` | **MITIGATED** |
 | TM-DOS-110 | In-builtin memory growth aborts the host | A value that keeps growing inside awk (`s = s s`, `gsub` with a long replacement, `sprintf("%s%s%s", s, s, s)`, `$1000000000 = 1`, filling arrays, deep recursion shadowing large values) or jq (`until(false; . + .)`, `"x" * 1e12`, `[range(1e12)]`, a non-emitting `until(false; .)` growing evaluator state) allocates until the allocator fails and the embedding process aborts with SIGABRT (#2444) | awk: every string is checked against `AWK_MAX_STRING_BYTES` (16 MiB) *before* it is allocated (concat, `SUBSEP` keys, `sub`/`gsub`/`gensub` as the result grows, `sprintf`/`printf`, `print` joins, rebuilt `$0`); `$N` assignment is capped at `AWK_MAX_FIELD_INDEX`; variables, array elements and values parked in call frames are accounted and capped at `ExecutionLimits::max_live_intermediate_bytes` (default 32 MB); each is a fatal awk error (exit 2) and the script carries on. jq: jaq-json is vendored with a live-memory meter charging every string and array/object body to the same limit, checked before growth (`jq: error: value size limit (N bytes) exceeded`, exit 5), sticky across `try`; value operations poll the execution deadline so non-emitting loops stop at the timeout; output conversion is capped by `max_stdout_bytes`. Regression tests: `memory_growth_security_tests`. Residual: recursion without value operations (`def f: f; f`) and dropping very deep values overflow the stack | **MITIGATED** |
 | TM-DOS-101 | yq structured-data amplification | YAML aliases can expand exponentially during deserialization; deep YAML/JSON, document floods, jaq generators, and YAML re-serialization can consume stack, CPU, or memory beyond the source size | Reject YAML alias tokens with a bounded lexical pass before deserialization; VFS/stdin and aggregate input budgets; serde_yaml_ng recursion cap 128 plus Bashkit depth 100; 4096-document cap; shared jaq work/deadline/output limits; post-serialization stdout cap; YAML+JSON depth/document/input/output regressions plus `yq_fuzz` and arbitrary-input proptest | **MITIGATED** |
 | TM-DOS-107 | Static-analysis command validation amplification | A large comment before thousands of commands makes a whole-script ordered-subsequence scan per command | Build one source-character position index, then validate each analyzed command-name character with a logarithmic position lookup instead of rescanning source | **MITIGATED** |