fix(jq): replace halt native to stop sandbox-escape via process::exit

[chaliy]

Closes #1571.

Summary

jaq_std's halt(N) native calls std::process::exit(exit_code). Because
defs.jq wraps it with def halt: halt(0); and
def halt_error(...): ..., halt(...);, an untrusted jq filter can run
halt or halt_error and tear down the entire embedding process — a
sandbox escape via DoS for any caller hosting bashkit.

Fix

Strip the upstream halt native from jaq_std::funs::<D>() and chain
in a safe replacement that pops the variable argument and returns
Error::str("halt is disabled in the bashkit sandbox"). The wrapper
defs (halt, halt_error) still resolve, so callers see a normal jq
runtime error (exit 5) instead of the host being killed.

Removing halt outright was the obvious first attempt, but it breaks
loading of defs.jq because def halt: halt(0); and
def halt_error: ... reference the native — every jq invocation would
fail with "halt/1 is not defined", including unrelated filters like
@tsv. Replacing the native keeps the surface working.

Tests

• halt_does_not_terminate_host_process
• halt_with_arg_does_not_terminate_host_process
• halt_error_does_not_terminate_host_process

The tests reach their assertions at all (instead of the test harness
being killed by std::process::exit), which is the actual regression
guard. All 221 jq unit tests pass.

Spec

• specs/threat-model.md: new row TM-INF-023 covering this threat
  and its mitigation.

Test plan

• cargo test -p bashkit --lib --features jq builtins::jq (221/221)
• cargo fmt --all -- --check
• cargo clippy -p bashkit --features jq --all-targets -- -D warnings

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	aefa2a1	Commit Preview URL Branch Preview URL	May 07 2026, 01:31 PM