fix(awk): reject oversized single output writes

Author: chaliy

crates/bashkit/src/builtins/awk/interpreter.rs

@@ -1000,7 +1000,7 @@ impl AwkInterpreter {
     }
 
     fn has_output_capacity(&self, len: usize) -> bool {
-        self.total_output_bytes <= MAX_AWK_OUTPUT_BYTES.saturating_sub(len)
+        len <= MAX_AWK_OUTPUT_BYTES.saturating_sub(self.total_output_bytes)
     }
 
     fn output_target_count(&self) -> usize {

crates/bashkit/src/builtins/awk/tests.rs

@@ -5,7 +5,7 @@ use super::{Awk, csv_split_fields};
 use crate::builtins::limits::{
     AWK_MAX_GETLINE_CACHE_BYTES as MAX_GETLINE_CACHE_BYTES,
     AWK_MAX_GETLINE_CACHED_FILES as MAX_GETLINE_CACHED_FILES,
-    AWK_MAX_GETLINE_FILE_BYTES as MAX_GETLINE_FILE_BYTES,
+    AWK_MAX_GETLINE_FILE_BYTES as MAX_GETLINE_FILE_BYTES, AWK_MAX_OUTPUT_BYTES as MAX_OUTPUT_BYTES,
     AWK_MAX_OUTPUT_TARGETS as MAX_OUTPUT_TARGETS,
 };
 use crate::builtins::{Builtin, Context};
@@ -947,6 +947,20 @@ async fn test_awk_output_limit_exceeded() {
     );
 }
 
+#[tokio::test]
+async fn test_awk_single_write_over_limit_rejected() {
+    // One oversized record must be rejected before buffering stdout.
+    let input = "x".repeat(MAX_OUTPUT_BYTES);
+    let result = run_awk(&["{ print }"], Some(&input)).await.unwrap();
+    assert_eq!(result.exit_code, 2);
+    assert!(
+        result.stderr.contains("output limit exceeded"),
+        "stderr should mention output limit: {}",
+        result.stderr
+    );
+    assert_eq!(result.stdout.len(), 0);
+}
+
 #[tokio::test]
 async fn test_awk_output_under_limit_ok() {
     // Small output well under 10MB should succeed normally