fix(yq): reject YAML aliases before parsing

[chaliy]

Motivation

• Prevent YAML alias/anchor expansion (alias bombs) from being materialized by serde_yaml_ng and amplifying memory/CPU before Bashkit's budget/deadline/output limits apply.

Description

• Add a bounded lexical check reject_yaml_aliases(input: &str) called from parse_yaml_documents to detect and reject alias tokens (*) before deserialization while preserving * inside quoted, single-quoted, multiline-quoted, and block scalar content. (crates/bashkit/src/builtins/yq.rs)
• Implement token_starts_at and is_block_scalar_header helpers to avoid false positives and to treat block scalar headers correctly. (crates/bashkit/src/builtins/yq.rs)
• Add an integration test yaml_aliases_are_rejected_before_expansion that verifies aliases fail closed and that legitimate scalar asterisks remain valid. (crates/bashkit/tests/integration/yq_integration_tests.rs)
• Update user and internal docs to document alias rejection and update TM-DOS-101 and L-YQ-002 mitigation text. (crates/bashkit/docs/yq.md, knowledge/operations/limitations.md, knowledge/security/threat-model.md)

Testing

• Ran formatting and static checks: cargo fmt --all -- --check succeeded, just check-okf succeeded, and just check-doc-links succeeded.
• Attempted targeted integration test run: cargo test -p bashkit --no-default-features --features jq --test integration yq_integration_tests::yaml_aliases_are_rejected_before_expansion -- --exact failed to complete because the workspace currently has unrelated compilation errors in crates/bashkit/src/builtins/archive.rs (type mismatches), so the new test could not be executed to completion in this environment.
• Verified the change is covered by the new integration test and documentation updates; CI must run full test matrix after the unrelated compile errors are fixed.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	5d3221c	Commit Preview URL	Aug 07 2026, 09:23 AM