nushell wrapper: a failing --execute body aborts before cleanup, leaking temp files and dropping stdout #3733

A --execute body that exits non-zero aborts the nushell wrapper before its cleanup runs: all three temp files leak, and the command's stdout is discarded. Split out of the review on #3732, which fixed the same abort-before-cleanup shape for the rm-alias case; this one is on a supported path rather than an alias-dependent one, and it's pre-existing — cleanup has always sat after the exec call.

The exec-directive call isn't wrapped in try — templates/nushell.nu#L121-L124. Nushell 0.98+ raises ShellError on a non-zero external exit, so ^sh -c $script unwinds the whole def.

Verified

Nushell 0.114.1, the real rendered wrapper, dedicated TMPDIR:

wt switch --create execfail --yes --execute "exit 42"
print "REACHED_AFTER_WT"

✓ Created branch execfail from main and worktree @ /tmp/nurepo2.execfail
◎ Executing (--execute):
  exit 42

REACHED_AFTER_WT never prints — the wrapper aborted mid-function, taking the rest of the calling script with it — and TMPDIR holds all three mktemp files afterwards. Bare mechanism, no wrapper:

def wrapper [] {
    let f = (mktemp --tmpdir)
    if true { ^sh -c "exit 42" }
    print "REACHED_AFTER_EXEC"     # never prints
    "RETVAL"                       # never returned
}

Why a green test doesn't catch it

test_wrapper_execute_exit_code_propagation already drives this for nu with --execute "exit 42", and passes — but it passes because the abort happens to carry exit 42 out to the shell, not because the wrapper handled it. The assertion the test makes is satisfied by the failure mode. So the leak sits on a path with test coverage.

Proposed fix

Capture the exec exit the way the bash and zsh wrappers do with src_exit, rather than letting the abort carry it:

let exec_exit = (try { ^sh -c $script; 0 } catch { $env.LAST_EXIT_CODE })

folded into $exit_code when that's still 0. The end of the function then propagates it through the existing ^sh -c $"exit ($exit_code)" path, which keeps the 42 the test asserts and additionally prints the stdout that's currently dropped, with cleanup running on the way.

Filed as an issue rather than a PR because it changes exit-code propagation: when both wt and the --execute body fail, something has to decide which code wins, and that's a user-visible contract rather than a mechanical port. Once it lands, test_wrapper_execute_exit_code_propagation should also assert the wrapper is still executing after the failing body — otherwise the next regression passes the same way this one does.