[worktrunk-bot]

Problem

The nushell wrapper's temp-file cleanup called a bare rm -f. Nushell resolves aliases at parse time, and config.nu runs before the $nu.vendor-autoload-dirs file the wrapper installs into — so a user's alias rm = ... is already in scope when the wrapper's def is parsed, and intercepts the cleanup. #3714 fixed the same shadowing in the bash and zsh wrappers with command rm; nushell has no command builtin, so it was left out.

Two failures, both verified end-to-end against nushell 0.114.1 (the version CI pins) driving the real rendered wrapper:

alias rm =	before	after
(none)	exit 0, stdout returned, 0 temp files left	unchanged
^false	exit 1, stdout empty, 3 temp files leaked	exit 0, stdout returned, 0 left
^echo TRASHED	TRASHED -f /tmp/... lines injected into stdout, 3 temp files leaked	exit 0, stdout returned, 0 left

The ^false row is the serious one. Cleanup sits between let output = (open $stdout_file --raw) and the function's return, and nushell 0.98+ raises ShellError on a non-zero external exit — so an rm alias that fails, prompts, or isn't installed on that machine aborts the wrapper before it returns, and the command's stdout is silently discarded. Only stdout is affected; stderr has already streamed to the terminal, which is why the symptom hides on wt switch (its output is on stderr) and shows on wt config show.

Solution

Consolidate the two cleanup calls into one, after the last read of any temp file, and branch at runtime on $nu.os-info.family:

if $nu.os-info.family == "windows" {
    try { rm -f $cd_file $exec_file $stdout_file }
} else {
    try { ^rm -f $cd_file $exec_file $stdout_file }
}

^rm bypasses alias expansion entirely — the Unix fix is complete, not partial. Windows keeps the builtin because ^rm is external-only and Windows has no external rm; try covers both branches so cleanup can never abort the wrapper again.

Branching at runtime rather than forking the template by build platform is what keeps this cheap: wt config shell init nu renders one text on every platform, so there's a single init_nu snapshot and no platform-specific rendering to maintain.

Options considered and rejected

• `rm` (backtick-quoted) — bypasses the alias, but `rm` with PATH emptied reports Command `rm` not found, and `rm` with no args prints /usr/bin/rm: missing operand. It resolves to the external, so it's just ^rm spelled differently — same Windows gap, no benefit.
• hide rm — works inside the def, but hide is a parse-time keyword that leaks into the enclosing scope. For an autoloaded file that scope is the user's session, so installing shell integration would silently unbind their own rm alias. Same leak inside a do {} closure. Worse than the bug.
• try alone, no ^rm — cross-platform and kills the abort, but leaves the alias running: a trash alias still trashes worktrunk's temp files on every invocation, and an rm -i-style alias still prompts.
• Forking the template by build platform — same end state on each platform, at the cost of platform-specific init_nu snapshots. The runtime branch gets there without them.

Testing

test_nu_wrapper_cleanup_survives_rm_alias in tests/integration_tests/shell_wrapper.rs runs the real wrapper through a PTY with alias rm = ^false declared ahead of it, against a dedicated TMPDIR, and asserts both symptoms: the wrapper's stdout comes back non-empty, and the temp dir is empty afterwards. It fails on the current template (marker absent — the wrapper aborted) and passes with the fix.

Also run locally: cargo test --lib --bins, and the full shell_wrapper + config_show + test_docs_are_in_sync integration set with --features shell-integration-tests (201 passed).

Not fixed here

A user alias to a custom command or builtin whose signature rejects -f — e.g. alias rm = print "…" — makes the whole wrapper file fail to parse, leaving wt undefined rather than merely broken. That's pre-existing (today's template has two bare rm -f calls) and survives this change, because the Windows branch is still parsed on Unix even though it never runs. Eliminating it means emitting no bare rm at all on Unix, which is the template fork above. Flagged on #3730 rather than bundled in here.

---

Closes #3730 — automated triage

[worktrunk-bot]

Self-authored, so this is a COMMENT rather than an approval.

One gap the consolidated cleanup doesn't close, verified against nushell 0.114.1: the exec-directive call a few lines above it — ^sh -c $script, inside the if ($exec_file | path exists) and (open $exec_file --raw | str trim | is-not-empty) block in templates/nushell.nu — isn't wrapped in try. A --execute body that exits non-zero raises the same ShellError the new comment describes, aborting the wrapper before cleanup runs: all three temp files leak and the command's stdout is discarded. That's the same abort-before-cleanup shape this PR fixes for the rm case, but on a supported path rather than an alias-dependent one.

It's pre-existing and not a regression here — cleanup already sat after the exec call. What makes it worth raising alongside this change is that test_wrapper_execute_exit_code_propagation already drives it for nu (--execute "exit 42"), and passes only because the abort happens to carry exit 42 out to the shell, not because the wrapper handled it. So the leak is on a path that's covered by a green test.

Repro — post-fix template shape, stub binary writing exit 42 into the exec file, dedicated TMPDIR

exit=42
leftover in TMPDIR: 3
tmp.BVI9gUzbux
tmp.R5lDm07YIU
tmp.ziwKEYB5JV

OUT=… (the print $"OUT=($out)" after the call) never runs — the function's return value is discarded along with the rest of the script.

Bare mechanism, no wrapper:

def wrapper [] {
    let f = (mktemp --tmpdir)
    if true { ^sh -c "exit 42" }
    print "REACHED_AFTER_EXEC"     # never prints
    "RETVAL"                       # never returned
}

The fix is to capture the exec exit the way the bash and zsh wrappers do with src_exit rather than letting the abort carry it — let exec_exit = (try { ^sh -c $script; 0 } catch { $env.LAST_EXIT_CODE }), folded into $exit_code when that's still 0. The end of the function then propagates it through the existing ^sh -c $"exit ($exit_code)" path, which keeps the 42 the test asserts and additionally prints the stdout that's currently dropped. That's a change to exit-code propagation, so it belongs in its own PR rather than bolted onto this one — happy to open it.

[worktrunk-bot]

Confirmed against nushell 0.114.1, both the bare mechanism and the real rendered wrapper: wt switch --create execfail --yes --execute "exit 42" leaves all three mktemp files in TMPDIR and never reaches the statement after the wt call, so the rest of the calling script dies with it. And test_wrapper_execute_exit_code_propagation does pass off the abort rather than off handling — its assertion is satisfied by the failure mode.

Split out to #3733 rather than folded in here, for the reason the review gives: deciding which code wins when both wt and the --execute body fail is a user-visible contract, not a mechanical port. The issue carries the repro, the src_exit-shaped fix, and a note that the existing test needs an "still executing after the failing body" assertion so the next regression can't pass the same way.