Adds cd as a sandboxed builtin so scripts can navigate inside their
AllowedPaths. Targets outside the sandbox are rejected; the working
directory and $PWD/$OLDPWD are updated atomically only after
sandbox.Stat confirms the target is a directory.

The framework gains two CallContext callbacks (ChangeDir,
LookupEnvVar) — the minimum surface for cd to mutate runner state
without exposing a generic env-write hook.

Supported flags: -L (default, lexical ..), -P (physical, walks
symlinks via the same sandbox-safe pattern as pwd -P), -h.
Operands: bare DIRECTORY, '-' (OLDPWD, prints new path), no-arg
(HOME). Multi-operand and empty operands are rejected. -e, -@,
CDPATH, ~user, and cdable_vars are intentionally unsupported.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Doubled scenario coverage and dropped skip_assert_against_bash on 5
error scenarios where the observable contract (exit code + cd:
stderr prefix + operand) matches bash even though the wording
diverges (bash prepends 'bash: line N:' and capitalises 'No such',
'Not a').

New basic scenarios cover form combinations that had no coverage:
chain_three_cds, trailing_slash, leading_dot_slash, dotdot_in_middle,
dotdot_chain, dash_toggles, dash_prints_destination,
no_stdout_on_success, oldpwd_chain, pwd_after_chain, in_for_loop,
in_command_substitution, in_or_chain, in_and_chain,
relative_then_absolute, cd_dir_with_space.

New flag scenarios cover combined-form parsing: LP_combined,
PL_combined, L_with_dotdot, dash_dash_then_dir, L_then_dash_dash,
P_then_dash_dash, L_with_dash, P_with_dash.

New hardening scenarios cover side-effect contracts:
no_filesystem_writes, in_pipeline_subshell,
oldpwd_isolated_in_subshell, cd_then_relative_file_resolves.

Skip rate: 53% → 18% (11 of 58 still skip; remaining skips are
sandbox-specific cases or rshell-only flag forms not understood by
bash).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

…n check

Two correctness fixes from review:

1. cd inside a sub-command spawned by RunCommand (find -exec,
   find -execdir, xargs) was wired to the parent runner's
   r.changeDir, so a sub-command could mutate the parent shell's
   working directory and $PWD/$OLDPWD. bash forks a process for
   each invocation, so cd in -exec is silently isolated. We model
   the same isolation by leaving ChangeDir nil in the child
   CallContext — cd in -exec now exits 1 with "cd: not supported
   in this runner" rather than leaking. Stricter than bash's silent
   fork but predictable.

2. changeDir committed the cd even when the target directory had no
   search/execute permission, so `cd nox` (mode 0644) would succeed
   while bash refuses with "Permission denied". Added a
   sandbox.Access(..., 0x01) check after the IsDir() guard; matches
   bash byte-for-byte for this case.

New tests:
- builtins/cd/cd_unix_test.go: TestCdNoSearchPermissionRejected
  locks down the permission-denied behaviour (Unix only; root is
  skipped because it bypasses permission bits).
- tests/scenarios/cmd/cd/hardening/cd_in_find_exec_isolated.yaml:
  verifies that find -execdir cd cannot mutate the parent's pwd.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

bash 5.2 treats `cd /tmp -P` as two operands and exits 1 with "too
many arguments". pflag's default interspersed parsing was silently
consuming the trailing -P as a flag and committing the cd, hiding
malformed scripts. Disable interspersed parsing on the cd FlagSet
so the first positional terminates flag parsing — any subsequent
token (flag-shaped or not) flows through the >1-positional check.

Also drops skip_assert_against_bash on too_many_args.yaml: bash 5.2
exits 1 here (not 2 as bash 3.2 on macOS does), so the scenario can
be compared against the CI bash now. Added a new scenario
flag_after_directory_rejected.yaml covering the regression directly.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Two related corrections so `PWD=/bogus cd b` matches bash byte-for-byte:

1. cd's OLDPWD source is the env var $PWD, not the runner's
   tracked r.Dir. They normally agree, but a temporary assignment
   like `PWD=/bogus` in front of cd makes them diverge — bash
   captures /bogus into OLDPWD, while we were capturing the real
   pre-cd dir. Read $PWD from r.writeEnv first, fall back to r.Dir
   only if unset.

2. cd intentionally writes $PWD and $OLDPWD as part of its
   semantics, but runner_exec.go's deferred temp-assignment revert
   was clobbering those updates after the call returned. Skip the
   revert for PWD/OLDPWD when the dispatched command was a
   *successful* cd. A failed cd still reverts normally so the temp
   assignment doesn't leak.

After both fixes:
  PWD=/bogus cd b → PWD=/parent/b OLDPWD=/bogus     (matches bash)
  PWD=/bogus cd nope → PWD reverts to original       (matches bash)

Two new scenarios in tests/scenarios/cmd/cd/basic/ lock in both
behaviours and run against the bash compat job.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

bash distinguishes \"unset\" from \"set to empty string\" for HOME and
OLDPWD. We were rejecting both, which broke scripts that
temporarily clear those vars (HOME= cd, OLDPWD= cd -). Drop the
empty check from resolveOperand and short-circuit on an empty
target in the handler:

  HOME= cd     → no-op success, pwd unchanged       (matches bash 5.2)
  unset HOME; cd → \"cd: HOME not set\" exit 1        (matches bash)
  OLDPWD= cd - → blank line + no-op success         (matches bash 5.2)
  unset OLDPWD; cd - → \"cd: OLDPWD not set\" exit 1  (matches bash)
  cd \"\"        → no-op success, pwd unchanged       (matches bash 5.2)

Scenarios added (all run against bash compat):
  basic/empty_operand_is_noop.yaml
  basic/home_empty_is_noop.yaml
  basic/oldpwd_empty_dash_prints_blank.yaml

Removed errors/empty_operand.yaml (the contract is no longer an
error). Replaced TestCdEmptyOperandRejected / TestCdPentestEmptyExpansion
with no-op assertions to lock the new contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Two bash-compatibility fixes flagged in review:

1. Per-component validation before ".." collapse. Previously cd
   relied on filepath.Clean (and filepath.Join for relative
   targets), which lexically erases ".." segments before any
   filesystem check. As a result `cd no-such/..` and
   `cd file/..` silently succeeded, while bash refuses both
   (bash POSIX: prefix must be an existing directory before .. is
   processed).

   Rewrote resolvePath to walk path components left-to-right and
   StatFile the accumulated prefix on every "..", erroring out on
   ENOENT / ENOTDIR. The same walker handles -L and -P; -P also
   expands symlinks. Above-sandbox paths still pass through
   opaquely (the final ChangeDir catches anything that lands
   outside).

   Switched the relative-path join in the handler to a raw
   concatenation that preserves "..", since filepath.Join calls
   Clean.

2. Empty-target cd now refreshes $PWD / $OLDPWD. Previously the
   short-circuit on empty target returned before ChangeDir, so
   `cd child; cd ""; cd -` jumped back to the *parent* instead of
   staying in `child` (the stale OLDPWD from the first cd). The
   handler now redirects an empty target to cwd and lets ChangeDir
   update the env vars normally; the `cd -` form still prints a
   blank line.

Allowlist additions: io/fs.ErrPermission (used for above-sandbox
passthrough), strings.HasSuffix (used by the manual path-join).

Three new bash-compared scenarios:
  errors/dotdot_after_missing.yaml
  errors/dotdot_after_file.yaml
  basic/empty_cd_refreshes_oldpwd.yaml

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

setVarString stashes failures on r.exit.code as a side-effect, but
the cd builtin's Result{} immediately clobbers r.exit.code in
runner_exec.go. As a result, hitting MaxTotalVarsBytes during cd's
own PWD/OLDPWD updates would print the storage-cap error but still
report cd as exit 0 — scripts continued past a failed cd with a
stale $PWD while r.Dir had already moved.

Switched the two setVarString calls in changeDir to setVarErr and
return the error. cd's handler already maps a ChangeDir error to
Result{Code: 1}, so the failure now surfaces correctly.

TestCdReportsVarStorageCapFailure pre-fills the env to
MaxTotalVarsBytes and verifies cd exits 1 with the storage-cap
message on stderr.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Previously changeDir set r.Dir = cleaned *before* writing $PWD and
$OLDPWD via setVarErr. If the var-storage cap rejected either
write, changeDir returned an error and the cd builtin reported
exit 1 — but r.Dir had already moved to the new directory, so
subsequent relative file operations resolved against the new dir
while $PWD/$OLDPWD still pointed at the old one. bash never
mutates pwd on a failed cd.

Reorder so the env writes are attempted first:

  1. Capture the previous OLDPWD value for rollback.
  2. setVarErr("OLDPWD", oldDir). On error → return; nothing mutated.
  3. setVarErr("PWD", cleaned). On error → restore the old OLDPWD
     via setVarRestore (cap-bypassing) and return; r.Dir unchanged.
  4. Commit r.Dir = cleaned only after both writes succeed.

Extended TestCdReportsVarStorageCapFailure to assert
`POST_PWD=$dir` after the failed cd, so a regression would surface
immediately.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

…cs; close coverage gaps

Four review items from @AlexandreYang on PR #237 addressed in one
commit:

1. Promote the -P-above-sandbox passthrough invariant from a local
   comment into the package docstring so callers can reason about
   when cd -P diverges from bash on container-style sandboxes.

2. Improve the diagnostic emitted when ChangeDir is nil (the
   RunCommand-child case used by find -exec / -execdir / xargs).
   Was "cd: not supported in this runner" — generic and opaque to
   users. Now reads "cd: cannot change directory from inside
   find -exec/-execdir or xargs (child invocations are isolated)"
   so the user knows the cause is intentional isolation.

3. Add a scenario for HOME pointing outside the sandbox
   (errors/home_outside_sandbox.yaml). Existing scenarios only
   covered HOME unset and HOME empty; the rejection path where
   resolveOperand succeeds but changeDir rejects was untested.

4. Add four hardening unit tests for the HostPrefix re-prefix
   logic in resolveSymlinks: unrelated absolute target gets
   re-prefixed, already-prefixed target is left alone, target
   exactly equal to hp is left alone, and the
   /mnt/host vs /mnt/hostile prefix-collision boundary is
   correctly distinguished by the hp+sep check.

P3 review items (#5 Windows ACL test, #6 isCd literal-name
defer-skip) are intentionally not addressed — both are flagged
as not blocking and are forward-looking notes; replies posted
on the threads.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>