…ion-mode-redirects

…ns [PR C]

In remediation mode, output redirections (>, >>, 2>, &>, &>>) open through
the AllowedPaths sandbox instead of being blocked at parse time. /dev/null
is still short-circuited to io.Discard. <> stays blocked in all modes.

- interp/validate.go: validateNode/validateRedirect accept remediationMode bool;
  file-target output redirect cases return nil (pass) when true
- interp/api.go: pass r.remediationMode to validateNode
- interp/runner_redir.go: in remediation mode, open file targets via the sandbox
  with O_WRONLY|O_CREATE|O_TRUNC (>) or O_WRONLY|O_CREATE|O_APPEND (>>);
  add rejectNonRegularRedirectTarget guard to prevent hangs on FIFOs
- analysis/symbols_interp.go: add os.O_APPEND, O_CREATE, O_TRUNC, O_WRONLY
  and io/fs.ModeType to the allowed symbol list
- tests/scenarios_test.go: add remediation_mode field to input struct
- tests/scenarios/shell/redirections/file_target/: 8 new scenarios covering
  truncate, overwrite, append, 2>, &>, &>>, sandbox-blocked, and > file 2>&1

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

…ionMode() with Mode()

Makes the Go API mirror the CLI's --mode flag: callers now write
interp.Mode(interp.ModeRemediation) instead of the asymmetric
interp.RemediationMode().

- type Mode string → type ExecutionMode string (frees "Mode" as a
  function name)
- RemediationMode() RunnerOption → Mode(m ExecutionMode) RunnerOption
  (validates the value, rejects unknown modes)
- cmd/rshell/main.go: interp.Mode(mode) type-conv → interp.ExecutionMode(mode);
  always pass interp.Mode(opts.mode) so read-only is explicit too
- tests/scenarios_test.go: updated call site

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Proves the mode gate (not just the sandbox) blocks writes: AllowedPaths
is configured so the sandbox would permit writes, but without remediation
mode the validator rejects >, >>, and &> at parse time (exit 2).

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Resolve 5 conflicts:
- allowedpaths/sandbox.go: take PR C's readOnly default + SetWritable() +
  tightened allowedOpenFlags (removes O_RDWR/O_EXCL)
- allowedpaths/sandbox_test.go: take PR C's TestSandboxDefaultReadOnly and
  updated SetWritable-gated write tests
- analysis/symbols_allowedpaths.go: drop O_EXCL/O_RDWR (removed from sandbox)
- interp/api.go: keep PR D's Mode(ExecutionMode) API; add SetWritable() call
  in New() when remediationMode is true
- README.md: keep PR D's AllowedPaths paragraph (includes remediation mode docs)

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

os.O_APPEND, os.O_CREATE, os.O_TRUNC, os.O_WRONLY, and io/fs.ModeType
were added to the interpAllowedSymbols ceiling but omitted from
interpPerModeSymbols["read-only"]. runner_redir.go (not a _remediation.go
file) uses all five, so TestInterpPerModeSymbols failed.

Add them to the "read-only" list. The runtime guard (r.remediationMode)
still prevents actual writes in read-only mode; these are flag constants
whose capability gate is allowedpaths.Sandbox.Open.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Move write-capable code (openWriteRedirect, openWriteAllRedirect,
rejectNonRegularRedirectTarget) out of runner_redir.go and into a new
_remediation.go file, so the write-flag symbols (os.O_WRONLY, os.O_CREATE,
os.O_TRUNC, os.O_APPEND, io/fs.ModeType, syntax.RedirOperator) can be listed
in interpPerModeSymbols["remediation"] only — not in "read-only". This restores
the static guarantee that write-capable symbols cannot appear in non-remediation
interp/ files.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

rejectNonRegularRedirectTarget previously returned nil when r.sandbox == nil,
silently skipping the check. Opening a FIFO with O_WRONLY blocks until a reader
connects, so a sandboxless remediation-mode runner would hang for up to 30s on
any named-pipe redirect target.

Extract a statFileMode helper that uses r.sandbox.Stat when a sandbox is
present, and falls back to os.Stat otherwise. The check now always runs,
regardless of whether AllowedPaths is configured.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Covers the one file-target redirect operator that had no dedicated test:
stderr append (2>>). Follows the same pattern as append.yaml and
stderr_redirect.yaml — appends stderr twice and verifies both lines appear.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Extract the repeated `redirectTargetIsDevNull(rd) || remediationMode`
condition into a redirectAllowed helper, removing the duplication across
all four write-redirect cases in validateRedirect (suggested by AlexandreYang).

Add clobber.yaml to cover the >| operator, the one file-target redirect
with no dedicated scenario.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

On Windows, Go's filepath treats /tmp/evil.txt as the relative path
tmp\evil.txt rather than an absolute path. The open therefore fails with
"no such file or directory" before the sandbox can reject it with
"permission denied". Add stderr_contains_windows to accept the
Windows-specific error while keeping the stricter check on Linux/macOS.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

SHELL_FEATURES.md still referenced interp.RemediationMode() which was
renamed to interp.Mode(interp.ModeRemediation) in this PR. Fix the doc.

sandbox.Open() returns ErrPermission immediately when called on a nil
receiver (sandbox.go:368-370), so r.open() always fails before touching
a FIFO when r.sandbox == nil. The os.Stat fallback in statFileMode was
therefore dead code — a nil sandbox already prevents any blocking open.
Replace it with an early return of os.ErrNotExist so the FIFO type-check
is skipped (the subsequent open failure surfaces the real error), and
remove os.Stat from the symbol allowlists.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

PR #524 reviewer explicitly asked for type Mode with ModeReadOnly and
ModeRemediation constants. PR #526 had renamed the type to ExecutionMode
to avoid a naming conflict with the Mode() RunnerOption function, but
that went against the prior review feedback.

Restore type Mode string (as requested in PR #524) and rename the
RunnerOption from Mode() to WithMode(), which reads naturally at the
call site (interp.WithMode(interp.ModeRemediation)) and eliminates the
awkward inversion where the setter and the type had swapped names.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Adds `truncate -s SIZE [-c] FILE...` as a new builtin that is only
wired when the interpreter is in remediation mode. The primary use
case is zeroing log files in place to reclaim disk space without
breaking processes that hold the file open.

Key design decisions:
- Sandbox.Truncate opens with O_NONBLOCK so FIFOs return ENXIO
  immediately instead of blocking, and fstats the fd (not the path)
  before ftruncate to close the TOCTOU race window.
- The callCtx.Truncate field is nil outside remediation mode, making
  the mode guard a nil-pointer check rather than a separate flag.
- Relative-size modifiers (+/-/<>//%/) are rejected with an explicit
  hint rather than silently treated as invalid numbers.
- Z/Y/R/Q suffixes (zetta+) are rejected; their multipliers exceed
  int64.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Sandbox.Open checks s == nil and s.readOnly before proceeding; Sandbox.Truncate
did not, so a direct library caller on a default-mode (read-only) sandbox could
still write. Mirror the same guards so Truncate is consistent with Open as a
public API.

The interp wiring already guards against this at the runner level (callCtx.Truncate
is nil unless remediationMode && sandbox != nil), but the sandbox itself should
enforce its own invariants.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

…ario

On Windows, /etc/hosts (no drive letter) resolves inside the os.Root sandbox
as $DIR\etc\hosts — within AllowedPaths but non-existent — producing
"no such file or directory" instead of "permission denied". Add stderr_windows
override to accept this platform-specific error message.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>