[astuyve]

What

CallContext.Out/Outf drop the error from the underlying write, and the dispatcher only looked at the builtin's own return code. So echo, printf, sed, awk, sort, grep, cut, wc, ls, find, strings and sha256sum exited 0 on ENOSPC/EIO/EFBIG and left a truncated redirect target.

The dispatcher now wraps the builtin's stdout in a builtins.WriteGuard, which remembers the first write error and fails every later write with it:

• Builtins that check their writes stop early.
• When the builtin otherwise succeeded, the dispatcher prints one <cmd>: write error: <reason> line and sets the status to 1, as bash does (e.g. echo: write error: no space left on device; lowercase like rshell's other messages and tr's existing write error).
• Builtins that already failed and said why (cat, head, uniq) aren't reported twice.
• A broken pipe stays silent, as bash builtins die quietly from SIGPIPE.
• The find -exec / xargs child dispatch gets the same treatment.

Credit

Found by Jacob Hayes with his deterministic-simulation tool patina (finding #1: SILENT oracle, random EIO leg, about 25k runs; reproduces natively with RLIMIT_FSIZE). Findings thread: https://dd.slack.com/archives/D0AC8RLB21J/p1793475631273749

Tests

interp/builtin_write_error_test.go gives the runner a stdout that fails with ENOSPC:

• TestBuiltinWriteErrorReported: echo, printf, sed, sort, grep, wc, cut, cat, head and uniq each exit 1 with exactly one stderr line.
• TestBuiltinWriteErrorFormat: the exact echo message.
• TestBuiltinWriteErrorBrokenPipeSilent: EPIPE prints nothing.

The first two fail on main for the Out-based builtins. go test ./... passes except TestPSPentestLargePIDListDoesNotHang in builtins/ps, which fails the same way on clean main on this host (it has real processes with the PIDs the test assumes are missing).

🤖 Generated with Claude Code