fix(fuzz): strip uutils clap error chrome before banned-shape check

[chaliy]

Summary

Yesterday's Fuzz Testing job on main went red again. glob_fuzz inputs that contain /rustc/ make uutils ls (via clap) emit its four-line error template that quotes the input verbatim:

error: unexpected argument '--i{fi/rustc/fi{{RRi' found

  tip: to pass '--i{fi/rustc/fi{{RRi' as a value, use '-- --i{fi/rustc/fi{{RRi'

Usage: ls [OPTION]... [FILE]...

For more information, try '--help'.

The error: line echoes the user input, so the banned host-path shape /rustc/ shows up in stderr even though no internal Debug formatter ran. PR #1623's strip filter only recognized bash: … and ls: cannot access '…' lines and missed this clap chrome — same crash class, different formatter.

Fix

Extend is_real_shell_error_line in crates/bashkit/src/testing.rs with a conservative clap-chrome matcher. Each branch is anchored on a string clap emits literally and that doesn't occur in real Debug leaks:

• error: lines containing one of clap's fixed fragments (unexpected argument ', invalid value ', the argument ', unrecognized subcommand ', the following required arguments…, a value is required for ', equal sign is needed…)
• tip: to pass '…' as a value, use '…'
• Usage: <prog> [OPTION]... [FILE]... / --help / --version
• For more information, try '…'. footer

Keeps the strict assert_no_leak path unchanged: production builtins must never produce shell echoes. MAX_STDERR_BYTES flood cap and the FUZZ_HOST_CANARY env-leak (TM-INF-013) check still run on the unfiltered stderr.

Threat-model TM-INF-022 prose updated to document the carve-out.

Test plan

• 4 new unit tests in testing::tests cover both directions — strip the real failing block (/rustc/ glued into error: unexpected argument + tip + Usage + footer), strip a stand-alone invalid value '…' line, keep error: parser failed: Tok::Ident (real internal leak that happens to start with error: ), keep a Usage: see Span { for details look-alike that lacks the clap shape.
• cargo test -p bashkit --lib testing:: green (12 tests)
• cargo test -p bashkit --test proptest_security --all-features green (18 cases)
• cargo clippy -p bashkit --lib --tests -- -D warnings clean
• cargo fmt --check clean
• Nightly Fuzz Testing on this branch green (manual dispatch after CI)

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	d033e3d	Commit Preview URL Branch Preview URL	May 12 2026, 09:21 AM