feat(interp): improve error messages for blocked and unknown commands

[julesmcrt]

Summary

• All error messages now prefixed with rshell: to clearly identify the source shell (follows the bash: cmd: error convention)
• "Command not allowed" (policy block) and "unknown command" (doesn't exist) use distinct wording so LLMs and users can immediately tell the difference
• A contextual Run 'help' to see allowed/available commands. hint is appended only when help is in the allowed commands list — avoids suggesting a command that would itself be blocked

Before / After

1. Command not allowed — help IS in allowed list

./rshell --allowed-commands "rshell:echo,rshell:help,rshell:ls" -c 'cat'

Before:

cat: command not allowed

After:

rshell: cat: command not allowed
Run 'help' to see allowed commands.

2. Command not allowed — help NOT in allowed list

./rshell --allowed-commands "rshell:echo,rshell:ls" -c 'cat'

Before:

cat: command not allowed

After:

rshell: cat: command not allowed

No hint is shown because help itself is not allowed — suggesting it would produce a confusing follow-up error.

3. Unknown command — help IS in allowed list

./rshell --allowed-commands "rshell:echo,rshell:help,rshell:ls" -c 'foo'

Before:

foo: command not allowed

After:

rshell: foo: command not allowed
Run 'help' to see allowed commands.

Note: foo is not in the allowed list, so the allow check fires before the builtin lookup. The "unknown command" path is only reached when a command passes the allow check but isn't a known builtin (e.g., with --allow-all-commands).

4. Unknown command — help NOT in allowed list

./rshell --allowed-commands "rshell:echo,rshell:ls" -c 'foo'

Before:

foo: command not allowed

After:

rshell: foo: command not allowed

5. Unknown command with --allow-all-commands (the "unknown command" path)

./rshell --allow-all-commands -c 'foo'

Before:

foo: command not found

After:

rshell: foo: unknown command
Run 'help' to see available commands.

Design decisions

• rshell: prefix — Follows the shell: cmd: error convention used by bash/zsh. Helps LLMs and log parsers identify which shell produced the error.
• "command not allowed" vs "unknown command" — Distinct wording prevents confusion between "exists but blocked by policy" and "doesn't exist in this shell at all".
• Conditional hint — The Run 'help' ... hint only appears when help is in the allowed commands set. This avoids a frustrating UX where following the hint produces another error (rshell: help: command not allowed). The check uses r.allowedCommands["help"] for the "not allowed" path, and a pre-computed helpAvailable bool captured at runner creation for the exec handler path.
• No version in error messages — help output already shows the rshell version (via feat(help): show version, command counts, and allowed/not-allowed builtins #181), keeping errors concise.

Depends on

• feat(help): show version, command counts, and allowed/not-allowed builtins #181 (feat(help): show version, command counts, and allowed/not-allowed builtins) — The Run 'help' ... hint is most useful when help shows the version header, allowed/not-allowed builtin lists, and the --all flag.

Test plan

• All 65 modified scenario + Go tests passing (go test ./... — 0 failures)
• Manual verification of all 5 cases above
• Conditional hint verified: appears only when help is allowed
• make fmt clean

🤖 Generated with Claude Code