Struct SubshStateGuard 

pub struct SubshStateGuard { /* private fields */ }

RAII guard applying the fork-safe subset of entersubsh(ESUB_PGRP|ESUB_NOMONITOR, NULL) (Src/exec.c:1083) around a command substitution that zshrs runs in-process, restoring every touched global on drop.

C’s getoutput() forks, and only the child runs entersubsh:

    /* pid == 0 */
    child_unblock();
    zclose(pipes[0]);
    redup(pipes[1], 1);
    entersubsh(ESUB_PGRP|ESUB_NOMONITOR, NULL);   /* c:4781 */
    cmdpush(CS_CMDSUBST);
    execode(prog, 0, 1, "cmdsubst");

so every state delta dies with the child and the parent is untouched. zshrs collapses that fork (getoutput below → run_command_substitution), which means the deltas were previously never applied at all: inside $( ) the shell kept the caller’s zleactive / opts[USEZLE], so every reader of them took the “we are inside the line editor” branch. Observed failure: lt=( ${(f)"$(fc -l -200)"} ) bound to a ZLE widget died with no interactive history within ZLE — bin_fc’s guard (builtin.rs:2757, a correct port of Src/builtin.c:1523-1527) firing on a stale zleactive. Same class of bug for every other reader: jobs.rs:1114 (time-report suppression), utils.rs:1785 (screen ownership), signals.rs:2050 (refresh-on-signal).

APPLIED (pure restorable scalar state; correct without a fork):

• c:1097 / c:1207 — opts[MONITOR] = 0. ESUB_NOMONITOR is set and job_control_ok is 0 (no ESUB_JOB_CONTROL), so both C branches agree. A substitution body must not do job control.
• c:1164 — shout = NULL. Its readers already handle the NULL case the way the C child does (putshout falls back to stderr, checkrmall returns 1 at utils.rs:3565 per c:2871, mailcheck stays silent per c:1670).
• c:1208 — opts[USEZLE] = 0.
• c:1209 — zleactive = 0.

DELIBERATELY SKIPPED — each would be wrong, or is already handled elsewhere on the in-process path:

• c:1127-1131 unsettrap(sig) — APPLIED, but not here: the trap table is not scalar state (trap bodies and sigaction dispositions), so run_command_substitution resets it with the same helper ( … ) uses (fusevm_bridge::entersubsh_reset_traps) and puts the parent’s flags and dispositions back on exit.
• c:1095 exit_val = 0 — ALREADY DONE on this path: vm_helper.rs:3893 swaps EXIT_VAL to 0 before the nested VM runs and restores it at vm_helper.rs:4004.
• c:1110-1151 setpgrp/attachtty/gleader bookkeeping — process-group and tty surgery. With no fork this moves the interactive shell’s own process group and hands the terminal away.
• c:1154 subsh = 1 — init.rs:2289 does if subsh != 0 { realexit() }. With no fork, an exit inside $( ) would then hard-kill the interactive shell instead of ending the substitution.
• c:1161 zsh_subshell++ — ALREADY DONE on this path by CmdSubstSubshellBump (fusevm_bridge.rs:232, entered at vm_helper.rs:3734). Bumping again would make $ZSH_SUBSHELL read 2 inside $( ) instead of 1.
• c:1165-1193 signal_ignore/signal_default — per-process signal dispositions. Defaulting SIGINT/SIGQUIT/SIGTSTP in the live interactive shell would let ^C kill and ^Z stop the shell itself.
• c:1202-1205 signal_unblock — the process signal mask is owned by the trap dispatcher’s block/unblock pairing; unblocking here breaks that pairing.
• c:1214-1217 close FDT_SAVED_MASK fds — fd surgery. These are the parent’s saved descriptors for redirection restore; closing them is unrecoverable.
• c:1219 clearjobtab(monitor) — would destroy the parent’s job table.
• c:1220 get_usage() — overwrites the parent’s times baseline with no fork to discard it, and nothing inside the substitution reads it.
• c:1221 forklevel = locallevel — FORKLEVEL gates local-scope unwinding; the in-process body pushes and pops its own locals normally, so moving the fork boundary would strand them.

Nesting is safe: each guard saves what it observed on entry and restores exactly that on drop, so LIFO nesting ($( … $( … ) … )) unwinds correctly.

Implementations

impl SubshStateGuard

pub fn enter() -> Self

Apply the deltas listed above and capture the values to restore.

Trait Implementations

impl Drop for SubshStateGuard

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.