fix: shell catch nil pointer dereference

When a command expression itself panics (not a shell exit code
failure), RadPanic.ShellResult is nil. The catch handler was
unconditionally dereferencing it, causing a nil pointer crash.

Now checks ShellResult != nil before dereferencing. When nil,
assigns the error value to target variables (matching how
assignment catch handlers work) so the catch block can still
access the error.

Author: amterp

core/shell.go

@@ -51,8 +51,17 @@ func (i *Interpreter) executeShellStmt(shell *rl.Shell) EvalResult {
 	}
 
 	return i.withCatch(shell.Catch, func(rp *RadPanic) EvalResult {
-		result := rp.ShellResult
-		assignResults(*result)
+		if rp.ShellResult != nil {
+			assignResults(*rp.ShellResult)
+		} else if len(targets) > 0 {
+			// The panic came from the command expression itself (not a shell exit code),
+			// so there's no shell result. Assign the error to the first target and null to the rest,
+			// matching how assignment catch handlers work.
+			i.doVarPathAssign(targets[0], rp.ErrV, false)
+			for j := 1; j < len(targets); j++ {
+				i.doVarPathAssign(targets[j], RAD_NULL_VAL, false)
+			}
+		}
 
 		res := i.runBlock(shell.Catch.Stmts)
 		if res.Ctrl != CtrlNormal {

core/testing/snapshots/control_flow/catch_shell.snap

@@ -0,0 +1,15 @@
+### TITLE ###
+Shell catch with expression panic
+### DESCRIPTION ###
+When the shell command expression itself causes a RadPanic (e.g., a function
+call returns an error), ShellResult is nil. The catch handler should not crash
+and should assign the error to target variables.
+### INPUT ###
+fn fail():
+	return error("cmd expression failed")
+
+code = `{fail()}` catch:
+	print("caught: {code}")
+### STDOUT ###
+caught: cmd expression failed
+