fix: harden maintenance operations

internal/shell/shell_test.go

@@ -472,6 +472,21 @@ func TestRecoveryAndGeneratedFilesAreAtomicOwnerOnly(t *testing.T) {
 	}
 }
 
+func TestDisableManagedShellAfterCurrentShellBecomesUnsupported(t *testing.T) {
+	root := t.TempDir()
+	configuration := shell.Configuration{Shell: "/bin/bash", StartupFile: filepath.Join(root, ".bashrc"), EnvironmentFile: filepath.Join(root, "config", "shell.env"), RecoveryFile: filepath.Join(root, "state", "shell.json")}
+	enabled := shell.New(configuration, shell.OSFileSystem{}, shell.MapEnvironment{})
+	if result := enabled.SetDesired(context.Background(), true, activeProfile()); result.Err != nil {
+		t.Fatal(result.Err)
+	}
+	configuration.Shell = "/bin/fish"
+	unsupported := shell.New(configuration, shell.OSFileSystem{}, shell.MapEnvironment{})
+	result := unsupported.SetDesired(context.Background(), false, nil)
+	if result.Err != nil || result.Inspection.State != target.Disabled {
+		t.Fatalf("disable from unsupported Shell = %#v", result)
+	}
+}
+
 func activeProfile() *profile.Profile {
 	return &profile.Profile{Name: "office", Mode: profile.AdvancedMode, HTTPURL: "http://alice:secret@proxy.example:8080", HTTPSURL: "https://proxy.example:8443", AllURL: "socks5h://proxy.example:1080", Bypass: []string{"localhost", ".example.com", "10.0.0.0/8"}}
 }