Do not pass cronic's -u option to the wrapped command

cronic

@@ -1,4 +1,8 @@
 #!/bin/bash
+{
+  cronic_caller_flags=${-//[^euvx]/}
+  if compgen -e -X '!SHELLOPTS' SHELLOPTS > /dev/null; then set +vx; fi
+} 2> /dev/null
 
 # Cronic v2 - cron job report wrapper
 # Copyright 2007 Chuck Houpt
@@ -14,6 +18,56 @@
 # --duplicate-stderr options, which may be given in any order.
 # The options and the treatment of execution traces are documented in function
 # `cronic_help`; run `cronic --help`.
+# COMMAND runs in a subshell, with the caller's shell options rather than this
+# script's.  Names that start with `cronic_` are reserved for this script:
+# COMMAND does not see a variable or function with such a name, even one that
+# the caller exported.
+# This script assumes that the caller has not exported a function with the name
+# of a builtin or program that this script uses, such as `set` or `cat`; such a
+# function would run in place of the builtin or program.
+# This script assumes that bash has the `compgen` builtin, which is absent only
+# if bash was built with `--disable-progcomp`.  Without it, an exported
+# SHELLOPTS could make this script trace itself to stderr, and the command could
+# see a `cronic_` function that the caller exported.
+# This script runs under bash 3.2, which is /bin/bash on macOS, so it uses a
+# feature of a later bash only after checking the version.
+
+# The first command sets cronic_caller_flags to the caller's shell options, as
+# the letters that `$-` uses for them, before this script changes them for
+# itself.  This script changes only errexit, nounset, verbose, and xtrace, so
+# the command inherits the caller's other `set -o` options, and its `shopt`
+# options, without any restoring; an option that this script changes must be
+# added to the pattern.  `$-` reports the options without the cost of a command
+# substitution, such as `$(set +o)`, in which bash would also report errexit as
+# off.
+# If the caller exported SHELLOPTS, then the first command also stops this
+# script from tracing itself or echoing its input:  that output would go to
+# this script's stderr, and cron would send email for every run.  An exported
+# `verbose` nonetheless echoes every line that bash reads before it reaches the
+# `set +vx`, which is why that command comes first, before any comment.  Bash
+# cannot tell whether xtrace came from SHELLOPTS or from the command line, so
+# `bash -x cronic` traces this script only if SHELLOPTS is not exported.  The
+# filter makes `compgen` match SHELLOPTS exactly, not every exported variable
+# whose name starts with SHELLOPTS.  The redirection discards the trace of the
+# first command.
+
+# Unset every function whose name starts with `cronic_`, all of which the caller
+# exported, because this script has not yet defined any.  Then the only such
+# functions are this script's, which the subshell that runs the command unsets
+# by name.  Testing the status of `compgen` first avoids the cost of a command
+# substitution when there is no such function.  Each name is read whole, rather
+# than split from an unquoted expansion, so that a name that contains a glob
+# character is not expanded to file names.  The names are read from a
+# here-string rather than from a process substitution, which bash before 5.1
+# rejects in posix mode, as an exported SHELLOPTS can set.  The redirection
+# discards the trace of these commands.
+{
+  if compgen -A function cronic_ > /dev/null; then
+    while read -r cronic_name; do
+      unset -f "$cronic_name"
+    done <<< "$(compgen -A function cronic_)"
+  fi
+} 2> /dev/null
 
 # Exit if a command exits with a non-zero status, and treat unset variables
 # as an error.
@@ -44,6 +98,8 @@ cronic_help() {
   echo "                       is less likely to be overlooked"
   echo "  --                   end the options, so that COMMAND may start with \"-\""
   echo "  -h, --help           print this message"
+  echo "Names that start with \"cronic_\" are reserved:  COMMAND does not see a"
+  echo "variable or function with such a name, even one that the caller exported."
   echo "Execution traces (from \"set -x\") are not treated as error output."
   echo "Bash 4.1 or later writes them to a separate file, via BASH_XTRACEFD; they"
   echo "appear in the report under \"TRACE OUTPUT\".  Other shells write them to"
@@ -152,22 +208,61 @@ trap 'cronic_cleanup; trap - TERM EXIT; kill -s TERM $$' TERM
 # error output exactly, whatever PS4 is.  The descriptor is allocated by bash
 # (as 10 or higher), so that it does not collide with a descriptor, such as 3,
 # that the wrapped command uses for its own purposes.  Bash before 4.1 supports
-# neither BASH_XTRACEFD nor descriptor allocation.
+# neither BASH_XTRACEFD nor descriptor allocation.  Only the subshell that runs
+# the command sets BASH_XTRACEFD, so that this script's own trace, under
+# `bash -x cronic`, goes to this script's stderr rather than into the report.
+cronic_xtrace_fd=
 if ((BASH_VERSINFO[0] > 4 || (BASH_VERSINFO[0] == 4 && BASH_VERSINFO[1] >= 1))); then
   exec {cronic_xtrace_fd}> "$cronic_xtrace"
-  export BASH_XTRACEFD=$cronic_xtrace_fd
 fi
 
+# Run the command with the caller's `set -o` shell options rather than this
+# script's.  If the caller exported SHELLOPTS, then the command would otherwise
+# inherit this script's options, and a bash script that reads an unset variable
+# (as `/usr/bin/texi2dvi` does when /bin/sh is bash) would fail.
+# The command runs in a subshell, rather than via `exec`, so that it can be a
+# shell builtin or an exported shell function; and in a subshell rather than in
+# this shell, so that a builtin such as `exit` or `exec` cannot end this script
+# before it reports.  The subshell is not the left operand of `||`, because
+# bash would then ignore `set -e` throughout the subshell, including in a
+# shell function that it runs.  The redirections are on the subshell, and the
+# subshell sets BASH_XTRACEFD before it restores the caller's xtrace, so that
+# when `-x` is set, the trace of running the command goes into the command's
+# trace output rather than to this script's stderr.
+# The subshell unsets every variable whose name starts with `cronic_` and every
+# function that this script defined, so that a builtin or shell function that
+# is the command does not see this script's variables and functions, and so
+# that a function does not take precedence over a program of the same name.
+# This script's functions are listed, rather than found by
+# `compgen -A function cronic_`, to avoid the cost of a command substitution.
+# The list must name every function that this script defines before this
+# point; the test suite fails if the command can see one that it omits.
+# Then the subshell restores the caller's options.  The subshell first turns
+# off this script's xtrace and verbose, so that the restoring is not traced or
+# echoed; any error in the restoring goes to the command's error output.  The
+# subshell then needs to turn off only this script's nounset (errexit is off
+# already), in the same command that turns on the caller's options, so that
+# restoring verbose and xtrace neither echoes nor traces the restoring of the
+# others.  The `:+` avoids a bare `set -`, which would turn off verbose and
+# xtrace.
 set +e
-# `command` because the wrapped command runs in this shell, where a function of
-# this script, such as `cronic_usage`, would otherwise run in place of a
-# program of the same name.
-command -- "$@" > "$cronic_out" 2> "$cronic_trace"
+(
+  { set +vx; } 2> /dev/null
+  if [ -n "$cronic_xtrace_fd" ]; then
+    export BASH_XTRACEFD=$cronic_xtrace_fd
+  fi
+  unset -f cronic_usage_line cronic_usage cronic_help \
+    cronic_set_expected cronic_cleanup
+  eval "unset -v \"\${!cronic_@}\"
+    set +u${cronic_caller_flags:+ -$cronic_caller_flags}"
+  "$@"
+) > "$cronic_out" 2> "$cronic_trace"
 cronic_result=$?
 set -e
 
-# Unsetting BASH_XTRACEFD also closes its file descriptor.
-unset BASH_XTRACEFD
+if [ -n "$cronic_xtrace_fd" ]; then
+  exec {cronic_xtrace_fd}>&-
+fi
 
 # Prints a basic regular expression that matches its argument literally.
 # The argument must not contain a backslash.