@pipelab/plugin-filesystem 1.0.0-beta.23 → 1.0.0-beta.26

package/dist/index.mjs

@@ -3,11 +3,11 @@ import { createRequire } from "node:module";
 import { hostname } from "os";
 import { normalize } from "path";
 import { formatWithOptions, types } from "util";
-import path, { basename, dirname, join } from "node:path";
+import path, { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { constants, platform } from "node:os";
+import { constants, homedir, platform } from "node:os";
 import { appendFileSync, createReadStream, createWriteStream, existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { cp, mkdir, rm, stat } from "node:fs/promises";
+import { cp, mkdir, readdir, rm, stat, writeFile } from "node:fs/promises";
 import http from "node:http";
 import { webcrypto } from "node:crypto";
 import { ChildProcess, exec, execFile, spawn, spawnSync } from "node:child_process";
@@ -45391,6 +45391,17 @@ const websocketPort = 33753;
 const metaUrl = typeof import.meta !== "undefined" ? import.meta.url : void 0;
 const _dirname = typeof __dirname !== "undefined" ? __dirname : metaUrl ? dirname(fileURLToPath(metaUrl)) : process.cwd();
 const isDev = process.env.NODE_ENV === "development";
+const getDefaultUserDataPath = (env) => {
+	const base = (() => {
+		switch (platform()) {
+			case "win32": return process.env.APPDATA || join(homedir(), "AppData", "Roaming");
+			case "darwin": return join(homedir(), "Library", "Application Support");
+			default: return process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+		}
+	})();
+	const mode = env ?? (isDev ? "dev" : "prod");
+	return join(base, "@pipelab", mode === "dev" ? "app-dev" : mode === "beta" ? "app-beta" : "app");
+};
 /**
 * Finds the monorepo root by looking for pnpm-workspace.yaml.
 */
@@ -49152,6 +49163,121 @@ var WebSocketServer = class {
 };
 new WebSocketServer();
 //#endregion
+//#region ../../packages/core-node/src/fs-utils.ts
+var import_slash = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = (path) => {
+		const isExtendedLengthPath = /^\\\\\?\\/.test(path);
+		const hasNonAscii = /[^\u0000-\u0080]+/.test(path);
+		if (isExtendedLengthPath || hasNonAscii) return path;
+		return path.replace(/\\/g, "/");
+	};
+})))(), 1);
+function removeTrailingSlash(path) {
+	return path.replace(/[\\/]+$/, "");
+}
+function isWindowsDriveRoot(path) {
+	return /^[a-z]:$/.test(path);
+}
+const windowsSystemFolders = [
+	"windows",
+	"program files",
+	"program files (x86)",
+	"users",
+	"programdata",
+	"perflogs"
+];
+function isWindowsSystemDirectory(path) {
+	if (!isWindowsDriveRoot(path.substring(0, 2)) || path.charAt(2) !== "/") return false;
+	const folder = path.substring(3);
+	return windowsSystemFolders.includes(folder);
+}
+const unixSystemDirectories = new Set([
+	"",
+	"/usr",
+	"/var",
+	"/opt",
+	"/etc",
+	"/bin",
+	"/sbin",
+	"/lib",
+	"/lib64",
+	"/boot",
+	"/sys",
+	"/proc",
+	"/dev",
+	"/run",
+	"/home",
+	"/root",
+	"/mnt",
+	"/media",
+	"/srv",
+	"/applications",
+	"/library",
+	"/system",
+	"/volumes",
+	"/snap"
+]);
+const homeDirectory = removeTrailingSlash((0, import_slash.default)(resolve(homedir()))).toLowerCase();
+const additionalProtectedPaths = [
+	getDefaultUserDataPath("dev"),
+	getDefaultUserDataPath("beta"),
+	getDefaultUserDataPath("prod"),
+	projectRoot,
+	process.cwd(),
+	"/tmp",
+	"/var/tmp",
+	process.env.TEMP,
+	process.env.TMP,
+	join(homedir(), "AppData"),
+	join(homedir(), "AppData", "Local"),
+	join(homedir(), "AppData", "Roaming"),
+	join(homedir(), "Library"),
+	join(homedir(), "Library", "Application Support"),
+	join(homedir(), ".config"),
+	join(homedir(), ".local"),
+	join(homedir(), ".local", "share"),
+	join(homedir(), ".cache"),
+	join(homedir(), "OneDrive"),
+	join(homedir(), "Dropbox"),
+	join(homedir(), ".ssh"),
+	join(homedir(), ".gnupg"),
+	join(homedir(), ".aws"),
+	join(homedir(), ".docker"),
+	join(homedir(), ".kube"),
+	join(homedir(), ".vscode"),
+	join(homedir(), ".vscode-insiders"),
+	join(homedir(), ".cursor"),
+	join(homedir(), ".npm"),
+	join(homedir(), ".pnpm-state"),
+	join(homedir(), ".yarn"),
+	join(homedir(), ".cargo"),
+	join(homedir(), ".rustup"),
+	join(homedir(), ".m2"),
+	join(homedir(), ".gradle")
+].filter((p) => typeof p === "string" && p.length > 0);
+const userSubdirectories = new Set([
+	join(homedir(), "Downloads"),
+	join(homedir(), "Documents"),
+	join(homedir(), "Desktop"),
+	join(homedir(), "Pictures"),
+	join(homedir(), "Music"),
+	join(homedir(), "Videos"),
+	join(homedir(), "Saved Games"),
+	join(homedir(), "Contacts"),
+	join(homedir(), "Searches"),
+	join(homedir(), "Links"),
+	join(homedir(), "3D Objects"),
+	...additionalProtectedPaths
+].map((p) => removeTrailingSlash((0, import_slash.default)(resolve(p))).toLowerCase()));
+/**
+* Checks if a path matches a critical user or system directory.
+*/
+function isPathBlacklisted(pathToCheck) {
+	if (!pathToCheck) return false;
+	const normalized = removeTrailingSlash((0, import_slash.default)(resolve(pathToCheck))).toLowerCase();
+	return normalized === homeDirectory || unixSystemDirectories.has(normalized) || userSubdirectories.has(normalized) || isWindowsDriveRoot(normalized) || isWindowsSystemDirectory(normalized);
+}
+//#endregion
 //#region ../../node_modules/is-plain-obj/index.js
 function isPlainObject(value) {
 	if (typeof value !== "object" || value === null) return false;
@@ -59542,13 +59668,13 @@ var require_opts_arg = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region ../../node_modules/mkdirp/lib/path-arg.js
 var require_path_arg = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const platform = process.env.__TESTING_MKDIRP_PLATFORM__ || process.platform;
-	const { resolve: resolve$12, parse: parse$2 } = __require("path");
+	const { resolve: resolve$13, parse: parse$2 } = __require("path");
 	const pathArg = (path) => {
 		if (/\0/.test(path)) throw Object.assign(/* @__PURE__ */ new TypeError("path must be a string without null bytes"), {
 			path,
 			code: "ERR_INVALID_ARG_VALUE"
 		});
-		path = resolve$12(path);
+		path = resolve$13(path);
 		if (platform === "win32") {
 			const badWinChars = /[*|"<>?:]/;
 			const { root } = parse$2(path);
@@ -62498,7 +62624,7 @@ var require_readdir_glob = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const fs$20 = __require("fs");
 	const { EventEmitter: EventEmitter$1 } = __require("events");
 	const { Minimatch } = require_minimatch$1();
-	const { resolve: resolve$11 } = __require("path");
+	const { resolve: resolve$12 } = __require("path");
 	function readdir(dir, strict) {
 		return new Promise((resolve, reject) => {
 			fs$20.readdir(dir, { withFileTypes: true }, (err, files) => {
@@ -62607,7 +62733,7 @@ var require_readdir_glob = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (this.options.ignore) this.ignoreMatchers = (Array.isArray(this.options.ignore) ? this.options.ignore : [this.options.ignore]).map((ignore) => new Minimatch(ignore, { dot: true }));
 			this.skipMatchers = [];
 			if (this.options.skip) this.skipMatchers = (Array.isArray(this.options.skip) ? this.options.skip : [this.options.skip]).map((skip) => new Minimatch(skip, { dot: true }));
-			this.iterator = explore(resolve$11(cwd || "."), this.options.follow, this.options.stat, this._shouldSkipDirectory.bind(this));
+			this.iterator = explore(resolve$12(cwd || "."), this.options.follow, this.options.stat, this._shouldSkipDirectory.bind(this));
 			this.paused = false;
 			this.inactive = false;
 			this.aborted = false;
@@ -97890,7 +98016,7 @@ var require_npa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const isWindows = process.platform === "win32";
 	const { URL: URL$6 } = __require("node:url");
 	const path$18 = isWindows ? __require("node:path/win32") : __require("node:path");
-	const { homedir: homedir$1 } = __require("node:os");
+	const { homedir: homedir$2 } = __require("node:os");
 	const HostedGit = require_lib$28();
 	const semver = require_semver$2();
 	const validatePackageName = require_lib$23();
@@ -98095,7 +98221,7 @@ var require_npa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 		if (/^\/~(\/|$)/.test(specPath)) {
 			res.saveSpec = `file:${specPath.substr(1)}`;
-			resolvedPath = path$18.resolve(homedir$1(), specPath.substr(3));
+			resolvedPath = path$18.resolve(homedir$2(), specPath.substr(3));
 		} else if (!path$18.isAbsolute(rawSpec.slice(5))) res.saveSpec = `file:${path$18.relative(where, resolvedPath)}`;
 		else res.saveSpec = `file:${path$18.resolve(resolvedPath)}`;
 		res.fetchSpec = path$18.resolve(where, resolvedPath);
@@ -99241,8 +99367,8 @@ var require_sort$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/@npmcli/package-json/lib/index.js
 var require_lib$18 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const { readFile: readFile$4, writeFile: writeFile$2 } = __require("node:fs/promises");
-	const { resolve: resolve$10 } = __require("node:path");
+	const { readFile: readFile$4, writeFile: writeFile$3 } = __require("node:fs/promises");
+	const { resolve: resolve$11 } = __require("node:path");
 	const parseJSON = require_lib$30();
 	const updateDeps = require_update_dependencies();
 	const updateScripts = require_update_scripts();
@@ -99345,7 +99471,7 @@ var require_lib$18 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				parseErr = err;
 			}
 			if (parseErr) {
-				const indexFile = resolve$10(this.path, "index.js");
+				const indexFile = resolve$11(this.path, "index.js");
 				let indexFileContent;
 				try {
 					indexFileContent = await readFile$4(indexFile, "utf8");
@@ -99390,7 +99516,7 @@ var require_lib$18 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			return this.#path;
 		}
 		get filename() {
-			if (this.path) return resolve$10(this.path, "package.json");
+			if (this.path) return resolve$11(this.path, "package.json");
 		}
 		create(path) {
 			this.#path = path;
@@ -99414,7 +99540,7 @@ var require_lib$18 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			const content = sort ? packageSort(rest) : rest;
 			const fileContent = `${JSON.stringify(content, null, format)}\n`.replace(/\n/g, eol);
 			if (fileContent.trim() !== this.#readFileContent.trim()) {
-				const written = await writeFile$2(this.filename, fileContent);
+				const written = await writeFile$3(this.filename, fileContent);
 				this.#readFileContent = fileContent;
 				return written;
 			}
@@ -100512,8 +100638,8 @@ var require_errors$3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var require_polyfill = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const { ERR_FS_CP_DIR_TO_NON_DIR, ERR_FS_CP_EEXIST, ERR_FS_CP_EINVAL, ERR_FS_CP_FIFO_PIPE, ERR_FS_CP_NON_DIR_TO_DIR, ERR_FS_CP_SOCKET, ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY, ERR_FS_CP_UNKNOWN, ERR_FS_EISDIR, ERR_INVALID_ARG_TYPE } = require_errors$3();
 	const { constants: { errno: { EEXIST, EISDIR, EINVAL, ENOTDIR } } } = __require("os");
-	const { chmod: chmod$1, copyFile, lstat: lstat$2, mkdir: mkdir$5, readdir: readdir$4, readlink, stat: stat$5, symlink, unlink, utimes } = __require("fs/promises");
-	const { dirname: dirname$6, isAbsolute: isAbsolute$1, join: join$6, parse, resolve: resolve$9, sep: sep$2, toNamespacedPath } = __require("path");
+	const { chmod: chmod$1, copyFile, lstat: lstat$2, mkdir: mkdir$5, readdir: readdir$5, readlink, stat: stat$5, symlink, unlink, utimes } = __require("fs/promises");
+	const { dirname: dirname$6, isAbsolute: isAbsolute$1, join: join$6, parse, resolve: resolve$10, sep: sep$2, toNamespacedPath } = __require("path");
 	const { fileURLToPath: fileURLToPath$1 } = __require("url");
 	const defaultOptions = {
 		dereference: false,
@@ -100600,8 +100726,8 @@ var require_polyfill = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		);
 	}
 	async function checkParentPaths(src, srcStat, dest) {
-		const srcParent = resolve$9(dirname$6(src));
-		const destParent = resolve$9(dirname$6(dest));
+		const srcParent = resolve$10(dirname$6(src));
+		const destParent = resolve$10(dirname$6(dest));
 		if (destParent === srcParent || destParent === parse(destParent).root) return;
 		let destStat;
 		try {
@@ -100620,7 +100746,7 @@ var require_polyfill = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		});
 		return checkParentPaths(src, srcStat, destParent);
 	}
-	const normalizePathToArray = (path) => resolve$9(path).split(sep$2).filter(Boolean);
+	const normalizePathToArray = (path) => resolve$10(path).split(sep$2).filter(Boolean);
 	function isSrcSubdir(src, dest) {
 		const srcArr = normalizePathToArray(src);
 		const destArr = normalizePathToArray(dest);
@@ -100719,7 +100845,7 @@ var require_polyfill = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return setDestMode(dest, srcMode);
 	}
 	async function copyDir(src, dest, opts) {
-		const dir = await readdir$4(src);
+		const dir = await readdir$5(src);
 		for (let i = 0; i < dir.length; i++) {
 			const item = dir[i];
 			const srcItem = join$6(src, item);
@@ -100730,7 +100856,7 @@ var require_polyfill = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	}
 	async function onLink(destStat, src, dest) {
 		let resolvedSrc = await readlink(src);
-		if (!isAbsolute$1(resolvedSrc)) resolvedSrc = resolve$9(dirname$6(src), resolvedSrc);
+		if (!isAbsolute$1(resolvedSrc)) resolvedSrc = resolve$10(dirname$6(src), resolvedSrc);
 		if (!destStat) return symlink(resolvedSrc, dest);
 		let resolvedDest;
 		try {
@@ -100741,7 +100867,7 @@ var require_polyfill = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			// istanbul ignore next: should not be possible
 			throw err;
 		}
-		if (!isAbsolute$1(resolvedDest)) resolvedDest = resolve$9(dirname$6(dest), resolvedDest);
+		if (!isAbsolute$1(resolvedDest)) resolvedDest = resolve$10(dirname$6(dest), resolvedDest);
 		if (isSrcSubdir(resolvedSrc, resolvedDest)) throw new ERR_FS_CP_EINVAL({
 			message: `cannot copy ${resolvedSrc} to a subdirectory of self ${resolvedDest}`,
 			path: dest,
@@ -100815,11 +100941,11 @@ var require_with_temp_dir = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 //#endregion
 //#region ../../node_modules/cacache/node_modules/@npmcli/fs/lib/readdir-scoped.js
 var require_readdir_scoped = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const { readdir: readdir$3 } = __require("fs/promises");
+	const { readdir: readdir$4 } = __require("fs/promises");
 	const { join: join$4 } = __require("path");
 	const readdirScoped = async (dir) => {
 		const results = [];
-		for (const item of await readdir$3(dir)) if (item.startsWith("@")) for (const scopedItem of await readdir$3(join$4(dir, item))) results.push(join$4(item, scopedItem));
+		for (const item of await readdir$4(dir)) if (item.startsWith("@")) for (const scopedItem of await readdir$4(join$4(dir, item))) results.push(join$4(item, scopedItem));
 		else results.push(item);
 		return results;
 	};
@@ -100828,7 +100954,7 @@ var require_readdir_scoped = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 //#endregion
 //#region ../../node_modules/cacache/node_modules/@npmcli/fs/lib/move-file.js
 var require_move_file = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const { dirname: dirname$5, join: join$3, resolve: resolve$8, relative: relative$1, isAbsolute } = __require("path");
+	const { dirname: dirname$5, join: join$3, resolve: resolve$9, relative: relative$1, isAbsolute } = __require("path");
 	const fs$12 = __require("fs/promises");
 	const pathExists = async (path) => {
 		try {
@@ -100864,10 +100990,10 @@ var require_move_file = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		if (root) {
 			await Promise.all(symlinks.map(async ({ source: symSource, destination: symDestination }) => {
 				let target = await fs$12.readlink(symSource);
-				if (isAbsolute(target)) target = resolve$8(symDestination, relative$1(symSource, target));
+				if (isAbsolute(target)) target = resolve$9(symDestination, relative$1(symSource, target));
 				let targetStat = "file";
 				try {
-					targetStat = await fs$12.stat(resolve$8(dirname$5(symSource), target));
+					targetStat = await fs$12.stat(resolve$9(dirname$5(symSource), target));
 					if (targetStat.isDirectory()) targetStat = "junction";
 				} catch {}
 				await fs$12.symlink(target, symDestination, targetStat);
@@ -101029,7 +101155,7 @@ var require_path = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region ../../node_modules/cacache/lib/entry-index.js
 var require_entry_index = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const crypto$1 = __require("crypto");
-	const { appendFile, mkdir: mkdir$3, readFile: readFile$3, readdir: readdir$2, rm: rm$4, writeFile: writeFile$1 } = __require("fs/promises");
+	const { appendFile, mkdir: mkdir$3, readFile: readFile$3, readdir: readdir$3, rm: rm$4, writeFile: writeFile$2 } = __require("fs/promises");
 	const { Minipass } = require_commonjs$10();
 	const path$13 = __require("path");
 	const ssri = require_lib$17();
@@ -101076,7 +101202,7 @@ var require_entry_index = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			});
 		};
 		const write = async (tmp) => {
-			await writeFile$1(tmp.target, newIndex, { flag: "wx" });
+			await writeFile$2(tmp.target, newIndex, { flag: "wx" });
 			await mkdir$3(path$13.dirname(bucket), { recursive: true });
 			await moveFile(tmp.target, bucket);
 			tmp.moved = true;
@@ -101222,7 +101348,7 @@ var require_entry_index = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		};
 	}
 	function readdirOrEmpty(dir) {
-		return readdir$2(dir).catch((err) => {
+		return readdir$3(dir).catch((err) => {
 			if (err.code === "ENOENT" || err.code === "ENOTDIR") return [];
 			throw err;
 		});
@@ -105944,7 +106070,7 @@ var require_rm = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/cacache/lib/verify.js
 var require_verify$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const { mkdir: mkdir$2, readFile: readFile$2, rm: rm$2, stat: stat$4, truncate, writeFile } = __require("fs/promises");
+	const { mkdir: mkdir$2, readFile: readFile$2, rm: rm$2, stat: stat$4, truncate, writeFile: writeFile$1 } = __require("fs/promises");
 	const contentPath = require_path();
 	const fsm = require_lib$15();
 	const glob = require_glob();
@@ -106133,7 +106259,7 @@ var require_verify$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	async function writeVerifile(cache, opts) {
 		const verifile = path$9.join(cache, "_lastverified");
 		opts.log.silly("verify", "writing verifile to " + verifile);
-		return writeFile(verifile, `${Date.now()}`);
+		return writeFile$1(verifile, `${Date.now()}`);
 	}
 	module.exports.lastRun = lastRun;
 	async function lastRun(cache) {
@@ -106683,8 +106809,8 @@ var require_lib$12 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region ../../node_modules/@npmcli/installed-package-contents/lib/index.js
 var require_lib$11 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const bundled = require_lib$12();
-	const { readFile: readFile$1, readdir: readdir$1, stat: stat$3 } = __require("fs/promises");
-	const { resolve: resolve$7, basename: basename$4, dirname: dirname$4 } = __require("path");
+	const { readFile: readFile$1, readdir: readdir$2, stat: stat$3 } = __require("fs/promises");
+	const { resolve: resolve$8, basename: basename$4, dirname: dirname$4 } = __require("path");
 	const normalizePackageBin = require_lib$21();
 	const readPackage = ({ path, packageJsonCache }) => packageJsonCache.has(path) ? Promise.resolve(packageJsonCache.get(path)) : readFile$1(path).then((json) => {
 		const pkg = normalizePackageBin(JSON.parse(json));
@@ -106728,7 +106854,7 @@ var require_lib$11 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				const nm = /^@.+/.test(scope) ? dirname$4(dir) : dir;
 				const binFiles = [];
 				Object.keys(pkg.bin).forEach((b) => {
-					const base = resolve$7(nm, ".bin", b);
+					const base = resolve$8(nm, ".bin", b);
 					binFiles.push(base, base + ".cmd", base + ".ps1");
 				});
 				(await Promise.all(binFiles.map((b) => stat$3(b).then(() => b).catch(() => null)))).filter((b) => b).forEach((b) => result.add(b));
@@ -106738,7 +106864,7 @@ var require_lib$11 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			result.add(path);
 			return result;
 		}
-		const [dirEntries, bundleDeps] = await Promise.all([readdir$1(path, { withFileTypes: true }), currentDepth === 0 && pkg && pkg.bundleDependencies ? bundled({
+		const [dirEntries, bundleDeps] = await Promise.all([readdir$2(path, { withFileTypes: true }), currentDepth === 0 && pkg && pkg.bundleDependencies ? bundled({
 			path,
 			packageJsonCache
 		}) : null]).catch(() => []);
@@ -106749,7 +106875,7 @@ var require_lib$11 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 		const recursePromises = [];
 		for (const entry of dirEntries) {
-			const p = resolve$7(path, entry.name);
+			const p = resolve$8(path, entry.name);
 			if (entry.isDirectory() === false) {
 				result.add(p);
 				continue;
@@ -106768,7 +106894,7 @@ var require_lib$11 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 		if (bundleDeps) recursePromises.push(...bundleDeps.map((dep) => {
 			return pkgContents({
-				path: resolve$7(path, "node_modules", dep),
+				path: resolve$8(path, "node_modules", dep),
 				packageJsonCache,
 				pkg: true,
 				depth,
@@ -106780,7 +106906,7 @@ var require_lib$11 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return result;
 	};
 	module.exports = ({ path, ...opts }) => pkgContents({
-		path: resolve$7(path),
+		path: resolve$8(path),
 		...opts,
 		pkg: true
 	}).then((results) => [...results]);
@@ -110391,18 +110517,18 @@ var require_protected = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/pacote/lib/util/cache-dir.js
 var require_cache_dir = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const { resolve: resolve$6 } = __require("node:path");
-	const { tmpdir, homedir } = __require("node:os");
+	const { resolve: resolve$7 } = __require("node:path");
+	const { tmpdir, homedir: homedir$1 } = __require("node:os");
 	module.exports = (fakePlatform = false) => {
 		const temp = tmpdir();
 		const uidOrPid = process.getuid ? process.getuid() : process.pid;
-		const home = homedir() || resolve$6(temp, "npm-" + uidOrPid);
+		const home = homedir$1() || resolve$7(temp, "npm-" + uidOrPid);
 		const platform = fakePlatform || process.platform;
 		const cacheExtra = platform === "win32" ? "npm-cache" : ".npm";
 		const cacheRoot = platform === "win32" && process.env.LOCALAPPDATA || home;
 		return {
-			cacache: resolve$6(cacheRoot, cacheExtra, "_cacache"),
-			tufcache: resolve$6(cacheRoot, cacheExtra, "_tuf")
+			cacache: resolve$7(cacheRoot, cacheExtra, "_cacache"),
+			tufcache: resolve$7(cacheRoot, cacheExtra, "_tuf")
 		};
 	};
 }));
@@ -112216,7 +112342,7 @@ var require_lib$10 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var require_lib$9 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const { Walker: IgnoreWalker } = require_lib$10();
 	const { lstatSync: lstat$1, readFileSync: readFile } = __require("fs");
-	const { basename: basename$3, dirname: dirname$3, extname: extname$1, join: join$2, relative, resolve: resolve$5, sep } = __require("path");
+	const { basename: basename$3, dirname: dirname$3, extname: extname$1, join: join$2, relative, resolve: resolve$6, sep } = __require("path");
 	const { log } = require_lib$29();
 	const defaultRules = Symbol("npm-packlist.rules.default");
 	const strictRules = Symbol("npm-packlist.rules.strict");
@@ -112267,7 +112393,7 @@ var require_lib$9 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				...opts,
 				includeEmpty: false,
 				follow: false,
-				path: resolve$5(opts?.path || tree.path).replace(/\\/g, "/"),
+				path: resolve$6(opts?.path || tree.path).replace(/\\/g, "/"),
 				ignoreFiles: opts?.ignoreFiles || [
 					defaultRules,
 					"package.json",
@@ -112468,8 +112594,8 @@ var require_lib$9 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var require_set_path = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	init_esm_shims();
 	const { log } = require_lib$29();
-	const { resolve: resolve$4, dirname: dirname$2, delimiter } = __require("path");
-	const nodeGypPath = resolve$4(__dirname, "../lib/node-gyp-bin");
+	const { resolve: resolve$5, dirname: dirname$2, delimiter } = __require("path");
+	const nodeGypPath = resolve$5(__dirname, "../lib/node-gyp-bin");
 	const setPATH = (projectPath, binPaths, env) => {
 		const PATH = Object.keys(env).filter((p) => /^path$/i.test(p) && env[p]).map((p) => env[p].split(delimiter)).reduce((set, p) => set.concat(p.filter((concatted) => !set.includes(concatted))), []).join(delimiter);
 		const pathArr = [];
@@ -112484,7 +112610,7 @@ var require_set_path = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		let p = projectPath;
 		let pp;
 		do {
-			pathArr.push(resolve$4(p, "node_modules", ".bin"));
+			pathArr.push(resolve$5(p, "node_modules", ".bin"));
 			pp = p;
 			p = dirname$2(p);
 		} while (p !== pp);
@@ -112499,7 +112625,7 @@ var require_set_path = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region ../../node_modules/@npmcli/run-script/lib/make-spawn-args.js
 var require_make_spawn_args = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const setPATH = require_set_path();
-	const { resolve: resolve$3 } = __require("path");
+	const { resolve: resolve$4 } = __require("path");
 	let npm_config_node_gyp;
 	const makeSpawnArgs = (options) => {
 		const { args, binPaths, cmd, env, event, nodeGyp, path, scriptShell = true, stdio, stdioString } = options;
@@ -112513,7 +112639,7 @@ var require_make_spawn_args = /* @__PURE__ */ __commonJSMin(((exports, module) =
 				env: setPATH(path, binPaths, {
 					...process.env,
 					...env,
-					npm_package_json: resolve$3(path, "package.json"),
+					npm_package_json: resolve$4(path, "package.json"),
 					npm_lifecycle_event: event,
 					npm_lifecycle_script: cmd,
 					npm_config_node_gyp
@@ -112601,10 +112727,10 @@ var require_signal_manager = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 //#region ../../node_modules/@npmcli/run-script/lib/is-server-package.js
 var require_is_server_package = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const { stat: stat$2 } = __require("node:fs/promises");
-	const { resolve: resolve$2 } = __require("node:path");
+	const { resolve: resolve$3 } = __require("node:path");
 	module.exports = async (path) => {
 		try {
-			return (await stat$2(resolve$2(path, "server.js"))).isFile();
+			return (await stat$2(resolve$3(path, "server.js"))).isFile();
 		} catch (er) {
 			return false;
 		}
@@ -112714,7 +112840,7 @@ var require_run_script = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/pacote/lib/file.js
 var require_file$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const { resolve: resolve$1 } = __require("node:path");
+	const { resolve: resolve$2 } = __require("node:path");
 	const { stat: stat$1, chmod } = __require("node:fs/promises");
 	const cacache = require_lib$14();
 	const fsm = require_lib$13();
@@ -112740,7 +112866,7 @@ var require_file$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		#exeBins(pkg, dest) {
 			if (!pkg.bin) return Promise.resolve();
 			return Promise.all(Object.keys(pkg.bin).map(async (k) => {
-				const script = resolve$1(dest, pkg.bin[k]);
+				const script = resolve$2(dest, pkg.bin[k]);
 				try {
 					const st = await stat$1(script);
 					const mode = st.mode | 73;
@@ -112791,7 +112917,7 @@ var require_tar_create_options = /* @__PURE__ */ __commonJSMin(((exports, module
 //#endregion
 //#region ../../node_modules/pacote/lib/dir.js
 var require_dir = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const { resolve } = __require("node:path");
+	const { resolve: resolve$1 } = __require("node:path");
 	const packlist = require_lib$9();
 	const runScript = require_run_script();
 	const tar = require_index_min();
@@ -112827,7 +112953,7 @@ var require_dir = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 					env: {
 						npm_package_resolved: this.resolved,
 						npm_package_integrity: this.integrity,
-						npm_package_json: resolve(this.resolved, "package.json")
+						npm_package_json: resolve$1(this.resolved, "package.json")
 					}
 				});
 			});
@@ -150469,7 +150595,7 @@ var require_src = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const { promisify: promisify$1 } = __require("util");
 	const path$2 = __require("path");
 	const { createHash } = __require("crypto");
-	const { realpath, lstat, createReadStream: createReadStream$1, readdir } = __require("fs");
+	const { realpath, lstat, createReadStream: createReadStream$1, readdir: readdir$1 } = __require("fs");
 	const url = __require("url");
 	const slasher = require_glob_slash();
 	const minimatch = require_minimatch();
@@ -150794,7 +150920,7 @@ var require_src = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		lstat: promisify$1(lstat),
 		realpath: promisify$1(realpath),
 		createReadStream: createReadStream$1,
-		readdir: promisify$1(readdir),
+		readdir: promisify$1(readdir$1),
 		sendError
 	}, methods);
 	module.exports = async (request, response, config = {}, methods = {}) => {
@@ -150947,6 +151073,39 @@ if (isDev && projectRoot) {
 //#endregion
 //#region ../plugin-core/src/pipelab.ts
 const createActionRunner = (runner) => runner;
+//#endregion
+//#region ../plugin-core/src/fs-utils.ts
+/**
+* Asserts that a directory is safe to be deleted/cleaned up.
+* Throws an error if the directory is protected or is not empty and lacks the Pipelab folder marker.
+*/
+async function assertSafeDirectoryCleanup(directoryPath) {
+	if (!directoryPath) return;
+	const resolvedPath = resolve(directoryPath);
+	if (isPathBlacklisted(resolvedPath)) throw new Error(`Cannot cleanup/delete protected system or user directory: ${resolvedPath}`);
+	try {
+		if ((await stat(resolvedPath)).isDirectory()) {
+			const files = await readdir(resolvedPath);
+			if (files.length > 0) {
+				if (!files.includes(".pipelab")) throw new Error(`Directory is not empty and was not created by Pipelab: ${resolvedPath}. Aborting to prevent data loss.`);
+			}
+		}
+	} catch (e) {
+		if (e.code !== "ENOENT") throw e;
+	}
+}
+/**
+* Creates a hidden Pipelab marker directory with metadata.json at the specified destination path.
+*/
+async function writePipelabFolderMarker(directoryPath, generator = "unknown") {
+	if (!directoryPath) return;
+	const markerDir = join(directoryPath, ".pipelab");
+	await mkdir(markerDir, { recursive: true });
+	await writeFile(join(markerDir, "metadata.json"), JSON.stringify({
+		createdBy: generator,
+		timestamp: Date.now()
+	}, null, 2), "utf-8");
+}
 const zip = createAction({
 	id: "zip-node",
 	name: "Zip",
@@ -151972,6 +152131,7 @@ const copy = createAction({
 			required: true,
 			control: {
 				type: "path",
+				warnIfBlacklisted: true,
 				options: { properties: [
 					"openFile",
 					"openDirectory",
@@ -151995,7 +152155,7 @@ const copy = createAction({
 		cleanup: {
 			label: "Cleanup",
 			required: true,
-			description: "Whether to delete the original file/folder",
+			description: "Delete existing files at destination before copying",
 			value: true,
 			control: { type: "boolean" }
 		}
@@ -152046,6 +152206,7 @@ const copyRunner = createActionRunner(async ({ log, inputs, setOutput }) => {
 	} catch (e) {}
 	log("Copying", from, "to", to, "recursive", inputs.recursive, "overwrite", inputs.overwrite);
 	if (inputs.cleanup) try {
+		await assertSafeDirectoryCleanup(to);
 		log("Cleaning up", to);
 		process.noAsar = true;
 		await rm(to, {
@@ -152065,6 +152226,7 @@ const copyRunner = createActionRunner(async ({ log, inputs, setOutput }) => {
 			recursive: inputs.recursive && !fromIsAFile,
 			force: inputs.overwrite
 		});
+		if (!fromIsAFile) await writePipelabFolderMarker(to, "fs:copy");
 		process.noAsar = false;
 		setOutput("output", to);
 		setOutput("input", from);
@@ -152085,6 +152247,7 @@ const remove = createAction({
 			required: true,
 			control: {
 				type: "path",
+				warnIfBlacklisted: true,
 				options: { properties: ["openFile"] }
 			}
 		}),
@@ -152109,6 +152272,7 @@ const removeRunner = createActionRunner(async ({ log, inputs }) => {
 		throw new Error("Missing source");
 	}
 	try {
+		await assertSafeDirectoryCleanup(from);
 		process.noAsar = true;
 		await rm(from, {
 			recursive: true,