@qodalis/cli-files 2.0.0-beta.12 → 2.0.0-beta.14

package/public-api.mjs

@@ -1,10 +1,10 @@
-import { ICliCompletionProvider_TOKEN, ICliFileTransferService_TOKEN, BrowserFileTransferService, DefaultLibraryAuthor, CliForegroundColor, ICliDragDropService_TOKEN } from '@qodalis/cli-core';
+import { ICliCompletionProvider_TOKEN, ICliFileTransferService_TOKEN, CliAccessDeniedError, BrowserFileTransferService, DefaultLibraryAuthor, CliForegroundColor, resolveHeaders, cliCanAccess, ICliUserSessionService_TOKEN, ICliUserEventService_TOKEN, ICliDragDropService_TOKEN, isCliAccessDeniedError, ICliAuthorizationService_TOKEN } from '@qodalis/cli-core';
 
 // src/lib/interfaces/i-file-system-service.ts
 var IFileSystemService_TOKEN = "cli-file-system-service";
 
 // src/lib/version.ts
-var LIBRARY_VERSION = "2.0.0-beta.12";
+var LIBRARY_VERSION = "2.0.0-beta.14";
 var API_VERSION = 2;
 
 // src/lib/processors/cli-ls-command-processor.ts
@@ -34,7 +34,7 @@ var CliLsCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const targetPath = command.value || fs.getCurrentDirectory();
@@ -105,7 +105,7 @@ var CliCdCommandProcessor = class {
     this.metadata = { icon: "\u{1F4C1}", module: "file management" };
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const target = command.value || "~";
@@ -126,7 +126,7 @@ var CliPwdCommandProcessor = class {
     this.metadata = { icon: "\u{1F4C2}", module: "file management" };
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     context.writer.writeln(fs.getCurrentDirectory());
@@ -152,7 +152,7 @@ var CliMkdirCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const path = command.value;
@@ -180,7 +180,7 @@ var CliRmdirCommandProcessor = class {
     this.metadata = { icon: "\u{1F5D1}", module: "file management" };
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const path = command.value;
@@ -224,7 +224,7 @@ var CliTouchCommandProcessor = class {
     this.metadata = { icon: "\u{1F4C4}", module: "file management" };
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const path = command.value;
@@ -251,7 +251,7 @@ var CliCatCommandProcessor = class {
     this.metadata = { icon: "\u{1F4D6}", module: "file management" };
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const path = command.value;
@@ -290,7 +290,7 @@ var CliEchoCommandProcessor = class {
       }
       return;
     }
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     let text;
@@ -362,7 +362,7 @@ var CliRmCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const path = command.value;
@@ -411,7 +411,7 @@ var CliCpCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const recursive = command.args["recursive"] || command.args["r"] || command.args["R"];
@@ -447,7 +447,7 @@ var CliMvCommandProcessor = class {
     this.metadata = { icon: "\u{1F4E6}", module: "file management" };
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const parts = this.parseArgs(command);
@@ -470,6 +470,14 @@ var CliMvCommandProcessor = class {
     return raw.split(/\s+/).filter((t) => t && !t.startsWith("--") && !t.startsWith("-"));
   }
 };
+function readableChildren(fs, path) {
+  try {
+    return fs.listDirectory(path);
+  } catch (e) {
+    if (isCliAccessDeniedError(e)) return null;
+    throw e;
+  }
+}
 var CliTreeCommandProcessor = class {
   constructor() {
     this.command = "tree";
@@ -489,7 +497,7 @@ var CliTreeCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const targetPath = command.value || fs.getCurrentDirectory();
@@ -516,7 +524,8 @@ var CliTreeCommandProcessor = class {
         )
       );
       const counts = { dirs: 0, files: 0 };
-      this.printTree(node, "", true, 0, maxDepth, context, counts);
+      this.fs = fs;
+      this.printTree(node, "", true, 0, maxDepth, context, counts, resolvedPath);
       context.writer.writeln();
       context.writer.writeln(
         `${counts.dirs} directories, ${counts.files} files`
@@ -525,11 +534,15 @@ var CliTreeCommandProcessor = class {
       context.writer.writeError(e.message);
     }
   }
-  printTree(node, prefix, isRoot, depth, maxDepth, context, counts) {
-    if (!node.children || depth >= maxDepth) {
+  printTree(node, prefix, isRoot, depth, maxDepth, context, counts, path = "/") {
+    if (depth >= maxDepth) {
       return;
     }
-    const children = [...node.children].sort((a, b) => {
+    const visible = this.fs ? readableChildren(this.fs, path) : node.children;
+    if (!visible) {
+      return;
+    }
+    const children = [...visible].sort((a, b) => {
       if (a.type !== b.type) {
         return a.type === "directory" ? -1 : 1;
       }
@@ -554,7 +567,8 @@ var CliTreeCommandProcessor = class {
           depth + 1,
           maxDepth,
           context,
-          counts
+          counts,
+          path === "/" ? `/${child.name}` : `${path}/${child.name}`
         );
       } else {
         counts.files++;
@@ -582,7 +596,7 @@ var CliHeadCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const count = parseInt(
@@ -647,7 +661,7 @@ var CliTailCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const count = parseInt(
@@ -726,7 +740,7 @@ var CliWcCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const showLines = command.args["lines"] || command.args["l"] || false;
@@ -820,7 +834,7 @@ var CliFindCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const searchPath = this.parseSearchPath(command) || fs.getCurrentDirectory();
@@ -844,6 +858,7 @@ var CliFindCommandProcessor = class {
       const resolvedBase = fs.resolvePath(searchPath);
       const nameRegex = namePattern ? this.globToRegex(namePattern) : null;
       const results = [];
+      this.fs = fs;
       this.walk(
         node,
         resolvedBase,
@@ -871,8 +886,9 @@ var CliFindCommandProcessor = class {
     return new RegExp(`^${regexStr}$`, "i");
   }
   walk(node, currentPath, depth, maxDepth, nameRegex, typeFilter, results) {
-    if (!node.children) return;
-    for (const child of node.children) {
+    const children = this.fs ? readableChildren(this.fs, currentPath) : node.children;
+    if (!children) return;
+    for (const child of children) {
       const childPath = currentPath === "/" ? `/${child.name}` : `${currentPath}/${child.name}`;
       let matches = true;
       if (nameRegex && !nameRegex.test(child.name)) {
@@ -955,7 +971,7 @@ var CliGrepCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const ignoreCase = command.args["ignore-case"] || command.args["i"] || false;
@@ -1103,8 +1119,9 @@ var CliGrepCommandProcessor = class {
     };
   }
   collectFiles(fs, basePath, node, result) {
-    if (!node.children) return;
-    for (const child of node.children) {
+    const children = readableChildren(fs, basePath);
+    if (!children) return;
+    for (const child of children) {
       const childPath = basePath === "/" ? `/${child.name}` : `${basePath}/${child.name}`;
       if (child.type === "file") {
         result.push(childPath);
@@ -1125,7 +1142,7 @@ var CliTacCommandProcessor = class {
     this.metadata = { icon: "\u{1F504}", module: "file management" };
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const paths = this.parsePaths(command);
@@ -1297,7 +1314,7 @@ var CliSortCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const reverse = !!command.args["r"] || !!command.args["reverse"];
@@ -1450,7 +1467,7 @@ var CliUniqCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const showCount = !!command.args["c"] || !!command.args["count"];
@@ -1581,7 +1598,7 @@ var CliCutCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const delimiter = command.args["d"] || command.args["delimiter"] || "	";
@@ -1731,7 +1748,7 @@ var CliPasteCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const delimiter = command.args["d"] || command.args["delimiters"] || "	";
@@ -1898,7 +1915,7 @@ var CliTrCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const raw = command.value || "";
@@ -2053,7 +2070,7 @@ var CliStatCommandProcessor = class {
     this.parameters = [];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const paths = this.parsePaths(command);
@@ -2063,6 +2080,10 @@ var CliStatCommandProcessor = class {
     }
     for (const path of paths) {
       const resolved = fs.resolvePath(path);
+      if (fs.canTraverse && !fs.canTraverse(resolved)) {
+        context.writer.writeError(`stat: cannot stat '${path}': Permission denied`);
+        continue;
+      }
       const node = fs.getNode(resolved);
       if (!node) {
         context.writer.writeError(
@@ -2106,7 +2127,7 @@ var CliChmodCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const { recursive, mode, paths } = this.parseArgs(command);
@@ -2226,7 +2247,7 @@ var CliChownCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const { recursive, ownerSpec, paths } = this.parseArgs(command);
@@ -2321,7 +2342,7 @@ var CliDuCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const { humanReadable, summaryOnly, maxDepth, paths } = this.parseArgs(command);
@@ -2331,6 +2352,10 @@ var CliDuCommandProcessor = class {
     }
     for (const path of paths) {
       const resolved = fs.resolvePath(path);
+      if (fs.canTraverse && !fs.canTraverse(resolved)) {
+        context.writer.writeError(`du: cannot access '${path}': Permission denied`);
+        continue;
+      }
       const node = fs.getNode(resolved);
       if (!node) {
         context.writer.writeError(
@@ -2344,6 +2369,7 @@ var CliDuCommandProcessor = class {
         );
       } else {
         const entries = [];
+        this.fs = fs;
         this.collectSizes(node, resolved, 0, maxDepth, summaryOnly, entries);
         for (const entry of entries) {
           context.writer.writeln(
@@ -2366,8 +2392,9 @@ var CliDuCommandProcessor = class {
       return node.size;
     }
     let total = 0;
-    if (node.children) {
-      for (const child of node.children) {
+    const children = this.fs ? readableChildren(this.fs, path) : node.children;
+    if (children) {
+      for (const child of children) {
         const childPath = path === "/" ? `/${child.name}` : `${path}/${child.name}`;
         total += this.collectSizes(
           child,
@@ -2418,7 +2445,7 @@ var CliLnCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const { symbolic, target, linkName } = this.parseArgs(command);
@@ -2492,7 +2519,7 @@ var CliSedCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const { inPlace, suppress, expressions, filePath } = this.parseRawCommand(command);
@@ -2835,7 +2862,7 @@ var CliAwkCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const { program, filePath, fieldSep } = this.parseArgs(command);
@@ -3311,7 +3338,7 @@ var CliDiffCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const unified = command.args["unified"] || command.args["u"] || false;
@@ -3497,7 +3524,7 @@ var CliTeeCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const append = command.args["append"] || command.args["a"] || false;
@@ -3591,7 +3618,7 @@ var CliXargsCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     const replaceStr = command.args["replace"] || command.args["I"] || null;
@@ -3704,7 +3731,7 @@ var CliShCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     let filePath = (command.value || "").trim();
@@ -3830,14 +3857,14 @@ function substituteVariables(input, variables) {
   );
   return result;
 }
-
-// src/lib/services/indexed-db-file-system.service.ts
 var DB_NAME = "qodalis-cli-filesystem";
 var STORE_NAME = "filesystem";
 var ROOT_KEY = "root";
 var CWD_KEY = "cwd";
 var HOME_KEY = "home";
 var DEFAULT_HOME = "/";
+var SYSTEM_OWNERSHIP = { uid: "root", gid: "admin" };
+var ANONYMOUS_OWNERSHIP = { uid: "nobody", gid: "nogroup" };
 function createSeedFileSystem() {
   const now = Date.now();
   return {
@@ -3885,6 +3912,88 @@ var IndexedDbFileSystemService = class {
     this.homePath = DEFAULT_HOME;
     this.currentUid = null;
     this.currentGroups = [];
+    this.systemDepth = 0;
+  }
+  // --- Access control ---
+  setAccessPolicy(policy) {
+    this.accessPolicy = policy;
+  }
+  runAsSystem(fn) {
+    this.systemDepth++;
+    try {
+      return fn();
+    } finally {
+      this.systemDepth--;
+    }
+  }
+  reassignOwner(fromUid, toUid) {
+    const from = fromUid.toLowerCase();
+    if (!from || !toUid) return 0;
+    let changed = 0;
+    const visit = (node) => {
+      if (node.ownership && node.ownership.uid.toLowerCase() === from) {
+        node.ownership = { ...node.ownership, uid: toUid };
+        changed++;
+      }
+      node.children?.forEach(visit);
+    };
+    visit(this.root);
+    return changed;
+  }
+  canTraverse(path) {
+    try {
+      this.assertTraverse(this.resolvePath(path), "stat", path);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  get enforcing() {
+    return !!this.accessPolicy && this.systemDepth === 0;
+  }
+  deny(op, path, reason = "Permission denied") {
+    throw new CliAccessDeniedError(`${op}: ${path}: ${reason}`);
+  }
+  /** `x` on every existing directory on the way to `resolved` (excluding the target). */
+  assertTraverse(resolved, op, display) {
+    if (!this.enforcing) return;
+    const parts = resolved.split("/").filter(Boolean);
+    let current = this.root;
+    for (let i = 0; i < parts.length; i++) {
+      if (!current || current.type !== "directory") return;
+      if (!this.accessPolicy.canAccess(current, "execute")) this.deny(op, display);
+      current = current.children?.find((c) => c.name === parts[i]);
+    }
+  }
+  assertAccess(node, action, op, display) {
+    if (this.enforcing && !this.accessPolicy.canAccess(node, action)) this.deny(op, display);
+  }
+  /** Recursive delete: every directory inside must allow removing its entries (`w` + `x`, readable). */
+  assertRemovableTree(dir, dirPath, display) {
+    if (!this.enforcing) return;
+    this.assertAccess(dir, "read", "rm", display);
+    this.assertAccess(dir, "execute", "rm", display);
+    if ((dir.children?.length ?? 0) > 0) this.assertAccess(dir, "write", "rm", display);
+    for (const child of dir.children ?? []) {
+      if (child.type === "directory") this.assertRemovableTree(child, `${dirPath}/${child.name}`, display);
+    }
+  }
+  /** Copying reads everything it copies: `r` on every file, `r` + `x` on every directory. */
+  assertReadableTree(node, display) {
+    if (!this.enforcing) return;
+    this.assertAccess(node, "read", "cp", display);
+    if (node.type !== "directory") return;
+    this.assertAccess(node, "execute", "cp", display);
+    for (const child of node.children ?? []) {
+      this.assertReadableTree(child, `${display.replace(/\/+$/, "")}/${child.name}`);
+    }
+  }
+  /** Creating/removing entries needs `w` and `x` on the containing directory. */
+  assertModifyDir(dir, dirPath, op, display) {
+    if (!this.enforcing) return;
+    this.assertTraverse(dirPath, op, display);
+    this.assertAccess(dir, "execute", op, display);
+    this.assertAccess(dir, "write", op, display);
   }
   // --- User context ---
   setCurrentUser(uid, groups) {
@@ -3892,7 +4001,9 @@ var IndexedDbFileSystemService = class {
     this.currentGroups = groups;
   }
   getDefaultOwnership() {
-    if (!this.currentUid) return void 0;
+    if (!this.currentUid) {
+      return this.accessPolicy ? { ...ANONYMOUS_OWNERSHIP } : void 0;
+    }
     return {
       uid: this.currentUid,
       gid: this.currentGroups[0] || "users"
@@ -3911,6 +4022,8 @@ var IndexedDbFileSystemService = class {
     if (node.type !== "directory") {
       throw new Error(`cd: ${path}: Not a directory`);
     }
+    this.assertTraverse(resolved, "cd", path);
+    this.assertAccess(node, "execute", "cd", path);
     this.cwd = resolved;
   }
   getHomePath() {
@@ -3967,6 +4080,8 @@ var IndexedDbFileSystemService = class {
     if (node.type !== "directory") {
       throw new Error(`ls: ${path}: Not a directory`);
     }
+    this.assertTraverse(this.resolvePath(path), "ls", path);
+    this.assertAccess(node, "read", "ls", path);
     return node.children || [];
   }
   readFile(path) {
@@ -3977,6 +4092,8 @@ var IndexedDbFileSystemService = class {
     if (node.type === "directory") {
       throw new Error(`cat: ${path}: Is a directory`);
     }
+    this.assertTraverse(this.resolvePath(path), "cat", path);
+    this.assertAccess(node, "read", "cat", path);
     return node.content ?? "";
   }
   exists(path) {
@@ -4001,6 +4118,10 @@ var IndexedDbFileSystemService = class {
         }
         let child = current.children.find((c) => c.name === part);
         if (!child) {
+          if (this.enforcing) {
+            this.assertAccess(current, "execute", "mkdir", path);
+            this.assertAccess(current, "write", "mkdir", path);
+          }
           const now = Date.now();
           child = {
             name: part,
@@ -4016,6 +4137,8 @@ var IndexedDbFileSystemService = class {
           current.modifiedAt = now;
         } else if (child.type !== "directory") {
           throw new Error(`mkdir: ${part}: Not a directory`);
+        } else {
+          this.assertAccess(child, "execute", "mkdir", path);
         }
         current = child;
       }
@@ -4034,6 +4157,7 @@ var IndexedDbFileSystemService = class {
       if (parent.children?.find((c) => c.name === dirName)) {
         throw new Error(`mkdir: ${path}: File exists`);
       }
+      this.assertModifyDir(parent, parentPath, "mkdir", path);
       const now = Date.now();
       if (!parent.children) {
         parent.children = [];
@@ -4068,6 +4192,12 @@ var IndexedDbFileSystemService = class {
     }
     const existing = parent.children?.find((c) => c.name === fileName);
     const now = Date.now();
+    if (existing) {
+      this.assertTraverse(resolved, "touch", path);
+      this.assertAccess(existing, "write", "touch", path);
+    } else {
+      this.assertModifyDir(parent, parentPath, "touch", path);
+    }
     if (existing) {
       existing.modifiedAt = now;
     } else {
@@ -4094,6 +4224,8 @@ var IndexedDbFileSystemService = class {
       if (node.type === "directory") {
         throw new Error(`write: ${path}: Is a directory`);
       }
+      this.assertTraverse(resolved, "write", path);
+      this.assertAccess(node, "write", "write", path);
       const now = Date.now();
       node.content = append ? (node.content ?? "") + content : content;
       node.size = new Blob([node.content]).size;
@@ -4122,6 +4254,8 @@ var IndexedDbFileSystemService = class {
     if (target.type === "directory" && !recursive) {
       throw new Error(`rm: ${path}: Is a directory`);
     }
+    this.assertModifyDir(parent, parentPath, "rm", path);
+    if (target.type === "directory") this.assertRemovableTree(target, resolved, path);
     parent.children.splice(index, 1);
     parent.modifiedAt = Date.now();
   }
@@ -4136,10 +4270,13 @@ var IndexedDbFileSystemService = class {
         `cp: -r not specified; omitting directory '${src}'`
       );
     }
+    this.assertTraverse(srcResolved, "cp", src);
+    this.assertReadableTree(srcNode, src);
     const destResolved = this.resolvePath(dest);
     const destNode = this.getNode(destResolved);
     if (destNode && destNode.type === "directory") {
-      const clone = this.cloneNode(srcNode);
+      this.assertModifyDir(destNode, destResolved, "cp", dest);
+      const clone = this.ownedByCurrentUser(this.cloneNode(srcNode));
       if (!destNode.children) {
         destNode.children = [];
       }
@@ -4159,7 +4296,8 @@ var IndexedDbFileSystemService = class {
       if (!parent || parent.type !== "directory") {
         throw new Error(`cp: ${parentPath}: No such file or directory`);
       }
-      const clone = this.cloneNode(srcNode);
+      this.assertModifyDir(parent, parentPath, "cp", dest);
+      const clone = this.ownedByCurrentUser(this.cloneNode(srcNode));
       clone.name = newName;
       if (!parent.children) {
         parent.children = [];
@@ -4191,10 +4329,12 @@ var IndexedDbFileSystemService = class {
     if (!srcParent || !srcParent.children) {
       throw new Error(`mv: ${src}: No such file or directory`);
     }
+    this.assertModifyDir(srcParent, srcParentPath, "mv", src);
     const srcIndex = srcParent.children.findIndex(
       (c) => c.name === srcNode.name
     );
     if (destNode && destNode.type === "directory") {
+      this.assertModifyDir(destNode, destResolved, "mv", dest);
       if (!destNode.children) {
         destNode.children = [];
       }
@@ -4217,6 +4357,7 @@ var IndexedDbFileSystemService = class {
           `mv: ${destParentPath}: No such file or directory`
         );
       }
+      this.assertModifyDir(destParent, destParentPath, "mv", dest);
       srcParent.children.splice(srcIndex, 1);
       srcNode.name = newName;
       if (!destParent.children) {
@@ -4240,6 +4381,9 @@ var IndexedDbFileSystemService = class {
     if (!node) {
       throw new Error(`chmod: ${path}: No such file or directory`);
     }
+    if (this.enforcing && !this.accessPolicy.canChangeOwnership(node)) {
+      this.deny("chmod", path, "Operation not permitted");
+    }
     node.permissions = permissions;
   }
   chown(path, ownership) {
@@ -4248,6 +4392,9 @@ var IndexedDbFileSystemService = class {
     if (!node) {
       throw new Error(`chown: ${path}: No such file or directory`);
     }
+    if (this.enforcing && !this.accessPolicy.canChangeOwnership(node, ownership)) {
+      this.deny("chown", path, "Operation not permitted");
+    }
     node.ownership = ownership;
   }
   // --- Persistence ---
@@ -4289,6 +4436,18 @@ var IndexedDbFileSystemService = class {
     }
   }
   // --- Private helpers ---
+  /** A copy belongs to whoever made it (like `cp` without `-p`) */
+  ownedByCurrentUser(node) {
+    const owner = this.getDefaultOwnership();
+    if (owner) {
+      const apply = (n) => {
+        n.ownership = { ...owner };
+        n.children?.forEach(apply);
+      };
+      apply(node);
+    }
+    return node;
+  }
   cloneNode(node) {
     const now = Date.now();
     const clone = {
@@ -4330,8 +4489,6 @@ var IndexedDbFileSystemService = class {
     });
   }
 };
-
-// src/lib/services/server-file-system.service.ts
 var DEFAULT_HOME2 = "/home/user";
 function createSeedFileSystem2() {
   const now = Date.now();
@@ -4381,6 +4538,7 @@ var ServerFileSystemService = class {
     this.currentUid = null;
     this.currentGroups = [];
     this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.headersProvider = options.headers;
   }
   // --- User context ---
   setCurrentUser(uid, groups) {
@@ -4788,7 +4946,14 @@ var ServerFileSystemService = class {
   // --- Private: server communication ---
   async serverFetch(endpoint, options) {
     const url = `${this.baseUrl}/api/qcli/fs${endpoint}`;
-    const response = await fetch(url, options);
+    const mergedHeaders = {
+      ...resolveHeaders(this.headersProvider),
+      ...options?.headers ?? {}
+    };
+    const response = await fetch(url, {
+      ...options,
+      headers: mergedHeaders
+    });
     if (!response.ok) {
       const body = await response.text();
       throw new Error(
@@ -4957,6 +5122,115 @@ var VirtualFsFileTransferService = class {
     return this._browserService.uploadFromBrowser(accept);
   }
 };
+var CliFilesPermissions = {
+  /** Bypass all file permission checks */
+  Admin: "files:admin",
+  /** chmod/chown files you do not own */
+  Chown: "files:chown"
+};
+var HOME_DIR_PERMISSIONS = "rwxr-x---";
+function authorization(context) {
+  try {
+    return context.services.get(ICliAuthorizationService_TOKEN);
+  } catch {
+    return void 0;
+  }
+}
+function createFileAccessPolicy(context) {
+  return {
+    // Nodes without an owner (system seed, legacy data) belong to root:admin
+    canAccess: (node, action) => cliCanAccess(
+      context,
+      node.ownership ? node : { ...node, ownership: SYSTEM_OWNERSHIP },
+      action,
+      [CliFilesPermissions.Admin]
+    ),
+    canChangeOwnership: (node, newOwnership) => {
+      const auth = authorization(context);
+      if (!auth) return true;
+      if (auth.can(CliFilesPermissions.Admin) || auth.can(CliFilesPermissions.Chown)) return true;
+      const principal = auth.getPrincipal();
+      if (!principal) return false;
+      const owns = !!node.ownership && (node.ownership.uid === principal.name || node.ownership.uid === principal.id);
+      const keepsOwner = !newOwnership || newOwnership.uid === node.ownership?.uid || newOwnership.uid === principal.name;
+      return owns && keepsOwner;
+    }
+  };
+}
+function followUserSession(context, fs) {
+  let sessions;
+  try {
+    sessions = context.services.get(ICliUserSessionService_TOKEN);
+  } catch {
+    sessions = void 0;
+  }
+  if (!sessions) return void 0;
+  let previousUser = null;
+  return sessions.getUserSession().subscribe((session) => {
+    if (!session?.user) {
+      fs.setCurrentUser("", []);
+      if (previousUser !== null || !canEnter(fs, fs.getCurrentDirectory())) {
+        try {
+          fs.setCurrentDirectory("/");
+          void fs.persist();
+        } catch {
+        }
+      }
+      previousUser = null;
+      return;
+    }
+    const user = session.user;
+    fs.setCurrentUser(user.name, user.groups ?? []);
+    if (user.homeDir) {
+      const home = user.homeDir;
+      const system = (fn) => fs.runAsSystem ? fs.runAsSystem(fn) : fn();
+      if (!fs.exists(home)) {
+        system(() => {
+          fs.createDirectory(home, true);
+          if (home !== "/") {
+            fs.chown(home, { uid: user.name, gid: user.groups?.[0] ?? "users" });
+            fs.chmod(home, HOME_DIR_PERMISSIONS);
+          }
+        });
+        void fs.persist();
+      }
+      fs.setHomePath(home);
+      if (previousUser !== user.id) {
+        try {
+          fs.setCurrentDirectory(home);
+        } catch {
+        }
+      }
+    }
+    previousUser = user.id;
+  });
+}
+function canEnter(fs, path) {
+  try {
+    fs.setCurrentDirectory(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function followUserAccounts(context, fs) {
+  let events;
+  try {
+    events = context.services.get(ICliUserEventService_TOKEN);
+  } catch {
+    events = void 0;
+  }
+  if (!events || !fs.reassignOwner) return void 0;
+  return events.events$.subscribe((event) => {
+    let changed = 0;
+    if (event.type === "user_updated" && event.previousName && event.previousName !== event.user?.name) {
+      changed = fs.reassignOwner(event.previousName, event.user.name);
+    } else if (event.type === "user_deleted" && event.user?.name) {
+      changed = fs.reassignOwner(event.user.name, SYSTEM_OWNERSHIP.uid);
+    }
+    if (changed > 0) void fs.persist().catch(() => void 0);
+  });
+}
 
 // src/lib/completion/file-path-completion-provider.ts
 var FILE_COMMANDS = /* @__PURE__ */ new Set([
@@ -5057,10 +5331,10 @@ var CliUploadCommandProcessor = class {
     ];
   }
   async processCommand(command, context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
-    const fileService = context.services.get(
+    const fileService = context.services.getRequired(
       ICliFileTransferService_TOKEN
     );
     if (!fileService) {
@@ -5070,7 +5344,7 @@ var CliUploadCommandProcessor = class {
     const accept = command.args?.["accept"];
     const destPath = command.value?.trim() || void 0;
     context.spinner?.show("Waiting for file selection...");
-    context.setStatusText("Waiting for file selection");
+    context.notifier.info("Waiting for file selection");
     const picked = await fileService.uploadFromBrowser(accept);
     if (!picked) {
       context.spinner?.hide();
@@ -5083,7 +5357,7 @@ var CliUploadCommandProcessor = class {
       filename.startsWith("/") ? filename : cwd + "/" + filename
     );
     context.spinner?.show(`Saving "${picked.name}" (${picked.content.length} bytes)...`);
-    context.setStatusText(`Saving ${picked.name}`);
+    context.notifier.info(`Saving ${picked.name}`);
     try {
       fs.writeFile(resolved, picked.content);
       await fs.persist();
@@ -5151,6 +5425,10 @@ var filesModule = {
     new CliShCommandProcessor(),
     new CliUploadCommandProcessor()
   ],
+  permissions: [
+    { name: CliFilesPermissions.Admin, description: "Bypass file permission checks" },
+    { name: CliFilesPermissions.Chown, description: "chmod/chown files owned by others" }
+  ],
   services: [
     {
       provide: IFileSystemService_TOKEN,
@@ -5182,7 +5460,7 @@ var filesModule = {
     return { ...this, config };
   },
   async onInit(context) {
-    const fs = context.services.get(
+    const fs = context.services.getRequired(
       IFileSystemService_TOKEN
     );
     await fs.initialize();
@@ -5193,7 +5471,7 @@ var filesModule = {
     }
     let dragDrop;
     try {
-      dragDrop = context.services.get(ICliDragDropService_TOKEN);
+      dragDrop = context.services.getRequired(ICliDragDropService_TOKEN);
     } catch {
     }
     if (dragDrop) {
@@ -5222,13 +5500,25 @@ var filesModule = {
       });
     }
   },
+  async onAfterBoot(context) {
+    const fs = context.services.getRequired(IFileSystemService_TOKEN);
+    fs.setAccessPolicy?.(createFileAccessPolicy(context));
+    this._sessionSubscription?.unsubscribe();
+    this._sessionSubscription = followUserSession(context, fs);
+    this._accountsSubscription?.unsubscribe();
+    this._accountsSubscription = followUserAccounts(context, fs);
+  },
   async onDestroy(_context) {
     const sub = this._dragDropSubscription;
     sub?.unsubscribe();
     this._dragDropSubscription = void 0;
+    this._sessionSubscription?.unsubscribe();
+    this._sessionSubscription = void 0;
+    this._accountsSubscription?.unsubscribe();
+    this._accountsSubscription = void 0;
   }
 };
 
-export { CliAwkCommandProcessor, CliBasenameCommandProcessor, CliCatCommandProcessor, CliCdCommandProcessor, CliChmodCommandProcessor, CliChownCommandProcessor, CliCpCommandProcessor, CliCutCommandProcessor, CliDiffCommandProcessor, CliDirnameCommandProcessor, CliDuCommandProcessor, CliEchoCommandProcessor, CliFindCommandProcessor, CliGrepCommandProcessor, CliHeadCommandProcessor, CliLnCommandProcessor, CliLsCommandProcessor, CliMkdirCommandProcessor, CliMvCommandProcessor, CliPasteCommandProcessor, CliPwdCommandProcessor, CliRmCommandProcessor, CliRmdirCommandProcessor, CliSedCommandProcessor, CliShCommandProcessor, CliSortCommandProcessor, CliStatCommandProcessor, CliTacCommandProcessor, CliTailCommandProcessor, CliTeeCommandProcessor, CliTouchCommandProcessor, CliTrCommandProcessor, CliTreeCommandProcessor, CliUniqCommandProcessor, CliWcCommandProcessor, CliXargsCommandProcessor, FilePathCompletionProvider, IFileSystemService_TOKEN, IndexedDbFileSystemService, ServerFileSystemService, VirtualFsFileTransferService, executeScript, filesModule };
+export { ANONYMOUS_OWNERSHIP, CliAwkCommandProcessor, CliBasenameCommandProcessor, CliCatCommandProcessor, CliCdCommandProcessor, CliChmodCommandProcessor, CliChownCommandProcessor, CliCpCommandProcessor, CliCutCommandProcessor, CliDiffCommandProcessor, CliDirnameCommandProcessor, CliDuCommandProcessor, CliEchoCommandProcessor, CliFilesPermissions, CliFindCommandProcessor, CliGrepCommandProcessor, CliHeadCommandProcessor, CliLnCommandProcessor, CliLsCommandProcessor, CliMkdirCommandProcessor, CliMvCommandProcessor, CliPasteCommandProcessor, CliPwdCommandProcessor, CliRmCommandProcessor, CliRmdirCommandProcessor, CliSedCommandProcessor, CliShCommandProcessor, CliSortCommandProcessor, CliStatCommandProcessor, CliTacCommandProcessor, CliTailCommandProcessor, CliTeeCommandProcessor, CliTouchCommandProcessor, CliTrCommandProcessor, CliTreeCommandProcessor, CliUniqCommandProcessor, CliWcCommandProcessor, CliXargsCommandProcessor, FilePathCompletionProvider, HOME_DIR_PERMISSIONS, IFileSystemService_TOKEN, IndexedDbFileSystemService, SYSTEM_OWNERSHIP, ServerFileSystemService, VirtualFsFileTransferService, createFileAccessPolicy, executeScript, filesModule, followUserAccounts, followUserSession };
 //# sourceMappingURL=public-api.mjs.map
 //# sourceMappingURL=public-api.mjs.map