file-ops — SFTP file management

Capabilities (engine status)

• Upload / download (put / get, space-safe quoting for paths)
• Permission: chmod (warnlist, needs --confirm yes)
• Delete: rm (warnlist, needs --mode yes)
• Directory: mkdir (default 755, write is audited)
• Stat: stat (size / type)
• Compress / batch copy-move: run tar/cp/mv via shell-exec (same gate)

Safety gate

• Delete and chmod go through warnlist (--mode auto denies by default)
• file-write runs the gate on the target (e.g. overwriting /etc/passwd is hard-blocked)
• Write ops and sftp results are audited (host + exit code)

Scenarios

• Deploy: upload dist/ to /var/www
• Backup: download /etc/nginx locally
• Permission: chmod 644 config.json

Forbidden

• Unauthorized hosts
• Silently delete critical paths

EXECUTION (real engine)

This skill is executed by the file-* subcommands of bin/opsctl.js (src/transport.js calls system sftp).

opsctl file-read   --host web1 --path /etc/nginx/nginx.conf
opsctl file-write  --host web1 --path /var/www/app.js --content "$(cat app.js)" --mode 644
opsctl file-mkdir  --host web1 --path /var/www/new --mode 755
opsctl file-delete --host web1 --path /tmp/old.log --mode yes
opsctl file-chmod  --host web1 --path /var/www/app.js --mode 644 --confirm yes

Delete / chmod go through the gate's warn/block lists (--mode auto denies warn class by default); writes and executions (host + exit code) are logged to ~/.opsctl/audit.log.