How are filesystem operations protected?
Paths are validated before an operation, protected areas stay out of reach, and data-changing modes must be selected explicitly.
Path validation
Before touching the filesystem, lil-terminal normalizes the requested path, checks the permitted working area and handles symbolic links deliberately instead of following them blindly. A command must not silently escape the root in which it is allowed to work.
Operations that change data
Deletion, replacement, extraction and bulk editing require the documented recursive, force or write mode. When an operation supports a safe preview, the preview is shown before anything is written.
Safe writes
Editors, Installer, Upgrade, key storage and many data commands write a temporary file first and then replace the target atomically. An interrupted request should not turn a valid file into a partially written one.