feat: menu/form ownership management (FEATURE-REQUESTS C1)

Manage who owns your menus and forms from the builder, via ccfe-build.

- ccfe-build gains list-users / list-groups (getent passwd/group, with an
  /etc fallback), list-objects (names for a picker) and a `chown` command that
  changes ownership of one of the user's own objects (NAME.menu/.form/.d). The
  object name is validated (no '/' or leading dot) so it cannot escape the user
  objdir -- a system-owned object, which restricted mode locks, is never
  reachable. chown failure (e.g. a non-root user changing to another user) exits
  non-zero with a clear message, which the output browser surfaces -- the clean
  failure path the command-not-found / error-modal work already provides.
- New builder form builder.d/chown.form (Object + Owner pickers driven by the
  new list_cmd commands), added to the builder menu as "Change object ownership
  (chown)".
- t/43 parse-checks the form and drives ccfe-build: enumerate, chown to self
  (always allowed), and the invalid-name / missing-object refusals.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: claude

src/builder.d/chown.form

@@ -0,0 +1,28 @@
+title { Change object ownership }
+top {
+  Change who owns one of your menus or forms.  Pick an object, then an owner
+  (USER or USER:GROUP).  Changing to another user usually needs root; if you
+  lack the privilege the error is shown.  Only your own objects are touched --
+  system objects (locked by restricted mode) are never reachable here.
+}
+field {
+  id       = OBJECT
+  len      = 24
+  type     = STRING
+  required = YES
+  list_cmd = command:single-val:"${CCFE_BIN_DIR:+$CCFE_BIN_DIR/}ccfe-build" list-objects
+  label    = Object (F2 for a list)
+}
+field {
+  id       = OWNER
+  len      = 24
+  type     = STRING
+  htab     = 1
+  required = YES
+  list_cmd = command:single-val:"${CCFE_BIN_DIR:+$CCFE_BIN_DIR/}ccfe-build" list-users
+  label    = New owner -- USER or USER:GROUP (F2 for users)
+}
+action { run:
+  "${CCFE_BIN_DIR:+$CCFE_BIN_DIR/}ccfe-build" chown \
+      "$CCFE_FIELD_OBJECT" "$CCFE_FIELD_OWNER"
+}

src/builder.menu

@@ -40,6 +40,11 @@ item {
   descr  = Change a setting (ccfe.conf)
   action = form:builder.d/settings
 }
+item {
+  id     = CHOWN
+  descr  = Change object ownership (chown)
+  action = form:builder.d/chown
+}
 item {
   id     = LIST
   descr  = List my menus and forms

src/t/43-ownership.t

@@ -0,0 +1,58 @@
+#!/usr/bin/perl
+#
+# Menu/form ownership management (FEATURE-REQUESTS C1).
+#
+# ccfe-build gains list-objects / list-users / list-groups and a `chown`
+# command that changes ownership of one of the user's own objects (only under
+# the user objdir -- a system object, locked by restricted mode, is never
+# reachable).  Driven directly at the ccfe-build layer: enumerate, chown to
+# self (always allowed), and the clean-failure paths (invalid name / missing
+# object).  Also parse-checks the chown builder form.
+#
+use strict;
+use warnings;
+use FindBin qw($Bin);
+use File::Temp qw(tempdir);
+use File::Path qw(make_path);
+use Test::More;
+
+my $src   = "$Bin/..";
+my $build = "$src/tools/ccfe-build";
+plan skip_all => 'no ccfe-build' unless -f $build;
+plan skip_all => 'no installer'  unless -f "$src/install.sh";
+
+# Parse-check the chown builder form (and the rest) via `ccfe -k`.
+my $prefix = tempdir( CLEANUP => 1 );
+my $log    = `cd "$src" && sh install.sh -b -p "$prefix" 2>&1`;
+plan skip_all => "install failed: $log" unless $? == 0 && -x "$prefix/bin/ccfe";
+
+plan tests => 6;
+
+system("$prefix/bin/ccfe -k builder.d/chown >/dev/null 2>&1");
+is( $? >> 8, 0, 'the chown builder form parses' );
+
+# Isolated user objdir with one object.
+my $home = tempdir( CLEANUP => 1 );
+local $ENV{XDG_DATA_HOME}   = "$home/data";
+local $ENV{XDG_CONFIG_HOME} = "$home/config";
+my $objdir = "$home/data/ccfe/ccfe";
+make_path($objdir);
+open( my $o, '>', "$objdir/myobj.menu" ) or die "obj: $!";
+print {$o} "title {\n  X\n}\n";
+close($o);
+
+my $me = getpwuid($<);
+
+like( scalar(`sh "$build" list-objects 2>&1`), qr/^myobj$/m,
+    'list-objects lists my object' );
+like( scalar(`sh "$build" list-users 2>&1`), qr/\Q$me\E/,
+    'list-users includes me' );
+
+system(qq{sh "$build" chown myobj "$me" >/dev/null 2>&1});
+is( $? >> 8, 0, 'chown to myself succeeds' );
+
+system(qq{sh "$build" chown 'bad/name' "$me" >/dev/null 2>&1});
+isnt( $? >> 8, 0, 'an invalid object name is refused' );
+
+system(qq{sh "$build" chown nosuchobject "$me" >/dev/null 2>&1});
+isnt( $? >> 8, 0, 'a missing object is refused' );

src/tools/ccfe-build

@@ -17,8 +17,11 @@
 #   ccfe-build set-action FORM ACTION
 #   ccfe-build set-config KEY VALUE        # global { } setting in the user conf
 #   ccfe-build set-var    NAME VALUE       # variables { } entry in the user conf
-#   ccfe-build show-config                 # print the user conf
+#   ccfe-build show-config                 # global { } print the user conf
 #   ccfe-build list                        # list the user's objects
+#   ccfe-build chown      NAME USER[:GROUP] # change ownership of one of my objects
+#   ccfe-build list-objects                # object names (for a list_cmd)
+#   ccfe-build list-users / list-groups    # local users / groups (for a list_cmd)
 #
 #  Copyright (C) 2026 CCFE contributors.  GPL-2.0-or-later.
 
@@ -224,6 +227,52 @@ case "$cmd" in
     done
     ;;
 
+  list-objects)   # every menu/form name, deduped (for a form's list_cmd)
+    for f in "$objdir"/*.menu "$objdir"/*.form; do
+      [ -e "$f" ] || continue
+      b=${f##*/}; echo "${b%.*}"
+    done | sort -u
+    ;;
+
+  list-users)     # local login names, for the ownership picker
+    if command -v getent >/dev/null 2>&1; then
+      getent passwd | cut -d: -f1
+    else
+      cut -d: -f1 /etc/passwd
+    fi | sort -u
+    ;;
+
+  list-groups)    # local group names, for the ownership picker
+    if command -v getent >/dev/null 2>&1; then
+      getent group | cut -d: -f1
+    else
+      cut -d: -f1 /etc/group
+    fi | sort -u
+    ;;
+
+  chown)          # change ownership of one of MY objects (FEATURE-REQUESTS C1)
+    name=${1:-}; owner=${2:-}
+    valid_name "$name" || die "invalid object name \"$name\""
+    # USER, USER:GROUP or :GROUP, restricted characters (no shell metachars,
+    # no path separators) so the value cannot escape into the chown arguments.
+    case "$owner" in
+      '' | *[!A-Za-z0-9_.:-]* ) die "invalid owner \"$owner\" (USER[:GROUP])" ;;
+    esac
+    # Only ever touch objects under MY objdir; valid_name already forbids '/'
+    # and a leading dot, so $name cannot traverse out of it -- a system-owned
+    # object (which restricted mode locks) is never reachable here.
+    found=0
+    for suffix in .menu .form .d; do
+      t="$objdir/$name$suffix"
+      [ -e "$t" ] || continue
+      found=1
+      chown -R -- "$owner" "$t" \
+        || die "could not change owner of $t to $owner (need more privilege?)"
+      echo "Changed owner of $t to $owner"
+    done
+    [ "$found" = 1 ] || die "no object named \"$name\" under $objdir"
+    ;;
+
   *)
     die "unknown command: $cmd"
     ;;