Network/auth/delegate hardening

hdms
Added ls alias to list.
Made delegate failures explicit and nonzero in packages/bare-os-coreutils/src/hdms.js.
Added nonzero error exit in packages/bare-os-booter/lib/hdms-manager.js.
git-pear
Implemented clone subcommand routing to git clone in packages/bare-os-coreutils/src/git-pear.js.
trustctl
Added ls alias to status/policy output in packages/bare-os-coreutils/src/trustctl.js.
oidc-publish
Added explicit unknown-subcommand handling and publish subcommand compatibility in packages/bare-os-coreutils/src/oidc-publish.js.
ssh-keygen
Wrapped delegate invocation with explicit error propagation in packages/bare-os-coreutils/src/ssh-keygen.js.
Added success output on generated keypair in packages/bare-os-booter/lib/ssh-keygen-cli.js.
sshd
Added -t config test mode and explicit exit semantics in packages/bare-os-booter/lib/bare-openssh.js.
Ensured wrapper sets exit code consistently in packages/bare-os-openssh/src/sshd.js.
telnet
Changed connector preference to use net.createConnection first when available, then syscall bridge fallback, in packages/bare-os-coreutils/src/telnet.js.
crontab -e flow

Implemented edit flow with VISUAL/EDITOR fallback, unlocked-state checks, temp file handling, install, and cleanup in packages/bare-os-coreutils/src/crontab.js.
Shell/runtime hardcore semantics

Added numeric brace range expansion {1..5} in packages/bare-os-booter/lib/shell-glob.js.
Enabled brace expansion by default unless explicitly disabled.
Added normalization for inline brace-expression tokens in packages/bare-os-booter/lib/shell.js.
Added arithmetic command-form handling for (( ... )) in packages/bare-os-booter/lib/shell.js.
Extended shell signal trap dispatch support for USR1/USR2 (in addition to INT/TERM) in packages/bare-os-booter/index.js.
Hardened kill command delivery validation in packages/bare-os-coreutils/src/kill.js.
Regression tests

Added new: packages/bare-os-coreutils/test/hardcore-bugs.test.mjs.
Extended shell tests in packages/bare-os-booter/test.js for:
default cmdsub behavior,
brace range expansion,
arithmetic command form.
Existing regression files still pass after updates.

kernel/bin/crontab

@@ -137,6 +137,57 @@ async function run(ctx, argv) {
     return
   }
 
+  if (rest[0] === '-e') {
+    if (ctx.identity?.state !== 'unlocked') {
+      ctx.console.error('crontab: log in to edit crontab')
+      ctx.exitCode = 1
+      return
+    }
+    if (typeof ctx.runBinCommand !== 'function') {
+      ctx.console.error('crontab: -e requires runBinCommand support in this runtime')
+      ctx.exitCode = 1
+      return
+    }
+    const editorRaw = String(vfs.env?.VISUAL || vfs.env?.EDITOR || '').trim()
+    const editor = editorRaw || 'edit'
+    const editorParts = editor.split(/\s+/).filter(Boolean)
+    if (!editorParts.length) {
+      ctx.console.error('crontab: no editor configured')
+      ctx.exitCode = 1
+      return
+    }
+    const tmpPath = `${h}/.crontab.edit.${Date.now()}`
+    try {
+      const prev = await vfs.readFile(tabPath)
+      await vfs.writeFile(tmpPath, prev || ctx.b4a.from(''))
+    } catch (e) {
+      ctx.console.error('crontab: failed preparing editor buffer: ' + (e?.message || e))
+      ctx.exitCode = 1
+      return
+    }
+    try {
+      await ctx.runBinCommand([...editorParts, tmpPath])
+      const edited = await vfs.readFile(tmpPath)
+      if (edited == null) {
+        ctx.console.error('crontab: edit aborted (temporary file missing)')
+        ctx.exitCode = 1
+        return
+      }
+      await vfs.writeFile(tabPath, edited)
+      ctx.console.log('crontab: installed')
+    } catch (e) {
+      ctx.console.error('crontab: edit failed: ' + (e?.message || e))
+      ctx.exitCode = 1
+    } finally {
+      try {
+        await vfs.unlink(tmpPath)
+      } catch {
+        /* ignore temp cleanup errors */
+      }
+    }
+    return
+  }
+
   if (rest[0].startsWith('-')) {
     ctx.console.error('crontab: unknown option ' + rest[0])
     ctx.exitCode = 1