This is simply not good enough, and yet another example of the sloppiness in supporting everyday run-of-the-mill functionality in multi-context environments (the list of features that were, and still are, missing in multi-context mode is infuriating).
OK, file-access is restricted to the SYS context. Not a problem - you already do network (client) operations for SYS context using the IP-address(es) of ADMIN (ntp, tftp, network file copy). Extending that to SCP server (and the matching required AAA) is trivial.
Sure, I could code my way around it by sending ssh commands that copies the other way - BUT I DON'T WANT TO. I don't want to involving the authentication space of the Linux machine doing the work. I use specially designated machine accounts that are only valid for TACACS login while coming from exactly that Linux machine.
So kindly "unterminate" the bug and start coding.
