Repository navigation
Rebuild NTFS mounting core and add native macOS menu bar app - #6
Conversation
…l diagnostics (0.2.3)
…filenames (0.2.4)
… scoped GUI volume access (0.2.5)
…ermissions in 0.2.10
…ch ID design in 0.2.11
…fter biometric lockout
…before authorization
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e88c2466ec
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the latest head. The app now gives mount operations a 420-second outer bound, beyond the authorization core's 300-second session deadline, and explicitly maps any outer mount timeout (124) to uncertain completion (125). The log and menu explain that the mount and device-lock state are uncertain even if the shell process group has exited; the app performs only read-only observation afterward. Added status propagation regression coverage. This addresses the newest outer-timeout feedback before the coordinated merge. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 50871a4880
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the latest head. The shared bounded-tool timeout conversion now preserves 420 seconds instead of silently clamping it to 300. A hard 600-second ceiling remains; default helper tool deadlines and the 300-second authorization session remain unchanged. Added a Swift test of the exact millisecond conversion for the 420-second cleanup window and boundary values. The app still treats any outer mount timeout as uncertain completion/status 125. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dd10e856fb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the latest head. Both authorization host and helper transaction now share a 300s new-work phase plus a bounded 120s cleanup/completion phase. Expired sessions refuse driver launch, directory creation and lock acquisition while allowing same-identity recovery, inactive controlled-directory removal and token-owned lock release/commit acknowledgement. After expiry, unmount can target only this transaction's controlled mount, never its original mount. Added lifetime boundary tests, cleanup allowlist checks and helper late-acknowledgement/final-expiry tests. The app retains outer-timeout status 125. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 318d15d136
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the latest head. Accepted default-path work now runs through the pinned root authorizer with an absolute remaining-phase deadline, including fixed allowlisted system commands. A wrapper timeout returns 125 because descendants may use separate process groups, retaining the lock and suppressing recovery. Helper tools also use the remaining phase budget. Tests include an actual hung subprocess, expired-work refusal, and protected root wrapper token-owned acquire/release without disk mutation. Subsecond remaining budgets are preserved instead of rounded up to one second. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1ec08264a0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the latest head. Confirmed inner tool timeouts (124) are converted to ordinary failure (1) in the approved-driver and authorized-system child entry points before crossing the absolute-deadline wrapper. Inner 125 remains unchanged. Thus wrapper 124 identifies the outer deadline and becomes uncertain 125, while confirmed inner timeout permits normal recovery/cleanup. Regression tests run a genuinely timed-out single-process inner tool and distinguish its normal failure from an actual outer hung-process deadline. |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
mouNTFS 0.3.4 replaces the shell-only experience with a native macOS menu bar app and rebuilds the NTFS mounting core around explicit external-partition selection, connection-scoped identity checks, device locks, controlled mount directories, a login-user exclusive write probe and identity-checked read-only recovery. Failed operations never force dirty or hibernated volumes writable. App bundles keep the stable mouNTFS.app name inside versioned download archives. Bilingual usage documentation and promotional assets describe the current development app.
The bounded AppleScript authorization path remains the default. At every privileged execution, a fixed system-shell gate verifies a root-owned authorizer copy against the live client's kernel CDHash. It never executes the mutable app source. Before authorization, the driver dependency graph is captured from descriptor-read bytes; root setup requires those exact hashes and publishes a protected cache only after validation, linkage rewriting and signing. The default GUI and CLI paths execute that protected driver copy under the fixed sandbox. Full Disk Access must cover the actual protected executable shown in the operation log; permission for the Homebrew source alone may not cover it. An opt-in SMAppService permission helper can reuse privileged authority after explicit administrator setup. Its root API is restricted to status, authorized configuration, begin and fixed transaction operations, without arbitrary shell or executable endpoints. The exact signed client and server are pinned at build time. Driver setup snapshots ntfs-3g and non-system dependencies into protected generations, rewrites linkage, and applies a fixed execution sandbox that denies reads from mutable Homebrew and home prefixes. Active generations remain available to existing mounts.
Configured helper mounts can use app-side LocalAuthentication confirmation with Touch ID and system password fallback. This confirms user presence, not administrator credentials; initial privilege comes from explicit authorized helper setup. SMAppService registration/launch failures were observed on the user's Mac with ad-hoc development signing. Helper setup, protected-driver Full Disk Access, Touch ID hardware and real-disk behavior remain pending physical-Mac validation. The established AppleScript path does not prove the new helper works.
Copilot review fixes: menu items retain the scanned IOMedia identity; mount and eject actions recheck it after confirmation/authentication and before launching. Mounts pass the expected identity into the shell core, which refuses replacement media before a transaction begins. Helper tools have monotonic deadlines, capped output and dedicated process groups terminated on timeout; unconfirmed termination retains the device lock. Driver sources use no-follow descriptor walks, fstat checks and bounded reads, with mode-0700 generations until validation completes. Authorization requests use a bounded local socket instead of owner-only plist files. Kernel-reported peer PID/UID must belong to the original shell's live process tree, pinned by shell PID and birth time; legitimate nested shells remain supported. Clients verify the server PID. Zombie hosts and deadlines fail closed, and uncertain accepted requests retain the device lock and block later mutation. Development version fallback now matches 0.3.4; packaged apps cannot execute a current-directory development identity tool. The default authorization path and root daemon share root-owned, token-checked device locks across login users, retaining stale locks for inspected administrator cleanup. Builds discard the previous app bundle, and documentation capture fixtures include media identity and defer popup until the event loop is ready. The driver sandbox denies both reads and executable mappings from mutable prefixes; tool timeouts retain locks unless the entire process group is confirmed gone. Mutating XPC reply loss and helper startup failures preserve status 125 over an authenticated startup handshake. Helper commit uses the shared request handler and retains its root-owned device lock on disconnect/expiry until the originating shell acknowledges the success reply. App commands use bounded process groups and retain their login-user environment; kernel mount-state failure excludes scan entries, stale helper-status completions are ignored, final write-state uncertainty is shown explicitly, and diagnostics preserve the selected backend. Command-line docs now state the native identity-tool dependency. Cleanup also rechecks uncertain late lock-release/acknowledgement results and preserves 125 through the EXIT trap, with explicit completion/lock-state diagnostics and regressions for both paths. Cleanup reports an explicit retained-lock failure if the native release client disappears during app replacement. The default authorization handler preserves exit status 125 (tested through the actual AppleScript handler); uncertain driver termination suppresses recovery, mount-directory cleanup and device-lock release. Promotional documentation uses durable main URLs; other documentation uses repository-relative links.
Validation: Linux and macOS CI passed, including 20 shell regression groups, metadata/identity/mount-state simulations, stale-menu identity rejection, capped-output and hung-process/inherited-pipe deadline tests, macOS zombie detection, Swift metadata tests, descriptor-read link/size rejection, bounded peer-authenticated authorization IPC (including a detached same-user process forging the shell PID, legitimate direct/nested children, wrong ancestor birth time, status-125 propagation and a silent peer), sandbox behavior, pinned IPC/launchd status checks, app build/signature verification and versioned archive layout. Documentation screenshot capture passed and produced four native UI images. All repository-relative documentation links were checked locally. Execution-boundary regression checks passed for rejecting a replaced app executable before bootstrap, executing the pinned protected authorizer after later app replacement, rejecting changed driver/dependency bytes and continuing to execute the approved snapshot after its source changes. Follow-up checks passed for independent privileged-process lock contention and wrong-token refusal in the real root-owned store, actual executable mapping denial (with the former read-only policy as an allowing control), process-group disappearance on timeout, and removal of a seeded stale build resource.
Limits: CI does not mount a physical NTFS disk or validate SMAppService registration through system approval UI. Userspace identity checks are not an atomic kernel reservation against hot unplug during a system command. Detached processes and actual driver/kernel timeout behavior require physical-Mac validation. docs/AUTHORIZATION.md and docs/VALIDATION.md describe these boundaries. This remains an ad-hoc development build, not a notarized public release. It does not merge or deploy the separate Pages PR.
Final helper completion fix: the finish RPC synchronously releases the token-owned device lock and returns any release error before shell cleanup completes. Successful release ends the service transaction. macOS daemon tests exercise release failure propagation, retained locks and idempotent completion without disk mutation.