On a headless Linux or BSD system (no DISPLAY or WAYLAND_DISPLAY) nothing
empties the freedesktop trash, so trashing never freed space. There, d now
deletes permanently after an explicit confirmation, checking owner and type
against the scan and removing through an os.Root on the parent so a swapped
symlink cannot redirect it. o shows the folder in the map instead of
launching a file manager. Desktop sessions, macOS and Windows are unchanged.
fix: duplicate search no longer hangs on files swapped for FIFOs
Candidates were reopened by path with os.Open after the scan. A file
replaced by a FIFO (or a symlink to one) blocked open(2) forever, and
context cancellation could not interrupt it, wedging the duplicate view
and --duplicates. Content is now opened with O_NOFOLLOW|O_NONBLOCK on
Unix; the existing regular-file check then skips it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix: pin parent directory and verify owner/type before trashing
Trash renamed the item by path after the confirmation dialog, so a
parent directory swapped for a symlink since the scan (e.g. by another
user, while an administrator cleans their home) redirected the move to
an unrelated file. The parent is now opened once and the item is checked
(owner and file type as scanned) and renamed relative to that fd.
macOS volume trash directories now get the same ownership/symlink checks
as freedesktop.org ones on Linux.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- snapshot: depth limit (stack overflow in exporters), decompressed-size
limit (gzip bombs), per-node size cap and saturating aggregation
- export: sanitise exclusion patterns from snapshot metadata
- tui: drop duplicate/trash/filter results that belong to a replaced
tree; cancel duplicate search on rescan
- trash: refuse symlinked or foreign shared-filesystem trash dirs; never
overwrite an existing trashed item
- scan: no symlink following without inode identity; correct unscanned
count and keep real read errors after cancellation
Single-writer controller with a select loop that offers jobs and accepts
results simultaneously, so bounded channels cannot deadlock. statx/fstatat
relative to the directory fd on Linux/macOS, portable fallback elsewhere.
Hard links counted once, symlink loops detected, virtual filesystems
skipped, errors classified and surfaced.
Andy Dixon
