feat: filter OS junk files (.DS_Store, Thumbs.db, etc.) (#15)

## Summary
- Reject creation of OS-generated junk files (`.DS_Store`, `._*`,
`.Spotlight-V100`, `.Trashes`, `.fseventsd`, `__MACOSX`, `Thumbs.db`,
`desktop.ini`) with `EACCES`
- Guards applied in `create()`, `mkdir()`, and `rename()` (destination
name) at the VirtualFs level, covering both FUSE and NFS
- Enabled by default, can be disabled with `--no-filter-os-files`

Closes #9

Author: XciD

src/setup.rs

@@ -101,6 +101,11 @@ pub struct Args {
     /// within this time regardless of ongoing writes resetting the debounce.
     #[arg(long, default_value_t = 30_000)]
     pub flush_max_batch_window_ms: u64,
+
+    /// Disable filtering of OS junk files (.DS_Store, Thumbs.db, etc.).
+    /// By default these files are rejected on create/mkdir/rename.
+    #[arg(long, default_value_t = false)]
+    pub no_filter_os_files: bool,
 }
 
 /// Everything needed to run a mount backend (FUSE or NFS).
@@ -261,6 +266,7 @@ pub fn setup(is_nfs: bool) -> MountSetup {
         args.poll_interval_secs,
         metadata_ttl,
         !args.metadata_ttl_minimal,
+        !args.no_filter_os_files,
         std::time::Duration::from_millis(args.flush_debounce_ms),
         std::time::Duration::from_millis(args.flush_max_batch_window_ms),
     );

src/test_mocks.rs

@@ -440,6 +440,7 @@ pub fn make_test_vfs(
         0,    // poll_interval_secs = 0 (disabled)
         opts.metadata_ttl,
         opts.serve_lookup_from_cache,
+        true,                       // filter_os_files
         Duration::from_millis(100), // fast debounce for tests
         Duration::from_secs(1),     // fast batch window for tests
     )

src/virtual_fs/mod.rs

@@ -29,6 +29,14 @@ type Invalidator = Arc<Mutex<Option<Box<dyn Fn(u64) + Send + Sync>>>>;
 type CommitHookTx = tokio::sync::watch::Sender<Option<Result<(), i32>>>;
 type CommitHookRx = tokio::sync::watch::Receiver<Option<Result<(), i32>>>;
 
+/// Returns `true` for OS-generated junk files that should not be synced to remote storage.
+fn is_os_junk(name: &str) -> bool {
+    matches!(
+        name,
+        ".DS_Store" | ".Spotlight-V100" | ".Trashes" | ".fseventsd" | "__MACOSX" | "Thumbs.db" | "desktop.ini"
+    ) || name.starts_with("._")
+}
+
 // ── VirtualFs ──────────────────────────────────────────────────────────
 
 pub struct VirtualFs {
@@ -66,6 +74,8 @@ pub struct VirtualFs {
     /// of `last_revalidated`.
     /// When true, lookups within the metadata TTL window skip HEAD.
     serve_lookup_from_cache: bool,
+    /// When true, reject creation of OS junk files (.DS_Store, Thumbs.db, etc.).
+    filter_os_files: bool,
 }
 
 /// Where to read file content from when opening read-only.
@@ -83,6 +93,7 @@ impl VirtualFs {
         poll_interval_secs: u64,
         metadata_ttl: Duration,
         serve_lookup_from_cache: bool,
+        filter_os_files: bool,
         flush_debounce: Duration,
         flush_max_batch_window: Duration,
     ) -> Arc<Self> {
@@ -146,6 +157,7 @@ impl VirtualFs {
             invalidator,
             metadata_ttl,
             serve_lookup_from_cache,
+            filter_os_files,
         });
 
         // Set root inode mtime (repos use the last commit date).
@@ -1799,6 +1811,10 @@ impl VirtualFs {
         if self.read_only {
             return Err(libc::EROFS);
         }
+        if self.filter_os_files && is_os_junk(name) {
+            debug!("create: rejecting OS junk file: {}", name);
+            return Err(libc::EACCES);
+        }
 
         debug!("create: parent={}, name={}", parent, name);
 
@@ -1907,6 +1923,10 @@ impl VirtualFs {
         if self.read_only {
             return Err(libc::EROFS);
         }
+        if self.filter_os_files && is_os_junk(name) {
+            debug!("mkdir: rejecting OS junk directory: {}", name);
+            return Err(libc::EACCES);
+        }
 
         debug!("mkdir: parent={}, name={}", parent, name);
 
@@ -2052,6 +2072,10 @@ impl VirtualFs {
         if self.read_only {
             return Err(libc::EROFS);
         }
+        if self.filter_os_files && is_os_junk(newname) {
+            debug!("rename: rejecting rename to OS junk name: {}", newname);
+            return Err(libc::EACCES);
+        }
 
         debug!(
             "rename: parent={}, name={}, newparent={}, newname={}",

src/virtual_fs/tests.rs

@@ -647,6 +647,40 @@ fn concurrent_create_eexist() {
     });
 }
 
+// ── OS junk file filtering ──────────────────────────────────────────
+
+/// create/mkdir/rename reject OS junk file names with EACCES.
+#[test]
+fn os_junk_files_rejected() {
+    let hub = MockHub::new();
+    hub.add_file("legit.txt", 10, Some("h"), None);
+    let xet = MockXet::new();
+    let (rt, vfs) = vfs_simple(&hub, &xet);
+
+    rt.block_on(async {
+        for name in [".DS_Store", "._metadata", "Thumbs.db", "desktop.ini", "__MACOSX"] {
+            assert_eq!(
+                vfs.create(ROOT_INODE, name, Some(1)).await.unwrap_err(),
+                libc::EACCES,
+                "create({name})"
+            );
+            assert_eq!(
+                vfs.mkdir(ROOT_INODE, name).await.unwrap_err(),
+                libc::EACCES,
+                "mkdir({name})"
+            );
+        }
+        // rename to a junk destination name is also blocked
+        let _ = vfs.lookup(ROOT_INODE, "legit.txt").await.unwrap();
+        assert_eq!(
+            vfs.rename(ROOT_INODE, "legit.txt", ROOT_INODE, ".DS_Store", false)
+                .await
+                .unwrap_err(),
+            libc::EACCES
+        );
+    });
+}
+
 // ── Lookup / revalidation / poll ────────────────────────────────────
 
 /// HEAD failure is silently ignored (graceful degradation, cached data served).