dwipe 3.0.1__tar.gz → 3.0.2__tar.gz

dwipe-3.0.2/.github/workflows/tests.yml

@@ -0,0 +1,47 @@
+name: tests
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install package with test extras
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e '.[test]'
+
+      - name: Run unit tests with coverage
+        run: pytest --cov=dwipe --cov-report=term-missing --cov-fail-under=40
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install pylint
+        run: python -m pip install --upgrade pip pylint
+
+      - name: Static checks (undefined names / bad calls)
+        # Full advisory lint is available locally via ./linter. This job blocks
+        # only on the error classes that indicate real bugs (undefined name,
+        # bad call signature) and currently passes at 10.00/10.
+        run: pylint --disable=all --enable=E0601,E0602,E0603,E1120,E1121 dwipe

{dwipe-3.0.1 → dwipe-3.0.2}/.gitignore

@@ -6,4 +6,5 @@ venv.zd/
 *.pyc
 *egg-info*
 dist/
-.github/
+.coverage
+htmlcov/

dwipe-3.0.1/README.md → dwipe-3.0.2/PKG-INFO

@@ -1,7 +1,26 @@
+Metadata-Version: 2.4
+Name: dwipe
+Version: 3.0.2
+Summary: A tool to wipe disks and partitions for Linux
+Keywords: disk,partition,wipe,clean,scrub
+Author-email: Joe Defen <joedef@google.com>
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: POSIX :: Linux
+License-File: LICENSE
+Requires-Dist: console-window == 1.4.2
+Requires-Dist: pytest >= 7.0 ; extra == "test"
+Requires-Dist: pytest-cov >= 4.0 ; extra == "test"
+Project-URL: Bug Tracker, https://github.com/joedefen/dwipe/issues
+Project-URL: Homepage, https://github.com/joedefen/dwipe
+Provides-Extra: test
+
 # dwipe
 `dwipe` is a tool to wipe disks and partitions for Linux to help secure your data. `dwipe` aims to reduce mistakes by providing ample information about your devices during selection.
 
-![Demo of dwipe](https://raw.githubusercontent.com/joedefen/dwipe/master/images/dwipe-2025-12-31-09-37.gif)
+![Demo of dwipe](https://raw.githubusercontent.com/joedefen/dwipe/master/images/dwipe-2026-02-05.07-58.gif)
 ### Quick Comparison
 
 | Feature | dwipe | nwipe | shred | dd |
@@ -15,7 +34,7 @@
 | Device/partition blocking | ✓ | ✗ | ✗ | ✗ |
 | Resume interrupted software wipes | ✓ | ✗ | ✗ | ✗ |
 | Wipe operation logging | ✓ | ✗ | ✗ | ✗ |
-| Mount detection/prevention | ✓ | ✓ | ✗ | ✗ |
+| Mount & LUKS/LVM/RAID/swap detection | ✓ | ✓ | ✗ | ✗ |
 | Fast Statistical sampling verification | ✓ | ✗ | ✗ | ✗ |
 | Certified destruction (DoD/Gutmann standards, full verification, certificates) | ✗ | ✓ | ✗ | ✗ |
 
@@ -30,7 +49,7 @@
 * **Multiple simultaneous wipes** - Start wipes on multiple devices at once with individual progress tracking and completion states
 * **Persistent state tracking** - Wipe status survives reboots; partially wiped and completed states persist on the device (can resume wipes across power cycles)
 * **Smart device identification** - Uses UUID/PARTUUID/serial numbers for stable device tracking across reconnections
-* **Safety protections** - Prevents wiping mounted devices, detects overlapping wipes, supports device blocking, inline confirmation prompts
+* **Safety protections** - Prevents wiping mounted or in-use devices (including LUKS/LVM/RAID containers and swap), detects overlapping wipes, supports device blocking, inline confirmation prompts
 * **Intelligent verification with statistical sampling** - Fast verification that covers entire disk even at low percentages (1% verification samples from all 100 disk sections)
 * **Direct I/O to disk** - Fast and efficient wiping that avoids page cache pollution with automatic slowdown/stall detection and graceful abort
 * **Multiple color themes** - Terminal color themes designed for readability with context-sensitive visual feedback (mounted devices dimmed, active wipes bright)
@@ -75,7 +94,7 @@
 `dwipe` provides comprehensive disk wiping capabilities with safety features:
 
 * **Smart device display** - Shows disks and partitions with labels, sizes, types, and vendor/model information to help identify devices correctly
-* **Safety protections** - Prevents wiping mounted devices, detects overlapping wipes, supports manual disk blocking
+* **Safety protections** - Prevents wiping mounted or in-use devices (including LUKS/LVM/RAID containers and swap), detects overlapping wipes, supports manual disk blocking
 * **Hot-swap detection** - Updates the device list when storage changes; newly added devices are marked with **^** to make them easy to spot
 * **Multiple simultaneous wipes** - Start wipes on multiple devices at once, with individual progress tracking and completion states
 * **Flexible wipe modes** - Choose between Rand, Zero, Rand+V (with auto-verify), or Zero+V (with auto-verify)
@@ -125,6 +144,10 @@ Simply run `dwipe` from the command line without arguments: `dwipe`
 - `--firmware-wipes` or `-F` - Enable firmware wipes
   - Enables hardware-based secure erase operations (NVMe Sanitize/Format, SATA ATA Security Erase)
   - Without this flag, only software wipes (Zero/Rand) are available
+- `--auto-block-containers {on,off}` - Auto-block encrypted/stacked containers on first sight (default: on)
+  - Blocks devices whose filesystem is a container (LUKS, LVM, RAID member, swap) the first time they are seen, so wiping requires an explicit unblock (**b**)
+  - The block is remembered per device; once you unblock, it stays unblocked
+  - Set to `off` when re-provisioning many encrypted disks to avoid unblocking each one
 - `--dump-lsblk` - Dump parsed device information and exit (for debugging)
 - `--help` - Show help message with all available options
 
@@ -132,7 +155,7 @@ Simply run `dwipe` from the command line without arguments: `dwipe`
 
 `dwipe` uses color coding to provide instant visual feedback about device and operation status:
 
-- **Dimmed (gray)** - Mounted or blocked devices (cannot be wiped)
+- **Dimmed (gray)** - Mounted, in-use (LUKS/LVM/RAID/swap), or blocked devices (cannot be wiped)
 - **Default (white)** - Ready to wipe, idle state, or previously wiped (before this session)
 - **Bright cyan/blue + bold** - Active wipe or verification in progress (0-100% write, v0-v100% verify)
 - **Bold yellow** - Stopped or partially completed wipe
@@ -174,15 +197,41 @@ The **STATE** column shows the current status of each device:
 |-------|---------|
 | **-** | Device is ready for wiping |
 | **^** | Device is ready for wiping AND was added after `dwipe` started (hot-swapped) |
-| **Mnt** | Partition is mounted or disk has mounted partitions - cannot be wiped |
+| **Mnt** | Partition/disk is mounted, or in use via a swap/LUKS/LVM/RAID mapping - cannot be wiped |
 | **N%** | Wipe is in progress (shows percentage complete, 0-100%) |
 | **vN%** | Verification is in progress (shows percentage complete, v0-v100%) |
 | **STOP** | Wipe or verification is being stopped |
 | **s** | Wipe was stopped - device is partially wiped (can restart or verify) |
 | **W** | Wipe was completed successfully (can wipe again or verify) |
-| **Blk** | Disk is manually blocked - partitions are hidden and cannot be wiped |
+| **Blk** | Device/disk is blocked (with **b**, or auto-blocked when it is a LUKS/LVM/RAID/swap container) - cannot be wiped |
 | **Unbl** | Disk was just unblocked (transitory state) |
 
+### Mounts / Status Column
+
+The **MOUNTS/STATUS** column shows how a device is currently in use:
+
+| Display | Meaning |
+|---------|---------|
+| **/**, **/data** | A real mount point (mounted directly, or through a LUKS/LVM/RAID mapping) |
+| **\busy** | In use but not mounted — e.g. an *open* LUKS container, an active LVM volume group, a running RAID array, or active swap |
+
+Both are treated as mounted: the device is dimmed and **w** (wipe) is not offered. `\busy` uses a backslash (not `/`) to make clear it is not a real mount point, yet it is treated like one for safety. To wipe such a device, first release the layer holding it (see [Wipe issues](#wipe-issues)).
+
+> **Note:** A device held by a lower layer (dm-crypt/LUKS, LVM, md/RAID, swap) is protected even when it is not itself mounted. Wiping the backing device while a mapping is active would corrupt the container, so `dwipe` treats it as mounted. Mount points reached through a mapping are attributed back to the underlying device, so a LUKS partition shows the mount of its unlocked mapping.
+
+### Auto-Blocking Containers
+
+`dwipe` auto-blocks devices that hold encrypted or stacked containers **the first time they are seen**, whether or not they are currently in use. This guards data that is otherwise easy to wipe by accident, since a *closed* container shows almost no hint beyond its type:
+
+- `crypto_LUKS` (dm-crypt/LUKS)
+- `LVM2_member` (LVM physical volume)
+- `linux_raid_member` / `isw_raid_member` / `ddf_raid_member` (RAID members)
+- `swap`
+
+Such a device shows state **Blk** with an `auto-blocked` status, and its whole disk is protected too (inherited block). To wipe it, press **b** to unblock — the unblock is remembered, so it is not re-blocked on later scans.
+
+Auto-blocking is on by default. Disable it for bulk re-provisioning with `--auto-block-containers off` (saved as a preference).
+
 ### Available Actions
 
 The top line shows available actions. Some are context-sensitive (only available for certain devices):
@@ -448,9 +497,14 @@ Press **ESC** from the main screen to clear the filter and return to showing all
 - **Colors don't work** - Ensure your terminal supports colors (most modern terminals do)
 
 ### Wipe issues
-- **Can't wipe a device** - Check the STATE column:
+- **Can't wipe a device** - Check the STATE and MOUNTS/STATUS columns:
   - **Mnt** - Unmount the partition first: `sudo umount /dev/sdXN`
-  - **Blk** - Press **b** to unblock
+  - **`\busy`** status, or **Mnt** caused by a lower layer - release the mapping/volume first, then rescan (**r**):
+    - LUKS: unmount, then `sudo cryptsetup close <name>`
+    - LVM: `sudo vgchange -an <vg>` (deactivate the volume group)
+    - RAID: `sudo mdadm --stop /dev/mdX`
+    - Swap: `sudo swapoff /dev/...`
+  - **Blk** - Press **b** to unblock (containers such as LUKS/LVM/RAID/swap are auto-blocked until you do)
   - **Busy** - Another partition on the disk is being wiped
 - **Wipe is very slow** - Normal for large drives; check write rate to verify progress
 - **Wipe seems stuck** - Most likely due to bad disks; Direct I/O makes progress almost constant on good disks.
@@ -546,4 +600,4 @@ Issues and pull requests welcome at [github.com/joedefen/dwipe](https://github.c
 
 ## License
 
-MIT License - see [LICENSE](LICENSE) file for details.
+MIT License - see [LICENSE](LICENSE) file for details.

dwipe-3.0.1/PKG-INFO → dwipe-3.0.2/README.md

@@ -1,23 +1,7 @@
-Metadata-Version: 2.4
-Name: dwipe
-Version: 3.0.1
-Summary: A tool to wipe disks and partitions for Linux
-Keywords: disk,partition,wipe,clean,scrub
-Author-email: Joe Defen <joedef@google.com>
-Requires-Python: >=3.10
-Description-Content-Type: text/markdown
-Classifier: Programming Language :: Python :: 3
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Operating System :: POSIX :: Linux
-License-File: LICENSE
-Requires-Dist: console-window == 1.4.2
-Project-URL: Bug Tracker, https://github.com/joedefen/dwipe/issues
-Project-URL: Homepage, https://github.com/joedefen/dwipe
-
 # dwipe
 `dwipe` is a tool to wipe disks and partitions for Linux to help secure your data. `dwipe` aims to reduce mistakes by providing ample information about your devices during selection.
 
-![Demo of dwipe](https://raw.githubusercontent.com/joedefen/dwipe/master/images/dwipe-2025-12-31-09-37.gif)
+![Demo of dwipe](https://raw.githubusercontent.com/joedefen/dwipe/master/images/dwipe-2026-02-05.07-58.gif)
 ### Quick Comparison
 
 | Feature | dwipe | nwipe | shred | dd |
@@ -31,7 +15,7 @@ Project-URL: Homepage, https://github.com/joedefen/dwipe
 | Device/partition blocking | ✓ | ✗ | ✗ | ✗ |
 | Resume interrupted software wipes | ✓ | ✗ | ✗ | ✗ |
 | Wipe operation logging | ✓ | ✗ | ✗ | ✗ |
-| Mount detection/prevention | ✓ | ✓ | ✗ | ✗ |
+| Mount & LUKS/LVM/RAID/swap detection | ✓ | ✓ | ✗ | ✗ |
 | Fast Statistical sampling verification | ✓ | ✗ | ✗ | ✗ |
 | Certified destruction (DoD/Gutmann standards, full verification, certificates) | ✗ | ✓ | ✗ | ✗ |
 
@@ -46,7 +30,7 @@ Project-URL: Homepage, https://github.com/joedefen/dwipe
 * **Multiple simultaneous wipes** - Start wipes on multiple devices at once with individual progress tracking and completion states
 * **Persistent state tracking** - Wipe status survives reboots; partially wiped and completed states persist on the device (can resume wipes across power cycles)
 * **Smart device identification** - Uses UUID/PARTUUID/serial numbers for stable device tracking across reconnections
-* **Safety protections** - Prevents wiping mounted devices, detects overlapping wipes, supports device blocking, inline confirmation prompts
+* **Safety protections** - Prevents wiping mounted or in-use devices (including LUKS/LVM/RAID containers and swap), detects overlapping wipes, supports device blocking, inline confirmation prompts
 * **Intelligent verification with statistical sampling** - Fast verification that covers entire disk even at low percentages (1% verification samples from all 100 disk sections)
 * **Direct I/O to disk** - Fast and efficient wiping that avoids page cache pollution with automatic slowdown/stall detection and graceful abort
 * **Multiple color themes** - Terminal color themes designed for readability with context-sensitive visual feedback (mounted devices dimmed, active wipes bright)
@@ -91,7 +75,7 @@ Project-URL: Homepage, https://github.com/joedefen/dwipe
 `dwipe` provides comprehensive disk wiping capabilities with safety features:
 
 * **Smart device display** - Shows disks and partitions with labels, sizes, types, and vendor/model information to help identify devices correctly
-* **Safety protections** - Prevents wiping mounted devices, detects overlapping wipes, supports manual disk blocking
+* **Safety protections** - Prevents wiping mounted or in-use devices (including LUKS/LVM/RAID containers and swap), detects overlapping wipes, supports manual disk blocking
 * **Hot-swap detection** - Updates the device list when storage changes; newly added devices are marked with **^** to make them easy to spot
 * **Multiple simultaneous wipes** - Start wipes on multiple devices at once, with individual progress tracking and completion states
 * **Flexible wipe modes** - Choose between Rand, Zero, Rand+V (with auto-verify), or Zero+V (with auto-verify)
@@ -141,6 +125,10 @@ Simply run `dwipe` from the command line without arguments: `dwipe`
 - `--firmware-wipes` or `-F` - Enable firmware wipes
   - Enables hardware-based secure erase operations (NVMe Sanitize/Format, SATA ATA Security Erase)
   - Without this flag, only software wipes (Zero/Rand) are available
+- `--auto-block-containers {on,off}` - Auto-block encrypted/stacked containers on first sight (default: on)
+  - Blocks devices whose filesystem is a container (LUKS, LVM, RAID member, swap) the first time they are seen, so wiping requires an explicit unblock (**b**)
+  - The block is remembered per device; once you unblock, it stays unblocked
+  - Set to `off` when re-provisioning many encrypted disks to avoid unblocking each one
 - `--dump-lsblk` - Dump parsed device information and exit (for debugging)
 - `--help` - Show help message with all available options
 
@@ -148,7 +136,7 @@ Simply run `dwipe` from the command line without arguments: `dwipe`
 
 `dwipe` uses color coding to provide instant visual feedback about device and operation status:
 
-- **Dimmed (gray)** - Mounted or blocked devices (cannot be wiped)
+- **Dimmed (gray)** - Mounted, in-use (LUKS/LVM/RAID/swap), or blocked devices (cannot be wiped)
 - **Default (white)** - Ready to wipe, idle state, or previously wiped (before this session)
 - **Bright cyan/blue + bold** - Active wipe or verification in progress (0-100% write, v0-v100% verify)
 - **Bold yellow** - Stopped or partially completed wipe
@@ -190,15 +178,41 @@ The **STATE** column shows the current status of each device:
 |-------|---------|
 | **-** | Device is ready for wiping |
 | **^** | Device is ready for wiping AND was added after `dwipe` started (hot-swapped) |
-| **Mnt** | Partition is mounted or disk has mounted partitions - cannot be wiped |
+| **Mnt** | Partition/disk is mounted, or in use via a swap/LUKS/LVM/RAID mapping - cannot be wiped |
 | **N%** | Wipe is in progress (shows percentage complete, 0-100%) |
 | **vN%** | Verification is in progress (shows percentage complete, v0-v100%) |
 | **STOP** | Wipe or verification is being stopped |
 | **s** | Wipe was stopped - device is partially wiped (can restart or verify) |
 | **W** | Wipe was completed successfully (can wipe again or verify) |
-| **Blk** | Disk is manually blocked - partitions are hidden and cannot be wiped |
+| **Blk** | Device/disk is blocked (with **b**, or auto-blocked when it is a LUKS/LVM/RAID/swap container) - cannot be wiped |
 | **Unbl** | Disk was just unblocked (transitory state) |
 
+### Mounts / Status Column
+
+The **MOUNTS/STATUS** column shows how a device is currently in use:
+
+| Display | Meaning |
+|---------|---------|
+| **/**, **/data** | A real mount point (mounted directly, or through a LUKS/LVM/RAID mapping) |
+| **\busy** | In use but not mounted — e.g. an *open* LUKS container, an active LVM volume group, a running RAID array, or active swap |
+
+Both are treated as mounted: the device is dimmed and **w** (wipe) is not offered. `\busy` uses a backslash (not `/`) to make clear it is not a real mount point, yet it is treated like one for safety. To wipe such a device, first release the layer holding it (see [Wipe issues](#wipe-issues)).
+
+> **Note:** A device held by a lower layer (dm-crypt/LUKS, LVM, md/RAID, swap) is protected even when it is not itself mounted. Wiping the backing device while a mapping is active would corrupt the container, so `dwipe` treats it as mounted. Mount points reached through a mapping are attributed back to the underlying device, so a LUKS partition shows the mount of its unlocked mapping.
+
+### Auto-Blocking Containers
+
+`dwipe` auto-blocks devices that hold encrypted or stacked containers **the first time they are seen**, whether or not they are currently in use. This guards data that is otherwise easy to wipe by accident, since a *closed* container shows almost no hint beyond its type:
+
+- `crypto_LUKS` (dm-crypt/LUKS)
+- `LVM2_member` (LVM physical volume)
+- `linux_raid_member` / `isw_raid_member` / `ddf_raid_member` (RAID members)
+- `swap`
+
+Such a device shows state **Blk** with an `auto-blocked` status, and its whole disk is protected too (inherited block). To wipe it, press **b** to unblock — the unblock is remembered, so it is not re-blocked on later scans.
+
+Auto-blocking is on by default. Disable it for bulk re-provisioning with `--auto-block-containers off` (saved as a preference).
+
 ### Available Actions
 
 The top line shows available actions. Some are context-sensitive (only available for certain devices):
@@ -464,9 +478,14 @@ Press **ESC** from the main screen to clear the filter and return to showing all
 - **Colors don't work** - Ensure your terminal supports colors (most modern terminals do)
 
 ### Wipe issues
-- **Can't wipe a device** - Check the STATE column:
+- **Can't wipe a device** - Check the STATE and MOUNTS/STATUS columns:
   - **Mnt** - Unmount the partition first: `sudo umount /dev/sdXN`
-  - **Blk** - Press **b** to unblock
+  - **`\busy`** status, or **Mnt** caused by a lower layer - release the mapping/volume first, then rescan (**r**):
+    - LUKS: unmount, then `sudo cryptsetup close <name>`
+    - LVM: `sudo vgchange -an <vg>` (deactivate the volume group)
+    - RAID: `sudo mdadm --stop /dev/mdX`
+    - Swap: `sudo swapoff /dev/...`
+  - **Blk** - Press **b** to unblock (containers such as LUKS/LVM/RAID/swap are auto-blocked until you do)
   - **Busy** - Another partition on the disk is being wiped
 - **Wipe is very slow** - Normal for large drives; check write rate to verify progress
 - **Wipe seems stuck** - Most likely due to bad disks; Direct I/O makes progress almost constant on good disks.
@@ -562,4 +581,4 @@ Issues and pull requests welcome at [github.com/joedefen/dwipe](https://github.c
 
 ## License
 
-MIT License - see [LICENSE](LICENSE) file for details.
+MIT License - see [LICENSE](LICENSE) file for details.

{dwipe-3.0.1 → dwipe-3.0.2}/dwipe/DeviceInfo.py

@@ -27,6 +27,23 @@ class DeviceInfo:
     disk_majors = set()  # major devices that are disks
     _discovery_cycle = 0  # Counter to prove discovery is running
 
+    # Filesystem types marking an encrypted/stacked container whose contents
+    # are hidden behind another layer. These are auto-blocked on first sight.
+    CONTAINER_FSTYPES = (
+        'crypto_LUKS', 'LVM2_member', 'linux_raid_member',
+        'isw_raid_member', 'ddf_raid_member', 'swap',
+    )
+    CONTAINER_FSTYPE_PREFIXES = ('crypto_', 'DM_')
+
+    @staticmethod
+    def is_container_fstype(fstype):
+        """True if fstype marks a container (LUKS/LVM/RAID/swap)."""
+        if not fstype:
+            return False
+        if fstype in DeviceInfo.CONTAINER_FSTYPES:
+            return True
+        return any(fstype.startswith(p) for p in DeviceInfo.CONTAINER_FSTYPE_PREFIXES)
+
     @staticmethod
     def clean_partition_label(label):
         """Clean up partition labels by decoding escape sequences and simplifying common labels.
@@ -99,6 +116,9 @@ class DeviceInfo:
                                hw_caps_state=ProbeState.PENDING,  # probe state for hw_caps
                                is_usb=False,   # True if device is on USB bus
                                is_rotational=False,  # True if HDD (spinning disk)
+                               in_use=False,   # mounted/swap or backing an active holder
+                               is_container=False,  # LUKS/LVM/RAID/swap container
+                               auto_blocked=False,  # blocked automatically (container)
                                )
 
     def get_hw_capabilities(self, ns):
@@ -112,11 +132,7 @@ class DeviceInfo:
         if ns.hw_caps_state == ProbeState.READY:
             return ns.hw_caps, ns.hw_nopes
 
-        # 2. Skip probing non-wipeable devices (mounted/blocked)
-        if ns.state in ('Mnt', 'iMnt', 'Blk', 'iBlk', 'Busy'):
-            return ns.hw_caps, ns.hw_nopes
-
-        # 3. Skip probing if device has active job (would block on SATA wipe)
+        # 2. Skip probing if device has active job (would block on SATA wipe)
         if ns.job:
             return ns.hw_caps, ns.hw_nopes
 
@@ -260,12 +276,40 @@ class DeviceInfo:
             pass
         return devices
 
+    @staticmethod
+    def _block_name_from_devpath(devpath):
+        """Resolve a /dev path to its canonical kernel block name.
+
+        Handles /dev/sda1, /dev/md0, /dev/dm-0 and indirection through
+        /dev/mapper/<name> or /dev/disk/by-* (resolved via realpath).
+        Returns '' for anything that is not a block device path.
+        """
+        if not devpath.startswith('/dev/'):
+            return ''
+        try:
+            real = os.path.realpath(devpath)
+        except OSError:
+            real = devpath
+        return os.path.basename(real)
+
+    @staticmethod
+    def _read_sysfs_dir(path):
+        """List a sysfs directory, returning [] if it is missing or unreadable."""
+        try:
+            return os.listdir(path)
+        except OSError:
+            return []
+
     def _parse_proc_mounts(self):
         """Parse /proc/mounts for mount points (non-blocking).
 
         Format: device mountpoint fstype options dump pass
                 /dev/sda1 /boot ext4 rw,relatime 0 0
 
+        Device paths are resolved to canonical block names so a mount on a
+        dm-crypt/LVM/RAID mapping (e.g. /dev/mapper/crypt -> dm-0) is
+        attributed to the underlying block device.
+
         Returns:
             dict: {device_name: {'mounts': [mountpoint1, ...], 'fstype': str}}
         """
@@ -275,7 +319,9 @@ class DeviceInfo:
                 for line in f:
                     parts = line.split()
                     if len(parts) >= 3 and parts[0].startswith('/dev/'):
-                        device = parts[0][5:]  # Strip '/dev/'
+                        device = self._block_name_from_devpath(parts[0])
+                        if not device:
+                            continue
                         mountpoint = parts[1]
                         fstype = parts[2]
                         if device not in mounts:
@@ -285,6 +331,94 @@ class DeviceInfo:
             pass
         return mounts
 
+    @staticmethod
+    def _parse_proc_swaps():
+        """Return canonical block names currently used as swap (non-blocking)."""
+        names = set()
+        try:
+            with open('/proc/swaps', 'r', encoding='utf-8') as f:
+                next(f, None)  # skip header line
+                for line in f:
+                    parts = line.split()
+                    if parts:
+                        name = DeviceInfo._block_name_from_devpath(parts[0])
+                        if name:
+                            names.add(name)
+        except (FileNotFoundError, PermissionError, Exception):
+            pass
+        return names
+
+    def _mark_block_usage(self, entries, swap_names):
+        """Flag devices consumed by a holder (LUKS, LVM, RAID, ...).
+
+        A device is *in use* when it is mounted, used as swap, or backs any
+        holder (an active dm/md mapping). Mountpoints of a mounted holder are
+        propagated down its slave chain so a LUKS container shows the mount of
+        its unlocked mapping; a holder that is open but unmounted marks the
+        backing device in-use (rendered as '\\busy'). All reads are sysfs-only
+        and non-blocking.
+        """
+        holders, slaves = {}, {}
+        for name in entries:
+            holders[name] = self._read_sysfs_dir(f'/sys/class/block/{name}/holders')
+            slaves[name] = self._read_sysfs_dir(f'/sys/class/block/{name}/slaves')
+
+        # Seed the walk with devices that are mounted or used as swap
+        queue = [n for n, ns in entries.items() if ns.mounts]
+        for name in swap_names:
+            if name in entries:
+                entries[name].in_use = True
+                if name not in queue:
+                    queue.append(name)
+        visited = set(queue)
+
+        # Propagate mount visibility down to backing devices via slaves
+        while queue:
+            cur = queue.pop()
+            cur_mounts = entries[cur].mounts if cur in entries else []
+            for backing in slaves.get(cur, []):
+                if backing not in entries:
+                    continue
+                bns = entries[backing]
+                for mount in cur_mounts:
+                    if mount not in bns.mounts:
+                        bns.mounts.append(mount)
+                bns.in_use = True
+                if backing not in visited:
+                    visited.add(backing)
+                    queue.append(backing)
+
+        # Any device with a holder is in use (mapping active) even if unmounted.
+        # Also classify containers (by fstype or by an existing holder).
+        for name, holder_list in holders.items():
+            if name not in entries:
+                continue
+            ns = entries[name]
+            if holder_list:
+                ns.in_use = True
+            if holder_list or self.is_container_fstype(ns.fstype):
+                ns.is_container = True
+
+    @staticmethod
+    def device_in_use(name):
+        """Best-effort, non-blocking check that a device is in use right now.
+
+        Guards a wipe at the moment it starts, closing the window between a
+        discovery refresh and the actual write. True if the device has any
+        holder (active dm/md mapping) or is currently mounted.
+        """
+        if DeviceInfo._read_sysfs_dir(f'/sys/class/block/{name}/holders'):
+            return True
+        try:
+            with open('/proc/mounts', 'r', encoding='utf-8') as f:
+                for line in f:
+                    parts = line.split()
+                    if parts and DeviceInfo._block_name_from_devpath(parts[0]) == name:
+                        return True
+        except (FileNotFoundError, PermissionError, Exception):
+            pass
+        return False
+
     def _is_partition(self, name):
         """Check if device is a partition (non-blocking).
 
@@ -508,6 +642,8 @@ class DeviceInfo:
                 entry.model = getattr(prev, 'model', '')
                 entry.port = getattr(prev, 'port', '')
                 entry.is_rotational = getattr(prev, 'is_rotational', False)
+                entry.in_use = getattr(prev, 'in_use', False)
+                entry.is_container = getattr(prev, 'is_container', False)
             else:
                 # Non-dark device: probe for metadata
                 if entry.type == 'disk':
@@ -582,13 +718,17 @@ class DeviceInfo:
 
             entries[name] = entry
 
+        # Phase 3c: Mark devices consumed by a holder (LUKS/LVM/RAID/swap)
+        swap_names = self._parse_proc_swaps()
+        self._mark_block_usage(entries, swap_names)
+
         # Phase 4: Build parent-child relationships (minors lists)
         for name, parent_name in parent_map.items():
             if parent_name in entries:
                 entries[parent_name].minors.append(name)
                 self.disk_majors.add(entries[name].major)
-                # Propagate mount state to parent
-                if entries[name].mounts:
+                # Propagate mount/in-use state to parent (holder-backed too)
+                if entries[name].mounts or getattr(entries[name], 'in_use', False):
                     entries[parent_name].state = 'iMnt'
 
         # Phase 4b: Clear marker display and state for disks with actual partitions
@@ -621,6 +761,8 @@ class DeviceInfo:
                     v_child.mounts = entry.mounts
                     v_child.parent = name
                     v_child.uuid = entry.uuid
+                    v_child.in_use = getattr(entry, 'in_use', False)
+                    v_child.is_container = getattr(entry, 'is_container', False)
 
                     final_entries[v_key] = v_child
                     entry.minors.append(v_key)
@@ -742,7 +884,7 @@ class DeviceInfo:
 
             # Exclude common virtual and optical device prefixes as a safety net
             # (most should already be filtered by ro check or missing sysfs)
-            excluded_prefixes = ('zram', 'loop', 'dm-', 'ram', 'sr', 'scd')
+            excluded_prefixes = ('zram', 'loop', 'dm-', 'md', 'ram', 'sr', 'scd')
             if any(name.startswith(prefix) for prefix in excluded_prefixes):
                 continue
 
@@ -757,10 +899,8 @@ class DeviceInfo:
         for ns in nss.values():
             wids.state = max(wids.state, len(ns.state))
             wids.name = max(wids.name, len(ns.name) + 2)
-            if ns.label is None:
-                pass
-            wids.label = max(wids.label, len(ns.label))
-            wids.fstype = max(wids.fstype, len(ns.fstype))
+            wids.label = max(wids.label, len(ns.label or ''))
+            wids.fstype = max(wids.fstype, len(ns.fstype or ''))
         self.head_str = self.get_head_str()
 
     def get_head_str(self):
@@ -829,15 +969,17 @@ class DeviceInfo:
             hw_state = getattr(ns, 'hw_caps_state', ProbeState.PENDING)
             is_usb = getattr(ns, 'is_usb', False)
 
+            # Non-wipeable devices always show '---' regardless of capabilities
             fw_label = ''
-            if hw_caps:
+            if ns.state in ('Mnt', 'iMnt', 'Blk', 'iBlk', 'Busy'):
+                fw_label = '---'
+            elif hw_caps:
                 fw_label = hw_summary
             elif hw_nopes and not is_usb:
                 first_issue = hw_nopes.split(',')[0].strip()
                 fw_label = f'✗{first_issue}'
-            elif hw_state in (ProbeState.PENDING, ProbeState.PROBING):
-                if ns.state not in ('Mnt', 'iMnt', 'Blk', 'iBlk', 'Busy') and not is_usb:
-                    fw_label = '...'
+            elif hw_state in (ProbeState.PENDING, ProbeState.PROBING) and not is_usb:
+                fw_label = '...'
 
             if not fw_label:
                 fw_label = '---'
@@ -878,6 +1020,12 @@ class DeviceInfo:
             elif ns.mounts:
                 # Disk has mounts - show them
                 emit += f'{sep}{",".join(ns.mounts)}'
+            elif getattr(ns, 'in_use', False):
+                # In use but not mounted (open LUKS/LVM/RAID mapping)
+                emit += f'{sep}\\busy'
+            elif getattr(ns, 'auto_blocked', False):
+                # Auto-blocked container (LUKS/LVM/RAID/swap)
+                emit += f'{sep}auto-blocked'
             elif ns.marker and ns.marker.strip() and not ns.minors:
                 # Disk has wipe status - show it ONLY if no child partitions
                 # (partitions take precedence over marker)
@@ -890,6 +1038,12 @@ class DeviceInfo:
             emit += sep + print_str_or_dash(ns.label, wids.label)
             if ns.mounts:
                 emit += f'{sep}{",".join(ns.mounts)}'
+            elif getattr(ns, 'in_use', False):
+                # In use but not mounted (open LUKS/LVM/RAID mapping)
+                emit += f'{sep}\\busy'
+            elif getattr(ns, 'auto_blocked', False):
+                # Auto-blocked container (LUKS/LVM/RAID/swap)
+                emit += f'{sep}auto-blocked'
             else:
                 emit += f'{sep}{ns.marker}'
 
@@ -1045,19 +1199,30 @@ class DeviceInfo:
 
         # Apply persistent blocked states
         if self.persistent_state:
+            auto_block = getattr(self.opts, 'auto_block_containers', True)
             for ns in nss.values():
                 # Update last_seen timestamp
                 self.persistent_state.update_device_seen(ns)
+                # Auto-block containers (LUKS/LVM/RAID/swap) the first time seen.
+                # Once the user unblocks, a record exists so this won't re-block.
+                if auto_block and getattr(ns, 'is_container', False) \
+                        and not self.persistent_state.has_device_record(ns):
+                    self.persistent_state.set_device_locked(ns, True, auto=True)
                 # Apply persistent block state
                 if self.persistent_state.get_device_locked(ns):
                     ns.state = 'Blk'
+                    if self.persistent_state.is_device_auto_blocked(ns):
+                        ns.auto_blocked = True
 
         # Clear inferred states so they can be re-computed based on current job status
         self.clear_inferred_states(nss)
 
         # Re-apply Mnt state for devices with mounts (cleared above, needed for set_all_states)
+        # Devices that are in use (mounted/swap/backing a holder) are treated as
+        # mounted so they cannot be wiped. But Blk trumps Mnt - blocked devices
+        # stay blocked even if mounted.
         for ns in nss.values():
-            if ns.mounts:
+            if (ns.mounts or getattr(ns, 'in_use', False)) and ns.state != 'Blk':
                 ns.state = 'Mnt'
 
         self.set_all_states(nss)  # set inferred states (propagates Mnt/Busy to parents)