gitpane 1.0.0__py3-none-any.whl

gitpane/process/released_child_watch.py

@@ -0,0 +1,138 @@
+"""Watch over one released helper, stopping it, never what it started, as soon as the process that started it ends.
+
+A browser sign-in starts Git Credential Manager in a session of its own, so that stopping the sign-in never closes the
+browser it opens. macOS gives a process no signal when its parent dies, and stopping the worker's group does not reach
+a helper that leads a session of its own: without help, a helper whose worker was stopped would keep its local sign-in
+port open until it ends by itself. This watcher is the helper's parent, and the kernel tells it when its own parent,
+the worker, ends; it then stops the helper alone. The browser the helper opened is never signalled.
+
+This file is run on its own: the base interpreter runs it in isolated mode, with neither the application's packages
+nor any site directory, so only the standard library can be imported. The application imports it only to find this
+file. The helper inherits the watcher's standard streams and environment, and the watcher ends with the helper's own
+exit code, so the worker reads the helper's answer as if it had started the helper itself.
+"""
+
+from __future__ import annotations
+
+import os
+import select
+import signal
+import subprocess
+import sys
+
+# Workaround: copies of process_group's exit codes. This file runs in isolated mode, where it cannot import the
+# application package, so it keeps its own; a test checks that both stay equal.
+PROCESS_STOP_EXIT_CODE = 125
+PROCESS_START_FAILED_EXIT_CODE = 127
+WATCH_OWNER_ARGUMENT_INDEX = 1
+WATCH_COMMAND_ARGUMENT_OFFSET = 2
+# Workaround: copy of the shell's signal exit base in config.py, kept here for the same isolated-mode reason; a test
+# checks that both stay equal. The watcher reports its helper ended by signal n with this base plus n.
+SIGNAL_EXIT_CODE_BASE = 128
+# At most the owner's end and the helper's end are pending at once.
+WATCH_EVENT_BATCH = 2
+
+
+class HelperState:
+    """Hold the helper once started, and whether a stop was asked before or while it starts.
+
+    The stop request comes as a signal, which may arrive before the helper exists: it is then remembered, so that
+    nothing is started, or the helper just started is stopped at once.
+    """
+
+    def __init__(self) -> None:
+        """Start with no helper and no stop asked."""
+        self.helper: subprocess.Popen | None = None
+        self.stop_requested = False
+
+    def request_stop(self, signal_number: int, frame: object) -> None:
+        """Answer the stop signal: stop the helper alone if it runs, and remember the request."""
+        self.stop_requested = True
+        self.stop_helper()
+
+    def stop_helper(self) -> None:
+        """Stop the helper, never its group: the browser it opened is a member of that group.
+
+        The helper is this watcher's child and is reaped only after this, so its process ID cannot name another process.
+        """
+        if self.helper is not None and self.helper.returncode is None:
+            self.helper.kill()
+
+
+def read_owner_id(arguments: list[str]) -> int:
+    """Read the process ID of the worker that started this watcher, refusing anything but a positive number and a command after it."""
+    if len(arguments) <= WATCH_COMMAND_ARGUMENT_OFFSET:
+        raise ValueError("The released helper watcher needs an owner process ID and a command")
+    owner_id = int(arguments[WATCH_OWNER_ARGUMENT_INDEX])
+    if owner_id <= 0:
+        raise ValueError("The released helper watcher owner process ID must be positive")
+    return owner_id
+
+
+def exit_watch(process_id: int) -> select.kevent:
+    """Describe a one-shot subscription to the end of ``process_id``."""
+    return select.kevent(process_id, select.KQ_FILTER_PROC, select.KQ_EV_ADD | select.KQ_EV_ONESHOT, select.KQ_NOTE_EXIT)
+
+
+def helper_exit_code(return_code: int) -> int:
+    """Turn the helper's status into this watcher's exit code: its own code, or the shell's form for a signal."""
+    if return_code >= 0:
+        return return_code
+    return SIGNAL_EXIT_CODE_BASE - return_code
+
+
+def watch(owner_id: int, command: list[str]) -> int:
+    """Start the helper only while its owner lives, stop it when the owner ends or on SIGTERM, and return its exit code.
+
+    The owner's end is subscribed to before anything starts, so the helper never runs unguarded. A watcher whose owner
+    is already gone, or is no longer its parent, starts nothing.
+    """
+    queue = select.kqueue()
+    try:
+        try:
+            queue.control([exit_watch(owner_id)], 0)
+        except ProcessLookupError:
+            return PROCESS_STOP_EXIT_CODE
+        if os.getppid() != owner_id:
+            return PROCESS_STOP_EXIT_CODE
+        state = HelperState()
+        signal.signal(signal.SIGTERM, state.request_stop)
+        if state.stop_requested:
+            return PROCESS_STOP_EXIT_CODE
+        try:
+            state.helper = subprocess.Popen(command)
+        except OSError as error:
+            print("Cannot start the credential helper: " + str(error), file=sys.stderr, flush=True)
+            return PROCESS_START_FAILED_EXIT_CODE
+        if state.stop_requested:
+            state.stop_helper()
+        try:
+            queue.control([exit_watch(state.helper.pid)], 0)
+        except ProcessLookupError:
+            # A stop asked while the helper started may already have reaped it, so the kernel no longer knows its ID;
+            # the helper has ended and waiting only reads the code recorded then.
+            return helper_exit_code(state.helper.wait())
+        helper_ended = False
+        while not helper_ended:
+            for event in queue.control(None, WATCH_EVENT_BATCH):
+                if event.ident == state.helper.pid:
+                    helper_ended = True
+                elif event.ident == owner_id:
+                    state.stop_helper()
+        return helper_exit_code(state.helper.wait())
+    finally:
+        queue.close()
+
+
+def main() -> int:
+    """Read the owner and the command, then watch the helper; a refused argument starts nothing."""
+    try:
+        owner_id = read_owner_id(sys.argv)
+    except ValueError as error:
+        print(str(error), file=sys.stderr, flush=True)
+        return PROCESS_START_FAILED_EXIT_CODE
+    return watch(owner_id, sys.argv[WATCH_COMMAND_ARGUMENT_OFFSET:])
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

gitpane/recent/mount_table.py

@@ -0,0 +1,422 @@
+"""Group the recent folders by what their answer waits on, from the mount table of Linux or macOS.
+
+Asking whether a folder exists waits on the file system that holds it: a sleeping disk, a frozen FUSE mount or a dead
+network share. Folders of one mount, or of one disk or server, are asked in order on one thread, so a slow one only
+delays its own folders. Reading the table itself touches no mounted disk: it is a list the system keeps in memory.
+
+This module only reads and compares text; it knows nothing about threads or windows.
+"""
+
+from __future__ import annotations
+
+import errno
+import os
+import posixpath
+import re
+import subprocess
+import sys
+import unicodedata
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+
+from gitpane.config import DECOMPOSED_UNICODE_FORM, LINUX_PLATFORM, MACOS_PLATFORM, MOUNT_TABLE_TIMEOUT_SECONDS
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+# Linux keeps the table of this process's mounts here, one mount per line: source, mount point, type, options.
+PROC_MOUNTS_FILENAME = "/proc/self/mounts"
+# The kernel writes a space, tab, newline, backslash and, in the source, a hash as a backslash and three octal digits,
+# so that the fields stay separated by spaces.
+MOUNT_FIELD_ESCAPE_PATTERN = re.compile(rb"\\([0-7]{3})")
+# The escaped digits are octal.
+OCTAL_BASE = 8
+# Positions of the fields a line of /proc/mounts starts with.
+SOURCE_FIELD, MOUNT_DIR_FIELD, FS_TYPE_FIELD = 0, 1, 2
+# A line shorter than this is not a mount: it is skipped rather than failing the whole table.
+MOUNT_LINE_MIN_FIELD_COUNT = 3
+# Start of a source that is a disk or a partition: one disk mounted at several places is one group.
+DEVICE_SOURCE_PREFIX = "/dev/"
+# Starts of the group keys: the prefix keeps a server name from ever meeting a device or a mount point with the same text.
+SERVER_GROUP_PREFIX = "server:"
+DEVICE_GROUP_PREFIX = "device:"
+MOUNT_GROUP_PREFIX = "mount:"
+# NFS writes its source as host:/export, or [address]:/export for an IPv6 address.
+NFS_FS_TYPE_SET = frozenset({"nfs", "nfs4"})
+# SMB writes its source as //[user@]host/share: macOS writes the user, Linux does not.
+SMB_FS_TYPE_SET = frozenset({"cifs", "smb3", "smbfs"})
+# sshfs writes its source as [user@]host:[path].
+SSHFS_FS_TYPE_SET = frozenset({"fuse.sshfs"})
+# Every network file system; those whose source names no server GitPane can read are grouped by mount point.
+NETWORK_FS_TYPE_SET = NFS_FS_TYPE_SET | SMB_FS_TYPE_SET | frozenset({"afpfs", "webdav", "9p"})
+# FUSE mounts answer through a program that may hang; on Linux their type is also written fuse.<program>.
+FUSE_FS_TYPE_SET = frozenset({"fuse", "fuseblk", "macfuse", "osxfuse"})
+# fusectl starts with "fuse" but is only the control folder of FUSE, not a FUSE mount: the dot keeps it out.
+FUSE_FS_TYPE_PREFIX = "fuse."
+# Reading inside an automount point triggers the mount, so it may wait on the network.
+AUTOMOUNT_FS_TYPE_SET = frozenset({"autofs"})
+# Separators of a network source: //host/share, user@host, host:path and [IPv6 address].
+NETWORK_SHARE_SOURCE_PREFIX = "//"
+NETWORK_SHARE_PATH_SEPARATOR = "/"
+USER_SEPARATOR = "@"
+HOST_PATH_SEPARATOR = ":"
+BRACKETED_HOST_START = "["
+BRACKETED_HOST_END = "]"
+# POSIX lets a path keep exactly two leading slashes, so normpath keeps them; Linux and macOS read them as one.
+DOUBLE_SLASH_ROOT = posixpath.sep * 2
+
+
+@dataclass(frozen=True)
+class MountEntry:
+    """One mounted file system: what is mounted, where, and its type."""
+
+    source: str
+    mount_dir: str
+    fs_type: str
+
+
+def decode_mount_field(field: bytes) -> str:
+    """Undo the kernel's octal escapes, then decode as Python decodes every path, so the result compares with recent paths.
+
+    Names that are not UTF-8 keep the same form as in Python's own paths.
+    """
+    return os.fsdecode(MOUNT_FIELD_ESCAPE_PATTERN.sub(lambda match: bytes([int(match.group(1), OCTAL_BASE)]), field))
+
+
+def parse_proc_mounts(data: bytes) -> list[MountEntry]:
+    """Read the lines of /proc/mounts; a malformed line is skipped rather than failing the whole table."""
+    entries: list[MountEntry] = []
+    for line in data.splitlines():
+        fields = line.split()
+        if len(fields) < MOUNT_LINE_MIN_FIELD_COUNT:
+            continue
+        entries.append(MountEntry(decode_mount_field(fields[SOURCE_FIELD]), decode_mount_field(fields[MOUNT_DIR_FIELD]), decode_mount_field(fields[FS_TYPE_FIELD])))
+    return entries
+
+
+def read_file_bytes(filename: str) -> bytes:
+    """Read a whole file as bytes."""
+    with open(filename, "rb") as file:
+        return file.read()
+
+
+def read_proc_mounts(read_file: Callable[[str], bytes] = read_file_bytes) -> list[MountEntry]:
+    """Read this process's mount table on Linux; an unreadable table is empty, never an error, so the checks keep one group."""
+    try:
+        data = read_file(PROC_MOUNTS_FILENAME)
+    except OSError:
+        return []
+    return parse_proc_mounts(data)
+
+
+def is_unwalked_mount(entry: MountEntry) -> bool:
+    """Tell whether even reading a link on this mount may wait on the network or on a program: network, FUSE and automount.
+
+    Following the links of a recent's path reads nothing on such a mount; only the question itself is asked there.
+    """
+    if entry.fs_type in NETWORK_FS_TYPE_SET or entry.fs_type in FUSE_FS_TYPE_SET or entry.fs_type in AUTOMOUNT_FS_TYPE_SET:
+        return True
+    return entry.fs_type.startswith(FUSE_FS_TYPE_PREFIX)
+
+
+def smb_server_name(source: str) -> str:
+    """Return the host of a //[user@]host/share source, or an empty text when the source does not have that form."""
+    if not source.startswith(NETWORK_SHARE_SOURCE_PREFIX):
+        return ""
+    user_and_host, _separator, _share = source.removeprefix(NETWORK_SHARE_SOURCE_PREFIX).partition(NETWORK_SHARE_PATH_SEPARATOR)
+    _user, _separator, host = user_and_host.rpartition(USER_SEPARATOR)
+    return host
+
+
+def host_path_server_name(source: str) -> str:
+    """Return the host of a [user@]host:path source, the host being bracketed for an IPv6 address; empty when there is none.
+
+    The user is only looked for before the host's colon, since the path after it may hold an at sign of its own.
+    """
+    host_end = source.find(HOST_PATH_SEPARATOR)
+    user_end = source.rfind(USER_SEPARATOR, 0, host_end if host_end != -1 else len(source))
+    host_and_path = source[user_end + len(USER_SEPARATOR):] if user_end != -1 else source
+    if host_and_path.startswith(BRACKETED_HOST_START):
+        host, separator, _path = host_and_path.removeprefix(BRACKETED_HOST_START).partition(BRACKETED_HOST_END)
+        return host if separator else ""
+    host, separator, _path = host_and_path.partition(HOST_PATH_SEPARATOR)
+    return host if separator else ""
+
+
+def server_name(entry: MountEntry) -> str | None:
+    """Return the network server a mount waits on, without user and compared without case; None when its source names none.
+
+    Only the host is kept, never the user or the path, so neither ends up in a group key or in a log line.
+    """
+    if entry.fs_type in SMB_FS_TYPE_SET:
+        host = smb_server_name(entry.source)
+    elif entry.fs_type in NFS_FS_TYPE_SET or entry.fs_type in SSHFS_FS_TYPE_SET:
+        host = host_path_server_name(entry.source)
+    else:
+        return None
+    return host.casefold() or None
+
+
+def case_sensitive_path_key(path: str) -> str:
+    """Compare paths as written, as Linux does: ``/mnt/NAS`` and ``/mnt/nas`` are two folders."""
+    return path
+
+
+def case_insensitive_path_key(path: str) -> str:
+    """Compare paths without case and without Unicode form, as the disks of macOS do by default.
+
+    ``/volumes/nas/dépôt`` is ``/Volumes/NAS/DÉPÔT`` whether its accents are composed or decomposed. The text is
+    decomposed again after the case fold, since folding a letter can give back a composed one.
+    """
+    return unicodedata.normalize(DECOMPOSED_UNICODE_FORM, unicodedata.normalize(DECOMPOSED_UNICODE_FORM, path).casefold())
+
+
+def platform_path_compare_key(platform: str) -> Callable[[str], str]:
+    """Return how this platform compares a recent's path with the mount points: without case on macOS, as written elsewhere."""
+    if platform == MACOS_PLATFORM:
+        return case_insensitive_path_key
+    return case_sensitive_path_key
+
+
+# Chosen once at import: the platform never changes while GitPane runs.
+PLATFORM_PATH_COMPARE_KEY = platform_path_compare_key(sys.platform)
+
+
+def without_double_slash_root(path: str) -> str:
+    """Write a path that starts with exactly two slashes with one, as the system reads it, so it compares with the mount points."""
+    if path.startswith(DOUBLE_SLASH_ROOT) and not path.startswith(DOUBLE_SLASH_ROOT + posixpath.sep):
+        return path[len(posixpath.sep):]
+    return path
+
+
+def comparable_path(path: str, path_compare_key: Callable[[str], str]) -> str:
+    """Return the form of a path or a mount point that is compared: one leading slash, and without case where the platform ignores it."""
+    return path_compare_key(without_double_slash_root(path))
+
+
+def path_parts(path: str) -> list[str]:
+    """Return the names of a path's folders, in order, without the empty ones that slashes leave."""
+    parts: list[str] = []
+    for part in path.split(posixpath.sep):
+        if part:
+            parts.append(part)
+    return parts
+
+
+# Mount points on Linux and macOS are POSIX paths: they are compared with posixpath so these functions and their tests
+# behave the same on Windows, where this module never runs for real.
+def mount_contains(mount_dir: str, path: str, path_compare_key: Callable[[str], str] = case_sensitive_path_key) -> bool:
+    """Tell whether the path is the mount point itself or below it: ``/mnt/nas2`` is not inside ``/mnt/nas``.
+
+    Both are brought to the same form first, so a path written ``//mnt/nas``, or on macOS ``/volumes/nas``, is on the mount.
+    """
+    compared_mount_dir = comparable_path(mount_dir, path_compare_key)
+    compared_path = comparable_path(path, path_compare_key)
+    if compared_path == compared_mount_dir:
+        return True
+    return compared_path.startswith(compared_mount_dir.rstrip(posixpath.sep) + posixpath.sep)
+
+
+def entry_preference_key(entry: MountEntry) -> tuple[bool, str, str]:
+    """Order two entries mounted at the same point by their content alone, never by their place in the table.
+
+    A mount that is not walked comes first, since that is the one a question may wait on; then the type and the source.
+    """
+    return (not is_unwalked_mount(entry), entry.fs_type, entry.source)
+
+
+def deepest_mount_entry(path: str, entries: list[MountEntry], path_compare_key: Callable[[str], str] = case_sensitive_path_key) -> MountEntry | None:
+    """Return the mount that holds the path, the one with the longest mount point; None when no mount holds it.
+
+    The path is absolute and normalized. Of two entries at the same point, such as an automount point and the network
+    share it mounted, the one not walked is preferred, then the smaller type and source: the order of the system's table
+    is not guaranteed, so it never decides. Either choice keeps the folder in a group of its own mount.
+    """
+    best_entry: MountEntry | None = None
+    for entry in entries:
+        if not mount_contains(entry.mount_dir, path, path_compare_key):
+            continue
+        if best_entry is None or len(entry.mount_dir) > len(best_entry.mount_dir):
+            best_entry = entry
+            continue
+        if len(entry.mount_dir) == len(best_entry.mount_dir) and entry_preference_key(entry) < entry_preference_key(best_entry):
+            best_entry = entry
+    return best_entry
+
+
+def mount_group_key(path: str, entries: list[MountEntry], path_compare_key: Callable[[str], str] = case_sensitive_path_key) -> str | None:
+    """Return what the folder's answer waits on: its network server, its disk, or its mount point; None when no mount holds it.
+
+    Every mount of one server is one group whatever its protocol, since a server that is off blocks them all alike.
+    """
+    entry = deepest_mount_entry(path, entries, path_compare_key)
+    if entry is None:
+        return None
+    return entry_group_key(entry)
+
+
+def entry_group_key(entry: MountEntry) -> str:
+    """Return the group of the folders of one mount: its network server, its disk, or its mount point."""
+    server = server_name(entry)
+    if server is not None:
+        return SERVER_GROUP_PREFIX + server
+    if entry.source.startswith(DEVICE_SOURCE_PREFIX):
+        return DEVICE_GROUP_PREFIX + entry.source
+    return MOUNT_GROUP_PREFIX + entry.mount_dir
+
+
+# Linux itself follows at most this many links while resolving one path; past it, the question is asked as the path is.
+MAX_FOLLOWED_LINK_COUNT = 40
+
+
+@dataclass(frozen=True)
+class FolderWalk:
+    """Where following the links of a recent's path led.
+
+    ``walked_dir`` is the path with the links read so far replaced by their targets; ``group`` is the group whose thread
+    goes on with the folder: its own group to ask the question, another one to hand it over.
+    """
+
+    walked_dir: str
+    group: str
+    followed_link_count: int
+
+
+def path_parts_below(path: str, mount_dir: str) -> list[str]:
+    """Return the names of the path's folders below a mount point that holds it, in order; empty for the mount point itself.
+
+    Counted in folders, not in characters: the path may write the mount point in another case, and folding the case
+    can change a name's length (``straße`` and ``STRASSE``).
+    """
+    return path_parts(path)[len(path_parts(mount_dir)):]
+
+
+def follow_folder_links(walked_dir: str, home_group: str, followed_link_count: int, entries: list[MountEntry], read_link: Callable[[str], str],
+                        path_compare_key: Callable[[str], str] = case_sensitive_path_key) -> FolderWalk:
+    """Follow the links of a recent's path, one folder at a time, as long as it stays on the mounts of its own group.
+
+    It runs on the thread of the group the path is on: reading a link only waits on the disk that holds it, so a slow disk
+    only delays its own folders. The path is compared with the mount table before every read; as soon as it enters a
+    mount of another group, the walk stops and names that group, which goes on with the folder: a link on the system
+    disk that points to a dead share never holds the system disk's thread. Nothing is ever read on a network, FUSE or
+    automount mount: its thread only asks the question. The walk starts at the deepest mount point of the path, since
+    the system lists mount points as real paths.
+
+    The question and its answer stay about the recent as saved, which the caller keeps: the walk only decides which
+    thread asks it. So the walk stops and the question is asked in the current group whenever the path cannot be read
+    further: a folder that does not exist, a refused access, a name the system rejects, or more links than the system
+    itself would follow, the count going on across groups. The question then tells what is there. A relative target is
+    joined to the link's folder and normalized: the folders above it are real paths already, so ``..`` is exact.
+
+    The path is compared with the mount points as the platform compares names, the same way the folders were sorted
+    into their groups: a path written in another case on macOS, or with two leading slashes, is still on its mount.
+    """
+    # Folders already found not to be links: a path that comes back after a link is not read twice.
+    plain_dir_set: set[str] = set()
+    while True:
+        entry = deepest_mount_entry(walked_dir, entries, path_compare_key)
+        if entry is None:
+            return FolderWalk(walked_dir, home_group, followed_link_count)
+        group = entry_group_key(entry)
+        if group != home_group:
+            return FolderWalk(walked_dir, group, followed_link_count)
+        if is_unwalked_mount(entry):
+            return FolderWalk(walked_dir, home_group, followed_link_count)
+        # Every folder read below is a start of the walked path, so the deepest mount of the whole path holds them all:
+        # checking it once, above, is checking each of them before its read.
+        next_dir: str | None = None
+        candidate_dir = entry.mount_dir
+        parts = path_parts_below(walked_dir, entry.mount_dir)
+        for part_index, part in enumerate(parts):
+            candidate_dir = posixpath.join(candidate_dir, part)
+            if candidate_dir in plain_dir_set:
+                continue
+            if followed_link_count >= MAX_FOLLOWED_LINK_COUNT:
+                return FolderWalk(walked_dir, home_group, followed_link_count)
+            try:
+                target = read_link(candidate_dir)
+            except OSError as error:
+                if error.errno != errno.EINVAL:
+                    return FolderWalk(walked_dir, home_group, followed_link_count)
+                plain_dir_set.add(candidate_dir)
+                continue
+            except ValueError:
+                return FolderWalk(walked_dir, home_group, followed_link_count)
+            next_dir = without_double_slash_root(posixpath.normpath(posixpath.join(posixpath.dirname(candidate_dir), target, *parts[part_index + 1:])))
+            followed_link_count += 1
+            break
+        if next_dir is None:
+            return FolderWalk(walked_dir, home_group, followed_link_count)
+        walked_dir = next_dir
+
+
+# The mount command of macOS, by absolute path: it is never looked for in the PATH, where another program could take its name.
+MOUNT_COMMAND_FILENAME = "/sbin/mount"
+# macOS writes each mount as "<source> on <mount point> (<type>, <option>, ...)", without escaping spaces. The mount
+# point is absolute, so the source ends at the first " on /", which keeps a source such as "Music on NAS" whole; the
+# mount point ends at the last " (".
+MACOS_MOUNT_ON_SEPARATOR = " on /"
+MACOS_MOUNT_OPTION_START = " ("
+MACOS_MOUNT_OPTION_END = ")"
+MACOS_MOUNT_OPTION_SEPARATOR = ","
+
+
+def parse_macos_mount_output(text: str) -> list[MountEntry]:
+    """Read the output of the mount command of macOS; a line that does not have the mount form is skipped.
+
+    A line without an absolute mount point is skipped too, rather than read as a mount that would hold no recent.
+    """
+    entries: list[MountEntry] = []
+    for line in text.splitlines():
+        source, on_separator, point_and_options = line.partition(MACOS_MOUNT_ON_SEPARATOR)
+        if not on_separator:
+            continue
+        # The separator took the mount point's leading slash.
+        point_and_options = posixpath.sep + point_and_options
+        mount_dir, option_separator, options = point_and_options.rpartition(MACOS_MOUNT_OPTION_START)
+        if not option_separator or not options.endswith(MACOS_MOUNT_OPTION_END):
+            continue
+        fs_type, _separator, _other_options = options.removesuffix(MACOS_MOUNT_OPTION_END).partition(MACOS_MOUNT_OPTION_SEPARATOR)
+        fs_type = fs_type.strip()
+        if not source or not mount_dir or not fs_type:
+            continue
+        entries.append(MountEntry(source, mount_dir, fs_type))
+    return entries
+
+
+def read_macos_mount_table(open_process: Callable[..., subprocess.Popen[bytes]] = subprocess.Popen) -> list[MountEntry]:
+    """Read the mount table of macOS from the mount command; any failure gives an empty table, so the checks keep one group.
+
+    Only called on the sorting thread of the recent folder checks: the command asks every mount point and may wait.
+    """
+    try:
+        process = open_process([MOUNT_COMMAND_FILENAME], stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)
+    except (OSError, ValueError):
+        return []
+    try:
+        stdout, _stderr = process.communicate(timeout=MOUNT_TABLE_TIMEOUT_SECONDS)
+    except subprocess.TimeoutExpired:
+        # Workaround: subprocess.run waits for the child after killing it, and a child stuck in the kernel on a dead share
+        # may never end, which would hold the sorting thread for good. The child is killed and left for subprocess to
+        # reap later, without waiting for it here.
+        process.kill()
+        return []
+    if process.returncode != 0:
+        return []
+    return parse_macos_mount_output(os.fsdecode(stdout))
+
+
+def platform_mount_table_reader(platform: str) -> Callable[[], list[MountEntry]] | None:
+    """Return the function that reads the mount table on this platform, or None where the folders are grouped otherwise.
+
+    Windows groups by drive letter and network server, and keeps doing so; an unknown system keeps a single group.
+    """
+    if platform == LINUX_PLATFORM:
+        return read_proc_mounts
+    if platform == MACOS_PLATFORM:
+        return read_macos_mount_table
+    return None
+
+
+# Chosen once at import: the platform never changes while GitPane runs.
+PLATFORM_MOUNT_TABLE_READER = platform_mount_table_reader(sys.platform)