[quickbeard]

Summary

macOS users keep getting "CoDev would like to access files on a network volume". Two things combine:

• The prompt repeats because the builds are unsigned. Fleet macOS builds carry only an ad-hoc signature (see mac-update.ts), so macOS ties the user's answer to that exact build's hash (cdhash H"…" in the TCC database). Every update drops the answer. Signing with a Developer ID is the real fix for that and is out of scope here.
• The launch-time stats push touched every past project directory. It reads everything it sends from the local session store, but readAllSessionStats named each session's project with projectFolderName, which calls realpathSync(dir). A single past project on an SMB/NFS share, under /net, or in an automounted home therefore triggered the prompt on every launch, from the desktop sidecar and the CLI's codev debug stats alike, even with that project closed.

The change (all in packages/codev-upload, which is fork-only, so no DIVERGENCES.md row):

• network-volumes.ts: networkVolumeFilter() reads the kernel mount table once per push (/sbin/mount lists mounts without opening them, about 4 ms here). It treats smbfs, afpfs, nfs, webdav, ftp and autofs mount points as network paths. Mount points under /System/Volumes/Data also match their short aliases, so auto_home covers /home/…. It's macOS-only; on other platforms, or if the table can't be read, nothing counts as a network path and behavior is unchanged.
• projectFolderName(dir, { resolve: false }) names a directory from its stored path, without touching the filesystem.
• readAllSessionStats (local store) and readSessionStatsFromServer (desktop sandboxes) use that for projects on network mounts. collectStats builds the filter once for all sources.
• Those sessions still count. Their project name only differs from before if the stored path goes through a symlink.
• The manual codev upload --logs export is unchanged: it's user-initiated and its dedup keys on resolved paths.

The push isn't the only thing that can touch a share. A project open in the sidebar, a sandbox, or a dotfile/PATH entry on a share can also prompt. Those reflect what the user is actively working with, and the prompt they cause only becomes a one-time question once builds are signed.

Related bug found while testing (not fixed here)

openSessionDb opens opencode.db read-only. SQLite can't open a WAL-mode database read-only when its -wal/-shm side files don't exist, which is the case after every CoDev process has closed it cleanly. The read then fails with SQLITE_CANTOPEN: reproduced on a copy of a real store (fails without the side files, opens once they exist). The launch-time push normally races a running server that has the database open, but a standalone codev upload (or --logs) with nothing else running would find no sessions. Worth a separate fix.

Test plan

• bun test in packages/codev-upload (63 tests; new: mount-table parsing, the macOS filter including the /home alias, local volumes, prefix look-alikes, non-macOS and unreadable-table fallbacks, projectFolderName with and without resolving, and readAllSessionStats leaving a network project unresolved)
• bun typecheck in packages/codev-upload and packages/desktop (which bundles it)
• Read-only check against a copy of a real session store with the real mount table: 52 sessions, project keys identical to the resolving path for local projects

🤖 Generated with Claude Code