fix(kit): DMG mount-leak and release-loading robustness (#487)

* fix(scanner): unmount system DMG when cryptex mount fails

The system DMG was only unmounted on the success path. If mounting the
cryptex DMG threw, the system volume stayed mounted while the subsequent
work-directory cleanup deleted its backing file, leaving a zombie mount
that needs a manual `hdiutil detach`. Wrap the post-mount work so the
system DMG is unmounted on every exit path.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Patrick Linnane <patrick@linnane.io>

* fix(kit): error when no indexed releases can be loaded

fetchAllReleases mapped every per-release fetch failure to nil, so a
fully-failed load returned an empty array indistinguishable from a
legitimately empty catalog. Throw DataProviderError.allReleasesFailed
when the index is non-empty but nothing loaded, so the UI can surface the
failure instead of showing an empty list. Also use Release.displayName in
the per-release success log so Xcode releases aren't mislabeled as macOS.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Patrick Linnane <patrick@linnane.io>

* docs: bump Claude commit trailer to Opus 4.8

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Patrick Linnane <patrick@linnane.io>

---------

Signed-off-by: Patrick Linnane <patrick@linnane.io>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: p-linnane

CLAUDE.md

@@ -202,7 +202,7 @@ Common types: `feat`, `fix`, `refactor`, `docs`, `ci`, `chore`
 
 All commits must:
 - Use `git commit -s` for DCO sign-off
-- Include a `Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>` trailer when authored with Claude
+- Include a `Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>` trailer when authored with Claude
 
 ## Git workflow
 

Sources/macOSdbKit/DataProvider.swift

@@ -59,14 +59,14 @@ public actor DataProvider {
         let release = try decoder.decode(Release.self, from: data)
         cachedReleases[entry.buildNumber] = release
 
-        Self.logger.info("Loaded release: macOS \(release.osVersion) (\(release.buildNumber))")
+        Self.logger.info("Loaded release: \(release.displayName) (\(release.buildNumber))")
         return release
     }
 
     public func fetchAllReleases(for productType: ProductType = .macOS) async throws -> [Release] {
         let index = try await fetchReleaseIndex(for: productType)
 
-        return await withTaskGroup(of: Release?.self, returning: [Release].self) { group in
+        let releases = await withTaskGroup(of: Release?.self, returning: [Release].self) { group in
             for entry in index {
                 group.addTask {
                     do {
@@ -88,6 +88,12 @@ public actor DataProvider {
             }
             return releases.sorted()
         }
+
+        // Surface an all-failed load as an error — an empty array reads as an empty catalog.
+        guard index.isEmpty || !releases.isEmpty else {
+            throw DataProviderError.allReleasesFailed(count: index.count)
+        }
+        return releases
     }
 
     public func findRelease(osVersion: String, productType: ProductType = .macOS) async throws -> Release? {
@@ -118,11 +124,14 @@ public actor DataProvider {
 
 enum DataProviderError: LocalizedError {
     case httpError(statusCode: Int, url: URL)
+    case allReleasesFailed(count: Int)
 
     var errorDescription: String? {
         switch self {
         case .httpError(let statusCode, let url):
             "HTTP \(statusCode) fetching \(url)"
+        case .allReleasesFailed(let count):
+            "Loaded the release index but failed to fetch any of its \(count) releases"
         }
     }
 }

Sources/macOSdbKit/Scanner/IPSWScanner.swift

@@ -212,35 +212,34 @@ public actor IPSWScanner {
         sendProgress(.mountingDMG)
         Self.logger.info("Mounting system DMG: \(systemDMG.lastPathComponent)")
         let systemMount = try await dmgMounter.mount(dmgPath: systemDMG)
+
         var fsComponents = await extractFilesystemComponents(mountPoint: systemMount)
 
+        // Unmount the system DMG on every path; a throw here leaks the volume, then cleanup deletes its backing file.
         let dyldComponents: [Component]
-        if let cryptexDMG {
-            sendProgress(.mountingCryptex)
-            Self.logger.info("Mounting cryptex DMG: \(cryptexDMG.lastPathComponent)")
-            let cryptexMount = try await dmgMounter.mount(dmgPath: cryptexDMG)
-
-            // Scan filesystem components from cryptex too (macOS 13+ moved some binaries there)
-            let cryptexFsComponents = await extractFilesystemComponents(mountPoint: cryptexMount)
-            let systemNames = Set(fsComponents.map(\.name))
-            for component in cryptexFsComponents {
-                if systemNames.contains(component.name) {
-                    // Cryptex version overrides system version
-                    fsComponents.removeAll { $0.name == component.name }
-                }
-                fsComponents.append(component)
+        do {
+            if let cryptexDMG {
+                sendProgress(.mountingCryptex)
+                Self.logger.info("Mounting cryptex DMG: \(cryptexDMG.lastPathComponent)")
+                let cryptexMount = try await dmgMounter.mount(dmgPath: cryptexDMG)
+
+                // Scan filesystem components from cryptex too (macOS 13+ moved some binaries there)
+                let cryptexFsComponents = await extractFilesystemComponents(mountPoint: cryptexMount)
+                fsComponents = merging(fsComponents, overriddenBy: cryptexFsComponents)
+
+                dyldComponents = await extractDyldCacheComponents(mountPoint: cryptexMount)
+                sendProgress(.unmountingDMG)
+                await dmgMounter.unmount(cryptexMount)
+            } else {
+                dyldComponents = await extractDyldCacheComponents(mountPoint: systemMount)
+                sendProgress(.unmountingDMG)
             }
-
-            dyldComponents = await extractDyldCacheComponents(mountPoint: cryptexMount)
-            sendProgress(.unmountingDMG)
-            await dmgMounter.unmount(cryptexMount)
-            await dmgMounter.unmount(systemMount)
-        } else {
-            dyldComponents = await extractDyldCacheComponents(mountPoint: systemMount)
-            sendProgress(.unmountingDMG)
+        } catch {
             await dmgMounter.unmount(systemMount)
+            throw error
         }
 
+        await dmgMounter.unmount(systemMount)
         return (fsComponents + dyldComponents).sorted { $0.name.localizedCaseInsensitiveCompare($1.name) == .orderedAscending }
     }
 
@@ -455,6 +454,13 @@ private func resolveDylibPath(
     return allPaths.first { $0.hasPrefix(prefix) && $0.hasSuffix(".dylib") }
 }
 
+/// Merges cryptex components over system ones, with cryptex winning on name collisions.
+private func merging(_ system: [Component], overriddenBy cryptex: [Component]) -> [Component] {
+    guard !cryptex.isEmpty else { return system }
+    let cryptexNames = Set(cryptex.map(\.name))
+    return system.filter { !cryptexNames.contains($0.name) } + cryptex
+}
+
 // MARK: - Board codename device mapping
 
 /// Fallback device mapping for kernelcache filenames that use board codenames