feat(filesystem): add bind-mount deny lists to hide host files/paths

[neurolabs]

Closes #1326

Summary

Adds an optional deny list of gitignore-style patterns to bind mounts. Matching host paths are hidden from the guest (ENOENT) and writes are rejected (EACCES) via the Unix/Windows passthrough backends. Usable across the CLI and Rust/Go/Python/Node SDKs.

Description

• Shared DenyList matcher in crates/filesystem
• Enforcement at the lookup gate plus create/mkdir/mknod/symlink/link/unlink/rmdir/rename, with readdir entry filtering, on both the unix and Windows passthrough backends (rename re-checks the destination so hidden entry types don't leak)
• basename patterns, path patterns, and dir-only patterns (node_modules/)
• per-mount case-sensitivity: probed similar to git's core.ignorecase for rw mounts, derived from platform/filesystem type on ro mounts
• macOS resolves parent paths via /.vol + F_GETPATH against the canonical mount root and fails closed when a path cannot be resolved
• performance varies with cases and patterns (tested on linux:
  • lookup overhead is negligible, denies are faster than actual lookups.
  • readdir overhead is substantial:
    • basename only (e.g. "*.log") and dirname patterns (e.g. "node_modules/") cost about 1.2x compared to a baseline
    • path patterns (e.g. "/var/log/*.log") cost about <2 compared to a baseline
  • see crates/filesystem/lib/backends/passthroughfs/unix/tests/test_deny_perf.rs for a test suite
• Wire format: repeatable deny= mount option; runtime and SDKs all reject empty patterns and patterns containing ,/:/newline/NUL.
• CLI: deny= on --mount-dir only (rejected with a clear error on --mount-file/--mount-disk/--mount-named); msb inspect renders a [deny=...] suffix
• Cloud: deny lists rejected at the CloudCreateBody conversion boundary (cloud creates can't enforce them)
• Docs (volumes, CLI reference, security/filesystem) document the semantics and the name-based limitations: rename evasion on writable mounts, symlink targets not re-checked, hard links matched by path not inode

Notes

• Developed and tested on Linux, therefore the MacOS and Windows paths were neither compiled nor executed.

Confidence Score: 3/5

The PR is not yet safe to merge because exchange operations can still move a concurrently substituted directory onto a directory-only-denied source name.

The Linux and macOS exchange paths make their reverse-direction deny decision from a one-time destination type snapshot, then revalidate only the source before the atomic swap, leaving the previously reported host-side destination replacement bypass outstanding.

Files Needing Attention: crates/filesystem/lib/backends/passthroughfs/unix/remove_ops.rs

_{Reviews (12): Last reviewed commit: "Merge branch 'main' into bind-mount-deny..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Filesystem backends and operations

[greptile-apps]

Prompt To Fix All With AI

### Issue 1
crates/filesystem/lib/backends/passthroughfs/windows/ops.rs:231-233
**Missing identity blocks every rename**

When a bind mount on FAT32, exFAT, or another filesystem without stable file identities has any directory-only deny pattern, this branch returns `EBUSY` for every rename before checking whether the allowed source and destination require that protection. As a result, ordinary file renames between non-denied paths fail even though neither path matches the deny list.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (3): Last reviewed commit: "fix(filesystem): fix greptile "missing i..." | Re-trigger Greptile}

[greptile-apps]

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Client[CLI or SDK] --> Config[Bind mount configuration]
  Config --> Runtime[Local runtime]
  Runtime --> Backend{Passthrough backend}
  Backend --> Unix[Unix namespace operations]
  Backend --> Windows[Windows namespace operations]
  Unix --> Matcher[Deny-list matcher]
  Windows --> Matcher
  Matcher -->|allowed| Host[Host bind path]
  Matcher -->|hidden lookup| ENOENT[ENOENT]
  Matcher -->|denied mutation| EACCES[EACCES]

Loading

_{Reviews (7): Last reviewed commit: "fix(filesystem): greptile "Exchange bypa..." | Re-trigger Greptile}

[greptile-apps]

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[CLI or SDK mount configuration] --> B[Validated bind-mount deny patterns]
  B --> C[Local runtime]
  B --> D[Cloud conversion rejects deny list]
  C --> E[Unix or Windows passthrough backend]
  E --> F[Deny matcher]
  F --> G[Lookup and readdir hide matches]
  F --> H[Namespace mutations reject matches]

Loading

_{Reviews (9): Last reviewed commit: "Merge branch 'main' into bind-mount-deny..." | Re-trigger Greptile}

[greptile-apps]

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Client[CLI or SDK deny patterns] --> Config[Validated bind-mount configuration]
  Config --> Runtime[Runtime mount options]
  Runtime --> Matcher[DenyList matcher]
  Guest[Guest filesystem operation] --> Backend[Unix or Windows passthrough backend]
  Backend --> Matcher
  Matcher -->|Denied lookup| ENOENT[Return ENOENT]
  Matcher -->|Denied mutation| EACCES[Return EACCES]
  Matcher -->|Allowed| Host[Perform host filesystem operation]

Loading

_{Reviews (10): Last reviewed commit: "Merge branch 'main' into bind-mount-deny..." | Re-trigger Greptile}

[greptile-apps]

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Client[CLI or SDK] --> Config[Bind mount deny patterns]
  Config --> Runtime[Runtime mount configuration]
  Runtime --> Backend{Passthrough backend}
  Backend --> Unix[Unix namespace operations]
  Backend --> Windows[Windows namespace operations]
  Unix --> Matcher[DenyList matcher]
  Windows --> Matcher
  Matcher --> Allowed[Perform host operation]
  Matcher --> Denied[Return ENOENT or EACCES]

Loading

_{Reviews (11): Last reviewed commit: "Merge branch 'main' into bind-mount-deny..." | Re-trigger Greptile}