Mori

A Tauri 2 desktop app: a React and TypeScript interface running in the system webview, and a Rust backend that owns everything touching the disk. The split is deliberate — the interface is where untrusted names and previews get displayed, so it's also the part given the least power. File bytes only reach it through a custom mori:// protocol.

Mori assumes media from an unfamiliar drive may be malformed or deliberately crafted: image and container bugs, decompression bombs, disguised extensions, symlink tricks, filenames that spoof their own extension. It treats decoding itself as the risky step and keeps that work away from the rest of the app.

Images are decoded in short-lived worker processes by memory-safe decoders. A worker receives bytes over a pipe, never a path, and returns a freshly encoded image the host validates. On macOS it enters the system sandbox before reading any input; pixel, memory, input-size and time caps apply everywhere, and a crash or hang fails only that one preview.

Least privilege first. The interface has no filesystem, shell or HTTP access; its Tauri capability allow-lists only Mori's own commands, and it works with opaque file ids rather than paths. File types come from magic bytes, filenames have control and bidi-override characters replaced before display, and every change to your files passes a backend mutation policy.

Every file access goes through Rust: the id is looked up in the index, .. and absolute components are rejected, the path is canonicalised and checked against the canonical root (which defeats symlink escapes), and the file is opened without following links.

Opening a drive loads its last index snapshot immediately while a background thread rescans it. Each entry carries a pre-folded search key — lower-cased, accents stripped, Unicode normalised — so "cumpleanos" finds "cumpleaños". Gallery, grid and list are one virtualised view, so folders with tens of thousands of files stay smooth.