Module platform 

The OS-specific half of the Files pane’s filesystem layer: path display form, hidden attributes, a rename that never overwrites, a delete that never follows a link, and the commands that open or reveal a path.

Deliberately depends on nothing but std, libc and windows-sys, so every cfg arm can be checked on its own.

Spec: docs/specs/SPEC_FILE_BROWSER_PANE_2026_10_01.md §9.

Functions

create_symlink

Create a symlink at link pointing at target, of the same kind as the link being copied (like, its own file type). Windows has separate file and directory links; a junction is recreated as a directory link.

display_path

path as the frontend should see it. On Windows, canonicalize returns verbatim paths (\\?\C:\…, \\?\UNC\host\share\…); those are turned back into their ordinary forms. Elsewhere the path is unchanged.

explorer_quote

explorer.exe’s argument for display. Windows paths can’t contain ", so quoting is unambiguous, and it keeps a path with spaces or commas in one piece. A trailing backslash would escape the closing quote, so it is trimmed; a drive root (C:\) has no spaces and goes unquoted.

has_hidden_attribute

Whether meta (the entry’s own metadata, not a link’s target) carries the hidden or system attribute. Always false off Windows, where hidden means only a leading dot.

is_os_blocked

Whether an access error is macOS’s privacy system (TCC) refusing, rather than ordinary permissions: TCC denials are EPERM, ordinary ones EACCES (spec §9.1.1 fact 2). Rust maps both to PermissionDenied, so the raw code decides.

is_symlink_privilege_error

Whether creating a symlink failed because Windows requires Developer Mode or elevation for it (ERROR_PRIVILEGE_NOT_HELD).

open_command

The command that opens path with the OS default application, for spawn_detached (which sanitizes its environment).

open_no_follow

Open path for reading, refusing a symlink where the OS can: a copy reads the file that was listed, never what a link swapped in since points at (spec §9: never follow a link when copying).

remove_entry_no_follow

Permanently remove the entry at path without following it: a symlink (or Windows junction) is unlinked and its target kept, a directory is removed with its contents, anything else is removed as a file.

remove_file_force

Remove the regular file at path. On Windows a read-only file refuses deletion, so the attribute is cleared first when that is the refusal: a moved file’s original and a discarded partial copy both have to go.

rename_checked 🔒

Check-then-rename, for filesystems with no atomic no-replace rename. symlink_metadata rather than exists, so a dangling link at to still counts as taken.

rename_no_replace

Rename from to to, failing with AlreadyExists instead of replacing an existing to.

reveal_command

The command that shows path selected in the OS file manager. Linux has no portable “select”, so it opens the containing folder.

spawn_detached

Spawn cmd detached from srv’s own stdio, and reap it on a thread.

strip_verbatim

The string half of display_path, separate so it can be tested on any platform. Only the drive and UNC forms are rewritten; any other verbatim path (\\?\Volume{…}\) has no ordinary spelling and is left alone.

trash_unavailable_reason

Why path can’t go to the Recycle Bin, if it can’t.