MPV Manager — Deep Codebase Audit

Reconciliation update (2026-09-05): The August fixes are confirmed present and identical to checkpoint fa0a678. Cross-review reconciliation maps all findings to their origins. R21 is now resolved: the missing historical report pairs were recovered byte-for-byte. The findings below preserve the initial audit record.

Implementation checkpoint (2026-09-05): Commit 346f272 preserves the August remediation, restored evidence, and both September reports. R04 is fixed in 979152e; R01/R02 are fixed in bf43eeb. R21 was resolved by restoring the historical reports. The remaining 18 findings are tracked in Atlas. The recovery changes passed the full Go race suite, lint, and all seven Linux native updater cases; the CI script passed all six targets. Windows/macOS native reruns remain release gates. Legacy unauthenticated update journals require manual recovery; see Troubleshooting.

Initial audit record: reviewed 2026-09-05 before implementation. Findings and counts below describe that baseline; subsequent fixes are listed above.

Atlas audit task: cebaeea6-fed6-4d19-811a-7288b1e9ed69 · Project: mpvrocks-mpv-manager. All R01–R22 belong to this audit task. Suggested work below preserves the original review recommendations; Atlas records subsequent implementation status.

Download Markdown · Validation · Reproduction fixtures

Assessment

The current tree contains substantial security and reliability improvements, but it is not ready to treat the earlier remediation pass as complete. This audit retains 22 findings: 4 High, 12 Medium, and 6 Low. The most consequential are destructive recovery replay (R01), journal-controlled backup execution under a weaker-trust parent directory (R02), Web shutdown abandoning workers (R03), and cross-target CI tools that cannot execute on the build host (R04). Review those four before release work continues.

The existing validation suite is green: normal/race Go tests, vet/Staticcheck, 180 frontend assertions, dependency scans, embedded-asset freshness, and six application cross-builds. Targeted probes still reproduced integration defects. Passing unit suites and compilable target binaries do not establish crash recovery, process ownership, real browser initialization, or complete CI-script correctness.

“AI slop” is assessed here as observable maintenance waste: unreachable paths, unused extension points, mock-only tests, redundant wrappers, and duplicated rules. No conclusion is drawn about who or what originally wrote a file. Existing failure-injection, authentication, archive, transaction, and lifecycle tests are valuable; wholesale test deletion or architectural replacement is not recommended.

Reviewed tree and method

Repository: /home/agent/Projects/mpvrocks/mpv-manager. HEAD: bdfb31b95030c2d992e5cfc4cb0ba5bada368d1b on master. The starting working tree had 195 tracked dirty paths and 89 untracked files, including earlier remediation and review artifacts. Findings apply to those actual working files, not to HEAD alone. Existing work was preserved.

A SHA-256 inventory captured 798 tracked/untracked nonignored files before analysis. Aggregate fingerprint of the sorted compact JSON path-to-hash map: 270747fe7c23e6252098960547f1575f948e06c8f9df714c3ae0ff9f1a8b90cf. Appendix C records hashes for the files cited by findings. Line references refer to this reviewed snapshot and may move after later edits.

The audit combined broad source inventory with risk-directed tracing of installer/update transactions, recovery and authentication boundaries, configuration persistence, Web/TUI/CLI lifecycle, package observations, frontend components, build/release scripts, tests, and agent instructions. Production Go and authored JavaScript accounted for approximately 58,000 lines; corresponding Go/JavaScript tests accounted for approximately 37,000 lines. This was a deep path-based review, not a claim that every line or platform behavior was independently proven correct.

Validation ran on Linux amd64 with go1.27.0-X:nodwarf5, Node 26.8.1, and npm 12.0.2. The repository’s CI uses Node 22; the complete CI container workflow was not run. Reproductions used disposable directories, harmless marker files, Go overlay tests, and a headless Chromium fixture. No application source, existing tests, dependency files, CI configuration, or live installation was modified.

Confidence labels distinguish executed behavior from source-confirmed paths and conditional exposure. Synthetic persisted journal states demonstrate replay behavior; they do not replace power-loss testing. Windows/macOS install/uninstall, UAC, signatures, ACLs, quarantine, and native process-tree handling were source-reviewed or cross-compiled, not exercised natively during this audit. No live signing service, protected GitLab settings, publication endpoint, or historical released-client bootstrap was newly qualified.

Findings index

Each item identifies the live code, observed behavior, impact, a proposed direction, and useful validation. R06/R20 cover consolidation at different boundaries; R12/R13/R17 should share one configuration-parser effort. Counts are this audit’s retained items, not additions to the historical 101-entry register.

No findings match these filters.

Validation results

The targeted Go overlay tests intentionally assert the defective behavior to document the finding; they are temporary audit probes, not proposed regression tests. A regression test added during remediation should assert the desired corrected invariant instead. Final baseline comparison found only Atlas-generated TRACKING.md changed among pre-existing files. Application source, existing tests, dependency files, CI, and pre-existing documentation stayed byte-for-byte unchanged. TRACKING.md was not hand-edited.

Controls and prior remediation that should be preserved

• The Web request boundary uses loopback Host checks, exact Origin matching when present, constant-time token comparison, method restrictions, and keyring authentication rate limiting. The review did not identify a new remote bypass of that boundary.
• Manifest/schema validation, pinned reviewed release inputs, authenticated asset size/hash checks, native update locking, and transactional replacement materially improve the normal update path. R01/R02 identify recovery gaps, not grounds to discard those controls.
• Shared atomic file operations, resource leases, owned Windows payload manifests, tri-state installation observations, UI config preservation, and terminal job-result handling are useful foundations. Several findings concern callers that bypass or incompletely integrate those mechanisms.
• Embedded exact-version frontend libraries, CSP work, Go race checks, static analysis, dependency scanning, native qualification tooling, and release evidence gates should remain. Improve integration coverage where the present suite demonstrably misses behavior.

Relationship to the August review and external gates

The existing finalized August report retains a historical 101-entry baseline and says 98 are repository-remediated. This audit does not rewrite that register or automatically reopen every earlier item. R01 revisits the crash-durable installer boundary previously mapped to CM-01/CM-29. R02 revisits recovery trust and pre-execution authentication. R03/R05/R07 revisit worker lifetime and cancellation. R06 shows that fixing bounded Web probes did not cover all shared update callers. R11/R16 show incomplete integration of metadata transactions and resource coordination. R18 qualifies the earlier “dead-code clean” claim. Review and map these residual findings before updating earlier completion status.

Atlas still tracks isolated signing/provenance provisioning (75ddd84a), release controls/native gates (22a13f11), and final release validation. Their current live external state was not independently rechecked. Keep them separate from this audit’s new source findings. A passed cross-build is not native installation evidence; synthetic unsigned audit fixtures are not release-signing qualification.

Recommended order after owner review

Approval can be scoped by finding or phase. The next step is owner review of these reports; no fixes, dependency upgrades, refactors, native uninstall operations, publication, or implementation task execution were performed.

Appendix A — Reproduction fixtures

The following fixtures preserve the strongest evidence inside the reports so it does not depend on the lifetime of temporary files. Run standalone Go fixtures from the repository root with go run /path/to/fixture.go. They create and remove their own disposable data; Linux shell probes require /bin/sh. They intentionally demonstrate current defects. Ignore exact random temporary path names and microsecond timing differences.

package main

import (
	"encoding/json"
	"fmt"
	"gitgud.io/mike/mpv-manager/pkg/installer"
	"os"
	"path/filepath"
)

func main() {
	for _, phase := range []string{"intent-before-backup", "recovery-after-backup-consumed"} {
		root, e := os.MkdirTemp("", "mpv-audit-recovery-")
		if e != nil {
			panic(e)
		}
		defer os.RemoveAll(root)
		target := filepath.Join(root, "player")
		backup := filepath.Join(root, ".mpv-manager-file-backup-review")
		os.Mkdir(backup, 0700)
		os.WriteFile(target, []byte("ONLY ORIGINAL COPY"), 0600)
		journal := map[string]any{"schema": 1, "kind": "file-swap", "state": "applying", "destination": target, "backup_root": backup, "changes": []any{map[string]any{"target": target, "backup": filepath.Join(backup, "player"), "had_original": true}}}
		b, _ := json.Marshal(journal)
		os.WriteFile(backup+".journal.json", b, 0600)
		err := installer.RecoverInstallerTransactions(target)
		_, stat := os.Stat(target)
		fmt.Printf("%s: recovery_error=%v original_deleted=%v\n", phase, err, os.IsNotExist(stat))
	}
}

package main

import (
	"encoding/json"
	"fmt"
	"gitgud.io/mike/mpv-manager/pkg/version"
	"os"
	"path/filepath"
	"runtime"
	"strings"
)

func main() {
	root, e := os.MkdirTemp("", "mpv-audit-update-")
	if e != nil {
		panic(e)
	}
	defer os.RemoveAll(root)
	os.Setenv("XDG_CONFIG_HOME", filepath.Join(root, "config"))
	target := filepath.Join(root, "mpv-manager")
	os.WriteFile(target, []byte("ORIGINAL"), 0755)
	id := "01950000-0000-7000-8000-000000000001"
	dir := filepath.Join(root, ".mpv-manager-update-"+id)
	os.Mkdir(dir, 0700)
	marker := filepath.Join(root, "unexpected-execution")
	backup := filepath.Join(root, ".mpv-manager.update-"+id+".backup")
	script := "#!/bin/sh\n: > '" + marker + "'\necho '{\"product\":\"not-a-manager\"}'\n"
	os.WriteFile(backup, []byte(script), 0755)
	journal := map[string]any{"schema_version": 1, "id": id, "state": "applying", "lock_path": target + ".update.lock", "helper_path": filepath.Join(dir, "mpv-manager-update-helper"), "health_path": filepath.Join(dir, "health.json"), "payload_path": filepath.Join(dir, "manager-payload"), "manifest_key_id": "not-a-trusted-key", "expected_size": 1, "expected_blake3": "blake3:" + strings.Repeat("0", 64), "expected_identity": map[string]any{"product": version.ProductID, "component": version.ComponentID, "version": "1.3.0", "goos": runtime.GOOS, "goarch": runtime.GOARCH}, "targets": []any{map[string]any{"role": "primary", "path": target, "staged_path": filepath.Join(root, ".mpv-manager.update-"+id+".new"), "backup_path": backup, "applied": true}}}
	b, _ := json.Marshal(journal)
	os.WriteFile(filepath.Join(dir, "transaction.json"), b, 0600)
	version.RecoverSelfUpdateTransactions(target)
	_, stat := os.Stat(marker)
	original, _ := os.ReadFile(target)
	fmt.Printf("forged unsigned recovery journal: backup_executed=%v original_preserved=%v\n", stat == nil, string(original) == "ORIGINAL")
}

package main

import (
	"context"
	"fmt"
	"gitgud.io/mike/mpv-manager/pkg/installer"
	"os"
	"path/filepath"
	"time"
)

func main() {
	root, _ := os.MkdirTemp("", "mpv-audit-cancel-")
	defer os.RemoveAll(root)
	marker := filepath.Join(root, "child-write")
	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
	defer cancel()
	cr := installer.NewCommandRunnerWithContext(ctx, make(chan string, 50), make(chan error, 10))
	start := time.Now()
	err := cr.RunCommand("/bin/sh", "-c", "(sleep 0.6; echo survived > '"+marker+"') & wait")
	_, stat := os.Stat(marker)
	fmt.Printf("deadline=100ms elapsed=%s error=%v child_mutated_after_cancel=%v\n", time.Since(start).Round(time.Millisecond), err, stat == nil)
}

package main

import (
	"fmt"
	"gitgud.io/mike/mpv-manager/pkg/config"
	"os"
	"path/filepath"
)

func main() {
	root, _ := os.MkdirTemp("", "mpv-audit-config-")
	defer os.RemoveAll(root)
	os.Setenv("XDG_CONFIG_HOME", root)
	dir := filepath.Join(root, "mpv")
	os.MkdirAll(dir, 0700)
	file := filepath.Join(dir, "mpv.conf")
	config.Load()
	for _, body := range []string{"screenshot-avif-opts=crf=20,speed=6\n", "[special]\nscale=bilinear\n", "hwdec=no\nhwdec=auto\n"} {
		os.WriteFile(file, []byte(body), 0600)
		if body[0] == 's' {
			fmt.Printf("scalar_read=%q\n", config.GetConfigValue("screenshot-avif-opts"))
		} else {
			err := config.SetConfigValue("hwdec", []string{"nvdec"}, true)
			after, _ := os.ReadFile(file)
			fmt.Printf("set_error=%v config_after=%q\n", err, after)
		}
	}
}

package web

import (
	"testing"
	"time"
)

func TestAuditShutdownLeavesJobAlive(t *testing.T) {
	jm := NewJobManager()
	job := jm.CreateJob("install", "mpv-binary", "MPV")
	server := &Server{jobManager: jm, shutdownCh: make(chan struct{})}
	start := time.Now()
	err := server.Shutdown()
	t.Logf("shutdown_error=%v elapsed=%s job_context_cancelled=%v active_jobs=%d", err, time.Since(start), job.Context().Err() != nil, len(jm.GetActiveJobs()))
	if err != nil || job.Context().Err() != nil || len(jm.GetActiveJobs()) != 1 {
		t.Fatal("reproduction changed")
	}
	job.Cancel()
}

package installer

import (
	"bytes"
	"gitgud.io/mike/mpv-manager/pkg/config"
	"os"
	"path/filepath"
	"testing"
)

func TestAuditLegacyOwnershipRefusal(t *testing.T) {
	dir := t.TempDir()
	os.WriteFile(filepath.Join(dir, "mpv.exe"), []byte("existing player"), 0600)
	err := validateWindowsInstallOwnership(dir)
	t.Logf("existing_install_without_new_manifest: %v", err)
	if err == nil {
		t.Fatal("reproduction changed")
	}
}
func TestAuditUnboundedOutputLine(t *testing.T) {
	capture := &outputCapture{}
	chunk := bytes.Repeat([]byte("x"), 64*1024)
	for range 64 {
		capture.Write(chunk)
	}
	t.Logf("single_unterminated_line_retained_bytes=%d", len(capture.pending))
	if len(capture.pending) != 4*1024*1024 {
		t.Fatal("reproduction changed")
	}
}

func TestAuditUIUpdateLosesConcurrentEdit(t *testing.T) {
	root := t.TempDir()
	t.Setenv("XDG_CONFIG_HOME", filepath.Join(root, "state"))
	live := filepath.Join(root, "mpv")
	opts := filepath.Join(live, "script-opts")
	os.MkdirAll(opts, 0700)
	path := filepath.Join(opts, "modernz.conf")
	os.WriteFile(path, []byte("old-user-setting"), 0600)
	inst := NewInstaller(ReleaseInfo{}, live)
	cr := NewCommandRunner(make(chan string, 100), make(chan error, 10))
	config.Load()
	err := inst.updateUIWithPreservedConfig(cr, live, "modernz", func(stage string) error {
		os.MkdirAll(filepath.Join(stage, "script-opts"), 0700)
		os.WriteFile(filepath.Join(stage, "script-opts", "modernz.conf"), []byte("upstream-default"), 0600)
		return os.WriteFile(path, []byte("saved-while-download-runs"), 0600)
	})
	after, _ := os.ReadFile(path)
	t.Logf("update_error=%v final_config=%q concurrent_edit_lost=%v", err, after, string(after) == "old-user-setting")
	if err != nil || string(after) != "old-user-setting" {
		t.Fatal("reproduction changed")
	}
}

<!doctype html><html><body><pre id="result">pending</pre><div x-data="tasksPage()" x-init="init()"></div><script>
window.counts={fetches:0,intervals:0};window.MPVUtils={apiFetch:async()=>{counts.fetches++;return {ok:true,data:{active:[],recent:[]}}}};const nativeInterval=window.setInterval;window.setInterval=(...args)=>{counts.intervals++;return nativeInterval(...args)};
window.addEventListener('load',()=>setTimeout(()=>document.getElementById('result').textContent=JSON.stringify(counts),10));
</script><script src="./internal/webassets/static/tasks-page.js"></script><script defer src="./internal/webassets/static/js/alpine.min.js"></script></body></html>

Observed key outputs:

R01: original_deleted=true (both constructed boundary states)
R02: backup_executed=true original_preserved=true
R03: shutdown_error=<nil> job_context_cancelled=false active_jobs=1
R04: fork/exec .../verify-manifest.exe: exec format error
R05: deadline=100ms elapsed=602ms child_mutated_after_cancel=true
R09: refusing to modify populated directory without .mpv-manager-owned.json ownership proof
R10: update_error=<nil> final_config="old-user-setting" concurrent_edit_lost=true
R12: config_after="[special]\nscale=bilinear\n\nhwdec=nvdec"
R13: scalar_read=["crf=20" "speed=6"]
R14: {"fetches":2,"intervals":2}
R15: single_unterminated_line_retained_bytes=4194304

Appendix B — Common unreachable symbols

Reproduce with go run golang.org/x/tools/cmd/deadcode@v0.45.0 -test ./... on Linux. For other targets, build the analyzer for the host first, then run that host executable with GOOS=windows GOARCH=amd64 and GOOS=darwin GOARCH=arm64. This deliberately avoids the build-tool error described in R04. Compare the intersection, not the union.

internal/assets/mpv.go:108:6: unreachable func: ExtractPNGIcon
pkg/config/config.go:1185:6: unreachable func: UpdateInstalledAppUIType
pkg/config/config.go:1243:6: unreachable func: UpdateInstalledAppManaged
pkg/config/config.go:625:6: unreachable func: SetCurrentUIType
pkg/config/config.go:632:6: unreachable func: GetCurrentUIType
pkg/constants/paths.go:336:6: unreachable func: GetMPVConfigBackupDirWithHome
pkg/constants/paths.go:84:6: unreachable func: GetWindowsPathPreference
pkg/hotkeys/hotkeys.go:206:6: unreachable func: SearchHotkeys
pkg/hotkeys/hotkeys.go:233:6: unreachable func: matchAliases
pkg/hotkeys/inputconf.go:170:6: unreachable func: WriteInputConf
pkg/installer/common_test.go:714:31: unreachable func: TestCommandRunner.GetOutputMessages
pkg/version/version.go:449:6: unreachable func: UpdateSelfFromCheckWithProgress
pkg/web/locale.go:273:6: unreachable func: GetCommonLanguages
pkg/web/locale.go:302:6: unreachable func: GetAllLanguages
pkg/web/locale_utils.go:110:6: unreachable func: extractFlagEmoji
pkg/web/locale_utils.go:34:6: unreachable func: ConvertToWebOption
pkg/web/locale_utils.go:50:6: unreachable func: ConvertToWebOptionSlice
pkg/web/models.go:255:6: unreachable func: LanguageName
pkg/web/package_detection.go:15:6: unreachable func: IsFlatpakAvailable
pkg/web/package_detection.go:27:6: unreachable func: IsBrewAvailable
pkg/web/package_detection.go:38:6: unreachable func: IsPackageManagerAvailable
pkg/web/package_detection.go:51:6: unreachable func: GetPackageManagerCommand
pkg/web/package_detection.go:9:6: unreachable func: IsCommandAvailable
pkg/web/package_version.go:85:6: unreachable func: GetAvailableVersion
pkg/web/server.go:919:18: unreachable func: Server.SetPendingNotice

Appendix C — Cited-file fingerprints

SHA-256 values below identify the pre-existing files cited by findings. Report files themselves are intentionally excluded. The full 798-file starting inventory and raw validation logs remain locally in /tmp/mpv-manager-audit-20260905; the findings and reproduction code above are self-contained.

Audit completed 2026-09-05. Owner review precedes implementation. Back to top