Add support for custom temporary directories in image creation scripts #26

2026-05-16T23:32:20-05:00

ali-ghanati commented

2026-05-16 23:32:20 -05:00

(Migrated from github.com)

note: because of my poor english, I've wrote description using ai, and did some refactor in code using ai, I just wanted to help and improve this awesome project from my own point of view, thank you everyone who helped this project

Summary

Adds an optional temp/work directory flag across all exFAT image creation paths so large builds can use a fast or spacious disk (e.g. /mnt/hdd, D:\temp) instead of default system temp or fixed mount paths.

Linux (mkexfat.sh): -t / --tmp-dir / --temp-dir may appear anywhere in the command line. Creates a unique mount dir under the chosen base (mkexfat.XXXXXX). Mount prefers direct exfat-fuse file access and falls back to -o loop when needed (fixes loop setup failures on some removable exFAT targets).
macOS (mkexfat_macos.sh): Same flag parsing; when omitted, behavior is unchanged (mktemp defaults). When set, sizing scratch file and mount staging dir are created under the given path.
Windows (New-OsfExfatImage.ps1, make_image.bat): -TempDir / -t (PowerShell) and -t / --tmp-dir / --temp-dir (batch). Sets %TEMP% / %TMP% for format redirect files and related scratch work.

Motivation

Large game/app images (~80GB+) can fail or run slowly when temp/mount work uses root-owned paths, small system partitions, or loop mounts on USB exFAT volumes. Letting users point temp work at another drive avoids those issues without changing default behavior for existing scripts.

Behavior

Platform	Without temp flag	With `-t` / `--tmp-dir`
Linux	Temp mount under `/tmp/mkexfat.*`	Temp mount under `<dir>/mkexfat.*`
macOS	System default `mktemp`	`<dir>/mkexfat.` and `<dir>/mkexfat_sizes.`
Windows	Windows default `%TEMP%`	User directory for script temp files

Output image path is always the positional/output argument you pass; only intermediate work moves to the temp directory.

Linux — `mkexfat.sh`

Requires: exfatprogs, exfat-fuse, fuse3, rsync
(often run with sudo for mount operations)

# Default (temp under /tmp)
./mkexfat.sh /path/to/payload /path/to/output.exfat

# Use another disk for mount staging (flag can be anywhere)
./mkexfat.sh -t /mnt/hdd /mnt/hdd/payload /media/usb/game.exfat

./mkexfat.sh /mnt/hdd/payload /media/usb/game.exfat --tmp-dir /mnt/hdd

<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit

* **New Features**
  * Specify a custom temporary directory across Windows, macOS, and Linux image-creation tools (-t/--tmp-dir), including examples in help text.

* **Improvements**
  * Improved CLI parsing, validation, and usage messages.
  * Safer mount/cleanup flow and per-run temp/mount directories to avoid conflicts and ensure proper cleanup.
  * Default output behavior and fallbacks clarified for more reliable image creation.

<!-- review_stack_entry_start -->

[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/drakmor/ShadowMountPlus/pull/26?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

note: because of my poor english, I've wrote description using ai, and did some refactor in code using ai, I just wanted to help and improve this awesome project from my own point of view, thank you everyone who helped this project ## Summary Adds an optional temp/work directory flag across all exFAT image creation paths so large builds can use a fast or spacious disk (e.g. `/mnt/hdd`, `D:\temp`) instead of default system temp or fixed mount paths. - **Linux (`mkexfat.sh`)**: `-t` / `--tmp-dir` / `--temp-dir` may appear anywhere in the command line. Creates a unique mount dir under the chosen base (`mkexfat.XXXXXX`). Mount prefers direct `exfat-fuse` file access and falls back to `-o loop` when needed (fixes loop setup failures on some removable exFAT targets). - **macOS (`mkexfat_macos.sh`)**: Same flag parsing; when omitted, behavior is unchanged (`mktemp` defaults). When set, sizing scratch file and mount staging dir are created under the given path. - **Windows (`New-OsfExfatImage.ps1`, `make_image.bat`)**: `-TempDir` / `-t` (PowerShell) and `-t` / `--tmp-dir` / `--temp-dir` (batch). Sets `%TEMP%` / `%TMP%` for format redirect files and related scratch work. ## Motivation Large game/app images (~80GB+) can fail or run slowly when temp/mount work uses root-owned paths, small system partitions, or loop mounts on USB exFAT volumes. Letting users point temp work at another drive avoids those issues without changing default behavior for existing scripts. ## Behavior | Platform | Without temp flag | With `-t` / `--tmp-dir` | |---|---|---| | Linux | Temp mount under `/tmp/mkexfat.*` | Temp mount under `<dir>/mkexfat.*` | | macOS | System default `mktemp` | `<dir>/mkexfat.*` and `<dir>/mkexfat_sizes.*` | | Windows | Windows default `%TEMP%` | User directory for script temp files | Output image path is always the positional/output argument you pass; only intermediate work moves to the temp directory. --- ## Linux — `mkexfat.sh` **Requires:** `exfatprogs`, `exfat-fuse`, `fuse3`, `rsync` (often run with `sudo` for mount operations) ```bash # Default (temp under /tmp) ./mkexfat.sh /path/to/payload /path/to/output.exfat # Use another disk for mount staging (flag can be anywhere) ./mkexfat.sh -t /mnt/hdd /mnt/hdd/payload /media/usb/game.exfat ./mkexfat.sh /mnt/hdd/payload /media/usb/game.exfat --tmp-dir /mnt/hdd  ## Summary by CodeRabbit * **New Features** * Specify a custom temporary directory across Windows, macOS, and Linux image-creation tools (-t/--tmp-dir), including examples in help text. * **Improvements** * Improved CLI parsing, validation, and usage messages. * Safer mount/cleanup flow and per-run temp/mount directories to avoid conflicts and ensure proper cleanup. * Default output behavior and fallbacks clarified for more reliable image creation.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/drakmor/ShadowMountPlus/pull/26?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

coderabbitai[bot] commented

2026-05-16 23:32:31 -05:00

(Migrated from github.com)

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 92284f79-afba-42c4-8713-d31e05e94403

📥 Commits

Reviewing files that changed from the base of the PR and between 9d6505d5d3 and b45396c134.

📒 Files selected for processing (4)

New-OsfExfatImage.ps1
make_image.bat
mkexfat.sh
mkexfat_macos.sh

📝 Walkthrough

Walkthrough

Adds an optional temp-directory option across PowerShell, Batch, Linux, and macOS scripts to control where temporary files and mount points are created during exFAT image building; includes CLI parsing, validation, dynamic mounts, and a PowerShell temp-file helper.

Changes

Temporary Directory Control Across Platforms

Layer / File(s)	Summary
PowerShell Parameter and Temp Directory Helpers `New-OsfExfatImage.ps1`	New-OsfExfatImage.ps1 adds a `-TempDir` parameter (alias `-t`) with documentation, implements `Initialize-ScriptTempDir` to validate and configure environment variables, and `New-ScriptTempFile` to create temp files within the specified directory.
PowerShell Format and Initialization Integration `New-OsfExfatImage.ps1`	`Invoke-FormatVolume` uses the new temp-file helper for format.com stdout/stderr redirection instead of direct system temp names, and the main script flow initializes the temp directory before image creation.
Batch Script Argument Parsing and Pass-Through `make_image.bat`	Argument parsing replaces positional handling with a loop parser supporting `-t`, `--tmp-dir`, and `--temp-dir` flags; validation confirms directory existence and passes it to PowerShell conditionally; usage documentation includes new examples.
Linux Shell Script CLI Parsing and Dynamic Mounting `mkexfat.sh`	Option parsing supports `-t/--tmp-dir/--temp-dir` alongside `-h/--help` and `--` positional separation; new `cleanup()` trap handler unmounts and removes dynamically created mount directories; mounting attempts unwrapped exfat-fuse before falling back to loop device and uses `rsync` into the dynamic mount.
macOS Shell Script CLI Parsing and Conditional Temp Placement `mkexfat_macos.sh`	Option parsing supports `-t/--tmp-dir/--temp-dir` with `--` separation and expands validation; intermediate sizes file and mount-point directory are conditionally placed under the user-specified temp base when provided.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

"🐰 I hopped through temp paths wide and narrow,
I tucked the files where you point the burrow,
Mounts cleaned up with a tidy sweep,
ExFAT sleeps safe and copies sleep deep,
Hooray — one small hop to a neater burrow!"

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely describes the main change across all affected scripts: adding support for custom temporary directories in image creation tools.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

> [!CAUTION] > ## Review failed > > The pull request is closed.  <details> <summary>ℹ️ Recent review info</summary> <details> <summary>⚙️ Run configuration</summary> **Configuration used**: defaults **Review profile**: CHILL **Plan**: Pro Plus **Run ID**: `92284f79-afba-42c4-8713-d31e05e94403` </details> <details> <summary>📥 Commits</summary> Reviewing files that changed from the base of the PR and between 9d6505d5d306f3a627abfc7e4a840300e5735ac0 and b45396c1341f811a0cbb9082301d0571bda7d105. </details> <details> <summary>📒 Files selected for processing (4)</summary> * `New-OsfExfatImage.ps1` * `make_image.bat` * `mkexfat.sh` * `mkexfat_macos.sh` </details> </details> ---  <details> <summary>📝 Walkthrough</summary> ## Walkthrough Adds an optional temp-directory option across PowerShell, Batch, Linux, and macOS scripts to control where temporary files and mount points are created during exFAT image building; includes CLI parsing, validation, dynamic mounts, and a PowerShell temp-file helper. ## Changes **Temporary Directory Control Across Platforms** |Layer / File(s)|Summary| |---|---| |**PowerShell Parameter and Temp Directory Helpers** `New-OsfExfatImage.ps1`|New-OsfExfatImage.ps1 adds a `-TempDir` parameter (alias `-t`) with documentation, implements `Initialize-ScriptTempDir` to validate and configure environment variables, and `New-ScriptTempFile` to create temp files within the specified directory.| |**PowerShell Format and Initialization Integration** `New-OsfExfatImage.ps1`|`Invoke-FormatVolume` uses the new temp-file helper for format.com stdout/stderr redirection instead of direct system temp names, and the main script flow initializes the temp directory before image creation.| |**Batch Script Argument Parsing and Pass-Through** `make_image.bat`|Argument parsing replaces positional handling with a loop parser supporting `-t`, `--tmp-dir`, and `--temp-dir` flags; validation confirms directory existence and passes it to PowerShell conditionally; usage documentation includes new examples.| |**Linux Shell Script CLI Parsing and Dynamic Mounting** `mkexfat.sh`|Option parsing supports `-t/--tmp-dir/--temp-dir` alongside `-h/--help` and `--` positional separation; new `cleanup()` trap handler unmounts and removes dynamically created mount directories; mounting attempts unwrapped exfat-fuse before falling back to loop device and uses `rsync` into the dynamic mount.| |**macOS Shell Script CLI Parsing and Conditional Temp Placement** `mkexfat_macos.sh`|Option parsing supports `-t/--tmp-dir/--temp-dir` with `--` separation and expands validation; intermediate sizes file and mount-point directory are conditionally placed under the user-specified temp base when provided.| ## Estimated code review effort 🎯 3 (Moderate) | ⏱️ ~25 minutes > "🐰 I hopped through temp paths wide and narrow, > I tucked the files where you point the burrow, > Mounts cleaned up with a tidy sweep, > ExFAT sleeps safe and copies sleep deep, > Hooray — one small hop to a neater burrow!" </details>   <details> <summary>🚥 Pre-merge checks | ✅ 4 | ❌ 1</summary> ### ❌ Failed checks (1 warning) | Check name | Status | Explanation | Resolution | | :----------------: | :--------- | :----------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------- | | Docstring Coverage | ⚠️ Warning | Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. | Write docstrings for the functions missing them to satisfy the coverage threshold. | <details> <summary>✅ Passed checks (4 passed)</summary> | Check name | Status | Explanation | | :------------------------: | :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Description Check | ✅ Passed | Check skipped - CodeRabbit’s high-level summary is enabled. | | Title check | ✅ Passed | The title accurately and concisely describes the main change across all affected scripts: adding support for custom temporary directories in image creation tools. | | Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. | | Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. | </details> ✏️ Tip: You can configure your own custom pre-merge checks in the settings. </details>   <details> <summary>✨ Finishing Touches</summary> <details> <summary>🧪 Generate unit tests (beta)</summary> - [ ]  Create PR with unit tests </details> </details>   --- Comment `@coderabbitai help` to get the list of available commands and usage tips.

coderabbitai[bot] (Migrated from github.com) reviewed

2026-05-16 23:35:51 -05:00

coderabbitai[bot] (Migrated from github.com) left a comment

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@make_image.bat`:
- Around line 75-77: Replace the insecure hardcoded "-ExecutionPolicy Bypass"
invocations for launching "%SCRIPT%" with a safer approach: sign
New-OsfExfatImage.ps1 using a code-signing certificate and change the PowerShell
launches in the batch file (the two powershell.exe calls that pass -File
"%SCRIPT%") to use "-ExecutionPolicy RemoteSigned"; if signing cannot be done,
add clear documentation near the "%SCRIPT%" invocation explaining the security
implications of using Bypass and require an explicit opt-in approval step
instead of silently bypassing execution policy.

In `@mkexfat_macos.sh`:
- Around line 76-79: Add an explicit validation step before normalizing OUTPUT:
check the parent directory of OUTPUT (derived via dirname "$OUTPUT") exists and
is writable; if it does not, print a clear error message referencing OUTPUT and
exit non-zero instead of letting the subsequent cd fail. Implement this
validation right before the OUTPUT="$(cd ...)" normalization and keep the OUTPUT
variable name and the dirname/"basename" approach so the check targets the same
path used for normalization.

In `@mkexfat.sh`:
- Around line 84-87: The current check only verifies TMP_BASE exists; change it
to validate that TMP_BASE is both writable and searchable/executable so mktemp
and child processes can create files there: update the directory check around
TMP_BASE to assert -d, -w and -x (or attempt a safe mktemp creation) and, on
failure, emit a clear error mentioning missing write/execute permissions for
TMP_BASE and exit 1; reference the TMP_BASE variable and the mktemp usage in the
script when implementing the check.

In `@New-OsfExfatImage.ps1`:
- Around line 140-149: The Initialize-ScriptTempDir function currently only
checks existence; update it to fail fast on non-writable directories by
attempting a safe write/delete in $resolved (e.g., create and remove a small
temp marker file) and throw a clear error if that operation fails; keep the
existing Resolve-Path, $script:ScriptTempDir assignment and env:TEMP/TMP updates
but perform the write-check before setting those and before continuing, and
ensure the thrown message mentions the directory and that it is not writable to
aid debugging.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c0061dd0-8ac7-44cf-9c95-cd3cc12002a5

📥 Commits

Reviewing files that changed from the base of the PR and between 8622d8757f and 9d6505d5d3.

📒 Files selected for processing (4)

New-OsfExfatImage.ps1
make_image.bat
mkexfat.sh
mkexfat_macos.sh

**Actionable comments posted: 4** <details> <summary>🤖 Prompt for all review comments with AI agents</summary> ``` Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. Inline comments: In `@make_image.bat`: - Around line 75-77: Replace the insecure hardcoded "-ExecutionPolicy Bypass" invocations for launching "%SCRIPT%" with a safer approach: sign New-OsfExfatImage.ps1 using a code-signing certificate and change the PowerShell launches in the batch file (the two powershell.exe calls that pass -File "%SCRIPT%") to use "-ExecutionPolicy RemoteSigned"; if signing cannot be done, add clear documentation near the "%SCRIPT%" invocation explaining the security implications of using Bypass and require an explicit opt-in approval step instead of silently bypassing execution policy. In `@mkexfat_macos.sh`: - Around line 76-79: Add an explicit validation step before normalizing OUTPUT: check the parent directory of OUTPUT (derived via dirname "$OUTPUT") exists and is writable; if it does not, print a clear error message referencing OUTPUT and exit non-zero instead of letting the subsequent cd fail. Implement this validation right before the OUTPUT="$(cd ...)" normalization and keep the OUTPUT variable name and the dirname/"basename" approach so the check targets the same path used for normalization. In `@mkexfat.sh`: - Around line 84-87: The current check only verifies TMP_BASE exists; change it to validate that TMP_BASE is both writable and searchable/executable so mktemp and child processes can create files there: update the directory check around TMP_BASE to assert -d, -w and -x (or attempt a safe mktemp creation) and, on failure, emit a clear error mentioning missing write/execute permissions for TMP_BASE and exit 1; reference the TMP_BASE variable and the mktemp usage in the script when implementing the check. In `@New-OsfExfatImage.ps1`: - Around line 140-149: The Initialize-ScriptTempDir function currently only checks existence; update it to fail fast on non-writable directories by attempting a safe write/delete in $resolved (e.g., create and remove a small temp marker file) and throw a clear error if that operation fails; keep the existing Resolve-Path, $script:ScriptTempDir assignment and env:TEMP/TMP updates but perform the write-check before setting those and before continuing, and ensure the thrown message mentions the directory and that it is not writable to aid debugging. ``` </details> <details> <summary>🪄 Autofix (Beta)</summary> Fix all unresolved CodeRabbit comments on this PR: - [ ]  Push a commit to this branch (recommended) - [ ]  Create a new PR with the fixes </details> --- <details> <summary>ℹ️ Review info</summary> <details> <summary>⚙️ Run configuration</summary> **Configuration used**: defaults **Review profile**: CHILL **Plan**: Pro Plus **Run ID**: `c0061dd0-8ac7-44cf-9c95-cd3cc12002a5` </details> <details> <summary>📥 Commits</summary> Reviewing files that changed from the base of the PR and between 8622d8757fe29a153c519c4e13e0b127d6881125 and 9d6505d5d306f3a627abfc7e4a840300e5735ac0. </details> <details> <summary>📒 Files selected for processing (4)</summary> * `New-OsfExfatImage.ps1` * `make_image.bat` * `mkexfat.sh` * `mkexfat_macos.sh` </details> </details>

New-OsfExfatImage.ps1

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fail fast when -TempDir is not writable.

The current check only verifies directory existence. If the directory exists but isn’t writable, the script fails later during formatting/log redirection with a less actionable error.

💡 Proposed fix

 function Initialize-ScriptTempDir([string]$dir) {
   if ([string]::IsNullOrWhiteSpace($dir)) { return }
   $resolved = $dir.Trim()
   if (-not (Test-Path -LiteralPath $resolved -PathType Container)) {
     throw "Temp directory not found: $resolved"
   }
   $script:ScriptTempDir = (Resolve-Path -LiteralPath $resolved).Path
+  $probe = Join-Path $script:ScriptTempDir ([System.IO.Path]::GetRandomFileName())
+  try {
+    Set-Content -LiteralPath $probe -Value "" -NoNewline
+    Remove-Item -LiteralPath $probe -Force -ErrorAction SilentlyContinue
+  } catch {
+    throw "Temp directory is not writable: $script:ScriptTempDir"
+  }
   $env:TEMP = $script:ScriptTempDir
   $env:TMP = $script:ScriptTempDir
   Write-Host "[Info] Temp directory: $script:ScriptTempDir"
 }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

function Initialize-ScriptTempDir([string]$dir) {
  if ([string]::IsNullOrWhiteSpace($dir)) { return }
  $resolved = $dir.Trim()
  if (-not (Test-Path -LiteralPath $resolved -PathType Container)) {
    throw "Temp directory not found: $resolved"
  }
  $script:ScriptTempDir = (Resolve-Path -LiteralPath $resolved).Path
  $probe = Join-Path $script:ScriptTempDir ([System.IO.Path]::GetRandomFileName())
  try {
    Set-Content -LiteralPath $probe -Value "" -NoNewline
    Remove-Item -LiteralPath $probe -Force -ErrorAction SilentlyContinue
  } catch {
    throw "Temp directory is not writable: $script:ScriptTempDir"
  }
  $env:TEMP = $script:ScriptTempDir
  $env:TMP = $script:ScriptTempDir
  Write-Host "[Info] Temp directory: $script:ScriptTempDir"
}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@New-OsfExfatImage.ps1` around lines 140 - 149, The Initialize-ScriptTempDir
function currently only checks existence; update it to fail fast on non-writable
directories by attempting a safe write/delete in $resolved (e.g., create and
remove a small temp marker file) and throw a clear error if that operation
fails; keep the existing Resolve-Path, $script:ScriptTempDir assignment and
env:TEMP/TMP updates but perform the write-check before setting those and before
continuing, and ensure the thrown message mentions the directory and that it is
not writable to aid debugging.

✅ Addressed in commit b45396c

_⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_ **Fail fast when `-TempDir` is not writable.** The current check only verifies directory existence. If the directory exists but isn’t writable, the script fails later during formatting/log redirection with a less actionable error. <details> <summary>💡 Proposed fix</summary> ```diff function Initialize-ScriptTempDir([string]$dir) { if ([string]::IsNullOrWhiteSpace($dir)) { return } $resolved = $dir.Trim() if (-not (Test-Path -LiteralPath $resolved -PathType Container)) { throw "Temp directory not found: $resolved" } $script:ScriptTempDir = (Resolve-Path -LiteralPath $resolved).Path + $probe = Join-Path $script:ScriptTempDir ([System.IO.Path]::GetRandomFileName()) + try { + Set-Content -LiteralPath $probe -Value "" -NoNewline + Remove-Item -LiteralPath $probe -Force -ErrorAction SilentlyContinue + } catch { + throw "Temp directory is not writable: $script:ScriptTempDir" + } $env:TEMP = $script:ScriptTempDir $env:TMP = $script:ScriptTempDir Write-Host "[Info] Temp directory: $script:ScriptTempDir" } ``` </details>  <details> <summary>📝 Committable suggestion</summary> > ‼️ **IMPORTANT** > Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements. ```suggestion function Initialize-ScriptTempDir([string]$dir) { if ([string]::IsNullOrWhiteSpace($dir)) { return } $resolved = $dir.Trim() if (-not (Test-Path -LiteralPath $resolved -PathType Container)) { throw "Temp directory not found: $resolved" } $script:ScriptTempDir = (Resolve-Path -LiteralPath $resolved).Path $probe = Join-Path $script:ScriptTempDir ([System.IO.Path]::GetRandomFileName()) try { Set-Content -LiteralPath $probe -Value "" -NoNewline Remove-Item -LiteralPath $probe -Force -ErrorAction SilentlyContinue } catch { throw "Temp directory is not writable: $script:ScriptTempDir" } $env:TEMP = $script:ScriptTempDir $env:TMP = $script:ScriptTempDir Write-Host "[Info] Temp directory: $script:ScriptTempDir" } ``` </details>  <details> <summary>🤖 Prompt for AI Agents</summary> ``` Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@New-OsfExfatImage.ps1` around lines 140 - 149, The Initialize-ScriptTempDir function currently only checks existence; update it to fail fast on non-writable directories by attempting a safe write/delete in $resolved (e.g., create and remove a small temp marker file) and throw a clear error if that operation fails; keep the existing Resolve-Path, $script:ScriptTempDir assignment and env:TEMP/TMP updates but perform the write-check before setting those and before continuing, and ensure the thrown message mentions the directory and that it is not writable to aid debugging. ``` </details>   ✅ Addressed in commit b45396c

make_image.bat

					
				@ -29,10 +61,21 @@ if not exist "%SRCDIR%\eboot.bin" (

				  exit /b 4

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

Is using powershell.exe -ExecutionPolicy Bypass recommended for automation scripts, and what safer alternatives does Microsoft recommend?

💡 Result:

Using powershell.exe -ExecutionPolicy Bypass is generally not recommended as a standard practice for automation scripts because it explicitly instructs PowerShell to ignore all security policies, including signature verification [1][2]. While it is a common method to resolve script execution errors, it should be used with caution and only when you fully trust the script being executed [1][2]. It is important to understand that PowerShell execution policies are not a security boundary; they are safety features designed to prevent accidental execution of scripts [3][2]. They do not prevent a determined user or attacker from running malicious code, as there are many ways to circumvent these policies [3][4]. Microsoft and security professionals recommend the following safer alternatives for automation: 1. Use RemoteSigned: This is the recommended policy for most environments [5]. It allows scripts created on the local machine to run without restriction, while requiring that scripts downloaded from the internet (or other remote locations) be digitally signed by a trusted publisher [3][5]. 2. Digitally Sign Your Scripts: For production, enterprise, or CI/CD environments, the most secure approach is to sign your automation scripts with a code-signing certificate [5]. This allows you to enforce a stricter policy, such as AllSigned, ensuring that only verified, trusted code can execute [5]. 3. Use the Process Scope: If you must bypass the policy for a specific, trusted automation task, you can set the execution policy for the current process only, rather than globally [6][7]. This limits the exposure to the duration of that specific script execution [8][7]. You can do this by using: powershell.exe -ExecutionPolicy RemoteSigned -Scope Process -File script.ps1 4. Implement Defense-in-Depth: Because execution policies are not a security boundary, rely on broader security controls such as AppLocker, Windows Defender Application Control (WDAC), and monitoring tools (e.g., AMSI, logging) to detect and block malicious activity, rather than relying on the execution policy alone [9][10]. In summary, while -ExecutionPolicy Bypass is a functional way to run scripts, it removes a layer of safety. Prioritize signing your scripts and using the RemoteSigned policy to maintain a balance between security and operational requirements [5][2].

Citations:

🏁 Script executed:

git ls-files make_image.bat