Opening a PDF Without Leaving a Single Trace on macOS [Devlog #9]

#rust #tauri #pdf #privacy

All tests run on an 8-year-old MacBook Air.

Open a PDF on macOS and the OS quietly logs it in at least five places:

Recent Documents (NSDocumentController)
Finder's recent items (LSSharedFileList)
App cache directory
QuickLook thumbnail cache
Rendering cache under ~/Library/Caches/

Sanctuary Viewer blocks all of them.

Blocking Recent Documents

macOS auto-registers opened files via NSDocumentController. Override it on the Swift side:

@implementation HiyokoSanctuaryDocument

- (void)addToRecentDocuments {
    // intentionally empty
}

+ (BOOL)autosavesInPlace {
    return NO;
}

@end

No disk writes — memory only

pub struct SanctuaryViewer {
    page_cache: HashMap>,
    temp_files: Vec,
}

impl Drop for SanctuaryViewer {
    fn drop(&mut self) {
        // Delete any temp files on close
        for path in &self.temp_files {
            let _ = std::fs::remove_file(path);
        }
        // Zero out in-memory cache
        self.page_cache.clear();
    }
}

Drop fires the moment the viewer closes. No manual cleanup required.

The tricky part: QuickLook

macOS runs QuickLook in the background and writes thumbnails to ~/Library/Caches/com.apple.QuickLook.thumbnailcache automatically.

The fix: never pass the file path to QuickLook. All rendering goes through Ghost Engine in memory — the file path never surfaces to any macOS API that would trigger caching.