[UTMapp-bot]

Stack 1/2 — the bottom of the stack; #8133 is stacked on this. Merge the stack bottom-up. (Replaces #8132, which was opened from a fork and cannot be part of a stack.)

Connecting a USB drive to a QEMU virtual machine takes the device away from macOS at once. A volume that was still mounted went away with it, as if the drive had been unplugged: macOS never got to unmount it, which for a volume that can be written to gives the "Disk Not Ejected Properly" warning of #5650.

UTM now asks macOS to unmount the volumes of the device first and connects it only when that worked. If a volume is in use, the device is left with macOS and an alert names the volume. This happens on every way to connect a device on macOS: the USB menu, the prompt when a device is plugged in, auto connect on start, and scripting.

The idea and a first version are from @giovariot in #7928 and the commit is in their name. This is a rewrite: it finds the device by vendor, product, bus, port and serial number, names the volume and not its device node (disk12s2) in the message, and has no timeout or error-text matching of its own.

Resolves #5650

Testing

Tested by an AI agent on a MacBook Pro M2 Max, macOS 27.2 (26B123), with a Debug build of the macOS scheme.

Setup: a Seagate 4 TB drive (0bc2:ab28) on a 5 Gb/s link with one NTFS volume, "New Volume", which macOS mounts read-only. Guest: Ubuntu 26.04 arm64 on a USB 3.0 controller; the drive is connected with the scripting connect command. A small DiskArbitration client outside UTM prints unmount requests, unmounts and disk disappearances, and can refuse unmount requests to stand in for a volume that is in use.

• Before (main): on connect the disks disappear with the volume still mounted. There is no unmount request.

  disappeared: disk12 -
  disappeared: disk12s2 New Volume
  

• After: the volume is unmounted first, then the device goes to the guest, which sees the 3.6 TB disk and reads from it at 103 MB/s.

  unmount requested: disk12s2 New Volume
  unmounted: disk12s2 New Volume
  disappeared: disk12 -
  

  After a disconnect macOS mounts the volume again within 4 to 14 s, and stopping the VM returns the drive.
• After, the unmount refused: connect fails with "'New Volume' could not be ejected because it is in use. Close anything that is using it and try again." The volume stays mounted on the Mac and the guest gets no disk.
• After, the device already connected: connect fails with CocoaSpice's "Cannot connect an already connected usb device" and nothing is unmounted.
• After, connect right after a disconnect, before macOS has mounted the volume again: works.

The static checks pass.

Not tested:

• The "Disk Not Ejected Properly" warning itself. It needs a volume that can be written to, and the volume at hand is read-only; the missing unmount request above is the cause of it.
• The USB menu, the prompt and auto connect in the VM window. They call the same function as scripting; I cannot send clicks to the window.
• A drive with several volumes, and two drives of the same model.

Notes from review

• UTM's sandbox lets it unmount a volume but not mount one (kDAReturnNotPrivileged). So before anything is unmounted, canRedirectUsbDevice is asked whether the connect can work. If the connect still fails afterwards, the volume stays unmounted until the drive is replugged or mounted in Disk Utility. The same goes for a drive with several volumes when a later one is in use.
• A volume that macOS mounts between the check and the capture (a drive connected within a second or two of being plugged in) is still taken away mounted.
• There is no way to connect a drive whose volume cannot be unmounted.
• There is no unit test: the code needs a real USB device and DiskArbitration.