It had been about 15 hours since I left the company and put my Mac to sleep. When I unlocked my Mac the next day when I went to work, it happened.

Hi Quinn, I encountered the same issue and posted the question [here].(https://developer.apple.com/forums/thread/781284) Did this issue already get fixed?

Hi Quinn, the ES client is a system extension, launched by launchd. I think it should more like a daemon.

There seems have UI alignment bug for the new forums UI in my comments...

Hi Eskimo! I think what I really care about here is avoid endless waiting for the XPC Service response. As you said, the XPC client just see if its message is handled, but if the XPC Service not running, the service response seems never come... how can I avoid endless waiting?

Thanks Quinn, as the document said, it's not a good idea to infer the high-level 'Copy' action from low-level operations. But I believe there should have requirements to monitor the user copy action by Endpoint Security, such as there is a security policy not allowed a special file be copied. Just like the user log in/out event, is there a plan to support 'copy' in ES framework?

I found the sample code 'EmptyFS' & 'MFSLives' are invalid in the Developing for VFS, anywhere I can find the resources?

Yes, it not a good way to create ES client to just handle this issue. But maybe the only way?

Thanks for your replay. But I think store file in LibraryDirectory is just suit for iOS user, but on Mac, user still can access his LibraryDirectory. I also tried start name with a dot, but when user press 'cmd+shift+.', the hidden files will be shown...