#213 macOS: hand shared files from the extension to the running app

[Anonymous]

Originally created by: kristofferR

The macOS share extension needs to hand a selected payload to Carrier without exposing filesystem paths to Messenger or losing a cold-start request.

Implemented design

• The extension opens carrier://share-pasteboard/<uuid>, where the lowercase UUID names one unguessable private pasteboard. Carrier accepts only that exact URL shape.
• AppKit pasteboard access is moved to the main thread and uses ownership-aware Objective-C bindings. Carrier reads the string under the real public.utf8-plain-text type, then clears and globally releases the one-time pasteboard.
• The complete payload is treated as untrusted and validated before delivery: non-empty selection, advertised count limit, 100 MB aggregate payload cap, UTF-8-bounded traversal-free names, and no partial acceptance.
• One fresh payload can remain parked across cold start, page load, or a webview rebuild for up to two minutes. A second share cannot silently replace it. The focused non-Settings Messenger window is preferred, Carrier is raised, and any Messenger window retries delivery after loading.

Verification

Verified through Finder and the system NSSharingService path. Native logs showed the capability handoff being accepted; Carrier came to the foreground and the payload reached the visible composer.

Implemented by [#220] and consumed by [#214]. Part of [#217].

[Anonymous]

Originally posted by: kristofferR

Completed by [#220]. The one-time pasteboard capability handoff, native validation, cold-start parking, and foreground delivery are merged and verified.

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed