#217 Share into Carrier: appear in the OS share sheets (macOS + Windows)

[Anonymous]

Originally created by: kristofferR

Carrier can share media out through [#218], but the reverse also needs first-class OS integration: pick a photo in Finder, Photos, or Explorer, choose Carrier from Share, and attach it to the open Messenger conversation.

Neither OS lists an app in its share sheet for free. macOS requires a bundled native Share Extension (.appex); Windows requires package identity plus a shareTarget declaration. Both terminate in the same page-side composer delivery path.

Architecture

• macOS: share sheet → sandboxed Carrier Share.appex → one-time UUID-named private pasteboard → carrier://share-pasteboard/<uuid> capability URL → native consume and validation → validated bytes delivered to the visible Messenger composer.
• Windows: Share pane → sparse-package activation of carrier.exe → DataPackageView read and validation → the same composer delivery path.
• No filesystem path crosses into the remote page. Native and page boundaries independently enforce count, aggregate-size, UTF-8 name, traversal, and freshness limits.

The private pasteboard is intentional. App-group containers reject ad-hoc-signed builds when the group prefix cannot match a signing team; the pasteboard works for both development and release signatures. Its unguessable name is carried only in the capability URL, consumed once, cleared, and globally released.

Sub-issues

• [x] [#211] macOS share extension: receive files from the system share sheet
• [x] [#212] Bundle and sign the macOS share extension in releases
• [x] [#213] macOS: hand shared files from the extension to the running app
• [x] [#214] Attach shared files into the Messenger composer
• [ ] [#215] Windows: register Carrier as a Share Target (sparse MSIX)
• [ ] [#216] Windows: handle share-target activation and forward to the composer

Status and sequencing

• [#220] merged [#211], [#213], and [#214] together. It is verified through the real Finder share sheet: Carrier came forward and a PNG rendered as an unsent composer attachment.
• [#212] is complete: release builds nested-sign the appex, and Apple notarization plus downloaded-artifact validation pass.
• [#215] remains blocked on the Windows Authenticode certificate decision tracked by [#186]; [#216] follows it.
• Linux remains out of scope because there is no cross-desktop share-target standard.

Ref [#218] for share-out.

[Anonymous]

Originally posted by: kristofferR

[!NOTE]
🤖 Claude Opus 5.5 responding on behalf of Kristoffer

Closing the share-into-Carrier epic. The macOS half is done: [#211], [#212], [#213] and [#214] landed through [#220], and release builds sign and notarize the extension. The Windows half stays open as [#215] and [#216], which wait on the signing decision in [#186].

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed

[Anonymous]

Originally posted by: kristofferR

[!NOTE]
🤖 Claude Opus 5.5 responding on behalf of Kristoffer

Update: the Windows half (#215, [#216]) is now closed as not planned, so sharing into Carrier is macOS only.