Ask the user to grant a filesystem to this app — the §8.6 powerbox. The app
asks; the HOST shows the user their spaces and, for the chosen one, its PROJECT
FOLDERS (§8.7). The user picks ONE project — so a shared space opens scoped to
just that project, never the whole space — and makes an EXPLICIT read-only vs
read-write decision (there is no default). The app never sees the list; it
resolves with the single granted mount, or rejects with a SpaceError
(cancelled) if declined. The granted scope is enforced host-side: the mount
is chroot'd to the project folder and ro-limited accordingly, so paths
outside the project are unnameable and writes on a ro grant fail EROFS.
A project folder is the macOS-bundle-like unit an app works in inside a space;
the host records which app a folder belongs to (a .immediately.run/ sidecar),
so the picker can surface the app's own projects or let the user create a new
one. Observe the granted access via SandboxMount.mode.
Backend-general (§3.5): the picker offers whatever mounts the user has (today,
their spaces). Returns the granted mount by its universal id.
Ask the user to grant a filesystem to this app — the §8.6 powerbox. The app asks; the HOST shows the user their spaces and, for the chosen one, its PROJECT FOLDERS (§8.7). The user picks ONE project — so a shared space opens scoped to just that project, never the whole space — and makes an EXPLICIT read-only vs read-write decision (there is no default). The app never sees the list; it resolves with the single granted mount, or rejects with a SpaceError (
cancelled) if declined. The granted scope is enforced host-side: the mount is chroot'd to the project folder andro-limited accordingly, so paths outside the project are unnameable and writes on arogrant failEROFS.A project folder is the macOS-bundle-like unit an app works in inside a space; the host records which app a folder belongs to (a
.immediately.run/sidecar), so the picker can surface the app's own projects or let the user create a new one. Observe the granted access via SandboxMount.mode.Backend-general (§3.5): the picker offers whatever mounts the user has (today, their spaces). Returns the granted mount by its universal id.