FR-PLAT-LIN-3 — A portal directory picker, not a manifest change #29

New Issue

2026-09-05T16:20:14Z

dtourolle commented

2026-09-05 16:20:14 +00:00

FR-PLAT-LIN-3 — Flatpak. Packaged, not satisfied — and it cannot be satisfied by packaging.

What exists

A Flatpak manifest granting no filesystem permission of any kind, AppStream metainfo, and docs/distribution.md.

Why that does not meet the requirement

Inside the sandbox:

A folder library is chosen by typing an absolute path, and nothing in the tree calls the FileChooser portal.
$HOME holds only .var/app/....
dr_plat::volumes() reads /proc/self/mountinfo, so a card mounted on the host is invisible to a sandboxed process.

So a Flatpak build of DarkRoom today can reach a Nextcloud account and essentially nothing else on disk.

The fix

An ashpd directory picker beside LocalStorage::grant — not a change to the manifest. The portal returns a handle the sandbox honours, which is the Linux analogue of the SAF work in #25 and worth designing alongside it.

Also

No Flatpak has been built here — flatpak-builder is not installed — so the permission set is reasoned, not observed.

Portal directory picker wired into the launch flow.
volumes() reports what the sandbox can actually reach.
Build the Flatpak and confirm the permission set empirically.

See docs/outstanding.md §5.

**FR-PLAT-LIN-3 — Flatpak.** Packaged, not satisfied — and **it cannot be satisfied by packaging**. ## What exists A Flatpak manifest granting no filesystem permission of any kind, AppStream metainfo, and `docs/distribution.md`. ## Why that does not meet the requirement Inside the sandbox: - A folder library is chosen by **typing an absolute path**, and nothing in the tree calls the FileChooser portal. - `$HOME` holds only `.var/app/...`. - `dr_plat::volumes()` reads `/proc/self/mountinfo`, so a card mounted on the host is invisible to a sandboxed process. So a Flatpak build of DarkRoom today can reach a Nextcloud account and essentially nothing else on disk. ## The fix An **`ashpd` directory picker beside `LocalStorage::grant`** — not a change to the manifest. The portal returns a handle the sandbox honours, which is the Linux analogue of the SAF work in #25 and worth designing alongside it. ## Also **No Flatpak has been built here** — `flatpak-builder` is not installed — so the permission set is reasoned, not observed. - [ ] Portal directory picker wired into the launch flow. - [ ] `volumes()` reports what the sandbox can actually reach. - [ ] Build the Flatpak and confirm the permission set empirically. See `docs/outstanding.md` §5.