Module shell_choosers

Expand description

Choosers the session shell draws itself, for sessions whose apps reach no desktop portal (a provider’s headless guest).

The launcher hands every app a connection to the shell’s chooser service (FD_ENV) and names the app and its workspace on it before the sandbox starts, so the shell knows who asks without trusting the app. Requests and replies are newline-delimited JSON (Request, Reply). The shell shows its own file chooser. Legacy path results remain limited to existing grants; owner-confirmed contents selections expose only bounded bytes on this connection, never a directory grant or a replayable host path. When nobody is at the computer it answers Reply::Nobody and the app falls back to the unattended picker ([crate::unattended_picker]).

Links go the same way (ShellLink::opener): the shell opens a link in the app that claims its scheme, as its own search does, and answers Reply::Unclaimed for one no app it knows opens, which the app then hands to its desktop’s opener.

Structs§

ChosenApp: The app the person chose in the shell’s app chooser.
FilePortalGrant: A private, read-only selection on one authenticated chooser connection. The token names an already-open regular file, never a replayable host path.
Filter: One entry of the chooser’s file-type control.
Handshake: The launcher’s first frame on a new connection: who the app is.
ShellLink: One connection to the session shell, which its choosers and its link opener share. The connection closes when the last of them is dropped.

Enums§

PickMode: Which chooser a Request::Pick opens.
Reply: Shell → app. Every reply names the request it answers.
Request: App → shell.

Constants§

CONTENT_CHUNK_BYTES
FD_ENV: Where the launcher tells the app its connection’s descriptor number.
MAX_CONTENT_BYTES
MAX_CONTENT_FILES
MAX_FRAME_BYTES: Longest frame either side accepts.
PROTOCOL: Version of the launcher’s first frame and of Request/Reply.
SERVICE: The service’s name: its socket is <runtime>/tilo/services/chooser.sock.

Functions§

inherited_opener: ShellLink::opener over the inherited connection.
inherited_picker: ShellLink::picker over the inherited connection.
picker: ShellLink::picker over a new connection on stream.