I'm building a sandboxed macOS app (Developer ID, App Sandbox enabled) with a File Provider extension that exposes on-demand placeholder files under ~/Library/CloudStorage/<domain>/ .
Expected: The app writes the placeholder file URLs to NSPasteboard.general . The user presses ⌘V in Finder, and Finder fetches the contents on demand via fetchContents .
Observed:
• Finder's own copy and paste of the same placeholders works, and fetchContents is called at paste time as expected.
• When the sandboxed app writes the URLs to the pasteboard, CFPasteboard logs: Sandbox extension creation failed ... (error -20) . The paste does not happen.
• Writing NSPasteboardItem with .fileURL strings instead of NSURL objects produces the same error.
• Adding com.apple.security.temporary-exception.files.absolute-path.read-only for the CloudStorage domain path fixes it.
Questions:
- Is there a supported way for a sandboxed app to put File Provider placeholder URLs on the pasteboard without the temporary-exception entitlement?
- Is the temporary-exception entitlement acceptable for Mac App Store distribution, or is it only viable for Developer ID builds?
- Should the app grant itself access another way, for example through a security-scoped bookmark or by using NSFileProviderManager APIs?