`gum file` renders an empty picker when a directory (or any of its descendants) carries the macOS `com.apple.provenance` extended attribute

[moonpetaldev]

Note: This issue description was written with the help of AI, as I had difficulty explaining the problem clearly and providing enough technical detail on my own. The underlying bug and repro steps are real and were verified manually.

Description

gum file renders a completely empty picker - no entries, nothing navigable, just the footer keybind hints (↑↓ navigate • esc close • enter select) - when browsing a directory tree where any entry (file or subdirectory) carries the macOS com.apple.provenance extended attribute.

This attribute is a SIP-protected security attribute macOS automatically applies to files/directories created by certain processes (e.g. a shell script writing files, or aws s3 cp downloading one). It cannot be removed by the user - xattr -d com.apple.provenance <path> silently no-ops, and even sudo xattr -d fails without disabling SIP.

Critically, the blank rendering isn't confined to the tagged entry itself: a parent directory that has no provenance attribute of its own also renders completely blank if just one of its children does. This suggests the picker's per-entry stat/read pass errors on the tagged entry and fails closed for the entire listing, rather than skipping just that entry.

Steps to reproduce

1. On macOS, create a directory and a file inside it via a normal script, e.g.:

   mkdir -p /tmp/repro/sub
   aws s3 cp s3://some-bucket/some-file /tmp/repro/sub/file.txt

   (Any process that causes macOS to tag the new files works - this reproduced consistently via aws s3 cp.)
2. Confirm the tag is present:

   xattr -l /tmp/repro/sub
   # com.apple.provenance:

3. Run:

   gum file --all /tmp/repro

Expected behavior

The picker lists sub/ (and, on navigating in, file.txt) normally.

Actual behavior

The picker shows an empty list area - only the footer help line renders. Nothing is selectable or navigable. This happens even though a plain ls -la / find on the same directory shows the entries fine with normal permissions and no symlinks involved.

Environment

• gum version: 0.17.0
• OS: macOS 26.2 (build 25C56)
• Arch: arm64
• Installed via Homebrew (/opt/homebrew/bin/gum)

Workaround

Avoid gum file for trees that may contain provenance-tagged entries. Listing files manually and piping into gum choose (e.g. find <dir> -type f | gum choose) is unaffected and works as expected.