Explicit as in when you run a new app it does not have access to any of your files and there is no way for it to gain access without you, the user, giving it.

>Does clicking a file count?

Yes, clicking a file from the file picker counts.

>Asking for code reformatting across the project?

You can grant access to a directory in that case.

>How long does access last? How is it revoked?

It can last forever or until the application is closed. There is room to choose how exactly it could work.

>If the user runs "reformat project" once, then gets a new version, are try going to have any warning that "reformat project" is about to encrypt every file it touches?

That would be up to the design.