v2.4.0

cpak 2.4 adds native file grants for applications that need a user-selected file or folder without mounting the complete host home.

File access

Applications can keep their normal file chooser. cpak validates the package policy, attaches each accepted selection to the running namespace, and returns a path below /run/cpak/grants. Exact files are read-only by default, parent-folder access is a separate choice, and persistent grants can be inspected or revoked with cpak grant.

GTK and GIO chooser calls use a restricted desktop-bus proxy, so packages do not need unrestricted session-bus access. The grant channel passes opened file descriptors to the mount worker instead of trusting application-supplied host paths.

Desktop dialogs

The official binaries include Adwaita, GTK, KDE and Qt adapters for cpak confirmations and progress windows, with the built-in interface as a fallback. Distributions can select the embedded adapters and default backend through Make options or Go build tags.

Full Changelog: v2.3.3...v2.4.0