v0.16.6

Workspace-root hardening. Several ways the workspace root could end up wider than anything you chose — up to and including your entire home directory — are closed. If you use [workspace] auto_attach, or plumb has ever attached to a directory you did not explicitly pin, upgrade.

Full detail for every item is in CHANGELOG.md — this is the readable summary.

Security

• Your home directory can no longer become the workspace root by accident. A dotfiles repository checked out at $HOME is a common setup, and the synthetic-root fallback walked up to the nearest .git with no guard — so a session seeded anywhere beneath it resolved the workspace to $HOME itself. The whole home directory then became a single read-write root, putting every SSH key, browser profile and credential file inside the boundary, with nothing in the tool call to say the workspace had widened. Four routes led there and all are closed: a dotfiles repo, an incidental tool path (one read_file of ~/.zshrc), a persisted pin replayed on reconnect, and a ~/.plumb left behind by an earlier build's auto_attach_persist.

  Two details worth knowing. $HOME is matched by filesystem identity across both the $HOME variable and the OS user database, so a symlinked spelling cannot slip past and a client that empties or repoints HOME — the daemon inherits its spawner's environment — cannot disarm the guard. And "you asked for this" now means the seed is your workspace argument: a call carrying both a path and a workspace (relevant_memories, write_memory) no longer lets an incidental path be treated as a deliberate declaration.

  If an earlier build left a ~/.plumb behind: touch ~/.plumb/context.md keeps that directory's memories and topology index and silences the warning, or remove ~/.plumb to discard it — which deletes those too. auto_attach_persist can no longer create one there.

  Known limit, stated rather than left to be discovered: a root that contains home directories — /Users, /home, /, or /System/Volumes/Data on macOS — is not guarded. Three implementations were built and all three were defeated by macOS path aliasing (/System/Volumes/Data/Users is /Users, and compares unequal under every resolve-then-compare test). Shipping a guard the platform walks straight past would be worse than not claiming one, so it is tracked as #306 with the full evidence.

• A deleted pinned workspace no longer rehydrates to the enclosing repository. A removed git worktree is the standing case: the persisted pin was restored by walking up to the nearest thing that looked like a project, silently widening the session's write surface past anything you chose.

Fixed

• A relative workspace root can no longer brick a session. Detection resolved a relative root against the daemon's working directory while the boundary policy declined to, so the two halves disagreed: session_start({workspace: "."}) succeeded and then refused every path — including the workspace's own files — with an error naming the workspace as . and advising the re-pin that had just happened. Six routes can set the pinned root; the invariant now lives where all six converge. Pass an absolute path: . means your directory, which is not the one a shared daemon resolves.

• The two functions answering "is this the same place?" have become one (#273). They disagreed on exactly the cases each was written for — one anchored a relative path to the daemon's working directory, and cleaned .. lexically before resolving symlinks, which is how a check and a syscall end up naming different files. A new internal/arch rule now fails a test if path canonicalisation is ever reimplemented, rather than waiting for a reviewer to notice. The sweep that rule forced found five copies, not the two the issue named — including one that started two concurrent xcodebuild flows for a single project reached by two spellings.

• Also: two agents on one project reached by different path spellings no longer disagree about where they are; a relative root in your global config now grants nothing rather than granting access relative to the daemon's working directory.

Added

• C#, Elixir and Scala are indexed by the topology Map, completing the language-coverage programme — every language in the registry now has an extractor.
• cherry-pick is admitted to the git tool's destructive tier; the MCP protocol version is negotiated at initialize.

---

Install: brew install plumbkit/plumb/plumb, or grab a binary below (macOS and Linux, arm64 and amd64). Existing Homebrew users: brew update && brew upgrade plumb.