The plugin file capability with swap-detection arrives with the off-by-default hook-module feature.
What
The plugin file capability refuses paths that escape the project root, non-regular files and hard links, and re-checks the opened file against what it saw before opening so a file swapped in mid-check is caught. It arrives with the plugin hook-module feature, off unless the server enables it.
Details
- Writes additionally refuse the project's config and git directories, plugin and marketplace folders, the session config directory, and home tool folders including
.ssh,.aws,.kube,.gnupg,.docker,.npm,.bun,.rustup,.m2,.gradle, and launchd/systemd/autostart locations. - Win32 short names and paths reached via relocation variables such as
XDG_CONFIG_HOME,ZDOTDIR,BASH_ENV,GIT_CONFIG_GLOBAL,NPM_CONFIG_USERCONFIGandKUBECONFIGare refused too. - The refusals themselves are unconditional path checks, with no separate switch.
Evidence
the open landed on a file the check did not see
Strings lifted out of the shipped bundle, so the claim above can be checked against them.