Changelog

What each release changed for the person running Plexus. The wire contract is versioned separately and moves far more slowly — see the protocol.

TIP

Tagged releases and their full commit history live on GitHub.

0.10.0 — coding agents stay inside the directory you authorized

Coding agents run inside Plexus's own jail. Claude Code and Codex no longer rely on their own sandboxes. Plexus wraps each run in a kernel jail of its own and checks that it holds before the tool starts.

• One directory, really. By default a run reads and writes only inside the directory you authorized, keeps its temp files there, and reaches the network for its model. The tool's own login works; its settings, hooks and plugins stay read-only.
• Your other sessions stay yours. A jailed run writes its own session and cannot read the rest of the tool's home: Claude Code's transcripts, prompt history, pastes, file snapshots and auto-memory, and Codex's rollouts, history, shell snapshots and sqlite stores are out of its reach. claude --resume and codex exec resume still work on the run's own session. One Linux residual is listed in Known limitations.
• Verified before every launch. A canary runs under the identical jail first and must fail to read or write outside it. If it can't prove that, the call fails and the tool never starts. There is no silent fallback.
• The result says what the run could reach. The fixed sandboxed: true is gone. Each result carries isolation, naming the policy and the reach, and whether the jail was enforced for that run. Callers that read sandboxed should read isolation instead.
• Host access, when you want it. A new Execution policy setting sits next to Real launch. Switch a source to Host access and it runs as if you had started it in your terminal, with your files, credentials and network. It asks you to confirm, the source shows a HOST ACCESS badge while it is on, and every switch is audited.
• The "reads are not confined" warning is gone from the console, because it is no longer true.

Desktop apps can ship Plexus inside them. A standalone native runtime and a management CLI travel with the app, keep working after the app moves into place, and need no Bun at runtime. A trusted desktop process manages sources, grants and approvals through scoped JSON commands, and can open the console for you without you copying the connection key. See host integration.

• Events follow the grant. A client receives only its own events, and only while the grant still covers them. Client /events now requires a registered PAT and its session; a client that subscribed anonymously must send credentials.
• File sources guard Plexus's own state. The first-party file sources refuse the private management directories of Plexus and of the hosting app, so file access never becomes a way to read the admin credential.

Also

• The console holds its layout in narrow windows: approval cards no longer collapse into one-character columns, tables scroll inside their own frame, and Realtime fits long agent names.

0.9.1 — reach the browser you are actually logged into

attach now works against your everyday Chrome, and a third route arrives.

• The chrome://inspect toggle is supported properly. Since Chrome 136 the binary refuses --remote-debugging-port on the default profile, so that toggle is the only way into a logged-in browser — and it serves a different surface than the classic flag. Both shapes now sit behind one connection facade.
• A Chrome extension, as a third transport. Consent is granted once at install instead of per connection, and it works on your normal profile. It is a transport and nothing else: the allowlist, the approval and the audit stay in the gateway, where a page cannot argue with them.
• Clicking and typing use real input events. Custom form widgets and rich-text editors that ignore direct DOM writes now actually receive what an agent sends — and a click is refused when something else is covering the target.
• Tabs are filtered before they are listed: on a browser with 25 tabs open, only the ones on authorized domains appear at all.

0.9.0 — browser control

Drive a real Chrome. A new execute-class source that navigates, reads, clicks, types, screenshots and uploads — over the DevTools Protocol, with no Puppeteer or Playwright dependency and no browser download.

• The owner's decision is which browser: a fresh empty profile that is nobody, or the browser they are logged into. That is what sets the blast radius; everything else is detail.
• A domain allowlist you control, checked against the real target URL and re-checked before every act — because Chrome's own consent authorizes the browser, not a set of sites.
• The page surface is open (arbitrary JavaScript and raw page-scoped CDP included), because inside a page an agent may already touch, click + type are already full user agency. The browser-global half of CDP is withheld, which is what keeps the allowlist meaningful.
• Upload is jailed to one directory you name, and refuses everything until you name one.

See expose a source.

0.8.1

• The audit records which transport shape an invoke actually used.

0.8.0 — long calls stop blocking, and the console says more

• Async invoke handles. A capability that takes minutes returns a handle immediately instead of holding the connection; the agent picks the result up when it is ready.
• An Activity summary band in the console — what has been happening, at a glance.
• Failure output from sandboxed runs is redacted before it reaches an agent.
• Agent-protocol hardening: denials now carry enough for an agent to correct itself without guessing, rather than needing an oracle.

0.7.0 — first public release

The release the project opened with: the trust model settled, and enough real sources on the machine to be worth connecting an agent to.

• Your personal data, as first-party sources. Apple Notes, Mail, Contacts, Photos and Shortcuts joined Calendar and Reminders, alongside read-only browser tabs/bookmarks/history and Obsidian search + append.
• An agent sees only the subset you authorized. Discovery stopped broadcasting a catalogue: what an agent can scan is what its owner granted it, and a request from outside that subset is denied outright rather than pended for you to rubber-stamp.
• Side-effecting capabilities are per-use by default. Selecting a write or execute at connect no longer makes it standing — each call asks. Standing is a deliberate, per-capability opt-in, off by default and double-confirmed.
• Sessions fail closed, and a revoke is a complete stop rather than a delayed one.
• Four ways to install an agent, including an in-context form for agents with no filesystem and no shell — plus quick starts that walk the whole loop end to end.
• Coding agents run in their own native sandbox rather than a second one wrapped around it.

Before 0.7

The build-up, in one paragraph each.

• 0.6.0-rc.1 — the first public release candidate: the desktop/runtime redesign, the unified authorization and trust model, the What I expose view built on Connector → Source → Capability, the first Apple sources, and per-source health.
• 0.4.0 — capability sources became managed: add, enable, reconfigure and remove them live from the console or the CLI, with no flags and no restart. Reconfiguring a source's security surface purges its grants.
• 0.3.x — Claude Code and Codex integrations, so mainstream coding agents could actually use what Plexus exposes; Obsidian read-write through Obsidian's own Local REST API.
• 0.2.x — the extension ecosystem: a published manifest spec, user-authored skills and workflows, and a first run on macOS that gets you from install to a connected agent.
• 0.1.x — the gateway itself, the M0 protocol contract, and the decision everything since rests on: a human-in-the-loop authorizer by default, so an agent can never self-grant a write or an execute.