@@ -188,6 +188,7 @@ FOUNDATION_SRCS = \
     src/foundation/str_intern.c \
     src/foundation/log.c \
     src/foundation/str_util.c \
+    src/foundation/workspace.c \
     src/foundation/platform.c \
     src/foundation/system_info.c \
     src/foundation/slab_alloc.c \
@@ -453,6 +454,7 @@ TEST_FOUNDATION_SRCS = \
     tests/test_str_intern.c \
     tests/test_log.c \
     tests/test_str_util.c \
+    tests/test_workspace.c \
     tests/test_platform.c \
     tests/test_diagnostics.c \
     tests/test_dump_verify.c \
 
@@ -670,7 +670,7 @@ codebase-memory-mcp config reset auto_index              # reset to default
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `CBM_ALLOWED_ROOT` | *(unset)* | Restrict `index_repository` to paths within this directory. When set, a `repo_path` that resolves (after symlink / `..` resolution) outside this root is refused; unset imposes no restriction. Useful when the server may be driven by an untrusted caller, e.g. agentic or multi-tenant deployments. |
+| `CBM_ALLOWED_ROOT` | *(unset)* | Confine `index_repository` to paths within this directory. When set, a `repo_path` that resolves (after symlink / `..` resolution) outside this root is refused, and the same check now applies to the graph UI's `POST /api/index` route rather than only to the MCP tool. Unset imposes no *containment* restriction — but see the always-on limits below, which apply whether or not this is set. Useful when the server may be driven by an untrusted caller, e.g. agentic or multi-tenant deployments. |
 | `CBM_CACHE_DIR` | `~/.cache/codebase-memory-mcp` | Override the database storage directory. All project indexes and config are stored here. One account can use only one canonical cache root at a time; close active CBM sessions/commands before switching it. |
 | `CBM_DIAGNOSTICS` | `false` | Set to `1` or `true` to enable the shared daemon's periodic `snapshot.json` and retained `trajectory.ndjson` below a fresh owner-private directory in the system temp directory. Exact paths are logged by `diagnostics.start`. |
 | `CBM_DOWNLOAD_URL` | *(GitHub releases)* | Override the download URL for updates. Used for testing or self-hosted deployments. |
 
@@ -172,8 +172,8 @@ sha256sum -c checksums.txt
 
 | Version | Supported |
 |---------|-----------|
-| Latest `0.8.x` | Yes — security fixes land in the newest release |
-| < 0.8   | No — please upgrade to the latest release |
+| Latest `0.9.x` | Yes — security fixes land in the newest release |
+| < 0.9   | No — please upgrade to the latest release |
 
 Only the latest release is supported. Security fixes are shipped in a new
 patched release rather than backported to older versions; upgrading to the
 
@@ -116,7 +116,7 @@ These environment variables affect runtime behavior:
 
 | Variable | Default | Description |
 |---|---|---|
-| `CBM_ALLOWED_ROOT` | *(unset)* | Restrict `index_repository` to paths within this directory. When set, a `repo_path` that resolves (after symlink / `..` resolution) outside this root is refused; unset imposes no restriction. Useful when the server may be driven by an untrusted caller (agentic or multi-tenant deployments). |
+| `CBM_ALLOWED_ROOT` | *(unset)* | Confine `index_repository` to paths within this directory. When set, a `repo_path` that resolves (after symlink / `..` resolution) outside this root is refused, and the same check now applies to the graph UI's `POST /api/index` route rather than only to the MCP tool. Unset imposes no *containment* restriction — but see the always-on limits below, which apply whether or not this is set. Useful when the server may be driven by an untrusted caller, e.g. agentic or multi-tenant deployments. |
 | `CBM_CACHE_DIR` | `~/.cache/codebase-memory-mcp` | Override the cache directory used for indexes, `_config.db`, and UI `config.json`. |
 | `CBM_DIAGNOSTICS` | `false` | Enable periodic `snapshot.json` and retained `trajectory.ndjson` below a fresh owner-private directory in the system temp directory. The daemon records the randomized paths in the `diagnostics.start` discovery record (a single JSON line) in `${CBM_CACHE_DIR}/logs/cbm-daemon.log`; that one record is emitted even when `CBM_LOG_LEVEL` suppresses ordinary logging, so the paths always remain discoverable. |
 | `CBM_DOWNLOAD_URL` | GitHub releases | Override the update download URL. |
@@ -125,6 +125,25 @@ These environment variables affect runtime behavior:
 
 Environment used by daemon-owned components—such as diagnostics, daemon logging, and process-wide indexing resource limits—is captured from the first daemon-backed session that starts the daemon. Later sessions join the existing process and cannot replace those values. To change them, close every daemon-backed session, update the relevant agent configurations consistently, and restart a session. `CBM_ALLOWED_ROOT` remains session-specific, a conflicting `CBM_CACHE_DIR` is rejected, and one-shot CLI commands use their own current environment without starting the daemon.
 
+
+### Roots that are always refused
+
+Independently of `CBM_ALLOWED_ROOT`, some directories are refused as an indexing
+root because they are too broad or too sensitive to index as a unit:
+
+- a filesystem root, a Windows drive root, or a UNC share root;
+- a top-level system tree — `/etc`, `/var`, `/usr`, `/home`, `/Users`, and on
+  Windows `C:\Windows`, `C:\Users`, `C:\ProgramData`, `C:\Program Files`;
+- your home directory itself (directories *below* it are fine);
+- a credential directory at any depth — `.ssh`, `.aws`, `.gnupg`, `.kube`,
+  `.docker`, `.netrc`, `.git-credentials`, `.password-store`, macOS `Keychains`.
+
+Two limits are worth stating plainly. This constrains *scope*, not
+*sensitivity*: inside a root that is allowed, every file the process can read may
+be indexed and later returned. And the credential list is a denylist, so it
+raises the cost of a mistake rather than closing the class — a directory it does
+not name is permitted.
+
 ## 5. Agent and Editor Integration Files
 
 The `install` command can also write MCP entries and instruction blocks into agent/editor config files such as Claude Code, Codex, Gemini, VS Code, Cursor, Zed, and others.
 
@@ -326,26 +326,36 @@ static char *extract_callee_from_fields(CBMArena *a, TSNode node, const char *so
 }
 
 // Haskell/OCaml: extract callee from apply/infix nodes.
+/* Apply-style node kinds whose function head can nest another application. */
+static bool fp_is_apply_kind(const char *kind) {
+    return strcmp(kind, "apply") == 0 || strcmp(kind, "application_expression") == 0 ||
+           strcmp(kind, "exp_apply") == 0;
+}
+
 static char *extract_fp_callee(CBMArena *a, TSNode node, const char *source, const char *nk) {
-    if (strcmp(nk, "apply") == 0 || strcmp(nk, "application_expression") == 0 ||
-        strcmp(nk, "exp_apply") == 0) {
-        if (ts_node_child_count(node) > 0) {
-            TSNode callee = ts_node_child(node, 0);
-            const char *ck = ts_node_type(callee);
-            if (strcmp(ck, "identifier") == 0 || strcmp(ck, "variable") == 0 ||
-                strcmp(ck, "constructor") == 0 || strcmp(ck, "value_path") == 0 ||
-                /* PureScript: exp_apply's function head is an `exp_name` whose
-                 * text is the (possibly qualified) function name. */
-                strcmp(ck, "exp_name") == 0) {
-                return cbm_node_text(a, callee, source);
-            }
-            /* Curried application `f a b` nests exp_apply/apply — descend the
-             * function head to recover the leftmost callee. */
-            if (strcmp(ck, "exp_apply") == 0 || strcmp(ck, "apply") == 0 ||
-                strcmp(ck, "application_expression") == 0) {
-                return extract_fp_callee(a, callee, source, ck);
-            }
+    /* Curried application `f a b …` nests one apply node per argument on the
+     * function head. Walk that left spine iteratively: recursing once per
+     * application makes stack use follow the parse-tree depth of the indexed
+     * file, and a long enough chain runs out. The other descendant finders in
+     * this tree are already depth-bounded.
+     *
+     * Reassigning node/nk before continuing leaves the fall-through below
+     * operating on the innermost apply node — where the recursive form left it. */
+    while (fp_is_apply_kind(nk) && ts_node_child_count(node) > 0) {
+        TSNode callee = ts_node_child(node, 0);
+        const char *ck = ts_node_type(callee);
+        if (strcmp(ck, "identifier") == 0 || strcmp(ck, "variable") == 0 ||
+            strcmp(ck, "constructor") == 0 || strcmp(ck, "value_path") == 0 ||
+            /* PureScript: exp_apply's function head is an `exp_name` whose
+             * text is the (possibly qualified) function name. */
+            strcmp(ck, "exp_name") == 0) {
+            return cbm_node_text(a, callee, source);
+        }
+        if (!fp_is_apply_kind(ck)) {
+            break;
         }
+        node = callee;
+        nk = ck;
     }
     if (strcmp(nk, "infix") == 0 || strcmp(nk, "infix_expression") == 0) {
         TSNode op = ts_node_child_by_field_name(node, TS_FIELD("operator"));
 
@@ -280,7 +280,7 @@ CBM_TEST_BINARY="$WATCHDOG_BINARY" bash "$ROOT/tests/test_worker_watchdog.sh"
 # still exits nonzero for the user-facing tool error, but the supervisor must
 # preserve that response instead of misreporting exit_nonzero as a file crash.
 echo "=== Step 5c: worker error-response transport regression ==="
-bash "$ROOT/tests/test_worker_error_response.sh"
+CBM_TEST_BINARY="$WATCHDOG_BINARY" bash "$ROOT/tests/test_worker_error_response.sh"
 
 # Step 5d (#1388) is DELIBERATELY NOT GATING HERE — see
 # tests/test_hook_conflict_notice.sh for the full what-was-tried record.
 
@@ -432,13 +432,36 @@ void cbm_lex_free(cbm_lex_result_t *r) {
  *  PARSER
  * ══════════════════════════════════════════════════════════════════ */
 
+/* The WHERE grammar descends once per nested '(' and once per NOT, so parse
+ * depth follows the query text rather than anything bounded. A few tens of KB of
+ * either exhausts the stack before any semantic limit applies. 256 is far past
+ * any hand-written or generated query while leaving the stack untouched. */
+enum { CYPHER_MAX_PARSE_DEPTH = 256 };
+
 typedef struct {
     const cbm_token_t *tokens;
     int count;
     int pos;
+    int depth; /* current recursive-descent depth; see CYPHER_MAX_PARSE_DEPTH */
     char error[CBM_SZ_512];
 } parser_t;
 
+/* Enter one level of recursive descent. Returns false when the cap is hit, in
+ * which case the caller must return NULL without recursing. */
+static bool parse_depth_enter(parser_t *p) {
+    if (p->depth >= CYPHER_MAX_PARSE_DEPTH) {
+        snprintf(p->error, sizeof(p->error), "expression nested deeper than %d levels",
+                 CYPHER_MAX_PARSE_DEPTH);
+        return false;
+    }
+    p->depth++;
+    return true;
+}
+
+static void parse_depth_leave(parser_t *p) {
+    p->depth--;
+}
+
 static const cbm_token_t *peek(parser_t *p) {
     if (p->pos >= p->count) {
         return &p->tokens[p->count - SKIP_ONE]; /* EOF */
@@ -1203,7 +1226,11 @@ static cbm_expr_t *parse_condition_expr(parser_t *p) {
 /* Atom: ( expr ) | condition */
 static cbm_expr_t *parse_atom_expr(parser_t *p) { // NOLINT(misc-no-recursion)
     if (match(p, TOK_LPAREN)) {
+        if (!parse_depth_enter(p)) {
+            return NULL;
+        }
         cbm_expr_t *e = parse_or_expr(p);
+        parse_depth_leave(p);
         expect(p, TOK_RPAREN);
         return e;
     }
@@ -1213,7 +1240,11 @@ static cbm_expr_t *parse_atom_expr(parser_t *p) { // NOLINT(misc-no-recursion)
 /* NOT: NOT atom | atom */
 static cbm_expr_t *parse_not_expr(parser_t *p) { // NOLINT(misc-no-recursion)
     if (match(p, TOK_NOT)) {
+        if (!parse_depth_enter(p)) {
+            return NULL;
+        }
         cbm_expr_t *child = parse_not_expr(p);
+        parse_depth_leave(p);
         return child ? expr_not(child) : NULL;
     }
     return parse_atom_expr(p);
 
@@ -39,17 +39,31 @@ struct cbm_gitignore {
 
 /* ── Pattern matching engine ─────────────────────────────────────── */
 
+/* Backtracking budget. `**` retries the remainder at every position, and
+ * consecutive literal + `**` groups multiply, so cost is exponential in the
+ * number of groups. Patterns come from a committed .gitignore / .cbmignore and
+ * every discovered path is matched against every pattern, so a small ignore file
+ * can make discovery take unbounded time. Cap the match steps per
+ * (pattern, path) pair.
+ *
+ * Exhausting the budget reports "no match", so a pathological pattern fails to
+ * ignore rather than ignoring the wrong files: the file gets indexed, which is
+ * the recoverable direction. The cap is far above any real pattern — ordinary
+ * globs finish in tens of steps. */
+enum { GI_MATCH_MAX_STEPS = 20000 };
+
 /* Forward declaration for recursive calls. */
-static bool glob_match(const char *pat, const char *str); // NOLINT(misc-no-recursion)
+static bool glob_match(const char *pat, const char *str,
+                       int *budget); // NOLINT(misc-no-recursion)
 
 /* Match a ** (doublestar-slash) pattern: try rest at every / boundary. */
 static bool glob_match_doublestar_slash(const char *pat, // NOLINT(misc-no-recursion)
-                                        const char *str) {
-    if (glob_match(pat, str)) {
+                                        const char *str, int *budget) {
+    if (glob_match(pat, str, budget)) {
         return true;
     }
     for (const char *s = str; *s; s++) {
-        if (*s == '/' && glob_match(pat, s + SKIP_ONE)) {
+        if (*s == '/' && glob_match(pat, s + SKIP_ONE, budget)) {
             return true;
         }
     }
@@ -58,9 +72,9 @@ static bool glob_match_doublestar_slash(const char *pat, // NOLINT(misc-no-recur
 
 /* Match a ** (doublestar) followed by non-slash: try at every position. */
 static bool glob_match_doublestar_any(const char *pat, // NOLINT(misc-no-recursion)
-                                      const char *str) {
+                                      const char *str, int *budget) {
     for (const char *s = str;; s++) {
-        if (glob_match(pat, s)) {
+        if (glob_match(pat, s, budget)) {
             return true;
         }
         if (!*s) {
@@ -70,9 +84,10 @@ static bool glob_match_doublestar_any(const char *pat, // NOLINT(misc-no-recursi
 }
 
 /* Match a * (single star): match any sequence not containing /. */
-static bool glob_match_star(const char *pat, const char *str) { // NOLINT(misc-no-recursion)
+static bool glob_match_star(const char *pat, const char *str,
+                            int *budget) { // NOLINT(misc-no-recursion)
     for (const char *s = str;; s++) {
-        if (glob_match(pat, s)) {
+        if (glob_match(pat, s, budget)) {
             return true;
         }
         if (!*s || *s == '/') {
@@ -119,24 +134,29 @@ static bool glob_match_charclass(const char *pat, char ch, const char **pat_out)
  * Handles: * (non-slash), ** (any path), ? (single non-slash), [class]
  */
 /* Handle ** at current position. Returns match result. */
-static bool glob_match_doublestar(const char *pat, const char *str) { // NOLINT(misc-no-recursion)
+static bool glob_match_doublestar(const char *pat, const char *str,
+                                  int *budget) { // NOLINT(misc-no-recursion)
     if (pat[GI_CHAR_IDX2] == '/') {
-        return glob_match_doublestar_slash(pat + GI_SKIP3, str);
+        return glob_match_doublestar_slash(pat + GI_SKIP3, str, budget);
     }
     if (pat[GI_CHAR_IDX2] == '\0') {
         return true;
     }
-    return glob_match_doublestar_any(pat + GI_CHAR_IDX2, str);
+    return glob_match_doublestar_any(pat + GI_CHAR_IDX2, str, budget);
 }
 
-static bool glob_match(const char *pat, const char *str) { // NOLINT(misc-no-recursion)
+static bool glob_match(const char *pat, const char *str,
+                       int *budget) { // NOLINT(misc-no-recursion)
+    if (--*budget <= 0) {
+        return false; /* budget exhausted — see GI_MATCH_MAX_STEPS */
+    }
     while (*pat && *str) {
         if (pat[0] == '*' && pat[GI_CHAR_IDX1] == '*') {
-            return glob_match_doublestar(pat, str);
+            return glob_match_doublestar(pat, str, budget);
         }
 
         if (*pat == '*') {
-            return glob_match_star(pat + SKIP_ONE, str);
+            return glob_match_star(pat + SKIP_ONE, str, budget);
         }
 
         if (*pat == '?') {
@@ -171,6 +191,13 @@ static bool glob_match(const char *pat, const char *str) { // NOLINT(misc-no-rec
     return *pat == '\0' && *str == '\0';
 }
 
+/* Match one pattern against one path with a fresh backtracking budget. Not
+ * recursive itself — it seeds the budget and hands off to the engine. */
+static bool glob_match_bounded(const char *pat, const char *str) {
+    int budget = GI_MATCH_MAX_STEPS;
+    return glob_match(pat, str, &budget);
+}
+
 /* ── Pattern parsing ─────────────────────────────────────────────── */
 
 static void gi_add_pattern(cbm_gitignore_t *gi, const char *line, int len) {
@@ -320,7 +347,7 @@ cbm_gitignore_t *cbm_gitignore_load(const char *path) {
 
 /* Match a non-rooted pattern against basename and path suffixes. */
 static bool match_unrooted(const char *pattern, const char *rel_path, const char *basename) {
-    if (glob_match(pattern, basename)) {
+    if (glob_match_bounded(pattern, basename)) {
         return true;
     }
     if (!strchr(rel_path, '/')) {
@@ -329,7 +356,7 @@ static bool match_unrooted(const char *pattern, const char *rel_path, const char
     /* Try matching at every / boundary */
     const char *s = rel_path;
     while (*s) {
-        if (glob_match(pattern, s)) {
+        if (glob_match_bounded(pattern, s)) {
             return true;
         }
         const char *next = strchr(s, '/');
@@ -359,7 +386,7 @@ int cbm_gitignore_match_result(const cbm_gitignore_t *gi, const char *rel_path,
             continue;
         }
 
-        bool this_match = p->rooted ? glob_match(p->pattern, rel_path)
+        bool this_match = p->rooted ? glob_match_bounded(p->pattern, rel_path)
                                     : match_unrooted(p->pattern, rel_path, basename);
 
         if (this_match) {
 
@@ -271,6 +271,23 @@ bool cbm_validate_shell_arg(const char *s) {
     return true;
 }
 
+bool cbm_validate_shell_path_arg(const char *path) {
+    if (!cbm_validate_shell_arg(path)) {
+        return false;
+    }
+#ifdef _WIN32
+    /* cmd.exe expands %VAR% and, with delayed expansion, !VAR! inside the
+     * double quotes these commands use; ^ is its escape character. None of the
+     * three can be neutralised by quoting, so reject them outright. */
+    for (const char *p = path; *p; p++) {
+        if (*p == '%' || *p == '!' || *p == '^') {
+            return false;
+        }
+    }
+#endif
+    return true;
+}
+
 bool cbm_validate_project_name(const char *name) {
     if (!name || !*name)
         return false;
 
@@ -57,6 +57,16 @@ char **cbm_str_split(CBMArena *a, const char *s, char delim, int *out_count);
  * Returns true if safe, false if the string contains shell metacharacters. */
 bool cbm_validate_shell_arg(const char *s);
 
+/* Validate a filesystem path that will be interpolated into a shell command.
+ * Everything cbm_validate_shell_arg rejects, plus the cmd.exe expansion
+ * metacharacters % ! ^ on Windows: a path reaching `git -C "%s"` through
+ * cmd.exe would otherwise get %VAR% / delayed-!VAR! expansion applied to it.
+ *
+ * Use this — not cbm_validate_shell_arg — for every path that crosses into a
+ * shell command, so the three git shell-out sites cannot drift apart again.
+ * Returns true if safe. */
+bool cbm_validate_shell_path_arg(const char *path);
+
 /* Validate a project name is safe for file path construction.
  * Allows: alphanumeric, dash, underscore, dot (but not leading dot or dot-dot).
  * Rejects: path separators (/ \), directory traversal (..), and control chars.