diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 7eea51c..4ac26cd 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.7.11"
+  ".": "0.7.12"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 35ec00e..ef08476 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.7.12](https://github.com/vibecook-dev/truffle/compare/truffle-v0.7.11...truffle-v0.7.12) (2026-08-03)
+
+
+### Bug Fixes
+
+* **sidecar:** confine static routes to rooted filesystem ([13a283b](https://github.com/vibecook-dev/truffle/commit/13a283b5df7e61fe11e5cf7cb07cf74033fc4f6a))
+
 ## [0.7.11](https://github.com/vibecook-dev/truffle/compare/truffle-v0.7.10...truffle-v0.7.11) (2026-07-28)
 
 
diff --git a/Cargo.lock b/Cargo.lock
index 355bd8d..084a600 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5909,7 +5909,7 @@ dependencies = [
 
 [[package]]
 name = "truffle"
-version = "0.7.11"
+version = "0.7.12"
 dependencies = [
  "serde_json",
  "truffle-core",
@@ -5937,7 +5937,7 @@ dependencies = [
 
 [[package]]
 name = "truffle-cli"
-version = "0.7.11"
+version = "0.7.12"
 dependencies = [
  "chrono",
  "clap",
@@ -5972,7 +5972,7 @@ dependencies = [
 
 [[package]]
 name = "truffle-core"
-version = "0.7.11"
+version = "0.7.12"
 dependencies = [
  "base64 0.22.1",
  "blake3",
@@ -6006,7 +6006,7 @@ dependencies = [
 
 [[package]]
 name = "truffle-napi"
-version = "0.7.11"
+version = "0.7.12"
 dependencies = [
  "napi",
  "napi-build",
@@ -6020,7 +6020,7 @@ dependencies = [
 
 [[package]]
 name = "truffle-sidecar"
-version = "0.7.11"
+version = "0.7.12"
 dependencies = [
  "serde_json",
  "sha2 0.11.0",
diff --git a/Cargo.toml b/Cargo.toml
index ba6f753..9c29d4c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -112,8 +112,8 @@ tauri-plugin = { version = "2", features = ["build"] }
 ureq = "3"
 
 # Internal crates
-truffle-core = { version = "0.7.11", path = "crates/truffle-core" }       # x-release-please-version
-truffle-sidecar = { version = "0.7.11", path = "crates/truffle-sidecar" } # x-release-please-version
+truffle-core = { version = "0.7.12", path = "crates/truffle-core" }       # x-release-please-version
+truffle-sidecar = { version = "0.7.12", path = "crates/truffle-sidecar" } # x-release-please-version
 
 # Dev / test
 # (tokio dev features are added per-crate via `features = [...]`)
diff --git a/crates/truffle-cli/Cargo.toml b/crates/truffle-cli/Cargo.toml
index bee62f6..f5fecbe 100644
--- a/crates/truffle-cli/Cargo.toml
+++ b/crates/truffle-cli/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "truffle-cli"
-version = "0.7.11" # x-release-please-version
+version = "0.7.12" # x-release-please-version
 edition.workspace = true
 description = "CLI tool for Truffle mesh networking (Node API)"
 license.workspace = true
diff --git a/crates/truffle-core/Cargo.toml b/crates/truffle-core/Cargo.toml
index 313ac6d..64229de 100644
--- a/crates/truffle-core/Cargo.toml
+++ b/crates/truffle-core/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "truffle-core"
-version = "0.7.11" # x-release-please-version
+version = "0.7.12" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 description = "Truffle mesh networking core (clean architecture)"
diff --git a/crates/truffle-napi/Cargo.toml b/crates/truffle-napi/Cargo.toml
index 64515fc..8ec9170 100644
--- a/crates/truffle-napi/Cargo.toml
+++ b/crates/truffle-napi/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "truffle-napi"
-version = "0.7.11" # x-release-please-version
+version = "0.7.12" # x-release-please-version
 edition.workspace = true
 description = "NAPI-RS bindings for truffle-core (published to npm, not crates.io)"
 license.workspace = true
diff --git a/crates/truffle-napi/npm/darwin-arm64/package.json b/crates/truffle-napi/npm/darwin-arm64/package.json
index 5d2bffd..ffc0b5f 100644
--- a/crates/truffle-napi/npm/darwin-arm64/package.json
+++ b/crates/truffle-napi/npm/darwin-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-native-darwin-arm64",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "cpu": [
     "arm64"
   ],
diff --git a/crates/truffle-napi/npm/darwin-x64/package.json b/crates/truffle-napi/npm/darwin-x64/package.json
index 023c1e7..d165167 100644
--- a/crates/truffle-napi/npm/darwin-x64/package.json
+++ b/crates/truffle-napi/npm/darwin-x64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-native-darwin-x64",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "cpu": [
     "x64"
   ],
diff --git a/crates/truffle-napi/npm/linux-arm64-gnu/package.json b/crates/truffle-napi/npm/linux-arm64-gnu/package.json
index 3256577..1e2c697 100644
--- a/crates/truffle-napi/npm/linux-arm64-gnu/package.json
+++ b/crates/truffle-napi/npm/linux-arm64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-native-linux-arm64-gnu",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "cpu": [
     "arm64"
   ],
diff --git a/crates/truffle-napi/npm/linux-x64-gnu/package.json b/crates/truffle-napi/npm/linux-x64-gnu/package.json
index 58a69b7..c7ca0c4 100644
--- a/crates/truffle-napi/npm/linux-x64-gnu/package.json
+++ b/crates/truffle-napi/npm/linux-x64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-native-linux-x64-gnu",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "cpu": [
     "x64"
   ],
diff --git a/crates/truffle-napi/npm/win32-x64-msvc/package.json b/crates/truffle-napi/npm/win32-x64-msvc/package.json
index 1915a7a..13dae9b 100644
--- a/crates/truffle-napi/npm/win32-x64-msvc/package.json
+++ b/crates/truffle-napi/npm/win32-x64-msvc/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-native-win32-x64-msvc",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "cpu": [
     "x64"
   ],
diff --git a/crates/truffle-napi/package-lock.json b/crates/truffle-napi/package-lock.json
index 20b487d..ef12794 100644
--- a/crates/truffle-napi/package-lock.json
+++ b/crates/truffle-napi/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@vibecook/truffle-native",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@vibecook/truffle-native",
-      "version": "0.7.11",
+      "version": "0.7.12",
       "license": "MIT",
       "devDependencies": {
         "@napi-rs/cli": "3.6.2"
diff --git a/crates/truffle-napi/package.json b/crates/truffle-napi/package.json
index 2ec8081..a56d453 100644
--- a/crates/truffle-napi/package.json
+++ b/crates/truffle-napi/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-native",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "description": "Mesh networking for local-first apps, built on Tailscale (native addon)",
   "main": "index.js",
   "types": "index.d.ts",
diff --git a/crates/truffle-sidecar/Cargo.toml b/crates/truffle-sidecar/Cargo.toml
index 0340ffb..85bb25a 100644
--- a/crates/truffle-sidecar/Cargo.toml
+++ b/crates/truffle-sidecar/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "truffle-sidecar"
-version = "0.7.11" # x-release-please-version
+version = "0.7.12" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 description = "Auto-downloads the truffle mesh networking sidecar binary at build time"
diff --git a/crates/truffle/Cargo.toml b/crates/truffle/Cargo.toml
index 2eb9d90..bf33539 100644
--- a/crates/truffle/Cargo.toml
+++ b/crates/truffle/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "truffle"
-version = "0.7.11" # x-release-please-version
+version = "0.7.12" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 description = "P2P mesh networking for your devices, built on Tailscale"
@@ -13,8 +13,8 @@ categories = ["network-programming"]
 workspace = true
 
 [dependencies]
-truffle-core = { version = "0.7.11", path = "../truffle-core" }       # x-release-please-version
-truffle-sidecar = { version = "0.7.11", path = "../truffle-sidecar" } # x-release-please-version
+truffle-core = { version = "0.7.12", path = "../truffle-core" }       # x-release-please-version
+truffle-sidecar = { version = "0.7.12", path = "../truffle-sidecar" } # x-release-please-version
 
 [dev-dependencies]
 serde_json.workspace = true
diff --git a/npm/truffle-sidecar-darwin-arm64/package.json b/npm/truffle-sidecar-darwin-arm64/package.json
index b94c561..090188c 100644
--- a/npm/truffle-sidecar-darwin-arm64/package.json
+++ b/npm/truffle-sidecar-darwin-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-sidecar-darwin-arm64",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "description": "Truffle sidecar binary for macOS ARM64 (Apple Silicon)",
   "license": "MIT",
   "author": "James Yong",
diff --git a/npm/truffle-sidecar-darwin-x64/package.json b/npm/truffle-sidecar-darwin-x64/package.json
index 0ded402..bb0bce6 100644
--- a/npm/truffle-sidecar-darwin-x64/package.json
+++ b/npm/truffle-sidecar-darwin-x64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-sidecar-darwin-x64",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "description": "Truffle sidecar binary for macOS x64 (Intel)",
   "license": "MIT",
   "author": "James Yong",
diff --git a/npm/truffle-sidecar-linux-arm64/package.json b/npm/truffle-sidecar-linux-arm64/package.json
index 7348765..8133a47 100644
--- a/npm/truffle-sidecar-linux-arm64/package.json
+++ b/npm/truffle-sidecar-linux-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-sidecar-linux-arm64",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "description": "Truffle sidecar binary for Linux ARM64",
   "license": "MIT",
   "author": "James Yong",
diff --git a/npm/truffle-sidecar-linux-x64/package.json b/npm/truffle-sidecar-linux-x64/package.json
index b00e0ad..9c22896 100644
--- a/npm/truffle-sidecar-linux-x64/package.json
+++ b/npm/truffle-sidecar-linux-x64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-sidecar-linux-x64",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "description": "Truffle sidecar binary for Linux x64",
   "license": "MIT",
   "author": "James Yong",
diff --git a/npm/truffle-sidecar-win32-x64/package.json b/npm/truffle-sidecar-win32-x64/package.json
index 6033c1a..4bd7f4e 100644
--- a/npm/truffle-sidecar-win32-x64/package.json
+++ b/npm/truffle-sidecar-win32-x64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-sidecar-win32-x64",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "description": "Truffle sidecar binary for Windows x64",
   "license": "MIT",
   "author": "James Yong",
diff --git a/packages/core/package.json b/packages/core/package.json
index 0cf2aea..8144e98 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "description": "Mesh networking for local-first apps, built on Tailscale",
   "license": "MIT",
   "author": "James Yong",
diff --git a/packages/react/package.json b/packages/react/package.json
index e3352ec..a12f513 100644
--- a/packages/react/package.json
+++ b/packages/react/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle-react",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "description": "React hooks for Truffle mesh networking",
   "license": "MIT",
   "author": "James Yong",