@dotdotgod/claude-code 0.6.3 → 0.6.5

package/README.md

@@ -80,7 +80,7 @@ The plugin starts a local stdio MCP server. It exposes `execute` and `execute_fi
 
 Dotdotgod execution tools share a 10 MiB stdout/stderr capture ceiling per command. Crossing that ceiling terminates the child process and reports `captureLimitExceeded`; direct stdout and stderr excerpts are each capped at 1 MiB. Their child environments preserve compatibility-oriented inheritance after filtering runtime injection variables; this reports filtered names without values but does not isolate ordinary inherited credentials. Large output is indexed before retrieval in the ignored project-local `.dotdotgod/context/context.sqlite` FTS5 store, and searches return bounded excerpts. The store uses WAL, a bounded busy timeout, and transactional source replacement, expiry, and purge. Structural Markdown/JSON chunks, bounded typo-tolerant trigram candidates, reciprocal-rank fusion, and title/path/proximity signals improve retrieval while provenance and `instructionAuthority: "none"` identify retrieved text as non-authoritative data.
 
-The MCP `index` tool accepts project-contained files or bounded directories with deterministic traversal, configurable resource limits, explicit extension/path exclusions, and symlinks skipped by default. These capture and retrieval rules apply when Claude calls the dotdotgod MCP tools; Claude Code's built-in Bash tool keeps its native behavior. URL indexing performs application-level HTTP(S), DNS/address, connected-peer, redirect, and byte-limit validation. Accepted HTML is normalized as bounded untrusted text without browser rendering, JavaScript, subresource loading, or link following by default. The server bundles no browser renderer, so browser opt-in fails unless a host injects that capability. These controls are not a network sandbox or complete prompt-injection prevention. See the [`@dotdotgod/context` npm package](https://www.npmjs.com/package/@dotdotgod/context), its [GitHub README](https://github.com/dotdotgod/dotdotgod-kit/tree/main/packages/context), and the [maintained execution contract](https://github.com/dotdotgod/dotdotgod-kit/blob/main/docs/spec/CONTEXT_EXECUTION.md) for the complete runtime behavior.
+The MCP `index` tool accepts files or explicitly requested bounded directories, including external paths, with deterministic traversal, configurable resource limits, explicit extension/path exclusions, and symlinks skipped by default. These capture and retrieval rules apply when Claude calls the dotdotgod MCP tools; Claude Code's built-in Bash tool keeps its native behavior. URL indexing performs application-level HTTP(S), DNS/address, connected-peer, redirect, and byte-limit validation. Accepted HTML is normalized as bounded untrusted text without browser rendering, JavaScript, subresource loading, or link following by default. The server bundles no browser renderer, so browser opt-in fails unless a host injects that capability. These controls are not a network sandbox or complete prompt-injection prevention. See the [`@dotdotgod/context` npm package](https://www.npmjs.com/package/@dotdotgod/context), its [GitHub README](https://github.com/dotdotgod/dotdotgod-kit/tree/main/packages/context), and the [maintained execution contract](https://github.com/dotdotgod/dotdotgod-kit/blob/main/docs/spec/CONTEXT_EXECUTION.md) for the complete runtime behavior.
 
 Bundled hooks mark project load as required at session start, record successful source/config edits, and deny broad verification or handoff commands until matching graph impact succeeds. Denial asks Claude to call the required MCP tool and retry; hooks do not silently change one tool type into another. See [`hooks/README.md`](https://github.com/dotdotgod/dotdotgod-kit/blob/main/packages/claude-code/hooks/README.md) for lifecycle and trust boundaries.
 

package/commands/dd/plan.md

@@ -14,7 +14,7 @@ Task request: `$ARGUMENTS`
 
 ## CLI Context
 
-For focused documentation routing, run `dotdotgod query <root> "<focus>" --limit 30 --json`. Run `dotdotgod config <root> --json` when memory-area policy, documentation exclusions, or Plan Mode writable paths affect the plan. If the CLI is unavailable, continue from README indexes and focused file reads.
+For focused documentation routing, run `dotdotgod query <root> "<focus>" --limit 30 --json`. Run `dotdotgod config <root> --json` when memory-area policy or documentation routing/exclusions affect the plan. If the CLI is unavailable, continue from README indexes and focused file reads.
 
 ## Goal
 

package/mcp/cli.mjs

@@ -855,6 +855,15 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 var DEFAULT_EMBEDDING_PROFILE = Object.freeze({ provider: "local", model: "Xenova/multilingual-e5-small" });
 var EMBEDDING_PROVIDERS = Object.freeze(["local", "openai-compatible", "ollama"]);
+var DEFAULT_INPUT_FORMAT = Object.freeze({ queryPrefix: "query: ", documentPrefix: "passage: " });
+function embeddingInputFormat(profile, label = "embedding") {
+  if (profile.inputFormat === void 0) return { ...DEFAULT_INPUT_FORMAT };
+  const format = profile.inputFormat;
+  if (!format || typeof format !== "object" || Array.isArray(format) || Object.keys(format).some((key) => !Object.hasOwn(DEFAULT_INPUT_FORMAT, key)) || Object.keys(DEFAULT_INPUT_FORMAT).some((key) => typeof format[key] !== "string")) {
+    throw new Error(`${label}.inputFormat must contain exactly queryPrefix and documentPrefix strings.`);
+  }
+  return { queryPrefix: format.queryPrefix, documentPrefix: format.documentPrefix };
+}
 function readJson(path, label) {
   if (!existsSync(path)) return null;
   try {
@@ -865,7 +874,7 @@ function readJson(path, label) {
 }
 function validateEmbeddingProfile(profile, label = "embedding") {
   if (!profile || typeof profile !== "object" || Array.isArray(profile)) throw new Error(`${label} must be an object.`);
-  const allowed = /* @__PURE__ */ new Set(["provider", "model", "baseUrl", "apiKey", "apiKeyEnv"]);
+  const allowed = /* @__PURE__ */ new Set(["provider", "model", "baseUrl", "apiKey", "apiKeyEnv", "inputFormat"]);
   const unknown = Object.keys(profile).find((key) => !allowed.has(key));
   if (unknown) throw new Error(`${label}.${unknown} is not supported.`);
   if (!EMBEDDING_PROVIDERS.includes(profile.provider)) throw new Error(`${label}.provider must be local, openai-compatible, or ollama.`);
@@ -883,6 +892,7 @@ function validateEmbeddingProfile(profile, label = "embedding") {
     if (!["http:", "https:"].includes(url.protocol)) throw new Error(`${label}.baseUrl must use HTTP or HTTPS.`);
     if (url.username || url.password) throw new Error(`${label}.baseUrl must not contain credentials.`);
   }
+  embeddingInputFormat(profile, label);
   return { ...profile, model: profile.model.trim(), ...profile.baseUrl ? { baseUrl: profile.baseUrl.replace(/\/$/, "") } : {} };
 }
 function sanitizeEmbeddingProfile(profile) {
@@ -890,8 +900,13 @@ function sanitizeEmbeddingProfile(profile) {
   return { ...safe, ...apiKey ? { apiKey: "[redacted]" } : {} };
 }
 function embeddingProfileIdentity(profile) {
-  const { apiKey, apiKeyEnv, ...identity2 } = profile;
-  return identity2;
+  return {
+    provider: profile.provider,
+    model: profile.model,
+    ...profile.baseUrl !== void 0 ? { baseUrl: profile.baseUrl } : {},
+    inputFormatVersion: 1,
+    inputFormat: embeddingInputFormat(profile)
+  };
 }
 function resolveEmbeddingProfile(root = ".", options = {}) {
   const home = options.home ?? homedir();
@@ -938,9 +953,6 @@ var DEFAULT_LOAD_POLICY = {
     exclude: ["docs/plan", "docs/archive"]
   }
 };
-var DEFAULT_PLAN_MODE_POLICY = {
-  writablePaths: ["docs/plan/**", "docs/archive/**"]
-};
 var DEFAULT_IMPACT_RANKING_POLICY = {
   connectionCap: 80,
   memoryCap: 20,
@@ -1115,8 +1127,8 @@ function cloneLoadPolicy(policy = DEFAULT_LOAD_POLICY) {
     }
   };
 }
-function clonePlanModePolicy(policy = DEFAULT_PLAN_MODE_POLICY) {
-  return { writablePaths: [...policy.writablePaths ?? DEFAULT_PLAN_MODE_POLICY.writablePaths] };
+function clonePlanModePolicy() {
+  return {};
 }
 function normalizeDocumentationRoot(value = DEFAULT_DOCUMENTATION_ROOT) {
   return String(value).trim().replaceAll("\\", "/").replace(/^\.\//, "").replace(/\/{2,}/g, "/").replace(/^\/+|\/+$/g, "");
@@ -1130,7 +1142,7 @@ function isValidDocumentationRoot(value) {
 }
 function defaultMemoryConfig({ documentationRoot = DEFAULT_DOCUMENTATION_ROOT } = {}) {
   const root = normalizeDocumentationRoot(documentationRoot);
-  return { source: "default", documentation: { root }, areas: memoryAreasForRoot(root).map(cloneArea), traceability: cloneTraceabilityPolicy({ ...DEFAULT_TRACEABILITY_POLICY, required: [`${root}/spec/**`] }), validation: cloneValidationPolicy(), impactRanking: cloneImpactRankingPolicy(), referenceExpansion: cloneReferenceExpansionPolicy(), load: cloneLoadPolicy({ ...DEFAULT_LOAD_POLICY, documentationSummary: { exclude: [`${root}/plan`, `${root}/archive`] } }), planMode: clonePlanModePolicy({ writablePaths: [`${root}/plan/**`, `${root}/archive/**`] }) };
+  return { source: "default", documentation: { root }, areas: memoryAreasForRoot(root).map(cloneArea), traceability: cloneTraceabilityPolicy({ ...DEFAULT_TRACEABILITY_POLICY, required: [`${root}/spec/**`] }), validation: cloneValidationPolicy(), impactRanking: cloneImpactRankingPolicy(), referenceExpansion: cloneReferenceExpansionPolicy(), load: cloneLoadPolicy({ ...DEFAULT_LOAD_POLICY, documentationSummary: { exclude: [`${root}/plan`, `${root}/archive`] } }), planMode: clonePlanModePolicy() };
 }
 function normalizePathPattern(value = "") {
   return value.replaceAll("\\", "/").replace(/^\.\//, "").replace(/\/+$|^\/+/, "");
@@ -1191,10 +1203,8 @@ function isSecretLikePathPattern(value = "") {
   const normalized = normalizePathPattern(value);
   return /(^|\/)(\.env|\.npmrc|\.pypirc|id_rsa|id_dsa|id_ed25519|credentials?|secrets?)(\.|\/|$)/i.test(normalized);
 }
-function normalizePlanModePolicy(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return clonePlanModePolicy();
-  const writablePaths = raw.writablePaths === void 0 ? DEFAULT_PLAN_MODE_POLICY.writablePaths : [...new Set((Array.isArray(raw.writablePaths) ? raw.writablePaths : []).map(normalizePathPattern))];
-  return clonePlanModePolicy({ writablePaths });
+function normalizePlanModePolicy(_raw) {
+  return clonePlanModePolicy();
 }
 function normalizeLoadPolicy(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return cloneLoadPolicy();
@@ -1339,10 +1349,6 @@ Fix: ${fix ?? `update ${field2 ?? "this config"} in ${file} to match the expecte
   if (planMode !== void 0) {
     if (!planMode || typeof planMode !== "object" || Array.isArray(planMode)) {
       add("PLAN_MODE_CONFIG_INVALID", "planMode", "Expected an object.");
-    } else if (planMode.writablePaths !== void 0) {
-      const paths = planMode.writablePaths;
-      if (!Array.isArray(paths)) add("PLAN_MODE_CONFIG_INVALID_WRITABLE_PATHS", "planMode.writablePaths", "Expected an array of documentation path strings.");
-      else if (paths.some((value) => !isValidPathPattern(value) || typeof value !== "string" || value.trim().startsWith("/") || !normalizePathPattern(value).startsWith(`${normalizeDocumentationRoot(data.documentation?.root ?? DEFAULT_DOCUMENTATION_ROOT)}/`) || normalizePathPattern(value).startsWith(`${normalizeDocumentationRoot(data.documentation?.root ?? DEFAULT_DOCUMENTATION_ROOT)}/.`) || isSecretLikePathPattern(value))) add("PLAN_MODE_CONFIG_INVALID_WRITABLE_PATHS", "planMode.writablePaths", "Expected safe repository-relative paths under documentation.root using exact paths or /** subtree patterns.");
     }
   }
   const referenceExpansion = data.referenceExpansion;
@@ -3804,7 +3810,6 @@ function formatConfigOutput(payload) {
   lines.push(`- load pinned paths: ${(payload.config.load?.pinnedPaths ?? []).join(", ") || "none"}`);
   lines.push(`- load pinned bodies: ${(payload.config.load?.pinnedBodies ?? []).join(", ") || "none"}`);
   lines.push(`- load documentation summary exclude: ${(payload.config.load?.documentationSummary?.exclude ?? []).join(", ") || "none"}`);
-  lines.push(`- plan mode writable paths: ${(payload.config.planMode?.writablePaths ?? []).join(", ") || "none"}`);
   const lowSignal = payload.config.referenceExpansion?.fuzzy?.lowSignal ?? { terms: [], add: [], remove: [] };
   lines.push(`- fuzzy low-signal terms: ${(lowSignal.terms ?? []).join(", ") || "none"} (add: ${(lowSignal.add ?? []).join(", ") || "none"}; remove: ${(lowSignal.remove ?? []).join(", ") || "none"})`);
   if (errors.length > 0) {
@@ -3954,7 +3959,12 @@ async function postJson(url, body, profile) {
     const response = await fetch(url, { method: "POST", headers: { "content-type": "application/json", ...key ? { authorization: `Bearer ${key}` } : {} }, body: JSON.stringify(body), signal: controller.signal });
     if (!response.ok) {
       const category = response.status === 401 || response.status === 403 ? "authentication" : response.status === 429 ? "rate limit" : `HTTP ${response.status}`;
-      throw new Error(`Remote embedding ${category} failure.`);
+      const error = new Error(`Remote embedding ${category} failure.`);
+      if (response.status === 400 || response.status === 413) {
+        const body2 = (await response.text()).slice(0, 8192);
+        error.tokenLimit = /(?:exceed\w*[\s\S]{0,120}tokens?|tokens?[\s\S]{0,120}(?:exceed|limit|too (?:long|many))|maximum context length)/i.test(body2);
+      }
+      throw error;
     }
     try {
       return await response.json();
@@ -3981,20 +3991,35 @@ function remoteEmbedder(profile) {
     return ordered.map(normalize);
   };
 }
+function withInputFormat(embed, profile) {
+  const format = embeddingInputFormat(profile);
+  return (texts, role) => {
+    if (role !== void 0 && role !== "query" && role !== "document") throw new Error("Embedding role must be query or document.");
+    return embed(role === void 0 ? texts : texts.map((text) => format[`${role}Prefix`] + text));
+  };
+}
 async function createEmbedder(profile) {
   const embed = profile.provider === "local" ? await localEmbedder(profile) : remoteEmbedder(profile);
-  return async (texts) => {
+  async function embedBatch(texts) {
     if (texts.length === 0) return [];
-    const rows = await embed(texts);
+    let rows;
+    try {
+      rows = await embed(texts);
+    } catch (error) {
+      if (!error.tokenLimit || texts.length === 1) throw error;
+      const middle = Math.ceil(texts.length / 2);
+      rows = [...await embedBatch(texts.slice(0, middle)), ...await embedBatch(texts.slice(middle))];
+    }
     if (!Array.isArray(rows) || rows.length !== texts.length) throw new Error("Embedding provider returned an unexpected vector count.");
     const dimensions = rows[0]?.length;
     if (!dimensions || rows.some((row) => row.length !== dimensions)) throw new Error("Embedding provider returned inconsistent vector dimensions.");
     return rows;
-  };
+  }
+  return withInputFormat(embedBatch, profile);
 }
 async function resolveEmbedder(root, options = {}) {
   const resolved = options.profile ? { profile: options.profile, source: options.source ?? "injected", path: null } : resolveEmbeddingProfile(root, options);
-  return { ...resolved, identity: embeddingProfileIdentity(resolved.profile), embed: options.embed ?? await createEmbedder(resolved.profile) };
+  return { ...resolved, identity: embeddingProfileIdentity(resolved.profile), embed: options.embed ? withInputFormat(options.embed, resolved.profile) : await createEmbedder(resolved.profile) };
 }
 
 // packages/cli/src/query/store.mjs
@@ -4200,7 +4225,7 @@ async function buildVectorIndex(root, embedOrOptions = {}) {
   });
   for (let offset = 0; offset < missing.length; offset += EMBED_BATCH_SIZE) {
     const batch = missing.slice(offset, offset + EMBED_BATCH_SIZE);
-    const embedded = await resolved.embed(batch.map(({ chunk }) => `passage: ${chunk.passage}`));
+    const embedded = await resolved.embed(batch.map(({ chunk }) => chunk.passage), "document");
     embedded.forEach((vector, index) => {
       rows[batch[index].index] = vector;
     });
@@ -4230,7 +4255,7 @@ async function queryProject(root, query, options = {}) {
     try {
       assertCodeEmbeddingConsent(root, options, corpus.chunks);
       index = await buildVectorIndex(root, { ...options, chunks: corpus.chunks });
-      const [queryVector] = await index.embedding.embed([`query: ${query}`]);
+      const [queryVector] = await index.embedding.embed([query], "query");
       vector = index.chunks.map((chunk, position) => ({ ...chunk, vectorScore: cosineScore(queryVector, index.vectors, position * index.manifest.dimensions, index.manifest.dimensions) })).sort((a, b) => b.vectorScore - a.vectorScore || a.id.localeCompare(b.id));
     } catch (error) {
       if (search === "vector") throw error;
@@ -6006,7 +6031,7 @@ async function buildVectorImpactOverlay(root, index, changedPaths, options = {})
       if (!profile) continue;
       const embed = vectorIndex.embedding?.embed ?? options.embed;
       if (!embed) throw new Error("Vector index did not provide an embedder.");
-      const [queryVector] = await embed([`query: ${profile.text}`]);
+      const [queryVector] = await embed([profile.text], "query");
       if (!queryVector) throw new Error("Changed-file embedding was empty.");
       const matches = rankVectorFiles(queryVector, vectorIndex).filter((match) => match.path !== changed && match.vectorScore >= threshold).slice(0, topK);
       for (const match of matches) {

package/mcp/server.mjs

@@ -3650,49 +3650,49 @@ var require_fast_uri = __commonJS({
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative4, options, skipNormalization) {
+    function resolveComponent(base, relative3, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse3(serialize(base, options), options);
-        relative4 = parse3(serialize(relative4, options), options);
+        relative3 = parse3(serialize(relative3, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative4.scheme) {
-        target.scheme = relative4.scheme;
-        target.userinfo = relative4.userinfo;
-        target.host = relative4.host;
-        target.port = relative4.port;
-        target.path = removeDotSegments(relative4.path || "");
-        target.query = relative4.query;
+      if (!options.tolerant && relative3.scheme) {
+        target.scheme = relative3.scheme;
+        target.userinfo = relative3.userinfo;
+        target.host = relative3.host;
+        target.port = relative3.port;
+        target.path = removeDotSegments(relative3.path || "");
+        target.query = relative3.query;
       } else {
-        if (relative4.userinfo !== void 0 || relative4.host !== void 0 || relative4.port !== void 0) {
-          target.userinfo = relative4.userinfo;
-          target.host = relative4.host;
-          target.port = relative4.port;
-          target.path = removeDotSegments(relative4.path || "");
-          target.query = relative4.query;
+        if (relative3.userinfo !== void 0 || relative3.host !== void 0 || relative3.port !== void 0) {
+          target.userinfo = relative3.userinfo;
+          target.host = relative3.host;
+          target.port = relative3.port;
+          target.path = removeDotSegments(relative3.path || "");
+          target.query = relative3.query;
         } else {
-          if (!relative4.path) {
+          if (!relative3.path) {
             target.path = base.path;
-            if (relative4.query !== void 0) {
-              target.query = relative4.query;
+            if (relative3.query !== void 0) {
+              target.query = relative3.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative4.path[0] === "/") {
-              target.path = removeDotSegments(relative4.path);
+            if (relative3.path[0] === "/") {
+              target.path = removeDotSegments(relative3.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative4.path;
+                target.path = "/" + relative3.path;
               } else if (!base.path) {
-                target.path = relative4.path;
+                target.path = relative3.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative4.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative3.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative4.query;
+            target.query = relative3.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -3700,7 +3700,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative4.fragment;
+      target.fragment = relative3.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -21959,23 +21959,15 @@ import { finished } from "node:stream/promises";
 
 // packages/context/src/paths.mjs
 import { realpathSync } from "node:fs";
-import { isAbsolute, relative, resolve as resolve2 } from "node:path";
-function assertWithinRoot(base, target, candidate) {
-  const rel = relative(base, target);
-  if (rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute(rel)) {
-    throw new Error(`Path escapes project root: ${candidate}`);
-  }
-}
+import { resolve as resolve2 } from "node:path";
 function resolveWithinRoot(root2, candidate = ".") {
   const base = resolve2(root2 || process.cwd());
   const target = resolve2(base, candidate);
-  assertWithinRoot(base, target, candidate);
   return target;
 }
 function resolveExistingWithinRoot(root2, candidate = ".") {
   const base = realpathSync(resolve2(root2 || process.cwd()));
   const target = realpathSync(resolveWithinRoot(base, candidate));
-  assertWithinRoot(base, target, candidate);
   return target;
 }
 
@@ -22271,7 +22263,7 @@ import { readFileSync as readFileSync3, statSync as statSync4 } from "node:fs";
 
 // packages/context/src/directory-ingestion.mjs
 import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync as readFileSync2, readdirSync, realpathSync as realpathSync2, statSync as statSync3 } from "node:fs";
-import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve3, sep } from "node:path";
+import { relative, resolve as resolve3, sep } from "node:path";
 var DEFAULT_LIMITS = Object.freeze({
   maxDepth: 16,
   maxVisitedEntries: 1e4,
@@ -22279,12 +22271,8 @@ var DEFAULT_LIMITS = Object.freeze({
   maxFileBytes: 25 * 1024 * 1024,
   maxAggregateBytes: 100 * 1024 * 1024
 });
-function inside(base, target) {
-  const rel = relative2(base, target);
-  return rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute2(rel);
-}
 function relativePath(base, target) {
-  return relative2(base, target).split(sep).join("/");
+  return relative(base, target).split(sep).join("/");
 }
 function boundedInteger(value, fallback, name) {
   const selected = value ?? fallback;
@@ -22335,10 +22323,7 @@ function snapshot(path, target, stat, symlink) {
 function walkDirectoryManifest(options = {}) {
   const root2 = realpathSync2(resolve3(options.root || process.cwd()));
   const requested = resolve3(root2, options.path ?? ".");
-  if (!inside(root2, requested)) throw new Error(`Directory escapes project root: ${options.path}`);
-  if (lstatSync(requested).isSymbolicLink()) throw new Error(`Directory symlinks are not followed: ${options.path ?? "."}`);
   const directory = realpathSync2(requested);
-  if (!inside(root2, directory)) throw new Error(`Directory escapes project root: ${options.path}`);
   if (!statSync3(directory).isDirectory()) throw new Error(`Not a directory: ${options.path ?? "."}`);
   const policy = normalizeOptions(options);
   const files = [];
@@ -22395,10 +22380,6 @@ function walkDirectoryManifest(options = {}) {
         let targetStat;
         try {
           target = realpathSync2(absolutePath);
-          if (!inside(root2, target)) {
-            skip(path, "symlink-outside-root");
-            continue;
-          }
           targetStat = statSync3(target);
         } catch {
           skip(path, "symlink-unresolvable");
@@ -22462,9 +22443,7 @@ function matchesIdentity(stat, identity) {
   return stat.dev === identity.dev && stat.ino === identity.ino && stat.size === identity.size && stat.mtimeMs === identity.mtimeMs;
 }
 function verifyManifestFile(entry, root2) {
-  const base = realpathSync2(resolve3(root2));
   const target = realpathSync2(entry.absolutePath);
-  if (!inside(base, target)) throw new Error(`Manifest file escapes project root: ${entry.path}`);
   const stat = statSync3(target);
   if (!stat.isFile()) throw new Error(`Manifest entry is not a regular file: ${entry.path}`);
   if (!matchesIdentity(stat, entry.identity ?? {})) throw new Error(`Manifest file changed before indexing: ${entry.path}`);
@@ -23197,7 +23176,7 @@ function runDoctor(options = {}) {
 // packages/context/src/project.mjs
 import { existsSync as existsSync3, readdirSync as readdirSync2 } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { relative as relative3, resolve as resolve5 } from "node:path";
+import { relative as relative2, resolve as resolve5 } from "node:path";
 import { spawn as spawn2 } from "node:child_process";
 var cli = fileURLToPath(new URL("./cli.mjs", import.meta.url));
 function markdownTree(root2, maxDepth = 5) {
@@ -23209,9 +23188,9 @@ function markdownTree(root2, maxDepth = 5) {
     for (const entry of readdirSync2(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
       const path = resolve5(dir, entry.name);
       if (entry.isDirectory()) {
-        output.push(`${"  ".repeat(depth - 1)}- ${relative3(root2, path)}/`);
+        output.push(`${"  ".repeat(depth - 1)}- ${relative2(root2, path)}/`);
         walk(path, depth + 1);
-      } else if (entry.isFile() && entry.name.endsWith(".md")) output.push(`${"  ".repeat(depth - 1)}- ${relative3(root2, path)}`);
+      } else if (entry.isFile() && entry.name.endsWith(".md")) output.push(`${"  ".repeat(depth - 1)}- ${relative2(root2, path)}`);
     }
   }
   walk(docs, 1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotdotgod/claude-code",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "description": "Claude Code adapter for dotdotgod project memory workflows.",
   "type": "module",
   "license": "Elastic-2.0",
@@ -25,7 +25,7 @@
   },
   "devDependencies": {
     "esbuild": "0.27.3",
-    "@dotdotgod/context": "0.6.3"
+    "@dotdotgod/context": "0.6.5"
   },
   "files": [
     ".claude-plugin",

package/skills/doc-first-planning/SKILL.md

@@ -10,7 +10,7 @@ version: 1.0.0
 
 ## CLI Context
 
-For focused documentation routing, run `dotdotgod query <root> "<focus>" --limit 30 --json`. Run `dotdotgod config <root> --json` when memory-area policy, documentation exclusions, or Plan Mode writable paths affect the plan. If the CLI is unavailable, continue from README indexes and focused file reads.
+For focused documentation routing, run `dotdotgod query <root> "<focus>" --limit 30 --json`. Run `dotdotgod config <root> --json` when memory-area policy or documentation routing/exclusions affect the plan. If the CLI is unavailable, continue from README indexes and focused file reads.
 
 ## Goal
 

package/skills/project-initializer/templates/case-and-evidence.json

@@ -215,10 +215,5 @@
       ]
     }
   },
-  "planMode": {
-    "writablePaths": [
-      "docs/plan/**",
-      "docs/archive/**"
-    ]
-  }
+  "planMode": {}
 }

package/skills/project-initializer/templates/dotdotgod.config.json

@@ -230,10 +230,5 @@
       ]
     }
   },
-  "planMode": {
-    "writablePaths": [
-      "docs/plan/**",
-      "docs/archive/**"
-    ]
-  }
+  "planMode": {}
 }

package/skills/project-initializer/templates/policy.json

@@ -237,10 +237,5 @@
       ]
     }
   },
-  "planMode": {
-    "writablePaths": [
-      "docs/plan/**",
-      "docs/archive/**"
-    ]
-  }
+  "planMode": {}
 }

package/skills/project-initializer/templates/portfolio.json

@@ -251,10 +251,5 @@
       ]
     }
   },
-  "planMode": {
-    "writablePaths": [
-      "docs/plan/**",
-      "docs/archive/**"
-    ]
-  }
+  "planMode": {}
 }

package/skills/project-initializer/templates/publication.json

@@ -261,10 +261,5 @@
       ]
     }
   },
-  "planMode": {
-    "writablePaths": [
-      "docs/plan/**",
-      "docs/archive/**"
-    ]
-  }
+  "planMode": {}
 }

package/skills/project-initializer/templates/research.json

@@ -283,10 +283,5 @@
       ]
     }
   },
-  "planMode": {
-    "writablePaths": [
-      "docs/plan/**",
-      "docs/archive/**"
-    ]
-  }
+  "planMode": {}
 }

package/skills/project-initializer/templates/software.json

@@ -230,10 +230,5 @@
       ]
     }
   },
-  "planMode": {
-    "writablePaths": [
-      "docs/plan/**",
-      "docs/archive/**"
-    ]
-  }
+  "planMode": {}
 }