@dotdotgod/hermes 0.6.3 → 0.6.5

package/README.md

@@ -29,9 +29,9 @@ Do not enable a separate profile-wide dotdotgod MCP server for these tools.
 Optional semantic embeddings use the existing explicit installation workflow;
 map/README routing works without them. Do not automatically install dependencies.
 
-## Gateway Repository Access
+## Project Routing
 
-The operator configures labels and principal-specific grants in config.yaml:
+Optional project labels can be configured in config.yaml:
 
 ```yaml
 plugins:
@@ -42,27 +42,31 @@ plugins:
         roots:
           app: /absolute/path/to/app
           docs: /absolute/path/to/docs-project
-        gateway_access:
-          "telegram:123456": [app]
-          "discord:987654": [docs]
 ```
 
-Use the trusted sender ID supplied by your Hermes gateway, not a display name.
-The model cannot grant itself a root or choose arbitrary filesystem paths.
-On an unbound gateway session the adapter requests dotdotgod_select_root with an
-authorized label before substantive work. Missing/changed grants deny access.
+Host session IDs are optional bookkeeping, not permissions. Tools work before
+pre-LLM registration. Without an ID, dotdotgod uses a disposable connection with
+an explicit load root or cli_root/launch-directory default, never another chat's
+selection. Ordinary host tools without known routing state pass through unchanged.
+Missing parents and changed senders do not deny tools. Impact interception needs
+known project state; nested host calls omitting it cannot be attributed reliably.
+
+Any host session may select a configured label or an existing absolute directory
+using dotdotgod_select_root. Legacy gateway_access settings are ignored.
+Dotdotgod imposes no filesystem-area restrictions. Gateway operators must rely
+on host permissions and OS isolation, not plugin labels, for access control.
 CLI starts at the launch directory; optional cli_root sets its repository.
 
-One bridge and MCP server are created lazily per authorized repository/host
+One bridge and MCP server are created lazily per selected project/host
 session. Same-repository connections share the project SQLite DB, not mutable
 connection-session identity. Explicit context session_resume affects only the
 caller's connection; its last resumed ID survives transport reconnects.
-Selections persist in profile-owned plugin state and are reauthorized on restore.
+Selections persist in profile-owned plugin state and are resolved on restore.
 Startup/restored sessions conservatively reassess project memory; abandoned
 sibling completion is not inherited.
 
 This is routing isolation, not multi-tenant OS isolation. Hermes and enabled
-plugins retain host permissions. Authorized users of the same repository share
+plugins retain host permissions. Sessions using the same repository share
 project data; context scope/session filters are not access-control lists.
 
 ## Features
@@ -82,7 +86,7 @@ project data; context scope/session filters are not access-control lists.
   checked fingerprints. Successful checks clear only checked, unchanged paths.
   Source edits reopen pending state; reads and impact checks remain available.
 - Native Hermes delegate_task is the delegation mechanism. Child hooks inherit
-  only an already authorized matching-principal parent repository, with a separate
+  an active matching-principal parent's project by default, with a separate
   context connection; impact covers their changes in the shared worktree.
 
 No dedicated planning state, wizard, source-edit approval UI, compaction feature,
@@ -95,8 +99,8 @@ Python/Node test commands are blocked while impact is pending. Execute batches
 are checked inside the adapter too. Opaque execute_file calls are blocked while
 pending because their effects cannot be inferred safely.
 
-Native file path arguments and terminal workdir are rooted to the selected local
-repository; reads may also access the installed bundled skill resources. This adapter targets local host worktrees, not remote/container path
+Relative native file paths and terminal workdir default to the selected project;
+explicit paths may refer anywhere accessible to the host. This adapter targets local host worktrees, not remote/container path
 translation. Shell paths, patch bodies, arbitrary programs and other plugins are
 not a filesystem sandbox; keep Hermes's own approvals and OS isolation.
 Shell mutations hidden inside one combined mutation/release command are not fully

package/__init__.py

@@ -31,7 +31,7 @@ def register(ctx):
         }, handler=handle, description=tool["description"])
 
     for name, schema, description in [
-        ("dotdotgod_select_root", {"type": "object", "properties": {"label": {"type": "string"}}, "required": ["label"], "additionalProperties": False}, "Select an operator-authorized repository for this host session."),
+        ("dotdotgod_select_root", {"type": "object", "properties": {"label": {"type": "string"}}, "required": ["label"], "additionalProperties": False}, "Select a project for this host session using a configured label or absolute directory path."),
         ("dotdotgod_impact_status", {"type": "object", "properties": {}, "additionalProperties": False}, "Read pending impact paths for the selected repository; does not clear them."),
     ]:
         def handle_local(args, session_id="", _name=name, **kwargs):

package/mcp/cli.mjs

@@ -855,6 +855,15 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 var DEFAULT_EMBEDDING_PROFILE = Object.freeze({ provider: "local", model: "Xenova/multilingual-e5-small" });
 var EMBEDDING_PROVIDERS = Object.freeze(["local", "openai-compatible", "ollama"]);
+var DEFAULT_INPUT_FORMAT = Object.freeze({ queryPrefix: "query: ", documentPrefix: "passage: " });
+function embeddingInputFormat(profile, label = "embedding") {
+  if (profile.inputFormat === void 0) return { ...DEFAULT_INPUT_FORMAT };
+  const format = profile.inputFormat;
+  if (!format || typeof format !== "object" || Array.isArray(format) || Object.keys(format).some((key) => !Object.hasOwn(DEFAULT_INPUT_FORMAT, key)) || Object.keys(DEFAULT_INPUT_FORMAT).some((key) => typeof format[key] !== "string")) {
+    throw new Error(`${label}.inputFormat must contain exactly queryPrefix and documentPrefix strings.`);
+  }
+  return { queryPrefix: format.queryPrefix, documentPrefix: format.documentPrefix };
+}
 function readJson(path, label) {
   if (!existsSync(path)) return null;
   try {
@@ -865,7 +874,7 @@ function readJson(path, label) {
 }
 function validateEmbeddingProfile(profile, label = "embedding") {
   if (!profile || typeof profile !== "object" || Array.isArray(profile)) throw new Error(`${label} must be an object.`);
-  const allowed = /* @__PURE__ */ new Set(["provider", "model", "baseUrl", "apiKey", "apiKeyEnv"]);
+  const allowed = /* @__PURE__ */ new Set(["provider", "model", "baseUrl", "apiKey", "apiKeyEnv", "inputFormat"]);
   const unknown = Object.keys(profile).find((key) => !allowed.has(key));
   if (unknown) throw new Error(`${label}.${unknown} is not supported.`);
   if (!EMBEDDING_PROVIDERS.includes(profile.provider)) throw new Error(`${label}.provider must be local, openai-compatible, or ollama.`);
@@ -883,6 +892,7 @@ function validateEmbeddingProfile(profile, label = "embedding") {
     if (!["http:", "https:"].includes(url.protocol)) throw new Error(`${label}.baseUrl must use HTTP or HTTPS.`);
     if (url.username || url.password) throw new Error(`${label}.baseUrl must not contain credentials.`);
   }
+  embeddingInputFormat(profile, label);
   return { ...profile, model: profile.model.trim(), ...profile.baseUrl ? { baseUrl: profile.baseUrl.replace(/\/$/, "") } : {} };
 }
 function sanitizeEmbeddingProfile(profile) {
@@ -890,8 +900,13 @@ function sanitizeEmbeddingProfile(profile) {
   return { ...safe, ...apiKey ? { apiKey: "[redacted]" } : {} };
 }
 function embeddingProfileIdentity(profile) {
-  const { apiKey, apiKeyEnv, ...identity2 } = profile;
-  return identity2;
+  return {
+    provider: profile.provider,
+    model: profile.model,
+    ...profile.baseUrl !== void 0 ? { baseUrl: profile.baseUrl } : {},
+    inputFormatVersion: 1,
+    inputFormat: embeddingInputFormat(profile)
+  };
 }
 function resolveEmbeddingProfile(root = ".", options = {}) {
   const home = options.home ?? homedir();
@@ -938,9 +953,6 @@ var DEFAULT_LOAD_POLICY = {
     exclude: ["docs/plan", "docs/archive"]
   }
 };
-var DEFAULT_PLAN_MODE_POLICY = {
-  writablePaths: ["docs/plan/**", "docs/archive/**"]
-};
 var DEFAULT_IMPACT_RANKING_POLICY = {
   connectionCap: 80,
   memoryCap: 20,
@@ -1115,8 +1127,8 @@ function cloneLoadPolicy(policy = DEFAULT_LOAD_POLICY) {
     }
   };
 }
-function clonePlanModePolicy(policy = DEFAULT_PLAN_MODE_POLICY) {
-  return { writablePaths: [...policy.writablePaths ?? DEFAULT_PLAN_MODE_POLICY.writablePaths] };
+function clonePlanModePolicy() {
+  return {};
 }
 function normalizeDocumentationRoot(value = DEFAULT_DOCUMENTATION_ROOT) {
   return String(value).trim().replaceAll("\\", "/").replace(/^\.\//, "").replace(/\/{2,}/g, "/").replace(/^\/+|\/+$/g, "");
@@ -1130,7 +1142,7 @@ function isValidDocumentationRoot(value) {
 }
 function defaultMemoryConfig({ documentationRoot = DEFAULT_DOCUMENTATION_ROOT } = {}) {
   const root = normalizeDocumentationRoot(documentationRoot);
-  return { source: "default", documentation: { root }, areas: memoryAreasForRoot(root).map(cloneArea), traceability: cloneTraceabilityPolicy({ ...DEFAULT_TRACEABILITY_POLICY, required: [`${root}/spec/**`] }), validation: cloneValidationPolicy(), impactRanking: cloneImpactRankingPolicy(), referenceExpansion: cloneReferenceExpansionPolicy(), load: cloneLoadPolicy({ ...DEFAULT_LOAD_POLICY, documentationSummary: { exclude: [`${root}/plan`, `${root}/archive`] } }), planMode: clonePlanModePolicy({ writablePaths: [`${root}/plan/**`, `${root}/archive/**`] }) };
+  return { source: "default", documentation: { root }, areas: memoryAreasForRoot(root).map(cloneArea), traceability: cloneTraceabilityPolicy({ ...DEFAULT_TRACEABILITY_POLICY, required: [`${root}/spec/**`] }), validation: cloneValidationPolicy(), impactRanking: cloneImpactRankingPolicy(), referenceExpansion: cloneReferenceExpansionPolicy(), load: cloneLoadPolicy({ ...DEFAULT_LOAD_POLICY, documentationSummary: { exclude: [`${root}/plan`, `${root}/archive`] } }), planMode: clonePlanModePolicy() };
 }
 function normalizePathPattern(value = "") {
   return value.replaceAll("\\", "/").replace(/^\.\//, "").replace(/\/+$|^\/+/, "");
@@ -1191,10 +1203,8 @@ function isSecretLikePathPattern(value = "") {
   const normalized = normalizePathPattern(value);
   return /(^|\/)(\.env|\.npmrc|\.pypirc|id_rsa|id_dsa|id_ed25519|credentials?|secrets?)(\.|\/|$)/i.test(normalized);
 }
-function normalizePlanModePolicy(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return clonePlanModePolicy();
-  const writablePaths = raw.writablePaths === void 0 ? DEFAULT_PLAN_MODE_POLICY.writablePaths : [...new Set((Array.isArray(raw.writablePaths) ? raw.writablePaths : []).map(normalizePathPattern))];
-  return clonePlanModePolicy({ writablePaths });
+function normalizePlanModePolicy(_raw) {
+  return clonePlanModePolicy();
 }
 function normalizeLoadPolicy(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return cloneLoadPolicy();
@@ -1339,10 +1349,6 @@ Fix: ${fix ?? `update ${field2 ?? "this config"} in ${file} to match the expecte
   if (planMode !== void 0) {
     if (!planMode || typeof planMode !== "object" || Array.isArray(planMode)) {
       add("PLAN_MODE_CONFIG_INVALID", "planMode", "Expected an object.");
-    } else if (planMode.writablePaths !== void 0) {
-      const paths = planMode.writablePaths;
-      if (!Array.isArray(paths)) add("PLAN_MODE_CONFIG_INVALID_WRITABLE_PATHS", "planMode.writablePaths", "Expected an array of documentation path strings.");
-      else if (paths.some((value) => !isValidPathPattern(value) || typeof value !== "string" || value.trim().startsWith("/") || !normalizePathPattern(value).startsWith(`${normalizeDocumentationRoot(data.documentation?.root ?? DEFAULT_DOCUMENTATION_ROOT)}/`) || normalizePathPattern(value).startsWith(`${normalizeDocumentationRoot(data.documentation?.root ?? DEFAULT_DOCUMENTATION_ROOT)}/.`) || isSecretLikePathPattern(value))) add("PLAN_MODE_CONFIG_INVALID_WRITABLE_PATHS", "planMode.writablePaths", "Expected safe repository-relative paths under documentation.root using exact paths or /** subtree patterns.");
     }
   }
   const referenceExpansion = data.referenceExpansion;
@@ -3804,7 +3810,6 @@ function formatConfigOutput(payload) {
   lines.push(`- load pinned paths: ${(payload.config.load?.pinnedPaths ?? []).join(", ") || "none"}`);
   lines.push(`- load pinned bodies: ${(payload.config.load?.pinnedBodies ?? []).join(", ") || "none"}`);
   lines.push(`- load documentation summary exclude: ${(payload.config.load?.documentationSummary?.exclude ?? []).join(", ") || "none"}`);
-  lines.push(`- plan mode writable paths: ${(payload.config.planMode?.writablePaths ?? []).join(", ") || "none"}`);
   const lowSignal = payload.config.referenceExpansion?.fuzzy?.lowSignal ?? { terms: [], add: [], remove: [] };
   lines.push(`- fuzzy low-signal terms: ${(lowSignal.terms ?? []).join(", ") || "none"} (add: ${(lowSignal.add ?? []).join(", ") || "none"}; remove: ${(lowSignal.remove ?? []).join(", ") || "none"})`);
   if (errors.length > 0) {
@@ -3954,7 +3959,12 @@ async function postJson(url, body, profile) {
     const response = await fetch(url, { method: "POST", headers: { "content-type": "application/json", ...key ? { authorization: `Bearer ${key}` } : {} }, body: JSON.stringify(body), signal: controller.signal });
     if (!response.ok) {
       const category = response.status === 401 || response.status === 403 ? "authentication" : response.status === 429 ? "rate limit" : `HTTP ${response.status}`;
-      throw new Error(`Remote embedding ${category} failure.`);
+      const error = new Error(`Remote embedding ${category} failure.`);
+      if (response.status === 400 || response.status === 413) {
+        const body2 = (await response.text()).slice(0, 8192);
+        error.tokenLimit = /(?:exceed\w*[\s\S]{0,120}tokens?|tokens?[\s\S]{0,120}(?:exceed|limit|too (?:long|many))|maximum context length)/i.test(body2);
+      }
+      throw error;
     }
     try {
       return await response.json();
@@ -3981,20 +3991,35 @@ function remoteEmbedder(profile) {
     return ordered.map(normalize);
   };
 }
+function withInputFormat(embed, profile) {
+  const format = embeddingInputFormat(profile);
+  return (texts, role) => {
+    if (role !== void 0 && role !== "query" && role !== "document") throw new Error("Embedding role must be query or document.");
+    return embed(role === void 0 ? texts : texts.map((text) => format[`${role}Prefix`] + text));
+  };
+}
 async function createEmbedder(profile) {
   const embed = profile.provider === "local" ? await localEmbedder(profile) : remoteEmbedder(profile);
-  return async (texts) => {
+  async function embedBatch(texts) {
     if (texts.length === 0) return [];
-    const rows = await embed(texts);
+    let rows;
+    try {
+      rows = await embed(texts);
+    } catch (error) {
+      if (!error.tokenLimit || texts.length === 1) throw error;
+      const middle = Math.ceil(texts.length / 2);
+      rows = [...await embedBatch(texts.slice(0, middle)), ...await embedBatch(texts.slice(middle))];
+    }
     if (!Array.isArray(rows) || rows.length !== texts.length) throw new Error("Embedding provider returned an unexpected vector count.");
     const dimensions = rows[0]?.length;
     if (!dimensions || rows.some((row) => row.length !== dimensions)) throw new Error("Embedding provider returned inconsistent vector dimensions.");
     return rows;
-  };
+  }
+  return withInputFormat(embedBatch, profile);
 }
 async function resolveEmbedder(root, options = {}) {
   const resolved = options.profile ? { profile: options.profile, source: options.source ?? "injected", path: null } : resolveEmbeddingProfile(root, options);
-  return { ...resolved, identity: embeddingProfileIdentity(resolved.profile), embed: options.embed ?? await createEmbedder(resolved.profile) };
+  return { ...resolved, identity: embeddingProfileIdentity(resolved.profile), embed: options.embed ? withInputFormat(options.embed, resolved.profile) : await createEmbedder(resolved.profile) };
 }
 
 // packages/cli/src/query/store.mjs
@@ -4200,7 +4225,7 @@ async function buildVectorIndex(root, embedOrOptions = {}) {
   });
   for (let offset = 0; offset < missing.length; offset += EMBED_BATCH_SIZE) {
     const batch = missing.slice(offset, offset + EMBED_BATCH_SIZE);
-    const embedded = await resolved.embed(batch.map(({ chunk }) => `passage: ${chunk.passage}`));
+    const embedded = await resolved.embed(batch.map(({ chunk }) => chunk.passage), "document");
     embedded.forEach((vector, index) => {
       rows[batch[index].index] = vector;
     });
@@ -4230,7 +4255,7 @@ async function queryProject(root, query, options = {}) {
     try {
       assertCodeEmbeddingConsent(root, options, corpus.chunks);
       index = await buildVectorIndex(root, { ...options, chunks: corpus.chunks });
-      const [queryVector] = await index.embedding.embed([`query: ${query}`]);
+      const [queryVector] = await index.embedding.embed([query], "query");
       vector = index.chunks.map((chunk, position) => ({ ...chunk, vectorScore: cosineScore(queryVector, index.vectors, position * index.manifest.dimensions, index.manifest.dimensions) })).sort((a, b) => b.vectorScore - a.vectorScore || a.id.localeCompare(b.id));
     } catch (error) {
       if (search === "vector") throw error;
@@ -6006,7 +6031,7 @@ async function buildVectorImpactOverlay(root, index, changedPaths, options = {})
       if (!profile) continue;
       const embed = vectorIndex.embedding?.embed ?? options.embed;
       if (!embed) throw new Error("Vector index did not provide an embedder.");
-      const [queryVector] = await embed([`query: ${profile.text}`]);
+      const [queryVector] = await embed([profile.text], "query");
       if (!queryVector) throw new Error("Changed-file embedding was empty.");
       const matches = rankVectorFiles(queryVector, vectorIndex).filter((match) => match.path !== changed && match.vectorScore >= threshold).slice(0, topK);
       for (const match of matches) {

package/mcp/server.mjs

@@ -3650,49 +3650,49 @@ var require_fast_uri = __commonJS({
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative4, options, skipNormalization) {
+    function resolveComponent(base, relative3, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse3(serialize(base, options), options);
-        relative4 = parse3(serialize(relative4, options), options);
+        relative3 = parse3(serialize(relative3, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative4.scheme) {
-        target.scheme = relative4.scheme;
-        target.userinfo = relative4.userinfo;
-        target.host = relative4.host;
-        target.port = relative4.port;
-        target.path = removeDotSegments(relative4.path || "");
-        target.query = relative4.query;
+      if (!options.tolerant && relative3.scheme) {
+        target.scheme = relative3.scheme;
+        target.userinfo = relative3.userinfo;
+        target.host = relative3.host;
+        target.port = relative3.port;
+        target.path = removeDotSegments(relative3.path || "");
+        target.query = relative3.query;
       } else {
-        if (relative4.userinfo !== void 0 || relative4.host !== void 0 || relative4.port !== void 0) {
-          target.userinfo = relative4.userinfo;
-          target.host = relative4.host;
-          target.port = relative4.port;
-          target.path = removeDotSegments(relative4.path || "");
-          target.query = relative4.query;
+        if (relative3.userinfo !== void 0 || relative3.host !== void 0 || relative3.port !== void 0) {
+          target.userinfo = relative3.userinfo;
+          target.host = relative3.host;
+          target.port = relative3.port;
+          target.path = removeDotSegments(relative3.path || "");
+          target.query = relative3.query;
         } else {
-          if (!relative4.path) {
+          if (!relative3.path) {
             target.path = base.path;
-            if (relative4.query !== void 0) {
-              target.query = relative4.query;
+            if (relative3.query !== void 0) {
+              target.query = relative3.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative4.path[0] === "/") {
-              target.path = removeDotSegments(relative4.path);
+            if (relative3.path[0] === "/") {
+              target.path = removeDotSegments(relative3.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative4.path;
+                target.path = "/" + relative3.path;
               } else if (!base.path) {
-                target.path = relative4.path;
+                target.path = relative3.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative4.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative3.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative4.query;
+            target.query = relative3.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -3700,7 +3700,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative4.fragment;
+      target.fragment = relative3.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -21959,23 +21959,15 @@ import { finished } from "node:stream/promises";
 
 // packages/context/src/paths.mjs
 import { realpathSync } from "node:fs";
-import { isAbsolute, relative, resolve as resolve2 } from "node:path";
-function assertWithinRoot(base, target, candidate) {
-  const rel = relative(base, target);
-  if (rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute(rel)) {
-    throw new Error(`Path escapes project root: ${candidate}`);
-  }
-}
+import { resolve as resolve2 } from "node:path";
 function resolveWithinRoot(root2, candidate = ".") {
   const base = resolve2(root2 || process.cwd());
   const target = resolve2(base, candidate);
-  assertWithinRoot(base, target, candidate);
   return target;
 }
 function resolveExistingWithinRoot(root2, candidate = ".") {
   const base = realpathSync(resolve2(root2 || process.cwd()));
   const target = realpathSync(resolveWithinRoot(base, candidate));
-  assertWithinRoot(base, target, candidate);
   return target;
 }
 
@@ -22271,7 +22263,7 @@ import { readFileSync as readFileSync3, statSync as statSync4 } from "node:fs";
 
 // packages/context/src/directory-ingestion.mjs
 import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync as readFileSync2, readdirSync, realpathSync as realpathSync2, statSync as statSync3 } from "node:fs";
-import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve3, sep } from "node:path";
+import { relative, resolve as resolve3, sep } from "node:path";
 var DEFAULT_LIMITS = Object.freeze({
   maxDepth: 16,
   maxVisitedEntries: 1e4,
@@ -22279,12 +22271,8 @@ var DEFAULT_LIMITS = Object.freeze({
   maxFileBytes: 25 * 1024 * 1024,
   maxAggregateBytes: 100 * 1024 * 1024
 });
-function inside(base, target) {
-  const rel = relative2(base, target);
-  return rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute2(rel);
-}
 function relativePath(base, target) {
-  return relative2(base, target).split(sep).join("/");
+  return relative(base, target).split(sep).join("/");
 }
 function boundedInteger(value, fallback, name) {
   const selected = value ?? fallback;
@@ -22335,10 +22323,7 @@ function snapshot(path, target, stat, symlink) {
 function walkDirectoryManifest(options = {}) {
   const root2 = realpathSync2(resolve3(options.root || process.cwd()));
   const requested = resolve3(root2, options.path ?? ".");
-  if (!inside(root2, requested)) throw new Error(`Directory escapes project root: ${options.path}`);
-  if (lstatSync(requested).isSymbolicLink()) throw new Error(`Directory symlinks are not followed: ${options.path ?? "."}`);
   const directory = realpathSync2(requested);
-  if (!inside(root2, directory)) throw new Error(`Directory escapes project root: ${options.path}`);
   if (!statSync3(directory).isDirectory()) throw new Error(`Not a directory: ${options.path ?? "."}`);
   const policy = normalizeOptions(options);
   const files = [];
@@ -22395,10 +22380,6 @@ function walkDirectoryManifest(options = {}) {
         let targetStat;
         try {
           target = realpathSync2(absolutePath);
-          if (!inside(root2, target)) {
-            skip(path, "symlink-outside-root");
-            continue;
-          }
           targetStat = statSync3(target);
         } catch {
           skip(path, "symlink-unresolvable");
@@ -22462,9 +22443,7 @@ function matchesIdentity(stat, identity) {
   return stat.dev === identity.dev && stat.ino === identity.ino && stat.size === identity.size && stat.mtimeMs === identity.mtimeMs;
 }
 function verifyManifestFile(entry, root2) {
-  const base = realpathSync2(resolve3(root2));
   const target = realpathSync2(entry.absolutePath);
-  if (!inside(base, target)) throw new Error(`Manifest file escapes project root: ${entry.path}`);
   const stat = statSync3(target);
   if (!stat.isFile()) throw new Error(`Manifest entry is not a regular file: ${entry.path}`);
   if (!matchesIdentity(stat, entry.identity ?? {})) throw new Error(`Manifest file changed before indexing: ${entry.path}`);
@@ -23197,7 +23176,7 @@ function runDoctor(options = {}) {
 // packages/context/src/project.mjs
 import { existsSync as existsSync3, readdirSync as readdirSync2 } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { relative as relative3, resolve as resolve5 } from "node:path";
+import { relative as relative2, resolve as resolve5 } from "node:path";
 import { spawn as spawn2 } from "node:child_process";
 var cli = fileURLToPath(new URL("./cli.mjs", import.meta.url));
 function markdownTree(root2, maxDepth = 5) {
@@ -23209,9 +23188,9 @@ function markdownTree(root2, maxDepth = 5) {
     for (const entry of readdirSync2(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
       const path = resolve5(dir, entry.name);
       if (entry.isDirectory()) {
-        output.push(`${"  ".repeat(depth - 1)}- ${relative3(root2, path)}/`);
+        output.push(`${"  ".repeat(depth - 1)}- ${relative2(root2, path)}/`);
         walk(path, depth + 1);
-      } else if (entry.isFile() && entry.name.endsWith(".md")) output.push(`${"  ".repeat(depth - 1)}- ${relative3(root2, path)}`);
+      } else if (entry.isFile() && entry.name.endsWith(".md")) output.push(`${"  ".repeat(depth - 1)}- ${relative2(root2, path)}`);
     }
   }
   walk(docs, 1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotdotgod/hermes",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "description": "Hermes CLI and messaging-gateway adapter without Plan Mode.",
   "type": "module",
   "publishConfig": {
@@ -13,7 +13,7 @@
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.25.2",
     "esbuild": "0.27.3",
-    "@dotdotgod/context": "0.6.3"
+    "@dotdotgod/context": "0.6.5"
   },
   "files": [
     "plugin.yaml",

package/plugin.yaml

@@ -1,5 +1,5 @@
 name: dotdotgod
-version: 0.6.3
+version: 0.6.5
 description: Project memory, isolated context tools and impact checks for Hermes CLI and messaging gateway; no Plan Mode.
 author: dotdotgod
 license: Elastic-2.0
@@ -8,10 +8,6 @@ config_schema:
     type: dict
     default: {}
     description: Repository labels mapped to absolute local paths, configured by the operator.
-  gateway_access:
-    type: dict
-    default: {}
-    description: 'Allowed repository labels per platform:sender_id principal; no wildcard grants.'
   cli_root:
     type: str
     default: ''

package/policy.py

@@ -1,4 +1,4 @@
-"""Root-contained changed-file fingerprints and deliberately limited command gates."""
+"""Project changed-file fingerprints and deliberately limited command gates."""
 import hashlib
 import re
 import subprocess
@@ -11,10 +11,8 @@ EXCLUDED = (".dotdotgod/", "node_modules/", "dist/", "build/", "coverage/", "doc
 
 
 def contained(root, value):
-    path = (root / value).resolve()
-    if not path.is_relative_to(root):
-        raise ValueError("Path escapes selected repository")
-    return path
+    # Legacy helper name: root supplies relative-path defaults only.
+    return (root / value).resolve()
 
 
 def tracked(path):
@@ -66,13 +64,7 @@ def file_arguments(root, name, args):
     if name in {"read_file", "write_file", "file_edit", "file_write", "file_read"}:
         for key in ("path", "file_path"):
             if isinstance(args.get(key), str):
-                try:
-                    target = contained(root, args[key])
-                except ValueError:
-                    target = Path(args[key]).resolve()
-                    if name not in {"read_file", "file_read"} or not target.is_relative_to(Path(__file__).parent.resolve() / "skills"):
-                        raise
-                args[key] = str(target)
+                args[key] = str(contained(root, args[key]))
     if name == "terminal":
         args["workdir"] = str(contained(root, args.get("workdir") or "."))
     return args

package/runtime.py

@@ -2,9 +2,11 @@
 import atexit
 import hashlib
 import json
+import os
 import re
 import subprocess
 import threading
+import uuid
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -46,44 +48,28 @@ class Runtime:
         roots = self.ctx.get_config("roots", {})
         if not isinstance(roots, dict):
             raise ValueError("roots must be an operator-configured mapping")
-        if session.platform in {"", "cli"}:
-            return roots
-        access = self.ctx.get_config("gateway_access", {})
-        labels = access.get(session.principal, []) if isinstance(access, dict) else []
-        return {label: roots[label] for label in labels if label in roots} if isinstance(labels, list) else {}
-
-    def trusted_session(self, session_id):
-        if not session_id or session_id not in self.sessions:
-            raise ValueError("No trusted host session; start a turn before using dotdotgod")
-        return self.sessions[session_id]
+        return roots
 
     def session(self, session_id):
-        session = self.trusted_session(session_id)
-        if session.root is None:
-            raise ValueError("Select an authorized repository with dotdotgod_select_root first")
-        if session.parent_id:
-            parent = self.session(session.parent_id)
-            if parent.root != session.root or parent.principal != session.principal:
-                raise PermissionError("Delegating parent repository or principal changed")
-        if session.label:
-            value = self.allowed(session).get(session.label)
-            if not isinstance(value, str) or Path(value).resolve(strict=True) != session.root:
-                raise PermissionError("Repository grant changed; select an authorized root again")
-        return session
+        # Anonymous calls use disposable state, never another conversation's route.
+        if not session_id:
+            return Session(uuid.uuid4().hex, "", "")
+        if session_id not in self.sessions:
+            self.sessions[session_id] = Session(session_id, "", "")
+        return self.sessions[session_id]
 
     def select(self, session, label):
-        if session.parent_id and label != self.session(session.parent_id).label:
-            raise PermissionError("Delegated work cannot select a different repository")
-        value = self.allowed(session).get(label)
+        value = self.allowed(session).get(label, label)
         if not isinstance(value, str) or not Path(value).is_absolute():
-            raise PermissionError("Unknown or unauthorized repository label")
+            raise ValueError("Use a configured repository label or an absolute directory path")
         root = Path(value).resolve(strict=True)
         if not root.is_dir():
             raise ValueError("Repository root must be a directory")
         if session.proxy:
             session.proxy.close()
         session.root, session.label, session.proxy, session.loaded = root, label, None, False
-        self.ctx.state.set("route:" + digest(session.id), {"principal": session.principal, "label": label})
+        if self.sessions.get(session.id) is session:
+            self.ctx.state.set("route:" + digest(session.id), {"principal": session.principal, "label": label})
         return envelope({"ok": True, "root": str(root), "label": label})
 
     def client(self, session):
@@ -123,12 +109,18 @@ class Runtime:
         data = {"ok": True, "root": str(session.root), "focus": focus, "documentationMap": mapping, "query": query}
         return envelope(data, "Project memory (map/query evidence; read bodies selectively):\n" + json.dumps(data, ensure_ascii=False) + "\nHelp: dotdotgod --help")
 
-    def call(self, name, args, session_id):
+    def call(self, name, args, session_id=""):
+        with self.lock:
+            session = self.session(session_id)
+        try:
+            return self.call_with_session(name, args, session)
+        finally:
+            if not session_id and session.proxy:
+                session.proxy.close()
+
+    def call_with_session(self, name, args, session):
         with self.lock:
-            session = self.trusted_session(session_id)
             if name == "dotdotgod_select_root":
-                if not self.allowed(session):
-                    raise PermissionError("No authorized repository labels; only dotdotgod_project_initialize is available")
                 return self.select(session, args.get("label"))
             if session.root is None and not session.parent_id and name == "dotdotgod_project_initialize":
                 target = args.get("root")
@@ -142,12 +134,20 @@ class Runtime:
                     return proxy.call(name, {**args, "root": str(root)})
                 finally:
                     proxy.close()
-            session = self.session(session_id)
+            if name == "dotdotgod_project_load" and args.get("root"):
+                base = session.root or self.launch_root
+                target = contained(base, args["root"])
+                if target != session.root:
+                    self.select(session, str(target))
+            if session.root is None:
+                session.root = Path(self.ctx.get_config("cli_root", "") or self.launch_root).resolve(strict=True)
+                if not session.root.is_dir():
+                    raise ValueError("Project root must be a directory")
         if name == "dotdotgod_impact_status":
             return envelope({"ok": True, "pending": list(self.pending(session))})
         if name == "dotdotgod_project_load":
             if contained(session.root, args.get("root") or ".") != session.root:
-                raise ValueError("Use dotdotgod_select_root to change repositories")
+                self.select(session, str(contained(session.root, args["root"])))
             return self.load(session, args)
         if name in {"execute", "execute_file"}:
             reason = self.check(session, name, args)
@@ -155,7 +155,7 @@ class Runtime:
                 raise PermissionError(reason)
         if name == "dotdotgod_project_impact":
             before = self.pending(session)
-            paths = [contained(session.root, path).relative_to(session.root).as_posix() for path in args.get("paths", [])]
+            paths = [os.path.relpath(contained(session.root, path), session.root) for path in args.get("paths", [])]
             args = {**args, "paths": paths}
         value = self.client(session).call(name, args)
         if name == "dotdotgod_project_impact" and not value.get("isError") and value.get("structuredContent", {}).get("ok") is True:
@@ -178,16 +178,13 @@ class Runtime:
 
     def before_tool(self, tool_name, args, session_id="", **kwargs):
         try:
-            session = self.trusted_session(session_id)
-            if session.root is None and not session.parent_id:
-                if not tool_name.startswith("dotdotgod_") or tool_name == "dotdotgod_project_initialize":
-                    return None
-                if tool_name == "dotdotgod_select_root" and self.allowed(session):
-                    return None
-                return {"action": "block", "message": "dotdotgod is inactive without a selected repository; only initialization is available (selection requires authorized labels)"}
+            session = self.sessions.get(session_id) if session_id else None
+            if session is None:
+                return None
+            if session.root is None:
+                return None
             if tool_name == "dotdotgod_select_root":
                 return None
-            session = self.session(session_id)
             reason = self.check(session, tool_name, args)
             if reason:
                 return {"action": "block", "message": reason}
@@ -199,20 +196,17 @@ class Runtime:
 
     def before_llm(self, session_id, user_message, platform="", sender_id="", parent_session_id="", **kwargs):
         with self.lock:
-            parent = self.session(parent_session_id) if platform == "subagent" else None
+            parent = self.sessions.get(parent_session_id) if platform == "subagent" else None
             principal = parent.principal if parent else platform + ":" + sender_id
             if parent:
                 platform = parent.platform
             session = self.sessions.get(session_id)
-            if session and session.principal != principal:
-                if session.proxy:
-                    session.proxy.close()
-                session = None
             if session is None:
-                session = Session(session_id, principal, platform)
-                self.sessions[session_id] = session
-                saved = self.ctx.state.get("route:" + digest(session_id), {})
-                if saved.get("principal") == principal and saved.get("label") in self.allowed(session):
+                session = Session(session_id or uuid.uuid4().hex, principal, platform)
+                if session_id:
+                    self.sessions[session_id] = session
+                saved = self.ctx.state.get("route:" + digest(session_id), {}) if session_id else {}
+                if isinstance(saved.get("label"), str) and (saved["label"] in self.allowed(session) or Path(saved["label"]).is_absolute()):
                     self.select(session, saved["label"])
                 elif parent:
                     session.root, session.label, session.parent_id = parent.root, parent.label, parent.id
@@ -220,12 +214,11 @@ class Runtime:
                     session.root = Path(self.ctx.get_config("cli_root", "") or self.launch_root).resolve(strict=True)
         if session.root is None:
             labels = list(self.allowed(session))
-            context = "dotdotgod is inactive; ordinary host tools remain available. Only dotdotgod_project_initialize may run without selection, with an explicit absolute root and existing write confirmation. Initialization does not select or authorize a repository."
+            context = "dotdotgod is inactive; ordinary host tools remain available. Select a project using dotdotgod_select_root with a configured label or absolute directory path, or initialize an explicit absolute directory with existing write confirmation. Initialization does not select a project."
             if labels:
-                context += " Optionally select a repository using dotdotgod_select_root. Authorized labels: " + json.dumps(labels)
+                context += " Configured project labels: " + json.dumps(labels)
             return {"context": context}
         try:
-            self.session(session_id)
             parts = []
             text = user_message if isinstance(user_message, str) else " ".join(p.get("text", "") for p in user_message if isinstance(p, dict))
             if not session.loaded and not re.search(r"(?:^|\s)/?dd:no-load\b|(?:^|\s)/no-load\b", text):
@@ -247,7 +240,7 @@ class Runtime:
 
     def finalize(self, session_id="", **kwargs):
         for child in list(self.sessions.values()):
-            if child.parent_id == session_id:
+            if session_id and child.parent_id == session_id:
                 self.finalize(child.id)
         session = self.sessions.pop(session_id, None)
         if session and session.proxy:
@@ -256,7 +249,7 @@ class Runtime:
     def end_turn(self, session_id="", interrupted=False, **kwargs):
         if interrupted:
             for child in list(self.sessions.values()):
-                if child.parent_id == session_id:
+                if session_id and child.parent_id == session_id:
                     self.end_turn(child.id, interrupted=True)
             session = self.sessions.get(session_id)
             if session and session.proxy:

package/skills/project-initializer/templates/case-and-evidence.json

@@ -215,10 +215,5 @@
       ]
     }
   },
-  "planMode": {
-    "writablePaths": [
-      "docs/plan/**",
-      "docs/archive/**"
-    ]
-  }
+  "planMode": {}
 }

package/skills/project-initializer/templates/dotdotgod.config.json

@@ -230,10 +230,5 @@
       ]
     }
   },
-  "planMode": {
-    "writablePaths": [
-      "docs/plan/**",
-      "docs/archive/**"
-    ]
-  }
+  "planMode": {}
 }

package/skills/project-initializer/templates/policy.json

@@ -237,10 +237,5 @@
       ]
     }
   },
-  "planMode": {
-    "writablePaths": [
-      "docs/plan/**",
-      "docs/archive/**"
-    ]
-  }
+  "planMode": {}
 }

package/skills/project-initializer/templates/portfolio.json

@@ -251,10 +251,5 @@
       ]
     }
   },
-  "planMode": {
-    "writablePaths": [
-      "docs/plan/**",
-      "docs/archive/**"
-    ]
-  }
+  "planMode": {}
 }

package/skills/project-initializer/templates/publication.json

@@ -261,10 +261,5 @@
       ]
     }
   },
-  "planMode": {
-    "writablePaths": [
-      "docs/plan/**",
-      "docs/archive/**"
-    ]
-  }
+  "planMode": {}
 }

package/skills/project-initializer/templates/research.json

@@ -283,10 +283,5 @@
       ]
     }
   },
-  "planMode": {
-    "writablePaths": [
-      "docs/plan/**",
-      "docs/archive/**"
-    ]
-  }
+  "planMode": {}
 }

package/skills/project-initializer/templates/software.json

@@ -230,10 +230,5 @@
       ]
     }
   },
-  "planMode": {
-    "writablePaths": [
-      "docs/plan/**",
-      "docs/archive/**"
-    ]
-  }
+  "planMode": {}
 }