dodo-mcp 1.2.1 → 1.3.1

package/docs/SECURITY.md

@@ -29,6 +29,19 @@ DODO ใช้หลายชั้นร่วมกัน:
 
 การผ่านชั้นใดชั้นหนึ่งไม่ grant สิทธิ์ชั้นอื่น
 
+Windows filesystem sharing-lock retries are bounded syscall retries. The journaled
+writer revalidates paths and expected bytes before each replacement, deletion or
+move attempt, including compensation. A concurrent external edit stops the retry
+and is preserved for review; the entire tool/action is never repeated implicitly.
+Internal OS error causes remain private and are omitted from MCP error envelopes.
+
+Windows private-directory initialization rereads owner/DACL on each invocation.
+An exact current-user-owned, protected, three-principal FullControl ACL is left
+unchanged instead of re-propagating identical permissions into live descendants
+while other owner CLI processes initialize them. This is not a permission cache;
+unexpected owners and permissive verification paths still fail closed. Native
+and PowerShell implementations apply the same checks, including final revalidation.
+
 Project Registry เป็น owner metadata แยกจาก authority: project ID หรือ readiness
 ไม่ grant OAuth scope, workspace ACL หรือ trust และ AI ไม่มี MCP tool สำหรับเพิ่ม ลบ
 หรือเปลี่ยนรายการโปรเจกต์
@@ -341,3 +354,113 @@ Admin API ไม่อยู่บน public MCP Events ใช้ authenticated
 ใช้ textContent แสดง path/model/error และไม่ render HTML จากโมเดล Tunnel credential
 อยู่ใน reviewed OS store/reference และไม่ถูกส่งกลับให้ browser การเริ่ม DODO,
 ปลดล็อก Keychain และให้ macOS permissions ต้องผ่านเจ้าของ
+
+## Verified recovery and staged-index boundaries
+
+`rollback_changes` is restricted to the principal that owns the committed
+changeset. A write scope alone does not authorize another caller's undo. This
+matches the agent snapshot contract. Cross-caller recovery is an explicit owner
+operation, `recover.rollback`, on authenticated private administration, with a
+current workspace/epoch, idempotency receipt and audit. It is not an MCP tool or
+an input flag that an AI can set. Existing changesets retain their recorded
+owner; no ownership migration or automatic transfer occurs.
+
+Before source mutation, DODO verifies stored before-image bytes, file identity,
+path policy and current hashes. Restore uses the same engine with an inverse
+plan and its own pre-restore backups. A durable write intent is saved before the
+filesystem operation; startup verifies actual bytes rather than trusting a
+journal status alone. Mixed, damaged or unverifiable state requires owner review;
+startup never replays filesystem writes. Unknown historical rollback direction
+is treated as recovery-required. Final hash checks preserve conflicting human
+edits rather than reporting a successful restore.
+
+`git_commit` validates the entire staged diff, including previously staged files,
+against workspace and denied-path rules. Staging uses a separate candidate index;
+a refused stage/commit leaves the user's index unchanged. Allowed pre-existing
+staged changes remain part of normal Git commit semantics. A commit whose result
+or index publication is uncertain requires inspection instead of silent retry.
+Git hooks/filters still execute under the existing exec policy and OS account:
+this protection is not a sandbox against arbitrary hooks or other local programs.
+
+Current recovery covers journaled file edits, not every effect of shell commands,
+package installs, directory creation, browser/desktop/device actions, databases
+or external editors. File mode bits are preserved where supported; this is not
+a full ACL/xattr/ownership backup. Portable path rechecks reduce races but do not
+provide filesystem confinement against a hostile process with the same OS user.
+The source snapshot/session UI uses the boundaries below.
+
+## Automatic source snapshots
+
+Recovery policy is private owner state; repository settings, MCP calls, discover
+visibility and trust overrides cannot disable it. Explicit opt-out is confirmed
+and audited. Source/backup identity and hashes are checked before effects.
+Caller authority and schedule approvals are rechecked after asynchronous backup.
+No credential echo, extra OAuth scope or approval bypass is introduced.
+See [Recovery boundaries](RECOVERY.md): this does not restore DBs, secrets, remote
+effects or all metadata, and same-user TOCTOU and tampering limits still apply.
+
+
+Reviewed restore binds plans to caller/project/root identity/epoch and
+requires write scope plus the existing exact-action approval in inspect mode.
+Source selection, backup integrity and current hashes are checked again under the
+shared mutation queue. Private owner cross-caller access is not an MCP argument.
+Session receipt chains reject interleaved edits; unknown shell authorship is never
+claimed as exclusively owned. Restore status and durable idempotency support
+reconnect without repeating uncertain effects. See [ADR-052](adr/052-reviewed-source-restore.md).
+
+## Recovery R03
+
+Expected source state is separate from observed backups. External target drift fails closed; only verified committed journals or exact, live owner acknowledgement can advance the baseline. MCP read access cannot acknowledge drift. Acknowledgement never grants OAuth/trust/exec authority. Private Git copies use captured bytes and an empty private index; no working Git history/config, hooks, filters, remotes or helpers are imported. Selected backup paths must be dedicated private directories, outside project/state/credential namespaces, with pinned identity; unavailable volumes do not fall back. Content and Git bytes share quotas. Job observations remain unknown-author data and hold the mutation ticket until their bounded scan finishes. See ADR 053 for scope and root-replacement limits.
+
+
+## Recovery R04
+
+Recovery names/pins are private owner actions, with current project/epoch, confirmation and live authority checks. They never promote test results or grant permissions. No public mark/purge endpoint exists. Caller-owned evidence retains target ACL checks; current inspection compares snapshot/recipes/runtime and never consumes model-supplied success. Truncated/unknown/skipped test evidence cannot certify a snapshot. Raw test logs and environment values are excluded from Recovery metadata. Source integrity, expected hashes, approvals and sandbox remain unchanged. Names and diffs use text-only DOM rendering. Production/DB protection is not implied.
+
+## registered deployment adapters
+
+Docker daemon access is explicitly owner registered and still subject to target
+OAuth scope/ACL, current workspace/epoch, exec approval, source hashes and the
+configured command sandbox. Snapshot creation grants none of those rights.
+No repository Compose hooks, arbitrary Docker arguments, bind mounts, privileged
+mode or permission fallback are accepted. Archive extraction verifies bytes in
+memory without executing or copying mounted data. Health requests use declared
+network scope and reject redirects/metadata/admin URLs, including actual private
+listener ports. No provider credentials or `allowWebFetch` permission are reused.
+
+Owner maintenance cannot be discovered/invoked through MCP. Exact review hashes,
+live state and expiry bind cleanup/uncertainty acknowledgement. No force deletion,
+volume prune, silent retry, database downgrade or automatic health success is
+performed. Private job output is not exposed through normal job output tools.
+Generic shell/other daemon clients remain outside this adapter's deployment guard;
+a workspace boundary is not an OS or Docker security sandbox.
+
+## private data recovery
+
+Database/config opt-ins do not inherit from default-on source backup. Read-only
+SQLite metadata and owner-authored compatibility rules never execute migrations
+or grant generic SQL rollback. Rule checks before and after the source backup
+reduce drift; an external database is not part of the source transaction.
+
+Encrypted config uses dedicated private state and OS-only AES-256-GCM keys, with
+project/root/target/revision-bound associated data. Registered inputs must already
+be private, source-denied files. Owner-only preview is redacted; MCP/discover cannot
+configure, decrypt or restore those copies. Keys never travel in argv/config JSON
+or logs; OS-store failure has no plaintext fallback. Lost keys are unrecoverable.
+
+Restore writes an existing file in place after an encrypted before-copy and durable
+UNKNOWN receipt. A crash may leave partial bytes; it never silently retries or
+restarts services. Owner/context/content checks and same-user filesystem race
+limits apply. Key rotation retains old references; retention protects referenced
+backups and does not promise physical secure erasure. See [ADR 056](adr/056-owner-data-recovery.md).
+
+## Config session isolation (1.3.1)
+
+Local Config retains its eight-hour process capability. Each owner CLI opening of
+Remote Config creates a distinct, random internal capability bounded by that
+one-hour lease. It never renews or reuses the local browser token. Closing, expiry
+or reopening revokes the old remote capability and cookie. No credential is sent
+in a remote URL or returned by state APIs. AI owner principals, streaming requests
+and queued owner revalidation use the authenticated request session, not the
+server start time. Loopback, Host/Origin, proxy-header rejection, rate limits,
+workspace/epoch checks and public MCP OAuth remain enforced.

package/docs/TEST_REPORT.md

@@ -1,5 +1,225 @@
 # DODO MCP — Test Report
 
+## 1.3.1 Config regression coverage
+
+`tests/security/remoteConfig.test.ts` reproduces the previous HTTP 401 after advancing
+the server clock nine hours, then verifies an independent CLI-created session,
+AI owner expiry, settings writes, renewal and queued-request revocation.
+`tests/security/localConfig.test.ts` checks distinct capabilities, local expiry,
+remote revocation and Host/Origin/proxy-header enforcement.
+`tests/integration/remoteConfigUi.test.ts` exercises desktop/mobile Chromium after
+local expiry and re-pairs after closing without restarting the fixture process.
+External AI clients and real Cloudflare remain MANUAL_NOT_RUN; the connection guide
+is based on client documentation and is not a live platform certification.
+
+## 1.3.0 Recovery — หลักฐานก่อน final platform gate
+
+Windows full [run35510440500](https://github.com/arthittakun/dodo-mcp/actions/runs/35510440500)
+ที่ `66605d9`: 907pass/1fail/38skip ปัญหา atomic edit เดิมผ่านแล้ว เหลือ concurrent
+CLI project registration ถูกปฏิเสธที่ private ACL Native diagnosis
+[run35511792781](https://github.com/arthittakun/dodo-mcp/actions/runs/35511792781)
+ทำซ้ำได้13/15pass,2fail,0skip และระบุ guard `final-owner` ระหว่าง protect
+แพตช์ `d145a3e` ไม่เขียน/propagate ACL ซ้ำเมื่อผลอ่านสดตรง canonical policy
+แต่ยังตรวจ owner, DACL และ reparse ใหม่ทุกครั้ง ไม่มี permission cache
+[run35512074966](https://github.com/arthittakun/dodo-mcp/actions/runs/35512074966)
+ผ่าน17/17,0skip รวม concurrent add6process จำนวน3รอบ, foreign-owner/permissive
+ACL rejection และ PowerShell fallback ผลนี้เป็น focused pass; full gates ต้อง
+ผ่านบน clean candidate หลังแพตช์นี้ก่อน release
+
+macOS และ Linux native Node22/24 full ที่ `66605d9` ผ่านก่อนแพตช์ ACL ล่าสุด:
+macOS910pass/36skip; Linux902pass/44skip ต่อ Node; 946total,0fail,
+packaging17/17, benchmark7/7, audit0 และ fresh install PASS ทั้งหมด
+ไม่ใช้ผล revision ก่อนหน้าแทนการตรวจ candidate หลังแก้
+
+Follow-up Windows หลังแก้ Git/restore: full
+[run35508647355](https://github.com/arthittakun/dodo-mcp/actions/runs/35508647355)
+ที่ `6ff35b8` ได้900pass/1fail/38skip เหลือ atomic modification ของไฟล์ชื่อไทย
+ที่มี BOM/CRLF ระบบชดเชยกลับและคืน INTERNAL_ERROR Focus
+[run35509902825](https://github.com/arthittakun/dodo-mcp/actions/runs/35509902825)
+ทำซ้ำได้8pass/1fail/0skip; OS errno เดิมไม่ได้ถูกเก็บ จึงไม่ระบุว่าเกิดจาก antivirus
+หรือโปรแกรมใดโดยไม่มีหลักฐาน
+
+ระหว่างตรวจพบและ reproduce อีกปัญหา: การ retry syscall หลัง sharing denial
+ต้องตรวจ expected state ซ้ำ การจำลอง external edit ทำให้ regression3/3ล้มก่อนแก้
+แพตช์ `560d930` ตรวจ hash/path ทุกครั้ง รวม compensation และเก็บ internal cause
+แบบ private โดยไม่ส่งออก MCP error envelope Native
+[run35510211305](https://github.com/arthittakun/dodo-mcp/actions/runs/35510211305)
+ผ่าน16/16,0skip รวมเคส BOM/CRLF และ7retry/compensation/error-redaction cases
+ผลนี้เป็น focused pass; full gates ของ candidate หลังแก้ยังต้องผ่านก่อน release
+
+Follow-up วันที่ 2026-09-20 ที่ clean revision `8c76c0a`
+(`sha256:a9118f3ce6d37a0520ef64720122eb36e9c684154aebb9cb984e8e6459f148bc`):
+
+| Platform | Core (142 files / 938 tests) | Packaging | Fresh install |
+|---|---|---|---|
+| macOS arm64 / Node 22 | 902 pass / 0 fail / 36 skip | 17/17 | PASS |
+| Linux native / Node 22 | 894 pass / 0 fail / 44 skip | 17/17 | PASS |
+| Linux native / Node 24 | 894 pass / 0 fail / 44 skip | 17/17 | PASS |
+
+ทั้งสาม gate: build/typecheck/lint/test:all exit0, DodoBench7/7, production audit0
+Linux [run35507491429](https://github.com/arthittakun/dodo-mcp/actions/runs/35507491429)
+ยืนยัน fresh-install หลังแก้ Node24 fixture connection reset: retry เฉพาะ initialize
+ที่ไม่มี effect ไม่ retry tool calls หรือ OAuth exchange
+
+Windows full [run35506660660](https://github.com/arthittakun/dodo-mcp/actions/runs/35506660660)
+ที่ `acf805a`: Node24 core889pass/7fail/38skip; duplicate-activation/UI409 ผ่านแล้ว
+เหลือ Git-copy6เคส และ timeout ของ scenario restore15ไฟล์ หลังเก็บหลักฐานยกเลิก
+Node22 ของ revision เก่าเพื่อทดสอบแพตช์ใหม่ ไม่ถือว่ารอบที่ยกเลิกผ่าน
+แพตช์ Git-copy ใช้ writable fd สำหรับ mandatory flush และ fixture ของปลายทาง private
+ใช้ Windows ACL จริง ความถูกต้องของแพตช์ต้องอ้าง native run ของ revision นั้น
+ผลย้อนหลังข้างต้นไม่ใช้แทน final gate หลังเปลี่ยน source
+
+Windows focused [run35507971440](https://github.com/arthittakun/dodo-mcp/actions/runs/35507971440)
+ที่ `144a3ee`: 22pass/3fail/0skip ยืนยัน writable-fd Git backup และ flush-failure
+regression, dirty/untracked restore15ไฟล์, worktree/large blobs และ browser drift
+success path ผ่าน เหลือสาม assertion ที่รอ asynchronous initialization ด้วย poll
+budget เริ่มต้น แยกเพิ่มเวลารอสถานะเป็น30วินาทีโดยไม่เปลี่ยนผล READY/BLOCKED
+ที่ต้องได้หรือ assertions การป้องกันไฟล์/การรันคำสั่ง Full gate ต้องรันอีกครั้ง
+บน clean revision หลังแพตช์นี้ก่อนเผยแพร่
+
+ผลแต่ละรอบอ้างเฉพาะ source fingerprint/revision ที่ระบุ ไม่ใช่ผล npm รุ่นก่อน
+และไม่รวม skipped tests เป็น pass ต้องใช้ final native Windows/Linux และ macOS
+ที่ตรง clean candidate ก่อน publish ดู [workflow](https://github.com/arthittakun/dodo-mcp/actions/workflows/platform-gates.yml)
+และ [วิธีอ่านหลักฐาน](CI.md)
+
+ชุดรวม macOS วันที่ 2026-09-20 ก่อนแก้ duplicate activation:
+`sha256:b75f20c8669d7a7fbd2e16d80104d1ef6dce4b36855a2ab039ae0d2d475d47e2`
+
+- AUTOMATED_PASS: core141files / 933total / 895pass / 0fail / 38skip;
+  packaging17/17; build/typecheck/lint/test:all/benchmark/audit/fresh install exit0
+- Production dependency audit0; DodoBench7/7
+- Fresh exact-tarball: OAuth + Compact20, Full158 with explicit Sub-agent exposure,
+  write/edit/readback, A/B routing, agent receipt; Recovery checkpoint, reviewed restore,
+  hash readback, idempotent retry, unrelated-file preservation, restart receipt and stale-context denial
+- Actual browser desktop/narrow uses isolated state; config plaintext never appears in UI
+- Actual macOS Keychain and Windows Credential Manager random-item put/read/delete passed
+  (AUTOMATED_PASS); no owner credentials touched
+
+Windows focused [run35505588240](https://github.com/arthittakun/dodo-mcp/actions/runs/35505588240)
+passed78/79,0skip and confirmed the native ACL backend (20freshchecks715ms).
+Remaining browser scan returned409 while duplicate project activation held the queue.
+Follow-up [run35506319903](https://github.com/arthittakun/dodo-mcp/actions/runs/35506319903)
+passed23/24,0skip, including all R06 security/browser/native credential tests;
+scalar diagnostics isolated the same409. The candidate now marks a checkpointed
+runtime active and avoids re-activation, with a regression that keeps external drift
+visible and source writes blocked until reviewed. These focused failures remain
+recorded; neither is a full Windows PASS. Final full gates must certify the fix.
+
+MANUAL_NOT_RUN: owner production restore, live external ChatGPT, Android hardware,
+and Linux Secret Service on a logged-in desktop. SQLite metadata fixtures do not
+claim generic database rollback/PITR. Actual disposable Docker product-adapter
+acceptance is separate from native CI and preserves database rows/volumes/config.
+
+## Unreleased — native CI workflow (2026-09-20)
+
+Linux platform gate เปลี่ยนเป็น self-hosted native เช่นเดียวกับ Windows โดยไม่ใช้
+Docker เพิ่ม prerequisites และ sandboxed Chromium launch probe; media tests ยัง
+ถูกบังคับให้รัน เก็บ evidence แยกตาม run ID/attempt เพื่อไม่เขียนทับผลเมื่อ rerun
+
+`AUTOMATED_PASS` บน macOS สำหรับการเปลี่ยน workflow/gate ครั้งนี้:
+actionlint 1.7.12, typecheck, lint และ gate-evidence unit tests **23 passed / 0 failed**
+รวมการปฏิเสธ Docker report, fingerprint/revision/lock ที่ไม่ตรง, dirty source,
+false pass และ fresh-install ที่ไม่ครบ ผลนี้ไม่ใช่ native Linux/Windows PASS
+
+Follow-up: diagnostics เพิ่มเฉพาะ test path/index/source line โดยไม่ส่ง raw error,
+titles หรือ expected/actual values และย้าย CI evidence ออกนอก checkout เพื่อไม่ถูก
+cleanup ลบ Typecheck/lint/actionlint และ gate-evidence tests **25 passed / 0 failed**
+ผ่านบน macOS หลังแก้ ส่วน native application test results ต้องดูแยกตาม CI run
+
+Native CI [run 35495748297](https://github.com/arthittakun/dodo-mcp/actions/runs/35495748297)
+ทดสอบ clean commit `e0e5f9a9b14d0d2e7f4c776aeaf0e19b621eb8f9`
+และ fingerprint `sha256:83791f00f244466f064ea413494e7555406835b276f562dca809e3c8901ae665`
+โดยตรงบน Linux X64 ไม่มี Docker:
+
+| Gate | Node 22.23.2 | Node 24.21.0 |
+|---|---|---|
+| build/typecheck/lint/full suite | exit 0 | exit 0 |
+| Core / 874 tests | 833 pass / 41 skip / 0 fail | 833 pass / 41 skip / 0 fail |
+| Packaging | 17 pass | 17 pass |
+| DodoBench | 7/7 pass | 7/7 pass |
+| Production audit | 0 vulnerabilities | 0 vulnerabilities |
+| Fresh exact-tarball install | PASS | PASS |
+
+ก่อนหน้านี้ run 35495249409 ที่ commit `723733e` มี Linux Node 24 core failure
+หนึ่งเคส (830 pass / 41 skip) ส่วน Node 22 ผ่านครบ ยังไม่ยืนยันสาเหตุของ failure
+รอบแรก และไม่อ้างว่า diagnostics change แก้ runtime bug ผลรอบล่าสุดข้างบนผ่านจริง
+แต่ไม่ลบหรือแทนที่ประวัติผลล้มเหลว
+
+Windows Node 22/24 ในรอบแรกล้มก่อน step แรกที่ runner `InitializeSecretMasker` /
+`PowerShellPreAmpersandEscape` ไม่มี application tests ได้รัน ดู [CI](CI.md)
+สำหรับการเปิด runner ใหม่ สถานะรอบแรกเป็น `RUNNER_BLOCKED` ไม่ใช่ application PASS
+และไม่ได้ rerun ใน Linux-only รอบดังกล่าว
+
+หลังเจ้าของเปิด runner ใหม่ [Windows run 35496561994](https://github.com/arthittakun/dodo-mcp/actions/runs/35496561994)
+ที่ clean commit `1739646f0678a6e1c29bc92c8eba6cd1a017f0df` ผ่าน startup แล้ว
+Node 24.21.0 ผ่าน build/typecheck/lint แต่ `test:all` หมดเวลา 30 นาที
+(1,800,010 ms) จึงเป็น `AUTOMATED_FAIL` ไม่มี complete core JSON report และยังไม่ถึง
+packaging/benchmark/audit/fresh install Node 22 ถูกยกเลิกก่อนทดสอบเพื่อวินิจฉัย
+ไม่ถือเป็น PASS หรือ application failure ของ Node 22
+
+[การอ่านหลักฐานเดิม](https://github.com/arthittakun/dodo-mcp/actions/runs/35498195971)
+พบ reporter output ของ 49 ไฟล์ / 490 tests / 47 failures / 29 skipped ก่อน timeout
+เป็น **ผลบางส่วนเท่านั้น** ไม่ใช่ยอดรวม full suite มี failures ใน Recovery และ
+integration อื่น จึงห้ามสรุปว่าเพิ่ม timeout อย่างเดียวจะผ่าน หรือยกเลิก backup/ACL
+เพื่อให้ผลเขียว งานตรวจเฉพาะกลุ่มมี scope `focused_diagnostics_only` ไม่ใช่ release gate
+Manual Windows acceptance ยัง `MANUAL_NOT_RUN`
+
+Focused reproduction [run 35498746408](https://github.com/arthittakun/dodo-mcp/actions/runs/35498746408)
+จบจริง: **17 pass / 8 fail / 0 skip** ใน 2 ไฟล์ (236,088 ms)
+พบ private ACL verifier คืน metadata ก่อน Windows ปรับ Administrators owner
+ขณะที่ journal ตรวจ ctime จาก file descriptor หลังปรับ จึงเกิด `CONFLICT` ทั้งที่
+backup ถูกต้อง แพตช์คืน metadata หลังตรวจ ACL พร้อมปฏิเสธ identity/type/content
+ที่เปลี่ยนระหว่างตรวจ ไม่ลบ hash/ACL/owner/reparse guards
+
+หลังแก้ที่ `89b762b` [Windows focused run 35499178559](https://github.com/arthittakun/dodo-mcp/actions/runs/35499178559)
+**34 pass / 0 fail / 0 skip** ใน 3 ไฟล์ (302,245 ms): recoveryBackups, directTools
+และ windowsAclOwner รวม native owner/DACL/junction checks และการอ่าน metadata
+หลัง owner repair ผลนี้เป็น `AUTOMATED_PASS` เฉพาะชุดย่อย ไม่ใช่ full Windows gate
+
+Local macOS สำหรับแพตช์: typecheck/lint ผ่าน, 31 focused tests pass / 9 native
+Windows tests skipped ไม่อ้าง skips เป็น Windows evidence Windows full gate
+รอบต่อไปใช้ aggregate `test:all` budget 60 นาที โดยคง timeout ราย test/hook และ
+assertions เดิม ผล full gate หลังแพตช์ยังรอยืนยัน
+
+ผล Recovery/Docker ด้านล่างเป็นหลักฐานของ candidate รอบก่อนตาม fingerprint เดิม
+ไม่ใช้แทน native CI ข้างบน ไม่มี merge main หรือ npm publish จากผลนี้
+
+## Unreleased — Source Recovery R00–R02 candidate
+
+ตรวจ 2026-09-20 บน source fingerprint
+`sha256:89c3ad25f99781f41824c3b13c39400ef231d173ea818e7eb9cd1717d4782c69`
+ผลนี้เป็น development candidate ไม่ใช่การรับรองว่า npm รุ่นที่เผยแพร่มีฟีเจอร์นี้แล้ว
+
+| Gate | macOS arm64 / Node 22 | Linux Docker arm64 / Node 22 |
+|---|---|---|
+| build, typecheck, lint, test:all | exit 0 | exit 0 |
+| Core: 121 files / 832 tests | 797 pass / 35 skip / 0 fail | 791 pass / 41 skip / 0 fail |
+| Packaging / fresh installed restore | 17 pass / 0 fail | 17 pass / 0 fail |
+| Production npm audit | 0 vulnerabilities | 0 vulnerabilities |
+| DodoBench | not rerun in this gate | 7/7 pass |
+
+`AUTOMATED_PASS`: real HTTP OAuth/target A/B/caller isolation, read-only refusal,
+inspect approval, external hash/mode conflicts, dirty Git index preservation,
+binary/directory/partial restore, injected write failure compensation, six abrupt
+restore crash boundaries, private owner API and built CLI. Real Chromium verifies
+desktop/390px preview → confirmation → restore → journal status. PACK-17 repeats
+backup/preview/restore/read-back/idempotent retry against an installed tarball.
+
+Linux fresh exact-tarball smoke additionally verifies Full STDIO 148 and Compact
+HTTP 20, OAuth, write/edit, target routing and sub-agent protocol fixtures. Sub-agent
+operations are explicitly enabled in that smoke; the normal hidden Full count is 144.
+
+One preliminary full run failed a Brain per-run metric assertion when automatic
+indexing ran before the fixture's manual rebuild. The fixture isolates that timer;
+the real parser/index/security and original assertions remain. The final full runs
+above passed; preliminary failed logs were retained. Skips cover platform/backend
+conditions and are not counted as passes.
+
+`MANUAL_NOT_RUN`: native Windows/Android, live owner data restore, live provider
+credentials and publication. Automated browser use is not `MANUAL_PASS`.
+See [Recovery scope and limitations](RECOVERY.md) and
+[ADR-052](adr/052-reviewed-source-restore.md).
+
 ## 1.2.1 Agent Profile creation and Compact/Hybrid visibility controls
 
 วันที่ตรวจ: 2026-09-16
@@ -505,11 +725,11 @@ Fresh release smoke ติดตั้ง exact tarball ใน temporary prefix
 แบบ explicit แล้วตรวจ CLI 1.0.0, STDIO Full 125, HTTP Streamable + OAuth Compact 19,
 write/edit read-back และ Sub-agent receipt จริง ค่า default-off ถูกตรวจแยกใน STDIO/HTTP/
 packaging regressions
-Release policy ใช้ macOS local และ Linux Docker โดย report ต้องมี revision/lock digest
-ตรงกันก่อน strict gate จะผ่าน Linux Docker image ติดตั้ง Playwright Chromium
-Dedicated self-hosted GitHub Actions รัน Linux X64 Docker และ Windows X64 native
-candidate บน Node 22/24 โดยไม่รับ untrusted pull requests Windows manual acceptance
-ยังคง `MANUAL_NOT_RUN`
+นโยบายปัจจุบันใช้ macOS local และ Linux native GitHub Actions โดย report ต้องมี
+clean revision/source fingerprint/lock digest ตรงกันก่อน strict gate จะผ่าน
+Dedicated self-hosted GitHub Actions รัน Linux X64 และ Windows X64 โดยตรงบน
+Node 22/24 โดยไม่รับ untrusted pull requests Windows manual acceptance
+ยังคง `MANUAL_NOT_RUN` ดู [CI](CI.md) สำหรับ prerequisites
 
 ## Required security scenarios
 
@@ -555,3 +775,90 @@ end-to-end บนอุปกรณ์ภายนอก: `MANUAL_NOT_RUN`
 สถานะ Runtime Intelligence ผ่าน external AI และ owner repository จริง: `MANUAL_NOT_RUN`
 
 สถานะ Advanced Agent Runtime ผ่าน external AI และ owner repository จริง: `MANUAL_NOT_RUN`
+
+## Unreleased R03 candidate — 2026-09-20 (AUTOMATED_PASS)
+
+Final source/test/gate fingerprint: `sha256:e8e638e493bbdacf27f39221178ba29005c9c094348c4cca2cbec19f7ad15f5b`.
+
+| Gate | macOS arm64 / Node 22.23.2 | Linux Docker arm64 / Node 22.23.2 |
+|---|---:|---:|
+| Build, typecheck, lint | exit 0 | exit 0 |
+| Core (124 files / 851 tests) | 816 pass / 35 skip / 0 fail | 810 pass / 41 skip / 0 fail |
+| Packaging | 17 pass / 0 fail | 17 pass / 0 fail |
+| Production npm audit | 0 vulnerabilities | 0 vulnerabilities |
+| Headless desktop/narrow owner UI | pass | pass |
+| Exact tarball install and HTTP OAuth / STDIO | packaging smoke pass | release smoke pass |
+
+R03 exercises persistent same-size/mtime drift, 54 overwrites + 2 deletions, original/emergency snapshot separation, unknown-author job observation, unchanged/non-target writes, nested ignore rules, deadline/raced hash failures, exact owner acknowledgement and revoked/stale authority. Independent Git tests cover staged secrets, hooks/filters, preserved index/HEAD/config, unborn/detached/parent/linked-worktree repositories, large blobs, unavailable backup volumes, quotas, and uncertain final journal persistence. Existing restore crash, OAuth, ACL, sandbox and path guard suites remain enabled.
+
+A separate disposable disaster fixture deleted the original root, working `.git` and CAS objects. On both platforms two approved files were recovered byte-for-byte from independent bare Git objects into a NEW directory; excluded credentials/database data were not restored. This demonstrates an owner-directed recovery procedure, not permission to override the original runtime's root identity.
+
+Environment-specific 200-file × 8 KiB scan measurements: unchanged source 63 ms macOS / 151 ms Docker; 54 overwrites + 2 deletions including emergency copy 2316 ms / 1382 ms. The default scan budget is 15000 ms; these small fixtures do not establish performance for all repositories. Linux DodoBench also passed its seven existing cases.
+
+Earlier failed rounds are retained privately: a legacy-schema fixture omitted new tables; a new test used the wrong fixture accessor; expected transport/error assertions were corrected to their actual typed contract. Final gates above reran the complete suite. Detailed logs, manifests, screenshots and checksums stay in private development evidence and are excluded from npm.
+
+MANUAL_NOT_RUN: live owner projects, native Windows/Android, physical removable-drive removal, live ChatGPT and external provider credentials. Automated browser tests are not manual acceptance. No npm publish or owner-server restart was performed.
+
+## Unreleased R04 candidate — 2026-09-20 (AUTOMATED_PASS)
+
+Source fingerprint (both gates):
+`sha256:fb79ab8f05a095b47545299af30e0dabb48633a2a547e3025990101688c375bc`.
+This is a dirty development candidate, not the published package with the same
+version metadata. No release readiness claim is made.
+
+| Platform | Core | Packaging | Skipped | Failures |
+|---|---:|---:|---:|---:|
+| macOS arm64, Node 22.23.2 | 833 passed / 868 | 17 passed | 35 | 0 |
+| Linux Docker arm64, Node 22.23.2 | 827 passed / 868 | 17 passed | 41 | 0 |
+
+`npm run build`, `npm run test:all` (including typecheck/lint), packaging and
+installed-package checks exited 0. Linux additionally passed the 7-case DodoBench
+and exact-tarball fresh-install smoke (Full STDIO 148; HTTP/OAuth Compact 20,
+write/edit/read-back and target routing). Production dependency audits reported
+0 vulnerabilities on both platforms. Platform/optional skips remain explicit in
+private machine reports; skipped tests are not passes.
+
+17 new R04 cases cover actual passing/failing/skipped/truncated/unknown/inconsistent
+recipe output, manifest/recipe/runtime drift, caller isolation, owner expiry,
+revision races/tombstones, immutable snapshots, protected pin/name retention,
+OAuth read-only/revoked ACL, rejected model-supplied status, private/public admin
+separation and hostile Origin/proxy headers. Browser fixtures on desktop/390px
+register a project with Recovery on, edit through MCP, verify, pin/name, detect
+stale source, restore/read back, and show a real quota reservation failure. Existing
+restore/crash/hash/secret/sandbox tests remain enabled. UI assets are included in
+the tarball and do not use external CDNs.
+
+MANUAL_NOT_RUN: owner's live projects/storage, native Windows, Android and live
+ChatGPT. Production/database recovery is not implemented in R04. Browser fixture
+screenshots are automated evidence, not manual owner acceptance. The first local
+Docker build failed because its daemon was off; the completed container gate above
+was run after starting Docker. Early test-fixture mistakes were corrected without
+relaxing security/schema assertions and remain in private logs.
+
+## Unreleased deployment/data recovery candidates — 2026-09-20
+
+R05 source fingerprint `sha256:548622178672a0baf317c33db634d17e33a1d28595781c48d9e18c4a4020b5c5`:
+macOS core135files910total874passed36skipped0failed; packaging17/17. Native Linux
+Node22+24 in run35503836757 each868passed42skipped0failed; packaging17/17,
+benchmark7/7, production audit0 and fresh tarball installPASS. All gate commands
+exit0. Disposable actual Docker acceptance separately passed (26.12s), including
+source/image tampering, unhealthy deployment, exact image rollback, source restore,
+unchanged SQLite/private volume data and reviewed probe/image cleanup.
+
+Initial R06 source fingerprint `sha256:77595e3557db592479fcb32c41324d2fdd7f441d10560622343c9f13a040a4c5`:
+macOS Node22 core141files929total892passed37skipped0failed; packaging17/17,
+benchmark7/7,audit0,fresh tarball installPASS; all gate commands exit0. Browser
+fixture exercises SQLite registration, encrypted config backup/redacted review/
+restore, real file read-back, CLI and desktop/narrow layouts. Crypto fixtures use
+an explicitly injected key store; a separate actual macOS Keychain random-item
+put/read/delete test also passed. Helper protocol fixtures cover secret stdin,
+fixed references and failure behavior for macOS/Windows/Linux.
+
+These snapshots predate final combined changes and are not release authorization.
+Native Windows R04 focus35503022077 used native .NET ACL checks (20checks718ms),
+75/78passed;3failures remained in drift tests. The earlier full Windows run failed.
+Those failures remain recorded and are not replaced with skipped assertions.
+Subsequent fixes require new exact-source native gates. Live owner production,
+manual ChatGPT, Linux Secret Service and Windows Credential Manager acceptance
+are MANUAL_NOT_RUN unless a later result explicitly records them. Database row
+rollback/PITR is NOT_SUPPORTED; no such result is implied by source recovery.

package/docs/TUNNEL.md

@@ -143,6 +143,12 @@ query/fragment secret Pairing code มีอายุสั้นและใช
 cookie แบบ `Secure`, `HttpOnly`, `SameSite=Strict`, `Path=/config` Lease ปิดเองภายใน
 หนึ่งชั่วโมง การเปิดใหม่ยกเลิก code/session เดิม
 
+ตั้งแต่ 1.3.1 session ของ Remote Config แยกจาก Local Config 8 ชั่วโมงโดยสมบูรณ์
+รัน `dodo --web` หลัง DODO เปิดเกิน 8 ชั่วโมงได้ทันที ไม่ต้อง restart หรือเปิด Local link
+ก่อน การเปิดรอบใหม่ไม่ต่ออายุ Local link เดิม และไม่เปลี่ยน workspace epoch
+AI/Projects, streaming และ owner action ที่รอคิวใช้ session ของคำขอนั้นจริง
+ดู [วิธีเชื่อม AI clients](MCP_CONNECTIONS.md) สำหรับ MCP URL กับ OAuth callback
+
 Remote Config proxy ไปยัง Local Config loopback โดยคง Host/Origin/proxy-header checks,
 private capability, rate limit, workspace ID/epoch และ owner policy เดิม การปิด lease
 ไม่หยุด MCP หรือ Tunnel และไม่มี MCP tool สำหรับเปิดหน้า owner นี้

package/docs/WEB_CLIENTS.md

@@ -1,5 +1,8 @@
 # DODO MCP — เชื่อม ChatGPT และ Web Clients
 
+ดู [คู่มือทุก AI platform](MCP_CONNECTIONS.md) สำหรับ Claude พร้อมตัวเลือก
+Sign in now / Use your own OAuth client และตัวอย่าง Claude Code, Codex, Gemini CLI, Cursor, VS Code
+
 ## สิ่งที่ต้องแยกให้ออกก่อน
 
 | ค่า | ใช้ตรงไหน | ตัวอย่าง |

package/docs/adr/047-temporary-remote-config.md

@@ -45,3 +45,14 @@ expiry still affects only Remote Config; MCP, OAuth and Tunnel continue running.
 - `tests/security/remoteConfig.test.ts`
 - `tests/integration/remoteConfigUi.test.ts`
 - `tests/integration/cli.test.ts`
+
+## 1.3.1 — independent owner sessions
+
+The original bridge reused the eight-hour Local Config capability. After eight
+hours a fresh one-hour CLI lease could pair but all upstream API calls failed.
+The bridge now obtains a separate capability with exactly its own lease deadline
+through the in-process Local Config handle. Reopening revokes the old capability;
+local browser expiry is unchanged. Request-bound session validation also governs
+AI owner principals, event streams and queued owner actions. The one-hour public
+lease and one-time pairing remain mandatory. Both owner-managed Cloudflare Local
+and DODO-managed Tunnel modes can open this lease. No server restart is needed.

package/docs/adr/051-source-recovery-foundation.md

@@ -0,0 +1,45 @@
+# ADR-051 — Default-on source backup foundation
+
+Status: implemented in unreleased working source. Reviewed restore and session
+pins are implemented in [ADR-052](052-reviewed-source-restore.md); publication
+still requires an explicit owner release request.
+
+Each leased project runtime owns a RecoveryService. Only owner-registered roots
+activate scanning. Missing versioned private project policy means enabled;
+explicit owner opt-out is preserved. Owner web and CLI share IPC validation.
+Repository configuration and model output cannot alter this policy.
+
+Storage is an independent CAS under private installation state. Immutable
+manifests bind project/workspace/root identity, epoch, implicit operation session,
+actor, trigger, scope and policy digest to actual source bytes. SQLite migration
+adds snapshot states, object references, policies and reservations. Older binaries
+refuse the newer schema; no old journal or authority records are rewritten.
+
+Capture hashes the scoped inventory, reserves installation/project capacity and
+free disk, streams private object copies, fsyncs, resamples source paths/hashes,
+verifies stored objects, publishes an immutable manifest, then transactionally
+commits refs and READY. Nothing labeled READY is merely a list of hashes.
+PREPARING records interrupted by restart become INCOMPLETE under the project
+lease; no command is replayed. Resource GC cannot remove Recovery objects.
+
+The existing Applier adds targeted before-images before journal creation and
+rechecks expected hashes after asynchronous capture. JobManager's async
+startProtected captures a fresh full scope while holding the shared mutation
+queue; its sync entry refuses registered-project bypasses. All production job
+producers use that path. The scheduler rechecks durable approval after capture,
+and tool invocation rechecks caller authority after capture before effects.
+Git commit (including hooks) and directory creation also require checkpoints.
+
+Full baselines and explicit mutation targets have different coverage. Policy
+exclusions never silently remove a named target; an allowed ordinary-ignored
+source target is included, while excluded data/secret targets are refused.
+Snapshot retention preserves newest complete full/target points and pins.
+Journal before-images remain independent. ADR-052 adds restore/session pins so
+those consumers can safely retain their old CAS references.
+
+Consequences: scans cost I/O and can block mutation on quota, corruption or
+unstable files. This is neither an OS sandbox nor a filesystem-wide atomic
+snapshot. No database/volume/secret, remote side-effect, or full filesystem
+metadata recovery is implied. Session restore is implemented by ADR-052;
+verification-bound stable points remain a later phase. Backup-only releases
+without reviewed restore are not sufficient for default-on Recovery acceptance.

package/docs/adr/052-reviewed-source-restore.md

@@ -0,0 +1,50 @@
+# ADR-052: Caller-owned Recovery sessions and reviewed source restore
+
+Status: implemented in the unreleased development candidate; release verification
+and platform evidence must match the final source fingerprint.
+
+Recovery adds ten operations to the end of the full catalog; compact HTTP keeps
+20 gateways. `recoverySessionId` is optional top-level invocation context and is
+rejected inside gateway arguments. Sessions are project/root/caller-bound private
+records, independent of conversational memory. An implicit session covers one
+operation; a sub-agent run has an independent recovery session per runtime epoch.
+Restart interrupts open sessions without resuming effects. A fresh session is
+required for new mutations after restart.
+
+Before-images are independently stored CAS bytes. Session events link snapshots,
+journaled changesets, jobs and verification IDs, not raw tokens, command contents
+or model reasoning. Changeset attribution is recorded in the journal transaction
+before source writes. Job IDs are linked before process launch. Session baseline
+Git status records bounded allowed dirty/staged/untracked/deleted path metadata;
+it never modifies the index. Shell authorship is unknown. Session undo containing
+jobs is refused; a caller may review a particular checkpoint instead, without
+claiming to undo external effects.
+
+Preview stores private immutable plan metadata only. It reads current authorized
+paths, verifies manifest/object integrity and displays bounded diffs plus hashes.
+Ordinary restore leaves unrelated extras alone. Explicit exact mirror includes
+extra allowed source-file deletions and requires a full-source checkpoint. Session
+undo coalesces before-images and checks the entire receipt chain and current
+post-state; interleaved edits refuse the whole selection. Owned directory removal
+requires its recorded identity and planned children, then an empty directory at
+the actual syscall. Unjournaled parent directories are conservatively retained.
+
+Apply requires the exact reviewed plan ID/hash, same principal/project/epoch,
+live access and existing trust/approval policy. An independent pre-restore backup
+is mandatory (disabled Recovery must be re-enabled first). The shared project
+queue and R00 journal validate all files before writing; each step persists intent
+before IO. Restore is a forward changeset with pre-restore compensation bytes.
+Ordinary apply_changes cannot execute a recovery plan outside its rechecks.
+
+Idempotency is durable. An uncertain reservation never reruns effects; status can
+be inspected after reconnect. Boot classifies actual states as committed, failed
+without change, or recovery-required; it does not replay or force overwrite.
+Directory creation records the resulting identity; a crash before identity receipt
+is conservative recovery-required. Mode/existence are verified where supported;
+this is not a global filesystem snapshot or a complete ACL/xattr backup.
+
+Active/interrupted sessions, unresolved journals, live jobs, pinned snapshots and
+unexpired reviewed plans retain backup references. Closed history ages out as a
+unit under owner retention policy. Snapshot references cannot be collected by the
+resource cache. Owner cross-caller actions are only on authenticated private IPC /
+Config with reviewed context and explicit apply confirmation, never an MCP flag.