dodo-mcp 1.3.1 → 1.3.2

package/docs/ARCHITECTURE.md

@@ -261,8 +261,8 @@ gateways Report ผูก revision, dataset, dependency lock, config และ h
 
 ## Tool surfaces
 
-- Complete capability catalog 158 individual definitions (Core 104 + Advanced Agent Runtime 17 + Sub-agents 4 + Android ADB 13 + Source Recovery 10 + Deployment 10)
-- Full live catalog ค่าเริ่มต้น 154 definitions; owner เปิด Sub-agent MCP exposure แล้วเป็น 158
+- Complete capability catalog 162 individual definitions (Core 104 + Advanced Agent Runtime 17 + Sub-agents 4 + Android ADB 13 + Source Recovery 14 + Deployment 10)
+- Full live catalog ค่าเริ่มต้น 158 definitions; owner เปิด Sub-agent MCP exposure แล้วเป็น 162
 - Compact catalog 20 definitions: overview, discover และ gateways รวม `dodo_mobile`
 - Hybrid catalog 49 definitions: compact core ตามด้วย direct tools
 
@@ -463,3 +463,19 @@ through public HTTP. A WeakMap binds each authenticated Express request to its
 session; `aiAdmin` resolves that session again for queued actions and event streams.
 The gateway strips incoming credentials, injects only its own capability on the
 loopback hop, and revokes it on close/renewal. Local expiry is independent.
+
+### Recovery storage maintenance
+
+`RecoveryMaintenance` shares validation between private owner administration and
+MCP invocation. Four new operations use existing read/write compact gateways.
+A durable review binds project, caller/owner role, epoch, root identity, policy and
+selection. Apply runs in the project mutation queue and rechecks protected references
+under the SQLite write lock. AI apply requires a scoped owner approval regardless
+of trust. Review/result state and pending cleanup files have separate durable tables.
+
+Logical deletion and pending file tasks commit together before physical cleanup.
+Cleanup removes only private, unreferenced manifests/objects; installation reservations
+protect concurrent publishers. Failures retain tasks and accounting, and explicit
+pending cleanup retries do not repeat logical deletion. CAS reuse skips staging of
+unchanged content but retains fresh source/object verification. Reservation estimation
+and reservation insertion hold one installation write lock against concurrent GC.

package/docs/COMPATIBILITY.md

@@ -113,3 +113,12 @@ Protocol fixtures ครอบคลุม Responses, Gemini Interactions, Anthr
 และ Ollama Native ทั้งเจ็ด presets ซึ่งไม่เท่ากับ live API/model compatibility ของแต่ละ
 account Session credentials ใช้ได้โดยไม่ต้อง Keychain; persistent Keychain ตรวจบน macOS
 Linux Docker และ live providers ต้องดูผลแยกใน TEST_REPORT ไม่ใช้ผล macOS แทน
+
+## 1.3.2 validation scope
+
+Recovery maintenance was validated on macOS with the complete core suite, real
+Chromium desktop/narrow fixtures and freshly installed npm tarballs. Native
+Linux/Windows CI for this patch is deferred to the next release by owner decision;
+prior platform results are not evidence for these new maintenance paths.
+No platform/security checks were disabled in code. Compact remains 20 tools;
+Full exposes 158 by default or 162 when sub-agent tools are enabled.

package/docs/MANUAL_ACCEPTANCE.md

@@ -433,3 +433,31 @@ or disaster-recovery success is implied.
 - Real external AI accounts, physical eight-hour waiting and real Cloudflare
   routes are MANUAL_NOT_RUN for this patch unless separately recorded. Automated
   tests advance the server clock and use isolated HTTP/browser fixtures.
+
+## 1.3.2 Recovery maintenance
+
+Use a disposable registered project and separate private state. Never test cleanup
+against production backup history.
+
+- Create several checkpoints with an unchanged large fixture under `models/`.
+  Compare logical checkpoint totals to unique source objects and separate Git copies.
+- Select an old unprotected checkpoint. Preview, cancel confirmation, and verify
+  no deletion. Confirm a fresh preview and verify its manifest/history are removed,
+  current source is unchanged, and actual reclaimed bytes match deleted files.
+- Pin a point or prepare a restore after preview: applying the old preview must fail.
+  Latest/baseline/named/deployment/database-linked points must remain protected.
+- Set an exclusion `models/` and a project quota through the policy preview. Verify
+  old checkpoints remain intact and a new checkpoint omits the directory. Inspect
+  project/installation/free-floor limits separately if capture still refuses quota.
+- Simulate a locked backup file in fixture state. Logical cleanup must report pending
+  physical cleanup; unlock and explicitly review pending cleanup to reclaim it.
+- From MCP, discover the four `recovery_*` maintenance operations. Read-only tokens
+  cannot preview/apply writes, other callers cannot delete each other's checkpoints,
+  and write-capable trusted callers still require exact owner approval for apply.
+- Retry the same idempotency key and inspect the plan receipt after reconnect.
+  Do not infer success or repeat side effects after an uncertain response.
+- Check desktop/narrow layout, keyboard focus, error and empty states. Verify the
+  private UI remains authenticated and no public admin endpoint is introduced.
+
+Automated Chromium coverage is distinct from a manual test in an actual AI client.
+Native Windows/Linux and production project cleanup are not certified by macOS tests.

package/docs/RECOVERY.md

@@ -1,7 +1,8 @@
 # Recovery: source, deployments and private configuration
 
-This documents the 1.3.0 source candidate. Publication and supported-platform
-results are recorded separately in [release notes](RELEASE_1.3.0.md) and
+This documents Recovery including the 1.3.2 storage-maintenance additions.
+Publication and platform results are recorded separately in
+[release notes](RELEASE_NOTES.md) and
 [the test report](TEST_REPORT.md). Source backup is default-on for registered
 projects; deployment/database/config adapters require separate owner opt-in.
 
@@ -111,7 +112,7 @@ MCP full operations: `checkpoint_list`, `checkpoint_inspect`, `checkpoint_create
 `recovery_session_list`, `recovery_session_inspect`, `recovery_session_begin`,
 `recovery_session_end`, `restore_preview`, `restore_apply`, `restore_status`.
 Use the existing `dodo_read` and `dodo_write` compact gateways and discover schemas.
-Full catalog: 158 capabilities (154 with sub-agents hidden); Compact remains 20.
+Full catalog: 162 capabilities (158 with sub-agents hidden); Compact remains 20.
 Gateway arguments cannot override top-level workspace/project/recovery context.
 
 For several edits belonging to one task, call `recovery_session_begin`, then pass
@@ -200,10 +201,74 @@ refused rather than overwritten. Pins and active names both protect retention.
 Unpinning a named point alone will not delete it. Old/new name changes appear in
 owner history. Naming never rewrites source or the snapshot manifest.
 
-Advanced settings include **ดู preview การล้างตาม retention**. It shows eligible
-points and why others are retained without deleting anything. Shared objects,
-Git copies and orphan grace periods mean the logical byte total is not immediate
-free disk space. This version does not expose a manual destructive purge.
+The **จัดการพื้นที่ Recovery** panel provides reviewed manual cleanup, retention
+cleanup and retry of pending physical cleanup. It reports unique source object
+bytes separately from Git copies and the logical checkpoint total. Checkpoints
+with unchanged content share objects; adding their logical sizes does not measure
+actual disk use. Unchanged objects are freshly verified and reused without writing
+another staging copy. Git copies are separate and can consume additional space.
+
+To manage a project such as `my-project`:
+
+1. Open the private Config link, select the registered project, then Recovery.
+2. Inspect actual source/Git usage and project/installation quotas. A quota refusal
+   can also mean the installation limit or minimum free disk space was reached.
+3. Select old checkpoints, click **ตรวจแผนลบสำเนาที่เลือก**, review the exact IDs
+   and closed sessions, then confirm. This permanently removes those backups and
+   their closed session history, never the current project files.
+4. For future backups, expand **โควตา ระยะเก็บ และโฟลเดอร์ที่ไม่สำรอง**. Increase
+   the project quota or put `models/` on its own exclusion line, review and confirm.
+   Exclusions are literal relative file/directory prefixes, not glob patterns.
+5. Create a checkpoint and inspect its coverage. Old backups still contain the
+   previously included files until separately deleted. Changing settings alone
+   does not certify readiness, acknowledge drift or repair a corrupt backup.
+
+Excluded files are not restorable from future checkpoints. When an operation
+requires a before-image of an excluded file, DODO refuses it rather than silently
+editing without protection. Shell commands can still change excluded data; a
+source checkpoint is not a full machine/data backup or an OS sandbox.
+
+Current/latest source checkpoints, drift baselines, pins, names, active captures,
+open sessions, unfinished work, live restore plans, deployment provenance and
+DB compatibility bindings remain protected. Deleting a closed session requires
+selecting all its checkpoints. Retention cleanup remains subject to the same
+protections. Lowering retention can remove older eligible history at a later
+capture; it is not a guarantee to keep exactly N points.
+
+Cleanup previews expire after 15 minutes and are bound to project, epoch, caller,
+policy and the reviewed selection. Changes to protection/history require a fresh
+preview. File deletion failures retain durable cleanup tasks. **เก็บกวาดไฟล์ค้าง**
+retries those tasks explicitly; shared objects are never removed while referenced
+or while an installation capture is active. Results separate logical deletion,
+source bytes freed, Git bytes freed and pending files. Accounting excludes filesystem
+overhead and temporary staging; it is not a claim about total disk free space.
+
+### AI-assisted storage maintenance
+
+Four Full operations are also available through existing Compact gateways:
+
+| Operation | Gateway | Scope / authority |
+| --- | --- | --- |
+| `recovery_storage_status` | `dodo_read` | Read; caller-owned checkpoint metadata, quota/storage totals, or a plan receipt |
+| `recovery_cleanup_preview` | `dodo_write` | Write; selected IDs, retention, or pending-file cleanup; no deletion |
+| `recovery_settings_preview` | `dodo_write` | Write; project quota, retention and exclusions only; no policy change |
+| `recovery_maintenance_apply` | `dodo_write` | Write plus exact owner approval, including in trusted mode |
+
+Use `project_overview` and `dodo_discover` to obtain current context and schemas.
+For example, `dodo_write` with `operation: "recovery_settings_preview"` and
+`args: {"changes":{"excludePaths":["models/"],"projectBytes":8589934592}}` proposes
+an 8 GiB quota and exclusion. It grants no permission. Review the returned plan,
+then apply with its exact `planId`, `planHash` and an `idempotencyKey` after owner
+approval. Keep project/workspace context at the gateway top level.
+
+An MCP caller can delete only its own checkpoint history; the authenticated owner
+web UI can manage all checkpoints in the selected project. AI cannot unpin points,
+remove names, disable Recovery, change storage destinations, approve its own action,
+relax secret/path guards or accept corruption as a new baseline. Approved plan
+retries return a durable receipt. Query `recovery_storage_status` with `planId`
+after an uncertain response; never silently repeat destructive operations.
+A crash after logical deletion may leave physical cleanup pending; review pending
+cleanup explicitly. Recovery maintenance never reruns a failed source command.
 
 Owner CLI, in the registered project's directory:
 
@@ -218,7 +283,7 @@ dodo recovery mark stable SNAPSHOT_ID --revision REVIEWED_REVISION --workspace W
 
 After browser reconnect, refresh evidence and query the existing restore receipt.
 Do not repeat uncertain effects. These are private owner controls; MCP/public
-HTTP has no mark/pin/purge endpoint. Without an owner-registered deployment target its state is **NOT_CONFIGURED**;
+HTTP has no public owner mark/pin/admin endpoint; reviewed MCP maintenance remains caller-bound and owner-approved. Without an owner-registered deployment target its state is **NOT_CONFIGURED**;
 database row rollback remains **NOT_SUPPORTED**. Optional adapters are described below. Windows/Android and live
 production recovery require their own acceptance; results from macOS/Linux
 fixtures are not substitutes.

package/docs/RELEASE_1.3.2.md

@@ -0,0 +1,50 @@
+# DODO MCP 1.3.2
+
+## Recovery storage management
+
+The project Recovery dashboard can now preview and confirm deletion of old
+checkpoints, retry pending file cleanup, change project quotas/retention, and exclude
+relative paths such as `models/` from future backups. It distinguishes logical
+checkpoint totals from unique source objects and separate Git copies. Verified
+unchanged objects are reused without another staging copy.
+
+Protected/current baselines, pinned/named points and referenced recovery history
+remain protected. Cleanup never edits project source. Unlink failures remain pending,
+and live capture reservations prevent deletion of objects another project is using.
+Changing exclusions does not delete older backups or acknowledge source drift.
+
+Four operations are available through existing Compact read/write gateways:
+`recovery_storage_status`, `recovery_cleanup_preview`, `recovery_settings_preview`
+and `recovery_maintenance_apply`. AI apply requires exact owner approval even in
+trusted mode. OAuth, ACL, caller ownership, workspace/epoch, path guards and
+idempotency remain authoritative. Full has 162 definitions (158 by default);
+Compact stays at 20.
+
+## Upgrade
+
+```sh
+npm install -g dodo-mcp@1.3.2
+dodo --version
+```
+
+Restart your foreground DODO process once to load the update, reopen Config, and
+select the project → Recovery → จัดการพื้นที่ Recovery. Refresh/rescan the MCP
+connection so its gateway operation schemas include the new capabilities.
+
+Private state gains maintenance review and cleanup-task tables on first open;
+existing backup data and access scopes are preserved. Keep CLI/server versions
+aligned: older DODO versions refuse a state database with newer migrations.
+See the [Recovery guide](RECOVERY.md) for the review/confirmation flow and
+limits on excluded files, retention and shared storage.
+
+## Verification
+
+AUTOMATED_PASS on macOS: build, typecheck, lint, core 926 passed / 40 skipped /
+0 failed; packaging 17 passed, including an installed CLI approval and Compact
+maintenance flow. Real Chromium exercised desktop and 390px screens. Production
+dependency audit reported zero vulnerabilities.
+
+Native Linux/Windows CI, live AI clients and production checkpoint cleanup are
+MANUAL_NOT_RUN for this patch. The owner explicitly chose publication with the
+completed macOS checks and deferred the remaining platform tests to the next release.
+No production process, tunnel or backup history was changed by release validation.

package/docs/RELEASE_NOTES.md

@@ -1,5 +1,15 @@
 # DODO MCP — Release Notes
 
+## 1.3.2 — Recovery storage management
+
+Adds owner-reviewed checkpoint cleanup, pending-file retry, project quotas and
+explicit exclusions in the web dashboard. Four caller-bound MCP maintenance
+operations use existing Compact gateways; destructive/settings apply still needs
+owner approval. Shows unique source objects separately from Git copies and logical
+checkpoint sizes. Reuses verified unchanged CAS objects without restaging them.
+See [Recovery usage](RECOVERY.md), [upgrade details](RELEASE_1.3.2.md) and [validation results](TEST_REPORT.md).
+This patch uses the completed macOS gate; native Linux/Windows CI is explicitly deferred to the next release.
+
 ## 1.3.1 — Independent Remote Config sessions
 
 `dodo --web` now creates an independent one-hour owner session even after the local

package/docs/SECURITY.md

@@ -464,3 +464,20 @@ in a remote URL or returned by state APIs. AI owner principals, streaming reques
 and queued owner revalidation use the authenticated request session, not the
 server start time. Loopback, Host/Origin, proxy-header rejection, rate limits,
 workspace/epoch checks and public MCP OAuth remain enforced.
+
+### Reviewed Recovery maintenance
+
+Storage status and previews are bounded and reveal no credentials or private backup
+paths. MCP checkpoint access remains caller-owned and workspace-bound. Cleanup/settings
+apply requires `dodo:write`, live ACL/context and a separate exact owner approval even
+in trusted mode. A review or discover result does not authorize apply. Settings are
+limited to project quota, retention and canonical relative exclusions; they cannot
+turn off Recovery, acknowledge drift or change private storage/installation authority.
+
+The private owner dashboard requires its authenticated, expiring session and current
+workspace context for confirmed apply. Public MCP has no administration endpoints.
+Cleanup protects current baselines, pins, names and active references, and never edits
+source files. Pending cleanup only processes stored private references, not paths
+supplied by callers. Shared objects and active installation captures block reclamation;
+I/O failure is reported as pending rather than successful deletion. No integrity
+failure is silently repaired by accepting the current source.

package/docs/TEST_REPORT.md

@@ -1,5 +1,33 @@
 # DODO MCP — Test Report
 
+## 1.3.2 Recovery maintenance — macOS release gate, 2026-09-25
+
+`AUTOMATED_PASS` on macOS: build, typecheck and lint; full core suite **926 passed,
+40 skipped, 0 failed** across 145 files (140 passed, 5 skipped). Packaging **17
+passed**, including fresh tarball install and real Compact MCP calls that request
+owner approval, approve via the installed CLI, clean a checkpoint, set an exclusion
+and read the resulting policy. `npm run test:all` exited 0; the extended packaging
+smoke, typecheck and lint were rerun successfully afterward.
+
+The 13 new security/integration cases cover CAS reuse with integrity checking,
+logical versus unique storage, actual reclamation including independent Git copies,
+protected/current checkpoints, caller ownership, partial closed sessions, read-only
+OAuth refusal, stale context, nested override, live ACL revocation, exact approvals,
+receipt replay, explicit exclusions, pending unlink retry, cross-project sharing,
+active reservations, unsafe hardlinks and queued authority changes. Existing migration
+fixtures retain assertions for scope/revocation preservation across old schemas.
+
+Real Chromium exercised the owner UI on desktop and 390px screens with private
+fixtures, confirming checkpoint deletion and `models/` policy persistence. CSP was
+kept unchanged. Tarball checks include the new UI/service and exclude private state,
+credentials, development documents and release evidence. Complete Full capability
+count is **162**, default Full **158**, Compact **20**, Hybrid **49**.
+
+`MANUAL_NOT_RUN`: production checkpoint cleanup, actual AI-client interaction, and
+native Linux/Windows CI for this change. The owner explicitly accepted the completed
+macOS gate and deferred the remaining platform tests to the next release. No production
+server was restarted. Automated fixture approval is not approval for production.
+
 ## 1.3.1 Config regression coverage
 
 `tests/security/remoteConfig.test.ts` reproduces the previous HTTP 401 after advancing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dodo-mcp",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "author": "Arthittakun",
   "description": "DODO — local-first MCP server with multi-project coding, AI providers, sub-agents, context, memory, media and workflow tools; embedded OAuth and workspace permissions.",
   "type": "module",
@@ -53,6 +53,7 @@
     "docs/RELEASE_1.2.1.md",
     "docs/RELEASE_1.3.0.md",
     "docs/RELEASE_1.3.1.md",
+    "docs/RELEASE_1.3.2.md",
     "docs/RELEASE_NOTES.md",
     "docs/SCHEDULES.md",
     "docs/SECURITY.md",

package/schemas/tools.compact.json

@@ -3,8 +3,8 @@
   "version": 1,
   "toolCount": 20,
   "defaultLiveToolCount": 20,
-  "fullToolCount": 158,
-  "defaultLiveFullToolCount": 154,
+  "fullToolCount": 162,
+  "defaultLiveFullToolCount": 158,
   "optionalMcpFeatures": {
     "subagents": {
       "configKey": "exposeSubagentsToMcp",
@@ -21,15 +21,15 @@
   "stats": {
     "compact": {
       "toolCount": 20,
-      "schemaBytes": 63349
+      "schemaBytes": 63565
     },
     "hybrid": {
       "toolCount": 49,
-      "schemaBytes": 144231
+      "schemaBytes": 144447
     },
     "full": {
-      "toolCount": 158,
-      "schemaBytes": 572388
+      "toolCount": 162,
+      "schemaBytes": 582689
     }
   },
   "tools": [
@@ -360,7 +360,7 @@
     {
       "name": "dodo_read",
       "title": "Read workspace state",
-      "description": "Gateway: read-only workspace access: files, search, symbols, jobs, history and agent notes. Set operation to one of: list_files, read_files, read_image, read_instructions, search_code, glob_files, symbols, references, diagnostics, change_history, approval_status, environment_info, todo_read, handoff_read, job_status, job_output, job_wait, list_jobs, restore_status, checkpoint_list, checkpoint_inspect, recovery_session_list, recovery_session_inspect, deployment_targets, deployment_list, deployment_inspect, deployment_compare. Put that operation's own arguments in args (never workspaceId/workspaceEpoch — they come from the top level only). Identical authorization to calling the operation directly: its own OAuth scope, workspace access, trust policy, local approvals, path/secret guards, hash checks and audit all apply. Call dodo_discover with operation=\"<name>\" for the exact input schema.",
+      "description": "Gateway: read-only workspace access: files, search, symbols, jobs, history and agent notes. Set operation to one of: list_files, read_files, read_image, read_instructions, search_code, glob_files, symbols, references, diagnostics, change_history, approval_status, environment_info, todo_read, handoff_read, job_status, job_output, job_wait, list_jobs, recovery_storage_status, restore_status, checkpoint_list, checkpoint_inspect, recovery_session_list, recovery_session_inspect, deployment_targets, deployment_list, deployment_inspect, deployment_compare. Put that operation's own arguments in args (never workspaceId/workspaceEpoch — they come from the top level only). Identical authorization to calling the operation directly: its own OAuth scope, workspace access, trust policy, local approvals, path/secret guards, hash checks and audit all apply. Call dodo_discover with operation=\"<name>\" for the exact input schema.",
       "requiredScope": "dodo:read",
       "annotations": {
         "readOnlyHint": true,
@@ -388,6 +388,7 @@
         "job_output",
         "job_wait",
         "list_jobs",
+        "recovery_storage_status",
         "restore_status",
         "checkpoint_list",
         "checkpoint_inspect",
@@ -452,6 +453,7 @@
               "job_output",
               "job_wait",
               "list_jobs",
+              "recovery_storage_status",
               "restore_status",
               "checkpoint_list",
               "checkpoint_inspect",
@@ -582,7 +584,7 @@
     {
       "name": "dodo_write",
       "title": "Change workspace files",
-      "description": "Gateway: hash-verified, journaled file changes: write/edit/patch, preview→apply→rollback, todos and handoff. Set operation to one of: write_file, edit_file, apply_patch, replace_in_files, delete_path, move_path, make_directory, preview_changes, apply_changes, rollback_changes, preview_rename, todo_write, handoff_write, agent_write, agent_snapshot_rollback, checkpoint_create, recovery_session_begin, recovery_session_end, restore_preview, restore_apply. Put that operation's own arguments in args (never workspaceId/workspaceEpoch — they come from the top level only). Identical authorization to calling the operation directly: its own OAuth scope, workspace access, trust policy, local approvals, path/secret guards, hash checks and audit all apply. Call dodo_discover with operation=\"<name>\" for the exact input schema.",
+      "description": "Gateway: hash-verified, journaled file changes: write/edit/patch, preview→apply→rollback, todos and handoff. Set operation to one of: write_file, edit_file, apply_patch, replace_in_files, delete_path, move_path, make_directory, preview_changes, apply_changes, rollback_changes, preview_rename, todo_write, handoff_write, agent_write, agent_snapshot_rollback, recovery_cleanup_preview, recovery_settings_preview, recovery_maintenance_apply, checkpoint_create, recovery_session_begin, recovery_session_end, restore_preview, restore_apply. Put that operation's own arguments in args (never workspaceId/workspaceEpoch — they come from the top level only). Identical authorization to calling the operation directly: its own OAuth scope, workspace access, trust policy, local approvals, path/secret guards, hash checks and audit all apply. Call dodo_discover with operation=\"<name>\" for the exact input schema.",
       "requiredScope": "dodo:write",
       "annotations": {
         "readOnlyHint": false,
@@ -607,6 +609,9 @@
         "handoff_write",
         "agent_write",
         "agent_snapshot_rollback",
+        "recovery_cleanup_preview",
+        "recovery_settings_preview",
+        "recovery_maintenance_apply",
         "checkpoint_create",
         "recovery_session_begin",
         "recovery_session_end",
@@ -664,6 +669,9 @@
               "handoff_write",
               "agent_write",
               "agent_snapshot_rollback",
+              "recovery_cleanup_preview",
+              "recovery_settings_preview",
+              "recovery_maintenance_apply",
               "checkpoint_create",
               "recovery_session_begin",
               "recovery_session_end",

package/schemas/tools.hybrid.json

@@ -34,8 +34,8 @@
     "job_wait",
     "job_cancel"
   ],
-  "fullToolCount": 158,
-  "defaultLiveFullToolCount": 154,
+  "fullToolCount": 162,
+  "defaultLiveFullToolCount": 158,
   "optionalMcpFeatures": {
     "subagents": {
       "configKey": "exposeSubagentsToMcp",
@@ -52,15 +52,15 @@
   "stats": {
     "compact": {
       "toolCount": 20,
-      "schemaBytes": 63349
+      "schemaBytes": 63565
     },
     "hybrid": {
       "toolCount": 49,
-      "schemaBytes": 144231
+      "schemaBytes": 144447
     },
     "full": {
-      "toolCount": 158,
-      "schemaBytes": 572388
+      "toolCount": 162,
+      "schemaBytes": 582689
     }
   },
   "tools": [
@@ -391,7 +391,7 @@
     {
       "name": "dodo_read",
       "title": "Read workspace state",
-      "description": "Gateway: read-only workspace access: files, search, symbols, jobs, history and agent notes. Set operation to one of: list_files, read_files, read_image, read_instructions, search_code, glob_files, symbols, references, diagnostics, change_history, approval_status, environment_info, todo_read, handoff_read, job_status, job_output, job_wait, list_jobs, restore_status, checkpoint_list, checkpoint_inspect, recovery_session_list, recovery_session_inspect, deployment_targets, deployment_list, deployment_inspect, deployment_compare. Put that operation's own arguments in args (never workspaceId/workspaceEpoch — they come from the top level only). Identical authorization to calling the operation directly: its own OAuth scope, workspace access, trust policy, local approvals, path/secret guards, hash checks and audit all apply. Call dodo_discover with operation=\"<name>\" for the exact input schema.",
+      "description": "Gateway: read-only workspace access: files, search, symbols, jobs, history and agent notes. Set operation to one of: list_files, read_files, read_image, read_instructions, search_code, glob_files, symbols, references, diagnostics, change_history, approval_status, environment_info, todo_read, handoff_read, job_status, job_output, job_wait, list_jobs, recovery_storage_status, restore_status, checkpoint_list, checkpoint_inspect, recovery_session_list, recovery_session_inspect, deployment_targets, deployment_list, deployment_inspect, deployment_compare. Put that operation's own arguments in args (never workspaceId/workspaceEpoch — they come from the top level only). Identical authorization to calling the operation directly: its own OAuth scope, workspace access, trust policy, local approvals, path/secret guards, hash checks and audit all apply. Call dodo_discover with operation=\"<name>\" for the exact input schema.",
       "requiredScope": "dodo:read",
       "annotations": {
         "readOnlyHint": true,
@@ -419,6 +419,7 @@
         "job_output",
         "job_wait",
         "list_jobs",
+        "recovery_storage_status",
         "restore_status",
         "checkpoint_list",
         "checkpoint_inspect",
@@ -483,6 +484,7 @@
               "job_output",
               "job_wait",
               "list_jobs",
+              "recovery_storage_status",
               "restore_status",
               "checkpoint_list",
               "checkpoint_inspect",
@@ -613,7 +615,7 @@
     {
       "name": "dodo_write",
       "title": "Change workspace files",
-      "description": "Gateway: hash-verified, journaled file changes: write/edit/patch, preview→apply→rollback, todos and handoff. Set operation to one of: write_file, edit_file, apply_patch, replace_in_files, delete_path, move_path, make_directory, preview_changes, apply_changes, rollback_changes, preview_rename, todo_write, handoff_write, agent_write, agent_snapshot_rollback, checkpoint_create, recovery_session_begin, recovery_session_end, restore_preview, restore_apply. Put that operation's own arguments in args (never workspaceId/workspaceEpoch — they come from the top level only). Identical authorization to calling the operation directly: its own OAuth scope, workspace access, trust policy, local approvals, path/secret guards, hash checks and audit all apply. Call dodo_discover with operation=\"<name>\" for the exact input schema.",
+      "description": "Gateway: hash-verified, journaled file changes: write/edit/patch, preview→apply→rollback, todos and handoff. Set operation to one of: write_file, edit_file, apply_patch, replace_in_files, delete_path, move_path, make_directory, preview_changes, apply_changes, rollback_changes, preview_rename, todo_write, handoff_write, agent_write, agent_snapshot_rollback, recovery_cleanup_preview, recovery_settings_preview, recovery_maintenance_apply, checkpoint_create, recovery_session_begin, recovery_session_end, restore_preview, restore_apply. Put that operation's own arguments in args (never workspaceId/workspaceEpoch — they come from the top level only). Identical authorization to calling the operation directly: its own OAuth scope, workspace access, trust policy, local approvals, path/secret guards, hash checks and audit all apply. Call dodo_discover with operation=\"<name>\" for the exact input schema.",
       "requiredScope": "dodo:write",
       "annotations": {
         "readOnlyHint": false,
@@ -638,6 +640,9 @@
         "handoff_write",
         "agent_write",
         "agent_snapshot_rollback",
+        "recovery_cleanup_preview",
+        "recovery_settings_preview",
+        "recovery_maintenance_apply",
         "checkpoint_create",
         "recovery_session_begin",
         "recovery_session_end",
@@ -695,6 +700,9 @@
               "handoff_write",
               "agent_write",
               "agent_snapshot_rollback",
+              "recovery_cleanup_preview",
+              "recovery_settings_preview",
+              "recovery_maintenance_apply",
               "checkpoint_create",
               "recovery_session_begin",
               "recovery_session_end",