dodo-mcp 1.3.1 → 1.4.0

package/dist/services/recovery/recoveryService.js

@@ -1,3 +1,4 @@
+import { RecoveryMaintenance } from './maintenance.js';
 import { RecoveryConfigVault } from './configVault.js';
 import { RecoveryDatabases } from './databaseAwareness.js';
 import { RecoveryEvidence } from './evidence.js';
@@ -16,7 +17,7 @@ import { digestOf } from '../../util/hash.js';
 import { loadGlobalConfig } from '../../config/globalConfig.js';
 import { RecoveryPolicySchema } from './contracts.js';
 import { RecoveryStorage, rootIdentity } from './storage.js';
-const OMIT_DIR = new Set(['.git', 'node_modules', 'dist', 'build', 'out', '.cache', 'coverage', 'target', '.venv', 'venv', '__pycache__', 'uploads', 'logs', 'volumes']);
+const OMIT_DIR = new Set(['.git', 'node_modules', '.next', '.nuxt', '.svelte-kit', '.turbo', '.output', '.vercel', '.parcel-cache', 'dist', 'build', 'out', '.cache', 'coverage', 'target', '.venv', 'venv', '__pycache__', 'uploads', 'logs', 'volumes', 'tmp', 'temp']);
 const DATA_EXTENSION = /\.(?:db|sqlite|sqlite3|db-wal|db-shm|log|dump|bak)$/i;
 // Bounded high-confidence screening, NOT a guarantee that every credential is detectable.
 const SECRET = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|\b(?:gh[pousr]_[a-zA-Z0-9]{30,}|github_pat_[a-zA-Z0-9_]{40,}|sk-[a-zA-Z0-9_-]{32,}|AKIA[0-9A-Z]{16})\b/;
@@ -25,6 +26,7 @@ const tick = () => new Promise(r => setImmediate(r));
 export class RecoveryService {
     s;
     configDir;
+    maintenance;
     storage;
     history;
     drift;
@@ -88,6 +90,11 @@ export class RecoveryService {
     identity;
     state = 'INITIALIZING';
     errorCode = null;
+    errorDetail = null;
+    blockedPath = null;
+    skippedSecretFiles = new Set();
+    lastWarning = null;
+    lastGitCheckpoint = null;
     baseline;
     latest;
     lastTrigger = null;
@@ -110,6 +117,7 @@ export class RecoveryService {
         this.deployments = new RecoveryDeployments(s, this);
         this.databases = new RecoveryDatabases(s, this);
         this.configVault = new RecoveryConfigVault(s, this);
+        this.maintenance = new RecoveryMaintenance(s, this);
     }
     project() {
         const row = this.s.store.db.prepare('SELECT id FROM project_registry WHERE workspace_id=? AND removed_at IS NULL').get(this.s.workspaceId);
@@ -131,10 +139,25 @@ export class RecoveryService {
             throw new DodoError('PATH_DENIED', 'path is outside allowed recovery source scope');
         this.s.wfs.resolve(rel, { allowMissing: true });
     }
+    effectiveMode(policy = this.policy()) {
+        if (!policy.enabled || policy.mode === 'off')
+            return 'off';
+        if (policy.mode === 'git')
+            return 'git';
+        if (policy.mode === 'snapshot')
+            return 'snapshot';
+        return this.s.git.hasGitMarker() ? 'git' : 'snapshot';
+    }
+    recordSkippedSecret(rel) {
+        if (this.skippedSecretFiles.size < 50)
+            this.skippedSecretFiles.add(rel);
+        this.lastWarning = `ข้ามไฟล์ที่มีเนื้อหาคล้ายคีย์ความลับอัตโนมัติ (${this.skippedSecretFiles.size} ไฟล์): ${[...this.skippedSecretFiles].slice(0, 5).join(', ')}`;
+    }
     async currentEntries(targets, extraPaths = []) {
-        return this.deadline.run(this.deadline.getStore() ?? Date.now() + this.policy().scanMs, async () => {
+        const policy = this.policy();
+        return this.deadline.run(this.deadline.getStore() ?? Date.now() + policy.scanMs, async () => {
             const read = async () => {
-                const inventory = await this.inventory(this.policy(), targets);
+                const inventory = await this.inventory(policy, targets);
                 const seen = new Set(inventory.files.map(f => f.entry.path));
                 for (const p of extraPaths)
                     if (!seen.has(p)) {
@@ -146,14 +169,28 @@ export class RecoveryService {
                         }
                         const r = this.s.wfs.resolve(p, { allowMissing: true });
                         if (r.stat?.isFile())
-                            inventory.files.push(...(await this.inventory(this.policy(), [p])).files);
+                            inventory.files.push(...(await this.inventory(policy, [p])).files);
                     }
-                if (inventory.files.length > this.policy().maxEntries)
+                if (inventory.files.length > policy.maxEntries)
                     throw new DodoError('RESOURCE_LIMIT', 'source scan exceeds entry budget');
-                for (const f of inventory.files)
-                    if (f.entry.kind === 'file')
-                        f.entry.hash = await this.readFile(f);
-                return inventory.files.sort((a, b) => a.entry.path.localeCompare(b.entry.path));
+                const kept = [];
+                for (const f of inventory.files) {
+                    if (f.entry.kind === 'file') {
+                        try {
+                            f.entry.hash = await this.readFile(f, undefined, policy);
+                        }
+                        catch (e) {
+                            if (e instanceof DodoError && e.code === 'SECRET_PATH_DENIED' && policy.skipSecretContentFiles) {
+                                this.recordSkippedSecret(f.entry.path);
+                                this.blockedPath = null;
+                                continue;
+                            }
+                            throw e;
+                        }
+                    }
+                    kept.push(f);
+                }
+                return kept.sort((a, b) => a.entry.path.localeCompare(b.entry.path));
             };
             const first = await read(), second = await read();
             if (digestOf(first) !== digestOf(second))
@@ -165,18 +202,44 @@ export class RecoveryService {
         const r = this.s.store.db.prepare('SELECT payload FROM recovery_policies WHERE workspace_id=?').get(this.s.workspaceId);
         return RecoveryPolicySchema.parse(r ? JSON.parse(r.payload) : {});
     }
+    normalizePolicyPaths(raw) {
+        const cleanList = (items, allowSecretNames) => {
+            const out = [];
+            for (const p of items) {
+                const candidate = p.trim().replace(/\\/g, '/').replace(/^\.\/+/, '').replace(/\/+$/, '');
+                if (!candidate || candidate === '.')
+                    throw new DodoError('INVALID_INPUT', 'data roots and exclusions must be canonical relative paths');
+                const rel = this.s.wfs.normalizeRel(candidate);
+                if (rel === '.' || rel !== candidate || /[?*\[\]]/.test(rel))
+                    throw new DodoError('INVALID_INPUT', 'data roots and exclusions must be canonical relative paths without wildcards');
+                if (!allowSecretNames) {
+                    try {
+                        this.s.wfs.resolve(rel, { allowMissing: true });
+                    }
+                    catch (e) {
+                        if (!(e instanceof DodoError && e.code === 'SECRET_PATH_DENIED'))
+                            throw e;
+                    }
+                }
+                out.push(rel);
+            }
+            return [...new Set(out)].sort();
+        };
+        return {
+            ...raw,
+            enabled: raw.mode === 'off' ? false : raw.enabled,
+            excludePaths: cleanList(raw.excludePaths, true),
+            dataRoots: cleanList(raw.dataRoots, false),
+        };
+    }
     /** Private owner service only. Repository configuration never reaches this method. */
     async configure(input, confirmed, revalidate) {
         if (!confirmed)
             throw new DodoError('INVALID_INPUT', 'confirm the Recovery policy change');
-        const policy = RecoveryPolicySchema.parse(input);
+        const parsed = RecoveryPolicySchema.parse(input);
         if (!this.project())
             throw new DodoError('NOT_FOUND', 'register this project first');
-        for (const p of policy.dataRoots) {
-            const rel = this.s.wfs.normalizeRel(p);
-            if (rel === '.' || rel !== p)
-                throw new DodoError('INVALID_INPUT', 'data roots must be canonical relative subdirectories');
-        }
+        const policy = this.normalizePolicyPaths(parsed);
         if (this.s.jobs.runningCount() || this.s.mutations?.busy)
             throw new DodoError('CONFLICT', 'wait for active mutations and jobs before changing Recovery policy');
         await this.initialization;
@@ -193,20 +256,119 @@ export class RecoveryService {
         this.activated = false;
         this.state = policy.enabled ? 'INITIALIZING' : 'DISABLED_BY_OWNER';
         this.errorCode = null;
+        this.errorDetail = null;
+        this.blockedPath = null;
+        this.lastWarning = null;
+        this.skippedSecretFiles.clear();
         this.activate();
         return this.status();
     }
+    updateMaintenancePolicy(policy) {
+        this.assertProject();
+        this.s.mutations.assertCanStart();
+        if (this.s.jobs.runningCount())
+            throw new DodoError('CONFLICT', 'wait for running jobs before changing Recovery policy');
+        const normalized = this.normalizePolicyPaths(policy);
+        this.s.store.db.prepare('INSERT INTO recovery_policies VALUES (?,?) ON CONFLICT(workspace_id) DO UPDATE SET payload=excluded.payload').run(this.s.workspaceId, JSON.stringify(normalized));
+        if (this.state === 'BLOCKED' || this.errorCode) {
+            this.errorCode = null;
+            this.errorDetail = null;
+            this.blockedPath = null;
+            this.lastWarning = null;
+            this.skippedSecretFiles.clear();
+            this.baseline = undefined;
+            this.activated = false;
+            this.state = normalized.enabled ? 'INITIALIZING' : 'DISABLED_BY_OWNER';
+            this.activate();
+        }
+    }
+    async resetBlockedState(revalidate) {
+        revalidate?.();
+        this.assertProject();
+        this.s.store.db.prepare("UPDATE recovery_snapshots SET state='INCOMPLETE' WHERE workspace_id=? AND state='PREPARING'").run(this.s.workspaceId);
+        this.s.store.db.prepare('DELETE FROM recovery_reservations WHERE workspace_id=?').run(this.s.workspaceId);
+        this.errorCode = null;
+        this.errorDetail = null;
+        this.blockedPath = null;
+        this.lastWarning = null;
+        this.skippedSecretFiles.clear();
+        this.baseline = undefined;
+        this.activated = false;
+        const policy = this.policy();
+        if (!policy.enabled || policy.mode === 'off') {
+            this.state = 'DISABLED_BY_OWNER';
+            return this.status();
+        }
+        this.state = 'INITIALIZING';
+        try {
+            await this.checkpoint('owner-checkpoint', 'local-config-owner');
+        }
+        catch {
+            /* status reflects current state */
+        }
+        return this.status();
+    }
+    async gitRecoveryStatus(limit = 20) {
+        this.assertProject();
+        const git = await this.s.git.gitRecoveryStatus(limit);
+        return { ...git, effectiveMode: this.effectiveMode(), lastGitCheckpoint: this.lastGitCheckpoint };
+    }
+    async createGitCheckpoint(trigger = 'owner-checkpoint', actor = 'local-config-owner') {
+        this.assertProject();
+        const policy = this.policy();
+        const cp = await this.s.git.createRecoveryCheckpoint({
+            trigger,
+            actor,
+            indexStagingDir: path.join(this.storage.directory, 'staging'),
+            excludePaths: [...policy.excludePaths, ...policy.dataRoots],
+        });
+        this.lastGitCheckpoint = { id: cp.id, ref: cp.ref, commitSha: cp.commitSha, createdAt: cp.createdAt, trigger };
+        this.lastCheckedAt = cp.createdAt;
+        this.lastTrigger = trigger;
+        this.state = 'READY';
+        this.errorCode = null;
+        this.errorDetail = null;
+        this.blockedPath = null;
+        this.s.store.audit({ principal: actor, workspaceId: this.s.workspaceId, tool: 'recovery.git.checkpoint', result: 'ready', inputDigest: digestOf({ id: cp.id, trigger }) });
+        return cp;
+    }
+    async previewGitRestore(opts) {
+        this.assertProject();
+        return await this.s.git.previewRecoveryRestore(opts);
+    }
+    async applyGitRestore(opts, revalidate) {
+        return this.s.mutations.run(async () => {
+            revalidate?.();
+            this.assertProject();
+            const policy = this.policy();
+            const res = await this.s.git.applyRecoveryRestore({
+                ...opts,
+                indexStagingDir: path.join(this.storage.directory, 'staging'),
+                excludePaths: [...policy.excludePaths, ...policy.dataRoots],
+            });
+            this.s.store.db.prepare('DELETE FROM recovery_drift WHERE workspace_id=?').run(this.s.workspaceId);
+            this.baseline = undefined;
+            this.lastCheckedAt = Date.now();
+            this.errorCode = null;
+            this.errorDetail = null;
+            this.blockedPath = null;
+            this.s.store.audit({ principal: 'local-config-owner', workspaceId: this.s.workspaceId, tool: 'recovery.git.restore', result: 'restored', inputDigest: digestOf({ ref: opts.ref, paths: opts.paths ?? [] }) });
+            return res;
+        });
+    }
+    protectedCheckpointIds() { return [this.baseline, this.latest]; }
     summary() {
-        const { enabled, state, registered, awaitingActivation, sourceOnly, lastCheckedAt, errorCode, progress, projectBytes } = this.status();
+        const { enabled, state, effectiveMode, hasGitRepo, registered, awaitingActivation, sourceOnly, lastCheckedAt, errorCode, errorDetail, blockedPath, skippedSecretFiles, lastWarning, lastGitCheckpoint, progress, projectBytes } = this.status();
         const drift = this.drift.status();
-        return { enabled, state, registered, awaitingActivation, sourceOnly, lastCheckedAt, errorCode, progress, projectBytes, drift: { state: drift.state, changedCount: drift.changedCount, critical: drift.critical, errorCode: drift.errorCode }, git: this.git.status(), verification: this.evidence.summary() };
+        return { enabled, state, effectiveMode, hasGitRepo, registered, awaitingActivation, sourceOnly, lastCheckedAt, errorCode, errorDetail, blockedPath, skippedSecretFiles, lastWarning, lastGitCheckpoint, progress, projectBytes, drift: { state: drift.state, changedCount: drift.changedCount, critical: drift.critical, errorCode: drift.errorCode }, git: this.git.status(), verification: this.evidence.summary() };
     }
     status() {
         const registered = Boolean(this.s.store.db.prepare('SELECT 1 FROM project_registry WHERE workspace_id=? AND removed_at IS NULL').get(this.s.workspaceId));
         const policy = this.policy();
-        return { enabled: policy.enabled, state: policy.enabled ? this.state : 'DISABLED_BY_OWNER', registered, awaitingActivation: registered && !this.activated,
-            sourceOnly: true, lastTrigger: this.lastTrigger, counts: { ...this.counts }, lastCheckpointId: this.latest ?? null, baselineId: this.baseline ?? null, integrity: this.lastCheckedAt ? 'verified_at_capture' : 'not_verified', lastCheckedAt: this.lastCheckedAt,
-            errorCode: this.errorCode, progress: { ...this.progress }, drift: this.drift.status(), git: this.git.status(), verification: this.evidence.summary(), ...this.storage.usageFor(this.s.workspaceId), policy };
+        const effectiveMode = this.effectiveMode(policy);
+        return { enabled: policy.enabled, state: policy.enabled && policy.mode !== 'off' ? this.state : 'DISABLED_BY_OWNER', effectiveMode, hasGitRepo: this.s.git.hasGitMarker(), registered, awaitingActivation: registered && !this.activated,
+            sourceOnly: true, lastTrigger: this.lastTrigger, counts: { ...this.counts }, lastCheckpointId: this.latest ?? this.lastGitCheckpoint?.id ?? null, baselineId: this.baseline ?? this.lastGitCheckpoint?.id ?? null, integrity: this.lastCheckedAt ? 'verified_at_capture' : 'not_verified', lastCheckedAt: this.lastCheckedAt,
+            errorCode: this.errorCode, errorDetail: this.errorDetail, blockedPath: this.blockedPath, skippedSecretFiles: [...this.skippedSecretFiles], lastWarning: this.lastWarning, lastGitCheckpoint: this.lastGitCheckpoint, progress: { ...this.progress }, drift: this.drift.status(), git: this.git.status(), verification: this.evidence.summary(), ...this.storage.usageFor(this.s.workspaceId), policy };
     }
     activate() {
         if (this.closed || this.activated)
@@ -216,7 +378,7 @@ export class RecoveryService {
                 return;
         }
         catch (e) {
-            this.fail(e);
+            this.fail(e, true);
             return;
         }
         this.activated = true;
@@ -227,13 +389,18 @@ export class RecoveryService {
             this.configVault.reconcile();
             this.reconciled = true;
         }
-        if (!this.policy().enabled) {
+        const policy = this.policy();
+        if (!policy.enabled || policy.mode === 'off') {
             this.state = 'DISABLED_BY_OWNER';
             return;
         }
         this.initialization = (async () => {
             // The same queue protects activation from direct, agent and scheduled writers.
             await this.s.mutations.run(async () => {
+                if (policy.mode === 'git') {
+                    await this.createGitCheckpoint('activation', 'system:activation');
+                    return;
+                }
                 const prior = this.s.store.db.prepare("SELECT id FROM recovery_snapshots WHERE workspace_id=? AND state='READY' ORDER BY created_at DESC LIMIT 1").get(this.s.workspaceId);
                 if (prior) {
                     const m = await this.storage.readVerified(prior.id, this.s.workspaceId);
@@ -248,7 +415,22 @@ export class RecoveryService {
             });
         })().catch(e => { this.fail(e); });
     }
-    fail(error) { this.state = 'BLOCKED'; this.errorCode = error instanceof DodoError ? error.code : 'BACKUP_IO_ERROR'; }
+    fail(error, forceBlock = false) {
+        const policy = this.policy();
+        this.errorCode = error instanceof DodoError ? error.code : 'BACKUP_IO_ERROR';
+        this.errorDetail = error instanceof Error ? error.message : String(error);
+        if (error instanceof DodoError && error.detail && typeof error.detail === 'object' && 'path' in error.detail && typeof error.detail.path === 'string') {
+            this.blockedPath = error.detail.path;
+        }
+        const criticalIdentity = error instanceof DodoError && ((error.code === 'PATH_DENIED' && /original registered project|private-state overlap|previous root identity/.test(error.message)) || error.code === 'RECOVERY_REQUIRED');
+        if (forceBlock || criticalIdentity || policy.strictEnforcement || policy.gitRequired || Boolean(policy.gitDirectory)) {
+            this.state = 'BLOCKED';
+        }
+        else {
+            this.lastWarning = `${this.errorCode}: ${this.errorDetail}${this.blockedPath ? ` (${this.blockedPath})` : ''}`;
+            this.state = 'READY';
+        }
+    }
     async checkpoint(trigger, actor, targets) {
         if (this.closed)
             throw new DodoError('CONFLICT', 'Recovery runtime is closing');
@@ -261,10 +443,33 @@ export class RecoveryService {
             this.configVault.reconcile();
             this.reconciled = true;
         }
-        if (!this.policy().enabled) {
+        const policy = this.policy();
+        if (!policy.enabled || policy.mode === 'off') {
             this.state = 'DISABLED_BY_OWNER';
             return undefined;
         }
+        if (policy.mode === 'git') {
+            return this.s.mutations.run(async () => {
+                try {
+                    const cp = await this.createGitCheckpoint(trigger, actor);
+                    this.activated = true;
+                    this.authority.getStore()?.();
+                    await this.reviewedRestore.getStore()?.();
+                    return cp.id;
+                }
+                catch (e) {
+                    if (e instanceof DodoError && ['FORBIDDEN', 'AUTH_REQUIRED'].includes(e.code))
+                        throw e;
+                    this.fail(e);
+                    if (!policy.strictEnforcement && (trigger === 'before-write' || trigger === 'before-exec' || trigger === 'activation')) {
+                        this.authority.getStore()?.();
+                        await this.reviewedRestore.getStore()?.();
+                        return this.lastGitCheckpoint?.id;
+                    }
+                    throw new DodoError('RECOVERY_REQUIRED', 'Git recovery checkpoint is blocked; no source mutation was started', { detail: { reason: this.errorCode, path: this.blockedPath }, recovery: 'inspect Recovery in project settings or switch mode' });
+                }
+            });
+        }
         // Initialization may itself be waiting behind this call's mutation ticket.
         // Capture here within that ticket; never await a queued activation from a writer.
         return this.s.mutations.run(async () => {
@@ -280,14 +485,18 @@ export class RecoveryService {
                     await this.capture('activation', 'system:activation');
                 }
                 await this.storage.readVerified(this.baseline, this.s.workspaceId);
-                if (!this.reviewedRestore.getStore() && (trigger === 'before-write' || trigger === 'before-exec'))
+                if (policy.checkDrift && !this.reviewedRestore.getStore() && (trigger === 'before-write' || trigger === 'before-exec')) {
                     try {
-                        await this.deadline.run(Date.now() + this.policy().scanMs, () => this.drift.guard(targets));
+                        await this.deadline.run(Date.now() + policy.scanMs, () => this.drift.guard(targets));
                     }
                     catch (e) {
-                        guardRejected = e instanceof DodoError && ['FILE_CHANGED', 'CONFLICT'].includes(e.code);
-                        throw e;
+                        if (policy.strictEnforcement) {
+                            guardRejected = e instanceof DodoError && ['FILE_CHANGED', 'CONFLICT'].includes(e.code);
+                            throw e;
+                        }
+                        this.lastWarning = e instanceof Error ? e.message : String(e);
                     }
+                }
                 const id = await this.capture(trigger, actor, targets);
                 this.activated = true;
                 this.startScanner();
@@ -304,8 +513,15 @@ export class RecoveryService {
             catch (e) {
                 if (guardRejected || e instanceof DodoError && (['FORBIDDEN', 'AUTH_REQUIRED'].includes(e.code)))
                     throw e;
-                this.fail(e);
-                throw new DodoError('RECOVERY_REQUIRED', 'source backup is blocked; no source mutation was started', { detail: { reason: this.errorCode }, recovery: 'inspect Recovery in project settings, fix storage/path/integrity problems and retry' });
+                const criticalIdentity = e instanceof DodoError && e.code === 'PATH_DENIED' && /original registered project|private-state overlap|previous root identity/.test(e.message);
+                const mustBlock = criticalIdentity || policy.strictEnforcement || policy.gitRequired || Boolean(policy.gitDirectory) || trigger === 'verified-checkpoint';
+                this.fail(e, mustBlock);
+                if (!mustBlock && (trigger === 'before-write' || trigger === 'before-exec' || trigger === 'activation')) {
+                    this.authority.getStore()?.();
+                    await this.reviewedRestore.getStore()?.();
+                    return this.latest ?? this.lastGitCheckpoint?.id;
+                }
+                throw new DodoError('RECOVERY_REQUIRED', 'source backup is blocked; no source mutation was started', { detail: { reason: this.errorCode, path: this.blockedPath }, recovery: 'inspect Recovery in project settings, fix storage/path/integrity problems and retry' });
             }
         });
     }
@@ -313,7 +529,7 @@ export class RecoveryService {
     excluded(rel, dir, policy) {
         if (rel === '.')
             return false;
-        return rel.split('/').some(p => OMIT_DIR.has(p)) || DATA_EXTENSION.test(rel) || policy.dataRoots.some(r => r === rel || rel.startsWith(r + '/')) || this.s.wfs.ignores.isSecret(rel) || this.s.wfs.ignores.isProtected(rel) || (dir && this.s.wfs.ignores.isSecret(rel + '/'));
+        return rel.split('/').some(p => OMIT_DIR.has(p)) || DATA_EXTENSION.test(rel) || [...policy.dataRoots, ...policy.excludePaths].some(r => r === rel || rel.startsWith(r + '/')) || this.s.wfs.ignores.isSecret(rel) || this.s.wfs.ignores.isProtected(rel) || (dir && this.s.wfs.ignores.isSecret(rel + '/'));
     }
     async inventory(policy, targets) {
         this.project();
@@ -329,8 +545,10 @@ export class RecoveryService {
             if (visited % 100 === 0)
                 await tick();
             if (this.excluded(rel, false, policy)) {
-                if (target)
-                    throw new DodoError('PATH_DENIED', 'mutation target is excluded from source Recovery');
+                if (target && (this.s.wfs.ignores.isSecret(rel) || this.s.wfs.ignores.isProtected(rel) || policy.strictEnforcement)) {
+                    this.blockedPath = rel;
+                    throw new DodoError('PATH_DENIED', `mutation target is excluded from source Recovery: ${rel}`, { detail: { path: rel } });
+                }
                 excluded++;
                 return;
             }
@@ -341,8 +559,10 @@ export class RecoveryService {
                 return;
             }
             if (this.excluded(rel, st.isDirectory(), policy)) {
-                if (target)
-                    throw new DodoError('PATH_DENIED', 'mutation target is excluded from source Recovery');
+                if (target && (this.s.wfs.ignores.isSecret(rel) || this.s.wfs.ignores.isProtected(rel) || policy.strictEnforcement)) {
+                    this.blockedPath = rel;
+                    throw new DodoError('PATH_DENIED', `mutation target is excluded from source Recovery: ${rel}`, { detail: { path: rel } });
+                }
                 excluded++;
                 return;
             }
@@ -360,8 +580,15 @@ export class RecoveryService {
             }
             else {
                 this.s.wfs.assertRegularFileForDirectAccess(r);
-                if (st.size > policy.fileBytes)
-                    throw new DodoError('RESOURCE_LIMIT', 'source file exceeds Recovery file budget');
+                if (st.size > policy.fileBytes) {
+                    if (!policy.strictEnforcement && !target) {
+                        this.lastWarning = `ข้ามไฟล์ขนาดใหญ่เกินขีดจำกัด (${rel})`;
+                        excluded++;
+                        return;
+                    }
+                    this.blockedPath = rel;
+                    throw new DodoError('RESOURCE_LIMIT', `source file exceeds Recovery file budget: ${rel}`, { detail: { path: rel } });
+                }
                 files.push({ entry: { path: rel, kind: 'file', hash: null, bytes: st.size, mode: st.mode & 0o777 }, signature: this.signature(st) });
             }
         };
@@ -379,7 +606,7 @@ export class RecoveryService {
         const distinct = new Map(files.map(f => [f.entry.path, f]));
         return { files: [...distinct.values()].sort((a, b) => a.entry.path.localeCompare(b.entry.path)), excluded };
     }
-    async readFile(file, stage) {
+    async readFile(file, stage, policy = this.policy()) {
         const r = this.s.wfs.resolve(file.entry.path);
         this.s.wfs.assertRegularFileForDirectAccess(r);
         if (!r.stat || this.signature(r.stat) !== file.signature)
@@ -401,10 +628,15 @@ export class RecoveryService {
                 bytes += bytesRead;
                 if (bytes > file.entry.bytes)
                     throw new DodoError('FILE_CHANGED', 'source grew during backup');
-                const chunk = buf.subarray(0, bytesRead), text = tail + chunk.toString('utf8');
-                if (SECRET.test(text))
-                    throw new DodoError('SECRET_PATH_DENIED', 'credential-like content found during source backup');
-                tail = text.slice(-1024);
+                const chunk = buf.subarray(0, bytesRead);
+                if (policy.scanContentSecrets) {
+                    const text = tail + chunk.toString('utf8');
+                    if (SECRET.test(text)) {
+                        this.blockedPath = file.entry.path;
+                        throw new DodoError('SECRET_PATH_DENIED', `credential-like content found during source backup: ${file.entry.path}`, { detail: { path: file.entry.path } });
+                    }
+                    tail = text.slice(-1024);
+                }
                 hash.update(chunk);
                 if (output) {
                     let offset = 0;
@@ -440,13 +672,33 @@ export class RecoveryService {
             const inventory = await this.inventory(policy, targets);
             // Hash before reserving: unchanged objects cost logical references, not duplicate disk bytes.
             const expectedHashes = new Map();
-            for (const f of inventory.files)
-                if (f.entry.kind === 'file')
-                    expectedHashes.set(f.entry.path, await this.readFile(f));
-            const estimate = this.storage.estimate(this.s.workspaceId, inventory.files.filter(f => f.entry.kind === 'file').map(f => ({ hash: expectedHashes.get(f.entry.path), bytes: f.entry.bytes })));
+            const keptFiles = [];
+            const skippedInPass = new Set();
+            for (const f of inventory.files) {
+                if (f.entry.kind === 'file') {
+                    try {
+                        expectedHashes.set(f.entry.path, await this.readFile(f, undefined, policy));
+                    }
+                    catch (e) {
+                        if (e instanceof DodoError && e.code === 'SECRET_PATH_DENIED' && policy.skipSecretContentFiles) {
+                            this.recordSkippedSecret(f.entry.path);
+                            this.blockedPath = null;
+                            skippedInPass.add(f.entry.path);
+                            inventory.excluded++;
+                            continue;
+                        }
+                        throw e;
+                    }
+                }
+                keptFiles.push(f);
+            }
+            inventory.files = keptFiles;
             this.storage.prune(this.s.workspaceId, policy);
             this.storage.collectOrphans();
-            this.storage.reserve(id, this.s.workspaceId, estimate.physical, policy, estimate.logical, estimate.staging);
+            this.s.store.db.transaction(() => {
+                const estimate = this.storage.estimate(this.s.workspaceId, inventory.files.filter(f => f.entry.kind === 'file').map(f => ({ hash: expectedHashes.get(f.entry.path), bytes: f.entry.bytes })));
+                this.storage.reserve(id, this.s.workspaceId, estimate.physical, policy, estimate.logical, estimate.staging);
+            }).immediate();
             this.s.store.db.prepare("INSERT INTO recovery_snapshots (id,workspace_id,project_id,state,scope,created_at) VALUES (?,?,?,'PREPARING',?,?)").run(id, this.s.workspaceId, project.projectId, targets ? 'targets' : 'source', createdAt);
             const entries = [], published = new Set();
             for (const f of inventory.files) {
@@ -455,9 +707,9 @@ export class RecoveryService {
                     // Rehash every source file even for identical content. Within this
                     // capture only, one CAS publication suffices per hash; publish()
                     // freshly verifies every distinct object before recording READY.
-                    const duplicate = published.has(expectedHashes.get(entry.path));
+                    const duplicate = published.has(expectedHashes.get(entry.path)) || this.storage.hasObject(expectedHashes.get(entry.path));
                     staging = duplicate ? undefined : this.storage.stagePath();
-                    entry.hash = await this.readFile(f, staging);
+                    entry.hash = await this.readFile(f, staging, policy);
                     if (entry.hash !== expectedHashes.get(entry.path))
                         throw new DodoError('FILE_CHANGED', 'source changed after space reservation');
                     if (staging)
@@ -471,12 +723,21 @@ export class RecoveryService {
             }
             // Rescan paths AND reread hashes. A watcher or old checkpoint alone is not freshness proof.
             const after = await this.inventory(policy, targets);
+            if (skippedInPass.size > 0) {
+                after.files = after.files.filter(af => {
+                    if (skippedInPass.has(af.entry.path)) {
+                        after.excluded++;
+                        return false;
+                    }
+                    return true;
+                });
+            }
             if (digestOf(after) !== digestOf(inventory))
                 throw new DodoError('FILE_CHANGED', 'source inventory changed during backup');
             const entryHashes = new Map(entries.map(e => [e.path, e.hash]));
             for (const f of after.files)
                 if (f.entry.kind === 'file') {
-                    const hash = await this.readFile(f);
+                    const hash = await this.readFile(f, undefined, policy);
                     if (hash !== entryHashes.get(f.entry.path))
                         throw new DodoError('FILE_CHANGED', 'source content changed during backup');
                 }
@@ -499,6 +760,8 @@ export class RecoveryService {
             this.lastCheckedAt = Date.now();
             this.state = 'READY';
             this.errorCode = null;
+            this.errorDetail = null;
+            this.blockedPath = null;
             this.s.store.audit({ principal: actor, workspaceId: this.s.workspaceId, tool: 'recovery.checkpoint', result: 'ready', inputDigest: digestOf({ id, trigger }) });
             this.storage.prune(this.s.workspaceId, policy);
             this.git.prune();
@@ -506,7 +769,8 @@ export class RecoveryService {
         }
         catch (e) {
             this.s.store.db.prepare("UPDATE recovery_snapshots SET state='INCOMPLETE' WHERE id=? AND state='PREPARING'").run(id);
-            this.fail(e);
+            const mustBlock = (e instanceof DodoError && e.code === 'PATH_DENIED' && /original registered project|private-state overlap|previous root identity/.test(e.message)) || policy.strictEnforcement || policy.gitRequired || Boolean(policy.gitDirectory) || trigger === 'verified-checkpoint';
+            this.fail(e, mustBlock);
             throw e;
         }
         finally {