This page is the spec the audit runs against, published from the repository — not a summary of one. It shows the guarantees for the local application and the release pipeline; remote control and self-hosting are on the self-host runbook, and what reaches your machine is on the supply-chain disclosure. The audited checklists behind all three live beside the spec, in the specs directory on GitHub.
Dormouse holds shells, source trees, credentials, and local files. Its dependencies and release pipeline determine what code reaches a machine; remote control admits an authorized phone as a person at the keyboard; loopback listeners receive requests from pages in the user's browser.
Remote control supports relay-backed sessions and direct one-time connections. The Relay can be self-hosted; Hosted implements admin-entitled enrollment, account-scoped relay routing, and Pocket, with live production controls and paid-service acceptance requiring verification (Hosted). Hosted account sign-in alone grants no terminal access. Pairing and presence remain the Burrow's decision. Hosted also serves the one-time phone page and forwards only that connection's handshake ciphertext, authorizing nothing (Hosted rendezvous); its deployment pipeline and Cloudflare account are part of a one-time session's trust base.
A self-hosted Relay runs on hardware the user owns; the default installer keeps it private to the tailnet, while the application boundary permits a public HTTPS origin (SELF_HOST.md). Remote access starts only when a Burrow enrolls with a Relay or opens a one-time link; a link admits one phone for one session. Paid cloud operation still needs the review under Cloud-hosted mode.
Guarantees
Each guarantee names its owning rule and automated checks. The nightly audit checks all of them; audit in the last column identifies a property without a cheaper automated check. Native Cargo tests run in separate CI jobs, outside root pnpm test.
| Guarantee | Rule | Pinned by |
|---|---|---|
Terminal output cannot write your clipboard or steal focus. File access requires a user action or a running designated Tool's gated OSC 367 open. OSC 52 only offers a copy format; links require confirmation or an allowed local preview, and deceptive links have no open action. | Terminal output | lib/, lib/, lib/, lib/ |
| A page in a browser pane cannot forge a host message. In VS Code every host message carries a per-boot token it cannot read, and the standalone adapters have no inbox for it to post to. | Browser panes | lib/ |
Only your own account can drive your terminals through dor. The socket sits in a directory only you can open, and its token never crosses the wire. | The dor control socket | standalone/ |
| A loopback listener grants a stranger nothing it could not get from the upstream directly. | Loopback Listeners | scripts/ |
| Current persistence writers never save terminal scrollback. Standalone snapshots are owner-only; VS Code controls access to its own storage. Older snapshots may contain transcripts. | Persisted state | cargo test in standalone/ (the owner-only half); audit |
| Under Settings → Network → Nothing, a new install's level, Dormouse opens no connection on its own: no relay socket, one-time link, push, managed voice, or update check. What you click, and what your terminals and browser panes reach, are yours. | Network policy | lib/, lib/, standalone/ |
Merging to main and creating a tag are admin-only, and every workflow this repository authors pins its actions by commit. | GitHub Actions Policies | audit |
| The bot maintainer cannot merge, tag, or read a release secret, and its token never enters its own environment. | Automated Maintainer (tend) | ., nightly |
| Publishing the extension takes a second human's approval. | VS Code Extension Releases | audit |
| Desktop binaries are signed locally. CI never holds production signing or updater keys, and the signing script verifies CI's attestations and hashes first. | Desktop Releases | scripts/ |
What is not defended
A process running as you.
dor, its socket, and every file mode bound other local accounts, never a program already running under your own account; an agent holdingdorhas exactly the power of the person at the keyboard, and the Tool trust prompt is no boundary against it (The dor control socket).The Windows
dorpipe carries no ACL of ours. A named pipe has no directory to harden, so an unguessable name and the token handshake are the whole of it (The dor control socket).A local HTML or SVG document you open can send its contents off the machine. The file viewer's content policy confines what the page loads, not where its scripts navigate (Local-file viewer).
A Tool trust grant on an upstream URL trusts the URL a checkout claims. Any directory whose own
.claims an already-granted upstream shares that grant; a folder-only grant is not shared (Dor Tool configuration).git/ config What VS Code does with the pane state it stores. Structure persists in VS Code's own storage under its modes, never a transcript (Persisted state).
The bot's upstream is pinned by tag, not commit, so a hostile upstream could change what the bot runs without a diff here. Accepted: the trust equals what the harness already holds (Automated Maintainer).
The repo-level snapshot-testing tokens are reachable by any workflow the bot can author. Accepted with rotation; each service's dashboard shows abuse (Automated Maintainer).
The workflow audit trusts what it classifies as routine. A Renovate pin bump trusts the ref Renovate picked inside that action's repository; a bot commit under a forged human author passes when an admin push that replaces nothing carries it in, such as a cherry-pick or a rebase onto a new branch, or when it was first pushed more than a quarter ago (Automated Maintainer).
Known gaps
Gaps rather than accepted risks: we intend to close them.
Browser-pane scripts share loopback cookies across grant ports. HTTP and WebSocket cookie headers are stripped, but
document.remains shared; cookie-authenticated iframe pages are unsupported (Loopback Listeners).cookie Windows screenshots and pasted clipboard images are only as private as the temp directory they land in: private by default, exposed if it is shared or loosened (Browser panes).
Neither VS Code's peer-link token, its Tool trust receipts, nor the
recovery.beside them carries a Windows ACL applied by Dormouse. They are written owner-only by unix mode, which Windows makes a no-op; standalone locks its state directory instead (Persisted state).json The standalone log file is written at the umask and records the
dorsocket path (Persisted state).A fork PR the bot checks out mid-run reaches it with that fork's instruction files. The harness pins project-instruction paths to the base branch only for the checkouts it makes before the agent starts (Automated Maintainer).
The workflow audit's window can be evaded. A pusher-set committer date hides a commit from every later window, and a branch pushed, run with repo-level secrets in scope, and deleted before the nightly fetch is in none (Automated Maintainer).
Audit domains share one credential. Their contexts are separate;
AUDIT_is not (Domains).PAT The audit's reporting can misstate a run. A
PASScan be accepted with no merged report, an open failure issue past the first page of the issue listing is never reconciled, and quotedVERDICT:lines can push later verdicts out of the issue's preserved head (Outcomes and reporting).The notarization password sits on a command line for up to half an hour per architecture; the remedy is known and not yet done (Desktop Releases).
Hosted's three Workers share one Postgres role. The relay and voice Workers query only their own tables and the entitlement's user row, but the role their database binding carries can write the account Worker's tables too, a user's verified email included; a restricted role per Worker would close it (Relay boundary).
How the guarantees are checked
On every pnpm test, lints turn the cheap half of these specs into build failures: scripts/ (the specs' own conventions and word budgets), scripts/ (one Noise suite, no negotiation, no plaintext path), scripts/ (every installer control, on all three platforms), and scripts/ (a new loopback bind references a guard). Each carries a self-test that re-introduces the thing it forbids and requires the lint to go red; a rule without one is a claim, not a check. scripts/ executes the installer helpers the lints can only read.
Every night, and before every VS Code release, . audits the repository against these specs. Domain subagents, each owning the specs below, run every FAIL IF as a mechanical check with evidence, then read their domain adversarially for what no check names. A failure, or a run reaching no verdict, files a public issue labeled security- and holds the release; a later pass closes it. Open issues are live; closed ones record what tripped and changed. scripts/ runs the same prompts locally. security-audit.md is the contract. pgstencil audits the packages Hosted consumes in its own repository.
| Domain | Specs | Covers |
|---|---|---|
application- | security-local.md, security-remote.md | local boundaries, remote control, and everything no other domain claims |
hosted | security-hosted.md | Hosted accounts, the one-time rendezvous, and the pgstencil provenance link |
supply- | security-supply-chain.md | the dependency graph, the lockfile, the disclosure and its generator |
ci- | security-ci.md, security-audit.md, this spec | GitHub Actions, the bot, releases, secrets, and the audit itself |
Production dependency changes require committed regenerated disclosure. Desktop release artifacts carry CI attestations and hash manifests, verified locally before signing.
Source of truth: root scripts in package.; native jobs in .; . and its release gate in ..
Reporting a vulnerability
Must report vulnerabilities privately through GitHub's Report a vulnerability form, visible only to the reporter and maintainers. Never open a public issue or email the maintainer. Include the version or commit, deployment (self-hosted Relay, Hosted, standalone app, or VS Code extension), and shortest reproduction. Every advisory is acknowledged with intended next steps; there is no bounty or promised response time. A coordinated-release requirement is communicated in the advisory.
FAIL IF private vulnerability reporting is disabled on the repository (
gh api repos/must reportdiffplug/ dormouse/ private- vulnerability- reporting enabled: true): the advisory form is the only channel this spec offers, and a disabled one sends a reporter to a public issue.