@dinoxx/dinox-cli 2.13.1 → 2.15.0

package/dist/commands/tags/index.js

@@ -1,3 +1,5 @@
+import { WRITE_DURABILITY_OPTION } from '../writeDurability.js';
+import { completeWrite, WRITE_RECEIPT_FIELDS } from '../writeReceipt.js';
 import { resolveAuthIdentity } from '../../auth/userInfo.js';
 import { registerCommandGroup } from '../descriptor/register.js';
 import { FORMAT_OPTIONS, OFFLINE_OPTIONS, REQUIRE_SYNC_OPTIONS, SYNC_TIMEOUT_OPTIONS } from '../schema/globalOptions.js';
@@ -5,7 +7,7 @@ import { buildTagAddDryRunPreview, buildTagMutationDryRunPreview } from '../writ
 import { printDryRunPreview } from '../../utils/dryRun.js';
 import { DinoxError } from '../../utils/errors.js';
 import { getRequestedStructuredOutputFormat, printHumanReadableLine, printSuccess, } from '../../utils/output.js';
-import { commandStale, printStaleCacheWarning, syncBeforeCommand, waitForMutationUpload, withCommandRuntime, } from '../runtime.js';
+import { commandStale, printStaleCacheWarning, syncBeforeCommand, resolveWriteDurabilityForRuntime, withCommandRuntime, } from '../runtime.js';
 import { assertWriteConfirmationProvided, parseExpectedCount } from '../writeConfirmation.js';
 import { addTag, inspectAddTag, listTags } from './repo.js';
 import { getTagStats, getTagTree, inspectTagCleanup, mergeTag, moveTag, renameTag, suggestTagMerges, } from './operations.js';
@@ -56,6 +58,7 @@ async function runTagAdd(context) {
     }
     const structuredOutput = getRequestedStructuredOutputFormat() !== null;
     await withCommandRuntime(context, async (runtime) => {
+        const durability = resolveWriteDurabilityForRuntime(runtime, context.options.durability);
         const identity = await resolveAuthIdentity(runtime.config);
         await syncBeforeCommand(runtime, { syncTokenIndex: true });
         const emoji = typeof context.options.emoji === 'string' ? context.options.emoji : undefined;
@@ -76,8 +79,7 @@ async function runTagAdd(context) {
             userId: identity.userId,
             emoji,
         });
-        await waitForMutationUpload(runtime);
-        const payload = { ok: true, stale: commandStale(runtime), ...result };
+        const payload = { ok: true, ...(await completeWrite(runtime, durability)), ...result };
         if (structuredOutput) {
             printSuccess(payload);
             return;
@@ -88,9 +90,10 @@ async function runTagAdd(context) {
 }
 async function withTagWriteRuntime(context, run) {
     return withCommandRuntime(context, async (runtime) => {
+        const durability = resolveWriteDurabilityForRuntime(runtime, context.options.durability);
         const identity = await resolveAuthIdentity(runtime.config);
         await syncBeforeCommand(runtime, { syncTokenIndex: true });
-        return run({ runtime, userId: identity.userId });
+        return run({ runtime, userId: identity.userId, durability });
     });
 }
 function requireArg(value, message) {
@@ -103,7 +106,7 @@ function requireArg(value, message) {
 async function runTagRename(context) {
     const path = requireArg(context.args.path, 'Tag path is required');
     const newName = requireArg(context.args.newName, 'New tag name is required');
-    await withTagWriteRuntime(context, async ({ runtime, userId }) => {
+    await withTagWriteRuntime(context, async ({ runtime, userId, durability }) => {
         const result = await renameTag(runtime.db, { path, newName, userId }, { dryRun: Boolean(context.options.dryRun) });
         if (Boolean(context.options.dryRun)) {
             printDryRunPreview(buildTagMutationDryRunPreview({
@@ -118,8 +121,7 @@ async function runTagRename(context) {
             }), runtime);
             return;
         }
-        await waitForMutationUpload(runtime);
-        printSuccess({ ok: true, stale: commandStale(runtime), ...result });
+        printSuccess({ ok: true, ...(await completeWrite(runtime, durability)), ...result });
     });
 }
 async function runTagMove(context) {
@@ -128,7 +130,7 @@ async function runTagMove(context) {
     if (!to) {
         throw new DinoxError('--to is required');
     }
-    await withTagWriteRuntime(context, async ({ runtime, userId }) => {
+    await withTagWriteRuntime(context, async ({ runtime, userId, durability }) => {
         const result = await moveTag(runtime.db, { path, to, userId }, { dryRun: Boolean(context.options.dryRun) });
         if (Boolean(context.options.dryRun)) {
             printDryRunPreview(buildTagMutationDryRunPreview({
@@ -143,8 +145,7 @@ async function runTagMove(context) {
             }), runtime);
             return;
         }
-        await waitForMutationUpload(runtime);
-        printSuccess({ ok: true, stale: commandStale(runtime), ...result });
+        printSuccess({ ok: true, ...(await completeWrite(runtime, durability)), ...result });
     });
 }
 async function runTagMerge(context) {
@@ -158,7 +159,7 @@ async function runTagMerge(context) {
         expectedCount,
     };
     assertWriteConfirmationProvided('Tag merge', writeOptions);
-    await withTagWriteRuntime(context, async ({ runtime, userId }) => {
+    await withTagWriteRuntime(context, async ({ runtime, userId, durability }) => {
         const result = await mergeTag(runtime.db, { from, to, userId }, writeOptions);
         if (dryRun) {
             printDryRunPreview(buildTagMutationDryRunPreview({
@@ -179,8 +180,7 @@ async function runTagMerge(context) {
             }), runtime);
             return;
         }
-        await waitForMutationUpload(runtime);
-        printSuccess({ ok: true, stale: commandStale(runtime), ...result });
+        printSuccess({ ok: true, ...(await completeWrite(runtime, durability)), ...result });
     });
 }
 async function runTagSuggest(context) {
@@ -273,7 +273,7 @@ export const tagCommandGroup = {
             options: [
                 { flags: '--name <string>', description: 'Tag name/path (alternative to positional name)' },
                 { flags: '--emoji <string>', description: 'Tag emoji' },
-                { flags: '--dry-run', description: 'Preview the write without executing it' },
+                WRITE_DURABILITY_OPTION, { flags: '--dry-run', description: 'Preview the write without executing it' },
             ],
             schema: {
                 path: 'tag.add',
@@ -283,7 +283,7 @@ export const tagCommandGroup = {
                 output: {
                     type: 'structured',
                     summary: 'Tag creation acknowledgement',
-                    fields: ['id', 'tag', 'createdNodes', 'restoredNodes', 'stale'],
+                    fields: ['id', 'tag', 'createdNodes', 'restoredNodes', ...WRITE_RECEIPT_FIELDS],
                 },
                 examples: ['dino tag add "work/projects" --format json --dry-run', 'dino tag add "work/projects" --emoji "🏷️" --format json'],
             },
@@ -296,7 +296,7 @@ export const tagCommandGroup = {
                 { syntax: '<path>', description: 'Existing tag path' },
                 { syntax: '<new-name>', description: 'New leaf name' },
             ],
-            options: [{ flags: '--dry-run', description: 'Preview the write without executing it' }],
+            options: [WRITE_DURABILITY_OPTION, { flags: '--dry-run', description: 'Preview the write without executing it' }],
             schema: {
                 path: 'tag.rename',
                 risk: 'write',
@@ -305,7 +305,7 @@ export const tagCommandGroup = {
                 output: {
                     type: 'structured',
                     summary: 'Tag rename result',
-                    fields: ['id', 'fromPath', 'toPath', 'updatedTags', 'updatedNotes', 'stale'],
+                    fields: ['id', 'fromPath', 'toPath', 'updatedTags', 'updatedNotes', ...WRITE_RECEIPT_FIELDS],
                 },
                 examples: ['dino tag rename "AI/old" "new" --format json --dry-run'],
             },
@@ -317,7 +317,7 @@ export const tagCommandGroup = {
             arguments: [{ syntax: '<path>', description: 'Existing tag path' }],
             options: [
                 { flags: '--to <parent-path>', description: 'Target parent tag path', required: true, type: 'string' },
-                { flags: '--dry-run', description: 'Preview the write without executing it' },
+                WRITE_DURABILITY_OPTION, { flags: '--dry-run', description: 'Preview the write without executing it' },
             ],
             schema: {
                 path: 'tag.move',
@@ -327,7 +327,7 @@ export const tagCommandGroup = {
                 output: {
                     type: 'structured',
                     summary: 'Tag move result',
-                    fields: ['id', 'fromPath', 'toPath', 'updatedTags', 'updatedNotes', 'stale'],
+                    fields: ['id', 'fromPath', 'toPath', 'updatedTags', 'updatedNotes', ...WRITE_RECEIPT_FIELDS],
                 },
                 examples: ['dino tag move "AI" --to "Technology" --format json --dry-run'],
             },
@@ -343,7 +343,7 @@ export const tagCommandGroup = {
             options: [
                 { flags: '--expected-count <n>', description: 'Required for real writes; must equal source tags plus notes affected', type: 'number' },
                 { flags: '--confirm', description: 'Required for real writes after reviewing a dry run', type: 'boolean' },
-                { flags: '--dry-run', description: 'Preview the write without executing it', type: 'boolean' },
+                WRITE_DURABILITY_OPTION, { flags: '--dry-run', description: 'Preview the write without executing it', type: 'boolean' },
             ],
             schema: {
                 path: 'tag.merge',
@@ -353,7 +353,7 @@ export const tagCommandGroup = {
                 output: {
                     type: 'structured',
                     summary: 'Tag merge result',
-                    fields: ['fromId', 'toId', 'fromPath', 'toPath', 'softDeletedTagIds', 'updatedNotes', 'affectedCount', 'stale'],
+                    fields: ['fromId', 'toId', 'fromPath', 'toPath', 'softDeletedTagIds', 'updatedNotes', 'affectedCount', ...WRITE_RECEIPT_FIELDS],
                 },
                 examples: [
                     'dino tag merge "ai" "AI" --format json --dry-run',

package/dist/commands/todo/index.js

@@ -1,4 +1,5 @@
 import { resolveAuthIdentity } from '../../auth/userInfo.js';
+import { nextCursor, resolveCursorOffset } from '../../utils/cursor.js';
 import { registerCommandGroup } from '../descriptor/register.js';
 import { FORMAT_OPTIONS, OFFLINE_OPTIONS, REQUIRE_SYNC_OPTIONS, SYNC_TIMEOUT_OPTIONS } from '../schema/globalOptions.js';
 import { WRITE_DURABILITY_OPTION } from '../writeDurability.js';
@@ -147,12 +148,25 @@ async function runTodoSearch({ args, globals, options }) {
     });
     const limit = parsePositiveIntegerOption(searchOptions.limit, '--limit', DEFAULT_TASK_LIMIT, MAX_TASK_LIMIT);
     const scanLimit = parsePositiveIntegerOption(searchOptions.scanLimit, '--scan-limit', DEFAULT_NOTE_SCAN_LIMIT, MAX_NOTE_SCAN_LIMIT);
+    // Raw option values, not the resolved range: `--days` must not change the hash between pages.
+    const cursorQuery = {
+        keyword,
+        includeDeleted: Boolean(searchOptions.includeDeleted),
+        taskStatus,
+        taskTagFilter,
+        from: searchOptions.from,
+        to: searchOptions.to,
+        days: searchOptions.days,
+        scanLimit,
+    };
+    const offset = resolveCursorOffset(searchOptions.cursor, 0, 'todo.search', cursorQuery);
     const wire = toTodoSearchWire(keyword, {
         includeDeleted: Boolean(searchOptions.includeDeleted),
         taskStatus,
         taskTagFilter,
         taskDateRange,
         limit,
+        offset,
         scanLimit,
     });
     const result = await routeRead(globals, 'todo.search', wire, () => withTodoDatabase(globals, async (runtime) => {
@@ -161,7 +175,12 @@ async function runTodoSearch({ args, globals, options }) {
         return { ...local, stale: commandStale(runtime) };
     }));
     const { stale, ...response } = result;
-    printSuccess({ stale: stale ?? false, ...response });
+    const nextOffset = response.meta.offset + response.meta.returned_count;
+    printSuccess({
+        stale: stale ?? false,
+        ...response,
+        meta: { ...response.meta, next_cursor: nextCursor('todo.search', cursorQuery, nextOffset, response.meta.has_more) },
+    });
 }
 async function runTodoAppend({ args, globals, options }) {
     const appendOptions = options;
@@ -290,6 +309,7 @@ const todoSearchCommand = {
         { flags: '--days <n>', description: 'Recent N days; mutually exclusive with --from/--to' },
         { flags: '--limit <n>', description: 'Maximum returned tasks' },
         { flags: '--scan-limit <n>', description: 'Maximum scanned note rows' },
+        { flags: '--cursor <token>', description: 'Continue from meta.next_cursor of the previous page (same query)' },
         { flags: '--include-deleted', description: 'Include soft-deleted notes' },
     ],
     schema: {
@@ -301,7 +321,7 @@ const todoSearchCommand = {
             type: 'structured',
             summary: 'Todo search payload with metadata and task list',
             fields: ['tasks.task_id', 'tasks.task_key', 'tasks.note_id', 'tasks.note_title', 'tasks.status', 'tasks.depth', 'tasks.parent_id', 'tasks.tags'],
-            metaFields: ['stale', 'meta.query', 'meta.returned_count', 'meta.total_count', 'meta.total_count_is_lower_bound', 'meta.matched_note_count', 'meta.limit', 'meta.scan_limit', 'meta.scanned_note_count', 'meta.scan_truncated', 'meta.truncated', 'meta.applied_filters.status', 'meta.applied_filters.tags', 'meta.applied_filters.include_deleted', 'meta.applied_filters.date_range'],
+            metaFields: ['stale', 'meta.query', 'meta.returned_count', 'meta.total_count', 'meta.total_count_is_lower_bound', 'meta.matched_note_count', 'meta.limit', 'meta.offset', 'meta.has_more', 'meta.next_cursor', 'meta.scan_limit', 'meta.scanned_note_count', 'meta.scan_truncated', 'meta.truncated', 'meta.applied_filters.status', 'meta.applied_filters.tags', 'meta.applied_filters.include_deleted', 'meta.applied_filters.date_range'],
         },
         examples: ['dino todo search "报销" --status uncompleted --format json', 'dino todo search --days 7 --format json'],
     },

package/dist/commands/todo/repo.d.ts

@@ -7,6 +7,7 @@ export type SearchTodoOptions = {
     taskTagFilter: string[];
     taskDateRange?: TaskDateRangeFilter;
     limit: number;
+    offset?: number;
     scanLimit: number;
 };
 export type AppendTodoTasksOptions = {
@@ -65,6 +66,8 @@ export type SearchedTodoResponse = {
         total_count: number;
         matched_note_count: number;
         limit: number;
+        offset: number;
+        has_more: boolean;
         scan_limit: number;
         scanned_note_count: number;
         scan_truncated: boolean;
@@ -109,6 +112,8 @@ export type TodoSearchWire = {
     taskStatus: TaskStatusFilter;
     taskTagFilter: string[];
     limit: number;
+    /** Index of the first returned task among the matches (from `--cursor`). */
+    offset?: number;
     scanLimit: number;
     startDate?: string;
     endDate?: string;

package/dist/commands/todo/repo.js

@@ -40,6 +40,7 @@ export function toTodoSearchWire(query, options) {
         taskStatus: options.taskStatus,
         taskTagFilter: options.taskTagFilter,
         limit: options.limit,
+        ...(options.offset ? { offset: options.offset } : {}),
         scanLimit: options.scanLimit,
         startDate: options.taskDateRange?.startDate?.toISOString(),
         endDate: options.taskDateRange?.endDate?.toISOString(),
@@ -62,6 +63,7 @@ export async function executeTodoSearch(db, wire) {
         taskTagFilter: wire.taskTagFilter,
         taskDateRange,
         limit: wire.limit,
+        offset: wire.offset,
         scanLimit: wire.scanLimit,
     });
 }
@@ -71,7 +73,8 @@ export async function searchTodoTasks(db, query, options) {
     const noteRows = scannedRows.slice(0, options.scanLimit);
     const allTasks = extractFlattenedTasks(noteRows);
     const filteredTasks = filterTasksForTodoList(allTasks, query, options.taskStatus, options.taskTagFilter, options.taskDateRange);
-    const visibleTasks = filteredTasks.slice(0, options.limit);
+    const offset = options.offset ?? 0;
+    const visibleTasks = filteredTasks.slice(offset, offset + options.limit);
     const tasks = visibleTasks.map((task) => ({
         task_key: buildTaskKey(task.noteId, task.taskId),
         note_id: task.noteId,
@@ -96,11 +99,13 @@ export async function searchTodoTasks(db, query, options) {
             total_count: filteredTasks.length,
             matched_note_count: new Set(filteredTasks.map((task) => task.noteId)).size,
             limit: options.limit,
+            offset,
+            has_more: filteredTasks.length > offset + tasks.length,
             scan_limit: options.scanLimit,
             scanned_note_count: noteRows.length,
             scan_truncated: scanTruncated,
             total_count_is_lower_bound: scanTruncated,
-            truncated: scanTruncated || filteredTasks.length > tasks.length,
+            truncated: scanTruncated || filteredTasks.length > offset + tasks.length,
             applied_filters: {
                 status: options.taskStatus,
                 tags: [...options.taskTagFilter],

package/dist/commands/writeReceipt.d.ts

@@ -0,0 +1,13 @@
+import type { WriteDurability } from './writeDurability.js';
+import { type CommandRuntime, type MutationUploadReceipt } from './runtime.js';
+/** Output fields every local-database write reports, as note and todo writes do. */
+export declare const WRITE_RECEIPT_FIELDS: readonly ["durability", "upload_queue_remaining", "stale"];
+export type WriteReceipt = MutationUploadReceipt & {
+    stale: boolean;
+};
+/**
+ * Waits for the upload `--durability` asks for and describes where the write
+ * stands: `durability` local or uploaded, the remaining upload queue, any
+ * upload error, and whether the pre-write sync was stale.
+ */
+export declare function completeWrite(runtime: CommandRuntime, durability: WriteDurability): Promise<WriteReceipt>;

package/dist/commands/writeReceipt.js

@@ -0,0 +1,12 @@
+import { commandStale, waitForMutationUpload } from './runtime.js';
+/** Output fields every local-database write reports, as note and todo writes do. */
+export const WRITE_RECEIPT_FIELDS = ['durability', 'upload_queue_remaining', 'stale'];
+/**
+ * Waits for the upload `--durability` asks for and describes where the write
+ * stands: `durability` local or uploaded, the remaining upload queue, any
+ * upload error, and whether the pre-write sync was stale.
+ */
+export async function completeWrite(runtime, durability) {
+    const upload = await waitForMutationUpload(runtime, { durability });
+    return { ...upload, stale: commandStale(runtime) };
+}

package/dist/config/serviceEndpoints.d.ts

@@ -1,3 +1,5 @@
 export declare const POWERSYNC_DEFAULT_ENDPOINT = "https://powersync.dinoai.fun";
 export declare const POWERSYNC_DEFAULT_TOKEN_ENDPOINT = "https://dinoai.chatgo.pro/auth/v2/token";
 export declare const POWERSYNC_DEFAULT_UPLOAD_BASE_URL = "https://dinoai.chatgo.pro";
+/** dinox-tool business API (semantic search, gateway credentials). */
+export declare const AI_SERVICE_URL = "https://aisdk.chatgo.pro";

package/dist/config/serviceEndpoints.js

@@ -1,3 +1,5 @@
 export const POWERSYNC_DEFAULT_ENDPOINT = 'https://powersync.dinoai.fun';
 export const POWERSYNC_DEFAULT_TOKEN_ENDPOINT = 'https://dinoai.chatgo.pro/auth/v2/token';
 export const POWERSYNC_DEFAULT_UPLOAD_BASE_URL = 'https://dinoai.chatgo.pro';
+/** dinox-tool business API (semantic search, gateway credentials). */
+export const AI_SERVICE_URL = 'https://aisdk.chatgo.pro';

package/dist/daemon/client.d.ts

@@ -1,6 +1,8 @@
 import type { DaemonPingResult, DaemonShutdownResult } from './types.js';
 export declare function sendDaemonRequest(method: string, params?: unknown, requestOptions?: {
     timeoutMs?: number;
+    /** Streamed responses: called with each NDJSON frame ahead of the final response line. */
+    onFrame?: (frame: unknown) => void;
 }): Promise<unknown>;
 export declare function isDaemonRunning(timeoutMs?: number): Promise<boolean>;
 /**

package/dist/daemon/client.js

@@ -1,6 +1,7 @@
 import { request as httpRequest } from 'node:http';
 import { existsSync } from 'node:fs';
 import { getDaemonSocketPath, isLegacyDaemonProcess, isProcessRunning, readPid, removePid, } from './pid.js';
+import { getPackageVersion } from '../utils/version.js';
 import { remainingDeadlineMs } from '../utils/deadline.js';
 import { DinoxError, wireErrorCode } from '../utils/errors.js';
 const DEFAULT_DAEMON_REQUEST_TIMEOUT_MS = 10_000;
@@ -34,6 +35,7 @@ export async function sendDaemonRequest(method, params, requestOptions = {}) {
     };
     return new Promise((resolve, reject) => {
         let settled = false;
+        let connected = false;
         let deadlineTimer;
         const finalize = (error, value) => {
             if (settled)
@@ -43,6 +45,8 @@ export async function sendDaemonRequest(method, params, requestOptions = {}) {
                 clearTimeout(deadlineTimer);
             }
             if (error) {
+                if (error instanceof Error)
+                    Object.assign(error, { requestWritten: connected });
                 reject(error);
                 return;
             }
@@ -62,15 +66,31 @@ export async function sendDaemonRequest(method, params, requestOptions = {}) {
         };
         const req = httpRequest(options, (res) => {
             const statusCode = res.statusCode ?? 0;
-            const chunks = [];
+            let chunks = [];
             let totalBytes = 0;
+            const { onFrame } = requestOptions;
             res.on('data', (chunk) => {
                 totalBytes += chunk.length;
-                if (totalBytes > MAX_DAEMON_RESPONSE_BYTES) {
+                if (method !== 'command.execute' && totalBytes > MAX_DAEMON_RESPONSE_BYTES) {
                     req.destroy(new Error('Daemon response too large'));
                     return;
                 }
                 chunks.push(chunk);
+                if (!onFrame || !chunk.includes(0x0a))
+                    return;
+                // Every complete line is a frame; the response itself is the unterminated last line.
+                let pending = Buffer.concat(chunks);
+                for (let newline = pending.indexOf(0x0a); newline !== -1; newline = pending.indexOf(0x0a)) {
+                    const line = pending.subarray(0, newline).toString('utf-8');
+                    pending = pending.subarray(newline + 1);
+                    try {
+                        onFrame(JSON.parse(line));
+                    }
+                    catch {
+                        // A malformed frame only loses that progress line.
+                    }
+                }
+                chunks = [pending];
             });
             res.on('end', () => {
                 try {
@@ -92,10 +112,23 @@ export async function sendDaemonRequest(method, params, requestOptions = {}) {
                 }
             });
         });
+        req.on('socket', socket => {
+            // A reused keep-alive socket is already connected and never emits
+            // 'connect' again; listening anyway leaks one listener per request.
+            if (!socket.connecting) {
+                connected = true;
+                return;
+            }
+            socket.once('connect', () => { connected = true; });
+        });
         req.on('timeout', () => {
             req.destroy(new Error('Daemon request timed out'));
         });
         req.on('error', (error) => finalize(error));
+        req.on('response', res => {
+            res.on('aborted', () => finalize(new Error('Daemon response interrupted')));
+            res.on('error', error => finalize(error));
+        });
         deadlineTimer = setTimeout(() => {
             req.destroy(new Error('Daemon request timed out'));
         }, timeoutMs);
@@ -282,6 +315,16 @@ export async function waitForFreshDaemon(expectedVersion, expectedUserId, expect
         }
     }
 }
+/** Daemon log context for a stop request; never carries credentials. */
+function redactRequesterCommand(argv) {
+    return argv.join(' ')
+        .replace(/(auth\s+login)\b[\s\S]*/i, '$1 [REDACTED]')
+        .replace(/((?:--)?[\w-]*(?:token|authorization|secret|password|api[-_]?key)[\w-]*[=\s]+)(?:Bearer\s+)?[^\s]+/gi, '$1[REDACTED]')
+        .replace(/\bBearer\s+\S+/gi, 'Bearer [REDACTED]')
+        .replace(/\beyJ[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+){1,2}\b/g, '[REDACTED]')
+        .replace(/\b[A-Za-z0-9_-]{32,}\b/g, '[REDACTED]')
+        .slice(0, 200);
+}
 /** Request shutdown of one exact daemon instance and reject if the socket changed owners. */
 export async function requestDaemonShutdown(expectedInstanceId, timeoutMs = 2_000) {
     if (!expectedInstanceId) {
@@ -290,7 +333,14 @@ export async function requestDaemonShutdown(expectedInstanceId, timeoutMs = 2_00
             recoverable: true,
         });
     }
-    const result = await sendDaemonRequest('shutdown', { expectedInstanceId }, { timeoutMs });
+    const result = await sendDaemonRequest('shutdown', {
+        expectedInstanceId,
+        requester: {
+            pid: process.pid,
+            version: getPackageVersion(),
+            command: redactRequesterCommand(process.argv.slice(2)),
+        },
+    }, { timeoutMs });
     if (!result
         || typeof result !== 'object'
         || result.stopping !== true

package/dist/daemon/connectivity.d.ts

@@ -0,0 +1,20 @@
+/** How often the daemon checks for a wake from sleep or a network change. */
+export declare const CONNECTIVITY_CHECK_INTERVAL_MS = 10000;
+/** A tick this late means the machine was asleep (timers do not run during sleep). */
+export declare const WAKE_DRIFT_THRESHOLD_MS = 30000;
+export type ConnectivityChange = 'wake' | 'network-change';
+/** Addresses of the non-internal interfaces; changes on Wi-Fi switch, VPN, or link loss. */
+export declare function networkSignature(): string;
+/**
+ * Detects the events after which a long-lived sync stream may be a dead
+ * connection that still reports "connected": a wake from sleep and a change
+ * of network. Call `tick()` every CONNECTIVITY_CHECK_INTERVAL_MS.
+ */
+export declare function createConnectivityWatcher(options: {
+    onChange: (change: ConnectivityChange) => void;
+    now?: () => number;
+    signature?: () => string;
+    intervalMs?: number;
+}): {
+    tick: () => void;
+};

package/dist/daemon/connectivity.js

@@ -0,0 +1,42 @@
+import os from 'node:os';
+/** How often the daemon checks for a wake from sleep or a network change. */
+export const CONNECTIVITY_CHECK_INTERVAL_MS = 10_000;
+/** A tick this late means the machine was asleep (timers do not run during sleep). */
+export const WAKE_DRIFT_THRESHOLD_MS = 30_000;
+/** Addresses of the non-internal interfaces; changes on Wi-Fi switch, VPN, or link loss. */
+export function networkSignature() {
+    const addresses = [];
+    for (const [name, entries] of Object.entries(os.networkInterfaces())) {
+        for (const entry of entries ?? []) {
+            if (!entry.internal)
+                addresses.push(`${name}:${entry.address}`);
+        }
+    }
+    return addresses.sort().join(',');
+}
+/**
+ * Detects the events after which a long-lived sync stream may be a dead
+ * connection that still reports "connected": a wake from sleep and a change
+ * of network. Call `tick()` every CONNECTIVITY_CHECK_INTERVAL_MS.
+ */
+export function createConnectivityWatcher(options) {
+    const now = options.now ?? Date.now;
+    const signature = options.signature ?? networkSignature;
+    const intervalMs = options.intervalMs ?? CONNECTIVITY_CHECK_INTERVAL_MS;
+    let lastTickAt = now();
+    let lastSignature = signature();
+    return {
+        tick() {
+            const tickAt = now();
+            const drift = tickAt - lastTickAt - intervalMs;
+            lastTickAt = tickAt;
+            const currentSignature = signature();
+            const networkChanged = currentSignature !== lastSignature;
+            lastSignature = currentSignature;
+            if (drift >= WAKE_DRIFT_THRESHOLD_MS)
+                options.onChange('wake');
+            else if (networkChanged)
+                options.onChange('network-change');
+        },
+    };
+}

package/dist/daemon/ensure.js

@@ -1,9 +1,12 @@
+import { existsSync } from 'node:fs';
 import { getDaemonInfo, isDaemonFresh, waitForFreshDaemon } from './client.js';
-import { stopDaemonLocked } from './index.js';
+import { matchesRuntimeTokenBinding } from './fresh.js';
+import { restartDaemonLocked, stopDaemonLocked } from './index.js';
 import { DEFAULT_DAEMON_PORT } from './types.js';
-import { launchDaemon } from './launch.js';
+import { daemonServiceSpec, foreignServiceOwner, launchDaemon, usableDaemonService } from './launch.js';
 import { getDaemonLogPath } from './log.js';
-import { acquireDaemonStartLock, } from './pid.js';
+import { acquireDaemonStartLock, getDaemonSocketPath, isProcessRunning, readPid, } from './pid.js';
+import { getDaemonService } from './supervisor.js';
 import { loadConfig } from '../config/store.js';
 import { fingerprintDaemonRuntimeConfig, resolveConfig } from '../config/resolve.js';
 import { hydrateResolvedAuthIdentity } from '../auth/userInfo.js';
@@ -20,13 +23,22 @@ async function hydrateDaemonIdentity(baseConfig) {
         runtimeConfigFingerprint: fingerprintDaemonRuntimeConfig(config),
     };
 }
-function matchesRuntimeTokenBinding(info, version, config) {
-    return Boolean(config.auth.authorization
-        && info.authenticated
-        && info.version === version
-        && info.tokenFingerprint === (config.auth.tokenFingerprint ?? null)
-        && info.runtimeConfigFingerprint === fingerprintDaemonRuntimeConfig(config)
-        && (!config.auth.userId || info.userId === config.auth.userId));
+/**
+ * Refuses to restart or rewrite a service another dino install owns. The data
+ * command then runs in-process; `dino daemon install` (or start/restart)
+ * switches the service to this CLI.
+ */
+async function assertServiceNotForeign() {
+    const service = await usableDaemonService();
+    const owner = service ? foreignServiceOwner(service) : null;
+    if (!service || !owner)
+        return;
+    throw new DinoxError(`The ${service.kind} daemon service belongs to another dino install (${owner}).`, {
+        code: 'DAEMON_SERVICE_FOREIGN',
+        recoverable: true,
+        details: { service: service.kind, owner, definitionPath: service.definitionPath },
+        suggestion: 'Run `dino daemon install` with the dino you want the service to use.',
+    });
 }
 async function ensureDaemonRunningUnlocked() {
     const expectedVersion = getPackageVersion();
@@ -43,15 +55,22 @@ async function ensureDaemonRunningUnlocked() {
         return;
     }
     const expectedIdentity = await hydrateDaemonIdentity(baseConfig);
+    if (info && isDaemonFresh(info, expectedVersion, expectedIdentity.userId, expectedIdentity.tokenFingerprint, expectedIdentity.runtimeConfigFingerprint)) {
+        return;
+    }
+    await assertServiceNotForeign();
     if (info) {
         // A daemon is reachable — make sure it is the *right* one. It holds a long-lived
         // PowerSync connection bound to whatever account/version it started with, so after
         // `auth login` (new userId) or `dino update` (new version) the running daemon would
         // otherwise keep serving stale or wrong-account data. Restart it when it drifts.
-        if (isDaemonFresh(info, expectedVersion, expectedIdentity.userId, expectedIdentity.tokenFingerprint, expectedIdentity.runtimeConfigFingerprint)) {
+        printHumanReadableWarning('Restarting daemon (version or account changed)...');
+        const service = getDaemonService();
+        if (service?.isInstalled() && info.supervisor === service.kind
+            && service.isCurrent(daemonServiceSpec(service, DEFAULT_DAEMON_PORT))) {
+            await restartDaemonLocked(DEFAULT_DAEMON_PORT, { quiet: true });
             return;
         }
-        printHumanReadableWarning('Restarting daemon (version or account changed)...');
         await stopDaemonLocked().catch((error) => {
             const message = error instanceof Error ? error.message : String(error);
             printHumanReadableWarning(`warning: failed to stop stale daemon: ${message}`);
@@ -65,6 +84,23 @@ async function ensureDaemonRunningUnlocked() {
         }
     }
     else {
+        // A live process that owns the socket but does not answer is hung; only
+        // launchd / systemd can replace it safely (they know the exact process).
+        const pid = readPid();
+        const service = getDaemonService();
+        if (pid && isProcessRunning(pid.pid) && existsSync(getDaemonSocketPath())
+            && service?.isInstalled() && service.kind !== 'schtasks') {
+            printHumanReadableWarning('warning: daemon is not responding; restarting the service');
+            await service.restart();
+            if (await waitForFreshDaemon(expectedVersion, expectedIdentity.userId, expectedIdentity.tokenFingerprint, expectedIdentity.runtimeConfigFingerprint, DAEMON_READY_TIMEOUT_MS)) {
+                return;
+            }
+            throw new DinoxError('The daemon service is still not responding after a restart.', {
+                code: 'DAEMON_START_FAILED',
+                details: { service: service.kind, logPath: getDaemonLogPath() },
+                suggestion: `Inspect ${getDaemonLogPath()} for the daemon's startup error.`,
+            });
+        }
         printHumanReadableWarning('Starting daemon...');
     }
     const launch = await launchDaemon(DEFAULT_DAEMON_PORT);