@dinoxx/dinox-cli 2.6.0 → 2.7.0

package/dist/commands/schema/renderSkills.js

@@ -4,7 +4,7 @@ import { listErrorCodes } from '../../utils/errorCodes.js';
 import { listCommandSchemas } from './spec.js';
 const SECTION_ORDER = [
     { title: 'Auth', paths: ['auth.login', 'auth.logout', 'auth.status'] },
-    { title: 'Daemon', paths: ['daemon.start', 'daemon.status', 'daemon.restart', 'daemon.stop', 'daemon.install', 'daemon.uninstall'] },
+    { title: 'Daemon', paths: ['daemon.start', 'daemon.status', 'daemon.restart', 'daemon.stop', 'daemon.install', 'daemon.uninstall', 'daemon.supervise'] },
     {
         title: 'Agent Gateways',
         paths: ['gateway.detect', 'gateway.add', 'gateway.list', 'gateway.remove', 'gateway.status', 'gateway.reload', 'gateway.mcp'],

package/dist/daemon/index.js

@@ -16,6 +16,7 @@ import { getPackageVersion } from '../utils/version.js';
 import { DAEMON_CHILD_ENV, daemonServiceSpec, envTokenOverridesLogin, launchDaemon } from './launch.js';
 import { getDaemonLogPath, rotateDaemonLog, writeDaemonLogLine } from './log.js';
 import { DAEMON_SERVICE_ENV, getDaemonService } from './supervisor.js';
+import { superviseCurrentDaemon } from './supervise.js';
 import { normalizeAuthToken } from '../utils/authToken.js';
 const DAEMON_STOP_POLL_INTERVAL_MS = 100;
 const DAEMON_STOP_TIMEOUT_MS = 5_000;
@@ -380,11 +381,20 @@ export async function uninstallDaemonService() {
     if (!service) {
         return { uninstalled: false, service: null, definitionPath: null };
     }
-    return withDaemonStartLock(async () => ({
-        uninstalled: await service.uninstall(),
-        service: service.kind,
-        definitionPath: service.definitionPath,
-    }));
+    return withDaemonStartLock(async () => {
+        if (service.isInstalled()) {
+            // Stop through the socket first: a clean exit is not restarted, and
+            // deleting a Windows task does not end the process it started.
+            const info = await getDaemonInfo();
+            if (info?.supervisor === service.kind)
+                await stopDaemonLocked();
+        }
+        return {
+            uninstalled: await service.uninstall(),
+            service: service.kind,
+            definitionPath: service.definitionPath,
+        };
+    });
 }
 function printDaemonStartResult(result) {
     if (result.alreadyRunning) {
@@ -432,7 +442,7 @@ function printDaemonInstallResult(result) {
     printHumanReadableLine(`Installed ${result.service} service ${result.label}`);
     printHumanReadableLine(`Definition: ${result.definitionPath}`);
     printHumanReadableLine(`Log: ${result.logPath}`);
-    printHumanReadableLine('The daemon now starts at login and restarts after a crash.');
+    printHumanReadableLine(`The daemon now starts at ${result.service === 'schtasks' ? 'logon (Task Scheduler)' : 'login'} and restarts after a crash.`);
     if (result.service === 'systemd') {
         printHumanReadableLine('To keep it running after you log out, run `loginctl enable-linger`.');
     }
@@ -482,6 +492,9 @@ async function runDaemonStatus() {
     }
     printDaemonStatusResult(result);
 }
+async function runDaemonSupervise(context) {
+    process.exitCode = await superviseCurrentDaemon(parsePort(context.options.port));
+}
 async function runDaemonInstall(context) {
     const result = await installDaemonService(parsePort(context.options.port));
     if (getRequestedStructuredOutputFormat()) {
@@ -620,6 +633,24 @@ export const daemonCommandGroup = {
             },
             action: runDaemonUninstall,
         },
+        {
+            name: 'supervise',
+            description: 'Run the daemon in the foreground and restart it after a crash (used by the Windows logon task)',
+            options: [{ flags: '--port <number>', description: 'Legacy compatibility field; daemon listens on a private local socket', type: 'number', defaultValue: DEFAULT_DAEMON_PORT }],
+            schema: {
+                path: 'daemon.supervise',
+                risk: 'write',
+                auth: 'none',
+                globalOptions: [],
+                output: {
+                    type: 'structured',
+                    summary: 'Runs until the daemon exits cleanly or the supervisor is stopped; no structured payload',
+                    fields: [],
+                },
+                examples: ['dino daemon supervise'],
+            },
+            action: runDaemonSupervise,
+        },
     ],
 };
 export function registerDaemonCommands(program) {

package/dist/daemon/launch.d.ts

@@ -14,7 +14,11 @@ export type DaemonLaunch = {
  * of its own environment can have.
  */
 export declare function envTokenOverridesLogin(raw: DinoxConfig, env?: NodeJS.ProcessEnv): boolean;
-/** What the service definition runs: this CLI, with no secrets written to disk. */
+/**
+ * What the service definition runs: this CLI, with no secrets written to disk.
+ * Task Scheduler cannot restart a crashed process, so on Windows the service
+ * runs the supervisor, which runs the daemon.
+ */
 export declare function daemonServiceSpec(service: DaemonService, port: number): DaemonServiceSpec;
 /** The installed service when this caller can use it, else null. */
 export declare function usableDaemonService(): Promise<DaemonService | null>;

package/dist/daemon/launch.js

@@ -6,17 +6,19 @@ import { DinoxError } from '../utils/errors.js';
 import { buildDaemonEnv } from './env.js';
 import { closeDaemonLogFd, getDaemonLogPath, openDaemonLogForChild } from './log.js';
 import { ensureDaemonDir } from './pid.js';
-import { DAEMON_SERVICE_ENV, getDaemonService, serviceDefinitionIsStale, } from './supervisor.js';
+import { DAEMON_SERVICE_ENV, getDaemonService, } from './supervisor.js';
 /** Tells a daemon child its parent holds the start lock (or that it runs under a service). */
 export const DAEMON_CHILD_ENV = 'DINOX_INTERNAL_DAEMON_CHILD';
-function daemonCommandLine(port) {
+function daemonCommandLine(port, mode = 'start') {
     const entrypoint = process.argv[1];
     if (!entrypoint) {
         throw new DinoxError('Cannot determine the CLI entrypoint for daemon startup', { code: 'DAEMON_START_FAILED' });
     }
     return {
         program: process.execPath,
-        args: [...process.execArgv, entrypoint, 'daemon', 'start', '--port', String(port), '--no-detach'],
+        args: mode === 'supervise'
+            ? [...process.execArgv, entrypoint, 'daemon', 'supervise', '--port', String(port)]
+            : [...process.execArgv, entrypoint, 'daemon', 'start', '--port', String(port), '--no-detach'],
     };
 }
 /**
@@ -28,9 +30,13 @@ export function envTokenOverridesLogin(raw, env = process.env) {
     const envToken = readEnvAuthToken(env);
     return Boolean(envToken && envToken !== normalizeAuthToken(raw.auth?.authorization));
 }
-/** What the service definition runs: this CLI, with no secrets written to disk. */
+/**
+ * What the service definition runs: this CLI, with no secrets written to disk.
+ * Task Scheduler cannot restart a crashed process, so on Windows the service
+ * runs the supervisor, which runs the daemon.
+ */
 export function daemonServiceSpec(service, port) {
-    const { program, args } = daemonCommandLine(port);
+    const { program, args } = daemonCommandLine(port, service.kind === 'schtasks' ? 'supervise' : 'start');
     const env = buildDaemonEnv();
     delete env[DINOX_TOKEN_ENV_VAR];
     env[DAEMON_SERVICE_ENV] = service.kind;
@@ -55,6 +61,8 @@ function spawnDetached(port) {
             stdio: ['ignore', log, log],
             env: { ...buildDaemonEnv(), [DAEMON_CHILD_ENV]: '1' },
             cwd: os.homedir(),
+            // A detached Windows child otherwise opens its own console window.
+            windowsHide: true,
         });
         child.unref();
         return { service: null, abort: () => child.kill('SIGTERM') };
@@ -75,7 +83,7 @@ export async function launchDaemon(port) {
         return spawnDetached(port);
     ensureDaemonDir();
     const spec = daemonServiceSpec(service, port);
-    if (serviceDefinitionIsStale(service, spec)) {
+    if (!service.isCurrent(spec)) {
         await service.install(spec);
     }
     else {

package/dist/daemon/log.d.ts

@@ -10,3 +10,5 @@ export declare function openDaemonLogForChild(): number | 'ignore';
 export declare function closeDaemonLogFd(fd: number | 'ignore'): void;
 /** One timestamped line on stderr, which a daemon child has pointed at its log. */
 export declare function writeDaemonLogLine(scope: string, message: string, details?: Record<string, unknown>): void;
+/** One timestamped line appended to the log file itself, for processes with no usable stderr. */
+export declare function appendDaemonLogLine(scope: string, message: string, details?: Record<string, unknown>): void;

package/dist/daemon/log.js

@@ -1,4 +1,4 @@
-import { closeSync, copyFileSync, openSync, statSync, truncateSync } from 'node:fs';
+import { appendFileSync, closeSync, copyFileSync, openSync, statSync, truncateSync } from 'node:fs';
 import { join } from 'node:path';
 import { ensureDaemonDir, getDaemonDir } from './pid.js';
 const MAX_DAEMON_LOG_BYTES = 5 * 1024 * 1024;
@@ -37,8 +37,21 @@ export function closeDaemonLogFd(fd) {
     if (fd !== 'ignore')
         closeSync(fd);
 }
+function formatLogLine(scope, message, details) {
+    const suffix = details ? ` ${JSON.stringify(details)}` : '';
+    return `${new Date().toISOString()} [${scope}] ${message}${suffix}\n`;
+}
 /** One timestamped line on stderr, which a daemon child has pointed at its log. */
 export function writeDaemonLogLine(scope, message, details) {
-    const suffix = details ? ` ${JSON.stringify(details)}` : '';
-    process.stderr.write(`${new Date().toISOString()} [${scope}] ${message}${suffix}\n`);
+    process.stderr.write(formatLogLine(scope, message, details));
+}
+/** One timestamped line appended to the log file itself, for processes with no usable stderr. */
+export function appendDaemonLogLine(scope, message, details) {
+    try {
+        ensureDaemonDir();
+        appendFileSync(getDaemonLogPath(), formatLogLine(scope, message, details), { mode: 0o600 });
+    }
+    catch {
+        // Logging is best effort.
+    }
 }

package/dist/daemon/server.js

@@ -21,7 +21,7 @@ import { readConversation } from '../gateway/conversationContext.js';
 const MAX_DAEMON_REQUEST_BYTES = 1 * 1024 * 1024;
 function daemonSupervisor() {
     const value = process.env[DAEMON_SERVICE_ENV];
-    return value === 'launchd' || value === 'systemd' ? value : null;
+    return value === 'launchd' || value === 'systemd' || value === 'schtasks' ? value : null;
 }
 const DAEMON_PROCESS_VERSION = getPackageVersion();
 async function readJsonBody(req) {

package/dist/daemon/supervise.d.ts

@@ -0,0 +1,29 @@
+import { type ChildProcess } from 'node:child_process';
+/** First restart delay after a crash; doubles per consecutive crash. */
+export declare const SUPERVISE_INITIAL_BACKOFF_MS = 1000;
+export declare const SUPERVISE_MAX_BACKOFF_MS = 60000;
+/** A daemon that ran this long counts as healthy, so the next crash restarts quickly again. */
+export declare const SUPERVISE_HEALTHY_RUN_MS = 60000;
+export type SupervisedExit = {
+    code: number | null;
+    signal: NodeJS.Signals | null;
+};
+export type SuperviseDependencies = {
+    startChild: () => ChildProcess;
+    sleep: (ms: number) => Promise<void>;
+    now: () => number;
+    log: (message: string, details?: Record<string, unknown>) => void;
+    /** Registers a handler for a stop request (signal); the loop then stops the child and returns. */
+    onStopRequest: (handler: () => void) => void;
+};
+/**
+ * Keeps one daemon running, the way launchd's KeepAlive.SuccessfulExit=false
+ * and systemd's Restart=on-failure do: restarts it after a crash with an
+ * exponential backoff, and returns once it exits cleanly (exit code 0 from
+ * `dino daemon stop`, an identity restart, or a stop for exclusive DB access)
+ * or when asked to stop. Used where the service manager cannot restart the
+ * daemon itself (Windows Task Scheduler).
+ */
+export declare function superviseDaemon(deps: SuperviseDependencies): Promise<number>;
+/** Runs the supervisor for this CLI's daemon until it exits cleanly or is signalled. */
+export declare function superviseCurrentDaemon(port: number): Promise<number>;

package/dist/daemon/supervise.js

@@ -0,0 +1,98 @@
+import { spawn } from 'node:child_process';
+import { appendDaemonLogLine, closeDaemonLogFd, openDaemonLogForChild } from './log.js';
+/** First restart delay after a crash; doubles per consecutive crash. */
+export const SUPERVISE_INITIAL_BACKOFF_MS = 1_000;
+export const SUPERVISE_MAX_BACKOFF_MS = 60_000;
+/** A daemon that ran this long counts as healthy, so the next crash restarts quickly again. */
+export const SUPERVISE_HEALTHY_RUN_MS = 60_000;
+function waitForExit(child) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const settle = (exit) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(exit);
+        };
+        child.once('exit', (code, signal) => settle({ code, signal }));
+        // A child that cannot be spawned at all counts as a crash.
+        child.once('error', () => settle({ code: 1, signal: null }));
+    });
+}
+/**
+ * Keeps one daemon running, the way launchd's KeepAlive.SuccessfulExit=false
+ * and systemd's Restart=on-failure do: restarts it after a crash with an
+ * exponential backoff, and returns once it exits cleanly (exit code 0 from
+ * `dino daemon stop`, an identity restart, or a stop for exclusive DB access)
+ * or when asked to stop. Used where the service manager cannot restart the
+ * daemon itself (Windows Task Scheduler).
+ */
+export async function superviseDaemon(deps) {
+    let stopping = false;
+    let current = null;
+    let wakeSleep = null;
+    deps.onStopRequest(() => {
+        stopping = true;
+        current?.kill('SIGTERM');
+        wakeSleep?.();
+    });
+    let backoffMs = SUPERVISE_INITIAL_BACKOFF_MS;
+    while (!stopping) {
+        const startedAt = deps.now();
+        const child = deps.startChild();
+        current = child;
+        deps.log('daemon started', { pid: child.pid ?? null });
+        const exit = await waitForExit(child);
+        current = null;
+        if (stopping)
+            break;
+        if (exit.code === 0) {
+            deps.log('daemon exited cleanly; supervisor stopping');
+            return 0;
+        }
+        if (deps.now() - startedAt >= SUPERVISE_HEALTHY_RUN_MS)
+            backoffMs = SUPERVISE_INITIAL_BACKOFF_MS;
+        deps.log('daemon crashed; restarting', { code: exit.code, signal: exit.signal, delayMs: backoffMs });
+        await Promise.race([
+            deps.sleep(backoffMs),
+            new Promise((resolve) => {
+                wakeSleep = resolve;
+            }),
+        ]);
+        wakeSleep = null;
+        backoffMs = Math.min(backoffMs * 2, SUPERVISE_MAX_BACKOFF_MS);
+    }
+    deps.log('supervisor stopped on request');
+    return 0;
+}
+/** Runs the supervisor for this CLI's daemon until it exits cleanly or is signalled. */
+export async function superviseCurrentDaemon(port) {
+    const entrypoint = process.argv[1];
+    if (!entrypoint)
+        throw new Error('Cannot determine the CLI entrypoint for the daemon');
+    // Launched hidden at logon there is no console, so write to the log file directly.
+    const log = (message, details) => appendDaemonLogLine('dinox-supervisor', message, details);
+    return superviseDaemon({
+        startChild: () => {
+            const logFd = openDaemonLogForChild();
+            try {
+                return spawn(process.execPath, [...process.execArgv, entrypoint, 'daemon', 'start', '--port', String(port), '--no-detach'], 
+                // Same (already clean) environment, which carries the service marker.
+                { stdio: ['ignore', logFd, logFd], env: process.env, windowsHide: true });
+            }
+            finally {
+                closeDaemonLogFd(logFd);
+            }
+        },
+        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+        now: () => Date.now(),
+        log,
+        onStopRequest: (handler) => {
+            for (const signal of ['SIGINT', 'SIGTERM', 'SIGBREAK']) {
+                process.on(signal, handler);
+            }
+            // Like the daemon, never stop on a hangup.
+            process.on('SIGHUP', () => undefined);
+        },
+    });
+}

package/dist/daemon/supervisor.d.ts

@@ -7,9 +7,11 @@
  *
  * Restart policy is "on failure" only: a clean exit (`dino daemon stop`, a
  * version/account restart, exclusive DB access for `doctor`) leaves it
- * stopped until the CLI starts it again through the manager.
+ * stopped until the CLI starts it again through the manager. launchd and
+ * systemd restart the daemon themselves; on Windows, Task Scheduler only
+ * starts `dino daemon supervise`, which restarts it (see supervise.ts).
  */
-export type DaemonServiceKind = 'launchd' | 'systemd';
+export type DaemonServiceKind = 'launchd' | 'systemd' | 'schtasks';
 export type DaemonServiceSpec = {
     program: string;
     args: string[];
@@ -29,6 +31,8 @@ export type DaemonService = {
     readonly definitionPath: string;
     render(spec: DaemonServiceSpec): string;
     isInstalled(): boolean;
+    /** True when the installed definition is exactly what this CLI would write. */
+    isCurrent(spec: DaemonServiceSpec): boolean;
     /** Writes the definition and (re)loads it, which starts the daemon. */
     install(spec: DaemonServiceSpec): Promise<void>;
     /** Starts the installed daemon when it is not running. */
@@ -44,16 +48,28 @@ export declare const runServiceCommand: ServiceCommandRunner;
  * non-default `DINOX_DATA_DIR` gets its own service.
  */
 export declare function daemonServiceLabel(env?: NodeJS.ProcessEnv): string;
-/** True when the installed definition differs from what this CLI would write. */
-export declare function serviceDefinitionIsStale(service: DaemonService, spec: DaemonServiceSpec): boolean;
 export declare function renderLaunchdPlist(label: string, spec: DaemonServiceSpec): string;
 export declare function renderSystemdUnit(spec: DaemonServiceSpec): string;
+/** Quotes one argument the way CommandLineToArgvW (and so Node) parses it back. */
+export declare function quoteWindowsArg(value: string): string;
+/**
+ * Task Scheduler runs console programs in a visible window, so the task runs
+ * this script with wscript, which sets the daemon environment and starts the
+ * supervisor with a hidden window (the launcher pattern pm2-windows-startup
+ * uses). The supervisor then outlives the script.
+ */
+export declare function renderWindowsLauncher(spec: DaemonServiceSpec): string;
+export declare function renderWindowsTaskXml(userId: string, wscriptPath: string, launcherPath: string): string;
 export type DaemonServiceOptions = {
     platform?: NodeJS.Platform;
     env?: NodeJS.ProcessEnv;
     homeDir?: string;
     uid?: number;
     run?: ServiceCommandRunner;
+    /** Windows: where the launcher script lives (the daemon directory). */
+    launcherDir?: string;
+    /** Windows: `DOMAIN\\user` the logon task runs as. */
+    windowsUserId?: string;
 };
-/** The service manager for this platform, or null where none is supported (Windows). */
+/** The service manager for this platform, or null where none is supported. */
 export declare function getDaemonService(options?: DaemonServiceOptions): DaemonService | null;

package/dist/daemon/supervisor.js

@@ -38,18 +38,14 @@ function writeDefinition(definitionPath, content) {
     mkdirSync(path.dirname(definitionPath), { recursive: true });
     writeFileSync(definitionPath, content, { mode: 0o644 });
 }
-function readDefinition(definitionPath) {
+function readDefinition(definitionPath, encoding = 'utf8') {
     try {
-        return readFileSync(definitionPath, 'utf8');
+        return readFileSync(definitionPath, encoding);
     }
     catch {
         return null;
     }
 }
-/** True when the installed definition differs from what this CLI would write. */
-export function serviceDefinitionIsStale(service, spec) {
-    return readDefinition(service.definitionPath) !== service.render(spec);
-}
 // ---------------------------------------------------------------- launchd
 function xmlEscape(value) {
     return value
@@ -118,6 +114,9 @@ class LaunchdService {
     isInstalled() {
         return existsSync(this.definitionPath);
     }
+    isCurrent(spec) {
+        return readDefinition(this.definitionPath) === this.render(spec);
+    }
     async isLoaded() {
         return (await this.run('launchctl', ['print', this.target])).code === 0;
     }
@@ -213,6 +212,9 @@ class SystemdService {
     isInstalled() {
         return existsSync(this.definitionPath);
     }
+    isCurrent(spec) {
+        return readDefinition(this.definitionPath) === this.render(spec);
+    }
     async systemctl(step, ...args) {
         const result = await this.run('systemctl', ['--user', ...args]);
         if (result.code !== 0)
@@ -236,7 +238,188 @@ class SystemdService {
         return true;
     }
 }
-/** The service manager for this platform, or null where none is supported (Windows). */
+// ---------------------------------------------------------------- Windows
+/** Quotes one argument the way CommandLineToArgvW (and so Node) parses it back. */
+export function quoteWindowsArg(value) {
+    if (value !== '' && !/[\s"]/.test(value))
+        return value;
+    let quoted = '"';
+    let backslashes = 0;
+    for (const char of value) {
+        if (char === '\\') {
+            backslashes += 1;
+            continue;
+        }
+        if (char === '"') {
+            quoted += '\\'.repeat(backslashes * 2 + 1) + '"';
+        }
+        else {
+            quoted += '\\'.repeat(backslashes) + char;
+        }
+        backslashes = 0;
+    }
+    return `${quoted}${'\\'.repeat(backslashes * 2)}"`;
+}
+function vbsString(value) {
+    return `"${value.replace(/"/g, '""').replace(/\r?\n/g, '" & vbLf & "')}"`;
+}
+/**
+ * Task Scheduler runs console programs in a visible window, so the task runs
+ * this script with wscript, which sets the daemon environment and starts the
+ * supervisor with a hidden window (the launcher pattern pm2-windows-startup
+ * uses). The supervisor then outlives the script.
+ */
+export function renderWindowsLauncher(spec) {
+    const commandLine = [spec.program, ...spec.args].map(quoteWindowsArg).join(' ');
+    const env = Object.keys(spec.env)
+        .sort()
+        .map((name) => `env(${vbsString(name)}) = ${vbsString(spec.env[name])}`)
+        .join('\r\n');
+    return [
+        "' Generated by `dino daemon install`; rewritten when the CLI changes.",
+        'Set shell = CreateObject("WScript.Shell")',
+        'Set env = shell.Environment("Process")',
+        env,
+        `shell.CurrentDirectory = ${vbsString(spec.workingDirectory)}`,
+        `shell.Run ${vbsString(commandLine)}, 0, False`,
+        '',
+    ].join('\r\n');
+}
+export function renderWindowsTaskXml(userId, wscriptPath, launcherPath) {
+    return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo>
+    <Description>Dinox CLI daemon (dino daemon install)</Description>
+  </RegistrationInfo>
+  <Triggers>
+    <LogonTrigger>
+      <Enabled>true</Enabled>
+      <UserId>${xmlEscape(userId)}</UserId>
+    </LogonTrigger>
+  </Triggers>
+  <Principals>
+    <Principal id="Author">
+      <UserId>${xmlEscape(userId)}</UserId>
+      <LogonType>InteractiveToken</LogonType>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
+    <IdleSettings>
+      <StopOnIdleEnd>false</StopOnIdleEnd>
+      <RestartOnIdle>false</RestartOnIdle>
+    </IdleSettings>
+    <AllowStartOnDemand>true</AllowStartOnDemand>
+    <Enabled>true</Enabled>
+    <Hidden>false</Hidden>
+    <RunOnlyIfIdle>false</RunOnlyIfIdle>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <Priority>7</Priority>
+  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>${xmlEscape(wscriptPath)}</Command>
+      <Arguments>${xmlEscape(`//B //Nologo ${quoteWindowsArg(launcherPath)}`)}</Arguments>
+    </Exec>
+  </Actions>
+</Task>
+`;
+}
+/** UTF-16LE with a BOM: what schtasks /XML expects and how wscript reads non-ASCII paths. */
+function writeUtf16(filePath, content) {
+    mkdirSync(path.dirname(filePath), { recursive: true });
+    writeFileSync(filePath, Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from(content, 'utf16le')]));
+}
+function readUtf16(filePath) {
+    const content = readDefinition(filePath, 'utf16le');
+    return content === null ? null : content.replace(/^\uFEFF/, '');
+}
+class WindowsTaskService {
+    label;
+    run;
+    launcherDir;
+    wscriptPath;
+    userId;
+    kind = 'schtasks';
+    definitionPath;
+    taskName;
+    constructor(label, run, launcherDir, wscriptPath, userId) {
+        this.label = label;
+        this.run = run;
+        this.launcherDir = launcherDir;
+        this.wscriptPath = wscriptPath;
+        this.userId = userId;
+        this.taskName = `Dinox\\${label}`;
+        this.definitionPath = path.join(launcherDir, `${label}.vbs`);
+    }
+    render(spec) {
+        return renderWindowsLauncher(spec);
+    }
+    isInstalled() {
+        return existsSync(this.definitionPath);
+    }
+    isCurrent(spec) {
+        return readUtf16(this.definitionPath) === this.render(spec);
+    }
+    async isRegistered() {
+        return (await this.run('schtasks', ['/Query', '/TN', this.taskName])).code === 0;
+    }
+    async register() {
+        if (!existsSync(this.wscriptPath)) {
+            throw new DinoxError(`Windows Script Host (${this.wscriptPath}) is not available, so the daemon cannot start hidden at logon.`, {
+                code: 'DAEMON_SERVICE_UNSUPPORTED',
+                details: { reason: 'wscript-missing' },
+            });
+        }
+        const xmlPath = path.join(this.launcherDir, `${this.label}.task.xml`);
+        writeUtf16(xmlPath, renderWindowsTaskXml(this.userId, this.wscriptPath, this.definitionPath));
+        try {
+            const result = await this.run('schtasks', ['/Create', '/TN', this.taskName, '/XML', xmlPath, '/F']);
+            if (result.code !== 0)
+                throw failed(this.kind, 'create', result);
+        }
+        finally {
+            try {
+                unlinkSync(xmlPath);
+            }
+            catch {
+                // Already gone.
+            }
+        }
+    }
+    async runTask() {
+        const result = await this.run('schtasks', ['/Run', '/TN', this.taskName]);
+        if (result.code !== 0)
+            throw failed(this.kind, 'run', result);
+    }
+    async install(spec) {
+        writeUtf16(this.definitionPath, this.render(spec));
+        await this.register();
+        await this.runTask();
+    }
+    async start() {
+        if (!(await this.isRegistered()))
+            await this.register();
+        await this.runTask();
+    }
+    async uninstall() {
+        const installed = this.isInstalled();
+        if (await this.isRegistered()) {
+            const result = await this.run('schtasks', ['/Delete', '/TN', this.taskName, '/F']);
+            if (result.code !== 0)
+                throw failed(this.kind, 'delete', result);
+        }
+        if (installed)
+            unlinkSync(this.definitionPath);
+        return installed;
+    }
+}
+/** The service manager for this platform, or null where none is supported. */
 export function getDaemonService(options = {}) {
     const platform = options.platform ?? process.platform;
     const env = options.env ?? process.env;
@@ -249,5 +432,10 @@ export function getDaemonService(options = {}) {
     if (platform === 'linux') {
         return new SystemdService(label, run, env.XDG_CONFIG_HOME || path.join(homeDir, '.config'));
     }
+    if (platform === 'win32') {
+        const systemRoot = env.SystemRoot || env.SYSTEMROOT || 'C:\\Windows';
+        const user = env.USERNAME || os.userInfo().username;
+        return new WindowsTaskService(label, run, options.launcherDir ?? path.join(getDataDir(), 'daemon'), path.join(systemRoot, 'System32', 'wscript.exe'), options.windowsUserId ?? (env.USERDOMAIN ? `${env.USERDOMAIN}\\${user}` : user));
+    }
     return null;
 }

package/dist/daemon/types.d.ts

@@ -43,7 +43,7 @@ export type DaemonPingResult = {
     /** True only for daemons using the current authenticated local protocol. */
     authenticated: boolean;
     /** Service manager that owns the process; null or absent (older daemons) when unmanaged. */
-    supervisor?: 'launchd' | 'systemd' | null;
+    supervisor?: 'launchd' | 'systemd' | 'schtasks' | null;
 };
 /** Kept only for old scripts that pass --port; the daemon transport is socket-based. */
 export declare const DEFAULT_DAEMON_PORT = 45678;

package/dist/gateway/adapters/acp.js

@@ -213,6 +213,8 @@ export class AcpGatewayAdapter {
             cwd: this.gateway.cwd ?? os.homedir(),
             env: { ...process.env, ...(this.gateway.env ?? {}) },
             stdio: ['pipe', 'pipe', 'pipe'],
+            // The daemon runs without a visible console on Windows; keep agents that way.
+            windowsHide: true,
         });
         child.stderr.on('data', (chunk) => this.log('agent stderr', { text: chunk.toString('utf8').slice(0, 2000) }));
         const exited = new Promise((_, reject) => {

package/dist/gateway/detect.js

@@ -70,7 +70,7 @@ export async function findExecutable(name, envPath = process.env.PATH ?? '') {
 }
 /** Starts the agent, runs `initialize`, and stops it. Never leaves the process running. */
 export async function probeAcpAgent(command, args, timeoutMs = PROBE_TIMEOUT_MS) {
-    const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'ignore'], env: process.env });
+    const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'ignore'], env: process.env, windowsHide: true });
     let timer;
     try {
         const exited = new Promise((_, reject) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dinoxx/dinox-cli",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "description": "Dinox CLI",
   "main": "dist/dinox.js",
   "scripts": {