Port new tests

feat:  decouple the database and vault directories

.github/workflows/cli-deno-tests.yml

@@ -1,17 +1,43 @@
 name: cli-deno-tests
 
 on:
+  push:
+    branches:
+      - main
+      - beta
+    paths:
+      - '.github/workflows/cli-deno-tests.yml'
+      - 'src/apps/cli/**'
+      - 'src/lib/src/API/processSetting.ts'
+      - 'package.json'
+      - 'package-lock.json'
+  pull_request:
+    paths:
+      - '.github/workflows/cli-deno-tests.yml'
+      - 'src/apps/cli/**'
+      - 'src/lib/src/API/processSetting.ts'
+      - 'package.json'
+      - 'package-lock.json'
   workflow_dispatch:
     inputs:
       test_task:
         description: 'Deno test task to run'
         type: choice
         options:
-          - test
+          - test:ci
+          - test:p2p
+          - test:all
           - test:local
           - test:e2e-matrix
-          - test:p2p-sync
-        default: test
+        default: test:ci
+      enable_debug:
+        description: 'Enable verbose and debug logging'
+        type: boolean
+        default: false
+      use_coturn:
+        description: 'Enable local coturn container for P2P tests'
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -27,21 +53,24 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          SELECTED_TASK="${{ github.event_name == 'workflow_dispatch' && inputs.test_task || 'test' }}"
+          SELECTED_TASK="${{ github.event_name == 'workflow_dispatch' && inputs.test_task || 'test:ci' }}"
           echo "[INFO] Selected task set: $SELECTED_TASK"
 
           case "$SELECTED_TASK" in
-            test)
-              TASK_MATRIX='["test:setup-put-cat","test:mirror","test:push-pull","test:sync-two-local","test:sync-locked-remote","test:p2p-host","test:p2p-peers","test:p2p-sync","test:p2p-three-nodes","test:p2p-upload-download","test:e2e-couchdb","test:e2e-matrix"]'
+            test:ci)
+              TASK_MATRIX='["test:setup-put-cat","test:mirror","test:push-pull","test:sync-two-local","test:sync-locked-remote","test:e2e-matrix:couchdb-enc0","test:e2e-matrix:couchdb-enc1","test:e2e-matrix:minio-enc0","test:e2e-matrix:minio-enc1"]'
+              ;;
+            test:p2p)
+              TASK_MATRIX='["test:p2p-host","test:p2p-peers","test:p2p-sync","test:p2p-three-nodes","test:p2p-upload-download"]'
+              ;;
+            test:all)
+              TASK_MATRIX='["test:setup-put-cat","test:mirror","test:push-pull","test:sync-two-local","test:sync-locked-remote","test:p2p-host","test:p2p-peers","test:p2p-sync","test:p2p-three-nodes","test:p2p-upload-download","test:e2e-matrix:couchdb-enc0","test:e2e-matrix:couchdb-enc1","test:e2e-matrix:minio-enc0","test:e2e-matrix:minio-enc1"]'
               ;;
             test:local)
               TASK_MATRIX='["test:setup-put-cat","test:mirror"]'
               ;;
             test:e2e-matrix)
-              TASK_MATRIX='["test:e2e-matrix"]'
-              ;;
-            test:p2p-sync)
-              TASK_MATRIX='["test:p2p-sync"]'
+              TASK_MATRIX='["test:e2e-matrix:couchdb-enc0","test:e2e-matrix:couchdb-enc1","test:e2e-matrix:minio-enc0","test:e2e-matrix:minio-enc1"]'
               ;;
             *)
               echo "[ERROR] Unknown task set: $SELECTED_TASK" >&2
@@ -55,6 +84,8 @@ jobs:
     needs: prepare
     runs-on: ubuntu-latest
     timeout-minutes: 60
+    env:
+      DENO_DIR: ~/.cache/deno
     strategy:
       fail-fast: false
       matrix:
@@ -70,12 +101,21 @@ jobs:
         with:
           node-version: '24.x'
           cache: 'npm'
+          cache-dependency-path: package-lock.json
 
       - name: Setup Deno
         uses: denoland/setup-deno@v2
         with:
           deno-version: v2.x
 
+      - name: Cache Deno dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/deno
+          key: ${{ runner.os }}-deno-${{ hashFiles('src/apps/cli/testdeno/deno.lock', 'src/apps/cli/testdeno/deno.json') }}
+          restore-keys: |
+            ${{ runner.os }}-deno-
+
       - name: Install dependencies
         run: npm ci
 
@@ -102,6 +142,9 @@ jobs:
         env:
           LIVESYNC_DOCKER_MODE: native
           LIVESYNC_CLI_RETRY: 3
+          LIVESYNC_CLI_DEBUG: ${{ inputs.enable_debug == true && '1' || '0' }}
+          LIVESYNC_CLI_VERBOSE: ${{ inputs.enable_debug == true && '1' || '0' }}
+          LIVESYNC_USE_COTURN: ${{ inputs.use_coturn == true && '1' || '0' }}
         run: |
           TASK="${{ matrix.task }}"
           echo "[INFO] Running Deno task: $TASK"
@@ -110,5 +153,5 @@ jobs:
       - name: Stop leftover containers
         if: always()
         run: |
-          docker stop couchdb-test minio-test relay-test >/dev/null 2>&1 || true
-          docker rm couchdb-test minio-test relay-test >/dev/null 2>&1 || true
+          docker stop couchdb-test minio-test relay-test coturn-test >/dev/null 2>&1 || true
+          docker rm couchdb-test minio-test relay-test coturn-test >/dev/null 2>&1 || true

.github/workflows/cli-e2e.yml

@@ -12,23 +12,6 @@ on:
           - two-vaults-couchdb
           - two-vaults-minio
         default: two-vaults-matrix
-  push:
-    branches:
-      - main
-      - beta
-    paths:
-      - '.github/workflows/cli-e2e.yml'
-      - 'src/apps/cli/**'
-      - 'src/lib/src/API/processSetting.ts'
-      - 'package.json'
-      - 'package-lock.json'
-  pull_request:
-    paths:
-      - '.github/workflows/cli-e2e.yml'
-      - 'src/apps/cli/**'
-      - 'src/lib/src/API/processSetting.ts'
-      - 'package.json'
-      - 'package-lock.json'
 
 permissions:
   contents: read

manifest.json

@@ -1,7 +1,7 @@
 {
     "id": "obsidian-livesync",
     "name": "Self-hosted LiveSync",
-    "version": "0.25.73",
+    "version": "0.25.74",
     "minAppVersion": "1.7.2",
     "description": "Community implementation of self-hosted livesync. Reflect your vault changes to some other devices immediately. Please make sure to disable other synchronize solutions to avoid content corruption or duplication.",
     "author": "vorotamoroz",

package-lock.json

@@ -1,12 +1,12 @@
 {
     "name": "obsidian-livesync",
-    "version": "0.25.73",
+    "version": "0.25.74",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "obsidian-livesync",
-            "version": "0.25.73",
+            "version": "0.25.74",
             "license": "MIT",
             "dependencies": {
                 "@aws-sdk/client-s3": "^3.808.0",

package.json

@@ -1,6 +1,6 @@
 {
     "name": "obsidian-livesync",
-    "version": "0.25.73",
+    "version": "0.25.74",
     "description": "Reflect your vault changes to some other devices immediately. Please make sure to disable other synchronize solutions to avoid content corruption or duplication.",
     "main": "main.js",
     "type": "module",

src/apps/cli/.gitignore

@@ -5,4 +5,5 @@ test/test-init.local.sh
 node_modules
 .*.json
 *.env
-!.test.env
+!.test.env
+bench-results

src/apps/cli/commands/runCommand.ts

@@ -70,6 +70,7 @@ async function verifyRemoteState(
 
 export async function runCommand(options: CLIOptions, context: CLICommandContext): Promise<boolean> {
     const { databasePath, core, settingsPath } = context;
+    const vaultPath = context.vaultPath || databasePath;
 
     await core.services.control.activated;
     if (options.command === "daemon") {
@@ -235,7 +236,7 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
             throw new Error("push requires two arguments: <src> <dst>");
         }
         const sourcePath = path.resolve(options.commandArgs[0]);
-        const destinationDatabasePath = toDatabaseRelativePath(options.commandArgs[1], databasePath);
+        const destinationDatabasePath = toDatabaseRelativePath(options.commandArgs[1], vaultPath);
         const sourceData = await fs.readFile(sourcePath);
         const sourceStat = await fs.stat(sourcePath);
         console.log(`[Command] push ${sourcePath} -> ${destinationDatabasePath}`);
@@ -253,7 +254,7 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
         if (options.commandArgs.length < 2) {
             throw new Error("pull requires two arguments: <src> <dst>");
         }
-        const sourceDatabasePath = toDatabaseRelativePath(options.commandArgs[0], databasePath);
+        const sourceDatabasePath = toDatabaseRelativePath(options.commandArgs[0], vaultPath);
         const destinationPath = path.resolve(options.commandArgs[1]);
         console.log(`[Command] pull ${sourceDatabasePath} -> ${destinationPath}`);
 
@@ -276,7 +277,7 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
         if (options.commandArgs.length < 3) {
             throw new Error("pull-rev requires three arguments: <src> <dst> <rev>");
         }
-        const sourceDatabasePath = toDatabaseRelativePath(options.commandArgs[0], databasePath);
+        const sourceDatabasePath = toDatabaseRelativePath(options.commandArgs[0], vaultPath);
         const destinationPath = path.resolve(options.commandArgs[1]);
         const rev = options.commandArgs[2].trim();
         if (!rev) {
@@ -333,7 +334,7 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
         if (options.commandArgs.length < 1) {
             throw new Error("put requires one argument: <dst>");
         }
-        const destinationDatabasePath = toDatabaseRelativePath(options.commandArgs[0], databasePath);
+        const destinationDatabasePath = toDatabaseRelativePath(options.commandArgs[0], vaultPath);
         const content = await readStdinAsUtf8();
         console.log(`[Command] put stdin -> ${destinationDatabasePath}`);
         return await core.serviceModules.databaseFileAccess.storeContent(
@@ -346,7 +347,7 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
         if (options.commandArgs.length < 1) {
             throw new Error("cat requires one argument: <src>");
         }
-        const sourceDatabasePath = toDatabaseRelativePath(options.commandArgs[0], databasePath);
+        const sourceDatabasePath = toDatabaseRelativePath(options.commandArgs[0], vaultPath);
         console.error(`[Command] cat ${sourceDatabasePath}`);
         const source = await core.serviceModules.databaseFileAccess.fetch(
             sourceDatabasePath as FilePathWithPrefix,
@@ -370,7 +371,7 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
         if (options.commandArgs.length < 2) {
             throw new Error("cat-rev requires two arguments: <src> <rev>");
         }
-        const sourceDatabasePath = toDatabaseRelativePath(options.commandArgs[0], databasePath);
+        const sourceDatabasePath = toDatabaseRelativePath(options.commandArgs[0], vaultPath);
         const rev = options.commandArgs[1].trim();
         if (!rev) {
             throw new Error("cat-rev requires a non-empty revision");
@@ -397,7 +398,7 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
     if (options.command === "ls") {
         const prefix =
             options.commandArgs.length > 0 && options.commandArgs[0].trim() !== ""
-                ? toDatabaseRelativePath(options.commandArgs[0], databasePath)
+                ? toDatabaseRelativePath(options.commandArgs[0], vaultPath)
                 : "";
         const rows: { path: string; line: string }[] = [];
 
@@ -429,7 +430,7 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
         if (options.commandArgs.length < 1) {
             throw new Error("info requires one argument: <path>");
         }
-        const targetPath = toDatabaseRelativePath(options.commandArgs[0], databasePath);
+        const targetPath = toDatabaseRelativePath(options.commandArgs[0], vaultPath);
 
         for await (const doc of core.services.database.localDatabase.findAllNormalDocs({ conflicts: true })) {
             if (doc._deleted || doc.deleted) continue;
@@ -473,7 +474,7 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
         if (options.commandArgs.length < 1) {
             throw new Error("rm requires one argument: <path>");
         }
-        const targetPath = toDatabaseRelativePath(options.commandArgs[0], databasePath);
+        const targetPath = toDatabaseRelativePath(options.commandArgs[0], vaultPath);
         console.error(`[Command] rm ${targetPath}`);
         return await core.serviceModules.databaseFileAccess.delete(targetPath as FilePathWithPrefix);
     }
@@ -482,7 +483,7 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
         if (options.commandArgs.length < 2) {
             throw new Error("resolve requires two arguments: <path> <revision-to-keep>");
         }
-        const targetPath = toDatabaseRelativePath(options.commandArgs[0], databasePath) as FilePathWithPrefix;
+        const targetPath = toDatabaseRelativePath(options.commandArgs[0], vaultPath) as FilePathWithPrefix;
         const revisionToKeep = options.commandArgs[1].trim();
         if (revisionToKeep === "") {
             throw new Error("resolve requires a non-empty revision-to-keep");

src/apps/cli/commands/runCommand.unit.spec.ts

@@ -1,3 +1,6 @@
+import * as path from "path";
+import * as fs from "fs/promises";
+import * as os from "os";
 import * as processSetting from "@lib/API/processSetting";
 import { ConnectionStringParser } from "@lib/common/ConnectionString";
 import { configURIBase } from "@lib/common/models/shared.const";
@@ -601,6 +604,45 @@ describe("runCommand abnormal cases", () => {
         expect(exported2).toBe(roundTripInput);
     });
 
+    describe("runCommand with decoupled vault path", () => {
+        it("push resolves target path relative to vaultPath, not databasePath", async () => {
+            const core = createCoreMock();
+            const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "livesync-test-"));
+            const localVaultPath = path.join(tempDir, "vault");
+            const localDatabasePath = path.join(tempDir, "db");
+            await fs.mkdir(localVaultPath);
+            await fs.mkdir(localDatabasePath);
+
+            const fileInVault = path.join(localVaultPath, "existing.md");
+            await fs.writeFile(fileInVault, "hello", "utf-8");
+
+            const decoupledContext = {
+                databasePath: localDatabasePath,
+                vaultPath: localVaultPath,
+                settingsPath: path.join(localDatabasePath, ".livesync/settings.json"),
+            } as any;
+
+            const options = {
+                command: "push" as const,
+                commandArgs: [fileInVault, fileInVault],
+                databasePath: localDatabasePath,
+                vaultPath: localVaultPath,
+            };
+
+            try {
+                const result = await runCommand(options, { ...decoupledContext, core });
+                expect(result).toBe(true);
+                expect(core.serviceModules.storageAccess.writeFileAuto).toHaveBeenCalledWith(
+                    "existing.md",
+                    expect.any(ArrayBuffer),
+                    expect.any(Object)
+                );
+            } finally {
+                await fs.rm(tempDir, { recursive: true, force: true });
+            }
+        });
+    });
+
     describe("mark-resolved and unlock-remote commands", () => {
         it("mark-resolved without args runs on active database", async () => {
             const core = createCoreMock();

src/apps/cli/commands/types.ts

@@ -46,6 +46,7 @@ export interface CLIOptions {
 
 export interface CLICommandContext {
     databasePath: string;
+    vaultPath: string;
     core: LiveSyncBaseCore<ServiceContext, any>;
     settingsPath: string;
     originalSyncSettings: Pick<

src/apps/cli/main.ts

@@ -329,8 +329,20 @@ export async function main() {
         options.command === "mirror" && options.commandArgs[0]
             ? path.resolve(options.commandArgs[0])
             : options.vaultPath
-                ? path.resolve(options.vaultPath)
-                : databasePath!;
+              ? path.resolve(options.vaultPath)
+              : databasePath!;
+
+    // Check if vault directory exists
+    try {
+        const stat = await fs.stat(vaultPath);
+        if (!stat.isDirectory()) {
+            console.error(`Error: Vault path ${vaultPath} is not a directory`);
+            process.exit(1);
+        }
+    } catch (error) {
+        console.error(`Error: Vault directory ${vaultPath} does not exist`);
+        process.exit(1);
+    }
 
     infoLog(`Self-hosted LiveSync CLI`);
     infoLog(`Database Path: ${databasePath}`);
@@ -541,7 +553,7 @@ export async function main() {
             infoLog("");
         }
 
-        const result = await runCommand(options, { databasePath, core, settingsPath, originalSyncSettings });
+        const result = await runCommand(options, { databasePath, vaultPath, core, settingsPath, originalSyncSettings });
         if (!result) {
             console.error(`[Error] Command '${options.command}' failed`);
             process.exitCode = 1;

src/apps/cli/test/test-decoupled-vault-linux.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+CLI_DIR="$(cd -- "$SCRIPT_DIR/.." && pwd)"
+cd "$CLI_DIR"
+source "$SCRIPT_DIR/test-helpers.sh"
+display_test_info
+
+RUN_BUILD="${RUN_BUILD:-1}"
+REMOTE_PATH="${REMOTE_PATH:-test/push-pull-decoupled.txt}"
+cli_test_init_cli_cmd
+
+WORK_DIR="$(mktemp -d "${TMPDIR:-/tmp}/livesync-cli-test.XXXXXX")"
+trap 'rm -rf "$WORK_DIR"' EXIT
+
+SETTINGS_FILE="${1:-$WORK_DIR/data.json}"
+
+if [[ "$RUN_BUILD" == "1" ]]; then
+    echo "[INFO] building CLI..."
+    npm run build
+fi
+
+echo "[INFO] generating settings from DEFAULT_SETTINGS -> $SETTINGS_FILE"
+cli_test_init_settings_file "$SETTINGS_FILE"
+
+if [[ -n "${COUCHDB_URI:-}" && -n "${COUCHDB_USER:-}" && -n "${COUCHDB_PASSWORD:-}" && -n "${COUCHDB_DBNAME:-}" ]]; then
+    echo "[INFO] applying CouchDB env vars to generated settings"
+    cli_test_apply_couchdb_settings "$SETTINGS_FILE" "$COUCHDB_URI" "$COUCHDB_USER" "$COUCHDB_PASSWORD" "$COUCHDB_DBNAME"
+else
+    echo "[WARN] CouchDB env vars are not fully set. push/pull may fail unless generated settings are updated."
+    cli_test_mark_settings_configured "$SETTINGS_FILE"
+fi
+
+VAULT_DIR="$WORK_DIR/vault"
+DB_DIR="$WORK_DIR/db"
+mkdir -p "$VAULT_DIR/test"
+mkdir -p "$DB_DIR"
+
+SRC_FILE="$WORK_DIR/push-source.txt"
+PULLED_FILE="$WORK_DIR/pull-result.txt"
+printf 'push-pull-decoupled-test %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$SRC_FILE"
+
+# 1. Test push command with decoupled vault directory
+echo "[INFO] push with decoupled vault -> $REMOTE_PATH"
+run_cli "$DB_DIR" --vault "$VAULT_DIR" --settings "$SETTINGS_FILE" push "$SRC_FILE" "$REMOTE_PATH"
+
+# 2. Test pull command with decoupled vault directory
+echo "[INFO] pull with decoupled vault <- $REMOTE_PATH"
+run_cli "$DB_DIR" --vault "$VAULT_DIR" --settings "$SETTINGS_FILE" pull "$REMOTE_PATH" "$PULLED_FILE"
+
+if cmp -s "$SRC_FILE" "$PULLED_FILE"; then
+    echo "[PASS] push/pull roundtrip with decoupled vault matched"
+else
+    echo "[FAIL] push/pull roundtrip with decoupled vault mismatch" >&2
+    echo "--- source ---" >&2
+    cat "$SRC_FILE" >&2
+    echo "--- pulled ---" >&2
+    cat "$PULLED_FILE" >&2
+    exit 1
+fi
+
+# 3. Clean up pulled file and vault test directory to verify mirror
+rm -f "$PULLED_FILE"
+rm -rf "$VAULT_DIR/test"
+
+# 4. Test mirror command with decoupled vault directory
+echo "[INFO] mirror with decoupled vault"
+run_cli "$DB_DIR" --vault "$VAULT_DIR" --settings "$SETTINGS_FILE" mirror
+
+RESTORED_FILE="$VAULT_DIR/$REMOTE_PATH"
+if cmp -s "$SRC_FILE" "$RESTORED_FILE"; then
+    echo "[PASS] mirror with decoupled vault matched"
+else
+    echo "[FAIL] mirror with decoupled vault mismatch" >&2
+    echo "--- source ---" >&2
+    cat "$SRC_FILE" >&2
+    echo "--- mirrored/restored ---" >&2
+    cat "$RESTORED_FILE" 2>/dev/null || echo "<none>" >&2
+    exit 1
+fi
+
+echo "[PASS] decoupled database/vault E2E tests successfully completed"

src/apps/cli/testdeno/bench-couchdb.ts

@@ -0,0 +1,312 @@
+import { TempDir } from "./helpers/temp.ts";
+import { applyRemoteSyncSettings, initSettingsFile } from "./helpers/settings.ts";
+import { assertFilesEqual, runCliOrFail } from "./helpers/cli.ts";
+import { startCouchdb, stopCouchdb } from "./helpers/docker.ts";
+import { createDeterministicDataset, type DatasetEntry } from "./helpers/dataset.ts";
+
+type BenchmarkConfig = {
+    couchdbBackendUri: string;
+    couchdbProxyUri: string;
+    couchdbUser: string;
+    couchdbPassword: string;
+    couchdbDbname: string;
+    datasetDirName: string;
+    datasetSeed: string;
+    mdFileCount: number;
+    mdMinSizeBytes: number;
+    mdMaxSizeBytes: number;
+    binFileCount: number;
+    binSizeBytes: number;
+    syncTimeoutSeconds: number;
+    requestedRttMs: number;
+    passphrase: string;
+    encrypt: boolean;
+};
+
+function readEnvString(name: string, fallback: string): string {
+    const value = Deno.env.get(name)?.trim();
+    return value && value.length > 0 ? value : fallback;
+}
+
+function readEnvNumber(name: string, fallback: number): number {
+    const raw = Deno.env.get(name);
+    if (raw === undefined || raw.trim() === "") {
+        return fallback;
+    }
+
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        throw new Error(`${name} must be a positive number, got '${raw}'`);
+    }
+    return parsed;
+}
+
+function readEnvBool(name: string, fallback: boolean): boolean {
+    const raw = Deno.env.get(name);
+    if (raw === undefined || raw.trim() === "") {
+        return fallback;
+    }
+    return /^(1|true|yes|on)$/i.test(raw.trim());
+}
+
+function nowMs(): number {
+    return performance.now();
+}
+
+function formatMs(value: number): string {
+    return `${value.toFixed(1)} ms`;
+}
+
+function formatBytes(value: number): string {
+    if (value < 1024) {
+        return `${value} B`;
+    }
+    const kib = value / 1024;
+    if (kib < 1024) {
+        return `${kib.toFixed(1)} KiB`;
+    }
+    return `${(kib / 1024).toFixed(1)} MiB`;
+}
+
+function buildConfig(): BenchmarkConfig {
+    return {
+        couchdbBackendUri: readEnvString("BENCH_COUCHDB_BACKEND_URI", "http://127.0.0.1:5989"),
+        couchdbProxyUri: readEnvString("BENCH_COUCHDB_URI", "http://127.0.0.1:15989"),
+        couchdbUser: readEnvString("BENCH_COUCHDB_USER", readEnvString("username", "admin")),
+        couchdbPassword: readEnvString("BENCH_COUCHDB_PASSWORD", readEnvString("password", "password")),
+        couchdbDbname: readEnvString("BENCH_COUCHDB_DBNAME", `bench-couchdb-${Date.now()}`),
+        datasetDirName: readEnvString("BENCH_DATASET_DIR", "bench-dataset"),
+        datasetSeed: readEnvString("BENCH_SEED", "livesync-benchmark-seed"),
+        mdFileCount: Math.floor(readEnvNumber("BENCH_MD_FILE_COUNT", 1500)),
+        mdMinSizeBytes: Math.floor(readEnvNumber("BENCH_MD_MIN_SIZE_BYTES", 1024)),
+        mdMaxSizeBytes: Math.floor(readEnvNumber("BENCH_MD_MAX_SIZE_BYTES", 20 * 1024)),
+        binFileCount: Math.floor(readEnvNumber("BENCH_BIN_FILE_COUNT", 500)),
+        binSizeBytes: Math.floor(readEnvNumber("BENCH_BIN_SIZE_BYTES", 100 * 1024)),
+        syncTimeoutSeconds: readEnvNumber("BENCH_SYNC_TIMEOUT", 240),
+        requestedRttMs: Math.floor(readEnvNumber("BENCH_COUCHDB_RTT_MS", 50)),
+        passphrase: readEnvString("BENCH_PASSPHRASE", `bench-${Date.now()}`),
+        encrypt: readEnvBool("BENCH_ENCRYPT", true),
+    };
+}
+
+function readOptionalResultPath(): string | undefined {
+    const raw = Deno.env.get("BENCH_RESULT_JSON")?.trim();
+    if (!raw) {
+        return undefined;
+    }
+    return raw;
+}
+
+function pickSampleFiles(entries: DatasetEntry[]): DatasetEntry[] {
+    if (entries.length === 0) {
+        return [];
+    }
+    const md = entries.find((e) => e.kind === "md");
+    const bin = entries.find((e) => e.kind === "bin");
+    const middle = entries[Math.floor(entries.length / 2)];
+    const last = entries[entries.length - 1];
+    const unique = new Map<string, DatasetEntry>();
+    for (const entry of [md, bin, middle, last]) {
+        if (entry) {
+            unique.set(entry.relativePath, entry);
+        }
+    }
+    return [...unique.values()];
+}
+
+type ProxyHandle = {
+    stop: () => Promise<void>;
+    applied: boolean;
+    note: string;
+};
+
+function startCouchdbProxy(options: { backendUri: string; proxyUri: string; requestedRttMs: number }): ProxyHandle {
+    const backend = new URL(options.backendUri);
+    const proxy = new URL(options.proxyUri);
+    const halfDelayMs = Math.max(1, Math.floor(options.requestedRttMs / 2));
+    const controller = new AbortController();
+
+    const listener = Deno.serve(
+        {
+            hostname: proxy.hostname,
+            port: Number(proxy.port),
+            signal: controller.signal,
+            onError(error) {
+                console.error(`[Proxy] ${String(error)}`);
+                return new Response("proxy error", { status: 502 });
+            },
+        },
+        async (request) => {
+            await new Promise((resolve) => setTimeout(resolve, halfDelayMs));
+
+            const targetUrl = new URL(request.url);
+            targetUrl.protocol = backend.protocol;
+            targetUrl.host = backend.host;
+
+            const headers = new Headers(request.headers);
+            headers.delete("host");
+            headers.delete("content-length");
+
+            let requestBody: ArrayBuffer | undefined;
+            if (request.method !== "GET" && request.method !== "HEAD") {
+                try {
+                    requestBody = await request.arrayBuffer();
+                } catch {
+                    requestBody = undefined;
+                }
+            }
+
+            const upstream = await fetch(targetUrl, {
+                method: request.method,
+                headers,
+                body: requestBody,
+                redirect: "manual",
+            });
+
+            const responseHeaders = new Headers(upstream.headers);
+            responseHeaders.delete("content-length");
+            const responseBody = await upstream.arrayBuffer();
+
+            return new Response(responseBody, {
+                status: upstream.status,
+                statusText: upstream.statusText,
+                headers: responseHeaders,
+            });
+        }
+    );
+
+    return {
+        applied: true,
+        note: `local reverse proxy on ${proxy.origin} with ${halfDelayMs}ms pre-forward delay`,
+        stop: async () => {
+            controller.abort();
+            await listener.finished.catch(() => {});
+        },
+    };
+}
+
+async function main(): Promise<void> {
+    const config = buildConfig();
+    const resultPath = readOptionalResultPath();
+
+    await using workDir = await TempDir.create("livesync-cli-couchdb-bench");
+    const vaultA = workDir.join("vault-a");
+    const vaultB = workDir.join("vault-b");
+    const settingsA = workDir.join("settings-a.json");
+    const settingsB = workDir.join("settings-b.json");
+    await Deno.mkdir(vaultA, { recursive: true });
+    await Deno.mkdir(vaultB, { recursive: true });
+
+    await initSettingsFile(settingsA);
+    await initSettingsFile(settingsB);
+
+    await startCouchdb(config.couchdbBackendUri, config.couchdbUser, config.couchdbPassword, config.couchdbDbname);
+
+    const proxy = startCouchdbProxy({
+        backendUri: config.couchdbBackendUri,
+        proxyUri: config.couchdbProxyUri,
+        requestedRttMs: config.requestedRttMs,
+    });
+
+    try {
+        await Promise.all([
+            applyRemoteSyncSettings(settingsA, {
+                remoteType: "COUCHDB",
+                couchdbUri: config.couchdbProxyUri,
+                couchdbUser: config.couchdbUser,
+                couchdbPassword: config.couchdbPassword,
+                couchdbDbname: config.couchdbDbname,
+                encrypt: config.encrypt,
+                passphrase: config.passphrase,
+            }),
+            applyRemoteSyncSettings(settingsB, {
+                remoteType: "COUCHDB",
+                couchdbUri: config.couchdbProxyUri,
+                couchdbUser: config.couchdbUser,
+                couchdbPassword: config.couchdbPassword,
+                couchdbDbname: config.couchdbDbname,
+                encrypt: config.encrypt,
+                passphrase: config.passphrase,
+            }),
+        ]);
+
+        const seedFiles = await createDeterministicDataset({
+            rootDir: vaultA,
+            datasetDirName: config.datasetDirName,
+            seed: config.datasetSeed,
+            mdCount: config.mdFileCount,
+            mdMinSizeBytes: config.mdMinSizeBytes,
+            mdMaxSizeBytes: config.mdMaxSizeBytes,
+            binCount: config.binFileCount,
+            binSizeBytes: config.binSizeBytes,
+        });
+
+        const mirrorStart = nowMs();
+        await runCliOrFail(vaultA, "--settings", settingsA, "mirror");
+        const mirrorElapsed = nowMs() - mirrorStart;
+
+        const syncAStart = nowMs();
+        await runCliOrFail(vaultA, "--settings", settingsA, "sync");
+        const syncAElapsed = nowMs() - syncAStart;
+
+        const syncBStart = nowMs();
+        await runCliOrFail(vaultB, "--settings", settingsB, "sync");
+        const syncBElapsed = nowMs() - syncBStart;
+
+        const sampleFiles = pickSampleFiles(seedFiles.entries);
+        for (const sample of sampleFiles) {
+            const pulledPath = workDir.join(`pulled-${sample.relativePath.split("/").join("_")}`);
+            await runCliOrFail(vaultB, "--settings", settingsB, "pull", sample.relativePath, pulledPath);
+            await assertFilesEqual(
+                sample.absolutePath,
+                pulledPath,
+                `sample file mismatch after CouchDB sync: ${sample.relativePath}`
+            );
+        }
+
+        const result = {
+            mode: "couchdb-cli-benchmark",
+            couchdbBackendUri: config.couchdbBackendUri,
+            couchdbProxyUri: config.couchdbProxyUri,
+            couchdbDbname: config.couchdbDbname,
+            rttRequestedMs: config.requestedRttMs,
+            proxyApplied: proxy.applied,
+            proxyNote: proxy.note,
+            datasetSeed: config.datasetSeed,
+            datasetDirName: config.datasetDirName,
+            totalFiles: seedFiles.totalFiles,
+            totalBytes: seedFiles.totalBytes,
+            mdFileCount: seedFiles.mdCount,
+            binFileCount: seedFiles.binCount,
+            mirrorElapsedMs: Number(mirrorElapsed.toFixed(1)),
+            syncAElapsedMs: Number(syncAElapsed.toFixed(1)),
+            syncBElapsedMs: Number(syncBElapsed.toFixed(1)),
+            totalSyncElapsedMs: Number((syncAElapsed + syncBElapsed).toFixed(1)),
+            throughputBytesPerSec: Number((seedFiles.totalBytes / ((syncAElapsed + syncBElapsed) / 1000)).toFixed(2)),
+            throughputMiBPerSec: Number(
+                (seedFiles.totalBytes / ((syncAElapsed + syncBElapsed) / 1000) / 1024 / 1024).toFixed(4)
+            ),
+        };
+
+        if (resultPath) {
+            await Deno.writeTextFile(resultPath, JSON.stringify(result, null, 2));
+        }
+
+        console.log(JSON.stringify(result, null, 2));
+        console.error(
+            `[Benchmark] couchdb mirrored ${seedFiles.totalFiles} files (${formatBytes(seedFiles.totalBytes)}) in ${formatMs(
+                mirrorElapsed
+            )}, synced in ${formatMs(syncAElapsed + syncBElapsed)} (${result.throughputBytesPerSec} B/s, ${result.throughputMiBPerSec} MiB/s)`
+        );
+    } finally {
+        await proxy.stop();
+        await stopCouchdb().catch(() => {});
+    }
+}
+
+if (import.meta.main) {
+    main().catch((error) => {
+        console.error(`[Fatal Error]`, error);
+        Deno.exit(1);
+    });
+}

src/apps/cli/testdeno/bench-p2p.ts

@@ -0,0 +1,223 @@
+import { TempDir } from "./helpers/temp.ts";
+import { applyP2pSettings, applyP2pTestTweaks, initSettingsFile } from "./helpers/settings.ts";
+import { startCliInBackground } from "./helpers/backgroundCli.ts";
+import { discoverPeer, maybeStartLocalRelay, stopLocalRelayIfStarted } from "./helpers/p2p.ts";
+import { assertFilesEqual, runCliOrFail } from "./helpers/cli.ts";
+import { createDeterministicDataset, type DatasetEntry } from "./helpers/dataset.ts";
+
+type BenchmarkConfig = {
+    relay: string;
+    appId: string;
+    roomId: string;
+    passphrase: string;
+    datasetDirName: string;
+    datasetSeed: string;
+    mdFileCount: number;
+    mdMinSizeBytes: number;
+    mdMaxSizeBytes: number;
+    binFileCount: number;
+    binSizeBytes: number;
+    peersTimeoutSeconds: number;
+    syncTimeoutSeconds: number;
+};
+
+function readEnvString(name: string, fallback: string): string {
+    const value = Deno.env.get(name)?.trim();
+    return value && value.length > 0 ? value : fallback;
+}
+
+function readEnvNumber(name: string, fallback: number): number {
+    const raw = Deno.env.get(name);
+    if (raw === undefined || raw.trim() === "") {
+        return fallback;
+    }
+
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        throw new Error(`${name} must be a positive number, got '${raw}'`);
+    }
+    return parsed;
+}
+
+function nowMs(): number {
+    return performance.now();
+}
+
+function formatMs(value: number): string {
+    return `${value.toFixed(1)} ms`;
+}
+
+function formatBytes(value: number): string {
+    if (value < 1024) {
+        return `${value} B`;
+    }
+    const kib = value / 1024;
+    if (kib < 1024) {
+        return `${kib.toFixed(1)} KiB`;
+    }
+    const mib = kib / 1024;
+    return `${mib.toFixed(1)} MiB`;
+}
+
+function buildConfig(): BenchmarkConfig {
+    return {
+        relay: readEnvString("BENCH_RELAY", "ws://localhost:4000/"),
+        appId: readEnvString("BENCH_APP_ID", "self-hosted-livesync-cli-benchmark"),
+        roomId: readEnvString("BENCH_ROOM_ID", `bench-room-${Date.now()}`),
+        passphrase: readEnvString("BENCH_PASSPHRASE", `bench-${Date.now()}`),
+        datasetDirName: readEnvString("BENCH_DATASET_DIR", "bench-dataset"),
+        datasetSeed: readEnvString("BENCH_SEED", "livesync-benchmark-seed"),
+        mdFileCount: Math.floor(readEnvNumber("BENCH_MD_FILE_COUNT", 1500)),
+        mdMinSizeBytes: Math.floor(readEnvNumber("BENCH_MD_MIN_SIZE_BYTES", 1024)),
+        mdMaxSizeBytes: Math.floor(readEnvNumber("BENCH_MD_MAX_SIZE_BYTES", 20 * 1024)),
+        binFileCount: Math.floor(readEnvNumber("BENCH_BIN_FILE_COUNT", 500)),
+        binSizeBytes: Math.floor(readEnvNumber("BENCH_BIN_SIZE_BYTES", 100 * 1024)),
+        peersTimeoutSeconds: readEnvNumber("BENCH_PEERS_TIMEOUT", 20),
+        syncTimeoutSeconds: readEnvNumber("BENCH_SYNC_TIMEOUT", 240),
+    };
+}
+
+function readOptionalResultPath(): string | undefined {
+    const raw = Deno.env.get("BENCH_RESULT_JSON")?.trim();
+    if (!raw) {
+        return undefined;
+    }
+    return raw;
+}
+
+function pickSampleFiles(entries: DatasetEntry[]): DatasetEntry[] {
+    if (entries.length === 0) {
+        return [];
+    }
+    const md = entries.find((e) => e.kind === "md");
+    const bin = entries.find((e) => e.kind === "bin");
+    const middle = entries[Math.floor(entries.length / 2)];
+    const last = entries[entries.length - 1];
+    const unique = new Map<string, DatasetEntry>();
+    for (const entry of [md, bin, middle, last]) {
+        if (entry) {
+            unique.set(entry.relativePath, entry);
+        }
+    }
+    return [...unique.values()];
+}
+
+async function main(): Promise<void> {
+    const config = buildConfig();
+    const resultPath = readOptionalResultPath();
+
+    const relayStarted = await maybeStartLocalRelay(config.relay);
+    await using workDir = await TempDir.create("livesync-cli-p2p-bench");
+
+    const hostVault = workDir.join("vault-host");
+    const clientVault = workDir.join("vault-client");
+    const hostSettings = workDir.join("settings-host.json");
+    const clientSettings = workDir.join("settings-client.json");
+
+    await Promise.all([
+        Deno.mkdir(hostVault, { recursive: true }),
+        Deno.mkdir(clientVault, { recursive: true }),
+        initSettingsFile(hostSettings),
+        initSettingsFile(clientSettings),
+    ]);
+
+    await Promise.all([
+        applyP2pSettings(hostSettings, config.roomId, config.passphrase, config.appId, config.relay, "~.*"),
+        applyP2pSettings(clientSettings, config.roomId, config.passphrase, config.appId, config.relay, "~.*"),
+    ]);
+
+    await Promise.all([
+        applyP2pTestTweaks(hostSettings, "p2p-bench-host", config.passphrase),
+        applyP2pTestTweaks(clientSettings, "p2p-bench-client", config.passphrase),
+    ]);
+
+    const seedFiles = await createDeterministicDataset({
+        rootDir: hostVault,
+        datasetDirName: config.datasetDirName,
+        seed: config.datasetSeed,
+        mdCount: config.mdFileCount,
+        mdMinSizeBytes: config.mdMinSizeBytes,
+        mdMaxSizeBytes: config.mdMaxSizeBytes,
+        binCount: config.binFileCount,
+        binSizeBytes: config.binSizeBytes,
+    });
+
+    const mirrorStart = nowMs();
+    await runCliOrFail(hostVault, "--settings", hostSettings, "mirror");
+    const mirrorElapsed = nowMs() - mirrorStart;
+
+    const host = startCliInBackground(hostVault, "--settings", hostSettings, "p2p-host");
+    try {
+        const hostReadyStart = nowMs();
+        await host.waitUntilContains("P2P host is running", 20000);
+        const hostReadyElapsed = nowMs() - hostReadyStart;
+
+        const peerDiscoveryStart = nowMs();
+        const peer = await discoverPeer(clientVault, clientSettings, config.peersTimeoutSeconds);
+        const peerDiscoveryElapsed = nowMs() - peerDiscoveryStart;
+
+        const syncStart = nowMs();
+        await runCliOrFail(
+            clientVault,
+            "--settings",
+            clientSettings,
+            "p2p-sync",
+            peer.id,
+            String(config.syncTimeoutSeconds)
+        );
+        const syncElapsed = nowMs() - syncStart;
+
+        const sampleFiles = pickSampleFiles(seedFiles.entries);
+        for (const sample of sampleFiles) {
+            const pulledPath = workDir.join(`pulled-${sample.relativePath.replaceAll("/", "_")}`);
+            await runCliOrFail(clientVault, "--settings", clientSettings, "pull", sample.relativePath, pulledPath);
+            await assertFilesEqual(
+                sample.absolutePath,
+                pulledPath,
+                `sample file mismatch after sync: ${sample.relativePath}`
+            );
+        }
+
+        const result = {
+            mode: "p2p-cli-benchmark",
+            relay: config.relay,
+            appId: config.appId,
+            roomId: config.roomId,
+            datasetSeed: config.datasetSeed,
+            datasetDirName: config.datasetDirName,
+            peerId: peer.id,
+            peerName: peer.name,
+            totalFiles: seedFiles.totalFiles,
+            totalBytes: seedFiles.totalBytes,
+            mdFileCount: seedFiles.mdCount,
+            binFileCount: seedFiles.binCount,
+            mirrorElapsedMs: Number(mirrorElapsed.toFixed(1)),
+            hostReadyElapsedMs: Number(hostReadyElapsed.toFixed(1)),
+            peerDiscoveryElapsedMs: Number(peerDiscoveryElapsed.toFixed(1)),
+            syncElapsedMs: Number(syncElapsed.toFixed(1)),
+            throughputBytesPerSec: Number((seedFiles.totalBytes / (syncElapsed / 1000)).toFixed(2)),
+            throughputMiBPerSec: Number((seedFiles.totalBytes / (syncElapsed / 1000) / 1024 / 1024).toFixed(4)),
+        };
+
+        if (resultPath) {
+            await Deno.writeTextFile(resultPath, JSON.stringify(result, null, 2));
+        }
+
+        console.log(JSON.stringify(result, null, 2));
+        console.error(
+            `[Benchmark] mirrored ${seedFiles.totalFiles} files (${formatBytes(seedFiles.totalBytes)}) in ${formatMs(mirrorElapsed)}, ` +
+                `synced in ${formatMs(syncElapsed)} ` +
+                `(${result.throughputBytesPerSec} B/s, ${result.throughputMiBPerSec} MiB/s)`
+        );
+    } finally {
+        await host.stop();
+        await stopLocalRelayIfStarted(relayStarted);
+    }
+}
+
+if (import.meta.main) {
+    main().catch((error) => {
+        console.error(`[Fatal Error]`, error);
+        Deno.exit(1);
+    });
+}

src/apps/cli/testdeno/bench-run-item1.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+RESULTS_ROOT="${SCRIPT_DIR}/bench-results"
+TIMESTAMP="$(date +%Y%m%d-%H%M%S)"
+OUT_DIR="${RESULTS_ROOT}/${TIMESTAMP}"
+
+mkdir -p "${OUT_DIR}"
+
+echo "[bench-wrapper] output directory: ${OUT_DIR}"
+
+echo "[bench-wrapper] running p2p benchmark"
+(
+  cd "${SCRIPT_DIR}"
+  BENCH_RESULT_JSON="${OUT_DIR}/p2p.json" deno task bench:p2p
+)
+
+echo "[bench-wrapper] running couchdb benchmark with RTT ${BENCH_COUCHDB_RTT_MS:-default} ms (emulating HTTP network latency)"
+(
+  cd "${SCRIPT_DIR}"
+  BENCH_RESULT_JSON="${OUT_DIR}/couchdb.json" deno task bench:couchdb
+)
+
+cat > "${OUT_DIR}/README.txt" <<EOF
+Bench wrapper result set
+
+Generated at: ${TIMESTAMP}
+Directory: ${OUT_DIR}
+
+Files:
+- p2p.json
+- couchdb.json
+EOF
+
+echo "[bench-wrapper] verify outputs by cat"
+echo "========== ${OUT_DIR}/README.txt =========="
+cat "${OUT_DIR}/README.txt"
+echo "========== ${OUT_DIR}/p2p.json =========="
+cat "${OUT_DIR}/p2p.json"
+echo "========== ${OUT_DIR}/couchdb.json =========="
+cat "${OUT_DIR}/couchdb.json"
+
+echo "[bench-wrapper] done"
+echo "[bench-wrapper] result directory: ${OUT_DIR}"

src/apps/cli/testdeno/deno.json

@@ -1,7 +1,10 @@
 {
     "tasks": {
         "test": "deno test --env-file=.test.env -A --no-check test-*.ts",
-        "test:local": "deno test --env-file=.test.env -A --no-check test-setup-put-cat.ts test-mirror.ts",
+        "test:local": "deno test --env-file=.test.env -A --no-check test-setup-put-cat.ts test-mirror.ts test-daemon.ts",
+        "test:daemon": "deno test --env-file=.test.env -A --no-check test-daemon.ts",
+        "test:decoupled-vault": "deno test --env-file=.test.env -A --no-check test-decoupled-vault.ts",
+        "test:remote-commands": "deno test --env-file=.test.env -A --no-check test-remote-commands.ts",
         "test:push-pull": "deno test --env-file=.test.env -A --no-check test-push-pull.ts",
         "test:setup-put-cat": "deno test --env-file=.test.env -A --no-check test-setup-put-cat.ts",
         "test:mirror": "deno test --env-file=.test.env -A --no-check test-mirror.ts",
@@ -12,8 +15,16 @@
         "test:p2p-sync": "deno test --env-file=.test.env -A --no-check test-p2p-sync.ts",
         "test:p2p-three-nodes": "deno test --env-file=.test.env -A --no-check test-p2p-three-nodes-conflict.ts",
         "test:p2p-upload-download": "deno test --env-file=.test.env -A --no-check test-p2p-upload-download-repro.ts",
+        "bench:p2p": "deno run --env-file=.test.env -A --no-check bench-p2p.ts",
+        "bench:couchdb": "deno run --env-file=.test.env -A --no-check bench-couchdb.ts",
+        "bench:item1": "bash ./bench-run-item1.sh",
+        "bench:item1:full": "BENCH_MD_FILE_COUNT=1500 BENCH_MD_MIN_SIZE_BYTES=1024 BENCH_MD_MAX_SIZE_BYTES=20480 BENCH_BIN_FILE_COUNT=500 BENCH_BIN_SIZE_BYTES=102400 BENCH_COUCHDB_RTT_MS=50 bash ./bench-run-item1.sh",
         "test:e2e-couchdb": "deno test --env-file=.test.env -A --no-check test-e2e-two-vaults-couchdb.ts",
-        "test:e2e-matrix": "deno test --env-file=.test.env -A --no-check test-e2e-two-vaults-matrix.ts"
+        "test:e2e-matrix": "deno test --env-file=.test.env -A --no-check test-e2e-two-vaults-matrix.ts",
+        "test:e2e-matrix:couchdb-enc0": "deno test --env-file=.test.env -A --no-check --filter='e2e matrix: COUCHDB-enc0' test-e2e-two-vaults-matrix.ts",
+        "test:e2e-matrix:couchdb-enc1": "deno test --env-file=.test.env -A --no-check --filter='e2e matrix: COUCHDB-enc1' test-e2e-two-vaults-matrix.ts",
+        "test:e2e-matrix:minio-enc0": "deno test --env-file=.test.env -A --no-check --filter='e2e matrix: MINIO-enc0' test-e2e-two-vaults-matrix.ts",
+        "test:e2e-matrix:minio-enc1": "deno test --env-file=.test.env -A --no-check --filter='e2e matrix: MINIO-enc1' test-e2e-two-vaults-matrix.ts"
     },
     "imports": {
         "@std/assert": "jsr:@std/assert@^1.0.13",

src/apps/cli/testdeno/helpers/backgroundCli.ts

@@ -1,4 +1,4 @@
-import { CLI_DIR } from "./cli.ts";
+import { CLI_DIR, TEE_ENABLED, formatTeeCommand, createLineTeeWriter } from "./cli.ts";
 import { join } from "@std/path";
 
 const CLI_DIST = join(CLI_DIR, "dist", "index.cjs");
@@ -12,10 +12,9 @@ function decorateArgs(args: string[]): string[] {
 async function pump(
     stream: ReadableStream<Uint8Array>,
     sink: (text: string) => void,
-    teeTarget: WritableStream<Uint8Array> | null
+    teeTarget: { write: (chunk: Uint8Array) => void; close: () => void } | null
 ): Promise<void> {
     const reader = stream.getReader();
-    const writer = teeTarget?.getWriter();
     const dec = new TextDecoder();
     try {
         while (true) {
@@ -23,12 +22,12 @@ async function pump(
             if (done) break;
             if (!value) continue;
             sink(dec.decode(value, { stream: true }));
-            if (writer) {
-                await writer.write(value);
+            if (teeTarget) {
+                teeTarget.write(value);
             }
         }
     } finally {
-        if (writer) writer.releaseLock();
+        if (teeTarget) teeTarget.close();
         reader.releaseLock();
     }
 }
@@ -43,19 +42,20 @@ export class BackgroundCliProcess {
         readonly child: Deno.ChildProcess,
         readonly args: string[]
     ) {
+        const cliArgs = decorateArgs(args);
         this.#stdoutDone = pump(
             child.stdout,
             (text) => {
                 this.#stdout += text;
             },
-            null
+            TEE_ENABLED ? createLineTeeWriter(child.pid, "stdout", (chunk) => Deno.stdout.writeSync(chunk)) : null
         );
         this.#stderrDone = pump(
             child.stderr,
             (text) => {
                 this.#stderr += text;
             },
-            null
+            TEE_ENABLED ? createLineTeeWriter(child.pid, "stderr", (chunk) => Deno.stderr.writeSync(chunk)) : null
         );
     }
 
@@ -101,12 +101,20 @@ export class BackgroundCliProcess {
 }
 
 export function startCliInBackground(...args: string[]): BackgroundCliProcess {
+    const cliArgs = decorateArgs(args);
     const child = new Deno.Command("node", {
-        args: [CLI_DIST, ...decorateArgs(args)],
+        args: [CLI_DIST, ...cliArgs],
         cwd: CLI_DIR,
         stdin: "null",
         stdout: "piped",
         stderr: "piped",
     }).spawn();
+
+    if (TEE_ENABLED) {
+        Deno.stdout.writeSync(
+            new TextEncoder().encode(`[CLI tee pid=${child.pid}] process(bg): ${formatTeeCommand(cliArgs)}\n`)
+        );
+    }
+
     return new BackgroundCliProcess(child, args);
 }

src/apps/cli/testdeno/helpers/cli.ts

@@ -20,7 +20,7 @@ export interface CliResult {
     code: number;
 }
 
-const TEE_ENABLED = Deno.env.get("LIVESYNC_TEST_TEE") === "1";
+export const TEE_ENABLED = Deno.env.get("LIVESYNC_TEST_TEE") === "1";
 const VERBOSE_ENABLED = Deno.env.get("LIVESYNC_CLI_VERBOSE") === "1";
 const DEBUG_ENABLED = Deno.env.get("LIVESYNC_CLI_DEBUG") === "1";
 
@@ -39,27 +39,73 @@ function concatChunks(chunks: Uint8Array[]): Uint8Array {
     return out;
 }
 
+export function formatTeeCommand(args: string[]): string {
+    return ["node", CLI_DIST, ...args].map((part) => JSON.stringify(part)).join(" ");
+}
+
+export function createLineTeeWriter(
+    pid: number,
+    streamName: "stdout" | "stderr",
+    writer: (chunk: Uint8Array) => void
+): { write: (chunk: Uint8Array) => void; close: () => void } {
+    const enc = new TextEncoder();
+    const dec = new TextDecoder();
+    let pending = "";
+    let headerWritten = false;
+    const emitLine = (line: string) => {
+        if (!headerWritten) {
+            writer(enc.encode(`[CLI tee pid=${pid}:${streamName}]\n`));
+            headerWritten = true;
+        }
+        writer(enc.encode(`[CLI tee pid=${pid}:${streamName}] ${line}\n`));
+    };
+
+    const flush = (final = false) => {
+        let index = pending.indexOf("\n");
+        while (index >= 0) {
+            const line = pending.slice(0, index).replace(/\r$/, "");
+            pending = pending.slice(index + 1);
+            emitLine(line);
+            index = pending.indexOf("\n");
+        }
+        if (final && pending.length > 0) {
+            emitLine(pending.replace(/\r$/, ""));
+            pending = "";
+        }
+    };
+
+    return {
+        write(chunk: Uint8Array) {
+            pending += dec.decode(chunk, { stream: true });
+            flush(false);
+        },
+        close() {
+            pending += dec.decode();
+            flush(true);
+        },
+    };
+}
+
 async function collectStream(
     stream: ReadableStream<Uint8Array>,
-    teeTarget: WritableStream<Uint8Array> | null
+    teeTarget: { write: (chunk: Uint8Array) => void; close: () => void } | null
 ): Promise<Uint8Array> {
     const reader = stream.getReader();
     const chunks: Uint8Array[] = [];
-    const writer = teeTarget?.getWriter();
     try {
         while (true) {
             const { done, value } = await reader.read();
             if (done) break;
             if (value) {
                 chunks.push(value);
-                if (writer) {
-                    await writer.write(value);
+                if (teeTarget) {
+                    teeTarget.write(value);
                 }
             }
         }
     } finally {
-        if (writer) {
-            writer.releaseLock();
+        if (teeTarget) {
+            teeTarget.close();
         }
         reader.releaseLock();
     }
@@ -76,8 +122,20 @@ async function runNodeCommand(args: string[], stdinData?: Uint8Array): Promise<C
         stderr: "piped",
     }).spawn();
 
-    const stdoutPromise = collectStream(child.stdout, TEE_ENABLED ? Deno.stdout.writable : null);
-    const stderrPromise = collectStream(child.stderr, TEE_ENABLED ? Deno.stderr.writable : null);
+    if (TEE_ENABLED) {
+        Deno.stdout.writeSync(
+            new TextEncoder().encode(`[CLI tee pid=${child.pid}] process: ${formatTeeCommand(cliArgs)}\n`)
+        );
+    }
+
+    const stdoutPromise = collectStream(
+        child.stdout,
+        TEE_ENABLED ? createLineTeeWriter(child.pid, "stdout", (chunk) => Deno.stdout.writeSync(chunk)) : null
+    );
+    const stderrPromise = collectStream(
+        child.stderr,
+        TEE_ENABLED ? createLineTeeWriter(child.pid, "stderr", (chunk) => Deno.stderr.writeSync(chunk)) : null
+    );
 
     if (stdinData) {
         const w = child.stdin.getWriter();

src/apps/cli/testdeno/helpers/dataset.ts

@@ -0,0 +1,123 @@
+export type DeterministicDatasetConfig = {
+    rootDir: string;
+    datasetDirName: string;
+    seed: string;
+    mdCount: number;
+    mdMinSizeBytes: number;
+    mdMaxSizeBytes: number;
+    binCount: number;
+    binSizeBytes: number;
+};
+
+export type DatasetEntry = {
+    kind: "md" | "bin";
+    relativePath: string;
+    absolutePath: string;
+    size: number;
+};
+
+export type DeterministicDataset = {
+    rootDir: string;
+    datasetDirName: string;
+    seed: string;
+    entries: DatasetEntry[];
+    totalFiles: number;
+    totalBytes: number;
+    mdCount: number;
+    binCount: number;
+};
+
+function fnv1a32(input: string): number {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < input.length; i++) {
+        hash ^= input.charCodeAt(i) & 0xff;
+        hash = Math.imul(hash, 0x01000193);
+    }
+    return hash >>> 0;
+}
+
+function createXorshift32(seed: number): () => number {
+    let state = seed >>> 0;
+    if (state === 0) {
+        state = 0x9e3779b9;
+    }
+    return () => {
+        state ^= state << 13;
+        state ^= state >>> 17;
+        state ^= state << 5;
+        return state >>> 0;
+    };
+}
+
+function createTextBytes(size: number, fileIndex: number, seed: string): Uint8Array {
+    const template =
+        `# Bench file ${fileIndex}\n` +
+        `seed: ${seed}\n` +
+        "lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.\n";
+
+    const templateBytes = new TextEncoder().encode(template);
+    const out = new Uint8Array(size);
+    for (let i = 0; i < size; i++) {
+        out[i] = templateBytes[i % templateBytes.length];
+    }
+    return out;
+}
+
+function toPath(rootDir: string, relativePath: string): string {
+    return `${rootDir}/${relativePath}`;
+}
+
+export async function createDeterministicDataset(config: DeterministicDatasetConfig): Promise<DeterministicDataset> {
+    if (config.mdCount < 0 || config.binCount < 0) {
+        throw new Error("mdCount and binCount must be non-negative");
+    }
+    if (config.mdMinSizeBytes <= 0 || config.mdMaxSizeBytes <= 0 || config.binSizeBytes <= 0) {
+        throw new Error("all size values must be positive");
+    }
+    if (config.mdMinSizeBytes > config.mdMaxSizeBytes) {
+        throw new Error("mdMinSizeBytes must be <= mdMaxSizeBytes");
+    }
+
+    const datasetRoot = toPath(config.rootDir, config.datasetDirName);
+    const mdDir = `${datasetRoot}/md`;
+    const binDir = `${datasetRoot}/bin`;
+    await Deno.mkdir(mdDir, { recursive: true });
+    await Deno.mkdir(binDir, { recursive: true });
+
+    const nextRandom = createXorshift32(fnv1a32(config.seed));
+    const mdRange = config.mdMaxSizeBytes - config.mdMinSizeBytes + 1;
+    const entries: DatasetEntry[] = [];
+
+    for (let index = 0; index < config.mdCount; index++) {
+        const size = config.mdMinSizeBytes + (nextRandom() % mdRange);
+        const relativePath = `${config.datasetDirName}/md/file-${String(index).padStart(4, "0")}.md`;
+        const absolutePath = toPath(config.rootDir, relativePath);
+        const body = createTextBytes(size, index, config.seed);
+        await Deno.writeFile(absolutePath, body);
+        entries.push({ kind: "md", relativePath, absolutePath, size });
+    }
+
+    for (let index = 0; index < config.binCount; index++) {
+        const size = config.binSizeBytes;
+        const relativePath = `${config.datasetDirName}/bin/file-${String(index).padStart(4, "0")}.bin`;
+        const absolutePath = toPath(config.rootDir, relativePath);
+        const body = new Uint8Array(size);
+        for (let i = 0; i < size; i++) {
+            body[i] = nextRandom() & 0xff;
+        }
+        await Deno.writeFile(absolutePath, body);
+        entries.push({ kind: "bin", relativePath, absolutePath, size });
+    }
+
+    const totalBytes = entries.reduce((sum, e) => sum + e.size, 0);
+    return {
+        rootDir: config.rootDir,
+        datasetDirName: config.datasetDirName,
+        seed: config.seed,
+        entries,
+        totalFiles: entries.length,
+        totalBytes,
+        mdCount: config.mdCount,
+        binCount: config.binCount,
+    };
+}

src/apps/cli/testdeno/helpers/docker.ts

@@ -14,6 +14,11 @@ type DockerInvoker = {
 
 let dockerInvokerPromise: Promise<DockerInvoker> | null = null;
 const DOCKER_TEE = Deno.env.get("LIVESYNC_DOCKER_TEE") === "1" || Deno.env.get("LIVESYNC_TEST_TEE") === "1";
+const trackedContainers = new Set<string>();
+const CLEANUP_SIGNALS: Deno.Signal[] = ["SIGINT", "SIGTERM"];
+let signalCleanupHandlersInstalled = false;
+let signalCleanupInProgress = false;
+const signalCleanupHandlers = new Map<Deno.Signal, () => void>();
 
 // ---------------------------------------------------------------------------
 // Low-level docker wrapper
@@ -27,29 +32,53 @@ function parseCommand(command: string): { bin: string; prefix: string[] } {
     return { bin: parts[0], prefix: parts.slice(1) };
 }
 
-async function runCommand(bin: string, args: string[]): Promise<{ code: number; stdout: string; stderr: string }> {
-    const cmd = new Deno.Command(bin, {
-        args,
-        stdin: "null",
-        stdout: "piped",
-        stderr: "piped",
-    });
+async function collectStream(
+    stream: ReadableStream<Uint8Array>,
+    teeTarget: ((chunk: Uint8Array) => void) | null
+): Promise<Uint8Array> {
+    const reader = stream.getReader();
+    const chunks: Uint8Array[] = [];
     try {
-        const { code, stdout, stderr } = await cmd.output();
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            if (!value) continue;
+            chunks.push(value);
+            if (teeTarget) {
+                teeTarget(value);
+            }
+        }
+    } finally {
+        reader.releaseLock();
+    }
+
+    const total = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return out;
+}
+
+async function runCommand(bin: string, args: string[]): Promise<{ code: number; stdout: string; stderr: string }> {
+    try {
+        const child = new Deno.Command(bin, {
+            args,
+            stdin: "null",
+            stdout: "piped",
+            stderr: "piped",
+        }).spawn();
+        const stdoutPromise = collectStream(child.stdout, DOCKER_TEE ? (chunk) => Deno.stdout.writeSync(chunk) : null);
+        const stderrPromise = collectStream(child.stderr, DOCKER_TEE ? (chunk) => Deno.stderr.writeSync(chunk) : null);
+        const [status, stdout, stderr] = await Promise.all([child.status, stdoutPromise, stderrPromise]);
         const dec = new TextDecoder();
         const result = {
-            code,
+            code: status.code,
             stdout: dec.decode(stdout),
             stderr: dec.decode(stderr),
         };
-        if (DOCKER_TEE) {
-            if (result.stdout.trim().length > 0) {
-                console.log(`[docker:${bin}] ${result.stdout.trimEnd()}`);
-            }
-            if (result.stderr.trim().length > 0) {
-                console.error(`[docker:${bin}] ${result.stderr.trimEnd()}`);
-            }
-        }
         return result;
     } catch (err) {
         if (err instanceof Deno.errors.NotFound) {
@@ -159,6 +188,73 @@ async function dockerOrFail(...args: string[]): Promise<string> {
     return r.stdout;
 }
 
+async function stopAndRemoveContainer(container: string): Promise<void> {
+    await docker("stop", container).catch(() => {});
+    await docker("rm", container).catch(() => {});
+}
+
+async function cleanupTrackedContainers(reason: string): Promise<void> {
+    const names = [...trackedContainers];
+    if (names.length === 0) return;
+
+    console.warn(`[WARN] cleaning up tracked containers on ${reason}: ${names.join(", ")}`);
+    for (const container of names.reverse()) {
+        await stopAndRemoveContainer(container);
+        trackedContainers.delete(container);
+    }
+}
+
+async function handleSignalCleanup(signal: Deno.Signal): Promise<void> {
+    if (signalCleanupInProgress) return;
+    signalCleanupInProgress = true;
+    try {
+        await cleanupTrackedContainers(`signal ${signal}`);
+    } finally {
+        Deno.exit(signal === "SIGINT" ? 130 : 143);
+    }
+}
+
+function ensureSignalCleanupHandlers(): void {
+    if (signalCleanupHandlersInstalled) return;
+    signalCleanupHandlersInstalled = true;
+    for (const signal of CLEANUP_SIGNALS) {
+        const listener = () => {
+            void handleSignalCleanup(signal);
+        };
+        try {
+            Deno.addSignalListener(signal, listener);
+            signalCleanupHandlers.set(signal, listener);
+        } catch {
+            // Unsupported signal on this platform.
+        }
+    }
+}
+
+function removeSignalCleanupHandlers(): void {
+    if (!signalCleanupHandlersInstalled) return;
+    for (const [signal, listener] of signalCleanupHandlers) {
+        try {
+            Deno.removeSignalListener(signal, listener);
+        } catch {
+            // Ignore if already removed or unsupported.
+        }
+    }
+    signalCleanupHandlers.clear();
+    signalCleanupHandlersInstalled = false;
+}
+
+function trackContainer(container: string): void {
+    ensureSignalCleanupHandlers();
+    trackedContainers.add(container);
+}
+
+function untrackContainer(container: string): void {
+    trackedContainers.delete(container);
+    if (trackedContainers.size === 0) {
+        removeSignalCleanupHandlers();
+    }
+}
+
 function sleep(ms: number): Promise<void> {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -235,8 +331,8 @@ const MINIO_IMAGE = "minio/minio";
 const MINIO_MC_IMAGE = "minio/mc";
 
 export async function stopCouchdb(): Promise<void> {
-    await docker("stop", COUCHDB_CONTAINER);
-    await docker("rm", COUCHDB_CONTAINER);
+    await stopAndRemoveContainer(COUCHDB_CONTAINER);
+    untrackContainer(COUCHDB_CONTAINER);
 }
 
 /**
@@ -265,6 +361,7 @@ export async function startCouchdb(couchdbUri: string, user: string, password: s
         "COUCHDB_SINGLE_NODE=y",
         COUCHDB_IMAGE
     );
+    trackContainer(COUCHDB_CONTAINER);
 
     console.log("[INFO] initialising CouchDB");
     await initCouchdb(couchdbUri, user, password);
@@ -365,8 +462,8 @@ function shQuote(value: string): string {
 }
 
 export async function stopMinio(): Promise<void> {
-    await docker("stop", MINIO_CONTAINER);
-    await docker("rm", MINIO_CONTAINER);
+    await stopAndRemoveContainer(MINIO_CONTAINER);
+    untrackContainer(MINIO_CONTAINER);
 }
 
 async function initMinioBucket(
@@ -446,6 +543,7 @@ export async function startMinio(
         "--console-address",
         ":9001"
     );
+    trackContainer(MINIO_CONTAINER);
 
     console.log(`[INFO] initialising MinIO test bucket: ${bucket}`);
     let initialised = false;
@@ -493,8 +591,8 @@ EOF
 exec /app/strfry --config /tmp/strfry.conf relay`;
 
 export async function stopP2pRelay(): Promise<void> {
-    await docker("stop", P2P_RELAY_CONTAINER);
-    await docker("rm", P2P_RELAY_CONTAINER);
+    await stopAndRemoveContainer(P2P_RELAY_CONTAINER);
+    untrackContainer(P2P_RELAY_CONTAINER);
 }
 
 /**
@@ -523,8 +621,51 @@ export async function startP2pRelay(): Promise<void> {
         "-lc",
         STRFRY_BOOTSTRAP_SH
     );
+    trackContainer(P2P_RELAY_CONTAINER);
 }
 
 export function isLocalP2pRelay(relayUrl: string): boolean {
-    return relayUrl === "ws://localhost:4000" || relayUrl === "ws://localhost:4000/";
+    return relayUrl.includes("localhost") || relayUrl.includes("127.0.0.1") || relayUrl.includes("[::1]");
+}
+
+// ---------------------------------------------------------------------------
+// Coturn (STUN/TURN)
+// ---------------------------------------------------------------------------
+const COTURN_CONTAINER = "coturn-test";
+const COTURN_IMAGE = "coturn/coturn:latest";
+
+export async function stopCoturn(): Promise<void> {
+    await stopAndRemoveContainer(COTURN_CONTAINER);
+    untrackContainer(COTURN_CONTAINER);
+}
+
+export async function startCoturn(
+    port = 3478,
+    user = "testuser",
+    pass = "testpass",
+    realm = "livesync.test"
+): Promise<void> {
+    console.log("[INFO] stopping leftover Coturn container if present");
+    await stopCoturn().catch(() => {});
+
+    const { getOptimalLoopbackIp } = await import("./net.ts");
+    const externalIp = await getOptimalLoopbackIp();
+
+    console.log(`[INFO] starting local Coturn container with external-ip ${externalIp}`);
+    await dockerOrFail(
+        "run",
+        "-d",
+        "--name",
+        COTURN_CONTAINER,
+        "-p",
+        `${port}:${port}`,
+        "-p",
+        `${port}:${port}/udp`,
+        COTURN_IMAGE,
+        "--log-file=stdout",
+        `--external-ip=${externalIp}`,
+        `--user=${user}:${pass}`,
+        `--realm=${realm}`
+    );
+    trackContainer(COTURN_CONTAINER);
 }

src/apps/cli/testdeno/helpers/net.ts

@@ -0,0 +1,68 @@
+type WaitForPortOptions = {
+    timeoutMs?: number;
+    intervalMs?: number;
+    connectTimeoutMs?: number;
+};
+
+function sleep(ms: number): Promise<void> {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function connectWithTimeout(hostname: string, port: number, timeoutMs: number): Promise<void> {
+    let timer: number | undefined;
+    try {
+        const connPromise = Deno.connect({ hostname, port });
+        const timeoutPromise = new Promise<never>((_, reject) => {
+            timer = setTimeout(() => reject(new Error(`connect timeout after ${timeoutMs}ms`)), timeoutMs);
+        });
+        const conn = await Promise.race([connPromise, timeoutPromise]);
+        conn.close();
+    } finally {
+        if (timer !== undefined) {
+            clearTimeout(timer);
+        }
+    }
+}
+
+export async function waitForPort(hostname: string, port: number, options: WaitForPortOptions = {}): Promise<void> {
+    const timeoutMs = options.timeoutMs ?? 15000;
+    const intervalMs = options.intervalMs ?? 250;
+    const connectTimeoutMs = options.connectTimeoutMs ?? 1000;
+
+    const started = Date.now();
+    let lastError: unknown;
+
+    while (Date.now() - started < timeoutMs) {
+        try {
+            await connectWithTimeout(hostname, port, connectTimeoutMs);
+            return;
+        } catch (error) {
+            lastError = error;
+            await sleep(intervalMs);
+        }
+    }
+
+    throw new Error(
+        `Port ${hostname}:${port} did not become ready within ${timeoutMs}ms` +
+            (lastError ? ` (last error: ${String(lastError)})` : "")
+    );
+}
+
+export async function getOptimalLoopbackIp(): Promise<string> {
+    const ipv4 = "127.0.0.1";
+    const ipv6 = "::1";
+
+    try {
+        const l = Deno.listen({ hostname: ipv4, port: 0 });
+        l.close();
+        return ipv4;
+    } catch {
+        try {
+            const l = Deno.listen({ hostname: ipv6, port: 0 });
+            l.close();
+            return ipv6;
+        } catch {
+            return ipv4; // fallback to default
+        }
+    }
+}

src/apps/cli/testdeno/helpers/p2p.ts

@@ -1,11 +1,26 @@
 import { runCli } from "./cli.ts";
-import { isLocalP2pRelay, startP2pRelay, stopP2pRelay } from "./docker.ts";
+import { isLocalP2pRelay, startP2pRelay, stopP2pRelay, startCoturn, stopCoturn } from "./docker.ts";
+import { waitForPort } from "./net.ts";
 
 export type PeerEntry = {
     id: string;
     name: string;
 };
 
+function sleep(ms: number): Promise<void> {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function parseRelayEndpoint(relay: string): { hostname: string; port: number } {
+    const url = new URL(relay);
+    const port = url.port ? Number(url.port) : url.protocol === "ws:" ? 80 : url.protocol === "wss:" ? 443 : NaN;
+    if (!Number.isFinite(port)) {
+        throw new Error(`Unsupported relay URL: ${relay}`);
+    }
+    const hostname = url.hostname === "localhost" ? "127.0.0.1" : url.hostname;
+    return { hostname, port };
+}
+
 export function parsePeerLines(output: string): PeerEntry[] {
     return output
         .split(/\r?\n/)
@@ -20,28 +35,58 @@ export async function discoverPeer(
     timeoutSeconds: number,
     targetPeer?: string
 ): Promise<PeerEntry> {
-    const result = await runCli(vaultDir, "--settings", settingsFile, "p2p-peers", String(timeoutSeconds));
-    if (result.code !== 0) {
-        throw new Error(`p2p-peers failed\n${result.combined}`);
-    }
-    const peers = parsePeerLines(result.stdout);
-    if (targetPeer) {
-        const matched = peers.find((peer) => peer.id === targetPeer || peer.name === targetPeer);
-        if (matched) return matched;
-    }
-    if (peers.length === 0) {
-        const fallback = result.combined.match(/Advertisement from\s+([^\s]+)/);
-        if (fallback?.[1]) {
-            return { id: fallback[1], name: fallback[1] };
+    const retries = Math.max(0, Number(Deno.env.get("LIVESYNC_P2P_PEERS_RETRY") ?? "3"));
+    let lastCombined = "";
+
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        const result = await runCli(vaultDir, "--settings", settingsFile, "p2p-peers", String(timeoutSeconds));
+        lastCombined = result.combined;
+
+        if (result.code === 0) {
+            const peers = parsePeerLines(result.stdout);
+            if (targetPeer) {
+                const matched = peers.find((peer) => peer.id === targetPeer || peer.name === targetPeer);
+                if (matched) return matched;
+            }
+            if (peers.length > 0) {
+                return peers[0];
+            }
+
+            const fallback = result.combined.match(/Advertisement from\s+([^\s]+)/);
+            if (fallback?.[1]) {
+                return { id: fallback[1], name: fallback[1] };
+            }
         }
-        throw new Error(`No peers discovered\n${result.combined}`);
+
+        if (attempt < retries) {
+            const waitMs = 400 * (attempt + 1);
+            console.warn(
+                `[WARN] p2p-peers returned no usable peers, retrying (${attempt + 1}/${retries}) in ${waitMs}ms`
+            );
+            await sleep(waitMs);
+            continue;
+        }
+
+        throw new Error(
+            result.code !== 0 ? `p2p-peers failed\n${result.combined}` : `No peers discovered\n${result.combined}`
+        );
     }
-    return peers[0];
+
+    throw new Error(`No peers discovered\n${lastCombined}`);
 }
 
 export async function maybeStartLocalRelay(relay: string): Promise<boolean> {
     if (!isLocalP2pRelay(relay)) return false;
     await startP2pRelay();
+    const endpoint = parseRelayEndpoint(relay);
+    await waitForPort(endpoint.hostname, endpoint.port, {
+        timeoutMs: Number(Deno.env.get("LIVESYNC_P2P_RELAY_READY_TIMEOUT_MS") ?? "15000"),
+        intervalMs: Number(Deno.env.get("LIVESYNC_P2P_RELAY_READY_INTERVAL_MS") ?? "250"),
+        connectTimeoutMs: Number(Deno.env.get("LIVESYNC_P2P_RELAY_CONNECT_TIMEOUT_MS") ?? "1000"),
+    });
+    // Docker proxy accepts TCP connections instantly before the container's internal process is fully ready.
+    // Wait an additional few seconds to ensure strfry is actually accepting WebSockets.
+    await sleep(3000);
     return true;
 }
 
@@ -50,3 +95,17 @@ export async function stopLocalRelayIfStarted(started: boolean): Promise<void> {
         await stopP2pRelay().catch(() => {});
     }
 }
+
+export async function maybeStartCoturn(turnServers: string): Promise<boolean> {
+    if (turnServers.includes("localhost") || turnServers.includes("127.0.0.1") || turnServers.includes("[::1]")) {
+        await startCoturn();
+        return true;
+    }
+    return false;
+}
+
+export async function stopCoturnIfStarted(started: boolean): Promise<void> {
+    if (started) {
+        await stopCoturn().catch(() => {});
+    }
+}

src/apps/cli/testdeno/helpers/settings.ts

@@ -172,7 +172,8 @@ export async function applyP2pSettings(
     passphrase: string,
     appId = "self-hosted-livesync-cli-tests",
     relays = "ws://localhost:4000/",
-    autoAccept = "~.*"
+    autoAccept = "~.*",
+    turnServers = "turn:127.0.0.1:3478"
 ): Promise<void> {
     const data = JSON.parse(await Deno.readTextFile(settingsFile));
     data.P2P_Enabled = true;
@@ -184,6 +185,9 @@ export async function applyP2pSettings(
     data.P2P_relays = relays;
     data.P2P_AutoAcceptingPeers = autoAccept;
     data.P2P_AutoDenyingPeers = "";
+    data.P2P_turnServers = turnServers;
+    data.P2P_turnUsername = "testuser";
+    data.P2P_turnCredential = "testpass";
     data.P2P_IsHeadless = true;
     data.isConfigured = true;
     await Deno.writeTextFile(settingsFile, JSON.stringify(data, null, 2));

src/apps/cli/testdeno/test-daemon.ts

@@ -0,0 +1,116 @@
+/**
+ * Deno port of test-daemon-linux.sh
+ *
+ * Tests daemon-related ignore rules behaviour.
+ *
+ * Tests that are runnable without a long-running daemon process are exercised
+ * here using the 'mirror' command, which calls the same 'isTargetFile' handler
+ * stack that the daemon uses.
+ *
+ * Covered cases:
+ *   1. .livesync/ignore with *.tmp pattern  → ignored file is not synced to database
+ *   2. .livesync/ignore missing             → no error, and normal synchronisation continues
+ *   3. import: .gitignore directive         → patterns from .gitignore are merged
+ *
+ * Run:
+ *   deno test -A test-daemon.ts
+ */
+
+import { join } from "@std/path";
+import { assertEquals } from "@std/assert";
+import { TempDir } from "./helpers/temp.ts";
+import { runCliOrFail, runCli, assertContains, assertNotContains } from "./helpers/cli.ts";
+import { initSettingsFile, markSettingsConfigured } from "./helpers/settings.ts";
+
+Deno.test("daemon: ignore rules behaviour", async (t) => {
+    // -------------------------------------------------------------------------
+    // Case 1: .livesync/ignore with *.tmp → ignored file not synced to database
+    // -------------------------------------------------------------------------
+    await t.step("case 1: .livesync/ignore *.tmp prevents sync", async () => {
+        await using workDir = await TempDir.create("livesync-cli-daemon-c1");
+        const settingsFile = workDir.join("data.json");
+        const vaultDir = workDir.join("vault");
+
+        await Deno.mkdir(join(vaultDir, ".livesync"), { recursive: true });
+        await Deno.mkdir(join(vaultDir, "notes"), { recursive: true });
+
+        await initSettingsFile(settingsFile);
+        await markSettingsConfigured(settingsFile);
+
+        await Deno.writeTextFile(join(vaultDir, ".livesync", "ignore"), "*.tmp\n");
+        await Deno.writeTextFile(join(vaultDir, "notes", "normal.md"), "normal content\n");
+        await Deno.writeTextFile(join(vaultDir, "notes", "scratch.tmp"), "tmp content\n");
+
+        console.log("[INFO] Running mirror for Case 1...");
+        await runCliOrFail(vaultDir, "--settings", settingsFile, "mirror");
+
+        // The normal file should be in the database.
+        const resultNormal = workDir.join("case1-normal.txt");
+        await runCliOrFail(vaultDir, "--settings", settingsFile, "pull", "notes/normal.md", resultNormal);
+        const normalContent = await Deno.readTextFile(resultNormal);
+        assertEquals(normalContent, "normal content\n", "normal.md content mismatch after mirror");
+
+        // The .tmp file should NOT be in the database.
+        const dbList = await runCliOrFail(vaultDir, "--settings", settingsFile, "ls");
+        assertNotContains(dbList, "scratch.tmp", "scratch.tmp (ignored) was unexpectedly synced to database");
+        assertContains(dbList, "normal.md", "normal.md was not found in database after mirror");
+        console.log("[PASS] Case 1 verified successfully");
+    });
+
+    // -------------------------------------------------------------------------
+    // Case 2: .livesync/ignore absent → no error, and normal synchronisation continues
+    // -------------------------------------------------------------------------
+    await t.step("case 2: .livesync/ignore absent does not cause failure", async () => {
+        await using workDir = await TempDir.create("livesync-cli-daemon-c2");
+        const settingsFile = workDir.join("data2.json");
+        const vaultDir = workDir.join("vault2");
+
+        await Deno.mkdir(join(vaultDir, "notes"), { recursive: true });
+
+        await initSettingsFile(settingsFile);
+        await markSettingsConfigured(settingsFile);
+
+        // No .livesync directory at all.
+        await Deno.writeTextFile(join(vaultDir, "notes", "hello.md"), "hello\n");
+
+        console.log("[INFO] Running mirror for Case 2...");
+        const result = await runCli(vaultDir, "--settings", settingsFile, "mirror");
+        assertEquals(result.code, 0, "mirror exited non-zero when .livesync/ignore is absent");
+
+        // The normal file should have been synced.
+        const resultHello = workDir.join("case2-hello.txt");
+        await runCliOrFail(vaultDir, "--settings", settingsFile, "pull", "notes/hello.md", resultHello);
+        const helloContent = await Deno.readTextFile(resultHello);
+        assertEquals(helloContent, "hello\n", "file content mismatch when .livesync/ignore is absent");
+        console.log("[PASS] Case 2 verified successfully");
+    });
+
+    // -------------------------------------------------------------------------
+    // Case 3: import: .gitignore merges patterns
+    // -------------------------------------------------------------------------
+    await t.step("case 3: import: .gitignore directive merges patterns", async () => {
+        await using workDir = await TempDir.create("livesync-cli-daemon-c3");
+        const settingsFile = workDir.join("data3.json");
+        const vaultDir = workDir.join("vault3");
+
+        await Deno.mkdir(join(vaultDir, ".livesync"), { recursive: true });
+        await Deno.mkdir(join(vaultDir, "notes"), { recursive: true });
+
+        await initSettingsFile(settingsFile);
+        await markSettingsConfigured(settingsFile);
+
+        await Deno.writeTextFile(join(vaultDir, ".livesync", "ignore"), "import: .gitignore\n");
+        await Deno.writeTextFile(join(vaultDir, ".gitignore"), "# gitignore comment\n*.log\nbuild/\n");
+
+        await Deno.writeTextFile(join(vaultDir, "notes", "regular.md"), "regular note\n");
+        await Deno.writeTextFile(join(vaultDir, "notes", "debug.log"), "log content\n");
+
+        console.log("[INFO] Running mirror for Case 3...");
+        await runCliOrFail(vaultDir, "--settings", settingsFile, "mirror");
+
+        const dbList = await runCliOrFail(vaultDir, "--settings", settingsFile, "ls");
+        assertNotContains(dbList, "debug.log", "debug.log (ignored via .gitignore import) was unexpectedly synced to database");
+        assertContains(dbList, "regular.md", "regular.md was not synced normally alongside .gitignore import rules");
+        console.log("[PASS] Case 3 verified successfully");
+    });
+});

src/apps/cli/testdeno/test-decoupled-vault.ts

@@ -0,0 +1,114 @@
+/**
+ * Deno port of test-decoupled-vault-linux.sh
+ *
+ * Tests push, pull, and mirror command behaviour when the vault directory is
+ * decoupled (separated) from the database directory.
+ *
+ * Run:
+ *   deno test -A test-decoupled-vault.ts
+ */
+
+import { join } from "@std/path";
+import { assertEquals } from "@std/assert";
+import { TempDir } from "./helpers/temp.ts";
+import { runCliOrFail } from "./helpers/cli.ts";
+import { applyCouchdbSettings, initSettingsFile, markSettingsConfigured } from "./helpers/settings.ts";
+import { startCouchdb, stopCouchdb } from "./helpers/docker.ts";
+
+const REMOTE_PATH = Deno.env.get("REMOTE_PATH") ?? "test/push-pull-decoupled.txt";
+
+Deno.test("decoupled database and vault", async () => {
+    await using workDir = await TempDir.create("livesync-cli-decoupled");
+
+    const settingsFile = workDir.join("data.json");
+    const vaultDir = workDir.join("vault");
+    const dbDir = workDir.join("db");
+
+    await Deno.mkdir(join(vaultDir, "test"), { recursive: true });
+    await Deno.mkdir(dbDir, { recursive: true });
+
+    const uri = Deno.env.get("COUCHDB_URI") ?? "http://127.0.0.1:5989/";
+    const user = Deno.env.get("COUCHDB_USER") ?? "admin";
+    const password = Deno.env.get("COUCHDB_PASSWORD") ?? "testpassword";
+    const dbname = Deno.env.get("COUCHDB_DBNAME") ?? `decoupled-${Date.now()}`;
+
+    const shouldStartDocker = Deno.env.get("LIVESYNC_START_DOCKER") !== "0";
+    const keepDocker = Deno.env.get("LIVESYNC_DEBUG_KEEP_DOCKER") === "1";
+
+    if (shouldStartDocker) {
+        await startCouchdb(uri, user, password, dbname);
+    }
+
+    try {
+        await initSettingsFile(settingsFile);
+
+        if (uri && user && password && dbname) {
+            console.log("[INFO] applying CouchDB environment variables to settings");
+            await applyCouchdbSettings(settingsFile, uri, user, password, dbname);
+        } else {
+            console.warn(
+                "[WARN] CouchDB environment variables are not fully set. Push and pull operations may fail."
+            );
+            await markSettingsConfigured(settingsFile);
+        }
+
+        const srcFile = workDir.join("push-source.txt");
+        const pulledFile = workDir.join("pull-result.txt");
+        const content = `push-pull-decoupled-test ${new Date().toISOString()}\n`;
+        await Deno.writeTextFile(srcFile, content);
+
+        // 1. Test push command with decoupled vault directory
+        console.log(`[INFO] push with decoupled vault -> ${REMOTE_PATH}`);
+        await runCliOrFail(
+            dbDir,
+            "--vault",
+            vaultDir,
+            "--settings",
+            settingsFile,
+            "push",
+            srcFile,
+            REMOTE_PATH
+        );
+
+        // 2. Test pull command with decoupled vault directory
+        console.log(`[INFO] pull with decoupled vault <- ${REMOTE_PATH}`);
+        await runCliOrFail(
+            dbDir,
+            "--vault",
+            vaultDir,
+            "--settings",
+            settingsFile,
+            "pull",
+            REMOTE_PATH,
+            pulledFile
+        );
+
+        const pulled = await Deno.readTextFile(pulledFile);
+        assertEquals(pulled, content, "push/pull roundtrip with decoupled vault content mismatch");
+        console.log("[PASS] push/pull roundtrip with decoupled vault matched");
+
+        // 3. Clean up pulled file and vault test directory to verify mirror
+        await Deno.remove(pulledFile).catch(() => {});
+        await Deno.remove(join(vaultDir, "test"), { recursive: true }).catch(() => {});
+
+        // 4. Test mirror command with decoupled vault directory
+        console.log("[INFO] mirror with decoupled vault");
+        await runCliOrFail(
+            dbDir,
+            "--vault",
+            vaultDir,
+            "--settings",
+            settingsFile,
+            "mirror"
+        );
+
+        const restoredFile = join(vaultDir, REMOTE_PATH);
+        const restored = await Deno.readTextFile(restoredFile);
+        assertEquals(restored, content, "mirror with decoupled vault content mismatch");
+        console.log("[PASS] mirror with decoupled vault matched");
+    } finally {
+        if (shouldStartDocker && !keepDocker) {
+            await stopCouchdb().catch(() => {});
+        }
+    }
+});

src/apps/cli/testdeno/test-p2p-peers-local-relay.ts

@@ -2,13 +2,28 @@ import { assert } from "@std/assert";
 import { TempDir } from "./helpers/temp.ts";
 import { initSettingsFile, applyP2pSettings, applyP2pTestTweaks } from "./helpers/settings.ts";
 import { startCliInBackground } from "./helpers/backgroundCli.ts";
-import { discoverPeer, maybeStartLocalRelay, stopLocalRelayIfStarted } from "./helpers/p2p.ts";
+import {
+    discoverPeer,
+    maybeStartLocalRelay,
+    stopLocalRelayIfStarted,
+    maybeStartCoturn,
+    stopCoturnIfStarted,
+} from "./helpers/p2p.ts";
+import { getOptimalLoopbackIp } from "./helpers/net.ts";
 
 Deno.test("p2p-peers: discovers host through local relay", async () => {
-    const relay = Deno.env.get("RELAY") ?? "ws://localhost:4000/";
+    const loopbackIp = await getOptimalLoopbackIp();
+    const loopbackHost = loopbackIp === "::1" ? "[::1]" : loopbackIp;
+    
+    const relay = Deno.env.get("RELAY") ?? `ws://${loopbackHost}:4000/`;
     const roomId = Deno.env.get("ROOM_ID") ?? `room-${Date.now()}`;
     const passphrase = Deno.env.get("PASSPHRASE") ?? "test";
     const timeoutSeconds = Number(Deno.env.get("TIMEOUT_SECONDS") ?? "8");
+    const nonce = `${Date.now()}-${crypto.randomUUID().slice(0, 8)}`;
+    const hostPeerName = Deno.env.get("HOST_PEER_NAME") ?? `p2p-host-${nonce}`;
+    const clientPeerName = Deno.env.get("CLIENT_PEER_NAME") ?? `p2p-client-${nonce}`;
+    const useCoturn = Deno.env.get("LIVESYNC_USE_COTURN") !== "0";
+    const turnServers = Deno.env.get("TURN_SERVERS") ?? (useCoturn ? `turn:${loopbackHost}:3478` : "none");
 
     await using workDir = await TempDir.create("livesync-cli-p2p-peers-local-relay");
     const hostVault = workDir.join("vault-host");
@@ -19,24 +34,43 @@ Deno.test("p2p-peers: discovers host through local relay", async () => {
     await Deno.mkdir(clientVault, { recursive: true });
 
     const relayStarted = await maybeStartLocalRelay(relay);
+    const coturnStarted = await maybeStartCoturn(turnServers);
     try {
         await initSettingsFile(hostSettings);
         await initSettingsFile(clientSettings);
-        await applyP2pSettings(hostSettings, roomId, passphrase, "self-hosted-livesync-cli-tests", relay);
-        await applyP2pSettings(clientSettings, roomId, passphrase, "self-hosted-livesync-cli-tests", relay);
-        await applyP2pTestTweaks(hostSettings, "p2p-host", passphrase);
-        await applyP2pTestTweaks(clientSettings, "p2p-client", passphrase);
+        await applyP2pSettings(
+            hostSettings,
+            roomId,
+            passphrase,
+            "self-hosted-livesync-cli-tests",
+            relay,
+            "~.*",
+            turnServers
+        );
+        await applyP2pSettings(
+            clientSettings,
+            roomId,
+            passphrase,
+            "self-hosted-livesync-cli-tests",
+            relay,
+            "~.*",
+            turnServers
+        );
+        await applyP2pTestTweaks(hostSettings, hostPeerName, passphrase);
+        await applyP2pTestTweaks(clientSettings, clientPeerName, passphrase);
 
         const host = startCliInBackground(hostVault, "--settings", hostSettings, "p2p-host");
         try {
             await host.waitUntilContains("P2P host is running", 20000);
-            const peer = await discoverPeer(clientVault, clientSettings, timeoutSeconds);
+            const peer = await discoverPeer(clientVault, clientSettings, timeoutSeconds, hostPeerName);
             assert(peer.id.length > 0);
             assert(peer.name.length > 0);
+            assert(peer.name === hostPeerName, `expected peer '${hostPeerName}', got '${peer.name}'`);
         } finally {
             await host.stop();
         }
     } finally {
         await stopLocalRelayIfStarted(relayStarted);
+        await stopCoturnIfStarted(coturnStarted);
     }
 });

src/apps/cli/testdeno/test-p2p-sync.ts

@@ -2,15 +2,30 @@ import { assert } from "@std/assert";
 import { TempDir } from "./helpers/temp.ts";
 import { initSettingsFile, applyP2pSettings, applyP2pTestTweaks } from "./helpers/settings.ts";
 import { startCliInBackground } from "./helpers/backgroundCli.ts";
-import { discoverPeer, maybeStartLocalRelay, stopLocalRelayIfStarted } from "./helpers/p2p.ts";
+import {
+    discoverPeer,
+    maybeStartLocalRelay,
+    stopLocalRelayIfStarted,
+    maybeStartCoturn,
+    stopCoturnIfStarted,
+} from "./helpers/p2p.ts";
 import { runCli } from "./helpers/cli.ts";
+import { getOptimalLoopbackIp } from "./helpers/net.ts";
 
 Deno.test("p2p-sync: discovers peer and completes sync", async () => {
-    const relay = Deno.env.get("RELAY") ?? "ws://localhost:4000/";
+    const loopbackIp = await getOptimalLoopbackIp();
+    const loopbackHost = loopbackIp === "::1" ? "[::1]" : loopbackIp;
+    
+    const relay = Deno.env.get("RELAY") ?? `ws://${loopbackHost}:4000/`;
     const roomId = Deno.env.get("ROOM_ID") ?? `room-${Date.now()}`;
     const passphrase = Deno.env.get("PASSPHRASE") ?? "test";
     const peersTimeout = Number(Deno.env.get("PEERS_TIMEOUT") ?? "12");
     const syncTimeout = Number(Deno.env.get("SYNC_TIMEOUT") ?? "15");
+    const nonce = `${Date.now()}-${crypto.randomUUID().slice(0, 8)}`;
+    const hostPeerName = Deno.env.get("HOST_PEER_NAME") ?? `p2p-host-${nonce}`;
+    const clientPeerName = Deno.env.get("CLIENT_PEER_NAME") ?? `p2p-client-${nonce}`;
+    const useCoturn = Deno.env.get("LIVESYNC_USE_COTURN") !== "0";
+    const turnServers = Deno.env.get("TURN_SERVERS") ?? (useCoturn ? `turn:${loopbackHost}:3478` : "none");
 
     await using workDir = await TempDir.create("livesync-cli-p2p-sync");
     const hostVault = workDir.join("vault-host");
@@ -21,13 +36,30 @@ Deno.test("p2p-sync: discovers peer and completes sync", async () => {
     await Deno.mkdir(clientVault, { recursive: true });
 
     const relayStarted = await maybeStartLocalRelay(relay);
+    const coturnStarted = await maybeStartCoturn(turnServers);
     try {
         await initSettingsFile(hostSettings);
         await initSettingsFile(clientSettings);
-        await applyP2pSettings(hostSettings, roomId, passphrase, "self-hosted-livesync-cli-tests", relay);
-        await applyP2pSettings(clientSettings, roomId, passphrase, "self-hosted-livesync-cli-tests", relay);
-        await applyP2pTestTweaks(hostSettings, "p2p-host", passphrase);
-        await applyP2pTestTweaks(clientSettings, "p2p-client", passphrase);
+        await applyP2pSettings(
+            hostSettings,
+            roomId,
+            passphrase,
+            "self-hosted-livesync-cli-tests",
+            relay,
+            "~.*",
+            turnServers
+        );
+        await applyP2pSettings(
+            clientSettings,
+            roomId,
+            passphrase,
+            "self-hosted-livesync-cli-tests",
+            relay,
+            "~.*",
+            turnServers
+        );
+        await applyP2pTestTweaks(hostSettings, hostPeerName, passphrase);
+        await applyP2pTestTweaks(clientSettings, clientPeerName, passphrase);
 
         const host = startCliInBackground(hostVault, "--settings", hostSettings, "p2p-host");
         try {
@@ -36,7 +68,7 @@ Deno.test("p2p-sync: discovers peer and completes sync", async () => {
                 clientVault,
                 clientSettings,
                 peersTimeout,
-                Deno.env.get("TARGET_PEER") ?? undefined
+                Deno.env.get("TARGET_PEER") ?? hostPeerName
             );
             const syncResult = await runCli(
                 clientVault,
@@ -55,5 +87,6 @@ Deno.test("p2p-sync: discovers peer and completes sync", async () => {
         }
     } finally {
         await stopLocalRelayIfStarted(relayStarted);
+        await stopCoturnIfStarted(coturnStarted);
     }
 });

src/apps/cli/testdeno/test-p2p-three-nodes-conflict.ts

@@ -1,17 +1,33 @@
 import { assert } from "@std/assert";
 import { TempDir } from "./helpers/temp.ts";
-import { applyP2pSettings, initSettingsFile } from "./helpers/settings.ts";
+import { applyP2pSettings, applyP2pTestTweaks, initSettingsFile } from "./helpers/settings.ts";
 import { startCliInBackground } from "./helpers/backgroundCli.ts";
-import { discoverPeer, maybeStartLocalRelay, stopLocalRelayIfStarted } from "./helpers/p2p.ts";
+import {
+    discoverPeer,
+    maybeStartLocalRelay,
+    stopLocalRelayIfStarted,
+    maybeStartCoturn,
+    stopCoturnIfStarted,
+} from "./helpers/p2p.ts";
 import { jsonStringField, runCliOrFail, runCliWithInputOrFail, sanitiseCatStdout } from "./helpers/cli.ts";
+import { getOptimalLoopbackIp } from "./helpers/net.ts";
 
 Deno.test("p2p: three nodes detect and resolve conflicts", async () => {
-    const relay = Deno.env.get("RELAY") ?? "ws://localhost:4000/";
-    const roomId = `${Deno.env.get("ROOM_ID_PREFIX") ?? "p2p-room"}-${Date.now()}`;
-    const passphrase = `${Deno.env.get("PASSPHRASE_PREFIX") ?? "p2p-pass"}-${Date.now()}`;
-    const appId = Deno.env.get("APP_ID") ?? "self-hosted-livesync-cli-tests";
+    const loopbackIp = await getOptimalLoopbackIp();
+    const loopbackHost = loopbackIp === "::1" ? "[::1]" : loopbackIp;
+    
+    const relay = Deno.env.get("RELAY") ?? `ws://${loopbackHost}:4000/`;
+    const roomId = Deno.env.get("ROOM_ID") ?? `room-${Date.now()}`;
+    const passphrase = Deno.env.get("PASSPHRASE") ?? "test";
+    const appId = "self-hosted-livesync-cli-tests";
     const peersTimeout = Number(Deno.env.get("PEERS_TIMEOUT") ?? "10");
     const syncTimeout = Number(Deno.env.get("SYNC_TIMEOUT") ?? "15");
+    const nonce = `${Date.now()}-${crypto.randomUUID().slice(0, 8)}`;
+    const hostPeerName = Deno.env.get("HOST_PEER_NAME") ?? `p2p-host-${nonce}`;
+    const peerNameB = Deno.env.get("PEER_NAME_B") ?? `p2p-client-b-${nonce}`;
+    const peerNameC = Deno.env.get("PEER_NAME_C") ?? `p2p-client-c-${nonce}`;
+    const useCoturn = Deno.env.get("LIVESYNC_USE_COTURN") !== "0";
+    const turnServers = Deno.env.get("TURN_SERVERS") ?? (useCoturn ? `turn:${loopbackHost}:3478` : "none");
 
     await using workDir = await TempDir.create("livesync-cli-p2p-3nodes");
     const vaultA = workDir.join("vault-a");
@@ -25,17 +41,23 @@ Deno.test("p2p: three nodes detect and resolve conflicts", async () => {
     await Deno.mkdir(vaultC, { recursive: true });
 
     const relayStarted = await maybeStartLocalRelay(relay);
+    const coturnStarted = await maybeStartCoturn(turnServers);
     try {
-        for (const settings of [settingsA, settingsB, settingsC]) {
-            await initSettingsFile(settings);
-            await applyP2pSettings(settings, roomId, passphrase, appId, relay);
-        }
+        await initSettingsFile(settingsA);
+        await initSettingsFile(settingsB);
+        await initSettingsFile(settingsC);
+        await applyP2pSettings(settingsA, roomId, passphrase, appId, relay, "~.*", turnServers);
+        await applyP2pSettings(settingsB, roomId, passphrase, appId, relay, "~.*", turnServers);
+        await applyP2pSettings(settingsC, roomId, passphrase, appId, relay, "~.*", turnServers);
+        await applyP2pTestTweaks(settingsA, hostPeerName, passphrase);
+        await applyP2pTestTweaks(settingsB, peerNameB, passphrase);
+        await applyP2pTestTweaks(settingsC, peerNameC, passphrase);
 
         const host = startCliInBackground(vaultA, "--settings", settingsA, "p2p-host");
         try {
             await host.waitUntilContains("P2P host is running", 20000);
-            const peerFromB = await discoverPeer(vaultB, settingsB, peersTimeout);
-            const peerFromC = await discoverPeer(vaultC, settingsC, peersTimeout);
+            const peerFromB = await discoverPeer(vaultB, settingsB, peersTimeout, hostPeerName);
+            const peerFromC = await discoverPeer(vaultC, settingsC, peersTimeout, hostPeerName);
             const targetPath = "p2p/conflicted-from-two-clients.txt";
 
             await runCliWithInputOrFail("from-client-b-v1\n", vaultB, "--settings", settingsB, "put", targetPath);
@@ -114,5 +136,6 @@ Deno.test("p2p: three nodes detect and resolve conflicts", async () => {
         }
     } finally {
         await stopLocalRelayIfStarted(relayStarted);
+        await stopCoturnIfStarted(coturnStarted);
     }
 });

src/apps/cli/testdeno/test-remote-commands.ts

@@ -0,0 +1,130 @@
+/**
+ * Deno port of test-remote-commands-linux.sh
+ *
+ * Tests remote management commands: remote-status, lock-remote, unlock-remote,
+ * and mark-resolved.
+ *
+ * Scenario:
+ *   1. Start CouchDB, create a test database, and perform an initial sync.
+ *   2. Run remote-status and assert that the output contains the database name in JSON format.
+ *   3. Run lock-remote and verify that the remote database is locked.
+ *   4. Lock the remote database milestone manually, verify status, and run unlock-remote.
+ *      Assert that the output of unlock-remote contains the unlocked verification status.
+ *   5. Lock the remote database milestone manually, run mark-resolved, and verify that the
+ *      current device is accepted.
+ *
+ * Run:
+ *   deno test -A test-remote-commands.ts
+ */
+
+import { join } from "@std/path";
+import { TempDir } from "./helpers/temp.ts";
+import { runCli, assertContains } from "./helpers/cli.ts";
+import { applyCouchdbSettings, initSettingsFile } from "./helpers/settings.ts";
+import { startCouchdb, stopCouchdb, updateCouchdbDoc } from "./helpers/docker.ts";
+
+async function runCliCombinedOrFail(...args: string[]): Promise<string> {
+    const res = await runCli(...args);
+    if (res.code !== 0) {
+        throw new Error(`CLI exited with code ${res.code}\nstdout: ${res.stdout}\nstderr: ${res.stderr}`);
+    }
+    return res.combined;
+}
+
+Deno.test("remote management commands", async () => {
+    await using workDir = await TempDir.create("livesync-cli-remote-cmds");
+
+    const settingsFile = workDir.join("settings.json");
+    const vaultDir = workDir.join("vault");
+    await Deno.mkdir(vaultDir, { recursive: true });
+
+    const uri = Deno.env.get("COUCHDB_URI") ?? "http://127.0.0.1:5989/";
+    const user = Deno.env.get("COUCHDB_USER") ?? "admin";
+    const password = Deno.env.get("COUCHDB_PASSWORD") ?? "testpassword";
+    const dbSuffix = `${Date.now()}-${Math.floor(Math.random() * 10000)}`;
+    const dbname = Deno.env.get("COUCHDB_DBNAME") ?? `remotes-${dbSuffix}`;
+
+    const shouldStartDocker = Deno.env.get("LIVESYNC_START_DOCKER") !== "0";
+    const keepDocker = Deno.env.get("LIVESYNC_DEBUG_KEEP_DOCKER") === "1";
+
+    if (shouldStartDocker) {
+        await startCouchdb(uri, user, password, dbname);
+    }
+
+    try {
+        await initSettingsFile(settingsFile);
+        await applyCouchdbSettings(settingsFile, uri, user, password, dbname, true);
+
+        console.log("[INFO] Performing initial sync to create milestone document...");
+        await runCliCombinedOrFail(vaultDir, "--settings", settingsFile, "sync");
+
+        // 1. remote-status outputs valid JSON with CouchDB details
+        console.log("[CASE] remote-status outputs valid JSON with CouchDB details");
+        const statusOutput = await runCliCombinedOrFail(vaultDir, "--settings", settingsFile, "remote-status");
+        assertContains(
+            statusOutput,
+            `"db_name": "${dbname}"`,
+            "remote-status should return JSON containing db_name"
+        );
+        console.log("[PASS] remote-status verified");
+
+        // 2. lock-remote locks and verifies state
+        console.log("[CASE] lock-remote locks and verifies state");
+        const lockOutput = await runCliCombinedOrFail(vaultDir, "--settings", settingsFile, "lock-remote");
+        assertContains(
+            lockOutput,
+            "[Verification] Remote Database: LOCKED",
+            "lock-remote output should show that the remote database is locked"
+        );
+        console.log("[PASS] lock-remote verified");
+
+        // 3. unlock-remote unlocks and verifies state
+        console.log("[CASE] unlock-remote unlocks and verifies state");
+        // Manually lock milestone
+        console.log("[INFO] Manually locking milestone...");
+        await updateCouchdbDoc(uri, user, password, `${dbname}/_local/obsydian_livesync_milestone`, (doc) => {
+            doc.locked = true;
+            doc.accepted_nodes = [];
+            return doc;
+        });
+
+        // Run unlock-remote and verify output contains verification message
+        const unlockOutput = await runCliCombinedOrFail(vaultDir, "--settings", settingsFile, "unlock-remote");
+        assertContains(
+            unlockOutput,
+            "[Verification] Remote Database: UNLOCKED",
+            "unlock-remote output should contain verification status"
+        );
+        console.log("[PASS] unlock-remote verified");
+
+        // 4. mark-resolved resolves and verifies state
+        console.log("[CASE] mark-resolved resolves and verifies state");
+        // Manually lock milestone
+        console.log("[INFO] Manually locking milestone...");
+        await updateCouchdbDoc(uri, user, password, `${dbname}/_local/obsydian_livesync_milestone`, (doc) => {
+            doc.locked = true;
+            doc.accepted_nodes = [];
+            return doc;
+        });
+
+        // Run mark-resolved and verify output contains verification messages
+        const resolvedOutput = await runCliCombinedOrFail(vaultDir, "--settings", settingsFile, "mark-resolved");
+        assertContains(
+            resolvedOutput,
+            "[Verification] Remote Database: LOCKED",
+            "mark-resolved output should show that the remote database remains locked"
+        );
+        assertContains(
+            resolvedOutput,
+            "ACCEPTED",
+            "mark-resolved output should show that the current device node is accepted"
+        );
+        console.log("[PASS] mark-resolved verified");
+
+        console.log("[ALL PASS] All remote CLI commands verified successfully");
+    } finally {
+        if (shouldStartDocker && !keepDocker) {
+            await stopCouchdb().catch(() => {});
+        }
+    }
+});

src/apps/cli/testdeno/test_dev_deno.md

@@ -39,6 +39,9 @@ src/apps/cli/testdeno/
   test-mirror.ts
   test-sync-two-local-databases.ts
   test-sync-locked-remote.ts
+  test-daemon.ts
+  test-decoupled-vault.ts
+  test-remote-commands.ts
 ```
 
 ---
@@ -54,6 +57,9 @@ Main tasks:
 
 - `deno task test`
 - `deno task test:local`
+- `deno task test:daemon`
+- `deno task test:decoupled-vault`
+- `deno task test:remote-commands`
 - `deno task test:push-pull`
 - `deno task test:setup-put-cat`
 - `deno task test:mirror`
@@ -183,6 +189,19 @@ Both CouchDB and P2P relay flows are bash-independent.
   - `MINIO-enc0`
   - `MINIO-enc1`
 
+### `test-daemon.ts`
+
+- Verifies daemon-related ignore rules behaviour.
+- Exercises scenarios with `.livesync/ignore` wildcard rules, missing ignore rules, and imported `.gitignore` rules.
+
+### `test-decoupled-vault.ts`
+
+- Verifies push, pull, and mirror command behaviour when the vault directory is decoupled from the database directory.
+
+### `test-remote-commands.ts`
+
+- Verifies remote database management commands: `remote-status`, `lock-remote`, `unlock-remote`, and `mark-resolved`.
+
 ---
 
 ## Running tests (PowerShell)
@@ -198,11 +217,14 @@ deno task test:local
 # Individual tests
 deno task test:setup-put-cat
 deno task test:mirror
+deno task test:daemon
 deno task test:push-pull
 deno task test:sync-locked-remote
 
 # CouchDB-based tests
 deno task test:sync-two-local
+deno task test:decoupled-vault
+deno task test:remote-commands
 deno task test:e2e-couchdb
 
 # P2P-based tests
@@ -281,7 +303,7 @@ deno task test:sync-two-local
 
 ## Continuous Integration
 
-The GitHub Actions workflow `.github/workflows/cli-deno-tests.yml` is used to run these tests automatically on push and pull requests affecting the CLI.
+The GitHub Actions workflow `.github/workflows/cli-deno-tests.yml` runs automatically on pushes and pull requests affecting the CLI, executing the non-P2P test suite (`test:ci`). P2P tests (`test:p2p`) are excluded from automatic execution and must be run via manual dispatch (`workflow_dispatch`). You can optionally check the "Enable verbose and debug logging" checkbox during a manual dispatch to produce detailed trace logs for troubleshooting.
 
 ---
 

styles.css

@@ -296,8 +296,9 @@ body {
     content: " ❓";
 }
 
-.sls-item-invalid-value {
-    background-color: rgba(var(--background-modifier-error-rgb), 0.3) !important;
+.sls-setting .setting-item-control input.sls-item-invalid-value,
+.sls-setting .setting-item-control textarea.sls-item-invalid-value {
+    background-color: rgba(var(--background-modifier-error-rgb), 0.3);
 }
 
 .sls-setting-disabled input[type=text],

updates.md

@@ -3,7 +3,7 @@ Since 19th July, 2025 (beta1 in 0.25.0-beta1, 13th July, 2025)
 
 The head note of 0.25 is now in [updates_old.md](https://github.com/vrtmrz/obsidian-livesync/blob/main/updates_old.md). Because 0.25 got a lot of updates, thankfully, compatibility is kept and we do not need breaking changes! In other words, when get enough stabled. The next version will be v1.0.0. Even though it my hope.
 
-## Unreleased
+## 0.25.74
 
 8th June, 2026
 
@@ -11,6 +11,7 @@ The head note of 0.25 is now in [updates_old.md](https://github.com/vrtmrz/obsid
 
 - Fixed an issue where disabling hidden file synchronisation did not take effect, allowing non-target hidden files to continue to be processed and synchronised by replication or boot-sequence scan (#941).
 - Prevented the automatic merging of conflicted revisions when one of the revisions has been deleted, which was causing deleted files to reappear (#911).
+- The startup sequence now saves the state more effectively (Thank you so much for @bmcyver)!
 
 ## Only CLI
 
@@ -18,7 +19,15 @@ The head note of 0.25 is now in [updates_old.md](https://github.com/vrtmrz/obsid
 
 I should also consider the version numbering for the CLI...
 
+### Improved
+
 - Added new remote database management commands: `remote-status`, `unlock-remote`, `lock-remote`, and `mark-resolved`.
+- Decoupled the database directory path from the actual vault directory path using the `--vault` (or `-V`) option.
+
+### Fixed (preventive)
+
+- Validated that the specified vault path exists and is indeed a directory before starting the CLI.
+- Integrated path resolution and validations for one-off commands (such as `'push'`, `'pull'`, `'cat'`, `'rm'`, `'info'`, and `'resolve'`) against the decoupled vault path instead of the database path.
 
 ## 0.25.73