@thinremote/thinr-cli 1.2.0-alpha.1 → 1.3.0

package/lib/mcp/tools-exec.js

@@ -1,14 +1,17 @@
 // @ts-check
 import { getMonitoringData } from '../monitoring.js';
 import { inputError } from '../errors.js';
+import { BYTES, TIMEOUTS } from '../constants.js';
 import { getAPI } from './helpers.js';
 
 async function toolExec(args) {
     const { api } = getAPI(args.device, args.user);
-    // Default to 30s so a hung command doesn't lock the session
-    // indefinitely. Callers can pass a larger value for known-long
-    // operations (compiles, backups, …).
-    const timeout = Number.isFinite(args.timeout) && args.timeout > 0 ? args.timeout : 30;
+    // Default guards against hung commands locking the session; callers
+    // override for known-long operations. Knob lives in lib/constants.js.
+    const timeout =
+        Number.isFinite(args.timeout) && args.timeout > 0
+            ? args.timeout
+            : TIMEOUTS.DEFAULT_EXEC_SECONDS;
     let output = '';
     const { exitCode, timedOut } = await api.execStream(args.command, {
         timeout,
@@ -58,15 +61,15 @@ async function toolMonitoring(args) {
             );
         if (mon.memory)
             parts.push(
-                `Memory: ${mon.memory.usage?.toFixed(1)}% (available: ${(mon.memory.available / 1073741824).toFixed(1)}GB / total: ${(mon.memory.total / 1073741824).toFixed(1)}GB)`,
+                `Memory: ${mon.memory.usage?.toFixed(1)}% (available: ${(mon.memory.available / BYTES.GB).toFixed(1)}GB / total: ${(mon.memory.total / BYTES.GB).toFixed(1)}GB)`,
             );
         if (mon.disk?.root)
             parts.push(
-                `Disk: ${mon.disk.root.usage?.toFixed(1)}% (available: ${(mon.disk.root.available / 1073741824).toFixed(1)}GB / total: ${(mon.disk.root.total / 1073741824).toFixed(0)}GB)`,
+                `Disk: ${mon.disk.root.usage?.toFixed(1)}% (available: ${(mon.disk.root.available / BYTES.GB).toFixed(1)}GB / total: ${(mon.disk.root.total / BYTES.GB).toFixed(0)}GB)`,
             );
         if (mon.network)
             parts.push(
-                `Network: rx=${(mon.network.rx_rate / 1024).toFixed(1)}KB/s tx=${(mon.network.tx_rate / 1024).toFixed(1)}KB/s`,
+                `Network: rx=${(mon.network.rx_rate / BYTES.KB).toFixed(1)}KB/s tx=${(mon.network.tx_rate / BYTES.KB).toFixed(1)}KB/s`,
             );
         if (mon.load)
             parts.push(
@@ -99,8 +102,10 @@ async function toolMonitoring(args) {
     if (Array.isArray(data) && data.length > 0) {
         output = data
             .map((d) => {
-                const ts = new Date(d.ts).toISOString();
-                const parts = [ts];
+                // Single-window aggregated rows (group_by without `agg`) come
+                // back without `ts`; skip it rather than emitting "Invalid Date".
+                const parts = [];
+                if (d.ts) parts.push(new Date(d.ts).toISOString());
                 if (d.device) parts.push(`device=${d.device}`);
                 if (d.cpu) {
                     const cpuParts = [];
@@ -113,7 +118,7 @@ async function toolMonitoring(args) {
                 if (d.disk?.root) parts.push(`disk=${d.disk.root.usage?.toFixed(1)}%`);
                 if (d.network)
                     parts.push(
-                        `net_rx=${(d.network.rx_rate / 1024)?.toFixed(1)}KB/s tx=${(d.network.tx_rate / 1024)?.toFixed(1)}KB/s`,
+                        `net_rx=${(d.network.rx_rate / BYTES.KB)?.toFixed(1)}KB/s tx=${(d.network.tx_rate / BYTES.KB)?.toFixed(1)}KB/s`,
                     );
                 if (d.load) parts.push(`load=${d.load['1m']?.toFixed(2)}`);
                 if (d.processes) parts.push(`procs=${d.processes.total}`);
@@ -166,7 +171,12 @@ export const tools = [
     },
     {
         name: 'thinr_monitoring',
-        description: `Get monitoring data (CPU, memory, disk, network, temperature, load) from a device or all devices. Use realtime=true for live data from the device, or omit for historical data from the monitoring bucket.`,
+        description: `Get monitoring data (CPU, memory, disk, network, temperature, load).
+
+Modes:
+- realtime=true + device: live sample read straight from the agent.
+- device only: historical time series for that device. Use \`agg\`+\`agg_type\` for time-windowed aggregates (e.g. avg CPU every 5m over the last hour).
+- no device: historical fleet view — returns ONE ROW PER DEVICE. Without \`agg_type\` each row is the latest sample for that device ("current fleet state"). With \`agg_type\` each row is the reducer applied over the time window per device (e.g. \`agg_type=max\`+\`minutes=60\` ⇒ peak per device in the last hour, ideal for ranking "which device had the most X"). Sort the returned array client-side on the metric to get the top N.`,
         inputSchema: {
             type: 'object',
             properties: {
@@ -178,11 +188,11 @@ export const tools = [
                 device: {
                     type: 'string',
                     description:
-                        'Device ID. Required for realtime. Omit for historical data from ALL devices.',
+                        'Device ID. Required for realtime. Omit for a one-row-per-device fleet view.',
                 },
                 items: {
                     type: 'number',
-                    description: 'Number of data points to return (default: 10)',
+                    description: 'Number of data points to return (default: 10). In multi-device mode set ≥ number of devices (e.g. 200) since each device contributes one row.',
                 },
                 minutes: {
                     type: 'number',
@@ -195,14 +205,17 @@ export const tools = [
                 },
                 sort: {
                     type: 'string',
-                    description: 'Sort order: "asc" or "desc" (default: "desc")',
+                    description: 'Sort order by timestamp: "asc" or "desc" (default: "desc"). Does NOT sort by metric — do that client-side on the result.',
+                },
+                agg: { type: 'string', description: 'Time-window size for windowed aggregation: "5m", "10m", "1h", "6h". Only meaningful with a specific device. For a per-device single value across the whole range, omit `agg` and pass `agg_type` alone.' },
+                agg_type: {
+                    type: 'string',
+                    description: 'Reducer applied to each group/window. Supported: "mean", "max", "min", "sum", "count", "first", "last", "median", "spread" (max-min), "stddev". Most common for monitoring: max, mean, min.',
                 },
-                agg: { type: 'string', description: 'Aggregation period: "5m", "10m", "1h", "6h"' },
-                agg_type: { type: 'string', description: 'Aggregation type: "mean", "min", "max"' },
                 fields: {
                     type: 'string',
                     description:
-                        'Comma-separated fields to return (e.g., "cpu.usage,memory.usage,disk.root.usage")',
+                        'Comma-separated fields to return (e.g., "cpu.usage,memory.usage,disk.root.usage"). Narrower queries are cheaper and produce tidier output.',
                 },
                 user: { type: 'string', description: 'API user' },
             },

package/lib/mcp/tools-filesystem.js

@@ -1,5 +1,8 @@
 // @ts-check
+import { readFile as readLocalFile, writeFile as writeLocalFile } from 'fs/promises';
+import { resolve as resolvePath, basename } from 'path';
 import { getAPI } from './helpers.js';
+import { inputError } from '../errors.js';
 
 async function toolRead(args) {
     const { api } = getAPI(args.device, args.user);
@@ -43,7 +46,7 @@ async function toolMkdir(args) {
     };
 }
 
-async function toolDelete(args) {
+async function toolRm(args) {
     const { api } = getAPI(args.device, args.user);
     await api.delete(args.path, args.recursive !== false);
     return {
@@ -52,7 +55,7 @@ async function toolDelete(args) {
     };
 }
 
-async function toolMove(args) {
+async function toolMv(args) {
     const { api } = getAPI(args.device, args.user);
     await api.move(args.source, args.destination, args.overwrite || false);
     return {
@@ -61,6 +64,55 @@ async function toolMove(args) {
     };
 }
 
+async function toolPush(args) {
+    if (typeof args.source !== 'string' || !args.source) {
+        throw inputError('`source` (local file path) is required');
+    }
+    if (typeof args.destination !== 'string' || !args.destination) {
+        throw inputError('`destination` (remote path on the device) is required');
+    }
+    const localPath = resolvePath(args.source);
+    const remotePath = args.destination.endsWith('/')
+        ? args.destination + basename(localPath)
+        : args.destination;
+    const { api } = getAPI(args.device, args.user);
+    const content = await readLocalFile(localPath);
+    await api.writeFile(remotePath, content);
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `Pushed ${content.byteLength} bytes: ${localPath} → ${remotePath}`,
+            },
+        ],
+        isError: false,
+    };
+}
+
+async function toolPull(args) {
+    if (typeof args.source !== 'string' || !args.source) {
+        throw inputError('`source` (remote path on the device) is required');
+    }
+    if (typeof args.destination !== 'string' || !args.destination) {
+        throw inputError('`destination` (local file path) is required');
+    }
+    const localPath = args.destination.endsWith('/')
+        ? resolvePath(args.destination, basename(args.source))
+        : resolvePath(args.destination);
+    const { api } = getAPI(args.device, args.user);
+    const buf = await api.readFile(args.source);
+    await writeLocalFile(localPath, buf);
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `Pulled ${buf.byteLength} bytes: ${args.source} → ${localPath}`,
+            },
+        ],
+        isError: false,
+    };
+}
+
 export const tools = [
     {
         name: 'thinr_read',
@@ -124,7 +176,7 @@ export const tools = [
         handler: toolMkdir,
     },
     {
-        name: 'thinr_delete',
+        name: 'thinr_rm',
         description: `Delete a file or directory on a remote device. Paths are absolute on the device filesystem (e.g., "/etc/hosts", "/var/log/syslog"). Subject to the OS user the agent runs as; check whoami (or thinr_device_info) before assuming write access to system paths like /etc.`,
         inputSchema: {
             type: 'object',
@@ -139,10 +191,10 @@ export const tools = [
             },
             required: ['path', 'device'],
         },
-        handler: toolDelete,
+        handler: toolRm,
     },
     {
-        name: 'thinr_move',
+        name: 'thinr_mv',
         description: `Move or rename a file or directory on a remote device. Paths are absolute on the device filesystem (e.g., "/etc/hosts", "/var/log/syslog"). Subject to the OS user the agent runs as; check whoami (or thinr_device_info) before assuming write access to system paths like /etc.`,
         inputSchema: {
             type: 'object',
@@ -158,6 +210,50 @@ export const tools = [
             },
             required: ['source', 'destination', 'device'],
         },
-        handler: toolMove,
+        handler: toolMv,
+    },
+    {
+        name: 'thinr_push',
+        description: `Upload a local file to a remote device. \`source\` is a path on the machine running the MCP server; \`destination\` is an absolute path on the device (trailing "/" keeps the source basename). Use this for binary or large payloads that don't fit as inline strings in thinr_write.`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                source: {
+                    type: 'string',
+                    description: 'Local file path (absolute or relative to the MCP server CWD).',
+                },
+                destination: {
+                    type: 'string',
+                    description:
+                        'Absolute path on the device. Trailing "/" keeps the source basename.',
+                },
+                device: { type: 'string', description: 'Device ID' },
+                user: { type: 'string', description: 'API user' },
+            },
+            required: ['source', 'destination', 'device'],
+        },
+        handler: toolPush,
+    },
+    {
+        name: 'thinr_pull',
+        description: `Download a remote file from a device to the local disk of the machine running the MCP server. \`source\` is an absolute path on the device; \`destination\` is a local file path (trailing "/" keeps the source basename).`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                source: {
+                    type: 'string',
+                    description: 'Absolute file path on the device.',
+                },
+                destination: {
+                    type: 'string',
+                    description:
+                        'Local file path (absolute or relative to the MCP server CWD). Trailing "/" keeps the source basename.',
+                },
+                device: { type: 'string', description: 'Device ID' },
+                user: { type: 'string', description: 'API user' },
+            },
+            required: ['source', 'destination', 'device'],
+        },
+        handler: toolPull,
     },
 ];

package/lib/mcp/tools-install.js

@@ -0,0 +1,153 @@
+// @ts-check
+import { requireConfig } from '../config.js';
+import { inputError } from '../errors.js';
+
+const CHANNEL_SCRIPT = {
+    latest: 'install.sh',
+    main: 'install-main.sh',
+    develop: 'install-develop.sh',
+};
+
+function shQuote(value) {
+    return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+
+function decodeJwtClaims(token) {
+    const parts = String(token).split('.');
+    if (parts.length !== 3) return null;
+    try {
+        const pad = parts[1].length % 4 === 0 ? '' : '='.repeat(4 - (parts[1].length % 4));
+        const normalized = parts[1].replace(/-/g, '+').replace(/_/g, '/') + pad;
+        return JSON.parse(Buffer.from(normalized, 'base64').toString('utf8'));
+    } catch {
+        return null;
+    }
+}
+
+async function toolAgentInstallCommand(args) {
+    // requireConfig throws `not_configured` if there's no active profile
+    // with a token — classifyError in server.js surfaces that cleanly.
+    const config = requireConfig();
+
+    const channel = args.channel || 'latest';
+    const script = CHANNEL_SCRIPT[channel];
+    if (!script) {
+        throw inputError(
+            `Unknown channel "${channel}". Valid channels: ${Object.keys(CHANNEL_SCRIPT).join(', ')}.`,
+        );
+    }
+
+    const scheme = args.http ? 'http' : 'https';
+    const url = `${scheme}://get.thinremote.io/${script}`;
+
+    const agentArgs = ['install', '--token', shQuote(config.token)];
+    if (args.device) agentArgs.push('--device', shQuote(args.device));
+    if (args.product) agentArgs.push('--product', shQuote(args.product));
+    if (args.overwrite) agentArgs.push('--overwrite');
+    if (args.no_start) agentArgs.push('--no-start');
+    if (args.no_verify_ssl) agentArgs.push('--no-verify-ssl');
+
+    const runner = args.sudo ? 'sudo sh' : 'sh';
+    const command = `curl -fsSL ${url} | ${runner} -s -- ${agentArgs.join(' ')}`;
+
+    // The agent's `install --token` flow decodes the JWT and requires
+    // both `svr` and `usr` claims. Permanent user tokens minted via
+    // /v1/users/{user}/tokens are missing `svr` on some server versions,
+    // which makes auto-provisioning fail with "Invalid token". Warn up
+    // front so the caller can switch to an OAuth-issued token or ask
+    // the platform for a proper provisioning token.
+    const claims = decodeJwtClaims(config.token);
+    const warnings = [];
+    if (!claims) {
+        warnings.push(
+            'The active profile token is not a decodable JWT. Auto-provisioning expects a JWT with `svr` and `usr` claims.',
+        );
+    } else {
+        if (!claims.svr) {
+            warnings.push(
+                `The profile token is missing the \`svr\` claim. The agent will reject it with "Invalid token: missing 'svr' or 'usr' claim". Re-authenticate this profile via OAuth (\`thinr\`) or generate a provisioning token from the ${config.server} console.`,
+            );
+        }
+        if (!claims.usr) {
+            warnings.push('The profile token is missing the `usr` claim.');
+        }
+    }
+
+    const sections = [
+        `Server:  ${config.server}`,
+        `User:    ${config.username}`,
+        `Channel: ${channel}`,
+        '',
+        'Run on the target host (directly or via `ssh host "<command>"`):',
+        '',
+        command,
+        '',
+        'Notes:',
+        '- The command embeds the active profile\'s API token — treat it as a credential.',
+        '- Installing the system service needs root. Pass `sudo: true` if the target host is not already root.',
+        '- The agent reads the target server from the JWT, so `--host` is not needed.',
+    ];
+
+    if (warnings.length) {
+        sections.push('', 'Warnings:', ...warnings.map((w) => `- ${w}`));
+    }
+
+    return {
+        content: [{ type: 'text', text: sections.join('\n') }],
+        isError: false,
+    };
+}
+
+export const tools = [
+    {
+        name: 'thinr_agent_install_command',
+        description:
+            "Generate a one-liner shell command that installs thinr-agent on a remote host using the active profile's token for auto-provisioning. Meant to be run on the target machine (directly or piped through `ssh`). The token is embedded verbatim, so only share the output through trusted channels.",
+        inputSchema: {
+            type: 'object',
+            properties: {
+                device: {
+                    type: 'string',
+                    description:
+                        'Custom device identifier. Omit to let the agent default to the target host\'s hostname.',
+                },
+                product: {
+                    type: 'string',
+                    description:
+                        'Product to associate the device with. Omit to auto-detect or create the default product.',
+                },
+                overwrite: {
+                    type: 'boolean',
+                    description:
+                        'Auto-overwrite an existing device with the same id on the server.',
+                },
+                no_start: {
+                    type: 'boolean',
+                    description: 'Install the service but do not start it.',
+                },
+                no_verify_ssl: {
+                    type: 'boolean',
+                    description:
+                        'Disable TLS certificate verification (for self-signed servers).',
+                },
+                channel: {
+                    type: 'string',
+                    enum: ['latest', 'main', 'develop'],
+                    description: 'Release channel. Defaults to `latest` (stable).',
+                },
+                sudo: {
+                    type: 'boolean',
+                    description:
+                        'Pipe into `sudo sh` instead of `sh`. Needed on Linux hosts when running as a non-root user, since installing the systemd service writes under /etc.',
+                },
+                http: {
+                    type: 'boolean',
+                    description:
+                        'Use http://get.thinremote.io instead of https (for devices without working HTTPS).',
+                },
+            },
+            required: [],
+        },
+        handler: toolAgentInstallCommand,
+    },
+];

package/lib/mcp/tools-logs.js

@@ -0,0 +1,225 @@
+// @ts-check
+import {
+    addLogSource,
+    getProductLogs,
+    listPresets,
+    removeLogSource,
+    setDefaultLogSource,
+} from '../product/logs.js';
+import { inputError } from '../errors.js';
+
+function truncate(value, max = 80) {
+    if (typeof value !== 'string') return '';
+    return value.length > max ? `${value.slice(0, max - 1)}…` : value;
+}
+
+async function toolProductLogsList(args) {
+    if (!args.product) throw inputError('product is required');
+    const cfg = await getProductLogs(args.product, args.user);
+    const fallback = !!(/** @type {any} */ (cfg).__fallback);
+    const def = cfg.default || cfg.sources[0]?.name || null;
+    const lines = cfg.sources.map((s) => {
+        const tag = s.name === def ? '★' : ' ';
+        return `  ${tag} ${s.name}  →  ${truncate(s.command)}`;
+    });
+    const header = fallback
+        ? `Product "${args.product}" has no logs property — showing the synthetic fallback (${cfg.sources.length} source):`
+        : `${cfg.sources.length} log source(s) on "${args.product}" (default: ${def}):`;
+    return {
+        content: [{ type: 'text', text: [header, ...lines].join('\n') }],
+        isError: false,
+    };
+}
+
+async function toolProductLogsAdd(args) {
+    if (!args.product) throw inputError('product is required');
+    if (!args.name) throw inputError('name is required');
+    if (typeof args.command !== 'string' || args.command.trim() === '') {
+        throw inputError('command is required (non-empty string)');
+    }
+    const { config, action } = await addLogSource(
+        args.product,
+        {
+            name: args.name,
+            command: args.command,
+            makeDefault: !!args.default,
+            pattern: args.pattern,
+            preset: args.preset,
+        },
+        args.user,
+    );
+    const def = config.default || config.sources[0]?.name || null;
+    const lines = [
+        `${action === 'added' ? 'Added' : 'Updated'} source "${args.name}" on product "${args.product}"${
+            args.default ? ' (default)' : ''
+        }.`,
+        `Command: ${truncate(args.command, 120)}`,
+    ];
+    if (args.preset) lines.push(`Preset: ${args.preset}`);
+    if (args.pattern) lines.push(`Pattern: ${truncate(args.pattern, 120)}`);
+    lines.push(`Sources: ${config.sources.length}${def ? `, default: ${def}` : ''}`);
+    return {
+        content: [{ type: 'text', text: lines.join('\n') }],
+        isError: false,
+    };
+}
+
+async function toolProductLogsPresets() {
+    const presets = listPresets();
+    const lines = [
+        `${presets.length} log line preset(s) shipped with the CLI:`,
+        ...presets.map((p) => `  · ${p.name} — ${p.description}`),
+    ];
+    return {
+        content: [{ type: 'text', text: lines.join('\n') }],
+        isError: false,
+    };
+}
+
+async function toolProductLogsRemove(args) {
+    if (!args.product) throw inputError('product is required');
+    if (!args.name) throw inputError('name is required');
+    const { removed, config } = await removeLogSource(args.product, args.name, args.user);
+    if (!removed) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `Source "${args.name}" was not configured on product "${args.product}".`,
+                },
+            ],
+            isError: false,
+        };
+    }
+    if (config === null) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `Removed last source "${args.name}" from product "${args.product}". Logs property cleared — falls back to the system journal.`,
+                },
+            ],
+            isError: false,
+        };
+    }
+    const def = config.default || config.sources[0]?.name || null;
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `Removed source "${args.name}" from product "${args.product}". ${config.sources.length} source(s) remain${def ? `, default: ${def}` : ''}.`,
+            },
+        ],
+        isError: false,
+    };
+}
+
+async function toolProductLogsSetDefault(args) {
+    if (!args.product) throw inputError('product is required');
+    if (!args.name) throw inputError('name is required');
+    const config = await setDefaultLogSource(args.product, args.name, args.user);
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `Default log source set to "${config.default}" on product "${args.product}".`,
+            },
+        ],
+        isError: false,
+    };
+}
+
+export const tools = [
+    {
+        name: 'thinr_product_logs_list',
+        description: `List the log sources configured on a product. Each source pairs a slug-ish \`name\` (visible to operators) with a \`command\` the agent will exec-stream when that source is selected. The default source — used when callers do not pick explicitly — is highlighted with a ★. When the product has no \`logs\` property yet, returns a synthetic fallback with a single \`system\` source running journalctl, matching the dashboard's pre-feature behaviour. Pair with thinr_product_logs_add to populate, thinr_product_logs_set_default to pick which one comes up first, or thinr_product_logs_remove to drop entries.`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                product: { type: 'string', description: 'Product ID.' },
+                user: { type: 'string', description: 'API user' },
+            },
+            required: ['product'],
+        },
+        handler: toolProductLogsList,
+    },
+    {
+        name: 'thinr_product_logs_add',
+        description: `Upsert a log source on a product: adds a new entry if \`name\` is unused, replaces the command in place when it already exists. The command is an opaque shell string the agent will exec-stream as-is when the dashboard or CLI selects this source — there is no protocol indirection, no special log "kind". Use it to expose journalctl unit tails, container log streams (\`docker logs -f thinger\`), application log files (\`tail -F /var/log/app.log\`), or any other follow-style command relevant to the device fleet.
+
+Set \`default: true\` to mark this source as the active default; the previous default is preserved otherwise (or, on a fresh product, no default is recorded so consumers fall back to the first source). Names are slug-ish (letters, digits, underscore, dash; ≤ 32 chars). Up to 32 sources per product. The product does not need to exist on the agent — the configuration lives entirely server-side.
+
+Optionally attach a \`pattern\` (regex with named groups \`time\`, \`level\`, \`msg\`) or a \`preset\` (named pattern shipped with the CLI; see thinr_product_logs_presets) to enable structured rendering in the dashboard. When the pattern captures a \`level\` group, the operator can filter the panel by severity (info+/warn+/error+). \`pattern\` and \`preset\` are mutually exclusive; omit both to keep the source rendered raw.`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                product: { type: 'string', description: 'Product ID.' },
+                name: {
+                    type: 'string',
+                    description:
+                        'Stable identifier for the source (letters, digits, underscore, dash; ≤ 32 chars). Reusing the name updates the existing entry.',
+                },
+                command: {
+                    type: 'string',
+                    description:
+                        'Shell command the agent should exec-stream when this source is selected (e.g. "journalctl --no-pager --output=short -f", "docker logs -f thinger", "tail -F /var/log/nginx/access.log"). Stored verbatim.',
+                },
+                default: {
+                    type: 'boolean',
+                    description:
+                        'Mark this source as the active default (default: false). When false the previous default is preserved.',
+                },
+                pattern: {
+                    type: 'string',
+                    description:
+                        'Custom regex with named groups (time, level, msg) for structured rendering in the dashboard. Mutually exclusive with `preset`. Validated to compile at config time.',
+                },
+                preset: {
+                    type: 'string',
+                    description:
+                        'Named preset for structured rendering (e.g. "spdlog", "journalctl", "nginx-error"). Use thinr_product_logs_presets to list available names. Mutually exclusive with `pattern`.',
+                },
+                user: { type: 'string', description: 'API user' },
+            },
+            required: ['product', 'name', 'command'],
+        },
+        handler: toolProductLogsAdd,
+    },
+    {
+        name: 'thinr_product_logs_remove',
+        description: `Remove a log source by name from a product. When the removed entry was the default, the default is dropped (consumers will fall back to the first remaining source). When the last source is removed, the entire \`logs\` property is deleted so the product reverts to the synthetic fallback. Idempotent — calling it on a missing source reports success without erroring.`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                product: { type: 'string', description: 'Product ID.' },
+                name: { type: 'string', description: 'Source name previously registered.' },
+                user: { type: 'string', description: 'API user' },
+            },
+            required: ['product', 'name'],
+        },
+        handler: toolProductLogsRemove,
+    },
+    {
+        name: 'thinr_product_logs_presets',
+        description: `List the named log line patterns shipped with the CLI. Each preset bundles a regex with named groups (\`time\`, \`level\`, \`msg\`) tuned for a common log format (journalctl short, spdlog, nginx access/error). Use the preset name with thinr_product_logs_add via the \`preset\` argument to enable structured rendering and level-based filtering on a source without typing the regex by hand.`,
+        inputSchema: {
+            type: 'object',
+            properties: {},
+        },
+        handler: toolProductLogsPresets,
+    },
+    {
+        name: 'thinr_product_logs_set_default',
+        description: `Set the active default log source on a product. The named source must already exist (use thinr_product_logs_add first). The default is what the dashboard surfaces first when an operator opens a device, and what \`thinr device logs <id>\` resolves to when no \`--source\` flag is passed. To clear the default, remove the matching source with thinr_product_logs_remove.`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                product: { type: 'string', description: 'Product ID.' },
+                name: { type: 'string', description: 'Source name to mark as default.' },
+                user: { type: 'string', description: 'API user' },
+            },
+            required: ['product', 'name'],
+        },
+        handler: toolProductLogsSetDefault,
+    },
+];