appduct 0.11.0 → 0.11.1

package/README.md

@@ -232,7 +232,7 @@ import { connect } from "appduct/client";
 // auto-spawns the daemon and picks the single session, or pass { selector: "pixel-8" } to target one explicitly
 const app = await connect();
 
-await app.tools();                                  // ToolDescriptor[]
+await app.tools();                                  // ListedToolDescriptor[]; an ungrouped tool's group is null
 const { total } = await app.call("sum", { a: 2, b: 3 });
 const { payload } = await app.waitForEvent("checkout_done", { timeoutMs: 5_000 });
 app.close();

package/dist/cli/result-types.d.ts

@@ -4,7 +4,7 @@
  * the thin-client shapes for the v2 command table.
  */
 import type { OpenTarget } from "./open-target.js";
-import type { AgentEndpoint, EffectivePolicyDecision, EventNotification, SessionSummary, ToolDescriptor, ToolGroupSummary, ToolsListResult } from "@appduct/shared";
+import type { AgentEndpoint, EffectivePolicyDecision, EventNotification, SessionSummary, ToolGroupSummary, ToolsListEntry, ToolsListResult } from "@appduct/shared";
 /**
  * CLI-domain error classes, used only to pick a sysexits-style exit code (see `errors.ts`).
  * `CliError.type` itself is *not* restricted to this union: RPC/app-originated failures preserve
@@ -129,9 +129,10 @@ export type ToolGroupsListing = {
     /** Every tool in the session, grouped or not. */
     total: number;
 };
-/** `appduct tools`: a listing, a groups summary (`--groups`), or a single descriptor when a tool
- * name resolved to a detail lookup. */
-export type ToolsCommandData = ToolsListing | ToolGroupsListing | ToolDescriptor;
+/** `appduct tools`: a listing, a groups summary (`--groups`), or a single entry when a tool name
+ * resolved to a detail lookup. The detail form is the daemon's own listing entry, picked out of
+ * `tools.list` — not a registration, so its `group` is `null` for an ungrouped tool. */
+export type ToolsCommandData = ToolsListing | ToolGroupsListing | ToolsListEntry;
 /** `appduct invoke`: the tool's raw result payload, printed as-is. */
 export type InvokeCommandData = unknown;
 export type RevokeCommandData = {

package/dist/cli/routes/daemon/start.js

@@ -9,7 +9,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -236,6 +236,7 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
@@ -248,6 +249,13 @@ var getStateDirPaths = (stateDir) => {
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -280,7 +288,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -296,7 +304,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -637,6 +645,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {

package/dist/cli/routes/daemon/status.js

@@ -53,7 +53,7 @@ import { join as join4 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -280,6 +280,7 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join as join3 } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
@@ -292,6 +293,13 @@ var getStateDirPaths = (stateDir) => {
     spawnLockPath: join3(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -324,7 +332,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -340,7 +348,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -646,6 +654,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {

package/dist/cli/routes/daemon/stop.js

@@ -42,6 +42,7 @@ var readPidFromFile = async (pidFilePath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
@@ -54,6 +55,13 @@ var getStateDirPaths = (stateDir) => {
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/rpc/client.ts
 import { connect as connect2 } from "node:net";
@@ -63,7 +71,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile as readFile2 } from "node:fs/promises";
@@ -280,7 +288,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -296,7 +304,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -637,6 +645,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {

package/dist/cli/routes/events.js

@@ -9,7 +9,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -236,6 +236,7 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
@@ -248,6 +249,13 @@ var getStateDirPaths = (stateDir) => {
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -280,7 +288,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -296,7 +304,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -637,6 +645,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {

package/dist/cli/routes/invoke.js

@@ -29,7 +29,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -256,6 +256,7 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
@@ -268,6 +269,13 @@ var getStateDirPaths = (stateDir) => {
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -300,7 +308,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -316,7 +324,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -657,6 +665,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {

package/dist/cli/routes/link.js

@@ -12,7 +12,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -239,6 +239,7 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
@@ -251,6 +252,13 @@ var getStateDirPaths = (stateDir) => {
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -283,7 +291,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -299,7 +307,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -640,6 +648,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {

package/dist/cli/routes/ls.js

@@ -9,7 +9,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -236,6 +236,7 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
@@ -248,6 +249,13 @@ var getStateDirPaths = (stateDir) => {
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -280,7 +288,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -296,7 +304,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -637,6 +645,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {

package/dist/cli/routes/mcp.js

@@ -171,6 +171,7 @@ var loadConfig = async (paths, options = {}) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
@@ -183,6 +184,13 @@ var getStateDirPaths = (stateDir) => {
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/mcp/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -267,7 +275,7 @@ import { join as join4 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/pidfile.ts
 import { readFileSync as readFileSync3 } from "node:fs";
@@ -355,7 +363,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -371,7 +379,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -677,6 +685,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {
@@ -2531,7 +2540,10 @@ var toDescriptor = (entry) => {
     output_schema: entry.output_schema,
     annotations: entry.annotations,
     timeout_ms: entry.timeout_ms,
-    group: entry.group
+    // Normalised the same way the listing normalises it, so `appduct_describe_tool` never
+    // disagrees with `appduct_list_tools` about whether a tool has a group. The `?? null` also
+    // covers a daemon that predates groups and omits the key entirely.
+    group: entry.group ?? null
   };
 };
 var resolveSession = async (call, selector) => {

package/dist/cli/routes/revoke.js

@@ -9,7 +9,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -236,6 +236,7 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
@@ -248,6 +249,13 @@ var getStateDirPaths = (stateDir) => {
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -280,7 +288,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -296,7 +304,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -637,6 +645,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {

package/dist/cli/routes/tools.js

@@ -12,7 +12,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -239,6 +239,7 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
@@ -251,6 +252,13 @@ var getStateDirPaths = (stateDir) => {
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -283,7 +291,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -299,7 +307,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -640,6 +648,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {

package/dist/client/app-client.d.ts

@@ -7,7 +7,7 @@
  * `appduct_wait_for_event` MCP tool (`mcp/events-tool.ts`) — see that module's doc comment for
  * why the notification listener has to be registered before the `events.since` drain call is sent.
  */
-import { type ToolDescriptor } from "@appduct/shared";
+import { type ListedToolDescriptor } from "@appduct/shared";
 import type { DaemonStream } from "../rpc/client.js";
 /** A project's own tool map — declared once, e.g. `type Tools = { sum: { args: { a: number; b:
  * number }; result: { total: number } } }` — to get typed {@link AppClient.call} throughout a test
@@ -80,8 +80,9 @@ export type AppEvent<TPayload = unknown> = {
 };
 export type AppClient<TTools = ToolMap> = {
     readonly sessionId: string;
-    /** `tools.list` for this session. */
-    tools(): Promise<ToolDescriptor[]>;
+    /** `tools.list` for this session. An entry spells an ungrouped tool's `group` as `null`,
+     * where a registration omits it. */
+    tools(): Promise<ListedToolDescriptor[]>;
     /** `tools.call`; rejects with a {@link AppductError} whose `type` preserves the wire error
      * type verbatim (e.g. `"tool_timeout"`, `"policy_denied"`, `"session_suspended"`). */
     call<K extends keyof TTools & string>(name: K, args: ToolArgs<TTools, K>, options?: CallOptions): Promise<ToolResult<TTools, K>>;

package/dist/client/index.d.ts

@@ -15,4 +15,4 @@ export { connect, type ConnectOptions } from "./connect.js";
 export { link, waitForSession, type LinkOptions, type LinkResult, type WaitForSessionOptions } from "./bootstrap.js";
 export { AppductError, type AppductErrorType } from "./errors.js";
 export type { AppClient, AppEvent, CallOptions, EventsOptions, EventsResult, ToolMap, WaitForEventOptions, } from "./app-client.js";
-export type { AgentEndpoint, ErrorType, ToolDescriptor } from "@appduct/shared";
+export type { AgentEndpoint, ErrorType, ListedToolDescriptor, ToolDescriptor } from "@appduct/shared";

package/dist/client/index.js

@@ -4,6 +4,7 @@ import { RPC_METHODS as RPC_METHODS3 } from "@appduct/shared";
 // src/daemon/state-dir.ts
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var resolveStateDir = (override) => {
   return override ?? process.env.APPDUCT_STATE_DIR ?? join(homedir(), ".appduct");
 };
@@ -19,6 +20,13 @@ var getStateDirPaths = (stateDir) => {
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/rpc/client.ts
 import { connect as connect2 } from "node:net";
@@ -28,7 +36,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -284,7 +292,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -300,7 +308,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -641,6 +649,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {
@@ -1096,7 +1105,8 @@ var makeAppClient = (stream, sessionId) => {
         const result = await stream.call(RPC_METHODS2.toolsList, {
           selector: sessionId
         });
-        return Array.isArray(result) ? result : result.tools;
+        const entries = Array.isArray(result) ? result : result.tools;
+        return entries.map((entry) => ({ ...entry, group: entry.group ?? null }));
       } catch (error) {
         throw toAppductError(error);
       }

package/dist/mcp/app-tools.d.ts

@@ -9,7 +9,7 @@
  * Every lookup goes to the daemon live, with no caching: the session and its registry can change
  * between any two calls, and the daemon is the single source of truth for both.
  */
-import { type EffectivePolicyDecision, type ToolDescriptor } from "@appduct/shared";
+import { type EffectivePolicyDecision, type ListedToolDescriptor } from "@appduct/shared";
 import type { DaemonCall } from "./daemon-tools.js";
 export declare const LIST_TOOLS_TOOL_NAME = "appduct_list_tools";
 export declare const DESCRIBE_TOOL_TOOL_NAME = "appduct_describe_tool";
@@ -103,7 +103,7 @@ export declare const CALL_TOOL_TOOL_DESCRIPTOR: {
 export type ResolvedAppTool = {
     sessionId: string;
     alias: string;
-    descriptor: ToolDescriptor;
+    descriptor: ListedToolDescriptor;
     policy: EffectivePolicyDecision;
 };
 export type CallToolArgs = {
@@ -132,11 +132,11 @@ export declare const handleListToolsTool: (rawArgs: unknown, call: DaemonCall) =
 export declare const handleDescribeToolTool: (rawArgs: unknown, call: DaemonCall) => Promise<{
     name: string;
     description: string;
-    input_schema?: import("@appduct/shared").ToolSchemaDescriptor;
-    output_schema?: import("@appduct/shared").ToolSchemaDescriptor;
-    annotations?: import("@appduct/shared").ToolAnnotations;
-    timeout_ms?: number;
-    group?: string | null;
+    input_schema?: import("@appduct/shared").ToolSchemaDescriptor | undefined;
+    output_schema?: import("@appduct/shared").ToolSchemaDescriptor | undefined;
+    annotations?: import("@appduct/shared").ToolAnnotations | undefined;
+    timeout_ms?: number | undefined;
+    group: string | null;
     session: string;
     signature: string;
     policy: EffectivePolicyDecision;

package/dist/rpc/client.d.ts

@@ -1,7 +1,8 @@
 /**
  * The auto-spawning RPC client library (ARCHITECTURE.md §4, §5) used by the CLI, MCP server, and
- * tests to talk to `daemon.sock`. On `ENOENT`/`ECONNREFUSED` it takes an exclusive spawn-lock,
- * spawns `daemon run` detached, polls the socket until ready, then retries the request once.
+ * tests to talk to `daemon.sock`. On `ENOENT`/`ECONNREFUSED` it creates the state dir if it is
+ * missing, takes an exclusive spawn-lock, spawns `daemon run` detached, polls the socket until
+ * ready, then retries the request once.
  */
 import { type RpcErrorData } from "@appduct/shared";
 export type SpawnContext = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appduct",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Driving React Native tools without in-app debug UI.",
   "type": "module",
   "main": "./dist/index.js",
@@ -45,12 +45,13 @@
     "reflect-metadata": "^0.2.2",
     "toqr": "^0.1.1",
     "ws": "^8.18.3",
-    "@appduct/shared": "0.11.0"
+    "@appduct/shared": "0.11.1"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",
     "@types/ws": "^8.18.1",
     "esbuild": "^0.25.12",
+    "eslint": "^10",
     "typescript": "~5.9.2"
   },
   "files": [
@@ -60,6 +61,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json && node scripts/bundle.mjs",
     "clean": "rm -rf dist",
+    "lint": "eslint src",
     "test": "vitest run --config ../../vitest.config.ts src/__tests__",
     "typecheck": "tsc -p tsconfig.json"
   }