appduct 0.11.0 → 0.12.0

package/README.md

@@ -42,7 +42,7 @@ That's the whole loop. There is no host process to start — `appduct` auto-spaw
 | `appduct tools [selector] [name] [--full] [--group <name>] [--filter <text>] [--limit <n>] [--offset <n>]` | list a session's tools (one call signature + description per line), or show one tool's full schema |
 | `appduct tools [selector] --groups` | list a session's tool groups with their tool counts |
 | `appduct invoke [selector] <tool> --input '<json>' [--timeout <ms>]` | call a tool |
-| `appduct events [selector] [--follow] [--since <cursor>]` | stream session/tool events (default), or one-shot pull everything retained since `<cursor>` (`--since`); `--json` emits NDJSON |
+| `appduct events [selector] [--follow] [--since <cursor>]` | stream the events the app posts with `postEvent` (default), or one-shot pull the ones retained since `<cursor>` (`--since`); `--json` emits NDJSON |
 | `appduct revoke [selector]` | revoke a session |
 | `appduct daemon run\|start\|stop\|status` | daemon lifecycle |
 | `appduct mcp [--scheme <s>]` | start a stdio MCP server proxying connected apps' tools to MCP clients |
@@ -232,7 +232,7 @@ import { connect } from "appduct/client";
 // auto-spawns the daemon and picks the single session, or pass { selector: "pixel-8" } to target one explicitly
 const app = await connect();
 
-await app.tools();                                  // ToolDescriptor[]
+await app.tools();                                  // ListedToolDescriptor[]; an ungrouped tool's group is null
 const { total } = await app.call("sum", { a: 2, b: 3 });
 const { payload } = await app.waitForEvent("checkout_done", { timeoutMs: 5_000 });
 app.close();
@@ -289,13 +289,13 @@ This writes an unencrypted PEM private key (PKCS#8) to `<state-dir>/key.pem` by
 
 ## Daemon lifecycle
 
-The daemon auto-starts the first time any CLI or MCP command needs it — you don't normally run `appduct daemon start` yourself. It writes state to `<state-dir>/` (`daemon.sock`, `daemon.pid`, `daemon.log`, `daemon.log.1`, `key.pem`, `config.json`, `audit/`), holds a single-instance lock via the pidfile, and runs independently of any one device's connection, so a reload or crash on the device side never costs you the daemon process.
+The daemon auto-starts the first time any CLI or MCP command needs it — you don't normally run `appduct daemon start` yourself. It writes state to `<state-dir>/` (`daemon.sock`, `daemon.pid`, `daemon.log`, `daemon.log.1`, `events.log`, `events.log.1`, `key.pem`, `config.json`, `audit/`), holds a single-instance lock via the pidfile, and runs independently of any one device's connection, so a reload or crash on the device side never costs you the daemon process.
 
 Use `appduct daemon status` to see what's running (version, pid, `wssPort`, pinned keys, live sessions, effective policy, and the audit log's retention window, file count, size, and failure counters) and `appduct daemon stop` to shut it down explicitly.
 
 Because the daemon outlives the CLI that started it, upgrading Appduct would otherwise leave the old daemon serving your commands. Every CLI/MCP process compares its version with the daemon's on its first command and replaces a stale daemon when nothing would be lost; when there is something at stake — connected sessions, or an unexpired link nobody has scanned yet — the command stops instead, naming both versions, until you run `appduct daemon stop` or pass `--daemon-restart`. A daemon newer than your CLI is left alone with a warning, so a project-local install never downgrades a global one's daemon.
 
-Neither log grows without bound: `audit/<YYYY-MM-DD>.jsonl` files older than `auditRetentionDays` (default 30) are pruned at daemon start and once a day after, and a `daemon.log` over `daemonLogMaxBytes` (default 10 MiB) is rotated to `daemon.log.1` when a daemon is next spawned. Both are `config.json` keys — see [`ARCHITECTURE.md` §3][architecture].
+No log grows without bound: `audit/<YYYY-MM-DD>.jsonl` files older than `auditRetentionDays` (default 30) are pruned at daemon start and once a day after, a `daemon.log` over `daemonLogMaxBytes` (default 10 MiB) is rotated to `daemon.log.1` when a daemon is next spawned, and `events.log` is rotated to `events.log.1` as soon as it passes `eventsLogMaxBytes` (default 10 MiB). `events.log` records the daemon's own events (links, sessions, tool registries and tool calls), one JSON line each, for debugging Appduct itself; your app's events are never written to it. All three are `config.json` keys — see [`ARCHITECTURE.md` §3][architecture].
 
 ## Release gate: `appduct doctor`
 

package/dist/bin.js

@@ -142,7 +142,7 @@ var createCli = () => {
     "--timeout <ms>",
     "Call timeout in milliseconds. Shortens the deadline; it cannot extend one past the app's own timer, which is the tool's declared timeoutMs (else 10000)."
   );
-  cli.command("events [selector]", "Stream session/tool events until interrupted.").option("--follow", "Accepted for script readability; the default behavior already follows.").option("--since <cursor>", "One-shot: print events retained since this cursor instead of streaming live.");
+  cli.command("events [selector]", "Stream the events the app posts until interrupted.").option("--follow", "Accepted for script readability; the default behavior already follows.").option("--since <cursor>", "One-shot: print the app events retained since this cursor instead of streaming live.");
   cli.command("revoke [selector]", "Revoke a session.");
   cli.command("mcp", "Start a stdio MCP server that gives MCP clients access to connected apps' tools.").option(
     "--scheme <scheme>",
@@ -166,6 +166,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -225,6 +226,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -287,6 +289,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -335,6 +340,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join3(stateDir, "daemon.sock"),
     pidFilePath: join3(stateDir, "daemon.pid"),
     logFilePath: join3(stateDir, "daemon.log"),
+    eventsLogPath: join3(stateDir, "events.log"),
     keyPath: join3(stateDir, "key.pem"),
     configPath: join3(stateDir, "config.json"),
     auditDir: join3(stateDir, "audit"),

package/dist/cli/result-types.d.ts

@@ -4,7 +4,7 @@
  * the thin-client shapes for the v2 command table.
  */
 import type { OpenTarget } from "./open-target.js";
-import type { AgentEndpoint, EffectivePolicyDecision, EventNotification, SessionSummary, ToolDescriptor, ToolGroupSummary, ToolsListResult } from "@appduct/shared";
+import type { AgentEndpoint, EffectivePolicyDecision, EventNotification, SessionSummary, ToolGroupSummary, ToolsListEntry, ToolsListResult } from "@appduct/shared";
 /**
  * CLI-domain error classes, used only to pick a sysexits-style exit code (see `errors.ts`).
  * `CliError.type` itself is *not* restricted to this union: RPC/app-originated failures preserve
@@ -129,9 +129,10 @@ export type ToolGroupsListing = {
     /** Every tool in the session, grouped or not. */
     total: number;
 };
-/** `appduct tools`: a listing, a groups summary (`--groups`), or a single descriptor when a tool
- * name resolved to a detail lookup. */
-export type ToolsCommandData = ToolsListing | ToolGroupsListing | ToolDescriptor;
+/** `appduct tools`: a listing, a groups summary (`--groups`), or a single entry when a tool name
+ * resolved to a detail lookup. The detail form is the daemon's own listing entry, picked out of
+ * `tools.list` — not a registration, so its `group` is `null` for an ungrouped tool. */
+export type ToolsCommandData = ToolsListing | ToolGroupsListing | ToolsListEntry;
 /** `appduct invoke`: the tool's raw result payload, printed as-is. */
 export type InvokeCommandData = unknown;
 export type RevokeCommandData = {

package/dist/cli/routes/daemon/run.js

@@ -139,6 +139,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -198,6 +199,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -260,6 +262,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -609,7 +614,6 @@ var createCallsManager = (options) => {
 
 // src/daemon/event-bus.ts
 var TERMINAL_EVENT_KINDS = /* @__PURE__ */ new Set(["session_expired", "session_revoked"]);
-var EXCLUDED_FROM_RETENTION = /* @__PURE__ */ new Set(["tool_call_progress"]);
 var createEventBus = (options = {}) => {
   const clock = options.clock ?? { now: () => /* @__PURE__ */ new Date() };
   const bufferSize = options.bufferSize ?? 256;
@@ -640,7 +644,7 @@ var createEventBus = (options = {}) => {
         if (TERMINAL_EVENT_KINDS.has(notification.kind)) {
           buffers.delete(sessionId);
           cursors.delete(sessionId);
-        } else if (!EXCLUDED_FROM_RETENTION.has(notification.kind)) {
+        } else if (notification.kind === "app_event") {
           appendToBuffer(sessionId, notification);
         }
       }
@@ -664,10 +668,6 @@ var createEventBus = (options = {}) => {
       if (query.since !== void 0) {
         events = events.filter((event) => event.seq > query.since);
       }
-      if (query.kinds !== void 0) {
-        const kinds = new Set(query.kinds);
-        events = events.filter((event) => kinds.has(event.kind));
-      }
       if (query.limit !== void 0 && events.length > query.limit) {
         events = events.slice(0, query.limit);
       }
@@ -681,6 +681,28 @@ var createEventBus = (options = {}) => {
   };
 };
 
+// src/daemon/events-log.ts
+var createEventsLog = (options) => {
+  const { file, maxBytes, warn } = options;
+  let queue = Promise.resolve();
+  return {
+    record: (event) => {
+      const line = JSON.stringify(event);
+      queue = queue.then(async () => {
+        try {
+          await file.append(line);
+          if (await file.size() > maxBytes) {
+            await file.rotate();
+          }
+        } catch (error) {
+          warn(`appduct daemon: failed to write events.log: ${error.message}`);
+        }
+      });
+    },
+    flush: () => queue
+  };
+};
+
 // src/daemon/listener.ts
 import { createServer as createHttpsServer } from "node:https";
 import { isSessionClaimMessage, isSessionResumeMessage, isSessionBoundMessage } from "@appduct/shared";
@@ -1409,6 +1431,37 @@ var acquirePidfile = async (pidFilePath, options = {}) => {
   throw new Error(`Failed to acquire the Appduct daemon pidfile at "${pidFilePath}".`);
 };
 
+// src/daemon/node-append-only-file.ts
+import { open as open3, rename, stat as stat2 } from "node:fs/promises";
+var NodeAppendOnlyFile = class {
+  constructor(path) {
+    this.path = path;
+  }
+  async append(line) {
+    const handle = await open3(this.path, "a", 384);
+    try {
+      await handle.appendFile(`${line}
+`);
+      await handle.chmod(384);
+    } finally {
+      await handle.close();
+    }
+  }
+  async size() {
+    try {
+      return (await stat2(this.path)).size;
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return 0;
+      }
+      throw error;
+    }
+  }
+  async rotate() {
+    await rename(this.path, `${this.path}.1`);
+  }
+};
+
 // src/daemon/rpc-server.ts
 import { createServer } from "node:net";
 import { chmod as chmod2, rm as rm3 } from "node:fs/promises";
@@ -1594,6 +1647,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join4(stateDir, "daemon.sock"),
     pidFilePath: join4(stateDir, "daemon.pid"),
     logFilePath: join4(stateDir, "daemon.log"),
+    eventsLogPath: join4(stateDir, "events.log"),
     keyPath: join4(stateDir, "key.pem"),
     configPath: join4(stateDir, "config.json"),
     auditDir: join4(stateDir, "audit"),
@@ -1612,7 +1666,7 @@ var ensureStateDir = async (stateDir) => {
 };
 
 // src/daemon/tls.ts
-import { stat as stat2, readFile as readFile3 } from "node:fs/promises";
+import { stat as stat3, readFile as readFile3 } from "node:fs/promises";
 
 // src/host-certificate.ts
 import "reflect-metadata";
@@ -1789,7 +1843,7 @@ var generateHostCertificate = async (keyPem, advertisedIp) => {
 // src/key-material.ts
 import { generateKeyPairSync } from "node:crypto";
 import { dirname as dirname2 } from "node:path";
-import { mkdir as mkdir3, rename, rm as rm4, writeFile } from "node:fs/promises";
+import { mkdir as mkdir3, rename as rename2, rm as rm4, writeFile } from "node:fs/promises";
 var generatePrivateKeyPem = () => {
   const { privateKey } = generateKeyPairSync("rsa", {
     modulusLength: 2048,
@@ -1809,7 +1863,7 @@ var writePrivateKeyAtomically = async (path, keyPem) => {
       mode: 384,
       flag: "wx"
     });
-    await rename(temporaryPath, path);
+    await rename2(temporaryPath, path);
   } catch (error) {
     await rm4(temporaryPath, { force: true }).catch(() => {
     });
@@ -1825,7 +1879,7 @@ var HostKeyError = class extends Error {
   }
 };
 var loadHostKeyPem = async (keyPath) => {
-  const fileStat = await stat2(keyPath);
+  const fileStat = await stat3(keyPath);
   if ((fileStat.mode & 63) !== 0) {
     throw new HostKeyError(
       `Appduct host key at "${keyPath}" is group- or world-readable (mode ${(fileStat.mode & 511).toString(8)}). Refusing to load it \u2014 run "chmod 600 ${keyPath}" or re-run "appduct keygen".`
@@ -2030,14 +2084,6 @@ var asEventsSinceParams = (params) => {
   if (since !== void 0 && (typeof since !== "number" || !Number.isInteger(since) || since < 0)) {
     throw new RpcApplicationError("invalid_request", '"since" must be a non-negative integer.');
   }
-  const kindsRaw = record.kinds;
-  let kinds;
-  if (kindsRaw !== void 0) {
-    if (!Array.isArray(kindsRaw) || !kindsRaw.every((kind) => typeof kind === "string" && KNOWN_EVENT_KINDS.has(kind))) {
-      throw new RpcApplicationError("invalid_request", '"kinds" must be an array of known event kinds.');
-    }
-    kinds = kindsRaw;
-  }
   const limit = record.limit;
   if (limit !== void 0 && (typeof limit !== "number" || !Number.isInteger(limit) || limit <= 0)) {
     throw new RpcApplicationError("invalid_request", '"limit" must be a positive integer.');
@@ -2045,7 +2091,6 @@ var asEventsSinceParams = (params) => {
   return {
     selector,
     since,
-    kinds,
     limit
   };
 };
@@ -2080,10 +2125,19 @@ var startDaemon = async (options) => {
     retentionDays: config.auditRetentionDays,
     warn: options.warn
   });
+  const eventsLog = createEventsLog({
+    file: new NodeAppendOnlyFile(paths.eventsLogPath),
+    maxBytes: config.eventsLogMaxBytes,
+    warn: options.warn ?? ((message) => {
+      process.stderr.write(`${message}
+`);
+    })
+  });
   let auditPruneInterval;
   let pidfile;
   let server;
   let listener;
+  let tlsManager;
   let sessionManager;
   let callsManager;
   let eventBus;
@@ -2110,6 +2164,7 @@ var startDaemon = async (options) => {
       await pidfile?.release();
       await rm5(getSocketPath(paths), { force: true });
       await auditLogger.flush();
+      await eventsLog.flush();
     } finally {
       resolveExited();
     }
@@ -2122,8 +2177,14 @@ var startDaemon = async (options) => {
     });
     eventBus = createEventBus({ clock, bufferSize: config.eventBufferSize });
     const activeEventBus = eventBus;
+    activeEventBus.subscribe((event) => {
+      if (event.kind !== "app_event") {
+        eventsLog.record(event);
+      }
+    });
     const detectAddress = options.detectAddress ?? (() => detectAdvertisedAddress({ override: config.advertisedIp }));
     const tls = await createTlsManager({ keyPath: config.keyPath, detectAddress, warn: options.warn });
+    tlsManager = tls;
     sessionManager = createSessionManager({
       graceSeconds: config.graceSeconds,
       keepaliveIntervalSeconds: config.keepaliveIntervalSeconds,
@@ -2367,9 +2428,9 @@ var startDaemon = async (options) => {
           return { ok: true };
         },
         [RPC_METHODS.eventsSince]: (params) => {
-          const { selector, since, kinds, limit } = asEventsSinceParams(params);
+          const { selector, since, limit } = asEventsSinceParams(params);
           const resolved = activeSessionManager.describe(selector);
-          return activeEventBus.since(resolved.sessionId, { since, kinds, limit });
+          return activeEventBus.since(resolved.sessionId, { since, limit });
         }
       }
     });
@@ -2395,6 +2456,7 @@ var startDaemon = async (options) => {
     startedAt,
     server,
     listener,
+    tls: tlsManager,
     eventBus,
     exited,
     shutdown

package/dist/cli/routes/daemon/start.js

@@ -9,7 +9,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -22,6 +22,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -81,6 +82,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -143,6 +145,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -236,18 +241,27 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -280,7 +294,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -296,7 +310,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -637,6 +651,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {

package/dist/cli/routes/daemon/status.js

@@ -53,7 +53,7 @@ import { join as join4 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -66,6 +66,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -125,6 +126,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -187,6 +189,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -280,18 +285,27 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join as join3 } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
     socketPath: join3(stateDir, "daemon.sock"),
     pidFilePath: join3(stateDir, "daemon.pid"),
     logFilePath: join3(stateDir, "daemon.log"),
+    eventsLogPath: join3(stateDir, "events.log"),
     keyPath: join3(stateDir, "key.pem"),
     configPath: join3(stateDir, "config.json"),
     auditDir: join3(stateDir, "audit"),
     spawnLockPath: join3(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -324,7 +338,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -340,7 +354,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -646,6 +660,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {

package/dist/cli/routes/daemon/stop.js

@@ -42,18 +42,27 @@ var readPidFromFile = async (pidFilePath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/rpc/client.ts
 import { connect as connect2 } from "node:net";
@@ -63,7 +72,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile as readFile2 } from "node:fs/promises";
@@ -76,6 +85,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -135,6 +145,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -197,6 +208,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -280,7 +294,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -296,7 +310,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -637,6 +651,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {