appduct 0.11.0 → 0.12.0

package/dist/cli/routes/events.js

@@ -9,7 +9,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -22,6 +22,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -81,6 +82,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -143,6 +145,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -236,18 +241,27 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -280,7 +294,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -296,7 +310,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -637,6 +651,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {
@@ -1019,7 +1034,8 @@ var handleEventsCommand = async (options, context) => {
   const stream = await openDaemonStream({ stateDir: context.stateDir, spawn: context.spawn });
   try {
     await stream.call(RPC_METHODS2.eventsSubscribe, {
-      sessionSelector: options.selector
+      sessionSelector: options.selector,
+      kinds: ["app_event"]
     });
   } catch (error) {
     stream.close();

package/dist/cli/routes/invoke.js

@@ -29,7 +29,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -42,6 +42,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -101,6 +102,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -163,6 +165,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -256,18 +261,27 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -300,7 +314,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -316,7 +330,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -657,6 +671,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {

package/dist/cli/routes/keygen.js

@@ -9,6 +9,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),

package/dist/cli/routes/link.js

@@ -12,7 +12,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -25,6 +25,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -84,6 +85,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -146,6 +148,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -239,18 +244,27 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -283,7 +297,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -299,7 +313,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -640,6 +654,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {

package/dist/cli/routes/ls.js

@@ -9,7 +9,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -22,6 +22,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -81,6 +82,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -143,6 +145,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -236,18 +241,27 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -280,7 +294,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -296,7 +310,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -637,6 +651,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {

package/dist/cli/routes/mcp.js

@@ -12,6 +12,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -71,6 +72,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -133,6 +135,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -171,18 +176,27 @@ var loadConfig = async (paths, options = {}) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/mcp/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -267,7 +281,7 @@ import { join as join4 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/pidfile.ts
 import { readFileSync as readFileSync3 } from "node:fs";
@@ -355,7 +369,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -371,7 +385,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -677,6 +691,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {
@@ -2531,7 +2546,10 @@ var toDescriptor = (entry) => {
     output_schema: entry.output_schema,
     annotations: entry.annotations,
     timeout_ms: entry.timeout_ms,
-    group: entry.group
+    // Normalised the same way the listing normalises it, so `appduct_describe_tool` never
+    // disagrees with `appduct_list_tools` about whether a tool has a group. The `?? null` also
+    // covers a daemon that predates groups and omits the key entirely.
+    group: entry.group ?? null
   };
 };
 var resolveSession = async (call, selector) => {
@@ -2638,27 +2656,24 @@ var resolveAppTool = async (call, selector, name) => {
 
 // src/mcp/events-tool.ts
 import {
-  RPC_METHODS as RPC_METHODS5,
-  EVENT_KINDS
+  RPC_METHODS as RPC_METHODS5
 } from "@appduct/shared";
 var EVENTS_TOOL_NAME = "appduct_events";
 var WAIT_FOR_EVENT_TOOL_NAME = "appduct_wait_for_event";
 var DEFAULT_WAIT_FOR_EVENT_TIMEOUT_MS = 12e4;
 var MAX_WAIT_FOR_EVENT_TIMEOUT_MS = 25 * 60 * 1e3;
 var WAIT_FOR_EVENT_PROGRESS_INTERVAL_MS = 6e4;
-var KNOWN_EVENT_KINDS = new Set(EVENT_KINDS);
 var clampWaitForEventTimeoutMs = (requestedMs) => {
   return Math.min(requestedMs ?? DEFAULT_WAIT_FOR_EVENT_TIMEOUT_MS, MAX_WAIT_FOR_EVENT_TIMEOUT_MS);
 };
 var EVENTS_TOOL_DESCRIPTOR = {
   name: EVENTS_TOOL_NAME,
-  description: "Drain events retained in the daemon's per-session ring buffer since a cursor \u2014 the pull counterpart to a live subscription, for checking what happened after calling a tool or triggering app behavior. With no selector, targets the sole active/suspended session. Returns { events, cursor }; pass cursor back as since on the next call to avoid re-reading events you've already seen. limit (if given) keeps the OLDEST events in the window and advances cursor only past what was actually returned, so repeated calls page forward through everything retained rather than skipping ahead.",
+  description: "Drain the events the app posted with postEvent(name, payload) that the daemon retained for a session since a cursor, for checking what the app reported after calling a tool or triggering app behavior. With no selector, targets the sole active/suspended session. Returns { events, cursor }; pass cursor back as since on the next call to avoid re-reading events you've already seen. limit (if given) keeps the OLDEST events in the window and advances cursor only past what was actually returned, so repeated calls page forward through everything retained rather than skipping ahead.",
   inputSchema: {
     type: "object",
     properties: {
       selector: { type: "string" },
       since: { type: "integer", minimum: 0 },
-      kinds: { type: "array", items: { type: "string", enum: EVENT_KINDS } },
       limit: { type: "integer", exclusiveMinimum: 0 }
     },
     additionalProperties: false
@@ -2722,14 +2737,13 @@ var asOptionalPositiveNumber2 = (value, field) => {
   }
   return value;
 };
-var asOptionalEventKinds = (value) => {
-  if (value === void 0) {
-    return void 0;
-  }
-  if (!Array.isArray(value) || !value.every((kind) => typeof kind === "string" && KNOWN_EVENT_KINDS.has(kind))) {
-    throw new McpBuiltinToolError("invalid_request", '"kinds" must be an array of known event kinds.');
+var rejectKinds = (args) => {
+  if (args.kinds !== void 0) {
+    throw new McpBuiltinToolError(
+      "invalid_request",
+      '"kinds" is not supported: these tools return only the events the app posted with postEvent.'
+    );
   }
-  return value;
 };
 var isMatchPrimitive = (value) => {
   return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
@@ -2754,10 +2768,10 @@ var asOptionalMatch = (value) => {
 };
 var handleEventsTool = async (rawArgs, deps) => {
   const args = asRecord3(rawArgs);
+  rejectKinds(args);
   return deps.call(RPC_METHODS5.eventsSince, {
     selector: asOptionalString2(args.selector, "selector"),
     since: asOptionalNonNegativeInteger(args.since, "since"),
-    kinds: asOptionalEventKinds(args.kinds),
     limit: asOptionalPositiveInteger(args.limit, "limit")
   });
 };
@@ -2770,6 +2784,7 @@ var payloadShallowMatches = (payload, match) => {
 };
 var handleWaitForEventTool = async (rawArgs, deps) => {
   const args = asRecord3(rawArgs);
+  rejectKinds(args);
   const selector = asOptionalString2(args.selector, "selector");
   const name = asOptionalString2(args.name, "name");
   if (!name) {
@@ -2812,8 +2827,7 @@ var handleWaitForEventTool = async (rawArgs, deps) => {
       await stream.call(RPC_METHODS5.eventsSubscribe, { sessionSelector: sessionId, kinds: ["app_event"] });
       const sinceResult = await stream.call(RPC_METHODS5.eventsSince, {
         selector: sessionId,
-        since,
-        kinds: ["app_event"]
+        since
       });
       const seenSeqs = /* @__PURE__ */ new Set();
       const backlog = [];

package/dist/cli/routes/revoke.js

@@ -9,7 +9,7 @@ import { join as join3 } from "node:path";
 import { RPC_METHODS } from "@appduct/shared";
 
 // src/daemon/log-rotation.ts
-import { chmod, rename, stat } from "node:fs/promises";
+import { chmod as chmod2, rename, stat } from "node:fs/promises";
 
 // src/daemon/config.ts
 import { readFile } from "node:fs/promises";
@@ -22,6 +22,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -81,6 +82,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -143,6 +145,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -236,18 +241,27 @@ var isSocketConnectable = (socketPath) => {
 
 // src/daemon/state-dir.ts
 import { join } from "node:path";
+import { mkdir, chmod } from "node:fs/promises";
 var getStateDirPaths = (stateDir) => {
   return {
     root: stateDir,
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),
     spawnLockPath: join(stateDir, "daemon.spawn.lock")
   };
 };
+var ensureStateDir = async (stateDir) => {
+  const paths = getStateDirPaths(stateDir);
+  await mkdir(paths.auditDir, { recursive: true });
+  await chmod(paths.root, 448);
+  await chmod(paths.auditDir, 448);
+  return paths;
+};
 
 // src/daemon/log-rotation.ts
 var STATE_FILE_MODE = 384;
@@ -280,7 +294,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
     const backupPath = daemonLogBackupPath(options.logFilePath);
     await rename(options.logFilePath, backupPath);
     try {
-      await chmod(backupPath, STATE_FILE_MODE);
+      await chmod2(backupPath, STATE_FILE_MODE);
     } catch (error) {
       warn(`appduct: rotated "${options.logFilePath}" but could not set 0600 on "${backupPath}": ${error.message}`);
     }
@@ -296,7 +310,7 @@ var rotateDaemonLogIfNeeded = async (options) => {
 var ensureDaemonLogMode = async (logFilePath, warn = (message) => process.stderr.write(`${message}
 `)) => {
   try {
-    await chmod(logFilePath, STATE_FILE_MODE);
+    await chmod2(logFilePath, STATE_FILE_MODE);
     return true;
   } catch (error) {
     warn(`appduct: could not set 0600 on "${logFilePath}": ${error.message}`);
@@ -637,6 +651,7 @@ var acquireSpawnLock = async (lockPath) => {
   return false;
 };
 var spawnDaemonAndWait = async (paths, spawn, waitTimeoutMs, pollIntervalMs, options = {}) => {
+  await ensureStateDir(paths.root);
   const acquiredLock = await acquireSpawnLock(paths.spawnLockPath);
   let lockWaitTimedOut = false;
   if (acquiredLock) {