appduct 0.11.1 → 0.12.0

package/README.md

@@ -42,7 +42,7 @@ That's the whole loop. There is no host process to start — `appduct` auto-spaw
 | `appduct tools [selector] [name] [--full] [--group <name>] [--filter <text>] [--limit <n>] [--offset <n>]` | list a session's tools (one call signature + description per line), or show one tool's full schema |
 | `appduct tools [selector] --groups` | list a session's tool groups with their tool counts |
 | `appduct invoke [selector] <tool> --input '<json>' [--timeout <ms>]` | call a tool |
-| `appduct events [selector] [--follow] [--since <cursor>]` | stream session/tool events (default), or one-shot pull everything retained since `<cursor>` (`--since`); `--json` emits NDJSON |
+| `appduct events [selector] [--follow] [--since <cursor>]` | stream the events the app posts with `postEvent` (default), or one-shot pull the ones retained since `<cursor>` (`--since`); `--json` emits NDJSON |
 | `appduct revoke [selector]` | revoke a session |
 | `appduct daemon run\|start\|stop\|status` | daemon lifecycle |
 | `appduct mcp [--scheme <s>]` | start a stdio MCP server proxying connected apps' tools to MCP clients |
@@ -289,13 +289,13 @@ This writes an unencrypted PEM private key (PKCS#8) to `<state-dir>/key.pem` by
 
 ## Daemon lifecycle
 
-The daemon auto-starts the first time any CLI or MCP command needs it — you don't normally run `appduct daemon start` yourself. It writes state to `<state-dir>/` (`daemon.sock`, `daemon.pid`, `daemon.log`, `daemon.log.1`, `key.pem`, `config.json`, `audit/`), holds a single-instance lock via the pidfile, and runs independently of any one device's connection, so a reload or crash on the device side never costs you the daemon process.
+The daemon auto-starts the first time any CLI or MCP command needs it — you don't normally run `appduct daemon start` yourself. It writes state to `<state-dir>/` (`daemon.sock`, `daemon.pid`, `daemon.log`, `daemon.log.1`, `events.log`, `events.log.1`, `key.pem`, `config.json`, `audit/`), holds a single-instance lock via the pidfile, and runs independently of any one device's connection, so a reload or crash on the device side never costs you the daemon process.
 
 Use `appduct daemon status` to see what's running (version, pid, `wssPort`, pinned keys, live sessions, effective policy, and the audit log's retention window, file count, size, and failure counters) and `appduct daemon stop` to shut it down explicitly.
 
 Because the daemon outlives the CLI that started it, upgrading Appduct would otherwise leave the old daemon serving your commands. Every CLI/MCP process compares its version with the daemon's on its first command and replaces a stale daemon when nothing would be lost; when there is something at stake — connected sessions, or an unexpired link nobody has scanned yet — the command stops instead, naming both versions, until you run `appduct daemon stop` or pass `--daemon-restart`. A daemon newer than your CLI is left alone with a warning, so a project-local install never downgrades a global one's daemon.
 
-Neither log grows without bound: `audit/<YYYY-MM-DD>.jsonl` files older than `auditRetentionDays` (default 30) are pruned at daemon start and once a day after, and a `daemon.log` over `daemonLogMaxBytes` (default 10 MiB) is rotated to `daemon.log.1` when a daemon is next spawned. Both are `config.json` keys — see [`ARCHITECTURE.md` §3][architecture].
+No log grows without bound: `audit/<YYYY-MM-DD>.jsonl` files older than `auditRetentionDays` (default 30) are pruned at daemon start and once a day after, a `daemon.log` over `daemonLogMaxBytes` (default 10 MiB) is rotated to `daemon.log.1` when a daemon is next spawned, and `events.log` is rotated to `events.log.1` as soon as it passes `eventsLogMaxBytes` (default 10 MiB). `events.log` records the daemon's own events (links, sessions, tool registries and tool calls), one JSON line each, for debugging Appduct itself; your app's events are never written to it. All three are `config.json` keys — see [`ARCHITECTURE.md` §3][architecture].
 
 ## Release gate: `appduct doctor`
 

package/dist/bin.js

@@ -142,7 +142,7 @@ var createCli = () => {
     "--timeout <ms>",
     "Call timeout in milliseconds. Shortens the deadline; it cannot extend one past the app's own timer, which is the tool's declared timeoutMs (else 10000)."
   );
-  cli.command("events [selector]", "Stream session/tool events until interrupted.").option("--follow", "Accepted for script readability; the default behavior already follows.").option("--since <cursor>", "One-shot: print events retained since this cursor instead of streaming live.");
+  cli.command("events [selector]", "Stream the events the app posts until interrupted.").option("--follow", "Accepted for script readability; the default behavior already follows.").option("--since <cursor>", "One-shot: print the app events retained since this cursor instead of streaming live.");
   cli.command("revoke [selector]", "Revoke a session.");
   cli.command("mcp", "Start a stdio MCP server that gives MCP clients access to connected apps' tools.").option(
     "--scheme <scheme>",
@@ -166,6 +166,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -225,6 +226,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -287,6 +289,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -335,6 +340,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join3(stateDir, "daemon.sock"),
     pidFilePath: join3(stateDir, "daemon.pid"),
     logFilePath: join3(stateDir, "daemon.log"),
+    eventsLogPath: join3(stateDir, "events.log"),
     keyPath: join3(stateDir, "key.pem"),
     configPath: join3(stateDir, "config.json"),
     auditDir: join3(stateDir, "audit"),

package/dist/cli/routes/daemon/run.js

@@ -139,6 +139,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -198,6 +199,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -260,6 +262,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -609,7 +614,6 @@ var createCallsManager = (options) => {
 
 // src/daemon/event-bus.ts
 var TERMINAL_EVENT_KINDS = /* @__PURE__ */ new Set(["session_expired", "session_revoked"]);
-var EXCLUDED_FROM_RETENTION = /* @__PURE__ */ new Set(["tool_call_progress"]);
 var createEventBus = (options = {}) => {
   const clock = options.clock ?? { now: () => /* @__PURE__ */ new Date() };
   const bufferSize = options.bufferSize ?? 256;
@@ -640,7 +644,7 @@ var createEventBus = (options = {}) => {
         if (TERMINAL_EVENT_KINDS.has(notification.kind)) {
           buffers.delete(sessionId);
           cursors.delete(sessionId);
-        } else if (!EXCLUDED_FROM_RETENTION.has(notification.kind)) {
+        } else if (notification.kind === "app_event") {
           appendToBuffer(sessionId, notification);
         }
       }
@@ -664,10 +668,6 @@ var createEventBus = (options = {}) => {
       if (query.since !== void 0) {
         events = events.filter((event) => event.seq > query.since);
       }
-      if (query.kinds !== void 0) {
-        const kinds = new Set(query.kinds);
-        events = events.filter((event) => kinds.has(event.kind));
-      }
       if (query.limit !== void 0 && events.length > query.limit) {
         events = events.slice(0, query.limit);
       }
@@ -681,6 +681,28 @@ var createEventBus = (options = {}) => {
   };
 };
 
+// src/daemon/events-log.ts
+var createEventsLog = (options) => {
+  const { file, maxBytes, warn } = options;
+  let queue = Promise.resolve();
+  return {
+    record: (event) => {
+      const line = JSON.stringify(event);
+      queue = queue.then(async () => {
+        try {
+          await file.append(line);
+          if (await file.size() > maxBytes) {
+            await file.rotate();
+          }
+        } catch (error) {
+          warn(`appduct daemon: failed to write events.log: ${error.message}`);
+        }
+      });
+    },
+    flush: () => queue
+  };
+};
+
 // src/daemon/listener.ts
 import { createServer as createHttpsServer } from "node:https";
 import { isSessionClaimMessage, isSessionResumeMessage, isSessionBoundMessage } from "@appduct/shared";
@@ -1409,6 +1431,37 @@ var acquirePidfile = async (pidFilePath, options = {}) => {
   throw new Error(`Failed to acquire the Appduct daemon pidfile at "${pidFilePath}".`);
 };
 
+// src/daemon/node-append-only-file.ts
+import { open as open3, rename, stat as stat2 } from "node:fs/promises";
+var NodeAppendOnlyFile = class {
+  constructor(path) {
+    this.path = path;
+  }
+  async append(line) {
+    const handle = await open3(this.path, "a", 384);
+    try {
+      await handle.appendFile(`${line}
+`);
+      await handle.chmod(384);
+    } finally {
+      await handle.close();
+    }
+  }
+  async size() {
+    try {
+      return (await stat2(this.path)).size;
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return 0;
+      }
+      throw error;
+    }
+  }
+  async rotate() {
+    await rename(this.path, `${this.path}.1`);
+  }
+};
+
 // src/daemon/rpc-server.ts
 import { createServer } from "node:net";
 import { chmod as chmod2, rm as rm3 } from "node:fs/promises";
@@ -1594,6 +1647,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join4(stateDir, "daemon.sock"),
     pidFilePath: join4(stateDir, "daemon.pid"),
     logFilePath: join4(stateDir, "daemon.log"),
+    eventsLogPath: join4(stateDir, "events.log"),
     keyPath: join4(stateDir, "key.pem"),
     configPath: join4(stateDir, "config.json"),
     auditDir: join4(stateDir, "audit"),
@@ -1612,7 +1666,7 @@ var ensureStateDir = async (stateDir) => {
 };
 
 // src/daemon/tls.ts
-import { stat as stat2, readFile as readFile3 } from "node:fs/promises";
+import { stat as stat3, readFile as readFile3 } from "node:fs/promises";
 
 // src/host-certificate.ts
 import "reflect-metadata";
@@ -1789,7 +1843,7 @@ var generateHostCertificate = async (keyPem, advertisedIp) => {
 // src/key-material.ts
 import { generateKeyPairSync } from "node:crypto";
 import { dirname as dirname2 } from "node:path";
-import { mkdir as mkdir3, rename, rm as rm4, writeFile } from "node:fs/promises";
+import { mkdir as mkdir3, rename as rename2, rm as rm4, writeFile } from "node:fs/promises";
 var generatePrivateKeyPem = () => {
   const { privateKey } = generateKeyPairSync("rsa", {
     modulusLength: 2048,
@@ -1809,7 +1863,7 @@ var writePrivateKeyAtomically = async (path, keyPem) => {
       mode: 384,
       flag: "wx"
     });
-    await rename(temporaryPath, path);
+    await rename2(temporaryPath, path);
   } catch (error) {
     await rm4(temporaryPath, { force: true }).catch(() => {
     });
@@ -1825,7 +1879,7 @@ var HostKeyError = class extends Error {
   }
 };
 var loadHostKeyPem = async (keyPath) => {
-  const fileStat = await stat2(keyPath);
+  const fileStat = await stat3(keyPath);
   if ((fileStat.mode & 63) !== 0) {
     throw new HostKeyError(
       `Appduct host key at "${keyPath}" is group- or world-readable (mode ${(fileStat.mode & 511).toString(8)}). Refusing to load it \u2014 run "chmod 600 ${keyPath}" or re-run "appduct keygen".`
@@ -2030,14 +2084,6 @@ var asEventsSinceParams = (params) => {
   if (since !== void 0 && (typeof since !== "number" || !Number.isInteger(since) || since < 0)) {
     throw new RpcApplicationError("invalid_request", '"since" must be a non-negative integer.');
   }
-  const kindsRaw = record.kinds;
-  let kinds;
-  if (kindsRaw !== void 0) {
-    if (!Array.isArray(kindsRaw) || !kindsRaw.every((kind) => typeof kind === "string" && KNOWN_EVENT_KINDS.has(kind))) {
-      throw new RpcApplicationError("invalid_request", '"kinds" must be an array of known event kinds.');
-    }
-    kinds = kindsRaw;
-  }
   const limit = record.limit;
   if (limit !== void 0 && (typeof limit !== "number" || !Number.isInteger(limit) || limit <= 0)) {
     throw new RpcApplicationError("invalid_request", '"limit" must be a positive integer.');
@@ -2045,7 +2091,6 @@ var asEventsSinceParams = (params) => {
   return {
     selector,
     since,
-    kinds,
     limit
   };
 };
@@ -2080,10 +2125,19 @@ var startDaemon = async (options) => {
     retentionDays: config.auditRetentionDays,
     warn: options.warn
   });
+  const eventsLog = createEventsLog({
+    file: new NodeAppendOnlyFile(paths.eventsLogPath),
+    maxBytes: config.eventsLogMaxBytes,
+    warn: options.warn ?? ((message) => {
+      process.stderr.write(`${message}
+`);
+    })
+  });
   let auditPruneInterval;
   let pidfile;
   let server;
   let listener;
+  let tlsManager;
   let sessionManager;
   let callsManager;
   let eventBus;
@@ -2110,6 +2164,7 @@ var startDaemon = async (options) => {
       await pidfile?.release();
       await rm5(getSocketPath(paths), { force: true });
       await auditLogger.flush();
+      await eventsLog.flush();
     } finally {
       resolveExited();
     }
@@ -2122,8 +2177,14 @@ var startDaemon = async (options) => {
     });
     eventBus = createEventBus({ clock, bufferSize: config.eventBufferSize });
     const activeEventBus = eventBus;
+    activeEventBus.subscribe((event) => {
+      if (event.kind !== "app_event") {
+        eventsLog.record(event);
+      }
+    });
     const detectAddress = options.detectAddress ?? (() => detectAdvertisedAddress({ override: config.advertisedIp }));
     const tls = await createTlsManager({ keyPath: config.keyPath, detectAddress, warn: options.warn });
+    tlsManager = tls;
     sessionManager = createSessionManager({
       graceSeconds: config.graceSeconds,
       keepaliveIntervalSeconds: config.keepaliveIntervalSeconds,
@@ -2367,9 +2428,9 @@ var startDaemon = async (options) => {
           return { ok: true };
         },
         [RPC_METHODS.eventsSince]: (params) => {
-          const { selector, since, kinds, limit } = asEventsSinceParams(params);
+          const { selector, since, limit } = asEventsSinceParams(params);
           const resolved = activeSessionManager.describe(selector);
-          return activeEventBus.since(resolved.sessionId, { since, kinds, limit });
+          return activeEventBus.since(resolved.sessionId, { since, limit });
         }
       }
     });
@@ -2395,6 +2456,7 @@ var startDaemon = async (options) => {
     startedAt,
     server,
     listener,
+    tls: tlsManager,
     eventBus,
     exited,
     shutdown

package/dist/cli/routes/daemon/start.js

@@ -22,6 +22,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -81,6 +82,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -143,6 +145,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -243,6 +248,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),

package/dist/cli/routes/daemon/status.js

@@ -66,6 +66,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -125,6 +126,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -187,6 +189,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -287,6 +292,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join3(stateDir, "daemon.sock"),
     pidFilePath: join3(stateDir, "daemon.pid"),
     logFilePath: join3(stateDir, "daemon.log"),
+    eventsLogPath: join3(stateDir, "events.log"),
     keyPath: join3(stateDir, "key.pem"),
     configPath: join3(stateDir, "config.json"),
     auditDir: join3(stateDir, "audit"),

package/dist/cli/routes/daemon/stop.js

@@ -49,6 +49,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),
@@ -84,6 +85,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -143,6 +145,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -205,6 +208,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,

package/dist/cli/routes/events.js

@@ -22,6 +22,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -81,6 +82,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -143,6 +145,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -243,6 +248,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),
@@ -1028,7 +1034,8 @@ var handleEventsCommand = async (options, context) => {
   const stream = await openDaemonStream({ stateDir: context.stateDir, spawn: context.spawn });
   try {
     await stream.call(RPC_METHODS2.eventsSubscribe, {
-      sessionSelector: options.selector
+      sessionSelector: options.selector,
+      kinds: ["app_event"]
     });
   } catch (error) {
     stream.close();

package/dist/cli/routes/invoke.js

@@ -42,6 +42,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -101,6 +102,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -163,6 +165,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -263,6 +268,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),

package/dist/cli/routes/keygen.js

@@ -9,6 +9,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),

package/dist/cli/routes/link.js

@@ -25,6 +25,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -84,6 +85,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -146,6 +148,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -246,6 +251,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),

package/dist/cli/routes/ls.js

@@ -22,6 +22,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -81,6 +82,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -143,6 +145,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -243,6 +248,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),

package/dist/cli/routes/mcp.js

@@ -12,6 +12,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -71,6 +72,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -133,6 +135,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -178,6 +183,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),
@@ -2650,27 +2656,24 @@ var resolveAppTool = async (call, selector, name) => {
 
 // src/mcp/events-tool.ts
 import {
-  RPC_METHODS as RPC_METHODS5,
-  EVENT_KINDS
+  RPC_METHODS as RPC_METHODS5
 } from "@appduct/shared";
 var EVENTS_TOOL_NAME = "appduct_events";
 var WAIT_FOR_EVENT_TOOL_NAME = "appduct_wait_for_event";
 var DEFAULT_WAIT_FOR_EVENT_TIMEOUT_MS = 12e4;
 var MAX_WAIT_FOR_EVENT_TIMEOUT_MS = 25 * 60 * 1e3;
 var WAIT_FOR_EVENT_PROGRESS_INTERVAL_MS = 6e4;
-var KNOWN_EVENT_KINDS = new Set(EVENT_KINDS);
 var clampWaitForEventTimeoutMs = (requestedMs) => {
   return Math.min(requestedMs ?? DEFAULT_WAIT_FOR_EVENT_TIMEOUT_MS, MAX_WAIT_FOR_EVENT_TIMEOUT_MS);
 };
 var EVENTS_TOOL_DESCRIPTOR = {
   name: EVENTS_TOOL_NAME,
-  description: "Drain events retained in the daemon's per-session ring buffer since a cursor \u2014 the pull counterpart to a live subscription, for checking what happened after calling a tool or triggering app behavior. With no selector, targets the sole active/suspended session. Returns { events, cursor }; pass cursor back as since on the next call to avoid re-reading events you've already seen. limit (if given) keeps the OLDEST events in the window and advances cursor only past what was actually returned, so repeated calls page forward through everything retained rather than skipping ahead.",
+  description: "Drain the events the app posted with postEvent(name, payload) that the daemon retained for a session since a cursor, for checking what the app reported after calling a tool or triggering app behavior. With no selector, targets the sole active/suspended session. Returns { events, cursor }; pass cursor back as since on the next call to avoid re-reading events you've already seen. limit (if given) keeps the OLDEST events in the window and advances cursor only past what was actually returned, so repeated calls page forward through everything retained rather than skipping ahead.",
   inputSchema: {
     type: "object",
     properties: {
       selector: { type: "string" },
       since: { type: "integer", minimum: 0 },
-      kinds: { type: "array", items: { type: "string", enum: EVENT_KINDS } },
       limit: { type: "integer", exclusiveMinimum: 0 }
     },
     additionalProperties: false
@@ -2734,14 +2737,13 @@ var asOptionalPositiveNumber2 = (value, field) => {
   }
   return value;
 };
-var asOptionalEventKinds = (value) => {
-  if (value === void 0) {
-    return void 0;
-  }
-  if (!Array.isArray(value) || !value.every((kind) => typeof kind === "string" && KNOWN_EVENT_KINDS.has(kind))) {
-    throw new McpBuiltinToolError("invalid_request", '"kinds" must be an array of known event kinds.');
+var rejectKinds = (args) => {
+  if (args.kinds !== void 0) {
+    throw new McpBuiltinToolError(
+      "invalid_request",
+      '"kinds" is not supported: these tools return only the events the app posted with postEvent.'
+    );
   }
-  return value;
 };
 var isMatchPrimitive = (value) => {
   return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
@@ -2766,10 +2768,10 @@ var asOptionalMatch = (value) => {
 };
 var handleEventsTool = async (rawArgs, deps) => {
   const args = asRecord3(rawArgs);
+  rejectKinds(args);
   return deps.call(RPC_METHODS5.eventsSince, {
     selector: asOptionalString2(args.selector, "selector"),
     since: asOptionalNonNegativeInteger(args.since, "since"),
-    kinds: asOptionalEventKinds(args.kinds),
     limit: asOptionalPositiveInteger(args.limit, "limit")
   });
 };
@@ -2782,6 +2784,7 @@ var payloadShallowMatches = (payload, match) => {
 };
 var handleWaitForEventTool = async (rawArgs, deps) => {
   const args = asRecord3(rawArgs);
+  rejectKinds(args);
   const selector = asOptionalString2(args.selector, "selector");
   const name = asOptionalString2(args.name, "name");
   if (!name) {
@@ -2824,8 +2827,7 @@ var handleWaitForEventTool = async (rawArgs, deps) => {
       await stream.call(RPC_METHODS5.eventsSubscribe, { sessionSelector: sessionId, kinds: ["app_event"] });
       const sinceResult = await stream.call(RPC_METHODS5.eventsSince, {
         selector: sessionId,
-        since,
-        kinds: ["app_event"]
+        since
       });
       const seenSeqs = /* @__PURE__ */ new Set();
       const backlog = [];

package/dist/cli/routes/revoke.js

@@ -22,6 +22,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -81,6 +82,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -143,6 +145,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -243,6 +248,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),

package/dist/cli/routes/tools.js

@@ -25,6 +25,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -84,6 +85,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -146,6 +148,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -246,6 +251,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),

package/dist/client/index.js

@@ -14,6 +14,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),
@@ -49,6 +50,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -108,6 +110,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -170,6 +173,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -1134,8 +1140,7 @@ var makeAppClient = (stream, sessionId) => {
         const result = await stream.call(RPC_METHODS2.eventsSince, {
           selector: sessionId,
           since: options.since,
-          limit: options.limit,
-          kinds: ["app_event"]
+          limit: options.limit
         });
         return {
           events: result.events.map((event) => appEventFrom(event, sessionId)).filter((event) => event !== void 0),
@@ -1194,8 +1199,7 @@ var makeAppClient = (stream, sessionId) => {
           await stream.call(RPC_METHODS2.eventsSubscribe, { sessionSelector: sessionId, kinds: ["app_event"] });
           const sinceResult = await stream.call(RPC_METHODS2.eventsSince, {
             selector: sessionId,
-            since: options.since,
-            kinds: ["app_event"]
+            since: options.since
           });
           const seenSeqs = /* @__PURE__ */ new Set();
           const backlog = [];

package/dist/commands/events.d.ts

@@ -1,6 +1,7 @@
 /**
- * `appduct events` (ARCHITECTURE.md §10): subscribes to `events.subscribe` over a persistent
- * connection and streams notifications until interrupted (Ctrl-C) or the connection drops. This is
+ * `appduct events` (ARCHITECTURE.md §10): subscribes to `events.subscribe` for `app_event` only
+ * over a persistent connection and streams the app's own events until interrupted (Ctrl-C) or the
+ * connection drops. Appduct's lifecycle and tool-call kinds are not printed (issue #98). This is
  * the one command whose output isn't a single rendered `CliResult` — each event is written as it
  * arrives (NDJSON under `--json`, a human line otherwise) — so it plugs into `executeHostedCommand`
  * with a live reporter that suppresses the default one-shot bootstrap render (`cli/runner.ts`).

package/dist/daemon/config.d.ts

@@ -34,7 +34,7 @@ export type AppductConfig = {
     graceSeconds: number;
     linkTtlSeconds: number;
     keepaliveIntervalSeconds: number;
-    /** Max retained `app_event`/etc. events per session (ARCHITECTURE.md §5's `events.since`
+    /** Max retained `app_event`s per session (ARCHITECTURE.md §5's `events.since`
      * retention buffer); default 256. */
     eventBufferSize: number;
     /** Days of `audit/<YYYY-MM-DD>.jsonl` history to keep; files older than this are pruned on
@@ -43,6 +43,9 @@ export type AppductConfig = {
     /** Size at which `daemon.log` is rotated to `daemon.log.1` before a daemon is spawned
      * (ARCHITECTURE.md §3/§4). Default 10 MiB. */
     daemonLogMaxBytes: number;
+    /** Size past which the daemon rotates `events.log` to `events.log.1` (ARCHITECTURE.md §3).
+     * Default 10 MiB. */
+    eventsLogMaxBytes: number;
     policy: AppductPolicyConfig;
     /**
      * When the CLI/MCP client finds the running daemon on a different Appduct version, restart it

package/dist/daemon/daemon.d.ts

@@ -14,6 +14,7 @@ import { type DaemonListener } from "./listener.js";
 import { type RpcServer } from "./rpc-server.js";
 import { type StateDirPaths } from "./state-dir.js";
 import { type TimerFns } from "./timers.js";
+import { type TlsManager } from "./tls.js";
 /** How often audit retention runs after the startup prune (ARCHITECTURE.md §3: "once a day"). */
 export declare const AUDIT_PRUNE_INTERVAL_MS: number;
 export type DaemonOptions = {
@@ -33,6 +34,8 @@ export type RunningDaemon = {
     startedAt: Date;
     server: RpcServer;
     listener: DaemonListener;
+    /** The host certificate the listener serves, so an in-process client can trust it. */
+    tls: TlsManager;
     eventBus: EventBus;
     /** Resolves once graceful teardown (sockets closed, RPC/listener closed, pidfile released) completes. */
     exited: Promise<void>;

package/dist/daemon/event-bus.d.ts

@@ -4,9 +4,10 @@
  * per-session retention ring buffer, and must never let a throwing subscriber take down the daemon
  * or another subscriber.
  *
- * Retention (issue #6): every session-scoped event (`sessionId` set), except the high-frequency
- * kinds in `EXCLUDED_FROM_RETENTION`, is appended to a per-session ring buffer with a
- * monotonically increasing `seq`, capped at `bufferSize` entries (oldest dropped first). A
+ * Retention (issue #6, #98): every session-scoped event gets a monotonically increasing per-session
+ * `seq`, but only `app_event` is appended to the per-session ring buffer, capped at `bufferSize`
+ * entries (oldest dropped first). Appduct's own kinds (lifecycle, tool calls) are fanned out live
+ * and never retained, so no number of tool calls can evict an app event. A
  * session's buffer is discarded the moment it emits a terminal event (`session_expired` /
  * `session_revoked`) — "terminal states free the alias" (sessions.ts) applies to retained events
  * too, matching "no persisted history" (ARCHITECTURE.md §3/§13) — or via an explicit `drop()` for
@@ -22,7 +23,6 @@ export type EventBusEmitInput = Omit<EventNotification, "ts" | "seq"> & {
 export type EventBusListener = (event: EventNotification) => void;
 export type EventsSinceQuery = {
     since?: number;
-    kinds?: EventKind[];
     limit?: number;
 };
 export type EventsSinceQueryResult = {

package/dist/daemon/events-log.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The daemon's own event log, `<stateDir>/events.log` (ARCHITECTURE.md §3): one JSON line per
+ * event, for debugging Appduct itself. The daemon decides which events to record; this module only
+ * writes them and keeps the file bounded.
+ *
+ * Writes are serialized on a promise queue, so {@link EventsLog.record} returns at once and never
+ * blocks the emitter. After each append the file is rotated to a single backup once it is over
+ * `maxBytes`, so the current file is never above the cap once a write has settled. A failed write
+ * or rotation is warned, never thrown, and never stops later writes.
+ */
+import type { EventNotification } from "@appduct/shared";
+/** A file that only ever grows by whole lines, with one backup slot. */
+export type AppendOnlyFile = {
+    /** Appends `line` plus a newline, creating the file at mode `0600` if it is missing. */
+    append(line: string): Promise<void>;
+    /** Current size in bytes; `0` when the file does not exist. */
+    size(): Promise<number>;
+    /** Moves the file to the backup slot, replacing any previous backup. */
+    rotate(): Promise<void>;
+};
+export type EventsLog = {
+    /** Queues `event` as one JSON line; returns immediately. */
+    record(event: EventNotification): void;
+    /** Resolves once every write queued so far has settled. */
+    flush(): Promise<void>;
+};
+export declare const createEventsLog: (options: {
+    file: AppendOnlyFile;
+    maxBytes: number;
+    warn: (message: string) => void;
+}) => EventsLog;

package/dist/daemon/memory-append-only-file.d.ts

@@ -0,0 +1,17 @@
+/** In-memory {@link AppendOnlyFile} for tests: inspect the lines written and the backup, or make
+ * appends fail. */
+import type { AppendOnlyFile } from "./events-log.js";
+export declare class MemoryAppendOnlyFile implements AppendOnlyFile {
+    private current;
+    private backup;
+    private appendError;
+    append(line: string): Promise<void>;
+    size(): Promise<number>;
+    rotate(): Promise<void>;
+    /** Lines in the current file, without their newlines. */
+    lines(): string[];
+    /** Lines in the backup, without their newlines. */
+    backupLines(): string[];
+    /** Makes every append throw `error` until called again with `undefined`. */
+    failAppendsWith(error: Error | undefined): void;
+}

package/dist/daemon/node-append-only-file.d.ts

@@ -0,0 +1,9 @@
+/** {@link AppendOnlyFile} on the real filesystem; the backup is `<path>.1`. */
+import type { AppendOnlyFile } from "./events-log.js";
+export declare class NodeAppendOnlyFile implements AppendOnlyFile {
+    private readonly path;
+    constructor(path: string);
+    append(line: string): Promise<void>;
+    size(): Promise<number>;
+    rotate(): Promise<void>;
+}

package/dist/daemon/state-dir.d.ts

@@ -11,6 +11,8 @@ export type StateDirPaths = {
     socketPath: string;
     pidFilePath: string;
     logFilePath: string;
+    /** The daemon's own event log; rotated to `<eventsLogPath>.1`. */
+    eventsLogPath: string;
     keyPath: string;
     configPath: string;
     auditDir: string;

package/dist/index.js

@@ -140,7 +140,7 @@ var createCli = () => {
     "--timeout <ms>",
     "Call timeout in milliseconds. Shortens the deadline; it cannot extend one past the app's own timer, which is the tool's declared timeoutMs (else 10000)."
   );
-  cli.command("events [selector]", "Stream session/tool events until interrupted.").option("--follow", "Accepted for script readability; the default behavior already follows.").option("--since <cursor>", "One-shot: print events retained since this cursor instead of streaming live.");
+  cli.command("events [selector]", "Stream the events the app posts until interrupted.").option("--follow", "Accepted for script readability; the default behavior already follows.").option("--since <cursor>", "One-shot: print the app events retained since this cursor instead of streaming live.");
   cli.command("revoke [selector]", "Revoke a session.");
   cli.command("mcp", "Start a stdio MCP server that gives MCP clients access to connected apps' tools.").option(
     "--scheme <scheme>",
@@ -164,6 +164,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -223,6 +224,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -285,6 +287,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -333,6 +338,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join3(stateDir, "daemon.sock"),
     pidFilePath: join3(stateDir, "daemon.pid"),
     logFilePath: join3(stateDir, "daemon.log"),
+    eventsLogPath: join3(stateDir, "events.log"),
     keyPath: join3(stateDir, "key.pem"),
     configPath: join3(stateDir, "config.json"),
     auditDir: join3(stateDir, "audit"),

package/dist/mcp/events-tool.d.ts

@@ -38,13 +38,6 @@ export declare const EVENTS_TOOL_DESCRIPTOR: {
                 readonly type: "integer";
                 readonly minimum: 0;
             };
-            readonly kinds: {
-                readonly type: "array";
-                readonly items: {
-                    readonly type: "string";
-                    readonly enum: readonly ["daemon_started", "link_created", "link_expired", "session_claimed", "session_suspended", "session_resumed", "session_revoked", "session_expired", "tools_changed", "app_event", "tool_call_started", "tool_call_progress", "tool_call_finished"];
-                };
-            };
             readonly limit: {
                 readonly type: "integer";
                 readonly exclusiveMinimum: 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appduct",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "description": "Driving React Native tools without in-app debug UI.",
   "type": "module",
   "main": "./dist/index.js",
@@ -45,7 +45,7 @@
     "reflect-metadata": "^0.2.2",
     "toqr": "^0.1.1",
     "ws": "^8.18.3",
-    "@appduct/shared": "0.11.1"
+    "@appduct/shared": "0.12.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",