appduct 0.11.1 → 0.13.0

package/dist/cli/routes/daemon/run.js

@@ -139,6 +139,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -198,6 +199,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -260,6 +262,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -609,7 +614,71 @@ var createCallsManager = (options) => {
 
 // src/daemon/event-bus.ts
 var TERMINAL_EVENT_KINDS = /* @__PURE__ */ new Set(["session_expired", "session_revoked"]);
-var EXCLUDED_FROM_RETENTION = /* @__PURE__ */ new Set(["tool_call_progress"]);
+var utf8ByteLength = (text) => Buffer.byteLength(text, "utf8");
+var truncateToUtf8Bytes = (text, maxBytes) => {
+  const encoded = Buffer.from(text, "utf8");
+  if (encoded.length <= maxBytes) {
+    return text;
+  }
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  for (let end = maxBytes; end > 0; end--) {
+    try {
+      return decoder.decode(encoded.subarray(0, end));
+    } catch {
+    }
+  }
+  return "";
+};
+var matchesNameGlob = (pattern, name) => {
+  const pieces = pattern.split("*");
+  const first = pieces[0] ?? "";
+  if (pieces.length === 1) {
+    return name === first;
+  }
+  const last = pieces[pieces.length - 1] ?? "";
+  if (first.length + last.length > name.length || !name.startsWith(first) || !name.endsWith(last)) {
+    return false;
+  }
+  const end = name.length - last.length;
+  let position = first.length;
+  for (const piece of pieces.slice(1, -1)) {
+    const found = name.indexOf(piece, position);
+    if (found === -1 || found + piece.length > end) {
+      return false;
+    }
+    position = found + piece.length;
+  }
+  return true;
+};
+var projectAppEvent = (event, options = {}) => {
+  if (event.kind !== "app_event") {
+    return event;
+  }
+  const data = event.data;
+  if (options.name !== void 0 && !(typeof data.name === "string" && matchesNameGlob(options.name, data.name))) {
+    return void 0;
+  }
+  if (options.payloadMaxBytes === void 0 || !("payload" in data)) {
+    return event;
+  }
+  const payloadJson = JSON.stringify(data.payload);
+  if (payloadJson === void 0) {
+    return event;
+  }
+  const payloadBytes = utf8ByteLength(payloadJson);
+  if (payloadBytes <= options.payloadMaxBytes) {
+    return event;
+  }
+  return {
+    ...event,
+    data: {
+      name: data.name,
+      payloadPreview: truncateToUtf8Bytes(payloadJson, options.payloadMaxBytes),
+      truncated: true,
+      payloadBytes
+    }
+  };
+};
 var createEventBus = (options = {}) => {
   const clock = options.clock ?? { now: () => /* @__PURE__ */ new Date() };
   const bufferSize = options.bufferSize ?? 256;
@@ -627,8 +696,9 @@ var createEventBus = (options = {}) => {
   return {
     emit: (event) => {
       const sessionId = event.sessionId;
-      const seq = sessionId !== void 0 ? (cursors.get(sessionId) ?? 0) + 1 : 0;
-      if (sessionId !== void 0) {
+      let seq = 0;
+      if (sessionId !== void 0 && event.kind === "app_event") {
+        seq = (cursors.get(sessionId) ?? 0) + 1;
         cursors.set(sessionId, seq);
       }
       const notification = {
@@ -640,7 +710,7 @@ var createEventBus = (options = {}) => {
         if (TERMINAL_EVENT_KINDS.has(notification.kind)) {
           buffers.delete(sessionId);
           cursors.delete(sessionId);
-        } else if (!EXCLUDED_FROM_RETENTION.has(notification.kind)) {
+        } else if (notification.kind === "app_event") {
           appendToBuffer(sessionId, notification);
         }
       }
@@ -660,19 +730,26 @@ var createEventBus = (options = {}) => {
     since: (sessionId, query = {}) => {
       const buffer = buffers.get(sessionId) ?? [];
       const sessionCursor = cursors.get(sessionId) ?? 0;
-      let events = buffer.slice();
+      const sinceValue = query.since ?? 0;
+      const oldestRetainedSeq = buffer.length > 0 ? buffer[0].seq : void 0;
+      const dropped = oldestRetainedSeq !== void 0 ? Math.max(0, oldestRetainedSeq - sinceValue - 1) : 0;
+      let matching = buffer.slice();
       if (query.since !== void 0) {
-        events = events.filter((event) => event.seq > query.since);
+        matching = matching.filter((event) => event.seq > query.since);
       }
-      if (query.kinds !== void 0) {
-        const kinds = new Set(query.kinds);
-        events = events.filter((event) => kinds.has(event.kind));
+      if (query.name !== void 0) {
+        matching = matching.filter((event) => projectAppEvent(event, { name: query.name }) !== void 0);
       }
+      let events = matching;
       if (query.limit !== void 0 && events.length > query.limit) {
         events = events.slice(0, query.limit);
       }
+      const remaining = matching.length - events.length;
       const cursor = events.length > 0 ? events[events.length - 1].seq : sessionCursor;
-      return { events, cursor };
+      if (query.payloadMaxBytes !== void 0) {
+        events = events.map((event) => projectAppEvent(event, { payloadMaxBytes: query.payloadMaxBytes }));
+      }
+      return { events, cursor, dropped, remaining };
     },
     drop: (sessionId) => {
       buffers.delete(sessionId);
@@ -681,6 +758,28 @@ var createEventBus = (options = {}) => {
   };
 };
 
+// src/daemon/events-log.ts
+var createEventsLog = (options) => {
+  const { file, maxBytes, warn } = options;
+  let queue = Promise.resolve();
+  return {
+    record: (event) => {
+      const line = JSON.stringify(event);
+      queue = queue.then(async () => {
+        try {
+          await file.append(line);
+          if (await file.size() > maxBytes) {
+            await file.rotate();
+          }
+        } catch (error) {
+          warn(`appduct daemon: failed to write events.log: ${error.message}`);
+        }
+      });
+    },
+    flush: () => queue
+  };
+};
+
 // src/daemon/listener.ts
 import { createServer as createHttpsServer } from "node:https";
 import { isSessionClaimMessage, isSessionResumeMessage, isSessionBoundMessage } from "@appduct/shared";
@@ -1409,6 +1508,37 @@ var acquirePidfile = async (pidFilePath, options = {}) => {
   throw new Error(`Failed to acquire the Appduct daemon pidfile at "${pidFilePath}".`);
 };
 
+// src/daemon/node-append-only-file.ts
+import { open as open3, rename, stat as stat2 } from "node:fs/promises";
+var NodeAppendOnlyFile = class {
+  constructor(path) {
+    this.path = path;
+  }
+  async append(line) {
+    const handle = await open3(this.path, "a", 384);
+    try {
+      await handle.appendFile(`${line}
+`);
+      await handle.chmod(384);
+    } finally {
+      await handle.close();
+    }
+  }
+  async size() {
+    try {
+      return (await stat2(this.path)).size;
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return 0;
+      }
+      throw error;
+    }
+  }
+  async rotate() {
+    await rename(this.path, `${this.path}.1`);
+  }
+};
+
 // src/daemon/rpc-server.ts
 import { createServer } from "node:net";
 import { chmod as chmod2, rm as rm3 } from "node:fs/promises";
@@ -1594,6 +1724,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join4(stateDir, "daemon.sock"),
     pidFilePath: join4(stateDir, "daemon.pid"),
     logFilePath: join4(stateDir, "daemon.log"),
+    eventsLogPath: join4(stateDir, "events.log"),
     keyPath: join4(stateDir, "key.pem"),
     configPath: join4(stateDir, "config.json"),
     auditDir: join4(stateDir, "audit"),
@@ -1612,7 +1743,7 @@ var ensureStateDir = async (stateDir) => {
 };
 
 // src/daemon/tls.ts
-import { stat as stat2, readFile as readFile3 } from "node:fs/promises";
+import { stat as stat3, readFile as readFile3 } from "node:fs/promises";
 
 // src/host-certificate.ts
 import "reflect-metadata";
@@ -1789,7 +1920,7 @@ var generateHostCertificate = async (keyPem, advertisedIp) => {
 // src/key-material.ts
 import { generateKeyPairSync } from "node:crypto";
 import { dirname as dirname2 } from "node:path";
-import { mkdir as mkdir3, rename, rm as rm4, writeFile } from "node:fs/promises";
+import { mkdir as mkdir3, rename as rename2, rm as rm4, writeFile } from "node:fs/promises";
 var generatePrivateKeyPem = () => {
   const { privateKey } = generateKeyPairSync("rsa", {
     modulusLength: 2048,
@@ -1809,7 +1940,7 @@ var writePrivateKeyAtomically = async (path, keyPem) => {
       mode: 384,
       flag: "wx"
     });
-    await rename(temporaryPath, path);
+    await rename2(temporaryPath, path);
   } catch (error) {
     await rm4(temporaryPath, { force: true }).catch(() => {
     });
@@ -1825,7 +1956,7 @@ var HostKeyError = class extends Error {
   }
 };
 var loadHostKeyPem = async (keyPath) => {
-  const fileStat = await stat2(keyPath);
+  const fileStat = await stat3(keyPath);
   if ((fileStat.mode & 63) !== 0) {
     throw new HostKeyError(
       `Appduct host key at "${keyPath}" is group- or world-readable (mode ${(fileStat.mode & 511).toString(8)}). Refusing to load it \u2014 run "chmod 600 ${keyPath}" or re-run "appduct keygen".`
@@ -2018,7 +2149,26 @@ var asEventsSubscribeParams = (params) => {
     }
     kinds = kindsRaw;
   }
-  return { sessionSelector, kinds };
+  const name = record.name;
+  if (name !== void 0 && typeof name !== "string") {
+    throw new RpcApplicationError("invalid_request", '"name" must be a string.');
+  }
+  const payloadMaxBytes = asPayloadMaxBytes(record.payloadMaxBytes);
+  return {
+    sessionSelector,
+    kinds,
+    name,
+    payloadMaxBytes
+  };
+};
+var asPayloadMaxBytes = (value) => {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
+    throw new RpcApplicationError("invalid_request", '"payloadMaxBytes" must be a positive integer.');
+  }
+  return value;
 };
 var asEventsSinceParams = (params) => {
   const record = asRecordParams(params);
@@ -2030,23 +2180,21 @@ var asEventsSinceParams = (params) => {
   if (since !== void 0 && (typeof since !== "number" || !Number.isInteger(since) || since < 0)) {
     throw new RpcApplicationError("invalid_request", '"since" must be a non-negative integer.');
   }
-  const kindsRaw = record.kinds;
-  let kinds;
-  if (kindsRaw !== void 0) {
-    if (!Array.isArray(kindsRaw) || !kindsRaw.every((kind) => typeof kind === "string" && KNOWN_EVENT_KINDS.has(kind))) {
-      throw new RpcApplicationError("invalid_request", '"kinds" must be an array of known event kinds.');
-    }
-    kinds = kindsRaw;
-  }
   const limit = record.limit;
   if (limit !== void 0 && (typeof limit !== "number" || !Number.isInteger(limit) || limit <= 0)) {
     throw new RpcApplicationError("invalid_request", '"limit" must be a positive integer.');
   }
+  const name = record.name;
+  if (name !== void 0 && typeof name !== "string") {
+    throw new RpcApplicationError("invalid_request", '"name" must be a string.');
+  }
+  const payloadMaxBytes = asPayloadMaxBytes(record.payloadMaxBytes);
   return {
     selector,
     since,
-    kinds,
-    limit
+    limit,
+    name,
+    payloadMaxBytes
   };
 };
 var asLinkCreateParams = (params) => {
@@ -2080,10 +2228,19 @@ var startDaemon = async (options) => {
     retentionDays: config.auditRetentionDays,
     warn: options.warn
   });
+  const eventsLog = createEventsLog({
+    file: new NodeAppendOnlyFile(paths.eventsLogPath),
+    maxBytes: config.eventsLogMaxBytes,
+    warn: options.warn ?? ((message) => {
+      process.stderr.write(`${message}
+`);
+    })
+  });
   let auditPruneInterval;
   let pidfile;
   let server;
   let listener;
+  let tlsManager;
   let sessionManager;
   let callsManager;
   let eventBus;
@@ -2110,6 +2267,7 @@ var startDaemon = async (options) => {
       await pidfile?.release();
       await rm5(getSocketPath(paths), { force: true });
       await auditLogger.flush();
+      await eventsLog.flush();
     } finally {
       resolveExited();
     }
@@ -2122,8 +2280,14 @@ var startDaemon = async (options) => {
     });
     eventBus = createEventBus({ clock, bufferSize: config.eventBufferSize });
     const activeEventBus = eventBus;
+    activeEventBus.subscribe((event) => {
+      if (event.kind !== "app_event") {
+        eventsLog.record(event);
+      }
+    });
     const detectAddress = options.detectAddress ?? (() => detectAdvertisedAddress({ override: config.advertisedIp }));
     const tls = await createTlsManager({ keyPath: config.keyPath, detectAddress, warn: options.warn });
+    tlsManager = tls;
     sessionManager = createSessionManager({
       graceSeconds: config.graceSeconds,
       keepaliveIntervalSeconds: config.keepaliveIntervalSeconds,
@@ -2177,10 +2341,17 @@ var startDaemon = async (options) => {
         if (subscription.kinds && !subscription.kinds.has(event.kind)) {
           continue;
         }
+        const projected = projectAppEvent(event, {
+          name: subscription.name,
+          payloadMaxBytes: subscription.payloadMaxBytes
+        });
+        if (projected === void 0) {
+          continue;
+        }
         if (subscription.sessionSelector !== void 0 && event.sessionId !== subscription.sessionSelector && event.alias !== subscription.sessionSelector) {
           continue;
         }
-        server?.notify(connection, event);
+        server?.notify(connection, projected);
       }
     });
     server = await startRpcServer({
@@ -2359,17 +2530,19 @@ var startDaemon = async (options) => {
           return { cancelled };
         },
         [RPC_METHODS.eventsSubscribe]: (params, context) => {
-          const { sessionSelector, kinds } = asEventsSubscribeParams(params);
+          const { sessionSelector, kinds, name, payloadMaxBytes } = asEventsSubscribeParams(params);
           context.connection.state.eventSubscription = {
             sessionSelector,
-            kinds: kinds ? new Set(kinds) : void 0
+            kinds: kinds ? new Set(kinds) : void 0,
+            name,
+            payloadMaxBytes
           };
           return { ok: true };
         },
         [RPC_METHODS.eventsSince]: (params) => {
-          const { selector, since, kinds, limit } = asEventsSinceParams(params);
+          const { selector, since, limit, name, payloadMaxBytes } = asEventsSinceParams(params);
           const resolved = activeSessionManager.describe(selector);
-          return activeEventBus.since(resolved.sessionId, { since, kinds, limit });
+          return activeEventBus.since(resolved.sessionId, { since, limit, name, payloadMaxBytes });
         }
       }
     });
@@ -2395,6 +2568,7 @@ var startDaemon = async (options) => {
     startedAt,
     server,
     listener,
+    tls: tlsManager,
     eventBus,
     exited,
     shutdown
@@ -2729,9 +2903,6 @@ var renderLsData = (colors, data, now) => {
     ...rows.map((row) => `  ${row.map((cell, index) => cell.padEnd(widths[index])).join("  ")}`)
   ];
 };
-var isToolsListing = (data) => {
-  return typeof data === "object" && data !== null && Array.isArray(data.tools);
-};
 var isToolGroupsListing = (data) => {
   return typeof data === "object" && data !== null && Array.isArray(data.groups) && !Array.isArray(data.tools);
 };
@@ -2749,7 +2920,7 @@ var renderEmptyToolsLine = (data) => {
   }
   if (data.group !== void 0) {
     const match = data.filter === void 0 ? "" : ` match ${JSON.stringify(data.filter)}`;
-    return `  No tools in group ${JSON.stringify(data.group)}${match}. Run \`appduct tools --groups\` to see the session's groups.`;
+    return `  No tools in group ${JSON.stringify(data.group)}${match}. Run \`appduct tools ls --groups\` to see the session's groups.`;
   }
   return data.filter === void 0 ? "  No tools registered." : `  No tools match ${JSON.stringify(data.filter)}.`;
 };
@@ -2831,7 +3002,7 @@ var renderToolSummaryTable = (colors, data) => {
     ...grouped ? renderGroupedToolLines(colors, data.tools) : data.tools.flatMap((tool) => renderToolSummaryLines(tool, "  ")),
     ...renderTruncationLine(data),
     "",
-    "Run `appduct tools <name>` for a tool's full schema."
+    "Run `appduct tools describe <name>` for a tool's full schema."
   ];
 };
 var renderToolDetail = (colors, tool, flags) => {
@@ -2883,16 +3054,13 @@ var renderToolGroups = (colors, data) => {
     colors.green("Groups"),
     ...data.groups.map((entry) => `  ${label(entry).padEnd(width)}  ${String(entry.total).padStart(countWidth)}`),
     "",
-    `${data.total} tool${data.total === 1 ? "" : "s"} in total. ` + (hasAnyGroup(data.groups) ? "Run `appduct tools --group <name>` to list one group's tools." : "No tool declares a group.")
+    `${data.total} tool${data.total === 1 ? "" : "s"} in total. ` + (hasAnyGroup(data.groups) ? "Run `appduct tools ls --group <name>` to list one group's tools." : "No tool declares a group.")
   ];
 };
-var renderToolsData = (colors, data, flags, full) => {
+var renderToolsListData = (colors, data, flags, full) => {
   if (isToolGroupsListing(data)) {
     return renderToolGroups(colors, data);
   }
-  if (!isToolsListing(data)) {
-    return renderToolDetail(colors, data, flags);
-  }
   return full ? renderToolsFullListing(colors, data, flags) : renderToolSummaryTable(colors, data);
 };
 var renderInvokeData = (colors, data, flags) => {
@@ -3078,15 +3246,17 @@ var renderSuccessData = (colors, command, data, options) => {
       return renderInitData(colors, data, flags);
     case "keygen":
       return renderKeygenData(colors, data, flags);
-    case "link":
+    case "sessions link":
       return renderLinkData(colors, data, flags, options.qr);
-    case "ls":
+    case "sessions ls":
       return renderLsData(colors, data, options.now ?? /* @__PURE__ */ new Date());
-    case "tools":
-      return renderToolsData(colors, data, flags, options.full);
-    case "invoke":
+    case "tools ls":
+      return renderToolsListData(colors, data, flags, options.full);
+    case "tools describe":
+      return renderToolDetail(colors, data, flags);
+    case "tools call":
       return renderInvokeData(colors, data, flags);
-    case "revoke":
+    case "sessions revoke":
       return renderRevokeData(colors, data);
     case "daemon run":
       return renderDaemonRunData(colors, data, flags);

package/dist/cli/routes/daemon/start.js

@@ -22,6 +22,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -81,6 +82,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -143,6 +145,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -243,6 +248,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join(stateDir, "daemon.sock"),
     pidFilePath: join(stateDir, "daemon.pid"),
     logFilePath: join(stateDir, "daemon.log"),
+    eventsLogPath: join(stateDir, "events.log"),
     keyPath: join(stateDir, "key.pem"),
     configPath: join(stateDir, "config.json"),
     auditDir: join(stateDir, "audit"),
@@ -1160,9 +1166,6 @@ var renderLsData = (colors, data, now) => {
     ...rows.map((row) => `  ${row.map((cell, index) => cell.padEnd(widths[index])).join("  ")}`)
   ];
 };
-var isToolsListing = (data) => {
-  return typeof data === "object" && data !== null && Array.isArray(data.tools);
-};
 var isToolGroupsListing = (data) => {
   return typeof data === "object" && data !== null && Array.isArray(data.groups) && !Array.isArray(data.tools);
 };
@@ -1180,7 +1183,7 @@ var renderEmptyToolsLine = (data) => {
   }
   if (data.group !== void 0) {
     const match = data.filter === void 0 ? "" : ` match ${JSON.stringify(data.filter)}`;
-    return `  No tools in group ${JSON.stringify(data.group)}${match}. Run \`appduct tools --groups\` to see the session's groups.`;
+    return `  No tools in group ${JSON.stringify(data.group)}${match}. Run \`appduct tools ls --groups\` to see the session's groups.`;
   }
   return data.filter === void 0 ? "  No tools registered." : `  No tools match ${JSON.stringify(data.filter)}.`;
 };
@@ -1262,7 +1265,7 @@ var renderToolSummaryTable = (colors, data) => {
     ...grouped ? renderGroupedToolLines(colors, data.tools) : data.tools.flatMap((tool) => renderToolSummaryLines(tool, "  ")),
     ...renderTruncationLine(data),
     "",
-    "Run `appduct tools <name>` for a tool's full schema."
+    "Run `appduct tools describe <name>` for a tool's full schema."
   ];
 };
 var renderToolDetail = (colors, tool, flags) => {
@@ -1314,16 +1317,13 @@ var renderToolGroups = (colors, data) => {
     colors.green("Groups"),
     ...data.groups.map((entry) => `  ${label(entry).padEnd(width)}  ${String(entry.total).padStart(countWidth)}`),
     "",
-    `${data.total} tool${data.total === 1 ? "" : "s"} in total. ` + (hasAnyGroup(data.groups) ? "Run `appduct tools --group <name>` to list one group's tools." : "No tool declares a group.")
+    `${data.total} tool${data.total === 1 ? "" : "s"} in total. ` + (hasAnyGroup(data.groups) ? "Run `appduct tools ls --group <name>` to list one group's tools." : "No tool declares a group.")
   ];
 };
-var renderToolsData = (colors, data, flags, full) => {
+var renderToolsListData = (colors, data, flags, full) => {
   if (isToolGroupsListing(data)) {
     return renderToolGroups(colors, data);
   }
-  if (!isToolsListing(data)) {
-    return renderToolDetail(colors, data, flags);
-  }
   return full ? renderToolsFullListing(colors, data, flags) : renderToolSummaryTable(colors, data);
 };
 var renderInvokeData = (colors, data, flags) => {
@@ -1509,15 +1509,17 @@ var renderSuccessData = (colors, command, data, options) => {
       return renderInitData(colors, data, flags);
     case "keygen":
       return renderKeygenData(colors, data, flags);
-    case "link":
+    case "sessions link":
       return renderLinkData(colors, data, flags, options.qr);
-    case "ls":
+    case "sessions ls":
       return renderLsData(colors, data, options.now ?? /* @__PURE__ */ new Date());
-    case "tools":
-      return renderToolsData(colors, data, flags, options.full);
-    case "invoke":
+    case "tools ls":
+      return renderToolsListData(colors, data, flags, options.full);
+    case "tools describe":
+      return renderToolDetail(colors, data, flags);
+    case "tools call":
       return renderInvokeData(colors, data, flags);
-    case "revoke":
+    case "sessions revoke":
       return renderRevokeData(colors, data);
     case "daemon run":
       return renderDaemonRunData(colors, data, flags);

package/dist/cli/routes/daemon/status.js

@@ -66,6 +66,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "eventBufferSize",
   "auditRetentionDays",
   "daemonLogMaxBytes",
+  "eventsLogMaxBytes",
   "policy",
   "advertisedIp",
   "scheme",
@@ -125,6 +126,7 @@ var defaultConfig = (paths) => {
     eventBufferSize: 256,
     auditRetentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
+    eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
     policy: {
       default: "allow",
@@ -187,6 +189,9 @@ var loadConfig = async (paths, options = {}) => {
   if (parsed.daemonLogMaxBytes !== void 0) {
     config.daemonLogMaxBytes = requirePositiveInteger(parsed.daemonLogMaxBytes, "daemonLogMaxBytes");
   }
+  if (parsed.eventsLogMaxBytes !== void 0) {
+    config.eventsLogMaxBytes = requirePositiveInteger(parsed.eventsLogMaxBytes, "eventsLogMaxBytes");
+  }
   if (parsed.restartDaemonOnVersionMismatch !== void 0) {
     config.restartDaemonOnVersionMismatch = requireBoolean(
       parsed.restartDaemonOnVersionMismatch,
@@ -287,6 +292,7 @@ var getStateDirPaths = (stateDir) => {
     socketPath: join3(stateDir, "daemon.sock"),
     pidFilePath: join3(stateDir, "daemon.pid"),
     logFilePath: join3(stateDir, "daemon.log"),
+    eventsLogPath: join3(stateDir, "events.log"),
     keyPath: join3(stateDir, "key.pem"),
     configPath: join3(stateDir, "config.json"),
     auditDir: join3(stateDir, "audit"),
@@ -1189,9 +1195,6 @@ var renderLsData = (colors, data, now) => {
     ...rows.map((row) => `  ${row.map((cell, index) => cell.padEnd(widths[index])).join("  ")}`)
   ];
 };
-var isToolsListing = (data) => {
-  return typeof data === "object" && data !== null && Array.isArray(data.tools);
-};
 var isToolGroupsListing = (data) => {
   return typeof data === "object" && data !== null && Array.isArray(data.groups) && !Array.isArray(data.tools);
 };
@@ -1209,7 +1212,7 @@ var renderEmptyToolsLine = (data) => {
   }
   if (data.group !== void 0) {
     const match = data.filter === void 0 ? "" : ` match ${JSON.stringify(data.filter)}`;
-    return `  No tools in group ${JSON.stringify(data.group)}${match}. Run \`appduct tools --groups\` to see the session's groups.`;
+    return `  No tools in group ${JSON.stringify(data.group)}${match}. Run \`appduct tools ls --groups\` to see the session's groups.`;
   }
   return data.filter === void 0 ? "  No tools registered." : `  No tools match ${JSON.stringify(data.filter)}.`;
 };
@@ -1291,7 +1294,7 @@ var renderToolSummaryTable = (colors, data) => {
     ...grouped ? renderGroupedToolLines(colors, data.tools) : data.tools.flatMap((tool) => renderToolSummaryLines(tool, "  ")),
     ...renderTruncationLine(data),
     "",
-    "Run `appduct tools <name>` for a tool's full schema."
+    "Run `appduct tools describe <name>` for a tool's full schema."
   ];
 };
 var renderToolDetail = (colors, tool, flags) => {
@@ -1343,16 +1346,13 @@ var renderToolGroups = (colors, data) => {
     colors.green("Groups"),
     ...data.groups.map((entry) => `  ${label(entry).padEnd(width)}  ${String(entry.total).padStart(countWidth)}`),
     "",
-    `${data.total} tool${data.total === 1 ? "" : "s"} in total. ` + (hasAnyGroup(data.groups) ? "Run `appduct tools --group <name>` to list one group's tools." : "No tool declares a group.")
+    `${data.total} tool${data.total === 1 ? "" : "s"} in total. ` + (hasAnyGroup(data.groups) ? "Run `appduct tools ls --group <name>` to list one group's tools." : "No tool declares a group.")
   ];
 };
-var renderToolsData = (colors, data, flags, full) => {
+var renderToolsListData = (colors, data, flags, full) => {
   if (isToolGroupsListing(data)) {
     return renderToolGroups(colors, data);
   }
-  if (!isToolsListing(data)) {
-    return renderToolDetail(colors, data, flags);
-  }
   return full ? renderToolsFullListing(colors, data, flags) : renderToolSummaryTable(colors, data);
 };
 var renderInvokeData = (colors, data, flags) => {
@@ -1538,15 +1538,17 @@ var renderSuccessData = (colors, command, data, options) => {
       return renderInitData(colors, data, flags);
     case "keygen":
       return renderKeygenData(colors, data, flags);
-    case "link":
+    case "sessions link":
       return renderLinkData(colors, data, flags, options.qr);
-    case "ls":
+    case "sessions ls":
       return renderLsData(colors, data, options.now ?? /* @__PURE__ */ new Date());
-    case "tools":
-      return renderToolsData(colors, data, flags, options.full);
-    case "invoke":
+    case "tools ls":
+      return renderToolsListData(colors, data, flags, options.full);
+    case "tools describe":
+      return renderToolDetail(colors, data, flags);
+    case "tools call":
       return renderInvokeData(colors, data, flags);
-    case "revoke":
+    case "sessions revoke":
       return renderRevokeData(colors, data);
     case "daemon run":
       return renderDaemonRunData(colors, data, flags);