beehaven 0.8.16

package/dist/commands/omni.js

@@ -0,0 +1,529 @@
+/**
+ * `beehaven omni` — DAEMON OMNI: Claude Code hosted in the daemon, with the
+ * beehaven surface as first-party tools.
+ *
+ * ## How this differs from `beehaven claude`
+ *
+ * `beehaven claude` runs the Agent SDK in the CLI's OWN process — one Claude
+ * per terminal invocation, dying with the command, with no beehaven tools and
+ * no way for anything else to see it. That is a fine shape for a one-shot task
+ * and a bad one for a companion.
+ *
+ * This drives the session living in the DAEMON. It is the same runtime the
+ * avatar's chat panel talks to, so a turn started here is visible there, and
+ * both share one warm session, one conversation, one set of tools. The daemon
+ * is also the only process holding the relay socket and the local buildings —
+ * which is what lets `mcp__clearly__*` be a real in-process tool call instead
+ * of a shell-out.
+ *
+ * ## Local only, and that is deliberate
+ *
+ * Everything here rides the IPC socket, which is chmod 0600 — the kernel
+ * proving the caller is this UNIX user, driving their own Claude subscription.
+ * Cloud→daemon Claude orchestration stays disabled (see relay.ts, Anthropic
+ * credential-use policy). Nothing in this file opens that path.
+ *
+ *   beehaven omni "add a red rectangle to my canvas"
+ *   beehaven omni --session build "run the tests"     # a named thread
+ *   beehaven omni sessions                            # what's live
+ *   beehaven omni end [--session id]
+ */
+import { IpcClient } from '../ipc-client.js';
+import { color } from '../spinner.js';
+const DEFAULT_SESSION = 'default';
+export async function cmdOmni(positionals, values) {
+    // `positionals[0]` is the verb itself ('omni') — the CLI passes the full
+    // argv slice, matching `commands/claude.ts`. Reading index 0 as the
+    // subcommand makes `beehaven omni sessions` prompt Claude with the literal
+    // words "omni sessions", which it will then dutifully go and research.
+    const sub = positionals[1];
+    const sessionId = String(values.session ?? DEFAULT_SESSION);
+    const client = new IpcClient();
+    try {
+        await client.connect();
+    }
+    catch {
+        console.error(color.red('  ✗ Cannot reach the daemon.'));
+        console.error(color.dim('    Start it with `beehaven start --headless`, or open the Mac app.'));
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        if (sub === 'sessions') {
+            const res = await client.omni('sessions');
+            const list = res?.sessions ?? [];
+            console.log(`  beehaven tools: ${res?.beehavenTools ? color.green('mounted') : color.yellow('not mounted')}`);
+            if (!list.length) {
+                console.log(color.dim('  No live sessions.'));
+                return;
+            }
+            for (const s of list) {
+                console.log(`  ${color.cyan(s.sessionId)}  turns=${s.turns ?? 0}  cwd=${color.dim(s.cwd ?? '')}`);
+            }
+            return;
+        }
+        /**
+         * ⚠⚠ WHERE IS IT WORKING, AND MOVE IT. The cwd decides which files the agent reads and writes
+         * and which SDK conversation resumes — and until this there was no way to see it or change it,
+         * so a session started in the wrong directory stayed there for its whole life.
+         *
+         *   beehaven omni cwd                    → print it
+         *   beehaven omni cwd ~/projects/foo     → move it
+         */
+        /**
+         * ⚠⚠ COMPANY MODE — READ ITS STATE, AND SWITCH IT.
+         *
+         * `companyDiagnostics` was written to catch the two failures that produce no error and no
+         * output: the mode silently off because the env var never reached the DAEMON, and the daemon
+         * drifted onto the wrong workspace because `beehaven connect` is machine-global. Both had
+         * happened. Neither could be seen, because the diagnostic had no caller at all — the daemon
+         * handled `omni:company-status`, `ipc-server` routed it, and the documented invocation
+         * (`beehaven call --ipc …`) is not a real flag. This is that caller.
+         *
+         *   beehaven omni company                       → the full report
+         *   beehaven omni company on [--workspace <id>] → persisted, survives a daemon restart
+         *   beehaven omni company off
+         */
+        if (sub === 'company') {
+            const verb = String(positionals[2] ?? '').trim().toLowerCase();
+            if (verb === 'on' || verb === 'off') {
+                /**
+                 * ⚠ WRITTEN BY THE CLI, READ BY THE DAEMON — one file, two processes, and no restart. That
+                 * is the whole point: an env var could only be changed by respawning the daemon, which is
+                 * why the mode had never actually been on.
+                 */
+                const { writeCompanyMode, COMPANY_MODE_FILE } = await import('../daemon-omni-company.js');
+                const wsId = String(values.workspace ?? '').trim();
+                const rec = writeCompanyMode({ enabled: verb === 'on', ...(wsId ? { workspaceId: wsId } : {}) });
+                console.log(`  ${color.green('✓')} company mode ${rec.enabled ? color.green('ON') : color.yellow('OFF')}`);
+                if (rec.workspaceId)
+                    console.log(color.dim(`    workspace ${rec.workspaceId}`));
+                console.log(color.dim(`    ${COMPANY_MODE_FILE}`));
+                /**
+                 * ⚠ THE DAEMON READS THIS PER TURN, so it takes effect on the next one — no restart. Said
+                 * out loud because every other switch in this CLI has needed one, and silently working is
+                 * indistinguishable from silently not.
+                 */
+                console.log(color.dim('    Takes effect on the next turn. `beehaven omni company` to confirm.'));
+                return;
+            }
+            if (verb && verb !== 'status') {
+                console.error(color.red(`  ✗ unknown: beehaven omni company ${verb}`));
+                console.error(color.dim('    Try: beehaven omni company [status|on|off]'));
+                process.exitCode = 1;
+                return;
+            }
+            const d = await client.omni('company-status');
+            const on = d?.mode === 'on';
+            console.log(`  Company mode: ${on ? color.green('ON') : color.yellow('OFF')}${d?.source ? color.dim(`  (${d.source})`) : ''}`);
+            const w = d?.workspace ?? {};
+            // ⚠ THREE STATES, NOT TWO. `matches === null` means "could not be checked" and must not be
+            //   drawn as a mismatch — reporting a fault it cannot actually see is the worse failure.
+            const mark = w.matches === true ? color.green('✓') : w.matches === false ? color.red('✗') : color.yellow('?');
+            console.log(`  Workspace:    ${mark} expected ${color.cyan(w.expected ?? '?')}, connected ${w.connected ? color.cyan(w.connected) : color.dim('(unknown)')}`);
+            console.log(`  Identity:     ${d?.identityRegistered ? color.green('registered') : color.red('MISSING')}`);
+            console.log(`  Claude:       ${d?.claudeBinary ? color.dim(d.claudeBinary) : color.red('not found')}`);
+            const p = d?.prompt ?? {};
+            console.log(color.dim(`  Prompt:       ${p.totalBytes ?? 0} B (identity ${p.identityBytes ?? 0} + addon ${p.addonBytes ?? 0}) ≈ ${p.approxTokens ?? 0} tok/turn`));
+            /**
+             * ⚠⚠ THE ADDON NAMES VERBS, AND A NAME IS NOT A VERB. This check exists because the addon
+             * shipped telling the agent to call `ticket-link` — which does not exist; the action is
+             * `ticket-link-create`. Nothing could have caught that: the prompt is a string, so it
+             * type-checks, reads correctly, and fails only when a model is mid-sprint and gets
+             * "Unknown action" back. `describe-action` refuses an unregistered name, so asking it once
+             * per verb is a real existence check.
+             *
+             * ⚠ IT NEEDS A CONNECTED WORKSPACE, and says so rather than reporting a false absence — a
+             * diagnostic that prints "12 verbs missing" because the daemon is pointed at nothing is
+             * worse than one that prints nothing.
+             */
+            const verbs = Array.isArray(d?.requiredVerbs) ? d.requiredVerbs : [];
+            if (verbs.length) {
+                const checks = await Promise.all(verbs.map(async (v) => {
+                    try {
+                        const r = await client.call('describe-action', { name: v }, 15_000);
+                        // ⚠ An `unknown_action` code is the refusal; anything else that answers is real.
+                        return { v, ok: !(r?.code === 'unknown_action' || /^Unknown action/i.test(String(r?.error ?? ''))), reached: true };
+                    }
+                    catch {
+                        return { v, ok: false, reached: false };
+                    }
+                }));
+                const unreachable = checks.filter((c) => !c.reached).length;
+                const missing = checks.filter((c) => c.reached && !c.ok).map((c) => c.v);
+                if (unreachable === checks.length) {
+                    console.log(color.dim(`  Verbs:        ${verbs.length} named by the addon (not checked — no workspace reachable)`));
+                }
+                else if (missing.length) {
+                    console.log(`  Verbs:        ${color.red(`${missing.length} of ${verbs.length} DO NOT EXIST`)}`);
+                    for (const m of missing)
+                        console.log(`    ${color.red('✗')} ${m}`);
+                    console.log(color.dim('    The addon tells the agent to call these. Fix the name in COMPANY_REQUIRED_VERBS and the addon text.'));
+                }
+                else {
+                    console.log(`  Verbs:        ${color.green(`${verbs.length}/${verbs.length}`)} named by the addon, all reachable`);
+                }
+            }
+            for (const warn of d?.warnings ?? [])
+                console.log(`  ${color.yellow('!')} ${warn}`);
+            if (!(d?.warnings ?? []).length)
+                console.log(`  ${color.green('✓')} nothing to report`);
+            return;
+        }
+        if (sub === 'cwd') {
+            const target = positionals.slice(2).join(' ').trim();
+            if (!target) {
+                const res = await client.omni('sessions');
+                const row = (res?.sessions ?? []).find((r) => r.sessionId === sessionId);
+                if (!row) {
+                    console.log(color.dim(`  no session "${sessionId}" yet — it is created on the first turn`));
+                    return;
+                }
+                console.log(`  ${color.cyan(sessionId)}  ${row.cwd ?? color.dim('(unknown)')}`);
+                return;
+            }
+            const r = await client.omni('set-cwd', { sessionId, cwd: target });
+            if (!r?.ok) {
+                console.error(color.red(`  ✗ ${r?.error ?? 'could not change the working directory'}`));
+                process.exitCode = 1;
+                return;
+            }
+            console.log(`  ${color.green('✓')} ${r.cwd}`);
+            /**
+             * ⚠ SAID OUT LOUD. Claude Code keys a conversation to a project directory derived from the
+             * cwd, so moving it starts a new thread. Someone who is not told simply finds an agent with
+             * no memory of the last five minutes.
+             */
+            if (r.threadReset)
+                console.log(color.dim('    new conversation — the thread is tied to the directory'));
+            else
+                console.log(color.dim('    unchanged — the conversation is kept'));
+            return;
+        }
+        if (sub === 'end') {
+            await client.omni('end', { sessionId });
+            console.log(color.dim(`  session ${sessionId} ended`));
+            return;
+        }
+        // ── A turn ────────────────────────────────────────────────────────
+        const prompt = positionals.slice(sub === 'run' ? 2 : 1).join(' ').trim();
+        if (!prompt) {
+            console.error('  Usage: beehaven omni "<task>"   ·   beehaven omni sessions|end');
+            process.exitCode = 1;
+            return;
+        }
+        // Subscribe BEFORE prompting. The daemon starts emitting the moment the
+        // turn is accepted, and a subscription set up afterwards races the first
+        // tokens — you would lose the opening of every reply.
+        let printedAny = false;
+        let lastLineWasTool = false;
+        /**
+         * callId → tool name. The daemon deliberately leaves `tool` EMPTY on
+         * `agent:tool-result` ("the human-readable name lives on the matching
+         * tool-call event"), so a result can only be labelled by correlating on
+         * `callId` — which matters now that results render, because calls interleave
+         * and an unlabelled ✓ under the wrong step is worse than no label.
+         */
+        const toolNames = new Map();
+        /** The most recent call, so a result printed right under it can stay unlabelled. */
+        let lastCallId = '';
+        const done = new Promise((resolve) => {
+            client.on('broadcast', (msg) => {
+                if (!msg?.omni || msg.sessionId !== sessionId)
+                    return;
+                switch (msg.type) {
+                    /**
+                     * ⚠ THE REPLY. `reply_to_principal` and the other principal tools —
+                     * this is what Omni deliberately chose to say.
+                     *
+                     * Rendering this was the whole parity gap. Without it a terminal user
+                     * saw `agent:text-delta` (below) and nothing else, which is exactly
+                     * backwards: that stream is Omni's PRIVATE working text, which the
+                     * desktop chat hides on purpose, while the actual replies went
+                     * nowhere. A CLI user was reading the agent's notes and missing its
+                     * answers.
+                     */
+                    case 'agent:principal': {
+                        const p = msg.event ?? {};
+                        if (lastLineWasTool) {
+                            process.stdout.write('\n');
+                            lastLineWasTool = false;
+                        }
+                        if (p.kind === 'prose') {
+                            process.stdout.write(`\n${p.text ?? ''}\n`);
+                            printedAny = true;
+                        }
+                        else if (p.kind === 'workspace') {
+                            // Cards, design docs, memories — real changes, but not the answer.
+                            console.log(color.dim(`  · ${p.text ?? ''}`));
+                        }
+                        else if (p.kind === 'preview') {
+                            // No window to open, so hand over the URL. This is the one place a
+                            // terminal is allowed the thing the desktop role forbids — there,
+                            // "go and open this" hands work back; here it IS the surface.
+                            console.log(`  ${color.cyan(String(p.url ?? ''))}  ${color.dim(String(p.caption ?? ''))}`);
+                        }
+                        else if (p.kind === 'image') {
+                            console.log(color.dim(`  [image] ${String(p.caption ?? '')}`));
+                        }
+                        else if (p.kind === 'window') {
+                            /**
+                             * ⚠ FLOATING WINDOWS ARE THE ONE THING A CLI USER DOES NOT GET,
+                             * and it says so rather than failing silently. The daemon emits the
+                             * request; only the Mac app can perform it.
+                             */
+                            console.log(color.dim(`  · (window ${p.op}: ${p.target} — not available in the terminal)`));
+                        }
+                        break;
+                    }
+                    /**
+                     * A question the turn is BLOCKED on. Answered inline, because the
+                     * alternative is a terminal that hangs for ten minutes and then
+                     * reports a timeout the user had no way to prevent.
+                     */
+                    case 'agent:ask':
+                        void answerInteractively(client, msg.askId, msg.ask);
+                        break;
+                    /**
+                     * ⚠ NOT THE REPLY — Omni's own working text, STREAMED as it is produced.
+                     *
+                     * Dimmed rather than hidden, and no longer behind `--verbose`. On a
+                     * terminal there is no work-log drawer to open, so a two-minute coding
+                     * turn that prints nothing until it finishes is indistinguishable from a
+                     * hang — which is the single most common reason someone Ctrl-Cs live
+                     * work. The dimming is what keeps it from being mistaken for the answer.
+                     *
+                     * `--quiet` suppresses it for scripts, where interleaved thinking is
+                     * noise rather than reassurance.
+                     */
+                    case 'agent:text-delta':
+                        if (!values.quiet) {
+                            if (lastLineWasTool) {
+                                process.stdout.write('\n');
+                                lastLineWasTool = false;
+                            }
+                            process.stdout.write(color.dim(msg.text ?? ''));
+                            printedAny = true;
+                        }
+                        break;
+                    /**
+                     * ⚠ STEPS RENDER INLINE — the name, then EVERY argument, then the result.
+                     *
+                     * This used to be one line per call: the tool name plus `summarize()`,
+                     * which picked a single string field and cut it at 80 chars. So
+                     * `canvas_act {action:'canvas.compose', args:{kind:'hero',…}}` rendered
+                     * as the composition id and nothing else — you could see THAT a step
+                     * happened and never what it did. Reading back a session meant guessing.
+                     */
+                    case 'agent:tool-call': {
+                        const callName = String(msg.tool ?? '');
+                        // Recorded even when quiet, so a result that DOES print (a failure)
+                        // can still name its tool.
+                        toolNames.set(String(msg.callId ?? ''), callName);
+                        if (values.quiet)
+                            break;
+                        lastCallId = String(msg.callId ?? '');
+                        process.stdout.write(`\n  ${color.dim('▪')} ${color.cyan(callName)}\n`);
+                        /**
+                         * ⚠ SOME TOOLS' ARGUMENTS ARE THE OUTPUT, and printing both says it
+                         * twice. `reply_to_principal`'s `text` IS the answer, which arrives a
+                         * moment later as `agent:principal` and renders in full — so dumping
+                         * the arg first shows the whole reply dimmed, then again brightly. The
+                         * step line still prints, because knowing Omni chose to reply is
+                         * useful; only the echo is dropped.
+                         */
+                        if (ECHOED_BY_EVENT.has(callName)) {
+                            lastLineWasTool = false;
+                            break;
+                        }
+                        for (const line of describeInput(msg.input ?? {})) {
+                            // ⚠ THE NEWLINE STAYS OUTSIDE THE COLOUR. Wrapping it puts the reset
+                            // sequence AFTER the line break, so the next line starts mid-escape
+                            // and a piped log shows a stray `[0m` at every line start.
+                            process.stdout.write(`${color.dim(`      ${line}`)}\n`);
+                        }
+                        lastLineWasTool = false;
+                        break;
+                    }
+                    /**
+                     * ⚠ SUCCESSES ARE SHOWN TOO, WHICH THEY WERE NOT.
+                     *
+                     * The old rule was failures-only, on the reasoning that "a successful
+                     * grep's stdout would bury the reply". That reasoning was sound and the
+                     * conclusion was too strong: the daemon already caps `preview` at 200
+                     * chars before it ever leaves the DO, so the flood it guarded against
+                     * cannot reach here. What the rule actually cost was the ability to see
+                     * whether a step did what it claimed — a tool that returns `{ok:false}`
+                     * INSIDE a successful call (which every canvas RPC does) was invisible.
+                     */
+                    case 'agent:tool-result': {
+                        // ⚠ FAILURES SURVIVE `--quiet`. A script that suppresses the step log
+                        // still needs to see the step that broke; silence there turns a failed
+                        // run into a mysteriously empty one.
+                        if (values.quiet && msg.ok)
+                            break;
+                        /**
+                         * ⚠ THE NAME IS ONLY PRINTED WHEN IT IS NOT ALREADY OBVIOUS.
+                         *
+                         * A result normally lands directly under its own call, where repeating
+                         * the tool name is pure noise on every single step. It stops being
+                         * obvious when calls INTERLEAVE — parallel tool use means the result
+                         * above may belong to a different step — so the label appears exactly
+                         * then, which is the only time it carries information.
+                         */
+                        const callId = String(msg.callId ?? '');
+                        const name = callId === lastCallId ? '' : (toolNames.get(callId) ?? '');
+                        const mark = msg.ok ? color.green('✓') : color.red('✗');
+                        const body = String(msg.preview ?? '').replace(/\s+/g, ' ').trim();
+                        const shown = body.length > 160 ? `${body.slice(0, 159)}…` : body;
+                        const tint = msg.ok ? color.dim : color.red;
+                        process.stdout.write(`      ${mark} ${tint(shown || (msg.ok ? 'ok' : 'failed'))}${name ? color.dim(`  (${name})`) : ''}\n`);
+                        lastLineWasTool = false;
+                        break;
+                    }
+                    case 'agent:error':
+                        console.error(`\n  ${color.red('✗')} ${msg.error}`);
+                        resolve();
+                        break;
+                    case 'agent:done':
+                        process.stdout.write('\n');
+                        resolve();
+                        break;
+                }
+            });
+        });
+        await client.omni('prompt', { prompt, sessionId, cwd: values.cwd ?? process.cwd() });
+        // No timeout on the wait: a coding turn legitimately runs for minutes and
+        // the user can always Ctrl-C. A timer here would abandon live work.
+        await done;
+        if (!printedAny)
+            console.log(color.dim('  (no text in that turn)'));
+    }
+    catch (err) {
+        console.error(color.red(`  ✗ ${err?.message ?? err}`));
+        process.exitCode = 1;
+    }
+    finally {
+        client.disconnect();
+    }
+}
+/**
+ * Render a blocked question and send the answer back.
+ *
+ * ⚠ THE TURN IS PARKED WHILE THIS IS OPEN. `ask_principal` and `propose_plan`
+ * sit inside a tool call in the daemon waiting for `omni:answer`, so a terminal
+ * that printed the question and moved on would hang for the full ten-minute
+ * timeout and then be told nobody answered.
+ *
+ * ⚠ FAILS AS A DISMISSAL, NOT AS AN ANSWER. If stdin is not a TTY (a script, a
+ * pipe, CI) there is nobody to ask, and answering with an empty string would
+ * read to the agent as a choice. `dismissed` is the honest outcome and the agent
+ * is instructed to treat it as "not now" rather than consent.
+ */
+async function answerInteractively(client, askId, ask) {
+    const opts = Array.isArray(ask?.options) ? ask.options : [];
+    try {
+        console.log(`\n  ${color.yellow('?')} ${ask?.question ?? 'Omni has a question'}`);
+        if (ask?.detail)
+            console.log(color.dim(`    ${String(ask.detail).split('\n').join('\n    ')}`));
+        if (!process.stdin.isTTY) {
+            console.log(color.dim('    (not a terminal — skipping)'));
+            await client.omni('answer', { askId, value: '', outcome: 'dismissed' });
+            return;
+        }
+        const { createInterface } = await import('node:readline/promises');
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        try {
+            let value = '';
+            if (opts.length) {
+                opts.forEach((o, i) => {
+                    console.log(`    ${color.cyan(String(i + 1))}. ${o.label}${o.detail ? color.dim(` — ${o.detail}`) : ''}`);
+                });
+                const raw = (await rl.question('    Choose [1]: ')).trim();
+                // Empty means the first option, which is where Omni is told to put its
+                // recommendation — so pressing return agrees with the recommendation.
+                const idx = raw === '' ? 0 : Number(raw) - 1;
+                value = opts[Number.isFinite(idx) && idx >= 0 && idx < opts.length ? idx : 0].value;
+            }
+            else {
+                value = (await rl.question('    ')).trim();
+            }
+            await client.omni('answer', { askId, value, outcome: value ? 'answered' : 'dismissed' });
+        }
+        finally {
+            rl.close();
+        }
+    }
+    catch {
+        // Never let a prompt failure strand the turn — dismiss so it can continue.
+        try {
+            await client.omni('answer', { askId, value: '', outcome: 'dismissed' });
+        }
+        catch { /* gone */ }
+    }
+}
+/**
+ * Every argument of a tool call, one `key: value` per line.
+ *
+ * ⚠ REPLACES `summarize()`, which returned ONE line built from the first string
+ * field it recognised. That was fine for `Bash{command}` and actively misleading
+ * for a structured call: `canvas_act{action, args, compositionId}` printed only
+ * the composition id, so the step that composed a hero block and the step that
+ * deleted a node looked identical.
+ *
+ * Bounded on BOTH axes on purpose — a `Write` call carries an entire file and a
+ * `MultiEdit` carries a list of them, so an unbounded dump would push the reply
+ * off screen, which is the failure the old one-liner was over-correcting for.
+ * Long values are cut at 240 chars; long inputs stop after 12 keys and say how
+ * many were withheld rather than trailing off silently.
+ */
+const MAX_VALUE_CHARS = 240;
+const MAX_KEYS = 12;
+/**
+ * Tools whose ARGUMENTS are re-rendered by a dedicated event, so echoing them as
+ * a step would print the same content twice.
+ *
+ * Each of these emits an `agent:principal` payload that the renderer above draws
+ * properly — prose, a URL, an image caption, a window notice. `ask_principal` is
+ * here for the same reason via `agent:ask`, which prints the question AND the
+ * choices before blocking on an answer.
+ */
+const ECHOED_BY_EVENT = new Set([
+    'mcp__principal__reply_to_principal',
+    'mcp__principal__ask_principal',
+    'mcp__principal__show_preview',
+    'mcp__principal__show_image',
+    'mcp__principal__open_window',
+]);
+function describeInput(input) {
+    const entries = Object.entries(input ?? {});
+    if (!entries.length)
+        return [];
+    const lines = [];
+    for (const [k, v] of entries.slice(0, MAX_KEYS)) {
+        let s;
+        if (typeof v === 'string')
+            s = v;
+        else if (v === null || v === undefined)
+            s = String(v);
+        else {
+            // Objects/arrays are the whole reason this exists — serialize rather than
+            // letting them render as "[object Object]", the exact bug this repo already
+            // records for `json` columns that are a type hint and not a serializer.
+            try {
+                s = JSON.stringify(v);
+            }
+            catch {
+                s = String(v);
+            }
+        }
+        s = s.replace(/\s+/g, ' ').trim();
+        if (s.length > MAX_VALUE_CHARS)
+            s = `${s.slice(0, MAX_VALUE_CHARS - 1)}…`;
+        lines.push(`${k}: ${s}`);
+    }
+    const hidden = entries.length - MAX_KEYS;
+    if (hidden > 0)
+        lines.push(`… ${hidden} more field${hidden === 1 ? '' : 's'}`);
+    return lines;
+}