Adds system_logs with two variants:
- journalctl (systemd hosts): unit, since, lines, grep
- dmesg (any Linux): source, lines, grep
Both declare sudo: true — privilege escalation is handled by dispatch.
Also adds OR support in match conditions: array values mean any must
pass. Combined with AND across keys:
{"binary": ["journalctl", "systemd-cat"], "os": "linux"}
= (journalctl OR systemd-cat) AND linux
Tools no longer need to be co-located in $OLLIE_TOOLS_PATH. The .meta
sidecar can specify a cmd field pointing to any executable:
- Absolute path: use directly
- Bare name: resolve via $PATH
Resolution order: OLLIE_TOOLS_PATH/<name> → meta.cmd → PATH lookup.
Local wrappers always win, enabling simplified interfaces over complex
system binaries.
Rewrites doc/WRITING_TOOLS.md to document the plugin model: any
executable + .meta = tool, no source tree integration required.
Ollie Agent