@openagents-org/agent-launcher 0.2.191 → 0.2.193

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openagents-org/agent-launcher",
-  "version": "0.2.191",
+  "version": "0.2.193",
   "description": "OpenAgents Launcher \u2014 install, configure, and run AI coding agents from your terminal",
   "main": "src/index.js",
   "bin": {

package/src/adapters/base.js

@@ -35,6 +35,7 @@ const {
   classifyHeartbeatError,
   httpStatusOf,
 } = require('./health-status');
+const { FailureStreak, isTransientNetworkError, formatDuration } = require('./failure-streak');
 
 const DEFAULT_ENDPOINT = 'https://workspace-endpoint.openagents.org';
 
@@ -104,7 +105,7 @@ class BaseAdapter {
    * @param {string} opts.agentName
    * @param {string} [opts.endpoint]
    */
-  constructor({ workspaceId, channelName, token, agentName, endpoint, agentEnv, agentType, workingDir, onStatus }) {
+  constructor({ workspaceId, channelName, token, agentName, endpoint, agentEnv, agentType, workingDir, onStatus, logSink }) {
     this.workspaceId = workspaceId;
     this.channelName = channelName;
     this.token = token;
@@ -198,10 +199,17 @@ class BaseAdapter {
     // (e.g. after a `restart` IPC bounce) so uptime tracks "time since last
     // restart" rather than the long-running daemon's process uptime.
     this._startedAt = Date.now();
-    this._log = (msg) => {
+    // Inside the daemon, `logSink` routes lines through its daemon.log writer
+    // (batching, repeat suppression, rotation). Standalone, they go to stdout.
+    const sink = typeof logSink === 'function' ? logSink : null;
+    this._log = (msg, level = 'info') => {
+      if (sink) return sink(level, msg);
       const ts = new Date().toISOString();
-      console.log(`${ts} INFO adapter [${this.agentName}]: ${msg}`);
+      console.log(`${ts} ${String(level).toUpperCase()} adapter [${this.agentName}]: ${msg}`);
     };
+    // Runs of identical background failures (see failure-streak.js).
+    this._pollFailures = new FailureStreak();
+    this._heartbeatFailures = new FailureStreak();
   }
 
   // ------------------------------------------------------------------
@@ -337,7 +345,7 @@ class BaseAdapter {
         this._log(`Synced model from workspace: ${this.workspaceModel}`);
       }
     } catch (e) {
-      this._log(`Warning: skill sync failed (non-fatal): ${e.message}`);
+      this._log(`Warning: skill sync failed (non-fatal): ${e.message}`, 'warn');
     }
 
     // Fast-path operations (control-event cursor + heartbeat + control poll)
@@ -352,7 +360,7 @@ class BaseAdapter {
     try {
       // Send initial heartbeat
       try { await this._heartbeat(); } catch (e) {
-        this._log(`Heartbeat failed (non-fatal): ${e.message}`);
+        this._log(`Heartbeat failed (non-fatal): ${e.message}`, 'warn');
       }
       // Slow path: only the message-poll loop waits for this.
       await this._skipExistingEvents();
@@ -412,7 +420,7 @@ class BaseAdapter {
     } catch (e) {
       if (!this._warnedCursorPersist) {
         this._warnedCursorPersist = true;
-        this._log(`Could not persist poll cursor (${e.message}) — a restart will skip messages that arrive while offline`);
+        this._log(`Could not persist poll cursor (${e.message}) — a restart will skip messages that arrive while offline`, 'warn');
       }
     }
   }
@@ -457,10 +465,14 @@ class BaseAdapter {
     try {
       await this.client.heartbeat(this.workspaceId, this.agentName, this.token, this._sessionId);
       this._heartbeatFailStreak = 0;
+      const recovered = this._heartbeatFailures.succeed();
+      if (recovered) {
+        this._log(`Workspace heartbeat recovered after ${recovered.count} unsuccessful attempt(s) over ${formatDuration(recovered.ms)}`);
+      }
       this._reportStatus(null); // alive → clear any prior connectivity error
     } catch (e) {
       if (e instanceof SessionRevokedError) {
-        this._log(`SESSION REVOKED: another client joined as '${this.agentName}'. Stopping adapter.`);
+        this._log(`SESSION REVOKED: another client joined as '${this.agentName}'. Stopping adapter.`, 'warn');
         // Terminal (not a user stop): record so the daemon can show why it ended.
         this._setExitInfo(REASON.SESSION_REVOKED, 'Workspace session revoked — another client joined with the same agent name');
         this._reportStatus(REASON.SESSION_REVOKED, 'Workspace session revoked');
@@ -471,7 +483,9 @@ class BaseAdapter {
       // single transient blip (or an expected brief reconnect) isn't mislabeled.
       this._heartbeatFailStreak++;
       const { reason, message } = classifyHeartbeatError(e);
-      this._log(`${message} (consecutive failures: ${this._heartbeatFailStreak})`);
+      if (this._heartbeatFailures.fail()) {
+        this._log(`${message} (consecutive failures: ${this._heartbeatFailStreak})`, 'warn');
+      }
       if (this._heartbeatFailStreak >= HEARTBEAT_ERROR_THRESHOLD) {
         this._reportStatus(reason, message);
       }
@@ -593,7 +607,7 @@ class BaseAdapter {
     }
     if (!channel) {
       try { await this._stopSharedWork(); } catch (e) {
-        this._log(`Stop: shared work did not stop cleanly: ${e && e.message ? e.message : e}`);
+        this._log(`Stop: shared work did not stop cleanly: ${e && e.message ? e.message : e}`, 'warn');
       }
     }
     for (const ch of channels) {
@@ -601,7 +615,7 @@ class BaseAdapter {
       try {
         outcome = await this._stopChannelWork(ch);
       } catch (e) {
-        this._log(`Stop: ${ch} did not stop cleanly: ${e && e.message ? e.message : e}`);
+        this._log(`Stop: ${ch} did not stop cleanly: ${e && e.message ? e.message : e}`, 'warn');
         outcome = 'failed';
       }
       // The pressed channel is always answered, so its UI settles even when
@@ -788,7 +802,7 @@ class BaseAdapter {
         skillId, state: 'installing',
       });
     } catch (e) {
-      this._log(`skill.install: could not report 'installing' (non-fatal): ${e && e.message ? e.message : e}`);
+      this._log(`skill.install: could not report 'installing' (non-fatal): ${e && e.message ? e.message : e}`, 'warn');
     }
 
     try {
@@ -822,19 +836,19 @@ class BaseAdapter {
           skillId, state: 'installed', path: result.path, partial: result.partial === true,
         });
       } catch (e) {
-        this._log(`skill.install: installed on disk but failed to report 'installed': ${e && e.message ? e.message : e}`);
+        this._log(`skill.install: installed on disk but failed to report 'installed': ${e && e.message ? e.message : e}`, 'warn');
       }
       this._log(`skill.install: SUCCESS "${skillId}" → ${result.path}${result.partial ? ' (partial)' : ''}`);
       await this._onSkillsChanged();
     } catch (e) {
       const msg = e && e.message ? e.message : String(e);
-      this._log(`skill.install: FAILED "${skillId}": ${msg}`);
+      this._log(`skill.install: FAILED "${skillId}": ${msg}`, 'error');
       try {
         await this.client.reportSkillStatus(this.workspaceId, this.agentName, this.token, {
           skillId, state: 'failed', error: msg,
         });
       } catch (e2) {
-        this._log(`skill.install: also failed to report 'failed': ${e2 && e2.message ? e2.message : e2}`);
+        this._log(`skill.install: also failed to report 'failed': ${e2 && e2.message ? e2.message : e2}`, 'warn');
       }
     }
   }
@@ -863,12 +877,12 @@ class BaseAdapter {
           skillId, state: 'uninstalled',
         });
       } catch (e) {
-        this._log(`skill.uninstall: failed to report status: ${e && e.message ? e.message : e}`);
+        this._log(`skill.uninstall: failed to report status: ${e && e.message ? e.message : e}`, 'warn');
       }
       await this._onSkillsChanged();
     } catch (e) {
       const msg = e && e.message ? e.message : String(e);
-      this._log(`skill.uninstall: FAILED "${skillId}": ${msg}`);
+      this._log(`skill.uninstall: FAILED "${skillId}": ${msg}`, 'error');
     }
   }
 
@@ -923,7 +937,7 @@ class BaseAdapter {
         sessionId: this._sessionId,
       });
     } catch (e) {
-      this._log(`Status: failed to post: ${e && e.message ? e.message : e}`);
+      this._log(`Status: failed to post: ${e && e.message ? e.message : e}`, 'warn');
     }
   }
 
@@ -950,7 +964,7 @@ class BaseAdapter {
         (r) => r.created_by === prefixed || r.created_by === this.agentName,
       );
     } catch (e) {
-      this._log(`Routines: failed to list: ${e && e.message ? e.message : e}`);
+      this._log(`Routines: failed to list: ${e && e.message ? e.message : e}`, 'warn');
       try {
         await this.client.sendMessage(
           this.workspaceId, channel, this.token,
@@ -991,7 +1005,7 @@ class BaseAdapter {
         sessionId: this._sessionId,
       });
     } catch (e) {
-      this._log(`Routines: failed to post: ${e && e.message ? e.message : e}`);
+      this._log(`Routines: failed to post: ${e && e.message ? e.message : e}`, 'warn');
     }
   }
 
@@ -1049,11 +1063,26 @@ class BaseAdapter {
         rawCursor = result.cursor;
         composingActive = !!result.composing;
         this._pollAuthFailStreak = 0;
+        const recovered = this._pollFailures.succeed();
+        if (recovered) {
+          this._log(`Poll recovered after ${recovered.count} unsuccessful attempt(s) over ${formatDuration(recovered.ms)}`);
+        }
         if (pollCount <= 3 || pollCount % 20 === 0) {
           this._log(`Poll #${pollCount}: ${messages.length} messages, cursor=${rawCursor || 'none'}${composingActive ? ' composing' : ''}`);
         }
       } catch (e) {
-        this._log(`Poll #${pollCount} failed: ${e.message} \nStack: ${e.stack}`);
+        // A workspace that is down or slow fails every poll until it is back;
+        // log the streak, not every attempt (see failure-streak.js).
+        if (this._pollFailures.fail()) {
+          const count = this._pollFailures.count;
+          const streak = count > 1 ? ` (consecutive failures: ${count})` : '';
+          if (isTransientNetworkError(e)) {
+            this._log(`Poll #${pollCount} failed: ${e.message}${streak} — retrying every 5s`, 'warn');
+          } else {
+            const stack = count === 1 && e && e.stack ? `\nStack: ${e.stack}` : '';
+            this._log(`Poll #${pollCount} failed: ${e && e.message}${streak}${stack}`, 'error');
+          }
+        }
         // A rejected credential never heals by retrying with the same token —
         // it means the device was re-paired/unpaired and this adapter is
         // running on a revoked one. After a few consecutive rejections (not
@@ -1249,7 +1278,7 @@ class BaseAdapter {
           await this._handleMessage(current);
         }
       } catch (e) {
-        this._log(`Error ${first ? 'in channel worker' : 'processing queued message'} for ${channel}: ${e.message}`);
+        this._log(`Error ${first ? 'in channel worker' : 'processing queued message'} for ${channel}: ${e.message}`, 'error');
         try { await this.sendError(channel, `Agent error: ${e.message}`); } catch {}
       }
       delete this._channelRunGeneration[channel];
@@ -1333,7 +1362,7 @@ class BaseAdapter {
           delete cache[channel];
           // Entry is gone — fall through to list+match below.
         } else {
-          this._log(`${label} read failed (${e.message}) — reusing last known state`);
+          this._log(`${label} read failed (${e.message}) — reusing last known state`, 'warn');
           return { available: true, state: 'found', entryId: cachedId, title: titles[0], content: null, error: true };
         }
       }
@@ -1369,7 +1398,7 @@ class BaseAdapter {
       }
       return { available: true, state: 'found', entryId: entry.id, title: matchedTitle, content: (full && full.content) || '', error: false };
     } catch (e) {
-      this._log(`${label} fetch failed (${e.message}) — reusing last known state`);
+      this._log(`${label} fetch failed (${e.message}) — reusing last known state`, 'warn');
       const knownId = cache[channel] || null;
       return { available: true, state: knownId ? 'found' : 'unknown', entryId: knownId, title: knownId ? titles[0] : null, content: null, error: true };
     }
@@ -1427,7 +1456,7 @@ class BaseAdapter {
       }
       this._pinnedContext[channel] = fresh;
     } catch (e) {
-      this._log(`Pinned-context fetch failed (${e && e.message ? e.message : e}) — reusing the last pinned context`);
+      this._log(`Pinned-context fetch failed (${e && e.message ? e.message : e}) — reusing the last pinned context`, 'warn');
     }
   }
 
@@ -1475,7 +1504,7 @@ class BaseAdapter {
         this._log(`Auto-titled channel: ${title}`);
       }
     } catch (e) {
-      this._log(`Failed to auto-title channel: ${e.message}`);
+      this._log(`Failed to auto-title channel: ${e.message}`, 'warn');
     }
   }
 
@@ -1625,7 +1654,7 @@ class BaseAdapter {
   }
 
   _onSessionRevoked() {
-    this._log(`SESSION REVOKED: another client joined as '${this.agentName}'. Stopping adapter.`);
+    this._log(`SESSION REVOKED: another client joined as '${this.agentName}'. Stopping adapter.`, 'warn');
     this._running = false;
   }
 

package/src/adapters/codex.js

@@ -343,6 +343,13 @@ class CodexAdapter extends BaseAdapter {
 
         if (result.responseText) {
           await this.sendResponse(msgChannel, result.responseText);
+          // A run that said something and then died (turn.failed, non-zero
+          // exit) used to post only that opening line as the finished reply,
+          // so it read as "Codex says one sentence and stops" with the real
+          // error left in daemon.log. Say it stopped, and why.
+          if (CodexAdapter._endedEarly(result)) {
+            await this._sendRunFailure(msgChannel, result, { partial: true });
+          }
           return;
         } else if (result.exitCode !== 0 && threadId && attempt === 0) {
           // Stale thread — clear and retry fresh
@@ -384,6 +391,7 @@ class CodexAdapter extends BaseAdapter {
       let lineBuffer = '';
       let stderrBuf = '';
       let lastErrorMessage = '';
+      let turnFailed = false;
       let _pendingLines = Promise.resolve();
 
       if (proc.stderr) {
@@ -433,7 +441,11 @@ class CodexAdapter extends BaseAdapter {
             this._log(`Command: ${cmdText} → exit ${exitCode}`);
           } else if (item.type === 'file_change') {
             hasToolUseSinceLastText = true;
-            const filename = item.filename || '';
+            // codex reports the edited files in `changes`; `filename` is the
+            // legacy shape and was always empty on current CLIs.
+            const filename = Array.isArray(item.changes) && item.changes.length
+              ? item.changes.map((c) => c && c.path).filter(Boolean).join(', ')
+              : (item.filename || '');
             try { await this.sendStatus(msgChannel, `**Editing:** \`${filename}\``); } catch {}
             this._log(`File change: ${filename}`);
           }
@@ -441,6 +453,7 @@ class CodexAdapter extends BaseAdapter {
           const error = event.error || {};
           const errMsg = error.message || JSON.stringify(error);
           lastErrorMessage = errMsg;
+          turnFailed = true;
           this._log(`Turn failed: ${errMsg}`);
         } else if (eventType === 'error') {
           const errMsg = event.message || JSON.stringify(event);
@@ -481,6 +494,7 @@ class CodexAdapter extends BaseAdapter {
           exitCode: code,
           stderr: stderrBuf,
           errorMessage: lastErrorMessage,
+          turnFailed,
         });
       });
 
@@ -569,14 +583,31 @@ class CodexAdapter extends BaseAdapter {
    * Post a user-visible failure carrying the actual reason a run produced no
    * reply, instead of a generic "No response generated".
    */
-  async _sendRunFailure(msgChannel, result) {
+  async _sendRunFailure(msgChannel, result, { partial = false } = {}) {
     const detail = CodexAdapter._failureDetail(result);
+    if (partial) {
+      const body = detail
+        ? `It stopped before finishing this task.\n\n> ${detail}`
+        : 'It stopped before finishing this task. Please try again.';
+      await this.sendError(msgChannel, `⚠️ **Codex stopped partway** — ${body}`);
+      return;
+    }
     const body = detail
       ? `Codex failed to complete this run.\n\n> ${detail}`
       : 'Codex finished without producing a reply. Please try again.';
     await this.sendError(msgChannel, `⚠️ **Codex couldn't run** — ${body}`);
   }
 
+  /**
+   * True when a run that produced some text did not actually finish. Only a
+   * turn.failed or a non-zero exit counts: codex also emits `error` events
+   * for retries it recovers from ("Reconnecting... 2/5"), and a run that
+   * reconnected and then completed is fine.
+   */
+  static _endedEarly({ exitCode, turnFailed } = {}) {
+    return Boolean(turnFailed) || (exitCode !== 0 && exitCode !== undefined);
+  }
+
   /**
    * Pick the most informative failure detail from a run result:
    * turn.failed / error event message → stderr tail → exit code. Redacted.

package/src/adapters/failure-streak.js

@@ -0,0 +1,89 @@
+'use strict';
+
+/**
+ * Logging policy for background calls that fail repeatedly — the message poll
+ * and the workspace heartbeat.
+ *
+ * Both retry forever, so an unreachable or slow workspace used to produce one
+ * entry per attempt: the poll wrote a full stack every ~20s (15s deadline + 5s
+ * back-off) at INFO, and the Logs page — inferring severity from "failed" plus
+ * the stack — showed a wall of red ERRORs for what was a network outage.
+ *
+ * A streak logs its 1st, 3rd, 10th, 30th and then every 100th failure, and one
+ * line when it ends. Network-level failures are expected in the field and are
+ * WARN without a stack; anything else is an ERROR, with its stack once.
+ *
+ * Pure and dependency-light, so it is unit-testable without an adapter.
+ */
+
+const { httpStatusOf } = require('./health-status');
+
+const TRANSIENT_CODES = new Set([
+  'ETIMEDOUT',
+  'ECONNRESET',
+  'ECONNREFUSED',
+  'ECONNABORTED',
+  'ENOTFOUND',
+  'EAI_AGAIN',
+  'ENETUNREACH',
+  'ENETDOWN',
+  'EHOSTUNREACH',
+  'EPIPE',
+  'UND_ERR_SOCKET',
+  'UND_ERR_CONNECT_TIMEOUT',
+]);
+
+/**
+ * True for failures of the network or of an overloaded server — the kind a
+ * retry is expected to fix, not a bug or a rejected credential.
+ */
+function isTransientNetworkError(err) {
+  if (!err) return false;
+  if (err.code && TRANSIENT_CODES.has(err.code)) return true;
+  if (err.name === 'AbortError' || err.name === 'TimeoutError') return true;
+  const status = httpStatusOf(err);
+  if (typeof status === 'number') return status === 429 || status >= 500;
+  return /\b(timed out|socket hang up|network)\b/i.test(err.message || '');
+}
+
+/** Which failure counts in a streak get a log line. */
+function isLogPoint(count) {
+  return count === 1 || count === 3 || count === 10 || count === 30 || count % 100 === 0;
+}
+
+class FailureStreak {
+  constructor() {
+    this.count = 0;
+    this.since = 0;
+  }
+
+  /** Record one failure. True when this one should be logged. */
+  fail(now = Date.now()) {
+    this.count++;
+    if (this.count === 1) this.since = now;
+    return isLogPoint(this.count);
+  }
+
+  /**
+   * Record a success. Returns the streak it ended — `{ count, ms }` — or null
+   * when there was none.
+   */
+  succeed(now = Date.now()) {
+    if (this.count === 0) return null;
+    const ended = { count: this.count, ms: now - this.since };
+    this.count = 0;
+    this.since = 0;
+    return ended;
+  }
+}
+
+/** "45s" / "12m" / "3h" — for the line that closes a streak. */
+function formatDuration(ms) {
+  const s = Math.max(0, Math.round(ms / 1000));
+  if (s < 120) return `${s}s`;
+  const m = Math.round(s / 60);
+  if (m < 120) return `${m}m`;
+  return `${Math.round(m / 60)}h`;
+}
+
+module.exports = { FailureStreak, isTransientNetworkError, isLogPoint, formatDuration };

package/src/adapters/kimi.js

@@ -38,6 +38,7 @@ const { spawn } = require('../wsl');
 const LlmDirectAdapter = require('./llm-direct');
 const { formatAttachmentsForPrompt, SESSION_DEFAULT_RE, generateSessionTitle } = require('./utils');
 const { defaultAgentWorkdir, whichBinary, whereBinary } = require('../paths');
+const { fixSpawnHelpersFor } = require('../node-pty-perms');
 const {
   KimiStreamParser,
   interpretKimiMessage,
@@ -70,6 +71,7 @@ const WATCHDOG_MAX = 20;         // ~5 min of silence → kill
 // don't re-spawn `kimi --version`, yet an install/upgrade is re-detected.
 const VERSION_CACHE_TTL_MS = 5 * 60 * 1000;
 const _kimiVersionCache = new Map(); // binPath -> { version, product, at }
+const _ptyFixedBins = new Set(); // binPaths whose node-pty spawn-helper was checked
 
 /** Newest mtime (ms) of a directory and everything under it, `depth` levels deep. */
 function newestMtimeMs(dir, depth) {
@@ -522,6 +524,15 @@ class KimiAdapter extends LlmDirectAdapter {
       return;
     }
 
+    // An install from before the installer restored node-pty's spawn-helper
+    // (or one the user made) still has it at 0644, and every terminal Kimi
+    // opens fails with "posix_spawnp failed." Once per binary per daemon.
+    if (!_ptyFixedBins.has(kimiBin)) {
+      _ptyFixedBins.add(kimiBin);
+      const fixed = fixSpawnHelpersFor(kimiBin);
+      if (fixed.length) this._log(`Made node-pty spawn-helper executable: ${fixed.join(', ')}`);
+    }
+
     await this._handleMessageCli(msg, kimiBin);
   }
 

package/src/adapters/pi.js

@@ -24,7 +24,8 @@
  *
  * Verified against pi 0.83.0 (engines.node >= 22.19.0). Because that engine
  * floor is above what a user's ambient Node may satisfy, a resolved JS entry
- * point is launched with the launcher's own portable Node (v22.22.3) and
+ * point is launched with the launcher's own portable Node (v24, or v22 on
+ * macOS before 13.5) and
  * preflight refuses to start on anything older.
  */
 

package/src/config.js

@@ -180,48 +180,62 @@ class Config {
 
   getLogs(agentName, lines = 200) {
     try {
-      if (!fs.existsSync(this.logFile)) return [];
-      const content = fs.readFileSync(this.logFile, 'utf-8');
-      let allLines = content.split('\n').filter(Boolean);
-      if (agentName) {
-        allLines = allLines.filter(
-          (l) => l.includes(agentName) || l.includes('daemon') || l.includes('Daemon')
-        );
-      }
-      return allLines.slice(-lines);
+      return this.tailLogs({ agent: agentName, lines }).lines;
     } catch {
       return [];
     }
   }
 
   /**
-   * Tail log file with optional filter. Returns { lines, size }.
+   * Tail log file with optional filter. Returns { lines, size, reset }.
+   * Reads only the end of the file (or what was appended since `offset`), so
+   * the cost tracks what is returned rather than how large daemon.log grew.
    * @param {Object} opts - { agent, lines, offset }
    * @param {string} [opts.agent] - Filter by agent name
    * @param {number} [opts.lines=100] - Number of lines to return
    * @param {number} [opts.offset=0] - Byte offset for incremental reads (0 = from end)
+   * @returns {{ lines: string[], size: number, reset: boolean }} `size` is the
+   *   offset for the next call; `reset` means the file shrank (cleared or
+   *   replaced) and `lines` replace what the caller had.
    */
   tailLogs(opts = {}) {
     const { agent, lines = 100, offset = 0 } = opts;
+    const keep = agent
+      ? (l) => l.includes(agent) || l.includes('daemon') || l.includes('Daemon')
+      : () => true;
+    let size;
     try {
-      if (!fs.existsSync(this.logFile)) return { lines: [], size: 0 };
-      const stat = fs.statSync(this.logFile);
-      if (offset > 0 && offset < stat.size) {
-        // Incremental read from offset
-        const fd = fs.openSync(this.logFile, 'r');
-        const buf = Buffer.alloc(stat.size - offset);
-        fs.readSync(fd, buf, 0, buf.length, offset);
-        fs.closeSync(fd);
-        let newLines = buf.toString('utf-8').split('\n').filter(Boolean);
-        if (agent) {
-          newLines = newLines.filter(l => l.includes(agent) || l.includes('Daemon'));
+      size = fs.statSync(this.logFile).size;
+    } catch {
+      return { lines: [], size: 0, reset: offset > 0 };
+    }
+    // Nothing appended since the last read.
+    if (offset > 0 && offset === size) return { lines: [], size, reset: false };
+
+    try {
+      const fd = fs.openSync(this.logFile, 'r');
+      try {
+        if (offset > 0 && offset < size) {
+          const start = Math.max(offset, size - MAX_INCREMENT_BYTES);
+          const buf = readRange(fd, start, size);
+          const lastNewline = buf.lastIndexOf(0x0a);
+          // A line still being written is left for the next read.
+          if (lastNewline < 0) {
+            return { lines: [], size: start > offset ? size : offset, reset: false };
+          }
+          let body = buf.subarray(0, lastNewline + 1);
+          // Skipped part of the backlog: drop the fragment the read landed in.
+          if (start > offset) body = body.subarray(body.indexOf(0x0a) + 1);
+          return { lines: splitLines(body, keep), size: start + lastNewline + 1, reset: false };
         }
-        return { lines: newLines, size: stat.size };
+        // First read, or the file shrank under us (cleared, replaced).
+        const tail = readLastLines(fd, size, lines, keep);
+        return { lines: tail.lines, size: tail.end, reset: offset > 0 };
+      } finally {
+        fs.closeSync(fd);
       }
-      // Full read, return last N
-      return { lines: this.getLogs(agent, lines), size: stat.size };
     } catch {
-      return { lines: [], size: 0 };
+      return { lines: [], size: 0, reset: offset > 0 };
     }
   }
 
@@ -255,9 +269,18 @@ class Config {
     const { keptLines, removed } = filterLogsByTimeRange(allLines, start, end);
 
     const nextContent = keptLines.join('\n') + (hasTrailingNewline && keptLines.length > 0 ? '\n' : '');
-    const tempFile = `${this.logFile}.tmp`;
-    fs.writeFileSync(tempFile, nextContent, 'utf-8');
-    fs.renameSync(tempFile, this.logFile);
+    // Rewrite in place, not write-temp + rename: the running daemon's stdout
+    // and stderr are append-mode handles to daemon.log. A rename leaves them
+    // writing into the replaced file (and fails outright on Windows while they
+    // are open); truncating in place keeps them appending to daemon.log.
+    const nextBytes = Buffer.from(nextContent, 'utf-8');
+    const fd = fs.openSync(this.logFile, 'r+');
+    try {
+      if (nextBytes.length > 0) fs.writeSync(fd, nextBytes, 0, nextBytes.length, 0);
+      fs.ftruncateSync(fd, nextBytes.length);
+    } finally {
+      fs.closeSync(fd);
+    }
 
     return { removed, remaining: keptLines.length };
   }
@@ -323,6 +346,62 @@ function parseYaml(text) {
   return result;
 }
 
+/** Bytes read per step when walking back from the end of the log. */
+const TAIL_CHUNK = 64 * 1024;
+/** How far back a first read may walk looking for lines matching the agent filter. */
+const MAX_SCAN_BYTES = 16 * 1024 * 1024;
+/** The most an incremental read takes in one go; older backlog is skipped. */
+const MAX_INCREMENT_BYTES = 4 * 1024 * 1024;
+
+function readRange(fd, start, end) {
+  const buf = Buffer.alloc(end - start);
+  let read = 0;
+  while (read < buf.length) {
+    const n = fs.readSync(fd, buf, read, buf.length - read, start + read);
+    if (n === 0) break;
+    read += n;
+  }
+  return read === buf.length ? buf : buf.subarray(0, read);
+}
+
+function splitLines(buf, keep) {
+  return buf.toString('utf-8').split('\n').filter((l) => l && keep(l));
+}
+
+/**
+ * The last `count` matching lines, read backwards in chunks. Stops at the last
+ * newline: a line still being written is left for the next incremental read.
+ */
+function readLastLines(fd, size, count, keep) {
+  const lastChunk = readRange(fd, Math.max(0, size - TAIL_CHUNK), size);
+  const lastNewline = lastChunk.lastIndexOf(0x0a);
+  const end = lastNewline >= 0 ? size - lastChunk.length + lastNewline + 1 : size;
+
+  let lines = [];
+  let pos = end;
+  let carry = Buffer.alloc(0);
+  while (pos > 0 && lines.length < count && end - pos < MAX_SCAN_BYTES) {
+    const start = Math.max(0, pos - TAIL_CHUNK);
+    const block = Buffer.concat([readRange(fd, start, pos), carry]);
+    pos = start;
+    let body = block;
+    if (pos > 0) {
+      // The block starts mid-line; that fragment joins the next block.
+      const firstNewline = block.indexOf(0x0a);
+      if (firstNewline < 0) {
+        carry = block;
+        continue;
+      }
+      carry = block.subarray(0, firstNewline);
+      body = block.subarray(firstNewline + 1);
+    } else {
+      carry = Buffer.alloc(0);
+    }
+    lines = [...splitLines(body, keep), ...lines];
+  }
+  return { lines: lines.slice(-count), end };
+}
+
 function normalizeTimeValue(value) {
   if (value instanceof Date) {
     return Number.isNaN(value.getTime()) ? null : value;