@ouro.bot/cli 0.1.0-alpha.36 → 0.1.0-alpha.361

package/dist/heart/daemon/hooks/bundle-meta.js

@@ -37,6 +37,115 @@ exports.bundleMetaHook = bundleMetaHook;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../../../nerves/runtime");
+/**
+ * Migrate bundle from schema 1 to schema 2:
+ * - Move state/{episodes,obligations,cares,intentions}/* to arc/{name}/*
+ * - Move the old psyche note store to diary/
+ * Idempotent: skips missing sources; on collision, newer mtime wins.
+ */
+function migrateToSchema2(agentRoot) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.bundle_migration_start",
+        message: "migrating bundle to schema 2",
+        meta: { agentRoot },
+    });
+    // Migrate arc entities
+    for (const name of ["episodes", "obligations", "cares", "intentions"]) {
+        const src = path.join(agentRoot, "state", name);
+        const dest = path.join(agentRoot, "arc", name);
+        migrateDirectory(src, dest);
+    }
+    // Migrate diary from the old pre-diary bundle layout.
+    const legacyDiarySrc = path.join(agentRoot, "psyche", "mem" + "ory");
+    const diaryDest = path.join(agentRoot, "diary");
+    migrateDirectory(legacyDiarySrc, diaryDest);
+    // Update bundle .gitignore
+    updateBundleGitignore(agentRoot);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.bundle_migration_end",
+        message: "bundle migration to schema 2 complete",
+        meta: { agentRoot },
+    });
+}
+/**
+ * Ensure bundle .gitignore has state/ ignored and does NOT ignore arc/, diary/, journal/.
+ */
+function updateBundleGitignore(agentRoot) {
+    const gitignorePath = path.join(agentRoot, ".gitignore");
+    let lines = [];
+    try {
+        if (fs.existsSync(gitignorePath)) {
+            lines = fs.readFileSync(gitignorePath, "utf-8").split("\n");
+        }
+    }
+    catch {
+        // If we can't read, start fresh
+    }
+    // Remove arc/, diary/, journal/ from ignore (they should be tracked)
+    const toRemove = new Set(["arc/", "diary/", "journal/"]);
+    lines = lines.filter((line) => !toRemove.has(line.trim()));
+    // Ensure state/ is in the ignore list
+    const hasState = lines.some((line) => line.trim() === "state/");
+    if (!hasState) {
+        lines.push("state/");
+    }
+    // Write back, trimming trailing empty lines and ensuring trailing newline
+    const content = lines.join("\n").replace(/\n+$/, "") + "\n";
+    try {
+        fs.writeFileSync(gitignorePath, content, "utf-8");
+    }
+    catch {
+        // Non-blocking: if we can't write .gitignore, migration still succeeds
+    }
+}
+/**
+ * Recursively copy files from src to dest.
+ * Creates destination directories as needed. Skips if source doesn't exist.
+ * When both source and destination exist, compares mtimes: newer file wins.
+ * Logs a warning either way when a collision is detected.
+ */
+function migrateDirectory(src, dest) {
+    if (!fs.existsSync(src))
+        return;
+    fs.mkdirSync(dest, { recursive: true });
+    const entries = fs.readdirSync(src, { withFileTypes: true });
+    for (const entry of entries) {
+        const srcPath = path.join(src, entry.name);
+        const destPath = path.join(dest, entry.name);
+        if (entry.isDirectory()) {
+            migrateDirectory(srcPath, destPath);
+        }
+        else if (!fs.existsSync(destPath)) {
+            fs.copyFileSync(srcPath, destPath);
+        }
+        else {
+            // Collision: both source and destination exist — compare mtimes
+            const srcMtime = fs.statSync(srcPath).mtimeMs;
+            const destMtime = fs.statSync(destPath).mtimeMs;
+            if (srcMtime > destMtime) {
+                fs.copyFileSync(srcPath, destPath);
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "daemon",
+                    event: "daemon.bundle_migration_collision",
+                    message: `migration collision: source newer, overwriting destination`,
+                    meta: { srcPath, destPath, srcMtime, destMtime },
+                });
+            }
+            else {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "daemon",
+                    event: "daemon.bundle_migration_collision",
+                    message: `migration collision: destination newer or equal, keeping destination`,
+                    meta: { srcPath, destPath, srcMtime, destMtime },
+                });
+            }
+        }
+    }
+}
 async function bundleMetaHook(ctx) {
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
@@ -56,9 +165,14 @@ async function bundleMetaHook(ctx) {
         // Malformed JSON -- treat as missing, will overwrite with fresh
         existing = undefined;
     }
+    // Run schema-2 migration if needed
+    const currentSchema = existing?.bundleSchemaVersion ?? 1;
+    if (currentSchema < 2) {
+        migrateToSchema2(ctx.agentRoot);
+    }
     const updated = {
         runtimeVersion: ctx.currentVersion,
-        bundleSchemaVersion: existing?.bundleSchemaVersion ?? 1,
+        bundleSchemaVersion: currentSchema < 2 ? 2 : currentSchema,
         lastUpdated: new Date().toISOString(),
     };
     // Save old runtimeVersion as previousRuntimeVersion (if there was one)

package/dist/heart/daemon/http-health-probe.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHttpHealthProbe = createHttpHealthProbe;
+const http = __importStar(require("node:http"));
+function createHttpHealthProbe(name, port, timeoutMs = 5000) {
+    return {
+        name,
+        check: () => new Promise((resolve) => {
+            const req = http.get({
+                hostname: "127.0.0.1",
+                port,
+                path: "/health",
+                timeout: timeoutMs,
+            }, (res) => {
+                let body = "";
+                res.on("data", (chunk) => {
+                    body += chunk.toString();
+                });
+                res.on("end", () => {
+                    if (res.statusCode !== 200) {
+                        resolve({ ok: false, detail: `HTTP ${res.statusCode}` });
+                        return;
+                    }
+                    try {
+                        const parsed = JSON.parse(body);
+                        if (parsed.status === "ok") {
+                            resolve({ ok: true });
+                        }
+                        else {
+                            resolve({ ok: false, detail: `unexpected status: ${String(parsed.status)}` });
+                        }
+                    }
+                    catch {
+                        resolve({ ok: false, detail: "invalid JSON response" });
+                    }
+                });
+            });
+            req.on("timeout", () => {
+                req.destroy();
+                resolve({ ok: false, detail: "timeout" });
+            });
+            req.on("error", (err) => {
+                resolve({ ok: false, detail: err.message });
+            });
+        }),
+    };
+}

package/dist/heart/daemon/inner-status.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildInnerStatusOutput = buildInnerStatusOutput;
+const runtime_1 = require("../../nerves/runtime");
+function formatRelativeTime(elapsedMs) {
+    const minutes = Math.floor(elapsedMs / (60 * 1000));
+    if (minutes < 1)
+        return "just now";
+    if (minutes === 1)
+        return "1 minute ago";
+    if (minutes < 60)
+        return `${minutes} minutes ago`;
+    const hours = Math.floor(minutes / 60);
+    if (hours === 1)
+        return "1 hour ago";
+    return `${hours} hours ago`;
+}
+function formatCadence(cadenceMs) {
+    const minutes = Math.round(cadenceMs / (60 * 1000));
+    if (minutes >= 60) {
+        const hours = Math.round(minutes / 60);
+        return `${hours}h`;
+    }
+    return `${minutes}m`;
+}
+function buildInnerStatusOutput(input) {
+    const { agentName, runtimeState, journalFiles, heartbeat, attentionCount, now } = input;
+    const lines = [];
+    lines.push(`inner dialog status: ${agentName}`);
+    // Last turn
+    if (runtimeState?.lastCompletedAt) {
+        const lastMs = new Date(runtimeState.lastCompletedAt).getTime();
+        const elapsed = now - lastMs;
+        const relativeTime = formatRelativeTime(elapsed);
+        const reasonSuffix = runtimeState.reason ? ` (${runtimeState.reason})` : "";
+        lines.push(`  last turn: ${relativeTime}${reasonSuffix}`);
+    }
+    else {
+        lines.push("  last turn: unknown");
+    }
+    // Status
+    if (runtimeState) {
+        const reasonSuffix = runtimeState.status === "running" && runtimeState.reason ? ` (${runtimeState.reason})` : "";
+        lines.push(`  status: ${runtimeState.status}${reasonSuffix}`);
+    }
+    else {
+        lines.push("  status: unknown");
+    }
+    // Heartbeat health
+    if (heartbeat && heartbeat.lastCompletedAt !== null) {
+        const elapsed = now - heartbeat.lastCompletedAt;
+        const threshold = heartbeat.cadenceMs * 1.5;
+        const health = elapsed < threshold ? "healthy" : "overdue";
+        const cadenceStr = formatCadence(heartbeat.cadenceMs);
+        const sinceStr = formatRelativeTime(elapsed);
+        lines.push(`  heartbeat: ${health} (cadence ${cadenceStr}, ${sinceStr})`);
+    }
+    else {
+        lines.push("  heartbeat: unknown");
+    }
+    // Journal
+    if (journalFiles.length === 0) {
+        lines.push("  journal: (empty)");
+    }
+    else {
+        lines.push("  journal:");
+        const sorted = [...journalFiles].sort((a, b) => b.mtimeMs - a.mtimeMs);
+        for (const file of sorted) {
+            const elapsed = now - file.mtimeMs;
+            const relativeTime = formatRelativeTime(elapsed);
+            lines.push(`    - ${file.name} (${relativeTime})`);
+        }
+    }
+    // Attention
+    const thoughtWord = attentionCount === 1 ? "thought" : "thoughts";
+    lines.push(`  attention: ${attentionCount} held ${thoughtWord}`);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.inner_status_read",
+        message: "inner dialog status read",
+        meta: {
+            agentName,
+            status: runtimeState?.status ?? "unknown",
+            journalCount: journalFiles.length,
+            attentionCount,
+        },
+    });
+    return lines.join("\n");
+}

package/dist/heart/daemon/interactive-repair.js

@@ -0,0 +1,91 @@
+"use strict";
+/**
+ * Interactive repair flow for degraded agents detected during `ouro up`.
+ *
+ * Examines each degraded agent's errorReason and fixHint to detect common
+ * issue patterns and prompt the user for repair actions.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runInteractiveRepair = runInteractiveRepair;
+const runtime_1 = require("../../nerves/runtime");
+const identity_1 = require("../identity");
+function isCredentialIssue(degraded) {
+    const reason = degraded.errorReason.toLowerCase();
+    const hint = degraded.fixHint.toLowerCase();
+    return reason.includes("credentials") || hint.includes("ouro auth");
+}
+function isConfigError(degraded) {
+    return degraded.fixHint.length > 0 && !isCredentialIssue(degraded);
+}
+function isAgentProvider(value) {
+    return Object.prototype.hasOwnProperty.call(identity_1.PROVIDER_CREDENTIALS, value);
+}
+function extractProviderFromFixHint(fixHint) {
+    const provider = fixHint.match(/--provider\s+([a-z0-9-]+)/)?.[1]
+        ?? fixHint.match(/providers\.([a-z0-9-]+)/)?.[1];
+    if (!provider || !isAgentProvider(provider))
+        return undefined;
+    return provider;
+}
+function authCommandFor(degraded) {
+    const command = degraded.fixHint.match(/ouro auth[^\n.]+/)?.[0]?.trim();
+    return command && command.length > 0 ? command : `ouro auth --agent ${degraded.agent}`;
+}
+async function runInteractiveRepair(degraded, deps) {
+    (0, runtime_1.emitNervesEvent)({
+        level: "info",
+        component: "daemon",
+        event: "daemon.interactive_repair_start",
+        message: "interactive repair flow started",
+        meta: { degradedCount: degraded.length },
+    });
+    if (degraded.length === 0) {
+        return { repairsAttempted: false };
+    }
+    let repairsAttempted = false;
+    for (const entry of degraded) {
+        if (isCredentialIssue(entry)) {
+            const provider = extractProviderFromFixHint(entry.fixHint);
+            const authCommand = authCommandFor(entry);
+            const answer = await deps.promptInput(`run \`${authCommand}\` now? [y/n] `);
+            if (answer.toLowerCase() === "y") {
+                try {
+                    if (provider) {
+                        await deps.runAuthFlow(entry.agent, provider);
+                    }
+                    else {
+                        await deps.runAuthFlow(entry.agent);
+                    }
+                    repairsAttempted = true;
+                }
+                catch (error) {
+                    const msg = error instanceof Error ? error.message : String(error);
+                    deps.writeStdout(`auth flow error for ${entry.agent}: ${msg}`);
+                    repairsAttempted = true;
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "error",
+                        component: "daemon",
+                        event: "daemon.interactive_repair_auth_error",
+                        message: `auth flow failed for ${entry.agent}`,
+                        meta: { agent: entry.agent, error: msg },
+                    });
+                }
+            }
+        }
+        else if (isConfigError(entry)) {
+            deps.writeStdout(`fix hint for ${entry.agent}: ${entry.fixHint}`);
+        }
+        else {
+            // Unknown error with no actionable fix hint
+            deps.writeStdout(`${entry.agent}: ${entry.errorReason}`);
+        }
+    }
+    (0, runtime_1.emitNervesEvent)({
+        level: "info",
+        component: "daemon",
+        event: "daemon.interactive_repair_end",
+        message: "interactive repair flow completed",
+        meta: { repairsAttempted },
+    });
+    return { repairsAttempted };
+}

package/dist/heart/daemon/launchd.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DAEMON_PLIST_LABEL = void 0;
 exports.generateDaemonPlist = generateDaemonPlist;
+exports.writeLaunchAgentPlist = writeLaunchAgentPlist;
 exports.installLaunchAgent = installLaunchAgent;
 exports.uninstallLaunchAgent = uninstallLaunchAgent;
 exports.isDaemonInstalled = isDaemonInstalled;
@@ -44,6 +45,9 @@ exports.DAEMON_PLIST_LABEL = "bot.ouro.daemon";
 function plistFilePath(homeDir) {
     return path.join(homeDir, "Library", "LaunchAgents", `${exports.DAEMON_PLIST_LABEL}.plist`);
 }
+function userLaunchDomain(userUid) {
+    return `gui/${userUid}`;
+}
 function generateDaemonPlist(options) {
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
@@ -65,15 +69,43 @@ function generateDaemonPlist(options) {
         `    <string>--socket</string>`,
         `    <string>${options.socketPath}</string>`,
         `  </array>`,
+        `  <key>RunAtLoad</key>`,
+        `  <true/>`,
         `  <key>KeepAlive</key>`,
         `  <true/>`,
     ];
+    if (options.envPath) {
+        lines.push(`  <key>EnvironmentVariables</key>`, `  <dict>`, `    <key>PATH</key>`, `    <string>${options.envPath}</string>`, `  </dict>`);
+    }
     if (options.logDir) {
-        lines.push(`  <key>StandardOutPath</key>`, `  <string>${path.join(options.logDir, "ouro-daemon-stdout.log")}</string>`, `  <key>StandardErrorPath</key>`, `  <string>${path.join(options.logDir, "ouro-daemon-stderr.log")}</string>`);
+        // PR 1 decision: we no longer emit `StandardErrorPath` for the daemon.
+        // The daemon's structured nerves ndjson pipeline (rotated + gzipped via
+        // createNdjsonFileSink) is the source of truth for diagnostics. Writing
+        // raw process stderr to an unrotated file grew to 366 MB in the wild;
+        // dropping the key lets launchd forward stray stderr to the system log
+        // where it gets rotated by the OS.
+        lines.push(`  <key>StandardOutPath</key>`, `  <string>${path.join(options.logDir, "ouro-daemon-stdout.log")}</string>`);
     }
     lines.push(`</dict>`, `</plist>`, ``);
     return lines.join("\n");
 }
+function writeLaunchAgentPlist(deps, options) {
+    const launchAgentsDir = path.join(deps.homeDir, "Library", "LaunchAgents");
+    deps.mkdirp(launchAgentsDir);
+    if (options.logDir) {
+        deps.mkdirp(options.logDir);
+    }
+    const fullPath = plistFilePath(deps.homeDir);
+    const xml = generateDaemonPlist(options);
+    deps.writeFile(fullPath, xml);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.launchd_plist_written",
+        message: "daemon launch agent plist written",
+        meta: { plistPath: fullPath, entryPath: options.entryPath, socketPath: options.socketPath },
+    });
+    return fullPath;
+}
 function installLaunchAgent(deps, options) {
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
@@ -81,23 +113,27 @@ function installLaunchAgent(deps, options) {
         message: "installing launch agent",
         meta: { entryPath: options.entryPath, socketPath: options.socketPath },
     });
-    const launchAgentsDir = path.join(deps.homeDir, "Library", "LaunchAgents");
-    deps.mkdirp(launchAgentsDir);
     const fullPath = plistFilePath(deps.homeDir);
+    const domain = userLaunchDomain(deps.userUid);
     // Unload existing (best effort) for idempotent re-install
     if (deps.existsFile(fullPath)) {
         try {
-            deps.exec(`launchctl unload "${fullPath}"`);
+            deps.exec(`launchctl bootout ${domain} "${fullPath}"`);
         }
         catch { /* best effort */ }
     }
-    const xml = generateDaemonPlist(options);
-    deps.writeFile(fullPath, xml);
-    deps.exec(`launchctl load "${fullPath}"`);
+    writeLaunchAgentPlist(deps, options);
+    // Bootstrap the plist so launchd manages crash recovery via KeepAlive.
+    // This is safe because ouro up calls this AFTER the daemon is already running,
+    // so launchd sees the existing process and just registers for KeepAlive.
+    try {
+        deps.exec(`launchctl bootstrap ${domain} "${fullPath}"`);
+    }
+    catch { /* already loaded */ }
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.launchd_installed",
-        message: "launch agent installed",
+        message: "launch agent installed with KeepAlive",
         meta: { plistPath: fullPath },
     });
 }
@@ -109,9 +145,10 @@ function uninstallLaunchAgent(deps) {
         meta: {},
     });
     const fullPath = plistFilePath(deps.homeDir);
+    const domain = userLaunchDomain(deps.userUid);
     if (deps.existsFile(fullPath)) {
         try {
-            deps.exec(`launchctl unload "${fullPath}"`);
+            deps.exec(`launchctl bootout ${domain} "${fullPath}"`);
         }
         catch { /* best effort */ }
         deps.removeFile(fullPath);

package/dist/heart/daemon/log-tailer.js

@@ -37,39 +37,103 @@ exports.discoverLogFiles = discoverLogFiles;
 exports.readLastLines = readLastLines;
 exports.formatLogLine = formatLogLine;
 exports.tailLogs = tailLogs;
-const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const zlib = __importStar(require("zlib"));
 const nerves_1 = require("../../nerves");
 const runtime_1 = require("../../nerves/runtime");
+const identity_1 = require("../identity");
 const LEVEL_COLORS = {
     debug: "\x1b[2m",
     info: "\x1b[36m",
     warn: "\x1b[33m",
     error: "\x1b[31m",
 };
+/**
+ * Parse a log filename into a (streamBase, generationRank) tuple.
+ *
+ * - `daemon.ndjson`          → { streamBase: "daemon", rank: 0 }   (active, newest)
+ * - `daemon.1.ndjson.gz`     → { streamBase: "daemon", rank: 1 }
+ * - `daemon.5.ndjson.gz`     → { streamBase: "daemon", rank: 5 }   (oldest)
+ * - Anything else            → null (not a log file).
+ *
+ * Higher rank = older. Used to sort so the oldest generation is read first
+ * and the active stream is read last, producing chronological output.
+ */
+function parseLogFilename(name) {
+    if (name.endsWith(".ndjson.gz")) {
+        // e.g. daemon.1.ndjson.gz → base "daemon.1", strip ".gz" then ".ndjson" then ".<n>"
+        const withoutGz = name.slice(0, -".gz".length); // daemon.1.ndjson
+        const withoutNdjson = withoutGz.slice(0, -".ndjson".length); // daemon.1
+        const genMatch = withoutNdjson.match(/^(.+)\.(\d+)$/);
+        if (!genMatch)
+            return null;
+        return { streamBase: genMatch[1], rank: parseInt(genMatch[2], 10) };
+    }
+    if (name.endsWith(".ndjson")) {
+        const withoutNdjson = name.slice(0, -".ndjson".length);
+        // Active file: daemon.ndjson → base "daemon", rank 0
+        // Legacy numeric gen: daemon.1.ndjson → base "daemon", rank 1 (treat same as gzipped)
+        const legacyMatch = withoutNdjson.match(/^(.+)\.(\d+)$/);
+        if (legacyMatch) {
+            return { streamBase: legacyMatch[1], rank: parseInt(legacyMatch[2], 10) };
+        }
+        return { streamBase: withoutNdjson, rank: 0 };
+    }
+    return null;
+}
 function discoverLogFiles(options) {
     /* v8 ignore start -- integration: default DI stubs for real OS @preserve */
-    const homeDir = options.homeDir ?? os.homedir();
     const existsSync = options.existsSync ?? (() => false);
     const readdirSync = options.readdirSync ?? (() => []);
     /* v8 ignore stop */
-    const logDir = path.join(homeDir, ".agentstate", "daemon", "logs");
-    const files = [];
+    const logDir = options.homeDir
+        ? path.join(options.homeDir, "AgentBundles", `${options.agentName ?? "slugger"}.ouro`, "state", "daemon", "logs")
+        : (0, identity_1.getAgentDaemonLogsDir)(options.agentName);
+    const entries = [];
     if (existsSync(logDir)) {
         for (const name of readdirSync(logDir)) {
-            if (!name.endsWith(".ndjson"))
+            const parsed = parseLogFilename(name);
+            if (!parsed)
                 continue;
             if (options.agentFilter && !name.includes(options.agentFilter))
                 continue;
-            files.push(path.join(logDir, name));
+            entries.push({ name, parsed });
         }
     }
-    return files.sort();
+    // Sort chronologically: for each stream, oldest generation first, active last.
+    // Across streams, sort alphabetically by streamBase so output is stable.
+    entries.sort((a, b) => {
+        if (a.parsed.streamBase !== b.parsed.streamBase) {
+            return a.parsed.streamBase < b.parsed.streamBase ? -1 : 1;
+        }
+        // Same stream: higher rank = older = read first.
+        return b.parsed.rank - a.parsed.rank;
+    });
+    return entries.map((e) => path.join(logDir, e.name));
+}
+/**
+ * Read a log file as a string, transparently handling gzipped rotations.
+ *
+ * For `.ndjson.gz` files we read the raw bytes via `fs.readFileSync` (ignoring
+ * any caller-supplied DI `readFileSync`, since that stub returns a `string`
+ * and would corrupt gzip bytes) and then `zlib.gunzipSync` to recover the
+ * original text. For plain `.ndjson` files we defer to the DI stub so tests
+ * can keep mocking fs.
+ */
+function readNdjsonFileContents(filePath, readFileSync) {
+    if (filePath.endsWith(".gz")) {
+        // Binary path: tests can mock readFileSync to return a Buffer (typed as
+        // string) via `as unknown as string` — we accept both Buffer and Uint8Array.
+        const raw = readFileSync(filePath);
+        const buf = typeof raw === "string" ? Buffer.from(raw, "binary") : Buffer.from(raw);
+        return zlib.gunzipSync(buf).toString("utf-8");
+    }
+    return readFileSync(filePath, "utf-8");
 }
 function readLastLines(filePath, count, readFileSync) {
     let content;
     try {
-        content = readFileSync(filePath, "utf-8");
+        content = readNdjsonFileContents(filePath, readFileSync);
     }
     catch {
         return [];
@@ -99,12 +163,17 @@ function tailLogs(options = {}) {
     const files = discoverLogFiles(options);
     (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.log_tailer_started", message: "log tailer started", meta: { fileCount: files.length, follow: !!options.follow } });
     const fileSizes = new Map();
-    // Read initial lines
+    // Read initial lines from each discovered file (oldest gz → newest gz → active).
+    // Gzipped files are historical and never tailed in follow mode.
     for (const file of files) {
         const lines = readLastLines(file, lineCount, readFileSync);
         for (const line of lines) {
             writer(`${formatLogLine(line)}\n`);
         }
+        if (file.endsWith(".gz")) {
+            // Historical rotation — skip size tracking, never followed.
+            continue;
+        }
         try {
             const content = readFileSync(file, "utf-8");
             fileSizes.set(file, content.length);
@@ -113,9 +182,10 @@ function tailLogs(options = {}) {
             fileSizes.set(file, 0);
         }
     }
-    // Follow mode
+    // Follow mode: only the active (non-gzipped) stream is watched.
     if (options.follow && watchFile && unwatchFile) {
-        for (const file of files) {
+        const activeFiles = files.filter((f) => !f.endsWith(".gz"));
+        for (const file of activeFiles) {
             watchFile(file, () => {
                 let content;
                 try {
@@ -137,7 +207,7 @@ function tailLogs(options = {}) {
             });
         }
         return () => {
-            for (const file of files) {
+            for (const file of activeFiles) {
                 unwatchFile(file);
             }
         };