nodespace logs loads the entire daemon log file into memory with no cap, and headless installs have no active log rotation #2963

Problem

A developer or user running the CLI-only (Homebrew/systemd) headless daemon for a long time with no desktop app ever opened will hit a real, unmitigated slow/memory-heavy nodespace logs invocation exactly when they most need it to debug a struggling daemon — because that install path has zero log rotation for the life of the service.

Root cause

run() in packages/cli/src/commands/logs.rs:99 does std::fs::read_to_string(&path) unconditionally, then filters/tails in memory, regardless of file size — no BufReader/streaming tail helper exists anywhere in the cli crate. packages/desktop-app/src-tauri/src/daemon_setup.rs's size-based log rotation (rotate_daemon_logs, gated by DAEMON_LOG_MAX_BYTES) and the continuous spawn_log_rotation_watcher both only run from the Tauri desktop-app process. The Homebrew formula generator (scripts/update-homebrew-formula.ts) confirms the nodespace-cli formula's service do block has keep_alive true and no newsyslog.d/logrotate hook of any kind — a daemon-only install genuinely never rotates, and the module's own doc comment explicitly treats the Homebrew-service scenario as a first-class supported install path.

Suggested fix

Switch nodespace logs to a streaming/reverse-seek tail read (read from the end in fixed-size chunks until N lines are found) instead of read_to_string. Separately, extend log rotation to the headless daemon process itself — e.g. a size check at daemon startup, or a lightweight background rotation task inside nodespaced — rather than relying entirely on the Tauri desktop-app process.

Found via the 2026-09-25 full-repo code sweep (finding #13 of 84 in CODE_SWEEP_FINDINGS_2026-09-25.md). Severity: medium. Category: risky.