.github/workflows/release.yml

@@ -73,27 +73,19 @@ jobs:
           BASE_VERSION=$(grep -m1 '^version' Cargo.toml | sed -E 's/version *= *"([^"]+)"/\1/')
 
           if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
-            # A pushed tag is authoritative — use it AS-IS (never recompute it
-            # from Cargo.toml, or the release would upload to a different tag than
-            # the one that triggered this run). The channel, and thus prerelease,
-            # is decided by the tag's suffix: v0.4.7-beta / v0.4.7-alpha are
-            # prereleases; a bare vX.Y.Z is the only thing that becomes stable.
+            CHANNEL="stable"
             TAG="${{ github.ref_name }}"
-            case "$TAG" in
-              *-alpha*) CHANNEL="alpha" ;;
-              *-beta*)  CHANNEL="beta"  ;;
-              *)        CHANNEL="stable" ;;
-            esac
+          elif [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            CHANNEL="${{ github.event.inputs.channel }}"
+          elif [ "${{ github.ref_name }}" = "alpha" ]; then
+            CHANNEL="alpha"
+          elif [ "${{ github.ref_name }}" = "pre-release" ]; then
+            CHANNEL="beta"
           else
-            # No tag (workflow_dispatch, or a legacy branch push): pick the
-            # channel, then synthesize the rolling tag from Cargo.toml's version.
-            if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-              CHANNEL="${{ github.event.inputs.channel }}"
-            elif [ "${{ github.ref_name }}" = "pre-release" ]; then
-              CHANNEL="beta"
-            else
-              CHANNEL="alpha"
-            fi
+            CHANNEL="alpha"
+          fi
+
+          if [ "$CHANNEL" != "stable" ]; then
             TAG="v${BASE_VERSION}-${CHANNEL}"
           fi
 
@@ -211,7 +203,7 @@ jobs:
             artifact_name: ostp
             release_name: ostp-linux-mipsle.tar.gz
             use_cross: true
-            toolchain: nightly
+            toolchain: alpha
 
           - os: ubuntu-latest
             target: riscv64gc-unknown-linux-gnu

.gitignore

@@ -43,5 +43,3 @@ ostp-brain/
 
 # Management panel built assets (built separately; dummy dist created for rust-embed build)
 ostp-control/
-
-.agents/

Cargo.lock

@@ -1384,7 +1384,7 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "ostp"
-version = "0.4.7"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "base64",
@@ -1406,7 +1406,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-client"
-version = "0.4.7"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "base64",
@@ -1437,7 +1437,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-core"
-version = "0.4.7"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "bytes",
@@ -1471,7 +1471,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-server"
-version = "0.4.7"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "axum",
@@ -1503,7 +1503,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-tun"
-version = "0.4.7"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "libc",
@@ -1515,7 +1515,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-tun-helper"
-version = "0.4.7"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "chrono",

Cargo.toml

@@ -12,7 +12,7 @@ resolver = "2"
 [workspace.package]
 edition = "2021"
 license = "AGPL-3.0"
-version = "0.4.7"
+version = "0.4.4"
 
 [workspace.dependencies]
 anyhow = "1.0"

ostp-client/src/bridge.rs

@@ -1060,14 +1060,9 @@ impl Bridge {
             let frag_sleep = self.frag_sleep;
             let [junk_pc_min, junk_pc_max] = self.junk_pc;
             let [junk_ps_min, junk_ps_max] = self.junk_ps;
-            // Time-rotating per-key junk marker — NOT a global constant and NOT
-            // even a static per-user value: it changes every window, so junk
-            // carries no fixed DPI signature on the wire. All frames in this
-            // burst are sent within milliseconds, so one window applies to all.
-            let junk_marker = ostp_core::crypto::derive_junk_marker(
-                &self.access_key,
-                ostp_core::crypto::current_junk_window(),
-            );
+            // Per-key junk marker (derived from the access key) — NOT a global
+            // constant, so junk frames carry no universal DPI signature.
+            let junk_marker = ostp_core::crypto::derive_all_secrets(&self.access_key).junk_marker;
 
             {
                 use tokio::io::AsyncWriteExt;

ostp-client/src/logging.rs

@@ -3,53 +3,6 @@ use std::io::Write;
 use std::path::PathBuf;
 use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt, EnvFilter};
 
-/// The single canonical log file for the whole core. Every process (CLI daemon,
-/// GUI, TUN helper) and every subsystem (tracing, the core event logger, the
-/// helper IPC, panics) writes here — no more per-binary / per-subsystem sprawl
-/// (`ostp-cli.log` + `ostp-core.log` + `ostp-helper.log` + `ostp-crash.log`).
-pub const LOG_FILE_NAME: &str = "ostp.log";
-
-/// Absolute path to the shared log file, next to the running executable.
-pub fn log_file_path() -> PathBuf {
-    std::env::current_exe()
-        .ok()
-        .and_then(|p| p.parent().map(|d| d.join(LOG_FILE_NAME)))
-        .unwrap_or_else(|| PathBuf::from(LOG_FILE_NAME))
-}
-
-/// True if this invocation is the long-running daemon (a client/server run),
-/// as opposed to a one-shot subcommand (`gk`, `check`, `init`, `-V`, ...).
-///
-/// Used to gate log truncation: only the daemon clears the log at startup, so a
-/// one-shot command run while a daemon is live can never wipe the daemon's log.
-/// A daemon invocation is simply one that carries none of the one-shot tokens
-/// (`ostp`, `ostp run`, `ostp connect <url>` → daemon; everything else → one-shot).
-pub fn invocation_is_daemon<I: IntoIterator<Item = String>>(args: I) -> bool {
-    const ONE_SHOT: &[&str] = &[
-        "gk", "generate-key", "check", "init", "setup", "links", "import",
-        "update", "migrate", "prober", "proxy-env", "proxy-env-clear",
-        "uninstall", "-V", "--version", "-h", "--help", "help",
-    ];
-    !args
-        .into_iter()
-        .skip(1) // program name
-        .any(|a| ONE_SHOT.contains(&a.as_str()))
-}
-
-/// Append a single timestamped line to the shared log file. Used by the manual
-/// writers (core event logger, TUN helper IPC) so their output lands in the same
-/// `ostp.log` as the tracing subscriber instead of a separate file.
-pub fn append_line(msg: &str) {
-    if let Ok(mut file) = OpenOptions::new().create(true).append(true).open(log_file_path()) {
-        let _ = writeln!(
-            file,
-            "[{}] {}",
-            chrono::Local::now().format("%Y-%m-%d %H:%M:%S"),
-            msg
-        );
-    }
-}
-
 pub fn setup_panic_hook() {
     std::panic::set_hook(Box::new(|info| {
         let payload = info.payload();
@@ -63,7 +16,7 @@ pub fn setup_panic_hook() {
 
         let location = info.location().unwrap_or_else(|| std::panic::Location::caller());
         let backtrace = std::backtrace::Backtrace::force_capture();
-
+        
         let crash_msg = format!(
             "[{}] PANIC at {}:{}\nMessage: {}\nBacktrace:\n{:?}",
             chrono::Local::now().format("%Y-%m-%d %H:%M:%S"),
@@ -76,16 +29,19 @@ pub fn setup_panic_hook() {
         eprintln!("{}", crash_msg);
         tracing::error!("{}", crash_msg);
 
-        // Crashes land in the same shared log file (append — a crash must never
-        // truncate, and the tracing worker may already be dead so we write direct).
-        if let Ok(mut file) = OpenOptions::new().create(true).append(true).open(log_file_path()) {
+        let path = std::env::current_exe()
+            .ok()
+            .and_then(|p| p.parent().map(|d| d.join("ostp-crash.log")))
+            .unwrap_or_else(|| PathBuf::from("ostp-crash.log"));
+
+        if let Ok(mut file) = OpenOptions::new().create(true).append(true).open(path) {
             let _ = file.write_all(crash_msg.as_bytes());
             let _ = file.write_all(b"\n===================================================\n");
         }
     }));
 }
 
-/// Initialises tracing and writes to the shared `ostp.log` next to the executable.
+/// Initialises tracing and writes to `<app_name>.log` next to the executable.
 ///
 /// The `level` parameter controls the minimum log level:
 /// - `"error"` — only errors
@@ -95,17 +51,7 @@ pub fn setup_panic_hook() {
 /// - `"trace"` — all messages including very verbose internal state
 ///
 /// The environment variable `RUST_LOG` overrides this value if set.
-///
-/// `truncate`: clear the log at startup. Honoured **only on Windows** — Linux
-/// servers keep their history (OS-rotated). Pass `true` only from the daemon's
-/// own entrypoint; one-shot commands and child processes (the TUN helper) pass
-/// `false` so they append instead of wiping a running daemon's log.
-pub fn init_tracing(
-    level: &str,
-    app_name: &str,
-    version: &str,
-    truncate: bool,
-) -> Option<tracing_appender::non_blocking::WorkerGuard> {
+pub fn init_tracing(level: &str, app_name: &str, version: &str) -> Option<tracing_appender::non_blocking::WorkerGuard> {
     // RUST_LOG overrides the config-derived level
     let env_filter = EnvFilter::try_from_default_env()
         .unwrap_or_else(|_| {
@@ -120,20 +66,12 @@ pub fn init_tracing(
             }
         });
 
-    let path = log_file_path();
+    let path = std::env::current_exe()
+        .ok()
+        .and_then(|p| p.parent().map(|d| d.join(format!("{}.log", app_name))))
+        .unwrap_or_else(|| PathBuf::from(format!("{}.log", app_name)));
 
-    let mut open_opts = OpenOptions::new();
-    open_opts.create(true);
-    // Truncate-on-startup is Windows-only and daemon-only. Everywhere else append:
-    // Linux keeps server history, and one-shot commands / the TUN helper must not
-    // wipe a running daemon's log.
-    if truncate && cfg!(windows) {
-        open_opts.write(true).truncate(true);
-    } else {
-        open_opts.append(true);
-    }
-
-    if let Ok(mut file) = open_opts.open(&path) {
+    if let Ok(mut file) = OpenOptions::new().create(true).append(true).open(&path) {
         // Write the startup banner directly to the log file, bypassing the
         // tracing subscriber entirely. Emitting it via tracing::info!() hits
         // BOTH layers below (file AND stderr), so every one-shot CLI command

ostp-client/src/runner.rs

@@ -10,9 +10,10 @@ use std::fs::OpenOptions;
 use std::io::Write as _;
 
 fn log_to_core_file(msg: &str) {
-    // Writes into the single shared ostp.log (same file as the tracing appender),
-    // not a separate ostp-core.log — see logging::LOG_FILE_NAME.
-    let path = crate::logging::log_file_path();
+    let path = std::env::current_exe()
+        .ok()
+        .and_then(|p| p.parent().map(|d| d.join("ostp-core.log")))
+        .unwrap_or_else(|| std::path::PathBuf::from("ostp-core.log"));
     if let Ok(mut file) = OpenOptions::new().create(true).append(true).open(path) {
         let _ = writeln!(file, "[{}] {}", chrono::Local::now().format("%Y-%m-%d %H:%M:%S"), msg);
     }

ostp-core/src/crypto/mod.rs

@@ -8,5 +8,4 @@ pub use noise::{NoiseRole, NoiseSession};
 pub use obfuscation::{
     deobfuscate_header_inplace, deobfuscate_packet_inplace, obfuscate_packet_inplace,
     derive_obfuscation_key, derive_psk, derive_all_secrets, DerivedSecrets,
-    derive_junk_marker, current_junk_window, JUNK_MARKER_WINDOW_SECS,
 };

ostp-core/src/crypto/obfuscation.rs

@@ -59,10 +59,11 @@ pub struct DerivedSecrets {
     pub psk: [u8; 32],
     pub handshake_pad_min: usize,
     pub handshake_pad_max: usize,
+    /// Per-key 4-byte prefix stamped on junk frames so the server can drop them
+    /// without a GLOBAL constant marker (which would be a universal DPI signature
+    /// for all OSTP users — exactly what the version gate avoids for the handshake).
+    pub junk_marker: [u8; 4],
 }
-// NOTE: the junk marker is NOT part of DerivedSecrets — it is time-rotating and
-// derived separately per window via `derive_junk_marker` (see below), so it
-// carries no static per-user signature.
 
 /// OSTP wire protocol version. Mixed into key derivation (NOT sent on the
 /// wire) so peers running incompatible versions derive entirely different
@@ -128,61 +129,25 @@ pub(crate) fn derive_all_secrets_versioned(access_key: &[u8], version: u8) -> De
     let pad_min = 16 + (pad_bytes[0] as usize % 64);       // 16-79
     let pad_max = pad_min + 48 + (pad_bytes[1] as usize % 128); // +48..+175
 
+    // Derive junk marker (4 bytes) — info = key_hash[16..] || 0x04.
+    // Per-key: to an outsider it is indistinguishable from the random junk
+    // payload, so there is no cross-user signature; the server, knowing the key,
+    // derives the same marker and drops the junk silently.
+    let mut junk_info = info_base.to_vec();
+    junk_info.push(0x04);
+    let junk_bytes = hkdf_expand(&prk, &junk_info, 4);
+    let mut junk_marker = [0u8; 4];
+    junk_marker.copy_from_slice(&junk_bytes);
+
     DerivedSecrets {
         obfuscation_key,
         psk,
         handshake_pad_min: pad_min,
         handshake_pad_max: pad_max,
+        junk_marker,
     }
 }
 
-/// Window length (seconds) for the rotating junk marker. The marker changes
-/// every window, so junk carries no static per-user fingerprint on the wire;
-/// the server checks the current and previous window to absorb clock skew.
-pub const JUNK_MARKER_WINDOW_SECS: u64 = 60;
-
-/// The current junk-marker time window (unix seconds / window length).
-pub fn current_junk_window() -> u64 {
-    std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .map(|d| d.as_secs() / JUNK_MARKER_WINDOW_SECS)
-        .unwrap_or(0)
-}
-
-/// Derive the 4-byte junk marker for a given time `window`.
-///
-/// Uses the same version-gated HKDF scheme as [`derive_all_secrets`], with the
-/// window folded into the `info` (label byte `0x04`). Folding in the window
-/// makes the marker rotate: to an on-path observer the junk prefix changes every
-/// window (no fixed signature), and a captured marker is only valid for ~1
-/// window. Only a holder of the access key can compute it, so an outsider cannot
-/// forge a silently-dropped junk packet.
-pub fn derive_junk_marker(access_key: &[u8], window: u64) -> [u8; 4] {
-    derive_junk_marker_versioned(access_key, window, PROTOCOL_VERSION)
-}
-
-pub(crate) fn derive_junk_marker_versioned(access_key: &[u8], window: u64, version: u8) -> [u8; 4] {
-    use sha2::Digest;
-    let key_hash = sha2::Sha256::digest(access_key);
-    let salt = &key_hash[..16];
-    let info_base = &key_hash[16..];
-
-    let mut ikm = Vec::with_capacity(access_key.len() + 1);
-    ikm.extend_from_slice(access_key);
-    ikm.push(version);
-    let prk = hkdf_extract(salt, &ikm);
-
-    // info = key_hash[16..] || 0x04 || window(LE) — same label byte as before,
-    // now parameterised by the time window.
-    let mut info = info_base.to_vec();
-    info.push(0x04);
-    info.extend_from_slice(&window.to_le_bytes());
-    let bytes = hkdf_expand(&prk, &info, 4);
-    let mut marker = [0u8; 4];
-    marker.copy_from_slice(&bytes);
-    marker
-}
-
 // ── Legacy API (delegates to derive_all_secrets) ─────────────────────────────
 
 pub fn derive_obfuscation_key(access_key: &[u8]) -> [u8; 8] {

ostp-core/src/crypto/obfuscation_tests.rs

@@ -191,29 +191,4 @@ mod tests {
         assert_eq!(recovered_nonce, nonce);
         assert_eq!(&packet[12..], &ciphertext);
     }
-
-    /// The junk marker must: be stable within a window (client and server agree),
-    /// rotate across windows (no static on-wire fingerprint), and differ per key
-    /// (one user's marker never silently-drops on another user's flow).
-    #[test]
-    fn test_junk_marker_rotation() {
-        let key_a = b"access-key-alpha";
-        let key_b = b"access-key-bravo";
-
-        // Stable within a window.
-        assert_eq!(derive_junk_marker(key_a, 1000), derive_junk_marker(key_a, 1000));
-
-        // Rotates across adjacent windows.
-        assert_ne!(derive_junk_marker(key_a, 1000), derive_junk_marker(key_a, 1001));
-        assert_ne!(derive_junk_marker(key_a, 1000), derive_junk_marker(key_a, 999));
-
-        // Distinct per key within the same window.
-        assert_ne!(derive_junk_marker(key_a, 1000), derive_junk_marker(key_b, 1000));
-
-        // A different protocol version yields a different marker (version gate).
-        assert_ne!(
-            derive_junk_marker_versioned(key_a, 1000, PROTOCOL_VERSION),
-            derive_junk_marker_versioned(key_a, 1000, PROTOCOL_VERSION.wrapping_add(1)),
-        );
-    }
 }

ostp-flutter/pubspec.yaml

@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 0.4.7+18
+version: 0.4.4+16
 
 environment:
   sdk: ^3.11.4

ostp-gui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ostp-gui",
   "private": true,
-  "version": "0.4.7",
+  "version": "0.4.4",
   "type": "module",
   "scripts": {
     "tauri": "tauri",

ostp-gui/src-tauri/Cargo.lock

@@ -2665,7 +2665,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-client"
-version = "0.4.7"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -2696,7 +2696,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-core"
-version = "0.4.7"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "bytes",
@@ -2713,7 +2713,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-gui"
-version = "0.4.7"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "json_comments",
@@ -2733,7 +2733,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-tun"
-version = "0.4.7"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "libc",

ostp-gui/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ostp-gui"
-version = "0.4.7"
+version = "0.4.4"
 description = "A Tauri App"
 authors = ["you"]
 edition = "2021"

ostp-gui/src-tauri/src/main.rs

@@ -8,10 +8,7 @@ fn main() {
     // Read config BEFORE init_tracing so we can use the correct log level from config.
     // If config is missing or debug=false we default to "info".
     let log_level = detect_log_level_from_config();
-    // The GUI launch IS the daemon's startup, so clear the shared log here
-    // (Windows-only inside init_tracing). The elevated TUN helper spawned later
-    // passes truncate=false so it appends instead of wiping this session's log.
-    let _log_guard = ostp_client::logging::init_tracing(&log_level, "ostp-gui", env!("CARGO_PKG_VERSION"), true);
+    let _log_guard = ostp_client::logging::init_tracing(&log_level, "ostp-gui", env!("CARGO_PKG_VERSION"));
 
     tracing::info!("ostp-gui starting (log_level={})", log_level);
 
@@ -31,7 +28,7 @@ fn main() {
         {
             use std::ffi::OsStr;
             use std::os::windows::ffi::OsStrExt;
-            let msg_w: Vec<u16> = OsStr::new(&format!("OSTP GUI crashed:\n\n{}\n\nSee ostp.log for details.", msg))
+            let msg_w: Vec<u16> = OsStr::new(&format!("OSTP GUI crashed:\n\n{}\n\nSee ostp-gui.log for details.", msg))
                 .encode_wide().chain(Some(0)).collect();
             let title_w: Vec<u16> = OsStr::new("OSTP GUI — Fatal Error").encode_wide().chain(Some(0)).collect();
             #[link(name = "user32")] extern "system" {

ostp-gui/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ostp-gui",
-  "version": "0.4.7",
+  "version": "0.4.4",
   "identifier": "com.ospab.ostp",
   "build": {
     "frontendDist": "../src"

ostp-server/src/dispatcher.rs

@@ -305,22 +305,14 @@ impl Dispatcher {
         // Not an existing session — try each registered access key's derived obfuscation key
         let keys_snapshot: Vec<String> = self.access_keys.read().unwrap_or_else(|e| e.into_inner()).keys().cloned().collect();
 
-        // Junk marker rotates per time window; check the current and previous
-        // window so a client whose clock is up to ~1 window behind/ahead is still
-        // recognised. Computed once per datagram, not per candidate key.
-        let junk_window = ostp_core::crypto::current_junk_window();
-
         for candidate_key in keys_snapshot {
             let secrets = ostp_core::crypto::derive_all_secrets(candidate_key.as_bytes());
 
-            // Junk frames carry this key's time-rotating marker (no global
-            // constant, no static per-user signature). Drop silently.
-            if packet.len() >= 4 {
-                let m_now = ostp_core::crypto::derive_junk_marker(candidate_key.as_bytes(), junk_window);
-                let m_prev = ostp_core::crypto::derive_junk_marker(candidate_key.as_bytes(), junk_window.wrapping_sub(1));
-                if packet[0..4] == m_now || packet[0..4] == m_prev {
-                    return Ok(DispatchOutcome::Junk);
-                }
+            // Junk frames carry this key's per-key derived marker (no global
+            // constant → no universal DPI signature). Drop silently — the secrets
+            // for this key are already derived here, so the check is free.
+            if packet.len() >= 4 && packet[0..4] == secrets.junk_marker {
+                return Ok(DispatchOutcome::Junk);
             }
 
             // Decode the session_id using this key's obfuscation

ostp-tun-helper/src/main.rs

@@ -14,8 +14,10 @@ use portable_atomic::Ordering;
 fn log_to_file(msg: &str) {
     let msg = msg.to_string();
     tokio::task::spawn_blocking(move || {
-        // Same shared ostp.log as everything else — not a separate ostp-helper.log.
-        let path = ostp_client::logging::log_file_path();
+        let path = std::env::current_exe()
+            .ok()
+            .and_then(|p| p.parent().map(|d| d.join("ostp-helper.log")))
+            .unwrap_or_else(|| std::path::PathBuf::from("ostp-helper.log"));
         if let Ok(mut file) = std::fs::OpenOptions::new().create(true).append(true).open(path) {
             let _ = writeln!(file, "[{}] {}", chrono::Local::now().format("%Y-%m-%d %H:%M:%S"), msg);
         }
@@ -51,10 +53,7 @@ struct TunnelState {
 #[tokio::main]
 async fn main() -> Result<()> {
     ostp_client::logging::setup_panic_hook();
-    // The helper is a child of the GUI, which already truncated the shared log at
-    // its own startup — pass false so the helper APPENDS instead of wiping the
-    // GUI's session log.
-    let _log_guard = ostp_client::logging::init_tracing("info", "ostp-helper", env!("CARGO_PKG_VERSION"), false);
+    let _log_guard = ostp_client::logging::init_tracing("info", "ostp-helper", env!("CARGO_PKG_VERSION"));
 
     if let Ok(exe) = std::env::current_exe() {
         if let Some(dir) = exe.parent() {

ostp/src/main.rs

@@ -251,11 +251,7 @@ async fn main() -> Result<()> {
     // where it does not apply.
     let _ = rlimit::increase_nofile_limit(1048576);
     ostp_client::logging::setup_panic_hook();
-    // Clear the shared log at startup only when THIS invocation is the daemon —
-    // a one-shot command (`ostp gk`, `ostp check`, ...) must not wipe a running
-    // daemon's log. (Truncation itself is additionally Windows-only.)
-    let is_daemon = ostp_client::logging::invocation_is_daemon(std::env::args());
-    let _log_guard = ostp_client::logging::init_tracing("info", "ostp-cli", env!("CARGO_PKG_VERSION"), is_daemon);
+    let _log_guard = ostp_client::logging::init_tracing("info", "ostp-cli", env!("CARGO_PKG_VERSION"));
 
     let res = run_app().await;
     if let Err(e) = res {