feat(kernel-cli): filter daemon log entries below a minimum severity (#1008)

Small, self-contained quality-of-life change to the daemon's log
transport, extracted from `chip/orchestration-demo`. Independent of the
kernel work in #1007 — this branches off `main` directly rather than
stacking.

## Problem

`daemon.log` recorded every level. In practice `debug` output — refcount
churn especially — dominated the file badly enough to make it hard to
read while debugging anything else. On a busy daemon the signal you
actually want is buried.

## Change

The file transport drops entries below a minimum severity, defaulting to
`info`. Set `$OCAP_DAEMON_LOG_LEVEL=debug` to record everything again.

Two details worth a reviewer's eye:

- `LOG_LEVELS` mirrors `@metamask/logger`'s level ordering locally
because `logLevels` isn't part of that package's public surface. If it's
ever exported, this should switch to importing it rather than keeping a
copy in sync.
- It's declared *above* the file-scope logger construction deliberately.
The transport factory is invoked during module init, so a later
declaration would put `LOG_LEVELS` in its temporal dead zone at exactly
the moment it's read.

## Not included

The fatal-path handler work that lives in the same file is already on
`main` (#966), so this PR touches only the level-filtering lines.

## Validation

`@metamask/kernel-cli` builds, lints, and its tests pass. Changelog
entry follows in a second commit once this PR has a number to link to.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Observability-only change to log file filtering; no auth, RPC, or
persistence behavior is affected.
> 
> **Overview**
> **`daemon.log` now skips entries below a minimum severity** (default
**`info`**) in the daemon file transport, so noisy **`debug`** lines no
longer bury useful output.
> 
> The threshold comes from **`OCAP_DAEMON_LOG_LEVEL`**; set it to
**`debug`** to record all levels again. **`makeFileTransport`** compares
each entry against a local **`LOG_LEVELS`** map (mirroring
`@metamask/logger` ordering, since levels aren’t exported). Changelog
documents the behavior change.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
66dc26d. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: FUDCo

packages/kernel-cli/CHANGELOG.md

@@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- The daemon log filters entries below a minimum severity, defaulting to `info`, so high-volume `debug` output (refcount churn and similar) no longer dominates `daemon.log`; set `$OCAP_DAEMON_LOG_LEVEL` to `debug` to record everything again ([#1008](https://github.com/MetaMask/ocap-kernel/pull/1008))
 - Relay state files (`relay.pid`, `relay.addr`) now live in their own directory (default `~/.libp2p-relay`, overridable via `$LIBP2P_RELAY_HOME`) instead of under `$OCAP_HOME`, so one libp2p relay can serve daemons with different OCAP_HOMEs ([#952](https://github.com/MetaMask/ocap-kernel/pull/952))
 
 ### Fixed

packages/kernel-cli/src/commands/daemon-entry.ts

@@ -11,11 +11,41 @@ import { join } from 'node:path';
 import { getOcapHome } from '../ocap-home.ts';
 import { isProcessAlive } from '../utils.ts';
 
+// Mirror of @metamask/logger's level ordering (`logLevels` is not part
+// of the package's public surface). Higher numbers are more severe.
+// Declared above the file-scope logger construction so the transport
+// factory doesn't hit a temporal-dead-zone reference when it's called
+// during module init.
+const LOG_LEVELS = {
+  debug: 1,
+  info: 2,
+  log: 3,
+  warn: 4,
+  error: 5,
+} as const;
+
+type LogLevelName = keyof typeof LOG_LEVELS;
+
+/**
+ * Resolve the daemon's minimum log level from `OCAP_DAEMON_LOG_LEVEL`.
+ * Defaults to `info` so noisy `debug` entries (refcount churn etc.)
+ * are dropped; set the env var to `debug` to re-enable everything.
+ *
+ * @returns The minimum log level to record.
+ */
+function resolveMinLogLevel(): LogLevelName {
+  const raw = process.env.OCAP_DAEMON_LOG_LEVEL;
+  if (raw !== undefined && raw in LOG_LEVELS) {
+    return raw as LogLevelName;
+  }
+  return 'info';
+}
+
 const ocapDir = getOcapHome();
 const logPath = join(ocapDir, 'daemon.log');
 const logger = new Logger({
   tags: ['daemon'],
-  transports: [makeFileTransport(logPath)],
+  transports: [makeFileTransport(logPath, resolveMinLogLevel())],
 });
 
 // Install exit-cause handlers at module load, before main() runs, so
@@ -139,13 +169,20 @@ async function readDaemonPid(pidPath: string): Promise<number | undefined> {
 }
 
 /**
- * Create a file transport that writes logs to a file.
+ * Create a file transport that writes logs to a file, filtering out
+ * entries below `minLevel`.
  *
  * @param logFilePath - The log file path.
+ * @param minLevel - Minimum severity to write; entries below this are
+ *   dropped silently.
  * @returns A log transport function.
  */
-function makeFileTransport(logFilePath: string) {
+function makeFileTransport(logFilePath: string, minLevel: LogLevelName) {
+  const minIdx = LOG_LEVELS[minLevel];
   return (entry: LogEntry): void => {
+    if (LOG_LEVELS[entry.level] < minIdx) {
+      return;
+    }
     const line = `[${new Date().toISOString()}] [${entry.level}] ${entry.message ?? ''} ${(entry.data ?? []).map(String).join(' ')}\n`;
     // eslint-disable-next-line n/no-sync -- synchronous write needed for log transport reliability
     appendFileSync(logFilePath, line);