@neuralnomads/codenomad-dev 0.13.3-dev-20260402-e82e529a → 0.13.3-dev-20260403-d0a0325d

package/dist/auth/manager.js

@@ -75,12 +75,16 @@ export class AuthManager {
         return isLoopbackAddress(request.socket.remoteAddress);
     }
     getSessionFromRequest(request) {
+        return this.getSessionFromHeaders(request.headers);
+    }
+    getSessionFromHeaders(headers) {
         if (!this.authEnabled) {
             // When auth is disabled, treat all requests as authenticated.
             // We still return a stable username so callers can display it.
             return { username: this.init.username, sessionId: "auth-disabled" };
         }
-        const cookies = parseCookies(request.headers.cookie);
+        const cookieHeader = Array.isArray(headers.cookie) ? headers.cookie.join("; ") : headers.cookie;
+        const cookies = parseCookies(cookieHeader);
         const sessionId = cookies[this.cookieName];
         const session = this.sessionManager.getSession(sessionId);
         if (!session)

package/dist/config/schema.js

@@ -23,6 +23,7 @@ const PreferencesSchema = z
     showUsageMetrics: z.boolean().default(true),
     autoCleanupBlankSessions: z.boolean().default(true),
     listeningMode: z.enum(["local", "all"]).default("local"),
+    logLevel: z.enum(["DEBUG", "INFO", "WARN", "ERROR"]).default("DEBUG"),
     // OS notifications
     osNotificationsEnabled: z.boolean().default(false),
     osNotificationsAllowWhenVisible: z.boolean().default(false),

package/dist/events/bus.js

@@ -20,6 +20,8 @@ export class EventBus extends EventEmitter {
         this.on("workspace.error", handler);
         this.on("workspace.stopped", handler);
         this.on("workspace.log", handler);
+        this.on("sidecar.updated", handler);
+        this.on("sidecar.removed", handler);
         this.on("storage.configChanged", handler);
         this.on("storage.stateChanged", handler);
         this.on("instance.dataChanged", handler);
@@ -31,6 +33,8 @@ export class EventBus extends EventEmitter {
             this.off("workspace.error", handler);
             this.off("workspace.stopped", handler);
             this.off("workspace.log", handler);
+            this.off("sidecar.updated", handler);
+            this.off("sidecar.removed", handler);
             this.off("storage.configChanged", handler);
             this.off("storage.stateChanged", handler);
             this.off("instance.dataChanged", handler);

package/dist/index.js

@@ -23,6 +23,7 @@ import { resolveHttpsOptions } from "./server/tls";
 import { resolveNetworkAddresses, resolveRemoteAddresses } from "./server/network-addresses";
 import { startDevReleaseMonitor } from "./releases/dev-release-monitor";
 import { SpeechService } from "./speech/service";
+import { SideCarManager } from "./sidecars/manager";
 const require = createRequire(import.meta.url);
 const packageJson = require("../package.json");
 const __filename = fileURLToPath(import.meta.url);
@@ -208,6 +209,11 @@ async function main() {
     const fileSystemBrowser = new FileSystemBrowser({ rootDir: options.rootDir, unrestricted: options.unrestrictedRoot });
     const instanceStore = new InstanceStore(configLocation.instancesDir);
     const speechService = new SpeechService(settings, logger.child({ component: "speech" }));
+    const sidecarManager = new SideCarManager({
+        settings,
+        eventBus,
+        logger: logger.child({ component: "sidecars" }),
+    });
     const instanceEventBridge = new InstanceEventBridge({
         workspaceManager,
         eventBus,
@@ -281,6 +287,7 @@ async function main() {
             serverMeta,
             instanceStore,
             speechService,
+            sidecarManager,
             authManager,
             uiStaticDir: uiResolution.uiStaticDir ?? DEFAULT_UI_STATIC_DIR,
             uiDevServerUrl: uiResolution.uiDevServerUrl,
@@ -301,6 +308,7 @@ async function main() {
             serverMeta,
             instanceStore,
             speechService,
+            sidecarManager,
             authManager,
             uiStaticDir: uiResolution.uiStaticDir ?? DEFAULT_UI_STATIC_DIR,
             uiDevServerUrl: undefined,
@@ -391,6 +399,12 @@ async function main() {
             catch (error) {
                 logger.warn({ err: error }, "Instance event bridge shutdown failed");
             }
+            try {
+                await sidecarManager.shutdown();
+            }
+            catch (error) {
+                logger.error({ err: error }, "SideCar manager shutdown failed");
+            }
             try {
                 await workspaceManager.shutdown();
                 logger.info("Workspace manager shutdown complete");

package/dist/server/http-server.js

@@ -3,7 +3,9 @@ import cors from "@fastify/cors";
 import fastifyStatic from "@fastify/static";
 import replyFrom from "@fastify/reply-from";
 import fs from "fs";
+import { connect as connectTcp } from "net";
 import path from "path";
+import { connect as connectTls } from "tls";
 import { fetch } from "undici";
 import { isValidWorktreeSlug, listWorktrees, resolveRepoRoot } from "../workspaces/git-worktrees";
 import { registerWorkspaceRoutes } from "./routes/workspaces";
@@ -16,6 +18,8 @@ import { registerPluginRoutes } from "./routes/plugin";
 import { registerBackgroundProcessRoutes } from "./routes/background-processes";
 import { registerWorktreeRoutes } from "./routes/worktrees";
 import { registerSpeechRoutes } from "./routes/speech";
+import { registerRemoteServerRoutes } from "./routes/remote-servers";
+import { registerSideCarRoutes } from "./routes/sidecars";
 import { BackgroundProcessManager } from "../background-processes/manager";
 import { registerAuthRoutes } from "./routes/auth";
 import { sendUnauthorized, wantsHtml } from "../auth/http-auth";
@@ -149,7 +153,7 @@ export function createHttpServer(deps) {
             return;
         }
         const session = deps.authManager.getSessionFromRequest(request);
-        const requiresAuthForApi = pathname.startsWith("/api/") || pathname.startsWith("/workspaces/");
+        const requiresAuthForApi = pathname.startsWith("/api/") || pathname.startsWith("/workspaces/") || pathname.startsWith("/sidecars/");
         if (requiresAuthForApi && !session) {
             // Allow OpenCode plugin -> CodeNomad calls with per-instance basic auth.
             const pluginMatch = pathname.match(/^\/workspaces\/([^/]+)\/plugin(?:\/|$)/);
@@ -207,7 +211,15 @@ export function createHttpServer(deps) {
         eventBus: deps.eventBus,
         workspaceManager: deps.workspaceManager,
     });
+    registerRemoteServerRoutes(app, { logger: apiLogger });
     registerSpeechRoutes(app, { speechService: deps.speechService });
+    registerSideCarRoutes(app, { sidecarManager: deps.sidecarManager });
+    registerSideCarProxyRoutes(app, { sidecarManager: deps.sidecarManager, logger: proxyLogger });
+    setupSideCarWebSocketProxy(app, {
+        sidecarManager: deps.sidecarManager,
+        authManager: deps.authManager,
+        logger: proxyLogger,
+    });
     registerPluginRoutes(app, {
         workspaceManager: deps.workspaceManager,
         eventBus: deps.eventBus,
@@ -277,6 +289,48 @@ export function createHttpServer(deps) {
         },
     };
 }
+function registerSideCarProxyRoutes(app, deps) {
+    const proxyBaseHandler = async (request, reply) => {
+        await proxySideCarRequest({
+            request,
+            reply,
+            sidecarManager: deps.sidecarManager,
+            logger: deps.logger,
+            pathSuffix: "",
+        });
+    };
+    const proxyWildcardHandler = async (request, reply) => {
+        await proxySideCarRequest({
+            request,
+            reply,
+            sidecarManager: deps.sidecarManager,
+            logger: deps.logger,
+            pathSuffix: request.params["*"] ?? "",
+        });
+    };
+    app.all("/sidecars/:id", proxyBaseHandler);
+    app.all("/sidecars/:id/*", proxyWildcardHandler);
+}
+function setupSideCarWebSocketProxy(app, deps) {
+    app.server.on("upgrade", (request, socket, head) => {
+        const rawUrl = request.url ?? "/";
+        const parsed = parseSideCarUpgradePath(rawUrl);
+        if (!parsed) {
+            return;
+        }
+        void proxySideCarWebSocketUpgrade({
+            request,
+            socket: socket,
+            head,
+            sidecarId: parsed.sidecarId,
+            incomingPath: parsed.pathname,
+            search: parsed.search,
+            sidecarManager: deps.sidecarManager,
+            authManager: deps.authManager,
+            logger: deps.logger,
+        });
+    });
+}
 function registerInstanceProxyRoutes(app, deps) {
     app.register(async (instance) => {
         instance.removeAllContentTypeParsers();
@@ -679,3 +733,229 @@ function buildProxyHeaders(headers) {
     }
     return result;
 }
+async function proxySideCarRequest(args) {
+    const sidecarId = args.request.params.id ?? "";
+    const sidecar = await args.sidecarManager.get(sidecarId);
+    if (!sidecar) {
+        args.reply.code(404).send({ error: "SideCar not found" });
+        return;
+    }
+    const pathname = (args.request.raw.url ?? args.request.url ?? "").split("?")[0] ?? "";
+    const queryIndex = (args.request.raw.url ?? args.request.url ?? "").indexOf("?");
+    const search = queryIndex >= 0 ? (args.request.raw.url ?? args.request.url ?? "").slice(queryIndex) : "";
+    const pathSuffix = args.pathSuffix ?? "";
+    const requestPath = pathSuffix ? `${args.sidecarManager.buildProxyBasePath(sidecarId)}/${pathSuffix.replace(/^\/+/, "")}` : args.sidecarManager.buildProxyBasePath(sidecarId);
+    const targetPath = args.sidecarManager.buildTargetPath(sidecarId, requestPath, search);
+    const targetOrigin = args.sidecarManager.buildTargetOrigin(sidecar);
+    const targetUrl = `${targetOrigin}${targetPath}`;
+    args.logger.debug({ sidecarId: sidecar.id, targetUrl, pathname, prefixMode: sidecar.prefixMode }, "Proxying request to SideCar");
+    await args.reply.from(targetUrl, {
+        rewriteRequestHeaders: (_originalRequest, headers) => sanitizeSideCarProxyRequestHeaders(headers, targetOrigin),
+        rewriteHeaders: (headers) => rewriteSideCarResponseHeaders(headers, sidecarId, targetOrigin, sidecar.prefixMode),
+        onError: (reply, { error }) => {
+            args.logger.error({ sidecarId: sidecar.id, err: error, targetUrl }, "Failed to proxy SideCar request");
+            if (!reply.sent) {
+                reply.code(502).send({ error: "SideCar proxy failed" });
+            }
+        },
+    });
+}
+function parseSideCarUpgradePath(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl, "http://localhost");
+    }
+    catch {
+        return null;
+    }
+    const match = parsed.pathname.match(/^\/sidecars\/([^/]+)(?:\/.*)?$/);
+    if (!match) {
+        return null;
+    }
+    try {
+        return {
+            sidecarId: decodeURIComponent(match[1] ?? ""),
+            pathname: parsed.pathname,
+            search: parsed.search,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+async function proxySideCarWebSocketUpgrade(args) {
+    const { request, socket, head, sidecarId, incomingPath, search, sidecarManager, authManager, logger } = args;
+    if (!isWebSocketUpgradeRequest(request)) {
+        rejectUpgrade(socket, 400, "Bad Request");
+        return;
+    }
+    const session = authManager.getSessionFromHeaders(request.headers);
+    if (!session) {
+        rejectUpgrade(socket, 401, "Unauthorized");
+        return;
+    }
+    const sidecar = await sidecarManager.get(sidecarId);
+    if (!sidecar) {
+        rejectUpgrade(socket, 404, "Not Found");
+        return;
+    }
+    const targetOrigin = sidecarManager.buildTargetOrigin(sidecar);
+    const targetPath = sidecarManager.buildTargetPath(sidecarId, incomingPath, search);
+    const targetUrl = new URL(`${targetOrigin}${targetPath}`);
+    logger.debug({ sidecarId, targetUrl: targetUrl.toString(), prefixMode: sidecar.prefixMode }, "Proxying websocket to SideCar");
+    const { socket: upstream, readyEvent } = createSideCarUpstreamSocket(targetUrl);
+    const closeBoth = () => {
+        if (!socket.destroyed) {
+            socket.destroy();
+        }
+        if (!upstream.destroyed) {
+            upstream.destroy();
+        }
+    };
+    upstream.once("error", (error) => {
+        logger.error({ sidecarId, err: error, targetUrl: targetUrl.toString() }, "Failed to proxy SideCar websocket");
+        rejectUpgrade(socket, 502, "Bad Gateway");
+        if (!upstream.destroyed) {
+            upstream.destroy();
+        }
+    });
+    socket.once("error", (error) => {
+        logger.debug({ sidecarId, err: error }, "SideCar websocket client socket errored");
+        if (!upstream.destroyed) {
+            upstream.destroy();
+        }
+    });
+    upstream.once(readyEvent, () => {
+        try {
+            upstream.write(buildSideCarWebSocketRequest(request, targetUrl));
+            if (head.length > 0) {
+                upstream.write(head);
+            }
+            upstream.pipe(socket);
+            socket.pipe(upstream);
+        }
+        catch (error) {
+            logger.error({ sidecarId, err: error, targetUrl: targetUrl.toString() }, "Failed to forward SideCar websocket upgrade");
+            closeBoth();
+        }
+    });
+    upstream.once("close", () => {
+        if (!socket.destroyed) {
+            socket.end();
+        }
+    });
+    socket.once("close", () => {
+        if (!upstream.destroyed) {
+            upstream.end();
+        }
+    });
+}
+function createSideCarUpstreamSocket(targetUrl) {
+    const port = Number(targetUrl.port || (targetUrl.protocol === "https:" ? 443 : 80));
+    if (targetUrl.protocol === "https:") {
+        return {
+            socket: connectTls({
+                host: targetUrl.hostname,
+                port,
+                servername: targetUrl.hostname,
+            }),
+            readyEvent: "secureConnect",
+        };
+    }
+    return {
+        socket: connectTcp(port, targetUrl.hostname),
+        readyEvent: "connect",
+    };
+}
+function buildSideCarWebSocketRequest(request, targetUrl) {
+    const pathWithQuery = `${targetUrl.pathname}${targetUrl.search}`;
+    const requestLine = `${request.method ?? "GET"} ${pathWithQuery} HTTP/${request.httpVersion}\r\n`;
+    const headerLines = [];
+    const rawHeaders = request.rawHeaders ?? [];
+    const blockedHeaders = getBlockedSideCarRequestHeaders();
+    for (let index = 0; index < rawHeaders.length; index += 2) {
+        const key = rawHeaders[index];
+        const value = rawHeaders[index + 1];
+        if (!key || value === undefined)
+            continue;
+        const lower = key.toLowerCase();
+        if (blockedHeaders.has(lower))
+            continue;
+        if (lower === "origin") {
+            headerLines.push(`Origin: ${targetUrl.origin}\r\n`);
+            continue;
+        }
+        headerLines.push(`${key}: ${value}\r\n`);
+    }
+    const hostValue = targetUrl.port ? `${targetUrl.hostname}:${targetUrl.port}` : targetUrl.hostname;
+    headerLines.push(`Host: ${hostValue}\r\n`);
+    headerLines.push("\r\n");
+    return requestLine + headerLines.join("");
+}
+function isWebSocketUpgradeRequest(request) {
+    const upgrade = request.headers.upgrade;
+    if (typeof upgrade !== "string" || upgrade.toLowerCase() !== "websocket") {
+        return false;
+    }
+    const connection = request.headers.connection;
+    const connectionValue = Array.isArray(connection) ? connection.join(",") : connection ?? "";
+    return connectionValue.toLowerCase().split(",").map((part) => part.trim()).includes("upgrade");
+}
+function rejectUpgrade(socket, statusCode, statusText) {
+    if (socket.destroyed) {
+        return;
+    }
+    socket.write(`HTTP/1.1 ${statusCode} ${statusText}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+    socket.destroy();
+}
+function rewriteSideCarResponseHeaders(headers, sidecarId, targetOrigin, prefixMode) {
+    if (prefixMode === "preserve") {
+        return headers;
+    }
+    const next = { ...headers };
+    const locationHeader = next.location;
+    const location = Array.isArray(locationHeader) ? locationHeader[0] : locationHeader;
+    if (!location) {
+        return next;
+    }
+    const publicBase = `/sidecars/${encodeURIComponent(sidecarId)}`;
+    if (location.startsWith("/")) {
+        next.location = `${publicBase}${location}`;
+        return next;
+    }
+    try {
+        const parsed = new URL(location);
+        if (parsed.origin === targetOrigin) {
+            next.location = `${publicBase}${parsed.pathname}${parsed.search}${parsed.hash}`;
+        }
+    }
+    catch {
+        // Relative redirects should continue to resolve against the public sidecar path.
+    }
+    return next;
+}
+function sanitizeSideCarProxyRequestHeaders(headers, targetOrigin) {
+    const blockedHeaders = getBlockedSideCarRequestHeaders();
+    const next = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (!value)
+            continue;
+        if (blockedHeaders.has(key.toLowerCase()))
+            continue;
+        next[key] = value;
+    }
+    next.origin = targetOrigin;
+    return next;
+}
+function getBlockedSideCarRequestHeaders() {
+    return new Set([
+        "host",
+        "authorization",
+        "proxy-authorization",
+        "forwarded",
+        "x-forwarded-for",
+        "x-forwarded-host",
+        "x-forwarded-port",
+        "x-forwarded-proto",
+    ]);
+}

package/dist/server/routes/remote-servers.js

@@ -0,0 +1,142 @@
+import { Agent, fetch } from "undici";
+import { z } from "zod";
+const ProbeSchema = z.object({
+    baseUrl: z.string().min(1),
+    skipTlsVerify: z.boolean().optional(),
+});
+const PROBE_TIMEOUT_MS = 8000;
+export function registerRemoteServerRoutes(app, deps) {
+    app.post("/api/remote-servers/probe", async (request, reply) => {
+        try {
+            const body = ProbeSchema.parse(request.body ?? {});
+            return await probeRemoteServer(body.baseUrl, Boolean(body.skipTlsVerify));
+        }
+        catch (error) {
+            deps.logger.warn({ err: error }, "Failed to probe remote server");
+            reply.code(400);
+            return { error: error instanceof Error ? error.message : "Invalid request" };
+        }
+    });
+}
+async function probeRemoteServer(baseUrl, skipTlsVerify) {
+    const normalizedUrl = normalizeBaseUrl(baseUrl);
+    const probeUrl = new URL("./api/auth/status", `${normalizedUrl}/`);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);
+    const dispatcher = skipTlsVerify ? new Agent({ connect: { rejectUnauthorized: false } }) : undefined;
+    try {
+        const response = await fetch(probeUrl, {
+            method: "GET",
+            dispatcher,
+            signal: controller.signal,
+            headers: {
+                Accept: "application/json",
+            },
+        });
+        if (!response.ok) {
+            return {
+                ok: false,
+                reachable: true,
+                normalizedUrl,
+                skipTlsVerify,
+                requiresAuth: false,
+                authenticated: false,
+                error: `Remote server returned HTTP ${response.status}`,
+                errorCode: "http_error",
+            };
+        }
+        const payload = (await response.json());
+        if (typeof payload?.authenticated !== "boolean") {
+            return {
+                ok: false,
+                reachable: true,
+                normalizedUrl,
+                skipTlsVerify,
+                requiresAuth: false,
+                authenticated: false,
+                error: "Remote server did not return a valid CodeNomad auth response",
+                errorCode: "invalid_server",
+            };
+        }
+        return {
+            ok: true,
+            reachable: true,
+            normalizedUrl,
+            skipTlsVerify,
+            requiresAuth: !payload.authenticated,
+            authenticated: payload.authenticated,
+        };
+    }
+    catch (error) {
+        const message = describeProbeError(error);
+        return {
+            ok: false,
+            reachable: false,
+            normalizedUrl,
+            skipTlsVerify,
+            requiresAuth: false,
+            authenticated: false,
+            error: message.message,
+            errorCode: message.code,
+        };
+    }
+    finally {
+        clearTimeout(timeout);
+        await dispatcher?.close().catch(() => { });
+    }
+}
+function normalizeBaseUrl(input) {
+    const parsed = new URL(input.trim());
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error("Server URL must use http:// or https://");
+    }
+    parsed.hash = "";
+    parsed.search = "";
+    parsed.pathname = parsed.pathname === "/" ? "/" : parsed.pathname.replace(/\/+$/, "") || "/";
+    const value = parsed.toString();
+    return parsed.pathname === "/" ? value.replace(/\/$/, "") : value.replace(/\/$/, "");
+}
+function describeProbeError(error) {
+    const chain = unwrapErrorChain(error);
+    const detailed = chain.find((entry) => {
+        const code = (entry?.code ?? "").toString();
+        return Boolean(code) && code !== "UND_ERR_RESPONSE_STATUS_CODE";
+    }) ?? chain[0];
+    const code = (detailed?.code ?? "").toString();
+    const exactMessage = detailed?.message?.trim() || chain.find((entry) => entry.message?.trim())?.message?.trim();
+    if (code === "DEPTH_ZERO_SELF_SIGNED_CERT" || code === "SELF_SIGNED_CERT_IN_CHAIN" || code === "CERT_HAS_EXPIRED") {
+        return {
+            code: "tls_error",
+            message: "Certificate check failed while connecting to the remote server.",
+        };
+    }
+    return {
+        code: code === "ERR_INVALID_URL"
+            ? "invalid_url"
+            : code === "ECONNREFUSED"
+                ? "connection_refused"
+                : code === "ENOTFOUND"
+                    ? "dns_error"
+                    : code === "UND_ERR_CONNECT_TIMEOUT" || code === "ABORT_ERR"
+                        ? "timeout"
+                        : code
+                            ? code.toLowerCase()
+                            : "probe_failed",
+        message: exactMessage || "Failed to connect to the remote server.",
+    };
+}
+function unwrapErrorChain(error) {
+    const results = [];
+    let current = error;
+    const seen = new Set();
+    while (current && typeof current === "object" && !seen.has(current)) {
+        seen.add(current);
+        const entry = current;
+        results.push({ code: entry.code, message: entry.message });
+        current = entry.cause;
+    }
+    if (results.length === 0 && error instanceof Error) {
+        results.push({ message: error.message });
+    }
+    return results;
+}

package/dist/server/routes/sidecars.js

@@ -0,0 +1,46 @@
+import { z } from "zod";
+const SideCarCreateSchema = z.object({
+    kind: z.literal("port").default("port"),
+    name: z.string().trim().min(1),
+    port: z.number().int().min(1).max(65535),
+    insecure: z.boolean().default(false),
+    prefixMode: z.enum(["strip", "preserve"]).default("strip"),
+});
+const SideCarUpdateSchema = SideCarCreateSchema.omit({ kind: true }).partial().refine((value) => Object.keys(value).length > 0, {
+    message: "At least one field is required",
+});
+export function registerSideCarRoutes(app, deps) {
+    app.get("/api/sidecars", async () => {
+        return { sidecars: await deps.sidecarManager.list() };
+    });
+    app.post("/api/sidecars", async (request, reply) => {
+        try {
+            const body = SideCarCreateSchema.parse(request.body ?? {});
+            const sidecar = await deps.sidecarManager.create(body);
+            reply.code(201);
+            return sidecar;
+        }
+        catch (error) {
+            reply.code(400);
+            return { error: error instanceof Error ? error.message : "Failed to create SideCar" };
+        }
+    });
+    app.put("/api/sidecars/:id", async (request, reply) => {
+        try {
+            const body = SideCarUpdateSchema.parse(request.body ?? {});
+            return await deps.sidecarManager.update(request.params.id, body);
+        }
+        catch (error) {
+            reply.code(400);
+            return { error: error instanceof Error ? error.message : "Failed to update SideCar" };
+        }
+    });
+    app.delete("/api/sidecars/:id", async (request, reply) => {
+        const removed = await deps.sidecarManager.delete(request.params.id);
+        if (!removed) {
+            reply.code(404);
+            return { error: "SideCar not found" };
+        }
+        reply.code(204);
+    });
+}

package/dist/settings/migrate.js

@@ -93,6 +93,10 @@ function mapLegacyToOwnerDocs(legacyConfig, legacyState) {
         if (typeof listeningMode === "string") {
             serverConfig.listeningMode = listeningMode;
         }
+        const logLevel = preferences.logLevel;
+        if (typeof logLevel === "string") {
+            serverConfig.logLevel = logLevel;
+        }
         const lastUsedBinary = preferences.lastUsedBinary;
         if (typeof lastUsedBinary === "string") {
             serverConfig.opencodeBinary = lastUsedBinary;
@@ -118,6 +122,7 @@ function mapLegacyToOwnerDocs(legacyConfig, legacyState) {
         const moved = new Set([
             "environmentVariables",
             "listeningMode",
+            "logLevel",
             "lastUsedBinary",
             "modelRecents",
             "modelFavorites",