@oar-sh/oar 0.9.10 → 0.9.12

package/server/services/cli-process-runner.mjs

@@ -37,10 +37,6 @@ const OTHER_ESCAPE_PATTERN = /\x1b[@-Z\\-_]/g;
 // differently-sized terminal this degrades to the pre-wrap behaviour.
 const PTY_WRAP_COLUMNS = 80;
 
-function normalizeText(value) {
-  return String(value == null ? '' : value).trim();
-}
-
 /**
  * Removes OSC sequences (including OSC-8 hyperlink wrappers), ANSI CSI
  * sequences and the CR the PTY adds to every line, leaving the human-visible
@@ -74,23 +70,10 @@ export function joinWrappedLines(value) {
   return joined.join('\n');
 }
 
-/**
- * Redacts anything token-shaped plus an exact secret the caller knows it
- * handed over (the pasted Claude login code), so an error tail can be surfaced
- * to the UI without leaking a credential. Long PKCE segments in an authorize
- * URL get caught by the generic rule too, which is fine: the URL is already
- * carried in the login payload.
- */
-export function scrubSecrets(text, submittedCode = '') {
-  let output = String(text == null ? '' : text);
-  const code = normalizeText(submittedCode);
-  if (code.length >= 4) {
-    output = output.split(code).join('[redacted]');
-  }
-  return output
-    .replace(/sk-ant-[A-Za-z0-9_-]+/g, '[redacted]')
-    .replace(/[A-Za-z0-9_-]{32,}/g, '[redacted]');
-}
+// Redacts anything token-shaped plus an exact secret the caller handed over.
+// The rules live in the shared text pipeline, which also scrubs background
+// task output (browser-safe, so it cannot import this module).
+export { scrubSecrets } from '../../shared/task-output-text.mjs';
 
 /** Collapses captured output into one short single-line tail for an error. */
 export function tailOf(text, limit = MAX_ERROR_TAIL_CHARS) {

package/server/services/conversation-history-page.mjs

@@ -0,0 +1,199 @@
+'use strict';
+
+// One page of a conversation's history, selected in SQL.
+//
+// The history route used to load every message, hydrate every reply and only
+// then cut the page out (selectConversationHistoryPage in sessions-routes.mjs),
+// so each page and each live poll paid for the whole conversation. This module
+// selects the page's rows in SQL with the same cursor rules and the same
+// pageInfo, so only the page is hydrated.
+//
+// The JS order is (timestamp in ms, then id by localeCompare). SQL orders by
+// (timestamp text, id text). The two agree when every timestamp has the fixed
+// ISO shape the relay writes (YYYY-MM-DDTHH:MM:SS.mmmZ) and every id is made
+// of lowercase letters, digits and dashes (the relay's UUIDs). A conversation
+// with any other row is not paged here: the selector returns null and the
+// caller keeps the in-memory path, which handles every shape.
+
+const ISO_TIMESTAMP_GLOB = '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9].[0-9][0-9][0-9]Z';
+const ISO_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+const ORDERABLE_ID_PATTERN = /^[-0-9a-z]+$/;
+
+export function normalizeConversationTimestampMs(value) {
+  const text = String(value || '').trim();
+  if (!text) return 0;
+  const sqliteUtcLike = /^(\d{4}-\d{2}-\d{2})[ T](\d{2}:\d{2}:\d{2}(?:\.\d{1,6})?)$/;
+  const hasExplicitTimezone = /(?:Z|[+-]\d{2}:?\d{2})$/i.test(text);
+  let normalized = text;
+  if (!hasExplicitTimezone && sqliteUtcLike.test(text)) {
+    const [, day, time] = text.match(sqliteUtcLike) || [];
+    normalized = `${day}T${time}Z`;
+  }
+  const parsed = Date.parse(normalized);
+  return Number.isFinite(parsed) ? parsed : 0;
+}
+
+export function normalizeConversationHistoryLimit(value, fallback = 20) {
+  const numeric = Number(value);
+  if (!Number.isFinite(numeric)) return fallback;
+  return Math.min(100, Math.max(1, Math.trunc(numeric)));
+}
+
+/**
+ * The pageInfo of a history page: `pageMessages` in conversation order, and
+ * whether the conversation has rows before the first and after the last.
+ */
+export function buildConversationHistoryPageInfo(pageMessages = [], { hasMoreOlder = false, hasMoreNewer = false } = {}) {
+  const firstMessage = pageMessages[0] || null;
+  const lastMessage = pageMessages[pageMessages.length - 1] || null;
+  return {
+    hasMore: hasMoreOlder,
+    hasMoreOlder,
+    hasMoreNewer,
+    nextCursor: firstMessage ? {
+      beforeMessageId: String(firstMessage.id || '').trim(),
+      beforeTimestamp: String(firstMessage.timestamp || '').trim() || null,
+    } : null,
+    olderCursor: firstMessage ? {
+      beforeMessageId: String(firstMessage.id || '').trim(),
+      beforeTimestamp: String(firstMessage.timestamp || '').trim() || null,
+    } : null,
+    newerCursor: lastMessage ? {
+      afterMessageId: String(lastMessage.id || '').trim(),
+      afterTimestamp: String(lastMessage.timestamp || '').trim() || null,
+    } : null,
+  };
+}
+
+/**
+ * The prepared statements for paging one conversation. `sharedOnly` pages
+ * over the rows a shared view shows (not hidden from shares).
+ */
+export function createConversationHistoryPageStatements(db) {
+  const messageColumns = new Set(db.prepare(`PRAGMA table_info(messages)`).all().map((column) => column.name));
+  const sharedFilter = messageColumns.has('hidden_from_shares') ? 'AND hidden_from_shares = 0' : '';
+  const hasResendColumns = messageColumns.has('source_message_id') && messageColumns.has('resend_of_message_id');
+  const build = (visibility) => {
+    const base = `FROM messages WHERE conversation_id = @conversationId ${visibility}`;
+    const older = `(timestamp < @timestamp OR (timestamp = @timestamp AND @id IS NOT NULL AND id < @id))`;
+    const newer = `(timestamp > @timestamp OR (timestamp = @timestamp AND @id IS NOT NULL AND id > @id))`;
+    return {
+      irregular: db.prepare(`
+        SELECT EXISTS (
+          SELECT 1 ${base}
+          AND NOT (timestamp GLOB '${ISO_TIMESTAMP_GLOB}' AND id <> '' AND id NOT GLOB '*[^-0-9a-z]*')
+        ) AS irregular
+      `),
+      findById: db.prepare(`SELECT id, timestamp ${base} AND id = @id`),
+      older: db.prepare(`SELECT * ${base} AND ${older} ORDER BY timestamp DESC, id DESC LIMIT @limit`),
+      newer: db.prepare(`SELECT * ${base} AND ${newer} ORDER BY timestamp ASC, id ASC LIMIT @limit`),
+      fromInclusive: db.prepare(`
+        SELECT * ${base} AND (timestamp > @timestamp OR (timestamp = @timestamp AND id >= @id))
+        ORDER BY timestamp ASC, id ASC LIMIT @limit
+      `),
+      tail: db.prepare(`SELECT * ${base} ORDER BY timestamp DESC, id DESC LIMIT @limit`),
+      existsOlder: db.prepare(`SELECT EXISTS (SELECT 1 ${base} AND ${older}) AS found`),
+      existsNewer: db.prepare(`SELECT EXISTS (SELECT 1 ${base} AND ${newer}) AS found`),
+      // What liveResendsByOriginal reads, for the whole conversation: a
+      // stopped marker on the page may have its Resend outside it.
+      resendIndex: hasResendColumns
+        ? db.prepare(`SELECT id, role, source_message_id, resend_of_message_id ${base} ORDER BY timestamp ASC`)
+        : null,
+    };
+  };
+  const all = build('');
+  const shared = build(sharedFilter);
+  return {
+    selectConversationHistoryPage(conversationId, options = {}) {
+      return selectConversationHistoryPageFromStatements(options.sharedOnly ? shared : all, conversationId, options);
+    },
+    listConversationResendIndex(conversationId, { sharedOnly = false } = {}) {
+      const statement = (sharedOnly ? shared : all).resendIndex;
+      return statement ? statement.all({ conversationId }) : [];
+    },
+  };
+}
+
+// A cursor as the in-memory selector resolves it, in the SQL shape: the
+// message's own timestamp when its id is in the conversation, else the given
+// timestamp. Null when there is no cursor; `unsupported` when the given
+// values cannot be compared in SQL the way the selector compares them.
+function resolveCursor(statements, conversationId, { messageId = '', timestamp = '' } = {}) {
+  const cursorMessageId = String(messageId || '').trim();
+  const cursorTimestampText = String(timestamp || '').trim();
+  if (cursorMessageId) {
+    const row = statements.findById.get({ conversationId, id: cursorMessageId });
+    if (row) return { id: cursorMessageId, timestamp: String(row.timestamp) };
+  }
+  if (!cursorTimestampText) return null;
+  if (cursorMessageId && !ORDERABLE_ID_PATTERN.test(cursorMessageId)) return 'unsupported';
+  let canonical = cursorTimestampText;
+  if (!ISO_TIMESTAMP_PATTERN.test(canonical)) {
+    canonical = new Date(normalizeConversationTimestampMs(cursorTimestampText)).toISOString();
+    if (!ISO_TIMESTAMP_PATTERN.test(canonical)) return 'unsupported';
+  }
+  return { id: cursorMessageId || null, timestamp: canonical };
+}
+
+/**
+ * The page of rows (raw message rows, in conversation order) and its
+ * pageInfo, by the rules of selectConversationHistoryPage; null when the
+ * conversation or the cursor cannot be paged in SQL (see the top note).
+ */
+function selectConversationHistoryPageFromStatements(statements, conversationId, {
+  limit = 20,
+  beforeMessageId = '',
+  beforeTimestamp = '',
+  afterMessageId = '',
+  afterTimestamp = '',
+  aroundMessageId = '',
+} = {}) {
+  if (statements.irregular.get({ conversationId })?.irregular) return null;
+  const pageLimit = normalizeConversationHistoryLimit(limit);
+  const aroundId = String(aroundMessageId || '').trim();
+  const requestedAroundWindow = !!aroundId;
+  const requestedAfterWindow = !!String(afterMessageId || '').trim();
+  const beforeCursor = resolveCursor(statements, conversationId, { messageId: beforeMessageId, timestamp: beforeTimestamp });
+  const afterCursor = resolveCursor(statements, conversationId, { messageId: afterMessageId, timestamp: afterTimestamp });
+  if (beforeCursor === 'unsupported' || afterCursor === 'unsupported') return null;
+
+  let rows = [];
+  if (aroundId) {
+    const anchor = statements.findById.get({ conversationId, id: aroundId });
+    if (anchor) {
+      // Enough rows on both sides for the in-memory window rules to give the
+      // same window as over the whole conversation.
+      const before = statements.older
+        .all({ conversationId, timestamp: anchor.timestamp, id: anchor.id, limit: pageLimit - 1 })
+        .reverse();
+      const fromAnchor = statements.fromInclusive
+        .all({ conversationId, timestamp: anchor.timestamp, id: anchor.id, limit: pageLimit });
+      const local = [...before, ...fromAnchor];
+      const aroundIndex = before.length;
+      const halfWindow = Math.floor((pageLimit - 1) / 2);
+      let start = Math.max(0, aroundIndex - halfWindow);
+      const end = Math.min(local.length, start + pageLimit);
+      if ((end - start) < pageLimit) start = Math.max(0, end - pageLimit);
+      rows = local.slice(start, end);
+    }
+  }
+  if (!rows.length && !requestedAroundWindow && afterCursor) {
+    rows = statements.newer.all({ conversationId, ...afterCursor, limit: pageLimit });
+  }
+  if (!rows.length && !requestedAfterWindow && !requestedAroundWindow) {
+    rows = (beforeCursor
+      ? statements.older.all({ conversationId, ...beforeCursor, limit: pageLimit })
+      : statements.tail.all({ conversationId, limit: pageLimit })
+    ).reverse();
+  }
+
+  const first = rows[0] || null;
+  const last = rows[rows.length - 1] || null;
+  const hasMoreOlder = first
+    ? !!statements.existsOlder.get({ conversationId, timestamp: first.timestamp, id: first.id })?.found
+    : false;
+  const hasMoreNewer = last
+    ? !!statements.existsNewer.get({ conversationId, timestamp: last.timestamp, id: last.id })?.found
+    : false;
+  return { rows, pageInfo: buildConversationHistoryPageInfo(rows, { hasMoreOlder, hasMoreNewer }) };
+}

package/server/services/delete-archive-service.mjs

@@ -25,7 +25,7 @@ function createSdkDeleteSessionCaller(sdkClient) {
 
 import { cleanupGeneratedImagesForConversation } from './generated-image-cleanup-service.mjs';
 
-export function createDeleteArchiveService(db, sdkClient, { resolveSessionStateRoot = null } = {}) {
+export function createDeleteArchiveService(db, sdkClient, { resolveSessionStateRoot = null, conversationGroups = null } = {}) {
   const callDeleteSession = createSdkDeleteSessionCaller(sdkClient);
 
   const stmts = {
@@ -87,6 +87,9 @@ export function createDeleteArchiveService(db, sdkClient, { resolveSessionStateR
       messageRows: stmts.listConversationMessages.all(conversationId),
       resolveSessionStateRoot,
     });
+    // A head leaves its session group (title frozen as the name) before its
+    // row goes; a group left empty goes with it.
+    try { conversationGroups?.forgetConversation?.(conversationId); } catch {}
     stmts.hardDeleteConversation(conversationId);
   }
 

package/server/services/detached-worker-watch-service.mjs

@@ -0,0 +1,150 @@
+// ---------------------------------------------------------------------------
+// Detached-worker watch
+//
+// A worker whose process lives on but whose websocket to the relay is gone
+// gets no deliveries, and the relay spawns no replacement while its process
+// is alive: a message for its session would wait for ever. A worker on Node
+// 22 ended up like that after a relay restart, its one reconnect having met a
+// runtime that was not ready yet.
+//
+// The watch looks at the sessions that have a message waiting. One whose
+// worker process is found alive with no socket, no turn running and no
+// background work is replaced once it has been detached for the grace time:
+// the old process is stopped and a new worker spawned, which takes the
+// waiting message at its hello. The grace time counts from the latest of the
+// watch's start (a relay start), the session's last socket end and its last
+// spawn; a worker still booting gets twice as long.
+// ---------------------------------------------------------------------------
+
+export const DETACHED_WORKER_GRACE_MS = 60_000;
+// A replacement that did not help (the new worker cannot connect either)
+// is not repeated at once.
+export const DETACHED_WORKER_REPLACE_COOLDOWN_MS = 5 * 60_000;
+
+function normalizeSessionId(value) {
+  return String(value || '').trim();
+}
+
+export function createDetachedWorkerWatch({
+  graceMs = DETACHED_WORKER_GRACE_MS,
+  replaceCooldownMs = DETACHED_WORKER_REPLACE_COOLDOWN_MS,
+  now = () => Date.now(),
+  // Whether the watch may act at all (routing on, no shutdown under way).
+  isEnabled = () => true,
+  // The session ids that have a message waiting for their worker.
+  listWaitingSessionIds = () => [],
+  hasWorkerSocket = () => true,
+  hasRunningTurn = () => true,
+  hasBackgroundWork = () => true,
+  // A kill just asked for, or a launch in flight: not the watch's business.
+  isLaunchBlocked = () => false,
+  // ({ launchMode, launchAtMs, awaitingHeartbeat }) for the session, or null.
+  getLaunchState = () => null,
+  // Resolves to whether a process of the session's worker is running.
+  isWorkerProcessAlive = async () => false,
+  // Stops the session's worker processes and spawns a new worker; resolves
+  // to { ok, error }.
+  replaceWorker = async () => ({ ok: false, error: 'not-configured' }),
+  log = () => {},
+} = {}) {
+  const startedAtMs = Number(now());
+  const socketEndedAtMs = new Map();
+  const replacedAtMs = new Map();
+  const replacing = new Set();
+  let sweepInFlight = false;
+
+  function nowMs() {
+    const value = Number(now());
+    return Number.isFinite(value) ? value : Date.now();
+  }
+
+  function noteSocketEnded(sessionId) {
+    const sid = normalizeSessionId(sessionId);
+    if (sid) socketEndedAtMs.set(sid, nowMs());
+  }
+
+  function forgetOld(atMs) {
+    const horizon = Math.max(graceMs * 2, replaceCooldownMs);
+    for (const [sid, at] of socketEndedAtMs) {
+      if (atMs - at > horizon) socketEndedAtMs.delete(sid);
+    }
+    for (const [sid, at] of replacedAtMs) {
+      if (atMs - at > horizon) replacedAtMs.delete(sid);
+    }
+  }
+
+  // How long the session's worker has been detached for the watch's
+  // purposes, and the grace it gets.
+  function detachedFor(sid, atMs) {
+    const launch = getLaunchState(sid) || null;
+    const launchAtMs = Number(launch?.launchAtMs || 0);
+    const spawnedAtMs = launch?.launchMode === 'spawned' ? launchAtMs : 0;
+    const anchorMs = Math.max(startedAtMs, Number(socketEndedAtMs.get(sid) || 0), spawnedAtMs);
+    const booting = launch?.launchMode === 'spawned' && launch?.awaitingHeartbeat === true;
+    return { detachedMs: atMs - anchorMs, graceMs: booting ? graceMs * 2 : graceMs };
+  }
+
+  function stillDetached(sid) {
+    return !hasWorkerSocket(sid) && !hasRunningTurn(sid) && !hasBackgroundWork(sid) && !isLaunchBlocked(sid);
+  }
+
+  async function considerSession(sid, atMs) {
+    if (replacing.has(sid)) return false;
+    if (!stillDetached(sid)) return false;
+    const lastReplacedAtMs = replacedAtMs.get(sid);
+    if (lastReplacedAtMs && atMs - lastReplacedAtMs < replaceCooldownMs) return false;
+    const { detachedMs, graceMs: grace } = detachedFor(sid, atMs);
+    if (detachedMs < grace) return false;
+    if (!(await isWorkerProcessAlive(sid))) return false;
+    // The process probe can take a moment (a process list): the worker may
+    // have reconnected or taken a turn meanwhile.
+    if (!isEnabled() || !stillDetached(sid)) return false;
+
+    replacing.add(sid);
+    replacedAtMs.set(sid, atMs);
+    log(`WORKER DETACHED session=${sid.slice(0, 8)} detachedMs=${detachedMs} — no socket while a message waits; replacing the worker`);
+    try {
+      const result = await replaceWorker(sid, { detachedMs });
+      if (result?.ok) {
+        log(`WORKER DETACHED session=${sid.slice(0, 8)} replaced`);
+        return true;
+      }
+      log(`WORKER DETACHED session=${sid.slice(0, 8)} replace failed: ${String(result?.error || 'unknown')}`);
+      return false;
+    } catch (error) {
+      log(`WORKER DETACHED session=${sid.slice(0, 8)} replace failed: ${error?.message || error}`);
+      return false;
+    } finally {
+      replacing.delete(sid);
+    }
+  }
+
+  // One sweep at a time: a slow process list must not pile sweeps up.
+  async function sweep() {
+    if (sweepInFlight) return 0;
+    if (!isEnabled()) return 0;
+    sweepInFlight = true;
+    try {
+      const atMs = nowMs();
+      forgetOld(atMs);
+      const sessionIds = [...new Set((listWaitingSessionIds() || []).map(normalizeSessionId).filter(Boolean))];
+      let replaced = 0;
+      for (const sid of sessionIds) {
+        if (!isEnabled()) break;
+        try {
+          if (await considerSession(sid, atMs)) replaced += 1;
+        } catch (error) {
+          log(`WORKER DETACHED check failed session=${sid.slice(0, 8)} err=${error?.message || error}`);
+        }
+      }
+      return replaced;
+    } finally {
+      sweepInFlight = false;
+    }
+  }
+
+  return {
+    noteSocketEnded,
+    sweep,
+  };
+}

package/server/services/hidden-message-list.mjs

@@ -0,0 +1,21 @@
+'use strict';
+
+// The list of messages a conversation hides from its shared viewers: one
+// short plain-text preview per message, the same shape as the pin list, so
+// the owner's 🙈 list and its count cover messages outside the loaded page.
+// Owner-only: the shared payload never carries it.
+
+import { buildPinPreview, countAttachments } from './message-pin-list.mjs';
+
+export function buildHiddenMessageList(rows) {
+  return (Array.isArray(rows) ? rows : [])
+    .filter((row) => String(row?.id || '').trim())
+    .map((row) => ({
+      messageId: String(row.id).trim(),
+      role: String(row.role || '').trim(),
+      preview: buildPinPreview(row.text, row.mode),
+      timestamp: row.timestamp || null,
+      hiddenAt: row.share_hidden_at || null,
+      attachmentCount: countAttachments(row.attachments),
+    }));
+}

package/server/services/host-suspend-command.mjs

@@ -1,6 +1,7 @@
 'use strict';
 
 import { spawn } from 'node:child_process';
+import { windowsSystemToolPath } from '../../shared/windows-system-tools.mjs';
 
 /**
  * The actual suspend-to-RAM call. Windows only: `SetSuspendState 0,0,0` puts
@@ -25,7 +26,7 @@ export function runHostSuspendToRam({
     return { ok: true, command, dryRun: true };
   }
   try {
-    const child = spawnImpl('rundll32.exe', ['powrprof.dll,SetSuspendState', '0,0,0'], {
+    const child = spawnImpl(windowsSystemToolPath('rundll32.exe'), ['powrprof.dll,SetSuspendState', '0,0,0'], {
       detached: true,
       stdio: 'ignore',
       windowsHide: true,

package/server/services/message-pin-list.mjs

@@ -9,7 +9,7 @@ import { stripRelayPromptContext } from './relay-prompt-sanitizer.mjs';
 export const MESSAGE_PIN_LIMIT = 100;
 export const PIN_PREVIEW_MAX_LENGTH = 160;
 
-function countAttachments(raw) {
+export function countAttachments(raw) {
   if (Array.isArray(raw)) return raw.length;
   if (typeof raw !== 'string' || !raw) return 0;
   try {

package/server/services/preview-health-probe.mjs

@@ -2,7 +2,7 @@
 
 import net from 'net';
 
-// Liveness for preview cards. Previews never auto-close, so the card has to say
+// Liveness for preview cards. Previews never expire, so the card has to say
 // whether the dev server behind it is still up — a TCP connect is enough and,
 // unlike an HTTP request, leaves nothing in the app's request log.
 
@@ -55,6 +55,10 @@ export function createPreviewHealthProbe({
     // A slow sweep must not overlap itself; with the registry capped at 8
     // previews and a 250ms connect budget, one pass is bounded at ~2s anyway.
     if (sweeping) return;
+    // Store writes that failed (a locked database) are retried on this beat,
+    // so the table catches up with memory without a timer of its own, and
+    // rows a restore could not judge get their check again.
+    try { registry.maintain?.(); } catch {}
     const previews = registry.list().filter((entry) => entry.mode !== 'static');
     if (previews.length === 0) return;
     sweeping = true;
@@ -70,6 +74,9 @@ export function createPreviewHealthProbe({
     timer = setIntervalImpl(() => { sweep().catch(() => {}); }, intervalMs);
     // An idle relay should not be held awake by a probe that has nothing to do.
     if (typeof timer?.unref === 'function') timer.unref();
+    // One pass right away: port previews restored at boot start without a
+    // health state, and their cards should not wait a full interval for one.
+    sweep().catch(() => {});
   }
 
   function stop() {

package/server/services/preview-proxy-server.mjs

@@ -2,7 +2,7 @@
 
 import http from 'http';
 
-import { parsePreviewPath } from './preview-registry-service.mjs';
+import { parsePreviewPath, previewLogId } from './preview-registry-service.mjs';
 import { serveStaticPreview } from './preview-static-handler.mjs';
 
 // The preview listener. A bare http.Server on its own loopback port whose
@@ -270,12 +270,16 @@ export function createPreviewProxyServer({
     socket.once('error', forget);
   }
 
-  function logHit(entry, req) {
+  // The token is the capability and the request URL carries it, so the line
+  // names the preview by a hash and logs only the upstream path, without query.
+  function logHit(entry, req, upstreamPath) {
     const now = Date.now();
     const last = lastHitLogAt.get(entry.token) || 0;
     if (now - last < 60_000) return;
     lastHitLogAt.set(entry.token, now);
-    logger?.log?.(`[preview] ${entry.token.slice(0, 8)} → :${entry.targetPort} ${req.method} ${req.url} from ${clientIp(req)}`);
+    const target = entry.mode === 'static' ? 'static' : `:${entry.targetPort}`;
+    const pathOnly = String(upstreamPath || '/').split('?')[0];
+    logger?.log?.(`[preview] ${previewLogId(entry.token)} → ${target} ${req.method} ${pathOnly} from ${clientIp(req)}`);
   }
 
   function resolveRequest(req) {
@@ -309,7 +313,7 @@ export function createPreviewProxyServer({
 
     const { entry, upstreamPath } = resolved;
     registry.recordHit(entry.token);
-    logHit(entry, req);
+    logHit(entry, req, upstreamPath);
 
     // Static previews are answered in-process — no upstream, no forwarding.
     if (entry.mode === 'static') {