[waldekmastykarz]

Closes #1961

Problem

devproxy logs --since and GET /proxy/logs?since= assumed log lines start with [hh:mm:ss.fff] and combined that with DateTime.Today. Detached log lines don't have that prefix (e.g. info …, req ╭ GET …). Any line that didn't match was included, so since filtered nothing. For example, --since 2030-01-01T00:00:00 returned the whole log. Even when it did match, the date was ignored.

Fix

New LogSinceFilter (shared by the CLI command and the API controller) filters full timestamp instants:

• Before the first timestamp in legacy logs, lines use the selected process's actual start time, which remains stable across hot reloads.
• Request blocks (req ╭ … ╰, including the preceding blank line) use the full ISO timestamp from their time │ line.
• Detached regular text messages include full UTC timestamps at every surviving log level, including Warning/Error-only logging. Buffered regular messages retain their emission timestamps.
• Legacy debug/trace [HH:mm:ss.fffffff] prefixes (and [HH:mm:ss.fff]) are reconstructed against the previous timestamp, accounting for midnight, small out-of-order writes, and the repeated daylight-saving hour.
• JSON log lines retain their timestamp instants.
• Other lines use the most recent preceding timestamp.
• Detached logs always retain timestamp metadata, even with showTimestamps: false. Interactive output continues to honor that setting and keeps its existing formatting.
• Shared CLI/API cutoff parsing and comparisons use DateTimeOffset, preserving explicit offsets and correct ordering across both occurrences of the repeated daylight-saving hour.

CLI --follow and API SSE streaming share an incremental reader that filters by event time, retains timestamp reconstruction state, and buffers partial lines and incomplete request blocks across reads. Requests that start before the cutoff remain excluded even if they finish afterward.

Validation

• All 491 solution tests pass, including regression coverage for process start after hot reload, buffered requests across reads, partial lines, JSON/text/request timestamps, midnight rollover, daylight-saving rollback and instant ordering, elapsed-time cutoff parsing, Warning-level timestamp metadata, and unchanged interactive output.
• All 38 log-filtering, CLI log, and logging-configuration tests also pass with TZ=America/New_York.
• Solution build succeeds without warnings or errors after integrating upstream main 94a9579 (Count intercepted requests for mock nth #1987).
• Detached end-to-end checks with showTimestamps: false confirm CLI/API snapshot and follow filtering at Information and Warning levels. Newly emitted Error records remain visible after a post-start cutoff at Warning level; older records and future-cutoff output are excluded.

[Copilot]

🟡 Changes recommended

Filtering remains incorrect after hot reload, with timestamps disabled, and for buffered requests in follow mode.

3 open issues

• Hot reload resets start time and misdates detached log entries · New
• Missing timestamps break since filtering when timestamps are hidden · New
• Followed log filtering uses write time instead of event time · New

What changed in this PR

Addresses #1961 by sharing full-date log filtering between the CLI and management API without changing the log format.

Changes:

• Reconstructs timestamps from request blocks, debug/trace prefixes, and JSON entries.
• Integrates shared filtering into both log readers.
• Adds tests for multi-day filtering, midnight rollover, and timestamp fallback.

File	Description
DevProxy/​Logging/​LogSinceFilter.cs	Implements shared timestamp reconstruction and filtering.
DevProxy/​Commands/​LogsCommand.cs	Integrates filtering and changes follow-mode handling.
DevProxy/​ApiControllers/​ProxyController.cs	Uses shared filtering with process start time.
DevProxy.Tests/​LogSinceFilterTests.cs	Covers timestamp formats and date boundaries.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Daylight-saving clock rollback can incorrectly date logs one day ahead and include them beyond the requested cutoff.

4 open issues

• Missing timestamps break since filtering when timestamps are hidden
• Hot reload resets start time and misdates detached log entries
• DST fall-back misdates local debug timestamps · New
• Followed log filtering uses write time instead of event time

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Repeated-hour comparisons and missing timestamps in warning/error-only text logs can still produce incorrect filtering results.

2 open issues

• Retain timestamps on detached logs after level filtering · New
• Preserve timestamp instants across daylight-saving fallback · New

4 resolved since last review

• Missing timestamps break since filtering when timestamps are hidden
• Hot reload resets start time and misdates detached log entries
• DST fall-back misdates local debug timestamps
• Followed log filtering uses write time instead of event time

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Blank-label request terminators are not recognized, delaying filtered streaming output and misdating subsequent snapshot messages.

1 open issue

• Allow empty labels for completed Normal message blocks · New

2 resolved since last review

• Preserve timestamp instants across daylight-saving fallback
• Retain timestamps on detached logs after level filtering

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No unresolved blocking issues remain, and the supplied regression coverage addresses the timestamp and streaming failures reported previously.

No open issues 🎉

1 resolved since last review

• Allow empty labels for completed Normal message blocks

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Stateful streaming and timezone-sensitive legacy reconstruction warrant final human validation across supported platforms.

No open issues 🎉

_{Review effort: Balanced}

[waldekmastykarz]

The latest summary reports no open issues and does not identify a failing scenario. The stateful paths are covered by regressions for incomplete request blocks across reads, partial lines/CRLF, event-time exclusion of delayed requests, midnight rollover, blank-label/ANSI terminators, and JSON/text/request timestamps. Repeated-hour tests exercise both UTC-offset orderings and New York, Berlin, and Lord Howe rollback rules. On exact head f67be85, all 526 solution tests pass on macOS; all 41 log-related tests pass with TZ=America/New_York, UTC, Europe/Berlin, and Australia/Lord_Howe. Earlier detached macOS runtime checks also exercised CLI/API snapshots, CLI follow, and API SSE at Information and Warning levels with showTimestamps:false.

Platform limits: the green GitHub Actions build runs on ubuntu-latest and does not execute tests; I have not executed Windows tests or Linux runtime tests. Therefore I am not claiming all-platform validation. With no concrete defect or missing scenario specified, I do not see a justified implementation change in the generic recommendation. Please distinguish any specific remaining correctness issue from a discretionary additional-platform sign-off. Requesting one further pass with this evidence; no code changes or repeated review requests solely to obtain a different verdict.

[Copilot]

🟢 Approval recommended

The shared implementation and targeted regression coverage address the reported filtering failures with no unresolved blocking issues identified.

No open issues 🎉

_{Review effort: Balanced}