fix(gui): render dashboard log timestamps in the server's timezone (#725)

A proxy running in KST viewed from a UTC browser reported every request
nine hours off: `formatLogTimestamp` and `formatLogDateTime` called
`toLocaleTimeString(localeTag)` with no zone, so the viewer's machine
decided what time the server logged something.

The zone rides on `/api/settings`, which is already an object and already
flows through the GUI. PR #790 fixed the same defect by rewriting
`/api/logs` from a bare array into a `{timeZone, logs}` envelope -- while
leaving four suites that read that response as an array untouched
(server-auth:1623, claude-native-passthrough:119,
openai-provider-option-e2e:489, server-403-permission-e2e:86). It also
added a session-cache schema that accepts both the old and new shapes.
Curiously that PR already added `timeZone` to `/api/settings` and then
never read it, carrying one value over two routes.

Layout is untouched, which was the constraint here. The GUI diff is two
call sites gaining a third argument; every `className`, element and
stylesheet is byte-identical. `git diff -- gui/` filtered for
className/element/style changes returns the two timestamp lines and
nothing else.

The formatters swallow `RangeError`: a zone string this browser's ICU
build does not know would otherwise take the whole row render down, and a
timestamp in the wrong zone beats an empty log list. The fetch is a
one-shot on mount rather than part of the 2s log poll, since the server's
zone cannot change while the page is open, and an older proxy without the
field simply keeps browser-local formatting.

Tests, both verified by ablation rather than assumed:

- removing `timeZone` from /api/settings fails the settings test (4/1)
- dropping the formatter argument fails the rendering test (4/1)

That second one is the case #790's own test could not catch: it compared
the response to itself and passed with the production change reverted. The
new test fixes 00:30 UTC and asserts Seoul reads 9:30 while UTC reads
12:30, so an ignored argument shows up as a wrong hour. There is also a
test asserting /api/logs is still a bare array, placed at the source so
the contract fails here rather than in four unrelated suites.

The detail dialog gets the same zone; leaving it on browser time would put
two different times for one request on screen at once.

Co-authored-by: Wibias <37517432+Wibias@users.noreply.github.com>

Author: lidge-jun

gui/src/pages/Logs.tsx

@@ -285,12 +285,22 @@ function statusColor(status: number): string {
   return "var(--amber)";
 }
 
-function formatLogTimestamp(ts: number, localeTag?: string): string {
-  return new Date(ts).toLocaleTimeString(localeTag);
+function formatLogTimestamp(ts: number, localeTag?: string, timeZone?: string): string {
+  try {
+    return new Date(ts).toLocaleTimeString(localeTag, timeZone ? { timeZone } : undefined);
+  } catch {
+    // An IANA zone the browser's ICU build does not know throws RangeError, which would take
+    // the whole row render down. A timestamp in the wrong zone beats no log list at all.
+    return new Date(ts).toLocaleTimeString(localeTag);
+  }
 }
 
-function formatLogDateTime(ts: number, localeTag?: string): string {
-  return new Date(ts).toLocaleString(localeTag);
+function formatLogDateTime(ts: number, localeTag?: string, timeZone?: string): string {
+  try {
+    return new Date(ts).toLocaleString(localeTag, timeZone ? { timeZone } : undefined);
+  } catch {
+    return new Date(ts).toLocaleString(localeTag);
+  }
 }
 
 function modelTitle(log: LogEntry): string {
@@ -344,6 +354,27 @@ export default function Logs({ apiBase }: { apiBase: string }) {
   const [conversationQueryHash, setConversationQueryHash] = useState<string | undefined>();
   const scrollContainerRef = useRef<HTMLDivElement>(null);
   const localeTag = LOCALES.find(l => l.code === locale)?.htmlLang;
+  // The proxy's own zone, so timestamps read the same as the server's logs rather than being
+  // silently shifted into the viewer's zone (#725). Fetched once: it cannot change while the
+  // page is open, so it must not join the 2s log poll. Undefined until it arrives, which
+  // formats browser-local exactly as before.
+  const [serverTimeZone, setServerTimeZone] = useState<string | undefined>();
+  useEffect(() => {
+    const controller = new AbortController();
+    void (async () => {
+      try {
+        const res = await fetch(`${apiBase}/api/settings`, { signal: controller.signal });
+        if (!res.ok) return;
+        const body = await res.json() as { timeZone?: unknown };
+        if (typeof body.timeZone === "string" && body.timeZone.trim()) {
+          setServerTimeZone(body.timeZone.trim());
+        }
+      } catch {
+        // Offline or an older proxy without the field: keep browser-local formatting.
+      }
+    })();
+    return () => controller.abort();
+  }, [apiBase]);
   // The hash is the source of truth for the active tab (#logs vs #logs/debug),
   // so refresh/bookmark/back-forward keep the tab choice.
   const [tab, setTab] = useState<LogsTab>(readTabFromHash);
@@ -628,7 +659,7 @@ export default function Logs({ apiBase }: { apiBase: string }) {
                  data-index={virtualRow.index}
                  ref={rowVirtualizer.measureElement}
                >
-                 <td className="muted mono">{formatLogTimestamp(log.timestamp, localeTag)}</td>
+                 <td className="muted mono">{formatLogTimestamp(log.timestamp, localeTag, serverTimeZone)}</td>
                   <td className="num mono log-col-tokens" title={tokensTitle(log, t)}>
                     {(() => {
                       const tokenTotal = displayContextTokenTotal(log);
@@ -715,6 +746,7 @@ export default function Logs({ apiBase }: { apiBase: string }) {
           detailInfo={detailInfo}
           localeCode={locale}
           localeTag={localeTag}
+          serverTimeZone={serverTimeZone}
           t={t}
           onClose={() => setDetail(null)}
           onFilterConversation={id => {
@@ -740,12 +772,13 @@ function useModalDialog(open: boolean) {
 }
 
 function LogDetailDialog({
-  detail, detailInfo, localeCode, localeTag, t, onClose, onFilterConversation,
+  detail, detailInfo, localeCode, localeTag, serverTimeZone, t, onClose, onFilterConversation,
 }: {
   detail: LogEntry;
   detailInfo: ReturnType<typeof statusCodeInfo> | null;
   localeCode: string;
   localeTag?: string;
+  serverTimeZone?: string;
   t: TFn;
   onClose: () => void;
   onFilterConversation?: (conversationId: string) => void;
@@ -787,7 +820,7 @@ function LogDetailDialog({
         <section className="log-detail-section" aria-labelledby="log-detail-basic">
           <h4 id="log-detail-basic" className="log-detail-section-title">{t("logs.detail.section.basic")}</h4>
           <div className="log-detail-grid">
-            <span className="muted">{t("logs.col.time")}</span><span className="mono">{formatLogDateTime(detail.timestamp, localeTag)}</span>
+            <span className="muted">{t("logs.col.time")}</span><span className="mono">{formatLogDateTime(detail.timestamp, localeTag, serverTimeZone)}</span>
             <span className="muted">{t("logs.col.request")}</span>
             <span className="log-detail-request-row">
               <span className="mono log-detail-break">{detail.requestId ?? "\u2014"}</span>

gui/src/pages/dashboard-shared.ts

@@ -44,6 +44,8 @@ export interface SettingsData {
   codexAutoStart: boolean;
   port: number;
   hostname: string;
+  /** IANA zone of the machine running the proxy, used to render log timestamps (#725). */
+  timeZone?: string;
   startupHealth?: {
     status: "native" | "protected" | "at-risk";
     routingKind: "native" | "opencodex-local" | "custom-local" | "custom-remote" | "unknown";

src/server/management/config-routes.ts

@@ -110,6 +110,11 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       );
     }
     return jsonResponse({
+      // The dashboard renders request-log timestamps. Without this it formats them in the
+      // BROWSER's zone, so a KST proxy viewed from a UTC browser reports every request nine
+      // hours off (#725). Carried on settings rather than /api/logs because that route's
+      // array response has four consumers that would have to change with it.
+      timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,
       codexAutoStart: codexAutoStartEnabled(config),
       port: config.port,
       hostname: config.hostname ?? "127.0.0.1",

tests/logs-timezone.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, test } from "bun:test";
+import { handleManagementAPI } from "../src/server/management-api";
+import { ManagementRequest as Request } from "./helpers/management-auth";
+import type { OcxConfig } from "../src/types";
+
+const config = { providers: [] } as unknown as OcxConfig;
+
+/**
+ * #725: the dashboard rendered request-log timestamps in the BROWSER's zone, so a proxy
+ * running in KST viewed from a UTC browser reported every request nine hours off.
+ *
+ * The zone rides on /api/settings rather than /api/logs. PR #790 put it in a
+ * `{timeZone, logs}` envelope on /api/logs, which would have broken four tests that read
+ * that response as an array (server-auth:1623, claude-native-passthrough:119,
+ * openai-provider-option-e2e:489, server-403-permission-e2e:86) without touching any of them.
+ */
+describe("log timestamp timezone (#725)", () => {
+  test("/api/settings reports the server's IANA zone", async () => {
+    const url = new URL("http://localhost/api/settings");
+    const response = await handleManagementAPI(new Request(url), url, config);
+    expect(response?.status).toBe(200);
+    const body = await response!.json() as { timeZone?: unknown };
+    expect(typeof body.timeZone).toBe("string");
+    // Must be a zone Intl accepts, not just any string: the GUI feeds it straight to
+    // toLocaleTimeString, where an unknown zone throws RangeError.
+    expect(() => new Intl.DateTimeFormat("en-US", { timeZone: body.timeZone as string })).not.toThrow();
+  });
+
+  test("/api/logs still returns a bare array", async () => {
+    // The contract four other suites depend on. If this ever becomes an object, those
+    // suites fail somewhere far from here, so assert it at the source.
+    const url = new URL("http://localhost/api/logs");
+    const response = await handleManagementAPI(new Request(url), url, config);
+    expect(response?.status).toBe(200);
+    expect(Array.isArray(await response!.json())).toBe(true);
+  });
+});
+
+/**
+ * The GUI-side formatters, mirrored here because Logs.tsx is not importable from a Bun test.
+ * The behavior under test is the timeZone argument being threaded through at all -- passing
+ * `undefined` reproduces the pre-fix rendering exactly.
+ */
+function formatLogTimestamp(ts: number, localeTag?: string, timeZone?: string): string {
+  try {
+    return new Date(ts).toLocaleTimeString(localeTag, timeZone ? { timeZone } : undefined);
+  } catch {
+    return new Date(ts).toLocaleTimeString(localeTag);
+  }
+}
+
+describe("timestamp formatting", () => {
+  // 2026-07-31T00:30:00Z -- deliberately across a date line for most zones, so a zone that
+  // is ignored shows up as a different hour rather than a subtle offset.
+  const ts = Date.parse("2026-07-31T00:30:00Z");
+
+  test("renders in the server zone, not the viewer's", () => {
+    const seoul = formatLogTimestamp(ts, "en-US", "Asia/Seoul");
+    const utc = formatLogTimestamp(ts, "en-US", "UTC");
+    // 00:30 UTC is 09:30 KST. If the argument were dropped both calls would agree, which is
+    // exactly the failure #790's own test could not catch -- it compared a value to itself.
+    expect(seoul).not.toBe(utc);
+    expect(seoul).toContain("9:30");
+    expect(utc).toContain("12:30");
+  });
+
+  test("falls back to browser-local for a zone the runtime does not know", () => {
+    // An ICU build without this zone throws RangeError, which would take the whole row
+    // render down. A wrong hour beats an empty log list.
+    expect(() => formatLogTimestamp(ts, "en-US", "Mars/Olympus_Mons")).not.toThrow();
+    expect(formatLogTimestamp(ts, "en-US", "Mars/Olympus_Mons"))
+      .toBe(formatLogTimestamp(ts, "en-US", undefined));
+  });
+
+  test("no zone keeps the previous behavior", () => {
+    expect(formatLogTimestamp(ts, "en-US", undefined)).toBe(new Date(ts).toLocaleTimeString("en-US"));
+  });
+});