Add logging module filters and cleanup logs

Expose module-filter management in the API and UI, and
reduce noisy internal logs to debug-level output.

Author: mcowger

docs/openapi/components/schemas/ModuleFilterState.yaml

@@ -0,0 +1,12 @@
+type: object
+properties:
+  modules:
+    type: array
+    description: >
+      List of module names to include in console output.  An empty array
+      means all modules are shown.
+    items:
+      type: string
+      example:
+        - dispatcher
+        - model-metadata-manager

docs/openapi/openapi.yaml

@@ -449,6 +449,8 @@ paths:
     $ref: paths/v0_management_metrics.yaml
   /v0/management/logging/level:
     $ref: paths/v0_management_logging_level.yaml
+  /v0/management/logging/modules:
+    $ref: paths/v0_management_logging_modules.yaml
   /v0/management/oauth/providers:
     $ref: paths/v0_management_oauth_providers.yaml
   /v0/management/oauth/sessions:

docs/openapi/paths/v0_management_logging_modules.yaml

@@ -0,0 +1,106 @@
+get:
+  tags:
+    - Management — Logging
+  summary: Get module filter (admin only)
+  description: |
+    Returns the current module filter — the set of module names whose
+    log entries are printed to the console.
+
+    When the list is empty (default), no filtering is applied and all
+    modules' logs are shown on the console.
+
+    ## Scope
+
+    This filter only affects the **console** transport.  The streaming
+    transport (used by the System Logs UI) and the StreamTransport used
+    for log streaming always receive all entries regardless of this
+    setting.
+
+    The filter can also be set at startup via the `LOG_MODULES` env var
+    (comma-separated list of module names, e.g.
+    `LOG_MODULES=dispatcher,model-metadata-manager`).
+
+    **Admin only** — limited principals receive 403.
+  security:
+    - AdminKey: []
+  responses:
+    '200':
+      description: Current module filter.
+      content:
+        application/json:
+          schema:
+            $ref: ../components/schemas/ModuleFilterState.yaml
+    '401':
+      description: Authentication required or invalid credentials.
+  operationId: getV0ManagementLoggingModules
+put:
+  tags:
+    - Management — Logging
+  summary: Set module filter (admin only)
+  description: |
+    Replaces the current module filter with the provided list.  Only
+    logs from the listed modules will appear in console output.
+
+    Set to an empty array to show all modules (disable filtering).
+
+    **Admin only** — limited principals receive 403.
+  security:
+    - AdminKey: []
+  requestBody:
+    required: true
+    content:
+      application/json:
+        schema:
+          type: object
+          properties:
+            modules:
+              type: array
+              items:
+                type: string
+              description: >
+                Module names to include.  Empty array = show all modules.
+              example:
+                - dispatcher
+                - model-metadata-manager
+          required:
+            - modules
+  responses:
+    '200':
+      description: Updated module filter.
+      content:
+        application/json:
+          schema:
+            $ref: ../components/schemas/ModuleFilterState.yaml
+    '400':
+      description: Invalid body.
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              error:
+                type: string
+    '401':
+      description: Authentication required or invalid credentials.
+  operationId: putV0ManagementLoggingModules
+delete:
+  tags:
+    - Management — Logging
+  summary: Clear module filter (admin only)
+  description: |
+    Clears the module filter so that all modules' logs appear in console
+    output again.
+
+    **Admin only** — limited principals receive 403.
+  security:
+    - AdminKey: []
+  responses:
+    '200':
+      description: Filter cleared (empty list).
+      content:
+        application/json:
+          schema:
+            $ref: ../components/schemas/ModuleFilterState.yaml
+    '401':
+      description: Authentication required or invalid credentials.
+  operationId: deleteV0ManagementLoggingModules

packages/backend/src/cli/migrate-quota-snapshots.ts

@@ -51,9 +51,9 @@ async function main() {
   const { inserted, skipped, totalSource } = await migrateLegacySnapshots();
 
   if (totalSource === 0) {
-    logger.info('Nothing to migrate.');
+    logger.debug('Nothing to migrate.');
   } else {
-    logger.info(`Migration complete. Inserted: ${inserted}, Skipped: ${skipped}`);
+    logger.debug(`Migration complete. Inserted: ${inserted}, Skipped: ${skipped}`);
   }
 }
 

packages/backend/src/cli/rekey.ts

@@ -125,7 +125,7 @@ async function main() {
       .where(eq(schema.apiKeys.id, row.id));
     totalReKeyed++;
   }
-  logger.info(`Re-keyed ${totalReKeyed} API key(s)`);
+  logger.warn(`Re-keyed ${totalReKeyed} API key(s)`);
 
   // ─── OAuth Credentials ──────────────────────────────────────────
   let oauthCount = 0;
@@ -146,7 +146,7 @@ async function main() {
       oauthCount++;
     }
   }
-  logger.info(`Re-keyed ${oauthCount} OAuth credential(s)`);
+  logger.warn(`Re-keyed ${oauthCount} OAuth credential(s)`);
 
   // ─── Providers ──────────────────────────────────────────────────
   let providerCount = 0;
@@ -171,7 +171,7 @@ async function main() {
       providerCount++;
     }
   }
-  logger.info(`Re-keyed ${providerCount} provider(s)`);
+  logger.warn(`Re-keyed ${providerCount} provider(s)`);
 
   // ─── MCP Servers ────────────────────────────────────────────────
   let mcpCount = 0;
@@ -188,9 +188,9 @@ async function main() {
       }
     }
   }
-  logger.info(`Re-keyed ${mcpCount} MCP server(s)`);
+  logger.warn(`Re-keyed ${mcpCount} MCP server(s)`);
 
-  logger.info(
+  logger.warn(
     `Re-key complete. Total: ${totalReKeyed + oauthCount + providerCount + mcpCount} record(s). ` +
       'Update your ENCRYPTION_KEY env var to the new key before restarting.'
   );

packages/backend/src/db/encrypt-migration.ts

@@ -24,7 +24,7 @@ export async function runEncryptionMigration(): Promise<void> {
     return;
   }
 
-  logger.info('Starting encryption migration for existing plaintext data...');
+  logger.debug('Starting encryption migration for existing plaintext data...');
 
   const db = getDatabase();
   const schema = getSchema();
@@ -45,7 +45,7 @@ export async function runEncryptionMigration(): Promise<void> {
         migratedCount++;
       }
     }
-    logger.info(`Encrypted ${migratedCount} API key(s)`);
+    logger.debug(`Encrypted ${migratedCount} API key(s)`);
   } catch (error) {
     logger.error('Failed to encrypt API keys:', error);
     throw error;
@@ -71,7 +71,7 @@ export async function runEncryptionMigration(): Promise<void> {
         oauthCount++;
       }
     }
-    logger.info(`Encrypted ${oauthCount} OAuth credential(s)`);
+    logger.debug(`Encrypted ${oauthCount} OAuth credential(s)`);
   } catch (error) {
     logger.error('Failed to encrypt OAuth credentials:', error);
     throw error;
@@ -108,7 +108,7 @@ export async function runEncryptionMigration(): Promise<void> {
         providerCount++;
       }
     }
-    logger.info(`Encrypted ${providerCount} provider(s)`);
+    logger.debug(`Encrypted ${providerCount} provider(s)`);
   } catch (error) {
     logger.error('Failed to encrypt providers:', error);
     throw error;
@@ -130,11 +130,11 @@ export async function runEncryptionMigration(): Promise<void> {
         }
       }
     }
-    logger.info(`Encrypted ${mcpCount} MCP server(s)`);
+    logger.debug(`Encrypted ${mcpCount} MCP server(s)`);
   } catch (error) {
     logger.error('Failed to encrypt MCP servers:', error);
     throw error;
   }
 
-  logger.info('Encryption migration completed successfully');
+  logger.debug('Encryption migration completed successfully');
 }

packages/backend/src/db/migrate.ts

@@ -60,7 +60,7 @@ async function buildMigrations(journal: Journal, devDir: string): Promise<Migrat
   );
 
   const sources = new Set(results.map((r) => r.meta.source));
-  logger.info(
+  logger.debug(
     `Loaded ${results.length} migrations from ${sources.size === 1 ? [...sources][0] : 'mixed'} source`
   );
 
@@ -246,7 +246,7 @@ export async function runMigrations() {
     const db = getDatabase();
     const dialect = getCurrentDialect();
 
-    logger.info(`Running ${dialect} migrations...`);
+    logger.debug(`Running ${dialect} migrations...`);
 
     if (dialect === 'sqlite') {
       // In dev/source mode, re-read the journal from disk so that migrations
@@ -325,7 +325,7 @@ export async function runMigrations() {
       }
     }
 
-    logger.info('Migrations completed successfully');
+    logger.debug('Migrations completed successfully');
   } catch (error: any) {
     logger.error('Migration failed', error);
     throw error;

packages/backend/src/index.ts

@@ -166,8 +166,8 @@ if (!process.env.DATABASE_URL) {
 }
 
 // Log startup configuration
-logger.info(`DATABASE_URL: ${process.env.DATABASE_URL}`);
-logger.info(`PORT: ${process.env.PORT || '4000'}`);
+logger.debug(`DATABASE_URL: ${process.env.DATABASE_URL}`);
+logger.debug(`PORT: ${process.env.PORT || '4000'}`);
 
 const fastify = Fastify({
   logger: false, // We use a custom winston-based logger
@@ -207,7 +207,7 @@ SelectorFactory.setUsageStorage(usageStorage);
 // Enable debug mode if DEBUG=true environment variable is set
 if (process.env.DEBUG === 'true') {
   DebugManager.getInstance().setEnabled(true);
-  logger.info('Debug mode auto-enabled via DEBUG=true environment variable');
+  logger.warn('Debug mode auto-enabled via DEBUG=true environment variable');
 }
 
 // --- Database Initialization ---
@@ -233,7 +233,7 @@ try {
   const configService = ConfigService.getInstance();
 
   if (await configService.isFirstLaunch()) {
-    logger.info('First launch detected — checking for existing config files to import');
+    logger.debug('First launch detected — checking for existing config files to import');
 
     // Import from plexus.yaml if it exists
     // Try CONFIG_FILE env var first, then check common locations
@@ -251,23 +251,23 @@ try {
       if (configPath && fs.existsSync(configPath)) {
         const yamlContent = fs.readFileSync(configPath, 'utf-8');
         await configService.importFromYaml(yamlContent);
-        logger.info(`Imported configuration from ${configPath} into database`);
+        logger.debug(`Imported configuration from ${configPath} into database`);
       } else {
-        logger.info('No plexus.yaml found — starting with empty configuration');
+        logger.debug('No plexus.yaml found — starting with empty configuration');
       }
 
       // Import from auth.json if it exists
       const authJsonPath = process.env.AUTH_JSON || './auth.json';
       if (fs.existsSync(authJsonPath)) {
         const authContent = fs.readFileSync(authJsonPath, 'utf-8');
         await configService.importFromAuthJson(authContent);
-        logger.info(`Imported OAuth credentials from ${authJsonPath} into database`);
+        logger.debug(`Imported OAuth credentials from ${authJsonPath} into database`);
       }
 
       // Mark bootstrap as complete so a future restart (even with an empty
       // providers table) does not re-import from the YAML file.
       await configService.getRepository().markBootstrapped();
-      logger.info('Bootstrap complete — marked database as bootstrapped');
+      logger.debug('Bootstrap complete — marked database as bootstrapped');
     } catch (importError) {
       logger.error(
         'Failed to import config — clearing partial data for clean retry on next launch',
@@ -279,7 +279,7 @@ try {
   }
 
   await configService.initialize();
-  logger.info('Configuration loaded from database');
+  logger.debug('Configuration loaded from database');
 
   // Eagerly initialize OAuth auth manager so auth.json schema migration
   // runs during startup (instead of waiting for first OAuth request).
@@ -322,7 +322,7 @@ try {
 let quotaEnforcer: QuotaEnforcer | undefined;
 try {
   quotaEnforcer = new QuotaEnforcer();
-  logger.info('User quota enforcer initialized');
+  logger.debug('User quota enforcer initialized');
 } catch (e) {
   logger.error('Failed to initialize user quota enforcer', e);
 }
@@ -438,7 +438,7 @@ const embeddedByName = new Map<string, EmbeddedFile>(
   (Bun.embeddedFiles as EmbeddedFile[]).map((f) => [f.name, f])
 );
 
-logger.info(`Serving frontend from: ${frontendDistDir}`);
+logger.debug(`Serving frontend from: ${frontendDistDir}`);
 
 const serveAsset = async (reply: FastifyReply, filePath: string, ext: string) => {
   const mimeType = mimeTypes[ext] ?? 'application/octet-stream';

packages/backend/src/middleware/log.ts

@@ -7,6 +7,6 @@ export const requestLogger = async (request: FastifyRequest, reply: FastifyReply
   if (method === 'GET' || method === 'POST') {
     logger.debug(`${method} ${path}`);
   } else {
-    logger.info(`${method} ${path}`);
+    logger.debug(`${method} ${path}`);
   }
 };

packages/backend/src/routes/management/_principal.ts

@@ -112,7 +112,7 @@ export async function resolvePrincipal(request: FastifyRequest): Promise<Princip
       comment: cfg.comment ?? null,
     };
   } catch (err) {
-    logger.silly(`[AUTH] api_keys lookup failed: ${(err as Error).message}`);
+    logger.silly(`api_keys lookup failed: ${(err as Error).message}`);
     return null;
   }
 }
@@ -124,7 +124,7 @@ export async function resolvePrincipal(request: FastifyRequest): Promise<Princip
 export async function authenticate(request: FastifyRequest, _reply: FastifyReply): Promise<void> {
   const principal = await resolvePrincipal(request);
   if (!principal) {
-    logger.silly(`[ADMIN AUTH] Rejected request to ${request.url} - invalid or missing credential`);
+    logger.silly(`Rejected request to ${request.url} - invalid or missing credential`);
     throw new ManagementAuthError(401, 'Unauthorized', 'auth_error');
   }
   request.principal = principal;