From 8a87c56e86adfc679880de24255d3d201ac91130 Mon Sep 17 00:00:00 2001
From: joshrmcdaniel <80354972+joshrmcdaniel@users.noreply.github.com>
Date: Sat, 30 May 2026 12:27:37 -0500
Subject: [PATCH 1/6] add css support, fix scriptlets

---
 privaxy/src/resources/procedural_cosmetics.js | 328 ++++++++++++++++++
 privaxy/src/server/blocker.rs                 |  26 +-
 privaxy/src/server/proxy/html_rewriter.rs     |  74 +++-
 privaxy/src/server/proxy/serve.rs             |  17 +-
 4 files changed, 423 insertions(+), 22 deletions(-)
 create mode 100644 privaxy/src/resources/procedural_cosmetics.js

diff --git a/privaxy/src/resources/procedural_cosmetics.js b/privaxy/src/resources/procedural_cosmetics.js
new file mode 100644
index 00000000..5be040f7
--- /dev/null
+++ b/privaxy/src/resources/procedural_cosmetics.js
@@ -0,0 +1,328 @@
+/*
+ * Privaxy in-page procedural cosmetic filtering shim.
+ *
+ * The proxy can apply plain-CSS cosmetic rules server-side by injecting a
+ * <style> block, but uBO/AdGuard procedural rules (:has-text, :matches-css,
+ * :upward, :xpath, :remove(), …) need to be evaluated against the live DOM.
+ * This shim receives those rules as JSON and applies them on load and on every
+ * subsequent DOM mutation.
+ *
+ * Rules are evaluated against the top document AND every reachable child-frame
+ * document. Same-origin frames built without a network fetch (`about:blank`,
+ * `srcdoc`, `data:`) never reach the proxy, so the only way to filter their
+ * contents is from the parent page — which we can do whenever the frame is
+ * same-origin (e.g. a `sandbox` that includes `allow-same-origin`). Cross-origin
+ * frames throw on document access and are silently skipped (those are filtered
+ * via their own proxied response instead).
+ *
+ * Each rule is a ProceduralOrActionFilter:
+ *   { "selector": [ { "type": "css-selector", "arg": "…" }, … ],
+ *     "action":   { "type": "style"|"remove"|"remove-attr"|"remove-class",
+ *                   "arg": "…" } }      // action is optional => hide
+ *
+ * Defined as an idempotent global so repeated injection on a page is harmless.
+ */
+window.__privaxyApplyProcedural = window.__privaxyApplyProcedural || (function () {
+    "use strict";
+
+    var REGEX_LITERAL = /^\/(.*)\/([a-z]*)$/;
+
+    // Build a string predicate from a uBO argument.
+    //   mode "substring" — plain text is a substring test (:has-text, path)
+    //   mode "wildcard"  — plain text supports `*` wildcards, full match
+    // A `/pattern/flags` argument is always treated as a regular expression.
+    function makeMatcher(arg, mode) {
+        var m = REGEX_LITERAL.exec(arg);
+        if (m !== null) {
+            var re = new RegExp(m[1], m[2]);
+            return function (value) {
+                return re.test(value);
+            };
+        }
+        if (mode === "wildcard") {
+            var escaped = arg.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+            var wild = new RegExp("^" + escaped + "$");
+            return function (value) {
+                return wild.test(value);
+            };
+        }
+        return function (value) {
+            return value.indexOf(arg) !== -1;
+        };
+    }
+
+    function uniqueElements(nodes) {
+        var seen = new Set();
+        var out = [];
+        for (var i = 0; i < nodes.length; i++) {
+            var node = nodes[i];
+            if (node && node.nodeType === 1 && !seen.has(node)) {
+                seen.add(node);
+                out.push(node);
+            }
+        }
+        return out;
+    }
+
+    function matchesCss(scope, node, arg, pseudo) {
+        var sep = arg.indexOf(":");
+        if (sep === -1) {
+            return false;
+        }
+        var prop = arg.slice(0, sep).trim();
+        var matcher = makeMatcher(arg.slice(sep + 1).trim(), "wildcard");
+        var style = scope.win.getComputedStyle(node, pseudo || null);
+        return matcher(style.getPropertyValue(prop).trim());
+    }
+
+    function matchesAttr(node, arg) {
+        var sep = arg.indexOf("=");
+        var nameArg = sep === -1 ? arg : arg.slice(0, sep);
+        var nameMatcher = makeMatcher(nameArg.trim(), "wildcard");
+        var valueMatcher = null;
+        if (sep !== -1) {
+            var rawValue = arg.slice(sep + 1).trim().replace(/^["']|["']$/g, "");
+            valueMatcher = makeMatcher(rawValue, "wildcard");
+        }
+        var attrs = node.attributes;
+        for (var i = 0; i < attrs.length; i++) {
+            if (nameMatcher(attrs[i].name)) {
+                if (valueMatcher === null || valueMatcher(attrs[i].value)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
+    function climbUpward(node, arg) {
+        var steps = parseInt(arg, 10);
+        if (String(steps) === arg.trim()) {
+            var current = node;
+            while (steps-- > 0 && current !== null) {
+                current = current.parentElement;
+            }
+            return current;
+        }
+        return node.parentElement !== null ? node.parentElement.closest(arg) : null;
+    }
+
+    function evaluateXpath(scope, contextNode, arg) {
+        var result = scope.doc.evaluate(
+            arg,
+            contextNode,
+            null,
+            XPathResult.ORDERED_NODE_SNAPSHOT_TYPE,
+            null
+        );
+        var out = [];
+        for (var i = 0; i < result.snapshotLength; i++) {
+            out.push(result.snapshotItem(i));
+        }
+        return out;
+    }
+
+    // Apply one operator to the running node set within `scope` (a {doc, win}
+    // pair). `nodes` is null until the first selector seeds it from the document.
+    function applyOperator(scope, nodes, op) {
+        var arg = op.arg;
+        switch (op.type) {
+            case "css-selector":
+                if (nodes === null) {
+                    return Array.prototype.slice.call(scope.doc.querySelectorAll(arg));
+                }
+                return nodes.reduce(function (acc, node) {
+                    return acc.concat(Array.prototype.slice.call(node.querySelectorAll(arg)));
+                }, []);
+            case "has-text": {
+                var textMatcher = makeMatcher(arg, "substring");
+                return (nodes || []).filter(function (node) {
+                    return textMatcher(node.textContent || "");
+                });
+            }
+            case "min-text-length": {
+                var minLength = parseInt(arg, 10);
+                return (nodes || []).filter(function (node) {
+                    return (node.textContent || "").length >= minLength;
+                });
+            }
+            case "matches-path": {
+                var pathMatcher = makeMatcher(arg, "substring");
+                var path = scope.win.location.pathname + scope.win.location.search;
+                return pathMatcher(path) ? (nodes || []) : [];
+            }
+            case "matches-css":
+                return (nodes || []).filter(function (node) {
+                    return matchesCss(scope, node, arg, null);
+                });
+            case "matches-css-before":
+                return (nodes || []).filter(function (node) {
+                    return matchesCss(scope, node, arg, "::before");
+                });
+            case "matches-css-after":
+                return (nodes || []).filter(function (node) {
+                    return matchesCss(scope, node, arg, "::after");
+                });
+            case "matches-attr":
+                return (nodes || []).filter(function (node) {
+                    return matchesAttr(node, arg);
+                });
+            case "upward":
+                return uniqueElements((nodes || []).map(function (node) {
+                    return climbUpward(node, arg);
+                }));
+            case "xpath":
+                if (nodes === null) {
+                    return evaluateXpath(scope, scope.doc, arg);
+                }
+                return uniqueElements((nodes || []).reduce(function (acc, node) {
+                    return acc.concat(evaluateXpath(scope, node, arg));
+                }, []));
+            default:
+                return nodes || [];
+        }
+    }
+
+    function selectNodes(scope, selector) {
+        var nodes = null;
+        for (var i = 0; i < selector.length; i++) {
+            nodes = applyOperator(scope, nodes, selector[i]);
+            if (nodes !== null && nodes.length === 0) {
+                return [];
+            }
+        }
+        return uniqueElements(nodes || []);
+    }
+
+    function applyStyle(node, declarations) {
+        declarations.split(";").forEach(function (declaration) {
+            var sep = declaration.indexOf(":");
+            if (sep === -1) {
+                return;
+            }
+            var prop = declaration.slice(0, sep).trim();
+            var value = declaration.slice(sep + 1).trim();
+            var priority = "";
+            if (/!important$/.test(value)) {
+                value = value.replace(/!important$/, "").trim();
+                priority = "important";
+            }
+            if (prop !== "") {
+                node.style.setProperty(prop, value, priority);
+            }
+        });
+    }
+
+    function applyAction(node, action) {
+        if (!action) {
+            node.style.setProperty("display", "none", "important");
+            return;
+        }
+        switch (action.type) {
+            case "style":
+                applyStyle(node, action.arg);
+                break;
+            case "remove":
+                node.remove();
+                break;
+            case "remove-attr":
+                node.removeAttribute(action.arg);
+                break;
+            case "remove-class":
+                node.classList.remove(action.arg);
+                break;
+        }
+    }
+
+    return function (filters) {
+        if (!Array.isArray(filters) || filters.length === 0) {
+            return;
+        }
+
+        var scheduled = false;
+        var observedDocs = new WeakSet();
+
+        // Walk this window and every reachable same-origin descendant frame,
+        // returning a {doc, win} scope for each. Cross-origin frames throw on
+        // document access and are skipped.
+        function collectScopes() {
+            var scopes = [];
+            var seenDocs = new Set();
+            (function visit(win) {
+                var doc;
+                try {
+                    doc = win.document;
+                } catch (err) {
+                    return;
+                }
+                if (!doc || seenDocs.has(doc)) {
+                    return;
+                }
+                seenDocs.add(doc);
+                scopes.push({ doc: doc, win: win });
+                var frames = doc.querySelectorAll("iframe, frame");
+                for (var i = 0; i < frames.length; i++) {
+                    var childWin = null;
+                    try {
+                        childWin = frames[i].contentWindow;
+                    } catch (err) {
+                        childWin = null;
+                    }
+                    if (childWin) {
+                        visit(childWin);
+                    }
+                }
+            })(window);
+            return scopes;
+        }
+
+        // Ads are often written into a frame *after* it's created, and a
+        // parent's observer doesn't see mutations inside a child document, so
+        // each reachable frame document gets its own observer (once).
+        function ensureObserved(doc) {
+            if (observedDocs.has(doc)) {
+                return;
+            }
+            observedDocs.add(doc);
+            var observer = new MutationObserver(schedule);
+            observer.observe(doc.documentElement || doc, { childList: true, subtree: true });
+        }
+
+        function apply() {
+            scheduled = false;
+            var scopes = collectScopes();
+            for (var s = 0; s < scopes.length; s++) {
+                var scope = scopes[s];
+                ensureObserved(scope.doc);
+                for (var i = 0; i < filters.length; i++) {
+                    // A single malformed rule (or a frame torn down mid-pass)
+                    // must not break the rest; throwing is part of normal
+                    // operation here.
+                    try {
+                        var nodes = selectNodes(scope, filters[i].selector);
+                        for (var j = 0; j < nodes.length; j++) {
+                            applyAction(nodes[j], filters[i].action);
+                        }
+                    } catch (err) {
+                        /* ignore this rule and continue */
+                    }
+                }
+            }
+        }
+
+        // Observers only feed `childList` mutations, so our hide/style/attr
+        // edits don't loop; a `:remove()` converges in one extra debounced pass.
+        function schedule() {
+            if (scheduled) {
+                return;
+            }
+            scheduled = true;
+            window.requestAnimationFrame(apply);
+        }
+
+        schedule();
+        if (document.readyState === "loading") {
+            document.addEventListener("DOMContentLoaded", schedule);
+        }
+    };
+})();
diff --git a/privaxy/src/server/blocker.rs b/privaxy/src/server/blocker.rs
index f8a4c568..72f841e7 100644
--- a/privaxy/src/server/blocker.rs
+++ b/privaxy/src/server/blocker.rs
@@ -62,6 +62,11 @@ pub struct CosmeticBlockerResult {
     pub hidden_selectors: Vec<String>,
     pub style_selectors: HashMap<String, Vec<String>>,
     pub injected_script: Option<String>,
+    /// JSON-encoded `ProceduralOrActionFilter` records that cannot be reduced to
+    /// plain CSS (`:has-text`, `:matches-css`, `:upward`, `:xpath`, `:remove()`,
+    /// …). These are handed to the in-page procedural shim, which evaluates them
+    /// against the live DOM. Empty for the vast majority of hosts.
+    pub procedural_filters: Vec<String>,
 }
 
 pub struct BlockerRequest {
@@ -135,6 +140,7 @@ impl Blocker {
                                 hidden_selectors: Vec::new(),
                                 style_selectors: HashMap::new(),
                                 injected_script: None,
+                                procedural_filters: Vec::new(),
                             },
                         ));
                         continue;
@@ -165,20 +171,25 @@ impl Blocker {
 
                     // adblock 0.12 replaced UrlSpecificResources::style_selectors
                     // with `procedural_actions`, a HashSet of JSON-encoded
-                    // ProceduralOrActionFilter records. Re-derive the
-                    // (selector -> style) map from the ones that reduce to
-                    // pure CSS via `as_css()`; non-CSS procedural filters
-                    // (those needing in-page JS to apply) are dropped — the
-                    // proxy can't run JS-driven procedural matching.
+                    // ProceduralOrActionFilter records. Records that reduce to
+                    // pure CSS via `as_css()` are applied server-side as a
+                    // (selector -> style) map. The rest need in-page JS to
+                    // evaluate (`:has-text`, `:matches-css`, `:upward`, `:xpath`,
+                    // `:remove()`, …); their raw JSON is forwarded to the
+                    // procedural shim injected into the page.
                     let mut style_selectors: HashMap<String, Vec<String>> = HashMap::new();
+                    let mut procedural_filters: Vec<String> = Vec::new();
                     for raw in url_specific_resources.procedural_actions.iter() {
                         let Ok(filter) = serde_json::from_str::<
                             adblock::cosmetic_filter_cache::ProceduralOrActionFilter,
                         >(raw) else {
                             continue;
                         };
-                        if let Some((selector, style)) = filter.as_css() {
-                            style_selectors.entry(selector).or_default().push(style);
+                        match filter.as_css() {
+                            Some((selector, style)) => {
+                                style_selectors.entry(selector).or_default().push(style);
+                            }
+                            None => procedural_filters.push(raw.clone()),
                         }
                     }
 
@@ -189,6 +200,7 @@ impl Blocker {
                                 hidden_selectors,
                                 style_selectors,
                                 injected_script,
+                                procedural_filters,
                             }));
                 }
                 RequestKind::Url(network_url) => {
diff --git a/privaxy/src/server/proxy/html_rewriter.rs b/privaxy/src/server/proxy/html_rewriter.rs
index fbce9255..0cf7e0db 100644
--- a/privaxy/src/server/proxy/html_rewriter.rs
+++ b/privaxy/src/server/proxy/html_rewriter.rs
@@ -31,8 +31,18 @@ pub struct Rewriter {
     // reference to the globals they hook (setTimeout, eval, etc.), so this is
     // injected early into `<head>` rather than appended at end-of-body.
     injected_script: Option<String>,
+    // Procedural cosmetic filters (`:has-text`, `:upward`, `:xpath`, …) that
+    // can't be reduced to plain CSS. Each entry is one JSON-encoded
+    // `ProceduralOrActionFilter`; they're handed to the in-page shim injected
+    // into `<head>` alongside the scriptlets.
+    procedural_filters: Vec<String>,
 }
 
+/// In-page evaluator for procedural cosmetic filters. Defines the idempotent
+/// `window.__privaxyApplyProcedural(filters)` global; see the source file for
+/// the supported operators and actions.
+const PROCEDURAL_COSMETICS_SHIM: &str = include_str!("../../resources/procedural_cosmetics.js");
+
 impl Rewriter {
     pub(crate) fn new(
         url: String,
@@ -42,6 +52,7 @@ impl Rewriter {
         statistics: Statistics,
         csp_nonce: String,
         injected_script: Option<String>,
+        procedural_filters: Vec<String>,
     ) -> Self {
         Self {
             url,
@@ -52,7 +63,51 @@ impl Rewriter {
             internal_body_channel: mpsc::unbounded_channel(),
             csp_nonce,
             injected_script,
+            procedural_filters,
+        }
+    }
+
+    /// Combine the uBO scriptlet payload and the procedural-filter shim into a
+    /// single `<head>` script body, or `None` when there's nothing to inject.
+    /// Scriptlets come first so they hook globals before page scripts run; the
+    /// procedural shim follows and sets up its own DOM observer.
+    fn build_head_script(
+        injected_script: Option<String>,
+        procedural_filters: &[String],
+    ) -> Option<String> {
+        if injected_script.is_none() && procedural_filters.is_empty() {
+            return None;
+        }
+
+        let mut payload = String::new();
+
+        if let Some(script) = injected_script {
+            // adblock-rust emits scriptlet bodies that reference an ambient
+            // `scriptletGlobals` object — uBO supplies it in its own injection
+            // wrapper, but adblock-rust leaves that to the embedder. Without it
+            // every scriptlet hits `ReferenceError: scriptletGlobals is not
+            // defined` on its first `safeSelf()`/`shouldDebug()` call, which the
+            // scriptlet's own `try { … } catch {}` swallows — so all scriptlets
+            // silently no-op. Defining it once at the top of the payload (the
+            // scriptlet bodies use dot-access, so it must be an object)
+            // so the scriptlets actually work.
+            payload.push_str("const scriptletGlobals = {};\n");
+            payload.push_str(&script);
+        }
+
+        if !procedural_filters.is_empty() {
+            if !payload.is_empty() {
+                payload.push('\n');
+            }
+            payload.push_str(PROCEDURAL_COSMETICS_SHIM);
+            // Each filter is already valid JSON, so they're spliced straight
+            // into an array literal without re-serialization.
+            payload.push_str(";window.__privaxyApplyProcedural([");
+            payload.push_str(&procedural_filters.join(","));
+            payload.push_str("]);");
         }
+
+        Some(payload)
     }
 
     pub(crate) fn rewrite(self) {
@@ -82,7 +137,10 @@ impl Rewriter {
 
         // Mutex<Option<_>> + take() = inject at most once even if the document
         // somehow contains multiple <head> openings.
-        let pending_script = Arc::new(Mutex::new(self.injected_script));
+        let pending_script = Arc::new(Mutex::new(Self::build_head_script(
+            self.injected_script,
+            &self.procedural_filters,
+        )));
         let head_csp_nonce = csp_nonce.clone();
         let head_statistics = statistics.clone();
 
@@ -186,8 +244,6 @@ impl Rewriter {
                 break;
             }
             if let Some(adblock_properties) = adblock_properties {
-                let mut response_has_been_modified = false;
-
                 let blocker_result = adblock_requester
                     .get_cosmetic_response(
                         adblock_properties.url,
@@ -205,12 +261,16 @@ impl Rewriter {
                 let style_selectors: String = blocker_result
                     .style_selectors
                     .into_iter()
-                    .map(|(selector, content)| {
-                        response_has_been_modified = true;
-                        format!("{} {{ {} }}", selector, content.join(";"))
-                    })
+                    .map(|(selector, content)| format!("{} {{ {} }}", selector, content.join(";")))
                     .collect();
 
+                // Count the response as modified whenever we inject any cosmetic
+                // rules — hide selectors as well as style selectors. Previously
+                // only style selectors flipped this flag, so pages where we hid
+                // ad elements via `display: none` were undercounted.
+                let response_has_been_modified =
+                    !hidden_selectors.is_empty() || !style_selectors.is_empty();
+
                 // Scriptlets (`blocker_result.injected_script`) are intentionally
                 // ignored here: they're injected into <head> from the rewriter
                 // path so they run before the page's own scripts.
diff --git a/privaxy/src/server/proxy/serve.rs b/privaxy/src/server/proxy/serve.rs
index 9ef08f71..0217f282 100644
--- a/privaxy/src/server/proxy/serve.rs
+++ b/privaxy/src/server/proxy/serve.rs
@@ -451,14 +451,14 @@ pub(crate) async fn serve(
     if is_html {
         let (sender_rewriter, receiver_rewriter) = crossbeam_channel::unbounded::<Bytes>();
 
-        // Resolve the URL-scoped scriptlet payload up-front so the rewriter can
-        // prepend it inside <head> before any page scripts execute. The
-        // end-of-body cosmetic lookup still runs for hide/style selectors,
-        // which depend on collected IDs/classes.
-        let injected_script = adblock_requester
+        // Resolve the URL-scoped payloads up-front so the rewriter can prepend
+        // them inside <head> before any page scripts execute: the uBO scriptlet
+        // and the procedural cosmetic filters (both URL-specific, not dependent
+        // on collected IDs/classes). The end-of-body cosmetic lookup still runs
+        // for hide/style selectors, which do depend on collected IDs/classes.
+        let head_cosmetics = adblock_requester
             .get_cosmetic_response(match_url.clone(), Vec::new(), Vec::new())
-            .await
-            .injected_script;
+            .await;
 
         let rewriter = Rewriter::new(
             match_url.clone(),
@@ -467,7 +467,8 @@ pub(crate) async fn serve(
             sender,
             statistics,
             csp_nonce.expect("csp_nonce is Some whenever is_html"),
-            injected_script,
+            head_cosmetics.injected_script,
+            head_cosmetics.procedural_filters,
         );
 
         tokio::task::spawn_blocking(|| rewriter.rewrite());

From 0c5adfc4a33318bc87396bc2141c7e9ab3b71125 Mon Sep 17 00:00:00 2001
From: joshrmcdaniel <80354972+joshrmcdaniel@users.noreply.github.com>
Date: Sat, 30 May 2026 12:47:48 -0500
Subject: [PATCH 2/6] debug setting entry

---
 privaxy/src/server/configuration/mod.rs    | 38 ++++++++++++++++++++--
 privaxy/src/server/lib.rs                  |  4 +++
 privaxy/src/server/proxy/html_rewriter.rs  | 19 ++++++++++-
 privaxy/src/server/proxy/mitm.rs           |  3 ++
 privaxy/src/server/proxy/serve.rs          |  2 ++
 privaxy/src/server/web_gui/settings/mod.rs |  8 +++++
 web_frontend/src/main.rs                   |  1 +
 web_frontend/src/settings.rs               |  9 +++++
 8 files changed, 81 insertions(+), 3 deletions(-)

diff --git a/privaxy/src/server/configuration/mod.rs b/privaxy/src/server/configuration/mod.rs
index 34020032..eec0b272 100644
--- a/privaxy/src/server/configuration/mod.rs
+++ b/privaxy/src/server/configuration/mod.rs
@@ -34,6 +34,8 @@ pub enum ConfigurationError {
     CaError(#[from] CaError),
     #[error("an error occured while trying to deserialize configuration file")]
     DeserializeError(#[from] toml::de::Error),
+    #[error("an error occured while trying to serialize configuration")]
+    SerializeError(#[from] toml::ser::Error),
     #[error("this directory was not found")]
     DirectoryNotFound,
     #[error("file system error")]
@@ -59,6 +61,20 @@ pub struct Configuration {
     pub filters: Vec<Filter>,
     #[serde(default)]
     pub auth: Auth,
+    #[serde(default)]
+    pub debug: DebugConfig,
+}
+
+/// Opt-in diagnostics. Off by default — these add visible/observable behavior to
+/// proxied pages, so they should only be enabled while troubleshooting.
+#[derive(Debug, Clone, Default, Deserialize, Serialize, PartialEq, Eq)]
+pub struct DebugConfig {
+    /// Surface errors thrown by injected uBO scriptlets to the page console
+    /// (`console.error('[privaxy scriptlet]', e)`) instead of swallowing them.
+    /// Useful for spotting a silently-failing scriptlet; noisy and reveals
+    /// Privaxy is in the path, so default off.
+    #[serde(default)]
+    pub scriptlet_console_logging: bool,
 }
 
 #[derive(Error, Debug)]
@@ -130,9 +146,26 @@ impl Configuration {
     pub async fn save(&self) -> ConfigurationResult<()> {
         let configuration_file_path = get_config_file();
 
-        let configuration_serialized = toml::to_string_pretty(&self).unwrap();
+        let configuration_serialized = toml::to_string_pretty(&self)?;
 
-        fs::write(configuration_file_path, configuration_serialized).await?;
+        // Write to a temporary file in the same directory, then atomically
+        // rename it over the target. This guarantees the live config is never
+        // observed in a half-written state: readers see either the old file or
+        // the fully-written new one, even if the process crashes mid-write.
+        let temp_file_path = get_base_directory()?.join(format!(
+            "{CONFIGURATION_FILE_NAME}.{}.tmp",
+            generate_random_hex(8)
+        ));
+
+        if let Err(err) = fs::write(&temp_file_path, configuration_serialized).await {
+            let _ = fs::remove_file(&temp_file_path).await;
+            return Err(ConfigurationError::FileSystemError(err));
+        }
+
+        if let Err(err) = fs::rename(&temp_file_path, &configuration_file_path).await {
+            let _ = fs::remove_file(&temp_file_path).await;
+            return Err(ConfigurationError::FileSystemError(err));
+        }
 
         Ok(())
     }
@@ -312,6 +345,7 @@ impl Configuration {
             ),
             custom_filters: Vec::new(),
             auth: Auth::new_initialized(),
+            debug: DebugConfig::default(),
         })
     }
 }
diff --git a/privaxy/src/server/lib.rs b/privaxy/src/server/lib.rs
index e35ea5d3..3216e77b 100644
--- a/privaxy/src/server/lib.rs
+++ b/privaxy/src/server/lib.rs
@@ -358,6 +358,9 @@ async fn privaxy_backend(
     let config = read_configuration(&configuration_save_lock).await;
     let network_config = &config.network;
     let doh_config = network_config.doh.clone();
+    // Read once per (re)start; the backend loop re-runs this on reload, so
+    // toggling the setting in the UI takes effect after its notify_reload.
+    let scriptlet_debug_logging = config.debug.scriptlet_console_logging;
 
     // The hyper client is only used to perform upgrades. We don't need to
     // handle compression.
@@ -390,6 +393,7 @@ async fn privaxy_backend(
                     client_ip_address,
                     local_exclusion_store.clone(),
                     doh_config.clone(),
+                    scriptlet_debug_logging,
                 )
             }))
         }
diff --git a/privaxy/src/server/proxy/html_rewriter.rs b/privaxy/src/server/proxy/html_rewriter.rs
index 0cf7e0db..70b33f24 100644
--- a/privaxy/src/server/proxy/html_rewriter.rs
+++ b/privaxy/src/server/proxy/html_rewriter.rs
@@ -36,6 +36,10 @@ pub struct Rewriter {
     // `ProceduralOrActionFilter`; they're handed to the in-page shim injected
     // into `<head>` alongside the scriptlets.
     procedural_filters: Vec<String>,
+    // When set (config `debug.scriptlet_console_logging`), the empty
+    // per-scriptlet `catch` emitted by adblock-rust is rewritten to log the
+    // caught error to the page console instead of swallowing it.
+    scriptlet_debug_logging: bool,
 }
 
 /// In-page evaluator for procedural cosmetic filters. Defines the idempotent
@@ -53,6 +57,7 @@ impl Rewriter {
         csp_nonce: String,
         injected_script: Option<String>,
         procedural_filters: Vec<String>,
+        scriptlet_debug_logging: bool,
     ) -> Self {
         Self {
             url,
@@ -64,6 +69,7 @@ impl Rewriter {
             csp_nonce,
             injected_script,
             procedural_filters,
+            scriptlet_debug_logging,
         }
     }
 
@@ -74,6 +80,7 @@ impl Rewriter {
     fn build_head_script(
         injected_script: Option<String>,
         procedural_filters: &[String],
+        scriptlet_debug_logging: bool,
     ) -> Option<String> {
         if injected_script.is_none() && procedural_filters.is_empty() {
             return None;
@@ -81,7 +88,16 @@ impl Rewriter {
 
         let mut payload = String::new();
 
-        if let Some(script) = injected_script {
+        if let Some(mut script) = injected_script {
+            // adblock-rust isolates each scriptlet in an empty `catch ( e ) { }`.
+            // When debugging is enabled, surface what was caught rather than
+            // swallowing it (this is what hid the missing `scriptletGlobals`).
+            if scriptlet_debug_logging {
+                script = script.replace(
+                    "} catch ( e ) { }",
+                    "} catch (e) { console.error('[privaxy scriptlet]', e); }",
+                );
+            }
             // adblock-rust emits scriptlet bodies that reference an ambient
             // `scriptletGlobals` object — uBO supplies it in its own injection
             // wrapper, but adblock-rust leaves that to the embedder. Without it
@@ -140,6 +156,7 @@ impl Rewriter {
         let pending_script = Arc::new(Mutex::new(Self::build_head_script(
             self.injected_script,
             &self.procedural_filters,
+            self.scriptlet_debug_logging,
         )));
         let head_csp_nonce = csp_nonce.clone();
         let head_statistics = statistics.clone();
diff --git a/privaxy/src/server/proxy/mitm.rs b/privaxy/src/server/proxy/mitm.rs
index da9e12cd..72141b66 100644
--- a/privaxy/src/server/proxy/mitm.rs
+++ b/privaxy/src/server/proxy/mitm.rs
@@ -25,6 +25,7 @@ pub(crate) async fn serve_mitm_session(
     client_ip_address: IpAddr,
     local_exclusion_store: LocalExclusionStore,
     doh_config: DohConfig,
+    scriptlet_debug_logging: bool,
 ) -> Result<Response<Body>, hyper::Error> {
     let authority = match req.uri().authority().cloned() {
         Some(authority) => authority,
@@ -84,6 +85,7 @@ pub(crate) async fn serve_mitm_session(
                                             statistics.clone(),
                                             client_ip_address,
                                             doh_config.clone(),
+                                            scriptlet_debug_logging,
                                         )
                                     }),
                                 )
@@ -120,6 +122,7 @@ pub(crate) async fn serve_mitm_session(
             statistics,
             client_ip_address,
             doh_config,
+            scriptlet_debug_logging,
         )
         .await
     }
diff --git a/privaxy/src/server/proxy/serve.rs b/privaxy/src/server/proxy/serve.rs
index 0217f282..9f50ff2c 100644
--- a/privaxy/src/server/proxy/serve.rs
+++ b/privaxy/src/server/proxy/serve.rs
@@ -257,6 +257,7 @@ pub(crate) async fn serve(
     statistics: Statistics,
     client_ip_address: IpAddr,
     doh_config: DohConfig,
+    scriptlet_debug_logging: bool,
 ) -> Result<Response<Body>, hyper::Error> {
     let scheme_string = scheme.to_string();
 
@@ -469,6 +470,7 @@ pub(crate) async fn serve(
             csp_nonce.expect("csp_nonce is Some whenever is_html"),
             head_cosmetics.injected_script,
             head_cosmetics.procedural_filters,
+            scriptlet_debug_logging,
         );
 
         tokio::task::spawn_blocking(|| rewriter.rewrite());
diff --git a/privaxy/src/server/web_gui/settings/mod.rs b/privaxy/src/server/web_gui/settings/mod.rs
index 2b57a1e0..06b5e50f 100644
--- a/privaxy/src/server/web_gui/settings/mod.rs
+++ b/privaxy/src/server/web_gui/settings/mod.rs
@@ -7,6 +7,7 @@ use warp::filters::BoxedFilter;
 use warp::Filter as RouteFilter;
 
 mod ca_certificate;
+mod debug;
 mod network;
 mod pac;
 
@@ -33,8 +34,15 @@ pub(crate) fn create_routes(
         notify_reload.clone(),
     ));
 
+    let debug_settings_route = warp::path("debug").and(debug::create_routes(
+        configuration_updater_sender.clone(),
+        configuration_save_lock.clone(),
+        notify_reload.clone(),
+    ));
+
     network_settings_route
         .or(ca_cert_route)
         .or(pac_settings_route)
+        .or(debug_settings_route)
         .boxed()
 }
diff --git a/web_frontend/src/main.rs b/web_frontend/src/main.rs
index 6581e5b1..d6c8bc3b 100644
--- a/web_frontend/src/main.rs
+++ b/web_frontend/src/main.rs
@@ -10,6 +10,7 @@ mod auth;
 mod blocking_enabled;
 mod button;
 mod dashboard;
+mod debug;
 mod filterlists;
 mod filters;
 mod general;
diff --git a/web_frontend/src/settings.rs b/web_frontend/src/settings.rs
index ba6e8df2..acb22aa0 100644
--- a/web_frontend/src/settings.rs
+++ b/web_frontend/src/settings.rs
@@ -1,4 +1,5 @@
 use crate::account::AccountSettings;
+use crate::debug::DebugSettingsPage;
 use crate::filters::Filters;
 use crate::general::GeneralSettings;
 use crate::pac::PacSettingsPage;
@@ -22,6 +23,8 @@ pub enum SettingsRoute {
     Pac,
     #[at("/settings/account")]
     Account,
+    #[at("/settings/debug")]
+    Debug,
 }
 
 pub fn switch_settings(route: &SettingsRoute) -> Html {
@@ -111,6 +114,11 @@ pub fn switch_settings(route: &SettingsRoute) -> Html {
 
             html! { <AccountSettings /> }
         }
+        SettingsRoute::Debug => {
+            set_title("Settings - Debug");
+
+            html! { <DebugSettingsPage /> }
+        }
     };
 
     html! {<div class="md:grid md:grid-cols-8">
@@ -121,6 +129,7 @@ pub fn switch_settings(route: &SettingsRoute) -> Html {
         <Link<SettingsRoute> classes={get_classes(*route, SettingsRoute::CustomFilters)} to={SettingsRoute::CustomFilters}> <span class="truncate">{ "Custom filters" }</span></Link<SettingsRoute>>
         <Link<SettingsRoute> classes={get_classes(*route, SettingsRoute::Pac)} to={SettingsRoute::Pac}> <span class="truncate">{ "PAC" }</span></Link<SettingsRoute>>
         <Link<SettingsRoute> classes={get_classes(*route, SettingsRoute::Account)} to={SettingsRoute::Account}> <span class="truncate">{ "Account" }</span></Link<SettingsRoute>>
+        <Link<SettingsRoute> classes={get_classes(*route, SettingsRoute::Debug)} to={SettingsRoute::Debug}> <span class="truncate">{ "Debug" }</span></Link<SettingsRoute>>
     </nav>
         <div class="container mx-auto px-4 sm:px-6 lg:px-8 mt-4 sm:col-span-6">{ content }</div>
     </div>

From dcf32bbd292a23217fcb92cd833d010ebbb8e77c Mon Sep 17 00:00:00 2001
From: joshrmcdaniel <80354972+joshrmcdaniel@users.noreply.github.com>
Date: Sat, 30 May 2026 12:48:17 -0500
Subject: [PATCH 3/6] changelog

---
 CHANGELOG.md | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4543150a..2d0dca1d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
 # Changelog
 
-## 0.7.0-0.7.1
+## v0.7.1
 
 - Validate filter lists when added
   - Adding a filter now rejects URLs that do not serve a `text/plain` filter list (e.g. an HTML error/landing page returned with a `200`) with a `422`, instead of silently saving a broken filter. The error is surfaced in the web UI, and filters whose URL stops serving a list are dropped from the engine with a warning on the next refresh.
@@ -15,6 +15,18 @@
 - All four engine-matching call sites now use match_url (canonical, default port stripped); the outbound request and stats still use the raw uri with its port, so nothing about proxying changes. This was silently breaking every hostname-anchored (||host/path) network rule on every HTTPS site
 - Update ublock annoyances url
 - Add support for MIPS, MIPSLE
+- Injected uBlock scriptlets now actually run
+  - Even after the 0.7.0 scriptlet repair, every injected `##+js(...)` scriptlet was a silent no-op. adblock-rust emits scriptlet bodies that reference an ambient `scriptletGlobals` object (uBlock Origin supplies it in its own injector; adblock-rust leaves it to the embedder), so the first internal call threw `ReferenceError: scriptletGlobals is not defined`, which each scriptlet's own `try/catch` swallowed. Privaxy now defines `scriptletGlobals` at the top of the injected payload, so `abort-current-script`, `prevent-addEventListener`, `abort-on-property-read`, `set-cookie`, etc. take effect.
+- Procedural cosmetic filtering
+  - Non-CSS procedural filters are no longer dropped (previously only filters reducible to plain CSS were applied). `:has-text`, `:matches-css`/`-before`/`-after`, `:matches-attr`, `:matches-path`, `:min-text-length`, `:upward`, `:xpath`, and the `:remove()`/`:style()`/`remove-attr`/`remove-class` actions are now evaluated in-page by an injected shim.
+  - The shim re-runs on DOM mutations and recurses into same-origin child frames (`about:blank`/`srcdoc`/`data:` with `allow-same-origin`), so ad content written into such frames after load is also matched. Cross-origin frames and closed shadow DOM remain out of reach.
+- Scriptlet error logging (debugging)
+  - New opt-in `debug.scriptlet_console_logging` (off by default), toggleable from Settings → Debug, surfaces errors thrown by injected scriptlets in the page console as `[privaxy scriptlet]` entries instead of swallowing them.
+- Fix cosmetic "modified responses" statistic undercount
+  - Pages where only element-hiding (`display: none`) selectors were injected were not counted as modified; any injected cosmetic CSS now counts
+
+## v0.7.0
+
 - Built-in authentication for the web UI and API
   - First-run setup page for choosing an admin username + password
   - 30-day HMAC-signed session cookie
@@ -32,6 +44,7 @@
 - Inject into CSP-protected websites
 - Add docker compose example
 
+
 ## v0.6.0
 
 - Remove gui app

From 6cf1a44a26faf4870cff08ebeb737478d55c7a37 Mon Sep 17 00:00:00 2001
From: joshrmcdaniel <80354972+joshrmcdaniel@users.noreply.github.com>
Date: Sat, 30 May 2026 12:59:24 -0500
Subject: [PATCH 4/6] debug frontned

---
 privaxy/src/server/web_gui/settings/debug.rs |  87 ++++++++++
 web_frontend/src/debug.rs                    | 170 +++++++++++++++++++
 2 files changed, 257 insertions(+)
 create mode 100644 privaxy/src/server/web_gui/settings/debug.rs
 create mode 100644 web_frontend/src/debug.rs

diff --git a/privaxy/src/server/web_gui/settings/debug.rs b/privaxy/src/server/web_gui/settings/debug.rs
new file mode 100644
index 00000000..da08cb5b
--- /dev/null
+++ b/privaxy/src/server/web_gui/settings/debug.rs
@@ -0,0 +1,87 @@
+use super::get_error_response;
+use crate::configuration::{Configuration, DebugConfig};
+use crate::web_gui::with_configuration_save_lock;
+use crate::web_gui::with_configuration_updater_sender;
+use crate::web_gui::with_notify_reload;
+use std::convert::Infallible;
+use std::sync::Arc;
+use tokio::sync::mpsc::Sender;
+use tokio::sync::Notify;
+use warp::filters::BoxedFilter;
+use warp::http::Response;
+use warp::Filter as RouteFilter;
+
+async fn get_debug_settings() -> Result<Box<dyn warp::Reply>, Infallible> {
+    log::debug!("Getting debug settings");
+    let configuration = match Configuration::read_from_home().await {
+        Ok(configuration) => configuration,
+        Err(err) => {
+            log::error!("Failed to read debug settings: {err}");
+            return Ok(Box::new(get_error_response(err)));
+        }
+    };
+    Ok(Box::new(warp::reply::json(&configuration.debug)))
+}
+
+async fn put_debug_settings(
+    debug_settings: DebugConfig,
+    configuration_updater_sender: Sender<Configuration>,
+    configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
+    notify_reload: Arc<Notify>,
+) -> Result<Box<dyn warp::Reply>, Infallible> {
+    let guard = configuration_save_lock.lock().await;
+    let mut configuration = match Configuration::read_from_home().await {
+        Ok(configuration) => configuration,
+        Err(err) => {
+            log::error!("Failed to read configuration for debug update: {err}");
+            return Ok(Box::new(get_error_response(err)));
+        }
+    };
+
+    configuration.debug = debug_settings;
+
+    if let Err(err) = configuration.save().await {
+        log::error!("Failed to save debug settings: {err}");
+        drop(guard);
+        return Ok(Box::new(get_error_response(err)));
+    }
+    configuration_updater_sender
+        .send(configuration.clone())
+        .await
+        .unwrap();
+    drop(guard);
+
+    // The proxy reads `debug.scriptlet_console_logging` when it (re)starts, so a
+    // reload is what makes the toggle take effect on newly served pages.
+    notify_reload.notify_waiters();
+
+    Ok(Box::new(
+        Response::builder()
+            .status(http::StatusCode::NO_CONTENT)
+            .body("".to_string()),
+    ))
+}
+
+pub(super) fn create_routes(
+    configuration_updater_sender: Sender<Configuration>,
+    configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
+    notify_reload: Arc<Notify>,
+) -> BoxedFilter<(impl warp::Reply,)> {
+    let get_route = warp::get()
+        .and(warp::path::end())
+        .and_then(get_debug_settings);
+
+    let put_route = warp::put()
+        .and(warp::path::end())
+        .and(warp::body::json())
+        .and(with_configuration_updater_sender(
+            configuration_updater_sender.clone(),
+        ))
+        .and(with_configuration_save_lock(
+            configuration_save_lock.clone(),
+        ))
+        .and(with_notify_reload(notify_reload.clone()))
+        .and_then(put_debug_settings);
+
+    get_route.or(put_route).boxed()
+}
diff --git a/web_frontend/src/debug.rs b/web_frontend/src/debug.rs
new file mode 100644
index 00000000..e065affe
--- /dev/null
+++ b/web_frontend/src/debug.rs
@@ -0,0 +1,170 @@
+use reqwasm::http::Request;
+use serde::{Deserialize, Serialize};
+use wasm_bindgen_futures::spawn_local;
+use web_sys::HtmlInputElement;
+use yew::prelude::*;
+use yew::{html, Component, Context, Html};
+
+/// Mirrors the backend `configuration::DebugConfig`.
+#[derive(Debug, Clone, Default, Deserialize, Serialize, PartialEq, Eq)]
+pub struct DebugConfig {
+    #[serde(default)]
+    pub scriptlet_console_logging: bool,
+}
+
+pub enum Message {
+    Loaded(DebugConfig),
+    ToggleScriptletLogging(bool),
+    SaveSucceeded(DebugConfig),
+    SaveFailed(String),
+}
+
+pub struct DebugSettingsPage {
+    config: DebugConfig,
+    loaded: bool,
+    saving: bool,
+    saved: bool,
+    error: Option<String>,
+}
+
+impl Component for DebugSettingsPage {
+    type Message = Message;
+    type Properties = ();
+
+    fn create(ctx: &Context<Self>) -> Self {
+        let link = ctx.link().clone();
+        spawn_local(async move {
+            match Request::get("/api/settings/debug").send().await {
+                Ok(response) if response.ok() => {
+                    if let Ok(config) = response.json::<DebugConfig>().await {
+                        link.send_message(Message::Loaded(config));
+                    }
+                }
+                _ => log::error!("Failed to load debug settings"),
+            }
+        });
+
+        Self {
+            config: DebugConfig::default(),
+            loaded: false,
+            saving: false,
+            saved: false,
+            error: None,
+        }
+    }
+
+    fn update(&mut self, ctx: &Context<Self>, msg: Self::Message) -> bool {
+        match msg {
+            Message::Loaded(config) => {
+                self.config = config;
+                self.loaded = true;
+                true
+            }
+            Message::ToggleScriptletLogging(value) => {
+                // Optimistically reflect the new value, then persist. The PUT
+                // triggers a backend reload, so it takes effect on newly served
+                // pages.
+                self.config.scriptlet_console_logging = value;
+                self.saving = true;
+                self.saved = false;
+                self.error = None;
+                let config = self.config.clone();
+                let link = ctx.link().clone();
+                spawn_local(async move {
+                    let body = serde_json::to_string(&config).unwrap();
+                    match Request::put("/api/settings/debug")
+                        .header("Content-Type", "application/json")
+                        .body(body)
+                        .send()
+                        .await
+                    {
+                        Ok(response) if response.ok() => {
+                            link.send_message(Message::SaveSucceeded(config));
+                        }
+                        Ok(response) => {
+                            link.send_message(Message::SaveFailed(format!(
+                                "Failed to save (HTTP {})",
+                                response.status()
+                            )));
+                        }
+                        Err(err) => link.send_message(Message::SaveFailed(format!("{err}"))),
+                    }
+                });
+                true
+            }
+            Message::SaveSucceeded(config) => {
+                self.config = config;
+                self.saving = false;
+                self.saved = true;
+                self.error = None;
+                true
+            }
+            Message::SaveFailed(message) => {
+                self.saving = false;
+                self.saved = false;
+                self.error = Some(message);
+                true
+            }
+        }
+    }
+
+    fn view(&self, ctx: &Context<Self>) -> Html {
+        if !self.loaded {
+            return html! { <div>{"Loading..."}</div> };
+        }
+
+        let on_toggle = ctx.link().callback(|e: MouseEvent| {
+            let input: HtmlInputElement = e.target_unchecked_into();
+            Message::ToggleScriptletLogging(input.checked())
+        });
+
+        let status = if self.saving {
+            html! { <span class="text-sm text-gray-400 ml-2">{"Saving..."}</span> }
+        } else if self.saved {
+            html! { <span class="text-sm text-green-600 ml-2">{"Saved"}</span> }
+        } else {
+            html! {}
+        };
+
+        html! {
+            <>
+                <div class="pt-1.5 mb-4">
+                    <h1 class="text-2xl font-bold text-gray-900">{ "Debug" }</h1>
+                </div>
+
+                <fieldset class="mb-8" style="width: 100%;">
+                    <legend class="text-lg font-medium text-gray-900">{ "Scriptlet diagnostics" }</legend>
+                    <div class="mt-4 border-t border-b border-gray-200 divide-y divide-gray-200">
+                        <div class="mb-4" style="display: flex; flex-direction: column; width: 100%; padding: 2px 0;">
+                            <div style="display: flex; align-items: center; width: 100%;">
+                                <div class="text-gray-500" style="width: 260px; text-align: left; padding-right: 4px;">
+                                    { "Log scriptlet errors to console" }
+                                </div>
+                                <div style="flex-grow: 1;">
+                                    <input
+                                        checked={self.config.scriptlet_console_logging}
+                                        onclick={on_toggle}
+                                        disabled={self.saving}
+                                        type="checkbox"
+                                        class="focus:ring-blue-500 h-4 w-4 text-blue-600 border-gray-300 rounded"
+                                    />
+                                    { status }
+                                </div>
+                            </div>
+                            <div style="margin-left: 260px;">
+                                <p class="text-gray-400 text-sm">
+                                    { "Surface errors thrown by injected uBO scriptlets in the page's developer console as " }
+                                    <span class="font-mono bg-gray-100 px-1">{ "[privaxy scriptlet]" }</span>
+                                    { " entries, instead of silently swallowing them. Noisy and reveals that Privaxy is intercepting the page \u{2014} leave off unless troubleshooting." }
+                                </p>
+                                if let Some(error) = &self.error {
+                                    <p class="text-red-500 text-xs italic">{ error.clone() }</p>
+                                }
+                            </div>
+                        </div>
+                    </div>
+                </fieldset>
+            </>
+        }
+    }
+}

From 829ffab2d1bb47cfa6f40bfb21ec1ad54644f956 Mon Sep 17 00:00:00 2001
From: joshrmcdaniel <80354972+joshrmcdaniel@users.noreply.github.com>
Date: Sat, 30 May 2026 13:39:40 -0500
Subject: [PATCH 5/6] logging

---
 privaxy/src/server/configuration/mod.rs      |   4 +
 privaxy/src/server/lib.rs                    |  14 +
 privaxy/src/server/logging.rs                | 231 +++++++++++++++++
 privaxy/src/server/main.rs                   |   2 -
 privaxy/src/server/web_gui/logs.rs           |  39 +++
 privaxy/src/server/web_gui/mod.rs            |  16 ++
 privaxy/src/server/web_gui/settings/debug.rs |  28 +-
 privaxy/src/server/web_gui/settings/mod.rs   |   3 +
 web_frontend/src/debug.rs                    | 134 ++++++++--
 web_frontend/src/logs.rs                     | 255 +++++++++++++++++++
 web_frontend/src/main.rs                     |   1 +
 11 files changed, 694 insertions(+), 33 deletions(-)
 create mode 100644 privaxy/src/server/logging.rs
 create mode 100644 privaxy/src/server/web_gui/logs.rs
 create mode 100644 web_frontend/src/logs.rs

diff --git a/privaxy/src/server/configuration/mod.rs b/privaxy/src/server/configuration/mod.rs
index eec0b272..99315ef0 100644
--- a/privaxy/src/server/configuration/mod.rs
+++ b/privaxy/src/server/configuration/mod.rs
@@ -75,6 +75,10 @@ pub struct DebugConfig {
     /// Privaxy is in the path, so default off.
     #[serde(default)]
     pub scriptlet_console_logging: bool,
+    /// Verbosity of Privaxy's own logs, applied live (no restart). Dependency
+    /// logs remain governed by `RUST_LOG`. Defaults to `info`.
+    #[serde(default)]
+    pub log_level: crate::logging::LogLevel,
 }
 
 #[derive(Error, Debug)]
diff --git a/privaxy/src/server/lib.rs b/privaxy/src/server/lib.rs
index 3216e77b..43eec62d 100644
--- a/privaxy/src/server/lib.rs
+++ b/privaxy/src/server/lib.rs
@@ -25,6 +25,7 @@ mod blocker_utils;
 mod ca;
 mod cert;
 pub mod configuration;
+pub mod logging;
 mod proxy;
 pub mod statistics;
 mod web_gui;
@@ -78,6 +79,11 @@ async fn handle_signals() -> (Arc<Notify>, Arc<Notify>) {
 }
 
 pub async fn start_privaxy() -> PrivaxyServer {
+    // Install the global logger first so every subsequent record is both
+    // written to stderr and made available to the `/api/logs` stream. The
+    // configured level is applied once the configuration is read below.
+    let log_handle = logging::init(logging::LogLevel::default().to_level_filter());
+
     // We use reqwest instead of hyper's client to perform most of the proxying as it's more convenient
     // to handle compression as well as offers a more convenient interface.
     let client = reqwest::Client::builder()
@@ -120,6 +126,10 @@ pub async fn start_privaxy() -> PrivaxyServer {
         }
     };
 
+    // Apply the persisted application log level now that configuration is
+    // available; the web UI can change it on the fly afterwards.
+    log_handle.set_level(configuration.debug.log_level.to_level_filter());
+
     let local_exclusion_store =
         LocalExclusionStore::new(Vec::from_iter(configuration.exclusions.clone().into_iter()));
     let local_exclusion_store_clone = local_exclusion_store.clone();
@@ -182,6 +192,7 @@ pub async fn start_privaxy() -> PrivaxyServer {
     let configuration_updater_tx_ref = configuration_updater_tx.clone();
     let configuration_save_lock_ref = configuration_save_lock.clone();
     let broadcast_tx_ref = broadcast_tx.clone();
+    let log_handle_ref = log_handle.clone();
     let notify_reload_clone = notify_reload.clone();
 
     tokio::spawn(async move {
@@ -197,6 +208,7 @@ pub async fn start_privaxy() -> PrivaxyServer {
                 configuration_updater_tx_ref.clone(),
                 cfg_lock_frontend.clone(),
                 notify_reload_frontend.clone(),
+                log_handle_ref.clone(),
             )
             .await;
             notify_reload_frontend.notified().await;
@@ -262,6 +274,7 @@ async fn privaxy_frontend(
     configuration_updater_tx: tokio::sync::mpsc::Sender<configuration::Configuration>,
     configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
     notify_reload: Arc<tokio::sync::Notify>,
+    log_handle: logging::LogHandle,
 ) {
     let frontend = web_gui::get_frontend(
         broadcast_tx.clone(),
@@ -271,6 +284,7 @@ async fn privaxy_frontend(
         &configuration_save_lock,
         &local_exclusion_store,
         notify_reload.clone(),
+        log_handle.clone(),
     );
     let frontend_server = warp::serve(frontend);
     let config = read_configuration(&configuration_save_lock).await;
diff --git a/privaxy/src/server/logging.rs b/privaxy/src/server/logging.rs
new file mode 100644
index 00000000..877fda78
--- /dev/null
+++ b/privaxy/src/server/logging.rs
@@ -0,0 +1,231 @@
+//! Global logging setup that mirrors `env_logger`'s stderr output while also
+//! fanning every emitted record out to in-process subscribers.
+//!
+//! The standard `log` facade only permits a single global logger, and
+//! `env_logger` writes exclusively to stderr with no hook to observe records.
+//! [`init`] therefore builds `env_logger::Logger`s for stderr formatting, then
+//! wraps them so each record is additionally pushed into a bounded ring buffer
+//! (for backlog replay) and broadcast to live WebSocket subscribers (see
+//! `web_gui::logs`).
+//!
+//! Verbosity of the application's own (`privaxy`-targeted) records is governed
+//! by a [`LogHandle`]'s atomic level, which the web UI can change on the fly
+//! via the Debug settings — no restart or `RUST_LOG` change required. Records
+//! from dependencies keep their `RUST_LOG`-derived filtering so the stream
+//! isn't drowned in third-party noise.
+
+use std::collections::VecDeque;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+
+use chrono::{DateTime, Utc};
+use log::{LevelFilter, Log, Metadata, Record};
+use serde::{Deserialize, Serialize};
+use tokio::sync::broadcast;
+
+/// Crate name used both as the logging target prefix for the application's own
+/// records and to decide which records the dynamic level applies to.
+const APP_TARGET: &str = "privaxy";
+
+/// Number of recent records retained for replay to clients that connect after
+/// the records were emitted.
+const BACKLOG_CAPACITY: usize = 1000;
+
+/// Bound on the broadcast channel. Slow subscribers that fall further behind
+/// than this are signalled with `Lagged` and skip the dropped records rather
+/// than stalling the logger.
+const CHANNEL_CAPACITY: usize = 512;
+
+/// Default level for dependency (non-`privaxy`) records when `RUST_LOG` doesn't
+/// say otherwise. Keeps third-party crates quiet so the stream stays readable.
+const DEPENDENCY_DEFAULT_LEVEL: LevelFilter = LevelFilter::Warn;
+
+/// A configurable log verbosity, persisted in the configuration and selectable
+/// from the web UI. Mirrors `log::LevelFilter` but owns its serialized form.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum LogLevel {
+    Off,
+    Error,
+    Warn,
+    Info,
+    Debug,
+    Trace,
+}
+
+impl Default for LogLevel {
+    fn default() -> Self {
+        Self::Info
+    }
+}
+
+impl LogLevel {
+    pub fn to_level_filter(self) -> LevelFilter {
+        match self {
+            Self::Off => LevelFilter::Off,
+            Self::Error => LevelFilter::Error,
+            Self::Warn => LevelFilter::Warn,
+            Self::Info => LevelFilter::Info,
+            Self::Debug => LevelFilter::Debug,
+            Self::Trace => LevelFilter::Trace,
+        }
+    }
+}
+
+/// A single formatted log record, serialized to WebSocket clients.
+#[derive(Debug, Clone, Serialize)]
+pub struct LogEntry {
+    pub now: DateTime<Utc>,
+    pub level: String,
+    pub target: String,
+    pub message: String,
+}
+
+/// Cheap-to-clone handle giving access to the live log broadcast, the retained
+/// backlog, and the runtime-adjustable application log level. Shared with the
+/// API layer so a new subscriber can be primed with recent history and the
+/// Debug settings route can change verbosity live.
+#[derive(Clone)]
+pub struct LogHandle {
+    pub sender: broadcast::Sender<LogEntry>,
+    pub backlog: Arc<Mutex<VecDeque<LogEntry>>>,
+    level: Arc<AtomicUsize>,
+}
+
+impl LogHandle {
+    /// Snapshot of the currently retained records, oldest first.
+    pub fn backlog_snapshot(&self) -> Vec<LogEntry> {
+        match self.backlog.lock() {
+            Ok(backlog) => backlog.iter().cloned().collect(),
+            Err(poisoned) => poisoned.get_ref().iter().cloned().collect(),
+        }
+    }
+
+    /// Changes the verbosity applied to the application's own records,
+    /// effective immediately for subsequent records.
+    pub fn set_level(&self, level: LevelFilter) {
+        self.level.store(level as usize, Ordering::Relaxed);
+    }
+
+    fn app_level(&self) -> LevelFilter {
+        level_filter_from_usize(self.level.load(Ordering::Relaxed))
+    }
+
+    fn record(&self, entry: LogEntry) {
+        if let Ok(mut backlog) = self.backlog.lock() {
+            if backlog.len() == BACKLOG_CAPACITY {
+                backlog.pop_front();
+            }
+            backlog.push_back(entry.clone());
+        }
+        // A send error only means there are no live subscribers; the backlog
+        // still captured the record, so the error is intentionally ignored.
+        let _ = self.sender.send(entry);
+    }
+}
+
+fn level_filter_from_usize(value: usize) -> LevelFilter {
+    match value {
+        0 => LevelFilter::Off,
+        1 => LevelFilter::Error,
+        2 => LevelFilter::Warn,
+        3 => LevelFilter::Info,
+        4 => LevelFilter::Debug,
+        _ => LevelFilter::Trace,
+    }
+}
+
+fn is_app_target(target: &str) -> bool {
+    target == APP_TARGET || target.starts_with(concat!("privaxy", "::"))
+}
+
+struct BroadcastLogger {
+    /// Pass-through formatter/writer for the application's own records; its own
+    /// filter is wide open so the dynamic level is the sole gate.
+    app_writer: env_logger::Logger,
+    /// `RUST_LOG`-derived formatter/filter for dependency records.
+    dependency_logger: env_logger::Logger,
+    handle: LogHandle,
+}
+
+impl BroadcastLogger {
+    fn enabled(&self, metadata: &Metadata) -> bool {
+        if is_app_target(metadata.target()) {
+            metadata.level() <= self.handle.app_level()
+        } else {
+            self.dependency_logger.enabled(metadata)
+        }
+    }
+}
+
+impl Log for BroadcastLogger {
+    fn enabled(&self, metadata: &Metadata) -> bool {
+        self.enabled(metadata)
+    }
+
+    fn log(&self, record: &Record) {
+        if !self.enabled(record.metadata()) {
+            return;
+        }
+
+        if is_app_target(record.target()) {
+            self.app_writer.log(record);
+        } else {
+            self.dependency_logger.log(record);
+        }
+
+        self.handle.record(LogEntry {
+            now: Utc::now(),
+            level: record.level().to_string(),
+            target: record.target().to_string(),
+            message: record.args().to_string(),
+        });
+    }
+
+    fn flush(&self) {
+        self.app_writer.flush();
+        self.dependency_logger.flush();
+    }
+}
+
+/// Installs the global logger and returns a [`LogHandle`] for streaming records
+/// to clients and adjusting verbosity at runtime.
+///
+/// `initial_level` seeds the application log level (typically from
+/// configuration). Dependency records are filtered via `RUST_LOG`, defaulting
+/// to [`DEPENDENCY_DEFAULT_LEVEL`].
+///
+/// Must be called exactly once, before any logging occurs.
+pub fn init(initial_level: LevelFilter) -> LogHandle {
+    // Wide-open writer: every application record we hand it is already gated by
+    // the dynamic level, so its own filter must not drop anything.
+    let app_writer = env_logger::Builder::new()
+        .filter_level(LevelFilter::Trace)
+        .build();
+
+    // Dependency records keep RUST_LOG behaviour on top of a quiet default.
+    let dependency_logger = env_logger::Builder::new()
+        .filter_level(DEPENDENCY_DEFAULT_LEVEL)
+        .parse_default_env()
+        .build();
+
+    let (sender, _receiver) = broadcast::channel(CHANNEL_CAPACITY);
+    let handle = LogHandle {
+        sender,
+        backlog: Arc::new(Mutex::new(VecDeque::with_capacity(BACKLOG_CAPACITY))),
+        level: Arc::new(AtomicUsize::new(initial_level as usize)),
+    };
+
+    let logger = BroadcastLogger {
+        app_writer,
+        dependency_logger,
+        handle: handle.clone(),
+    };
+
+    log::set_boxed_logger(Box::new(logger)).expect("failed to install global logger");
+    // Keep the facade permissive so the dynamic level can be raised to Trace at
+    // runtime; the wrapper performs the actual per-record gating.
+    log::set_max_level(LevelFilter::Trace);
+
+    handle
+}
diff --git a/privaxy/src/server/main.rs b/privaxy/src/server/main.rs
index 8474af7a..afb33946 100644
--- a/privaxy/src/server/main.rs
+++ b/privaxy/src/server/main.rs
@@ -9,8 +9,6 @@ async fn main() {
         std::env::set_var(RUST_LOG_ENV_KEY, "privaxy=info");
     }
 
-    env_logger::init();
-
     start_privaxy().await;
 
     loop {
diff --git a/privaxy/src/server/web_gui/logs.rs b/privaxy/src/server/web_gui/logs.rs
new file mode 100644
index 00000000..5b664af2
--- /dev/null
+++ b/privaxy/src/server/web_gui/logs.rs
@@ -0,0 +1,39 @@
+use crate::logging::LogHandle;
+use futures::{SinkExt, StreamExt};
+use tokio::sync::broadcast::error::RecvError;
+use warp::ws::{Message, WebSocket};
+
+pub(super) async fn logs(websocket: WebSocket, log_handle: LogHandle) {
+    let mut receiver = log_handle.sender.subscribe();
+
+    let (mut tx, mut rx) = websocket.split();
+
+    // To handle Ping / Pong messages
+    tokio::spawn(async move { while let Some(_message) = rx.next().await {} });
+
+    // Prime the client with recently retained records so the view isn't empty
+    // until the next record is emitted.
+    for entry in log_handle.backlog_snapshot() {
+        let message = Message::text(serde_json::to_string(&entry).unwrap());
+
+        if tx.send(message).await.is_err() {
+            return;
+        }
+    }
+
+    loop {
+        match receiver.recv().await {
+            Ok(entry) => {
+                let message = Message::text(serde_json::to_string(&entry).unwrap());
+
+                if tx.send(message).await.is_err() {
+                    break;
+                }
+            }
+            // The subscriber fell behind and the channel dropped records; keep
+            // streaming from the most recent retained record.
+            Err(RecvError::Lagged(_)) => continue,
+            Err(RecvError::Closed) => break,
+        }
+    }
+}
diff --git a/privaxy/src/server/web_gui/mod.rs b/privaxy/src/server/web_gui/mod.rs
index 45012adf..0c0cb0c2 100644
--- a/privaxy/src/server/web_gui/mod.rs
+++ b/privaxy/src/server/web_gui/mod.rs
@@ -1,3 +1,4 @@
+use crate::logging::LogHandle;
 use crate::proxy::exclusions::LocalExclusionStore;
 use crate::statistics::Statistics;
 use crate::WEBAPP_FRONTEND_DIR;
@@ -18,6 +19,7 @@ pub(crate) mod events;
 pub(crate) mod exclusions;
 mod filterlists;
 pub(crate) mod filters;
+pub(crate) mod logs;
 mod pac;
 pub(crate) mod settings;
 pub(crate) mod statistics;
@@ -34,6 +36,7 @@ pub(crate) fn get_frontend(
     configuration_save_lock: &Arc<tokio::sync::Mutex<()>>,
     local_exclusions_store: &LocalExclusionStore,
     notify_reload: Arc<Notify>,
+    log_handle: LogHandle,
 ) -> BoxedFilter<(impl warp::Reply,)> {
     let static_files_routes = create_static_routes();
 
@@ -57,6 +60,7 @@ pub(crate) fn get_frontend(
         local_exclusions_store,
         http_client,
         notify_reload,
+        log_handle,
     );
 
     let pac_route = pac::create_routes(configuration_save_lock.clone());
@@ -106,6 +110,7 @@ fn create_api_routes(
     local_exclusions_store: &LocalExclusionStore,
     http_client: reqwest::Client,
     notify_reload: Arc<Notify>,
+    log_handle: LogHandle,
 ) -> BoxedFilter<(impl Reply,)> {
     let def_headers =
         warp::filters::reply::default_header(http::header::CONTENT_TYPE, "application/json");
@@ -134,6 +139,15 @@ fn create_api_routes(
             ws.on_upgrade(move |websocket| statistics::statistics(websocket, statistics))
         });
 
+    let logs_handle = log_handle.clone();
+    let logs_route = warp::path("logs")
+        .and(require_auth.clone())
+        .and(warp::ws())
+        .map(move |ws: warp::ws::Ws| {
+            let log_handle = logs_handle.clone();
+            ws.on_upgrade(move |websocket| logs::logs(websocket, log_handle))
+        });
+
     let filters_route =
         warp::path("filters")
             .and(require_auth.clone())
@@ -167,6 +181,7 @@ fn create_api_routes(
                 configuration_updater_sender.clone(),
                 configuration_save_lock.clone(),
                 notify_reload.clone(),
+                log_handle.clone(),
             ));
 
     let blocking_enabled_route = warp::path("blocking-enabled")
@@ -189,6 +204,7 @@ fn create_api_routes(
     let api_inner = auth_routes
         .or(events_route)
         .or(statistics_route)
+        .or(logs_route)
         .or(filters_route)
         .or(custom_filters_route)
         .or(exclusions_route)
diff --git a/privaxy/src/server/web_gui/settings/debug.rs b/privaxy/src/server/web_gui/settings/debug.rs
index da08cb5b..fb704993 100644
--- a/privaxy/src/server/web_gui/settings/debug.rs
+++ b/privaxy/src/server/web_gui/settings/debug.rs
@@ -1,5 +1,6 @@
 use super::get_error_response;
 use crate::configuration::{Configuration, DebugConfig};
+use crate::logging::LogHandle;
 use crate::web_gui::with_configuration_save_lock;
 use crate::web_gui::with_configuration_updater_sender;
 use crate::web_gui::with_notify_reload;
@@ -11,6 +12,12 @@ use warp::filters::BoxedFilter;
 use warp::http::Response;
 use warp::Filter as RouteFilter;
 
+fn with_log_handle(
+    log_handle: LogHandle,
+) -> impl RouteFilter<Extract = (LogHandle,), Error = Infallible> + Clone {
+    warp::any().map(move || log_handle.clone())
+}
+
 async fn get_debug_settings() -> Result<Box<dyn warp::Reply>, Infallible> {
     log::debug!("Getting debug settings");
     let configuration = match Configuration::read_from_home().await {
@@ -28,6 +35,7 @@ async fn put_debug_settings(
     configuration_updater_sender: Sender<Configuration>,
     configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
     notify_reload: Arc<Notify>,
+    log_handle: LogHandle,
 ) -> Result<Box<dyn warp::Reply>, Infallible> {
     let guard = configuration_save_lock.lock().await;
     let mut configuration = match Configuration::read_from_home().await {
@@ -38,6 +46,12 @@ async fn put_debug_settings(
         }
     };
 
+    // The log level is applied live below, but the proxy only reads
+    // `scriptlet_console_logging` when it (re)starts, so only that toggle
+    // warrants the disruptive reload.
+    let scriptlet_logging_changed =
+        configuration.debug.scriptlet_console_logging != debug_settings.scriptlet_console_logging;
+
     configuration.debug = debug_settings;
 
     if let Err(err) = configuration.save().await {
@@ -51,9 +65,15 @@ async fn put_debug_settings(
         .unwrap();
     drop(guard);
 
-    // The proxy reads `debug.scriptlet_console_logging` when it (re)starts, so a
-    // reload is what makes the toggle take effect on newly served pages.
-    notify_reload.notify_waiters();
+    // Apply the log level immediately rather than waiting for the next
+    // process restart; verbosity is governed by the live atomic in LogHandle.
+    log_handle.set_level(configuration.debug.log_level.to_level_filter());
+
+    // Avoid bouncing the proxy/frontend (and dropping live connections) for a
+    // log-level-only change, which already took effect above.
+    if scriptlet_logging_changed {
+        notify_reload.notify_waiters();
+    }
 
     Ok(Box::new(
         Response::builder()
@@ -66,6 +86,7 @@ pub(super) fn create_routes(
     configuration_updater_sender: Sender<Configuration>,
     configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
     notify_reload: Arc<Notify>,
+    log_handle: LogHandle,
 ) -> BoxedFilter<(impl warp::Reply,)> {
     let get_route = warp::get()
         .and(warp::path::end())
@@ -81,6 +102,7 @@ pub(super) fn create_routes(
             configuration_save_lock.clone(),
         ))
         .and(with_notify_reload(notify_reload.clone()))
+        .and(with_log_handle(log_handle))
         .and_then(put_debug_settings);
 
     get_route.or(put_route).boxed()
diff --git a/privaxy/src/server/web_gui/settings/mod.rs b/privaxy/src/server/web_gui/settings/mod.rs
index 06b5e50f..2e79e12f 100644
--- a/privaxy/src/server/web_gui/settings/mod.rs
+++ b/privaxy/src/server/web_gui/settings/mod.rs
@@ -1,5 +1,6 @@
 use super::get_error_response;
 use crate::configuration::Configuration;
+use crate::logging::LogHandle;
 use std::sync::Arc;
 use tokio::sync::mpsc::Sender;
 use tokio::sync::Notify;
@@ -15,6 +16,7 @@ pub(crate) fn create_routes(
     configuration_updater_sender: Sender<Configuration>,
     configuration_save_lock: Arc<tokio::sync::Mutex<()>>,
     notify_reload: Arc<Notify>,
+    log_handle: LogHandle,
 ) -> BoxedFilter<(impl warp::Reply,)> {
     let network_settings_route = warp::path("network").and(network::create_routes(
         configuration_updater_sender.clone(),
@@ -38,6 +40,7 @@ pub(crate) fn create_routes(
         configuration_updater_sender.clone(),
         configuration_save_lock.clone(),
         notify_reload.clone(),
+        log_handle,
     ));
 
     network_settings_route
diff --git a/web_frontend/src/debug.rs b/web_frontend/src/debug.rs
index e065affe..8dea556b 100644
--- a/web_frontend/src/debug.rs
+++ b/web_frontend/src/debug.rs
@@ -1,20 +1,41 @@
+use crate::logs::LogStream;
 use reqwasm::http::Request;
 use serde::{Deserialize, Serialize};
 use wasm_bindgen_futures::spawn_local;
-use web_sys::HtmlInputElement;
+use web_sys::{HtmlInputElement, HtmlSelectElement};
 use yew::prelude::*;
 use yew::{html, Component, Context, Html};
 
+/// Selectable log verbosities, matching the backend `logging::LogLevel`
+/// (serialized lowercase).
+const LOG_LEVELS: [&str; 6] = ["off", "error", "warn", "info", "debug", "trace"];
+
+fn default_log_level() -> String {
+    "info".to_string()
+}
+
 /// Mirrors the backend `configuration::DebugConfig`.
-#[derive(Debug, Clone, Default, Deserialize, Serialize, PartialEq, Eq)]
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
 pub struct DebugConfig {
     #[serde(default)]
     pub scriptlet_console_logging: bool,
+    #[serde(default = "default_log_level")]
+    pub log_level: String,
+}
+
+impl Default for DebugConfig {
+    fn default() -> Self {
+        Self {
+            scriptlet_console_logging: false,
+            log_level: default_log_level(),
+        }
+    }
 }
 
 pub enum Message {
     Loaded(DebugConfig),
     ToggleScriptletLogging(bool),
+    SetLogLevel(String),
     SaveSucceeded(DebugConfig),
     SaveFailed(String),
 }
@@ -65,31 +86,14 @@ impl Component for DebugSettingsPage {
                 // triggers a backend reload, so it takes effect on newly served
                 // pages.
                 self.config.scriptlet_console_logging = value;
-                self.saving = true;
-                self.saved = false;
-                self.error = None;
-                let config = self.config.clone();
-                let link = ctx.link().clone();
-                spawn_local(async move {
-                    let body = serde_json::to_string(&config).unwrap();
-                    match Request::put("/api/settings/debug")
-                        .header("Content-Type", "application/json")
-                        .body(body)
-                        .send()
-                        .await
-                    {
-                        Ok(response) if response.ok() => {
-                            link.send_message(Message::SaveSucceeded(config));
-                        }
-                        Ok(response) => {
-                            link.send_message(Message::SaveFailed(format!(
-                                "Failed to save (HTTP {})",
-                                response.status()
-                            )));
-                        }
-                        Err(err) => link.send_message(Message::SaveFailed(format!("{err}"))),
-                    }
-                });
+                self.persist(ctx);
+                true
+            }
+            Message::SetLogLevel(level) => {
+                // The backend applies the level live (no reload needed) on the
+                // PUT; we persist it so it survives restarts.
+                self.config.log_level = level;
+                self.persist(ctx);
                 true
             }
             Message::SaveSucceeded(config) => {
@@ -126,6 +130,12 @@ impl Component for DebugSettingsPage {
             html! {}
         };
 
+        let on_level_change = ctx.link().callback(|e: Event| {
+            let select: HtmlSelectElement = e.target_unchecked_into();
+            Message::SetLogLevel(select.value())
+        });
+        let current_level = self.config.log_level.clone();
+
         html! {
             <>
                 <div class="pt-1.5 mb-4">
@@ -148,7 +158,7 @@ impl Component for DebugSettingsPage {
                                         type="checkbox"
                                         class="focus:ring-blue-500 h-4 w-4 text-blue-600 border-gray-300 rounded"
                                     />
-                                    { status }
+                                    { status.clone() }
                                 </div>
                             </div>
                             <div style="margin-left: 260px;">
@@ -164,7 +174,75 @@ impl Component for DebugSettingsPage {
                         </div>
                     </div>
                 </fieldset>
+
+                <fieldset class="mb-8" style="width: 100%;">
+                    <legend class="text-lg font-medium text-gray-900">{ "Logging" }</legend>
+                    <div class="mt-4 border-t border-b border-gray-200 divide-y divide-gray-200">
+                        <div class="mb-4" style="display: flex; flex-direction: column; width: 100%; padding: 2px 0;">
+                            <div style="display: flex; align-items: center; width: 100%;">
+                                <div class="text-gray-500" style="width: 260px; text-align: left; padding-right: 4px;">
+                                    { "Log level" }
+                                </div>
+                                <div style="flex-grow: 1;">
+                                    <select
+                                        onchange={on_level_change}
+                                        disabled={self.saving}
+                                        class="block pl-3 pr-8 py-1.5 text-sm border-gray-300 rounded-md focus:ring-blue-500 focus:border-blue-500">
+                                        { for LOG_LEVELS.iter().map(|level| html! {
+                                            <option value={*level} selected={current_level == *level}>
+                                                { level.to_uppercase() }
+                                            </option>
+                                        }) }
+                                    </select>
+                                    { status }
+                                </div>
+                            </div>
+                            <div style="margin-left: 260px;">
+                                <p class="text-gray-400 text-sm">
+                                    { "Verbosity of Privaxy's own logs, applied immediately and persisted. Dependency logs stay governed by the " }
+                                    <span class="font-mono bg-gray-100 px-1">{ "RUST_LOG" }</span>
+                                    { " environment variable." }
+                                </p>
+                            </div>
+                        </div>
+                    </div>
+                </fieldset>
+
+                <LogStream />
             </>
         }
     }
 }
+
+impl DebugSettingsPage {
+    /// Persists the current config to the backend, reflecting save state via
+    /// `SaveSucceeded`/`SaveFailed` messages.
+    fn persist(&mut self, ctx: &Context<Self>) {
+        self.saving = true;
+        self.saved = false;
+        self.error = None;
+
+        let config = self.config.clone();
+        let link = ctx.link().clone();
+        spawn_local(async move {
+            let body = serde_json::to_string(&config).unwrap();
+            match Request::put("/api/settings/debug")
+                .header("Content-Type", "application/json")
+                .body(body)
+                .send()
+                .await
+            {
+                Ok(response) if response.ok() => {
+                    link.send_message(Message::SaveSucceeded(config));
+                }
+                Ok(response) => {
+                    link.send_message(Message::SaveFailed(format!(
+                        "Failed to save (HTTP {})",
+                        response.status()
+                    )));
+                }
+                Err(err) => link.send_message(Message::SaveFailed(format!("{err}"))),
+            }
+        });
+    }
+}
diff --git a/web_frontend/src/logs.rs b/web_frontend/src/logs.rs
new file mode 100644
index 00000000..0eedb02c
--- /dev/null
+++ b/web_frontend/src/logs.rs
@@ -0,0 +1,255 @@
+use futures::future::{AbortHandle, Abortable};
+use futures::StreamExt;
+use reqwasm::websocket::futures::WebSocket;
+use serde::Deserialize;
+use wasm_bindgen_futures::spawn_local;
+use web_sys::HtmlSelectElement;
+use yew::{html, Component, Context, Html, TargetCast};
+
+/// Upper bound on retained rows in the browser, mirroring the requests feed so
+/// a long-running session can't grow unbounded.
+const MAX_LOGS_SHOWN: usize = 1000;
+
+/// Mirrors the backend `logging::LogEntry`.
+#[derive(Deserialize, Clone, PartialEq)]
+pub struct LogEntry {
+    now: String,
+    level: String,
+    target: String,
+    message: String,
+}
+
+impl LogEntry {
+    /// Severity rank, lower is more severe. Unknown levels sort last so they
+    /// are only hidden by the most permissive ("All") filter.
+    fn severity(&self) -> u8 {
+        match self.level.as_str() {
+            "ERROR" => 0,
+            "WARN" => 1,
+            "INFO" => 2,
+            "DEBUG" => 3,
+            "TRACE" => 4,
+            _ => 5,
+        }
+    }
+}
+
+/// Minimum severity selected in the level dropdown.
+#[derive(Clone, Copy, PartialEq)]
+enum LevelFilter {
+    All,
+    Error,
+    Warn,
+    Info,
+    Debug,
+    Trace,
+}
+
+impl LevelFilter {
+    fn from_value(value: &str) -> Self {
+        match value {
+            "ERROR" => Self::Error,
+            "WARN" => Self::Warn,
+            "INFO" => Self::Info,
+            "DEBUG" => Self::Debug,
+            "TRACE" => Self::Trace,
+            _ => Self::All,
+        }
+    }
+
+    /// Highest severity rank still shown. `All` keeps everything, including
+    /// unknown levels.
+    fn max_rank(&self) -> u8 {
+        match self {
+            Self::All => u8::MAX,
+            Self::Error => 0,
+            Self::Warn => 1,
+            Self::Info => 2,
+            Self::Debug => 3,
+            Self::Trace => 4,
+        }
+    }
+}
+
+pub enum Message {
+    Received(LogEntry),
+    SetFilter(LevelFilter),
+    TogglePause,
+    Clear,
+}
+
+pub struct LogStream {
+    entries: Vec<LogEntry>,
+    filter: LevelFilter,
+    paused: bool,
+    ws_abort_handle: AbortHandle,
+}
+
+impl Component for LogStream {
+    type Message = Message;
+    type Properties = ();
+
+    fn create(ctx: &Context<Self>) -> Self {
+        let message_callback = ctx.link().callback(Message::Received);
+
+        let ws = WebSocket::open("/api/logs").unwrap();
+        let (_write, mut read) = ws.split();
+
+        let (abort_handle, abort_registration) = AbortHandle::new_pair();
+        let future = Abortable::new(
+            async move {
+                while let Some(Ok(msg)) = read.next().await {
+                    let entry = match msg {
+                        reqwasm::websocket::Message::Text(s) => {
+                            serde_json::from_str::<LogEntry>(&s).unwrap()
+                        }
+                        reqwasm::websocket::Message::Bytes(_) => unreachable!(),
+                    };
+
+                    message_callback.emit(entry);
+                }
+            },
+            abort_registration,
+        );
+
+        spawn_local(async {
+            let _result = future.await;
+        });
+
+        Self {
+            entries: Vec::new(),
+            filter: LevelFilter::All,
+            paused: false,
+            ws_abort_handle: abort_handle,
+        }
+    }
+
+    fn update(&mut self, _ctx: &Context<Self>, msg: Self::Message) -> bool {
+        match msg {
+            Message::Received(entry) => {
+                // While paused the live view is frozen; incoming records are
+                // dropped rather than buffered.
+                if self.paused {
+                    return false;
+                }
+
+                self.entries.insert(0, entry);
+                self.entries.truncate(MAX_LOGS_SHOWN);
+                true
+            }
+            Message::SetFilter(filter) => {
+                self.filter = filter;
+                true
+            }
+            Message::TogglePause => {
+                self.paused = !self.paused;
+                true
+            }
+            Message::Clear => {
+                self.entries.clear();
+                true
+            }
+        }
+    }
+
+    fn view(&self, ctx: &Context<Self>) -> Html {
+        let link = ctx.link();
+
+        let on_filter_change = link.callback(|e: yew::events::Event| {
+            let select: HtmlSelectElement = e.target_unchecked_into();
+            Message::SetFilter(LevelFilter::from_value(&select.value()))
+        });
+        let on_toggle_pause = link.callback(|_| Message::TogglePause);
+        let on_clear = link.callback(|_| Message::Clear);
+
+        let max_rank = self.filter.max_rank();
+        let visible = self
+            .entries
+            .iter()
+            .filter(|entry| entry.severity() <= max_rank);
+
+        let pause_label = if self.paused { "Resume" } else { "Pause" };
+        let pause_classes = if self.paused {
+            "inline-flex items-center px-3 py-1.5 border border-transparent text-sm font-medium rounded-md text-white bg-green-600 hover:bg-green-700"
+        } else {
+            "inline-flex items-center px-3 py-1.5 border border-gray-300 text-sm font-medium rounded-md text-gray-700 bg-white hover:bg-gray-50"
+        };
+
+        html! {
+            <fieldset class="mb-8" style="width: 100%;">
+                <legend class="text-lg font-medium text-gray-900">
+                    { "Live logs" }
+                    if !self.paused {
+                        <div class="mt-2 ml-3 inline pulsating-circle"></div>
+                    }
+                </legend>
+                <p class="text-gray-400 text-sm mt-1 mb-3">
+                    { "Streams the server's log output (controlled by " }
+                    <span class="font-mono bg-gray-100 px-1">{ "RUST_LOG" }</span>
+                    { "). Filtering and pausing are local to this view and don't affect what the server records." }
+                </p>
+
+                <div class="flex items-center space-x-3 mb-3">
+                    <label class="text-sm text-gray-500">{ "Minimum level" }</label>
+                    <select
+                        onchange={on_filter_change}
+                        class="block pl-3 pr-8 py-1.5 text-sm border-gray-300 rounded-md focus:ring-blue-500 focus:border-blue-500">
+                        <option value="ALL" selected={self.filter == LevelFilter::All}>{ "All" }</option>
+                        <option value="ERROR" selected={self.filter == LevelFilter::Error}>{ "Error" }</option>
+                        <option value="WARN" selected={self.filter == LevelFilter::Warn}>{ "Warn" }</option>
+                        <option value="INFO" selected={self.filter == LevelFilter::Info}>{ "Info" }</option>
+                        <option value="DEBUG" selected={self.filter == LevelFilter::Debug}>{ "Debug" }</option>
+                        <option value="TRACE" selected={self.filter == LevelFilter::Trace}>{ "Trace" }</option>
+                    </select>
+                    <button type="button" onclick={on_toggle_pause} class={pause_classes}>
+                        { pause_label }
+                    </button>
+                    <button
+                        type="button"
+                        onclick={on_clear}
+                        class="inline-flex items-center px-3 py-1.5 border border-gray-300 text-sm font-medium rounded-md text-gray-700 bg-white hover:bg-gray-50">
+                        { "Clear" }
+                    </button>
+                </div>
+
+                <div class="bg-gray-900 rounded-md overflow-x-auto" style="max-height: 32rem; overflow-y: auto;">
+                    <table class="min-w-full text-xs font-mono">
+                        <tbody>
+                            { for visible.map(Self::render_row) }
+                        </tbody>
+                    </table>
+                </div>
+            </fieldset>
+        }
+    }
+
+    fn destroy(&mut self, _ctx: &Context<Self>) {
+        self.ws_abort_handle.abort()
+    }
+}
+
+impl LogStream {
+    fn render_row(entry: &LogEntry) -> Html {
+        let level_classes = match entry.level.as_str() {
+            "ERROR" => "text-red-400",
+            "WARN" => "text-yellow-400",
+            "INFO" => "text-green-400",
+            "DEBUG" => "text-blue-400",
+            "TRACE" => "text-gray-400",
+            _ => "text-gray-300",
+        };
+
+        html! {
+            <tr class="border-b border-gray-800 align-top">
+                <td class="px-3 py-1 whitespace-nowrap text-gray-500">{ &entry.now }</td>
+                <td class={classes_for_level(level_classes)}>{ &entry.level }</td>
+                <td class="px-3 py-1 whitespace-nowrap text-gray-400">{ &entry.target }</td>
+                <td class="px-3 py-1 text-gray-200" style="word-break: break-word;">{ &entry.message }</td>
+            </tr>
+        }
+    }
+}
+
+fn classes_for_level(level_classes: &str) -> String {
+    format!("px-3 py-1 whitespace-nowrap font-semibold {level_classes}")
+}
diff --git a/web_frontend/src/main.rs b/web_frontend/src/main.rs
index d6c8bc3b..1908c072 100644
--- a/web_frontend/src/main.rs
+++ b/web_frontend/src/main.rs
@@ -14,6 +14,7 @@ mod debug;
 mod filterlists;
 mod filters;
 mod general;
+mod logs;
 mod pac;
 mod requests;
 mod save_button;

From d2a13a7788120092eefaf88c37dd8ff77a3f2306 Mon Sep 17 00:00:00 2001
From: joshrmcdaniel <80354972+joshrmcdaniel@users.noreply.github.com>
Date: Sat, 30 May 2026 13:41:40 -0500
Subject: [PATCH 6/6] changelog

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2d0dca1d..cb233065 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,9 @@
   - The shim re-runs on DOM mutations and recurses into same-origin child frames (`about:blank`/`srcdoc`/`data:` with `allow-same-origin`), so ad content written into such frames after load is also matched. Cross-origin frames and closed shadow DOM remain out of reach.
 - Scriptlet error logging (debugging)
   - New opt-in `debug.scriptlet_console_logging` (off by default), toggleable from Settings → Debug, surfaces errors thrown by injected scriptlets in the page console as `[privaxy scriptlet]` entries instead of swallowing them.
+- Live log streaming in the web UI
+  - Settings → Debug now shows the server's log output in real time
+  - The level can be changed in the webui
 - Fix cosmetic "modified responses" statistic undercount
   - Pages where only element-hiding (`display: none`) selectors were injected were not counted as modified; any injected cosmetic CSS now counts