fix(supportBundle): cap log size and stop redacting defaults

Address PR #971 review findings:
- CRF-12: tail-truncate log files over 50 MB in readLogFile to prevent
  OOM during rezip when a long-lived session has a multi-GB debug log
- CRF-13: passthrough `defaultValue` in maybeRedact so package.json
  defaults (public, no user data) stay visible for triage

Author: EhabY

src/supportBundle/files.ts

@@ -10,10 +10,11 @@ export interface CollectedFile {
 	relativePath: string;
 }
 
-// 3 days is enough context for recent issues; matching the 7-day
-// rotation would bloat the bundle.
+/** 3-day window; the 7-day rotation would bloat the bundle. */
 const LOG_MAX_AGE_MS = 3 * 24 * 60 * 60 * 1000;
 const MAX_LOG_SCAN_DEPTH = 6;
+/** Per-file cap to prevent OOM on multi-GB debug logs. */
+const MAX_LOG_FILE_BYTES = 50 * 1024 * 1024;
 
 // Accept .log and VS Code's rotated .log.N form.
 export const isLogFile = (name: string): boolean => /\.log(\.\d+)?$/.test(name);
@@ -46,7 +47,22 @@ function isEnoent(error: unknown): boolean {
 	);
 }
 
-/** Read a file with an lstat guard that rejects symlinks. */
+/** Read the last `length` bytes of `filePath`. */
+async function readTail(filePath: string, length: number): Promise<Uint8Array> {
+	const handle = await fs.open(filePath, "r");
+	try {
+		const { size } = await handle.stat();
+		const offset = Math.max(0, size - length);
+		const readLen = Math.min(length, size);
+		const buf = Buffer.alloc(readLen);
+		const { bytesRead } = await handle.read(buf, 0, readLen, offset);
+		return buf.subarray(0, bytesRead);
+	} finally {
+		await handle.close();
+	}
+}
+
+/** lstat-guarded read; tail-truncates files over `MAX_LOG_FILE_BYTES`. */
 export async function readLogFile(
 	filePath: string,
 	logger: Logger,
@@ -56,6 +72,15 @@ export async function readLogFile(
 		if (!stat.isFile()) {
 			return undefined;
 		}
+		if (stat.size > MAX_LOG_FILE_BYTES) {
+			logger.warn(
+				`Truncating log file ${filePath} (${stat.size} bytes) to last ${MAX_LOG_FILE_BYTES} bytes`,
+			);
+			return {
+				data: await readTail(filePath, MAX_LOG_FILE_BYTES),
+				mtimeMs: stat.mtimeMs,
+			};
+		}
 		return { data: await fs.readFile(filePath), mtimeMs: stat.mtimeMs };
 	} catch (error) {
 		logger.warn(`Could not read log file ${filePath}`, error);

src/supportBundle/settings.ts

@@ -57,13 +57,15 @@ function redactedSettingValue(value: SettingValue): string {
 		: "<set>";
 }
 
+/** inspect() metadata + public package.json default; not user-supplied. */
+const REDACTION_PASSTHROUGH = new Set(["key", "languageIds", "defaultValue"]);
+
 function maybeRedact(
 	key: string,
 	name: string,
 	value: SettingValue,
 ): SettingValue {
-	// `key` and `languageIds` are inspect() metadata, not the secret payload.
-	if (name === "key" || name === "languageIds") {
+	if (REDACTION_PASSTHROUGH.has(name)) {
 		return value;
 	}
 	return REDACTED_SETTINGS.has(key) ? redactedSettingValue(value) : value;

test/unit/supportBundle/files.test.ts

@@ -10,6 +10,7 @@ import {
 	isLogFile,
 	normalizeZipPath,
 	prefixFiles,
+	readLogFile,
 } from "@/supportBundle/files";
 
 import { createMockLogger } from "../../mocks/testHelpers";
@@ -88,6 +89,22 @@ describe("support bundle file helpers", () => {
 		]);
 	});
 
+	it("truncates oversized log files to the tail", async () => {
+		const filePath = path.join(tmpDir, "huge.log");
+		const head = Buffer.alloc(60 * 1024 * 1024, "H");
+		const tail = Buffer.from("TAIL_MARKER\n");
+		await fs.writeFile(filePath, Buffer.concat([head, tail]));
+
+		const result = await readLogFile(filePath, logger);
+
+		expect(result?.data.byteLength).toBe(50 * 1024 * 1024);
+		expect(
+			Buffer.from(result?.data ?? new Uint8Array())
+				.subarray(-tail.byteLength)
+				.toString(),
+		).toBe("TAIL_MARKER\n");
+	});
+
 	it.runIf(process.platform !== "win32")(
 		"does not follow symlinks when reading files",
 		async () => {

test/unit/supportBundle/settings.test.ts

@@ -79,7 +79,7 @@ describe("collectSettingsFile", () => {
 
 		expect(raw).not.toContain("DO_NOT_LEAK_SECRET");
 		expect(settings["coder.headerCommand"]).toEqual({
-			defaultValue: "<empty>",
+			defaultValue: "",
 			effective: "<set>",
 			globalValue: "<set>",
 			key: "coder.headerCommand",