Logging: Add log-storage cap setting + DEBUG file target

- New `advanced.maxLogStorageMb` setting (default 200 MB, range 0–5000). 0 disables log storage entirely so error reports cannot be sent.
- File target switched to DEBUG so error reports capture full context. Terminal rides along (`tauri-plugin-log` has no per-target levels — documented tradeoff).
- Rotation: `RotationStrategy::KeepSome(N)` where `N = ceil(cap_mb / 50)`. Native plugin support, no custom pruner needed.
- New `cmdr_lib::logging` module: log-dir cache, keep-count atomic, `eager_prune` for the user-lowered-the-cap case, plus `list_recent_log_files` and `current_total_log_bytes` for Phase 4.
- New Tauri command `set_max_log_storage_mb` updates the in-RAM keep-count and runs an eager prune; settings applier toasts "Restart Cmdr to apply" on `0 ↔ non-zero` transitions.
- Early loader reads the setting before the Tauri app handle exists (the plugin builds before `setup()`).
- Bonus fix: `diskSpaceChangeThreshold` now shows "MB" instead of "px" in the Advanced UI.
- Docs updated: `apps/desktop/src/lib/logging/CLAUDE.md`, `docs/tooling/logging.md`, `apps/desktop/src-tauri/src/settings/CLAUDE.md`, new `apps/desktop/src-tauri/src/logging/CLAUDE.md`.

Author: vdavid

apps/desktop/src-tauri/src/commands/settings.rs

@@ -70,6 +70,37 @@ pub fn set_smb_concurrency_cmd(value: u16) {
     set_smb_concurrency(value as usize);
 }
 
+/// Updates the in-RAM log-storage cap and runs an eager prune so the user sees excess files
+/// disappear immediately when they lower the cap.
+///
+/// Note: the actual rotation strategy `tauri-plugin-log` uses is fixed at app start (the
+/// plugin has no runtime reconfigure API). Restart-to-apply is therefore unavoidable for
+/// `0 ↔ non-zero` transitions and for raising the cap above the previously baked-in value.
+/// The frontend toasts a "restart required" notice for those cases.
+///
+/// `value` is in MB. `0` means "log storage disabled".
+#[tauri::command]
+pub fn set_max_log_storage_mb(value: u64) -> Result<(), String> {
+    use crate::logging;
+
+    let new_keep = if value == 0 { 0 } else { value.div_ceil(50) as usize };
+    logging::set_keep_count(new_keep);
+
+    // Eager-prune is purely cosmetic — files would also vanish on the next rotation, but
+    // the user just changed a setting, so we should show the effect now.
+    if let Some(dir) = logging::log_dir() {
+        match logging::eager_prune(dir, new_keep) {
+            Ok(0) => {}
+            Ok(n) => log::info!(
+                target: "cmdr_lib::logging",
+                "Eager-pruned {n} log files after cap change ({value} MB → keep {new_keep}).",
+            ),
+            Err(err) => return Err(format!("Failed to eager-prune log files: {err}")),
+        }
+    }
+    Ok(())
+}
+
 /// Update menu accelerator for a command.
 /// Called from frontend when keyboard shortcuts are changed.
 #[tauri::command]

apps/desktop/src-tauri/src/lib.rs

@@ -61,6 +61,8 @@ use nusb as _;
 mod ignore_poison;
 pub use ignore_poison::IgnorePoison;
 
+mod logging;
+
 #[cfg(target_os = "macos")]
 mod accent_color;
 #[cfg(target_os = "linux")]
@@ -216,25 +218,68 @@ pub fn run() {
             // 1. CMDR_LOG_DIR env var (explicit override)
             // 2. CMDR_DATA_DIR env var → <CMDR_DATA_DIR>/logs/ (dev and E2E test isolation)
             // 3. Default Tauri log dir (production)
-            let log_target = if let Ok(log_dir) = std::env::var("CMDR_LOG_DIR") {
-                Target::new(TargetKind::Folder {
-                    path: std::path::PathBuf::from(log_dir),
-                    file_name: None,
-                })
+            let resolved_log_dir: std::path::PathBuf = if let Ok(log_dir) = std::env::var("CMDR_LOG_DIR") {
+                std::path::PathBuf::from(log_dir)
             } else if let Ok(data_dir) = std::env::var("CMDR_DATA_DIR") {
-                let log_dir = std::path::PathBuf::from(data_dir).join("logs");
-                Target::new(TargetKind::Folder {
-                    path: log_dir,
+                std::path::PathBuf::from(data_dir).join("logs")
+            } else {
+                // Mirror tauri-plugin-log's `LogDir`: `<app_log_dir>/`. On macOS/iOS this is
+                // `~/Library/Logs/<bundle_id>/`; on Linux it's `$XDG_DATA_HOME/<bundle_id>/logs`;
+                // on Windows it's `<FOLDERID_LocalAppData>/<bundle_id>/logs`. We mirror the
+                // macOS shape (the only platform we currently ship to) — `dirs::home_dir() +
+                // Library/Logs/<bundle_id>`. Other platforms only matter for dev, where
+                // CMDR_DATA_DIR is always set by `tauri-wrapper.js`.
+                #[cfg(target_os = "macos")]
+                {
+                    dirs::home_dir()
+                        .map(|h| h.join("Library/Logs/com.veszelovszki.cmdr"))
+                        .unwrap_or_else(|| std::path::PathBuf::from("./logs"))
+                }
+                #[cfg(not(target_os = "macos"))]
+                {
+                    dirs::data_local_dir()
+                        .map(|d| d.join("com.veszelovszki.cmdr/logs"))
+                        .unwrap_or_else(|| std::path::PathBuf::from("./logs"))
+                }
+            };
+
+            // Read the log-storage cap from settings.json *before* the app handle exists.
+            // 0 = disabled (drop the file target entirely).
+            // None = no setting yet → 200 MB default.
+            // Any other value = N MB cap, mapped to KeepSome(ceil(N / 50)).
+            let cap_mb = settings::early_load_max_log_storage_mb().unwrap_or(200);
+            let file_logging_enabled = cap_mb > 0;
+            let keep_count: usize = if file_logging_enabled {
+                cap_mb.div_ceil(50) as usize
+            } else {
+                0
+            };
+
+            // Cache for the rest of the app (Phase 4 bundle builder, eager-prune callers).
+            logging::set_log_dir(resolved_log_dir.clone());
+            logging::set_keep_count(keep_count);
+
+            let stdout_target = Target::new(TargetKind::Stdout);
+            let targets: Vec<Target> = if file_logging_enabled {
+                let folder_target = Target::new(TargetKind::Folder {
+                    path: resolved_log_dir,
                     file_name: None,
-                })
+                });
+                vec![stdout_target, folder_target]
             } else {
-                Target::new(TargetKind::LogDir { file_name: None })
+                vec![stdout_target]
             };
 
             let mut builder = tauri_plugin_log::Builder::new()
-                .targets([Target::new(TargetKind::Stdout), log_target])
-                .rotation_strategy(RotationStrategy::KeepAll)
-                .max_file_size(50_000_000) // 50 MB
+                .targets(targets)
+                .rotation_strategy(if file_logging_enabled {
+                    RotationStrategy::KeepSome(keep_count)
+                } else {
+                    // Irrelevant when there's no Folder target, but the builder needs *some*
+                    // value. KeepOne is the plugin's default and the cheapest.
+                    RotationStrategy::KeepOne
+                })
+                .max_file_size(50_000_000) // 50 MB per rotated file
                 .format(|out, message, record| {
                     let now = chrono::Local::now();
                     let ts = now.format("%H:%M:%S%.3f"); // HH:MM:SS.mmm
@@ -280,9 +325,32 @@ pub fn run() {
             builder.build()
         })
         .setup(|app| {
-            // When RUST_LOG is not set, restrict to Info by default (verbose toggle can raise to Debug)
+            // When RUST_LOG is not set, choose a runtime floor:
+            // - If file logging is enabled (`logging::keep_count() > 0`): Debug, so the file
+            //   target captures the full debug context error reports rely on. The plugin can't
+            //   filter per-target, so the terminal also sees Debug — documented tradeoff.
+            // - If file logging is disabled (cap = 0): Info, preserving the old behavior. The
+            //   verbose toggle can raise to Debug at runtime.
             if std::env::var("RUST_LOG").is_err() {
-                log::set_max_level(log::LevelFilter::Info);
+                let floor = if logging::keep_count() > 0 {
+                    log::LevelFilter::Debug
+                } else {
+                    log::LevelFilter::Info
+                };
+                log::set_max_level(floor);
+            }
+
+            // One-line marker so the resolved log-storage state is visible at startup.
+            match logging::keep_count() {
+                0 => log::info!(
+                    target: "cmdr_lib::logging",
+                    "Log storage disabled (advanced.maxLogStorageMb = 0). Error reports cannot be sent.",
+                ),
+                n => log::info!(
+                    target: "cmdr_lib::logging",
+                    "Log storage enabled: keep up to {n} files × 50 MB ({} MB cap)",
+                    n * 50,
+                ),
             }
 
             // Initialize crash reporter early, before anything that might crash
@@ -994,6 +1062,7 @@ pub fn run() {
             commands::settings::set_direct_smb_connection,
             commands::settings::set_filter_safe_save_artifacts_cmd,
             commands::settings::set_smb_concurrency_cmd,
+            commands::settings::set_max_log_storage_mb,
             // Logging commands (frontend log bridge + runtime level control)
             commands::logging::batch_fe_logs,
             commands::logging::set_log_level,

apps/desktop/src-tauri/src/logging/CLAUDE.md

@@ -0,0 +1,69 @@
+# Logging support module
+
+Lives under `src-tauri/src/logging/`. `tauri-plugin-log` owns the actual log pipeline
+(terminal target + rotating file target). This module fills the gaps the plugin doesn't
+expose.
+
+## File map
+
+| File       | Purpose                                                                 |
+| ---------- | ----------------------------------------------------------------------- |
+| `mod.rs`   | `OnceLock<PathBuf>` for the resolved log dir, `AtomicUsize` for keep-count, `eager_prune`, `list_recent_log_files`, `current_total_log_bytes` |
+| `tests.rs` | Unit tests: pruner keep-N, zero-keep, missing dir, sorted listing, byte totals |
+
+## What lives here
+
+| Function                          | Role                                                                                   |
+| --------------------------------- | -------------------------------------------------------------------------------------- |
+| `set_log_dir(path)` / `log_dir()` | Cache the resolved dir once at plugin-build time; Phase 4 bundle builder reads it back |
+| `set_keep_count(n)` / `keep_count()` | Live view of the `KeepSome(N)` value the plugin was built with                     |
+| `list_recent_log_files(dir)`      | `*.log*` files newest-first by mtime                                                   |
+| `current_total_log_bytes(dir)`    | Sum sizes of `*.log*` files (diagnostic)                                               |
+| `eager_prune(dir, keep_n)`        | One-shot: delete everything beyond `keep_n` newest                                     |
+
+## Why a one-shot pruner and not a recurring task
+
+`tauri-plugin-log` 2.8.0 exposes `RotationStrategy::KeepSome(usize)` natively. The plugin
+rotates and prunes files itself on each rotation. We don't need a 10-min recurring pruner.
+
+The only gap is the "user just lowered the cap at runtime" case: the plugin won't delete
+existing archived files until the next rotation, which may not happen for a while. The
+`set_max_log_storage_mb` Tauri command calls `eager_prune` so the user sees files disappear
+immediately. Purely cosmetic — correctness is already guaranteed by the plugin's rotation.
+
+## Plugin is one-shot
+
+`tauri_plugin_log::Builder` builds the plugin exactly once. There's no runtime reconfigure
+API — no "switch rotation strategy", no "add Folder target", no "change max file size".
+Changes to the cap that need a different rotation strategy or a target list change (0 ↔
+non-zero transitions, raising the cap above the previously baked-in value) take effect on
+the next app launch.
+
+This is why `set_keep_count` exists: the in-RAM count drives `eager_prune` calls without
+needing to restart the plugin. The next startup reads the setting again and bakes the new
+value into the plugin.
+
+## Per-target level filtering (missing feature)
+
+`tauri-plugin-log` does NOT support different log levels per target. Setting the file
+target to Debug also forces the terminal target to Debug for modules that don't have an
+explicit `RUST_LOG` filter. This is the documented tradeoff in the error-report design —
+worth it to get full debug context in error report bundles.
+
+When `advanced.maxLogStorageMb = 0`, the file target is dropped entirely, and terminal
+level falls back to the old Info default. The verbose toggle continues to flip terminal
+gating via `log::set_max_level` in that case.
+
+## Gotcha/Why
+
+- `list_recent_log_files` returns `Vec<PathBuf>` in "newest-first by mtime" order. If you
+  use it to locate the currently-active file, trust mtime, not the filename — rotated
+  files have a timestamp suffix but there's no guarantee the suffix is current.
+- `eager_prune(dir, 0)` wipes everything including the live file; the plugin re-creates it
+  on the next write. This is the correct behavior for the "user just disabled logging at
+  runtime" path — we stop capturing immediately rather than waiting for the next restart.
+- The log dir resolution in `lib.rs` and in `early_load_max_log_storage_mb` must stay in
+  sync. `lib.rs` resolves at plugin-build time with env-var precedence; the early-load
+  helper in `settings::loader` mirrors the CMDR_DATA_DIR fallback but uses `dirs::data_dir`
+  + bundle id rather than Tauri's `app_data_dir`. If the bundle id changes, both places
+  need updating.

apps/desktop/src-tauri/src/logging/mod.rs

@@ -0,0 +1,122 @@
+//! Logging support module.
+//!
+//! `tauri-plugin-log` owns the actual log routing (terminal + rotating file). This module
+//! adds the bits the plugin doesn't expose:
+//!
+//! - **Resolved log dir cache** ([`set_log_dir`] / [`log_dir`]): the path is derived in `lib.rs`
+//!   from `CMDR_LOG_DIR` / `CMDR_DATA_DIR` / the Tauri default. Phase 4's bundle builder needs
+//!   the same path without re-deriving the env-var logic.
+//! - **Live keep-count** ([`set_keep_count`] / [`keep_count`]): the rotation `KeepSome(N)` value
+//!   the plugin was built with. The plugin is one-shot — changing this at runtime does NOT
+//!   reconfigure the plugin, but [`eager_prune`] uses it to delete excess archived files
+//!   immediately when the user lowers the cap.
+//! - **One-shot pruner** ([`eager_prune`]): for the user-lowered-the-cap case. Files would
+//!   also vanish on the next rotation; this gives the user immediate feedback.
+//! - **Listing helpers** ([`list_recent_log_files`], [`current_total_log_bytes`]): for Phase 4
+//!   bundle building and diagnostics.
+
+use std::path::{Path, PathBuf};
+use std::sync::OnceLock;
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+#[cfg(test)]
+mod tests;
+
+static LOG_DIR: OnceLock<PathBuf> = OnceLock::new();
+static KEEP_COUNT: AtomicUsize = AtomicUsize::new(0);
+
+/// Records the resolved log directory once, at plugin-build time.
+///
+/// Subsequent calls are no-ops — the path doesn't change without an app restart.
+pub fn set_log_dir(path: PathBuf) {
+    let _ = LOG_DIR.set(path);
+}
+
+/// Returns the resolved log directory if it was recorded.
+///
+/// Returns `None` when log storage is disabled (cap = 0) or before the plugin builder ran.
+pub fn log_dir() -> Option<&'static Path> {
+    LOG_DIR.get().map(PathBuf::as_path)
+}
+
+/// Records the keep-count the plugin was built with (`ceil(cap_mb / 50)`).
+pub fn set_keep_count(n: usize) {
+    KEEP_COUNT.store(n, Ordering::Relaxed);
+}
+
+/// Current keep-count.
+///
+/// Used by [`eager_prune`] callers and reported in diagnostics. `0` means "log storage
+/// disabled" (the `Folder` target was dropped at build time).
+pub fn keep_count() -> usize {
+    KEEP_COUNT.load(Ordering::Relaxed)
+}
+
+/// Lists `*.log*` files in the log dir, newest first by mtime.
+///
+/// Returns an empty `Vec` if the directory doesn't exist or can't be read. The "live" file
+/// (no rotation suffix) sorts ahead of archived `cmdr.log.YYYY-MM-DD-HH-MM-SS` siblings as
+/// long as its mtime is fresher, which is the case during normal operation.
+pub fn list_recent_log_files(log_dir: &Path) -> Vec<PathBuf> {
+    let Ok(entries) = std::fs::read_dir(log_dir) else {
+        return Vec::new();
+    };
+
+    let mut files: Vec<(PathBuf, std::time::SystemTime)> = entries
+        .filter_map(Result::ok)
+        .filter_map(|entry| {
+            let path = entry.path();
+            // Match anything containing ".log" — covers `cmdr.log` and rotated
+            // `cmdr.log.2025-01-15-...` siblings without hard-coding a stem.
+            let name = path.file_name()?.to_str()?;
+            if !name.contains(".log") {
+                return None;
+            }
+            let mtime = entry.metadata().ok()?.modified().ok()?;
+            Some((path, mtime))
+        })
+        .collect();
+
+    // Newest first — `Reverse` avoids the `sort_by`/`Ord` boilerplate clippy flags.
+    files.sort_by_key(|(_, mtime)| std::cmp::Reverse(*mtime));
+    files.into_iter().map(|(p, _)| p).collect()
+}
+
+/// Sums sizes of all `*.log*` files in the log dir. Returns `0` if the dir is missing.
+#[allow(dead_code, reason = "Diagnostic helper; wired up by Phase 4 bundle manifest")]
+pub fn current_total_log_bytes(log_dir: &Path) -> u64 {
+    list_recent_log_files(log_dir)
+        .into_iter()
+        .filter_map(|p| std::fs::metadata(&p).ok().map(|m| m.len()))
+        .sum()
+}
+
+/// Deletes all but the `keep_n` newest `*.log*` files in `log_dir`.
+///
+/// One-shot — call once after the user lowers the cap. Returns the number of files deleted.
+/// A missing directory is not an error (returns `Ok(0)`). Per-file deletion errors are
+/// logged but don't abort the sweep.
+///
+/// `keep_n == 0` keeps no files at all — used when the user disables log storage at runtime
+/// (the live `cmdr.log` will be re-created by the plugin on the next write).
+pub fn eager_prune(log_dir: &Path, keep_n: usize) -> std::io::Result<usize> {
+    if !log_dir.exists() {
+        return Ok(0);
+    }
+    let files = list_recent_log_files(log_dir);
+    if files.len() <= keep_n {
+        return Ok(0);
+    }
+    let mut deleted = 0usize;
+    for path in files.into_iter().skip(keep_n) {
+        match std::fs::remove_file(&path) {
+            Ok(()) => deleted += 1,
+            Err(err) => log::warn!(
+                target: "cmdr_lib::logging",
+                "Failed to prune log file {}: {err}",
+                path.display(),
+            ),
+        }
+    }
+    Ok(deleted)
+}