Pre-fill issue reports with a redacted log tail. Principle VII.

Fixes #3705

## Summary

- Pre-fill Help → Support → Submit Bug Report with system/radio context and a bounded recent-log tail.
- Re-run centralized privacy redaction at the public issue-render boundary and fall back to the clipboard when the encoded GitHub URL would be too long.
- Keep SmartLink account names and GPS/location coordinates out of logs at their source, including the WAN certificate-decision path.
- Add centralized name/coordinate redaction as a fail-safe so those fields cannot survive into disk logs or the public issue body if a future logging path submits them.
- Replace the absolute no-personal-data claim with a concrete privacy notice and a prompt to review before submission.

## Verification

- Full macOS RelWithDebInfo build with 8 parallel jobs.
- `async_log_writer_test` passes with planted SmartLink names and GPS/location coordinates absent from disk logs.
- `issue_report_test` passes with the same planted fields absent from the generated public report.
- `tools/check_engine_boundary.py --strict` passes with no new violations.

Squashed-from: #4314

Co-authored-by: aethersdr-agent[bot] <273844287+aethersdr-agent[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Pat Jensen <patjensen@gmail.com>

Author: aethersdr-agent[bot]

CMakeLists.txt

@@ -600,6 +600,7 @@ set(CORE_SOURCES
     src/core/LogManager.cpp
     src/core/ShortcutManager.cpp
     src/core/SupportBundle.cpp
+    src/core/IssueReport.cpp
     src/core/DeviceDiagnostics.cpp
     src/core/SerialPortController.cpp
     src/core/FlexControlManager.cpp
@@ -3453,6 +3454,21 @@ if(UNIX)
 endif()
 set_target_properties(async_log_writer_test PROPERTIES AUTOMOC ON)
 
+# Pre-filled GitHub issue body + redaction-at-render guarantee (#3705).
+# IssueReport.cpp depends only on redactPii (AsyncLogWriter.cpp) — no
+# RadioModel — so the redaction contract is unit-testable in isolation.
+add_executable(issue_report_test
+    tests/issue_report_test.cpp
+    src/core/IssueReport.cpp
+    src/core/AsyncLogWriter.cpp
+)
+target_include_directories(issue_report_test PRIVATE src src/core)
+target_link_libraries(issue_report_test PRIVATE Qt6::Core)
+if(UNIX)
+    target_link_libraries(issue_report_test PRIVATE pthread)
+endif()
+set_target_properties(issue_report_test PROPERTIES AUTOMOC ON)
+
 add_executable(perf_telemetry_test
     tests/perf_telemetry_test.cpp
     src/core/PerfTelemetry.cpp

src/core/AsyncLogWriter.cpp

@@ -83,6 +83,26 @@ QString redactPii(const QString& msg)
         QRegularExpression::CaseInsensitiveOption);
     out.replace(*bearerRe, QStringLiteral("\\1\\2\\3***REDACTED***"));
 
+    // SmartLink account-holder names are not useful for diagnostics. Scrub
+    // the protocol's snake_case fields and common camelCase equivalents as a
+    // final defense if a raw or parsed user-settings message reaches logging.
+    static const QRegularExpression* personalNameRe = new QRegularExpression(
+        R"(\b(first_?name|last_?name|full_?name)(["']?\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s#|,}\]]+))",
+        QRegularExpression::CaseInsensitiveOption);
+    out.replace(*personalNameRe, QStringLiteral("\\1\\2***REDACTED***"));
+
+    // GPS coordinates likewise have no diagnostic value. Cover the Flex
+    // lat=/lon= status spelling, long-form/JSON spellings, optional gps_
+    // prefixes, and a numeric pair carried in a location=/gps= field.
+    static const QRegularExpression* coordinateFieldRe = new QRegularExpression(
+        R"(\b((?:gps[_-]?)?(?:lat(?:itude)?|lon(?:gitude)?))(["']?\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s#|,}\]]+))",
+        QRegularExpression::CaseInsensitiveOption);
+    out.replace(*coordinateFieldRe, QStringLiteral("\\1\\2***REDACTED***"));
+    static const QRegularExpression* coordinatePairRe = new QRegularExpression(
+        R"(\b(gps(?:[_-]?location)?|location)(["']?\s*[:=]\s*)[-+]?\d{1,3}(?:\.\d+)?\s*[,/]\s*[-+]?\d{1,3}(?:\.\d+)?)",
+        QRegularExpression::CaseInsensitiveOption);
+    out.replace(*coordinatePairRe, QStringLiteral("\\1\\2***REDACTED***"));
+
     // MAC addresses: 00-1C-2D-05-37-2A -> **-**-**-**-**-2A
     //                00:1C:2D:05:37:2A -> **:**:**:**:**:2A
     static const QRegularExpression* macRe = new QRegularExpression(

src/core/AsyncLogWriter.h

@@ -15,7 +15,8 @@
 namespace AetherSDR {
 
 // Apply log-style PII redaction (IPv4 → *.*.*.X, radio serial →
-// ****-****-****-XXXX, Auth0 tokens, MAC addresses).  Defined in
+// ****-****-****-XXXX, Auth0 tokens, SmartLink personal names, GPS
+// coordinates, and MAC addresses). Defined in
 // AsyncLogWriter.cpp; thread-safe (pure function over local copies of
 // static const QRegularExpressions).  Used by AsyncLogWriter for every
 // log line and by SupportBundle to scrub radio-info.json fields per

src/core/IssueReport.cpp

@@ -0,0 +1,78 @@
+#include "IssueReport.h"
+#include "AsyncLogWriter.h"  // redactPii — GHSA-ccrg-j8cp-qhc4
+
+namespace AetherSDR {
+
+QString buildIssueReport(const SupportBundle::SystemInfo& sys,
+                         const SupportBundle::RadioInfo& radio,
+                         const QString& logTail)
+{
+    QString body;
+
+    // State the concrete privacy guarantees without implying that arbitrary
+    // user-authored log text can be proven free of every kind of PII.
+    body += "<!-- Pre-filled by AetherSDR (Help \xE2\x86\x92 File an Issue). "
+            "Known sensitive fields are redacted: authentication tokens, "
+            "network/radio identifiers, GPS coordinates, and SmartLink "
+            "account names. Please review the report, then "
+            "replace the italic placeholders with your own words. -->\n\n";
+
+    body += "### What happened?\n";
+    body += "_Describe what went wrong (e.g. \"the waterfall freezes after "
+            "about 10 minutes\")._\n\n";
+
+    body += "### What did you expect?\n";
+    body += "_Describe the expected behavior._\n\n";
+
+    body += "### Steps to reproduce\n";
+    body += "1. _First step_\n";
+    body += "2. _\xE2\x80\xA6_\n\n";
+
+    body += "### Radio model & firmware\n";
+    if (radio.connected) {
+        // Serial/IP are PII — redact to the same form used in logs so support
+        // can correlate without seeing cleartext.  Callsign is FCC public
+        // record; model/firmware/protocol are not sensitive.
+        body += QString("- Model: %1\n").arg(radio.model);
+        body += QString("- Firmware: %1\n").arg(radio.firmware);
+        if (!radio.protocolVersion.isEmpty()) {
+            body += QString("- Protocol: %1\n").arg(radio.protocolVersion);
+        }
+        if (!radio.callsign.isEmpty()) {
+            body += QString("- Callsign: %1\n").arg(radio.callsign);
+        }
+        if (!radio.serial.isEmpty()) {
+            body += QString("- Serial: %1\n").arg(redactPii(radio.serial));
+        }
+        body += "- Connection: connected\n\n";
+    } else {
+        body += "- Connection: not connected\n\n";
+    }
+
+    body += "### OS & version\n";
+    body += QString("- AetherSDR: %1\n").arg(sys.aetherVersion);
+    body += QString("- Qt: %1\n").arg(sys.qtVersion);
+    body += QString("- OS: %1 (kernel %2)\n").arg(sys.osName, sys.kernelVersion);
+    body += QString("- Arch: %1\n").arg(sys.cpuArch);
+    body += QString("- Build: %1\n\n").arg(sys.buildDate);
+
+    body += "### Recent log\n";
+    if (logTail.isEmpty()) {
+        body += "_(Recent log omitted from this link to keep it short \xE2\x80\x94 "
+                "see the attached support bundle, or paste it from your "
+                "clipboard.)_\n";
+    } else {
+        body += QString("Last %1 lines, secret-redacted:\n\n")
+                    .arg(kIssueLogTailLines);
+        // Redact at the render boundary: even though the on-disk tail is
+        // already scrubbed by AsyncLogWriter::formatLine, re-run redactPii so
+        // the guarantee holds regardless of the tail's provenance.
+        body += "```text\n";
+        body += redactPii(logTail).trimmed();
+        body += "\n```\n";
+    }
+
+    return body;
+}
+
+} // namespace AetherSDR

src/core/IssueReport.h

@@ -0,0 +1,43 @@
+#pragma once
+
+#include "SupportBundle.h"
+
+#include <QString>
+
+namespace AetherSDR {
+
+// Pre-filled GitHub issue body (#3705).
+//
+// buildIssueReport() renders the same headed-Markdown sections the AI-prompt
+// template uses (What happened / Expected / Steps / Radio / OS) with the
+// SupportBundle snapshot filled in and clear placeholders for the user's
+// prose.  When a log tail is supplied it is embedded as a fenced ```text
+// block; when it is empty a short "omitted — see support bundle" note is
+// substituted so the "graceful degrade" path still reads sensibly.
+//
+// Redaction guarantee: the log tail is passed through redactPii() here, at
+// the render boundary, before it can reach the body or the clipboard — the
+// same scrub applied to every on-disk log line (GHSA-ccrg-j8cp-qhc4).  The
+// on-disk tail is already redacted at capture; this second pass is
+// belt-and-suspenders so the guarantee holds no matter where the tail came
+// from.  Radio serial/IP are scrubbed too; callsign/model are public and
+// left intact.  This TU depends only on redactPii (no RadioModel), so the
+// redaction contract is unit-testable in isolation (issue_report_test).
+
+// Last N lines of the recent log to include in the issue body.
+inline constexpr int kIssueLogTailLines = 100;
+
+// Conservative ceiling on the assembled issues/new URL.  A pre-filled URL
+// can only carry text in the query string and browsers/GitHub reject or
+// truncate over-long URLs; above this the caller re-renders without the log
+// block and delivers the full report via the clipboard/bundle instead.
+inline constexpr int kIssueUrlMaxBytes = 8000;
+
+// Build the headed-Markdown issue body.  logTail empty => log block replaced
+// by the omission note.  Non-empty => redacted and embedded in a fenced
+// block headed "last kIssueLogTailLines lines, secret-redacted".
+QString buildIssueReport(const SupportBundle::SystemInfo& sys,
+                         const SupportBundle::RadioInfo& radio,
+                         const QString& logTail);
+
+} // namespace AetherSDR

src/core/RadioConnection.cpp

@@ -293,6 +293,9 @@ void RadioConnection::onHeartbeat()
 
 void RadioConnection::processLine(const QString& line)
 {
+    // GPS coordinates are never useful in a support log. Drop the raw status
+    // at the source; AsyncLogWriter also scrubs coordinate-shaped fields as a
+    // defense against future logging paths.
     const bool isGps = line.contains("|gps ");
     bool isPingReply = false;
     if (m_lastPingSeq && line.startsWith("R")) {
@@ -305,8 +308,9 @@ void RadioConnection::processLine(const QString& line)
             m_lastPingSeq = 0;
         }
     }
-    if (!isGps && !isPingReply)
+    if (!isGps && !isPingReply) {
         qCDebug(lcConnection) << "RX:" << line;
+    }
 
     ParsedMessage msg = CommandParser::parseLine(line);
     emit messageReceived(msg);

src/core/SmartLinkClient.cpp

@@ -402,19 +402,27 @@ void SmartLinkClient::onPingTimer()
 
 void SmartLinkClient::parseMessage(const QString& msg)
 {
-    // Redact any token= values from log output
-    if (msg.contains("token="))
+    const bool isUserSettings = msg.startsWith("application user_settings");
+
+    // SmartLink account-holder names have no diagnostic value. Do not enqueue
+    // the raw user-settings message at all; the centralized writer redaction
+    // remains a final defense for any future logging path.
+    if (isUserSettings) {
+        qCDebug(lcSmartLink)
+            << "SmartLink RX: application user_settings (personal fields omitted)";
+    } else if (msg.contains("token=")) {
         qCDebug(lcSmartLink) << "SmartLink RX:" << msg.left(msg.indexOf("token=") + 6) + "***REDACTED***";
-    else
+    } else {
         qCDebug(lcSmartLink) << "SmartLink RX:" << msg.left(120);
+    }
 
     if (msg.startsWith("radio list ")) {
         parseRadioList(msg);
     } else if (msg.startsWith("radio connect_ready")) {
         parseConnectReady(msg);
     } else if (msg.startsWith("application info")) {
         parseApplicationInfo(msg);
-    } else if (msg.startsWith("application user_settings")) {
+    } else if (isUserSettings) {
         parseUserSettings(msg);
     } else if (msg.startsWith("application registration_invalid")) {
         qCWarning(lcSmartLink) << "SmartLinkClient: registration invalid — token rejected";
@@ -542,8 +550,7 @@ void SmartLinkClient::parseUserSettings(const QString& msg)
         else if (key == "first_name") m_userFirstName = val;
         else if (key == "last_name")  m_userLastName = val;
     }
-    qCDebug(lcSmartLink) << "SmartLinkClient: user:" << m_userFirstName << m_userLastName
-             << "callsign:" << m_userCallsign;
+    qCDebug(lcSmartLink) << "SmartLinkClient: user settings received (personal fields omitted)";
 }
 
 void SmartLinkClient::parseTestResults(const QString& msg)

src/core/SupportBundle.cpp

@@ -14,6 +14,7 @@
 #include <QJsonDocument>
 #include <QJsonObject>
 #include <QSaveFile>
+#include <QStringList>
 #include <QSysInfo>
 #include <QTemporaryDir>
 #include <QUrl>
@@ -210,6 +211,39 @@ QString SupportBundle::createBundle(const RadioInfo& radio)
     return archivePath;
 }
 
+QString SupportBundle::recentLogTail(int lines)
+{
+    if (lines <= 0)
+        return {};
+
+    auto& logMgr = LogManager::instance();
+    logMgr.flushLog();
+
+    QFile f(logMgr.logFilePath());
+    if (!f.open(QIODevice::ReadOnly | QIODevice::Text))
+        return {};
+
+    // Read a bounded tail; ~200KB comfortably holds kIssueLogTailLines worth
+    // of formatted lines without loading a large log in full.
+    constexpr qint64 kMaxRead = 200 * 1024;
+    const qint64 size = f.size();
+    const bool seeked = size > kMaxRead;
+    if (seeked)
+        f.seek(size - kMaxRead);
+    const QString text = QString::fromUtf8(f.readAll());
+    f.close();
+
+    QStringList all = text.split('\n');
+    // A mid-line seek can leave a partial first line; drop it so the tail
+    // starts on a clean line boundary.
+    if (seeked && !all.isEmpty())
+        all.removeFirst();
+
+    if (all.size() > lines)
+        all = all.mid(all.size() - lines);
+    return all.join('\n').trimmed();
+}
+
 void SupportBundle::openEmailClient(const QString& bundlePath,
                                     const SystemInfo& sys,
                                     const RadioInfo& radio)

src/core/SupportBundle.h

@@ -41,6 +41,13 @@ class SupportBundle {
     // Returns the full path to the archive, or empty string on failure.
     static QString createBundle(const RadioInfo& radio);
 
+    // Flush the log pipeline and return the last `lines` lines of the most
+    // recent on-disk log (#3705).  The on-disk log is already secret-redacted
+    // at capture (AsyncLogWriter::formatLine → redactPii), so this is the
+    // redacted stream; callers still re-scrub at the render boundary as
+    // belt-and-suspenders.  Reads a bounded tail (~200KB) to stay responsive.
+    static QString recentLogTail(int lines);
+
     // Open the default email client with pre-filled subject/body.
     static void openEmailClient(const QString& bundlePath,
                                 const SystemInfo& sys,

src/core/WanConnection.cpp

@@ -362,6 +362,11 @@ void WanConnection::onHeartbeat()
 
 void WanConnection::processLine(const QString& line)
 {
+    // GPS coordinates are never useful in a support log. Compute this before
+    // the certificate-decision early return so that path cannot bypass the
+    // normal GPS payload suppression below.
+    const bool isGps = line.contains("|gps ");
+
     // GHSA-wfx7-w6p8-4jr2 phase 2: while the operator is being prompted
     // about a cert mismatch, the TLS channel stays open but we must not
     // act on anything that arrives. A MITM on the path (the exact threat
@@ -372,13 +377,17 @@ void WanConnection::processLine(const QString& line)
     // to connected() — so we extend the suppression symmetrically:
     // nothing gets parsed until the operator's decision lands.
     if (m_awaitingCertDecision) {
-        qCDebug(lcSmartLink)
-            << "WAN RX (suppressed during cert-pin decision):" << line;
+        if (isGps) {
+            qCDebug(lcSmartLink)
+                << "WAN RX (suppressed during cert-pin decision; GPS payload omitted)";
+        } else {
+            qCDebug(lcSmartLink)
+                << "WAN RX (suppressed during cert-pin decision):" << line;
+        }
         return;
     }
 
     // Suppress noisy messages
-    const bool isGps = line.contains("|gps ");
     bool isPingReply = false;
     if (m_lastPingSeq && line.startsWith("R")) {
         isPingReply = line.startsWith(QString("R%1|").arg(m_lastPingSeq));
@@ -387,8 +396,9 @@ void WanConnection::processLine(const QString& line)
             m_lastPingSeq = 0;
         }
     }
-    if (!isGps && !isPingReply)
+    if (!isGps && !isPingReply) {
         qCDebug(lcSmartLink) << "WAN RX:" << line;
+    }
 
     ParsedMessage msg = CommandParser::parseLine(line);
     emit messageReceived(msg);