patch: disable automatic variable dumps in file logs (#2047)

## Why

The file logger automatically includes variable values in exception
tracebacks, bypassing structured trace redaction and potentially
exposing request credentials. Addresses the automatic traceback dumps
reported in #2002.

## How

Set `diagnose=False` when creating file sinks. Exception chains, stack
traces, and explicitly logged context remain available. Automatic
variable annotations are disabled, so any additional diagnostic values
must be logged explicitly.


<!-- greptile_comment -->

<!-- greptile_summary -->

<h2><a
href="https://app.greptile.com/api/retrigger?id=78608416"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/RetriggerDark.svg?v=2"><source
media="(prefers-color-scheme: light)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/Retrigger.svg?v=2"><img
alt="Retrigger"
src="https://greptile-static-assets.s3.amazonaws.com/badges/Retrigger.svg?v=2"
align="right"></picture></a>Confidence Score: 5/5</h2>

<!-- greptile-impact-verdict --> Safe to merge. Executed checks
confirmed the credential protection without losing exception details or
explicit context.

<h2>T-Rex evidence</h2>

**[Command output from the
check](https://app.greptile.com/trex/artifacts/44936914-51ff-483f-9754-ab9db6797f1d)**

- Ran the prescribed focused test command before environment repair and
captured the missing-interpreter warning and pytest\_asyncio import
failure, showing an environment blocker rather than a PR defect.

**[Command output from the
check](https://app.greptile.com/trex/artifacts/947bf228-7b15-4b04-93c6-517557c46f3f)**

- Ran uv sync --frozen --group dev and captured its successful
installation output, showing that the test environment was restored.

**[Command output from the
check](https://app.greptile.com/trex/artifacts/89879f93-b2d8-403f-9be2-7ca43a40731c)**

- Reran the exact requested pytest command and captured 24 passing tests
with exit code 0, showing that the focused suite succeeds.

**[Evidence from the
check](https://app.greptile.com/trex/artifacts/ed90ce90-f7f5-463d-a5bf-cad7497dfca8)**

- Authored and executed this isolated harness against both Git revisions
with real file sinks, making the paired runtime observations
reproducible without tracked code changes.

**[Command output from the
check](https://app.greptile.com/trex/artifacts/3f4233df-0e62-40df-82ff-1ce0c64dc193)**

- Executed 16 parent-revision cases and captured their actual serialized
file records, showing synthetic local credentials exposed across both
logging routes and all four sink configurations.

**[Command output from the
check](https://app.greptile.com/trex/artifacts/dd8d06c4-0d2c-4215-8154-0c1c498c707f)**

- Executed the same 16 cases against the PR and captured their actual
serialized file records, showing automatic credentials omitted while
exception chains, frames, and explicit context remain.

**[Command output from the
check](https://app.greptile.com/trex/artifacts/18872c5f-f89f-4f68-9c81-de4081418efa)**

- Executed working-tree and staged diff checks plus git status after
validation, showing no tracked modifications.

<a
href="https://app.greptile.com/trex/runs/31063320/artifacts?artifact=44936914-51ff-483f-9754-ab9db6797f1d"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/ViewArtifactsDark.svg?v=4"><source
media="(prefers-color-scheme: light)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/ViewArtifacts.svg?v=4"><img
alt="View artifacts"
src="https://greptile-static-assets.s3.amazonaws.com/badges/ViewArtifacts.svg?v=4"></picture></a>

<details open><summary><h3>Summary</h3></summary>

File logs now use `diagnose=False` to stop automatic variable dumps in
exception traces.

- File exception logs keep failure details without dumping local values.
</details>

<!-- greptile_confidence_score:5 -->

<sub>Reviews (1) · Last reviewed commit: ["patch: disable automatic
variable dumps
..."](cd1550ba32)
· [Reviewed by
Greptile](https://www.greptile.com/?utm_source=greptile_expert&utm_medium=github&utm_campaign=code_reviews&utm_content=alishahryar1/free-claude-code)</sub>

<!-- /greptile_comment -->

src/free_claude_code/config/logging_config.py

@@ -71,6 +71,7 @@ def _add_file_sink(log_file: str | Path, level: str) -> int:
         log_path,
         level=level,
         serialize=True,
+        diagnose=False,
         encoding="utf-8",
         mode="a",
         rotation="50 MB",

tests/config/test_logging_config.py

@@ -76,6 +76,31 @@ def test_native_json_preserves_exception_chain_and_stack(tmp_path, stdlib):
     assert "test_native_json_preserves_exception_chain_and_stack" in row["text"]
 
 
+@pytest.mark.parametrize("stdlib", [False, True])
+def test_exception_logs_omit_local_values_but_keep_explicit_context(tmp_path, stdlib):
+    log_file = tmp_path / "exception.log"
+    configure_logging(log_file, force=True)
+    secret = "DUMMY_EXCEPTION_CREDENTIAL"
+    headers = {"Authorization": f"Bearer {secret}"}
+    try:
+        _ = len(headers) / 0
+    except ZeroDivisionError:
+        with logger.contextualize(attempt=2):
+            if stdlib:
+                logging.getLogger("test.exception").exception("request failed")
+            else:
+                logger.exception("request failed")
+    logger.complete()
+
+    text = log_file.read_text(encoding="utf-8")
+    assert secret not in text
+    row = json.loads(text)
+    assert row["record"]["extra"]["attempt"] == 2
+    assert row["record"]["message"] == "request failed"
+    assert row["record"]["exception"]["traceback"] is True
+    assert "ZeroDivisionError: division by zero" in row["text"]
+
+
 def test_logging_preserves_records_across_process_restarts(tmp_path):
     log_file = tmp_path / "server.log"
     script = """