Clarify or clear tee logs in telemetry forget

Summary

rtk telemetry forget deletes telemetry salt/marker data and the local history database, but it does not clear tee recovery logs. User-facing docs say telemetry forget deletes "all local data", while tee logs can contain raw command output.

This is a privacy/documentation hardening issue, not an accusation of malware.

Version / tag / commit

• Tag: v0.39.0
• Commit: 2fbc7514f6964acabcfac65501b8bb6b525e3aa8

Evidence

Tee logs can contain raw command output and are enabled by default:

• src/core/tee.rs:1 describes tee as raw output recovery.
• src/core/tee.rs:37-50 chooses RTK_TEE_DIR, config tee.directory, or default dirs::data_local_dir()/rtk/tee.
• src/core/tee.rs:76-102 writes only when enabled, mode permits it, output is at least 500 bytes, and exit status/mode match.
• src/core/tee.rs:105-146 writes the raw output content to a .log file, truncating at max_file_size.
• src/core/tee.rs:252-260 defaults tee to enabled, failures mode, max_files = 20, max_file_size = 1_048_576.
• src/core/tee.rs:193-228 force_tee_hint can write on successful-but-truncated output while still respecting RTK_TEE=0 and tee.enabled.

rtk telemetry forget does not remove tee logs:

• src/core/telemetry_cmd.rs:109-158 saves consent false, deletes .device_salt, deletes the telemetry marker, deletes history.db, and sends server erasure. It does not reference tee, RTK_TEE_DIR, tee.directory, or the tee directory.

Docs imply broader deletion than the implementation performs:

• README.md:436-439 documents rtk telemetry forget as "Withdraw consent + delete all local data + request server-side erasure".
• docs/guide/resources/telemetry.md:159 says rtk telemetry forget deletes local data and the local tracking database.
• docs/guide/getting-started/configuration.md:66-82 documents tee raw output and rotation, but does not document a clear command/path for deleting tee logs.

Duplicate search performed:

• gh issue list -R rtk-ai/rtk --search "telemetry forget tee logs local data"

No focused duplicate was found.

Impact

A user can run rtk telemetry forget expecting all local RTK data to be removed, while raw output recovery logs remain under the tee directory. Those logs may include command output from failing or truncated commands, including paths, environment-like text, logs, or other sensitive local data emitted by the underlying tool.

Verification steps

1. Inspect src/core/tee.rs to confirm tee log contents, default path, and defaults.
2. Inspect src/core/telemetry_cmd.rs:109-158 to confirm what forget deletes.
3. Inspect README and telemetry/configuration docs for the "all local data" wording and lack of tee cleanup docs.

Suggested mitigation

Either:

• include tee cleanup in rtk telemetry forget when claiming "all local data"; or
• narrow the docs to "telemetry salt/marker and tracking DB" and add a separate documented command or manual path for clearing tee logs.

If deleting tee logs automatically is too broad, consider adding rtk data clear --tee, rtk data clear --history, or equivalent explicit local-data controls.