The archive stays sealed; the question still gets answered

The customer's diagnostic bundle is 12 GB. It arrives at your files URL as support/4417.tar.gz. The old move is a 12 GB extraction on a box that doesn't have 12 GB to spare, then a find for one log file.

Instead: GET /support/4417.tar.gz?preview. A JSON listing of every entry, no extraction. Then ?preview=logs/error.log, and the raw content of that one file streams back. The stack trace is on line 4,102. The archive on disk is untouched.

When you need the database too, ?extract_file&extract=db/ pulls that one directory and nothing else. When an agent works the ticket, the same two query strings are its tools.

Support used to start with decompressing someone else's disk. Now it starts with a path.