feat(debug): debug mode that survives a crash, and altimate debug bundle (#1409)

* feat(debug): debug mode that survives a crash, and `altimate debug bundle`

When Altimate Code hung or closed, neither opencode.log nor telemetry showed what
it was doing: tool calls were not logged, the log never recorded the version,
and telemetry only reports an attempt once it finishes.

Debug mode (`ALTIMATE_DEBUG=1`):
- every tool call is written to opencode.log when it starts and ends, with its
  duration; while a call runs, a heartbeat line every 15 s names what is still in
  progress. Lines are appended synchronously, so the last ones survive a hang the
  user kills or a crash;
- raises the log level to DEBUG unless `--log-level` is given.

Always on:
- one line per process start (main and TUI worker) with version, OS, terminal,
  TTY and whether debug mode is on;
- every event-loop stall is written to the log (before the telemetry cap).

`altimate debug bundle [--output <path>] [--no-network]` writes one Markdown
report that leads with detected problems in plain language, then the evidence:
version and install method, OS and terminal, proxy hosts, settings in the
environment (names only), telemetry state, the Altimate account, warehouse
connections (type, sign-in method, field names, and whether a password is
actually retrievable), MCP servers, reachability of the hosts this install uses,
a log summary (runs that ended mid-tool, connection failures, MCP start failures,
starts per day, stalls, repeated warnings) and the last 300 log lines. Passwords,
keys, tokens, PEM blocks, emails, URL queries, the home folder and the user name
are removed from the whole report. It is written locally; nothing is uploaded.

`fileLog` appends lines to opencode.log in the Effect logger's format: `Log.create`
writes to stderr only with print-logs on, so it could not serve either purpose.

Docs: troubleshooting "Debug Mode" rewritten; `debug` and `ALTIMATE_DEBUG` in the
CLI reference.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018fJ3X7pcGT4R9yzjsJnqsV

* fix(debug): redact every secret form, judge connections as the driver sees them, and run without starting the project (review)

Consensus review fixes.

Redaction:
- A secret key is matched as a suffix in any case (`client_secret`,
  `access_token`, `PGPASSWORD`, `aws_secret_access_key`, `accessToken`).
- Quoted values are removed whole.
- Queries are removed from any `scheme://` URL, and `scheme://user:secret@`
  loses the secret.
- The computer's name is removed too.
- A user name that is an ordinary word ("code") is replaced only where it
  is used as a name.

Connections:
- Each connection is classified with its secrets filled back in from the
  credential store, so working token, key-pair, BigQuery key-file and
  connection-string connections are no longer "missing a password".
- BigQuery with no key file (default credentials) is not a problem.

`debug bundle`:
- Runs without a project instance, so a hang in plugins, LSP or snapshots
  cannot hang it, and it does not write into the log it reads.
- MCP servers are read straight from the config files.
- `--no-network` now means no network at all: telemetry is not started.
- Telemetry status waits for telemetry to finish starting; telemetry is
  probed only when on, at its configured endpoint.
- One deadline covers DNS too; DNS is skipped behind a proxy.
- Only HTTPS warehouses are probed (Snowflake, Databricks), and the docs
  now say so.
- The report is written readable by the owner only (0600).

Unfinished tool calls:
- One counts as a crash only when the process that ran it has ended (pid
  from the start line).
- One in a still-running process is not reported; one with no pid is a
  warning marked unconfirmed.
- The trace ends before the tool title is built, so a throwing label
  cannot leave a finished call "running".
- The heartbeat stops when nothing is running, and fallback call ids use a
  counter.

Tests: redaction forms, liveness, connection classification, probe
deadline and proxy, MCP config reading.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018fJ3X7pcGT4R9yzjsJnqsV

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: sahrizvi

docs/docs/reference/troubleshooting.md

@@ -245,13 +245,35 @@ Or manually compact in the TUI: leader + `Shift+C`.
 
 ## Debug Mode
 
-Run with full debug output:
+When something goes wrong that is hard to reproduce (a hang, Altimate Code closing unexpectedly, a connection that fails sometimes), turn on debug mode, reproduce the problem, then create a diagnostic report.
+
+**1. Turn on debug mode** for the session where you will reproduce the problem:
 
 ```bash
-altimate --print-logs --log-level DEBUG 2>debug.log
+# macOS / Linux
+ALTIMATE_DEBUG=1 altimate
+
+# Windows (PowerShell)
+$env:ALTIMATE_DEBUG = "1"; altimate
+```
+
+In debug mode the log records every tool call as it starts and ends, and while one is running, a line every 15 seconds naming what is still in progress. Lines are written as they happen, so if Altimate Code hangs or closes, the log still shows what it was doing.
+
+**2. Create the report** after the problem has happened:
+
+```bash
+altimate debug bundle
 ```
 
-Then share `debug.log` when reporting issues.
+This writes `altimate-debug-report-<time>.md` in the current folder (use `--output <path>` to choose another place). It lists the problems it detected first, then the evidence: version and install method, operating system and terminal, warehouse connections (names, types, sign-in method and which fields are set, never values), MCP servers, a summary of the log, and the last 300 log lines. It also checks that the Snowflake and Databricks warehouses, the Altimate API, the telemetry endpoint (when telemetry is on) and the model catalogue this installation uses are reachable over HTTPS. Add `--no-network` and the command makes no network requests at all, telemetry included. It does not start your project (plugins, language servers), so it still works when that is what hangs. The file is readable only by you.
+
+Passwords, keys, tokens and other secret settings (in any `name=value`, JSON or connection-URL form), email addresses, URL parameters, your home folder, your user name and your computer's name are removed. The report stays on your machine: read it, then send it to Altimate support yourself.
+
+For raw logs printed to the terminal instead:
+
+```bash
+altimate --print-logs --log-level DEBUG 2>debug.log
+```
 
 ## Getting Help
 

docs/docs/usage/cli.md

@@ -43,6 +43,7 @@ altimate --agent analyst
 | `trace`     | List and view session traces (recordings of agent sessions) |
 | `github`    | GitHub integration             |
 | `pr`        | Pull request tools             |
+| `debug`     | Troubleshooting tools -- `debug bundle` writes a diagnostic report to send to support; see [Debug Mode](../reference/troubleshooting.md#debug-mode) |
 | `upgrade`   | Upgrade to latest version      |
 | `uninstall` | Uninstall altimate             |
 
@@ -79,6 +80,7 @@ Configuration can be controlled via environment variables:
 | Variable                      | Description                  |
 | ----------------------------- | ---------------------------- |
 | `ALTIMATE_CLI_CONFIG`         | Path to custom config file   |
+| `ALTIMATE_DEBUG`              | `1` turns on debug mode: every tool call and a heartbeat for long ones are recorded in the log (see [Debug Mode](../reference/troubleshooting.md#debug-mode)) |
 | `ALTIMATE_CLI_CONFIG_DIR`     | Custom config directory      |
 | `ALTIMATE_CLI_CONFIG_CONTENT` | Inline config as JSON string |
 | `ALTIMATE_CLI_GIT_BASH_PATH`  | Path to Git Bash (Windows)   |