feat(debug): wire LLM debug logger end-to-end

The debug-logger.ts module existed but was completely orphaned — none of
its functions had any callsites, so DISPATCH_DEBUG_LLM=1 did nothing.

Wires it in across the stack:

- llm/debug-logger.ts: add wrapFetchWithLogging() that tees SSE bodies via
  TransformStream + response.clone() so we capture every chunk without
  draining the body the AI SDK consumes. Redacts authorization / x-api-key
  / cookie headers in logs. Also exports nextDebugSeq() so requests and
  log files share an id.
- llm/provider.ts: all 3 factories (Claude OAuth, plain-API-key Anthropic,
  OpenAI-compatible) now pass fetch: wrapFetchWithLogging(globalThis.fetch).
  For Claude OAuth the wrap goes on the inner base fetch so logged bodies
  reflect the post-transform shape + Claude-Code session headers. Added
  tabId to ProviderConfig for log labelling.
- agent/agent.ts: threads tabId through createProvider and emits
  logAgentLoop / logStepLifecycle / logStreamEvent at every meaningful
  point in the run loop — step start/end, tool count, every fullStream
  event. All are no-ops when DISPATCH_DEBUG_LLM is unset.
- core/index.ts: re-exports the debug helpers.
- tests/llm/provider.test.ts: switch one full-object equality assertion
  to property assertions so the test survives the new fetch: wrapper.

Plumbing the env var into the container required three more fixes:

- bin/up: re-export DISPATCH_DEBUG_LLM* so docker compose forwards them
  (compose only forwards vars referenced in the environment: block).
  Also pre-creates /tmp/dispatch/llm-debug and chowns it on first run so
  the container's UID-1000 bun process can write into it without EACCES.
- docker-compose.yml: declare the debug vars on api.environment and
  bind-mount /tmp/dispatch/llm-debug:/tmp/dispatch/llm-debug so logs are
  inspectable from the host without docker exec.
- docker/entrypoint.dev.sh: explicitly forward DISPATCH_DEBUG_* through
  the 'su -' login-shell barrier — su - resets the environment to TERM/
  PATH/HOME/SHELL/USER/LOGNAME only, silently stripping everything else.
  This is why the vars appeared via 'docker exec env' (which spawns a
  new process inheriting the container env) but were absent from the
  actual bun process's /proc/<pid>/environ.

bin/build: drop stray sudo for consistency with bin/up and bin/down.

1 files changed, 10 insertions, 0 deletions

diff --git a/docker-compose.yml b/docker-compose.yml
index c1b009f..aedd0f2 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -11,6 +11,11 @@ services:
       - ${HOME}/.local/share/dispatch:/home/${HOST_USER:-dispatch}/.local/share/dispatch
       - ${HOME}/.skills:/home/${HOST_USER:-dispatch}/.skills
       - ${HOME}/.config/dispatch:/home/${HOST_USER:-dispatch}/.config/dispatch
+      # Surface LLM debug logs on the host so they're inspectable without
+      # `docker exec`. The container path is fixed to the same default the
+      # debug-logger uses (DISPATCH_DEBUG_LLM_DIR), so on the host you can
+      # `tail -F /tmp/dispatch/llm-debug/*.json` while running.
+      - /tmp/dispatch/llm-debug:/tmp/dispatch/llm-debug
     env_file:
       - .env.dispatch
     environment:
@@ -18,6 +23,11 @@ services:
       HOST_GID: ${HOST_GID:-1000}
       HOST_USER: ${HOST_USER:-dispatch}
       DISPATCH_WORKING_DIR: /app
+      # Debug logger — forwarded from host via bin/up. When unset, the logger
+      # is a no-op (early-return on the !ENABLED guard in debug-logger.ts).
+      DISPATCH_DEBUG_LLM: ${DISPATCH_DEBUG_LLM:-}
+      DISPATCH_DEBUG_LLM_VERBOSITY: ${DISPATCH_DEBUG_LLM_VERBOSITY:-}
+      DISPATCH_DEBUG_USAGE: ${DISPATCH_DEBUG_USAGE:-}
 
   frontend:
     build: