feat(debug): wire LLM debug logger end-to-end

The debug-logger.ts module existed but was completely orphaned — none of
its functions had any callsites, so DISPATCH_DEBUG_LLM=1 did nothing.

Wires it in across the stack:

- llm/debug-logger.ts: add wrapFetchWithLogging() that tees SSE bodies via
  TransformStream + response.clone() so we capture every chunk without
  draining the body the AI SDK consumes. Redacts authorization / x-api-key
  / cookie headers in logs. Also exports nextDebugSeq() so requests and
  log files share an id.
- llm/provider.ts: all 3 factories (Claude OAuth, plain-API-key Anthropic,
  OpenAI-compatible) now pass fetch: wrapFetchWithLogging(globalThis.fetch).
  For Claude OAuth the wrap goes on the inner base fetch so logged bodies
  reflect the post-transform shape + Claude-Code session headers. Added
  tabId to ProviderConfig for log labelling.
- agent/agent.ts: threads tabId through createProvider and emits
  logAgentLoop / logStepLifecycle / logStreamEvent at every meaningful
  point in the run loop — step start/end, tool count, every fullStream
  event. All are no-ops when DISPATCH_DEBUG_LLM is unset.
- core/index.ts: re-exports the debug helpers.
- tests/llm/provider.test.ts: switch one full-object equality assertion
  to property assertions so the test survives the new fetch: wrapper.

Plumbing the env var into the container required three more fixes:

- bin/up: re-export DISPATCH_DEBUG_LLM* so docker compose forwards them
  (compose only forwards vars referenced in the environment: block).
  Also pre-creates /tmp/dispatch/llm-debug and chowns it on first run so
  the container's UID-1000 bun process can write into it without EACCES.
- docker-compose.yml: declare the debug vars on api.environment and
  bind-mount /tmp/dispatch/llm-debug:/tmp/dispatch/llm-debug so logs are
  inspectable from the host without docker exec.
- docker/entrypoint.dev.sh: explicitly forward DISPATCH_DEBUG_* through
  the 'su -' login-shell barrier — su - resets the environment to TERM/
  PATH/HOME/SHELL/USER/LOGNAME only, silently stripping everything else.
  This is why the vars appeared via 'docker exec env' (which spawns a
  new process inheriting the container env) but were absent from the
  actual bun process's /proc/<pid>/environ.

bin/build: drop stray sudo for consistency with bin/up and bin/down.

1 files changed, 10 insertions, 5 deletions

diff --git a/packages/core/tests/llm/provider.test.ts b/packages/core/tests/llm/provider.test.ts
index 12b6350..c8c0877 100644
--- a/packages/core/tests/llm/provider.test.ts
+++ b/packages/core/tests/llm/provider.test.ts
@@ -59,11 +59,16 @@ describe("createProvider (default OpenAI-compatible path)", () => {
 			baseURL: "https://opencode.ai/zen/v1",
 		})("deepseek-v4-pro");
 
-		expect(mockCreateOpenAICompatible).toHaveBeenCalledWith({
-			name: "opencode-zen",
-			apiKey: "zen-key",
-			baseURL: "https://opencode.ai/zen/v1",
-		});
+		// We assert by property rather than full-object equality because the
+		// provider also passes a `fetch:` wrapper (the debug-logger tee). The
+		// load-bearing wiring is name/apiKey/baseURL; the fetch field is
+		// tested separately via the wrap-fetch tests.
+		expect(mockCreateOpenAICompatible).toHaveBeenCalledOnce();
+		const zenArgs = mockCreateOpenAICompatible.mock.calls[0]?.[0] as Record<string, unknown>;
+		expect(zenArgs.name).toBe("opencode-zen");
+		expect(zenArgs.apiKey).toBe("zen-key");
+		expect(zenArgs.baseURL).toBe("https://opencode.ai/zen/v1");
+		expect(typeof zenArgs.fetch).toBe("function");
 	});
 });