[Improvement] omacase debug — one-command support bundle

[splaice]

Quattro feature

Omarchy 4 ships omarchy-debug, collecting diagnostic data into one artifact for support (their Discord). It exists because "run doctor and paste these five other things" doesn't scale past the maintainer's own machines.

Omacase fit

Everything the bundle needs already has a producer: omacase doctor output, omacase version + git SHA/channel, brew bundle check result, OmniWM version + omniwmctl ping, LaunchAgent states (launcher/usage), theme + wallpaper state, recent migrate/update markers, tail of tracker.log. What's missing is one command that gathers them with secrets scrubbed.

Proposed shape

• omacase debug → writes ~/Desktop/omacase-debug-<ts>.txt (or stdout with -): sections per source above, each failure-tolerant
• Scrub rules stated in the header: no tokens, no Keychain access, usage records summarized as counts only, $HOME replaced with ~
• Completion + menu entry; README one-liner

Scope

Future release; becomes valuable the day Omacase has its second user. Small, independent.

🤖 Generated with Claude Code

[splaice]

Implementation plan

Self-contained; needs only this comment and the repo.

Background

One command that gathers a scrubbed support bundle. Producers all exist: omacase doctor (lib/doctor.sh), omacase version (VERSION), git state ($OMACASE_ROOT), brew bundle check, OmniWM (omniwmctl ping, cask version), LaunchAgent states (launchctl print gui/$UID/<label> — labels from #15's registry if landed, else hardcode launcher/usage), theme state ($OMACASE_STATE/theme, wallpaper marker), migrate marker (migrations-last), update markers, tail -50 of ~/.local/state/omacase/usage/tracker.log.

Change — lib/debug.sh (new): omacase debug [-]

• Default: write ~/Desktop/omacase-debug-<YYYYmmdd-HHMMSS>.txt and print the path; - → stdout.
• Sections, each produced by a small _debug_<name> function wrapped in a failure-tolerant runner (_debug_section <title> <fn>: header + fn output, || echo "(failed)" — a broken subsystem is exactly when debug runs, so nothing may abort; do NOT use run, this is read-only).
  1. system: macOS version (sw_vers), arch, hostname (scrubbed to first 8 chars + …), date.
  2. omacase: VERSION, git -C "$OMACASE_ROOT" rev-parse --short HEAD + status --porcelain | wc -l (count only, not paths), channel env if [Security] Add integrity and version controls to updates and mutable dependencies #9 landed.
  3. doctor: full omacase_doctor output captured (source lib/doctor.sh, run in-process).
  4. brew: brew bundle check --file=… result + brew outdated --quiet | wc -l count.
  5. omniwm: cask version (brew list --cask --versions omniwm), omniwmctl ping result, process uptime (ps -o etime= -p $(pgrep -x OmniWM)).
  6. launchd: per label — plist present, launchctl print exit status (status only, not the full dump — it contains env vars).
  7. state: theme name, wallpaper index, migrations-last, last-backup id, usage records' ages (find -mmin buckets — ages only, no contents).
  8. logs: last 50 lines of tracker.log passed through the scrubber.
• Scrub rules (one _debug_scrub sed filter applied to every section's output, stated in the file header): $HOME → ~; the username → <user>; anything matching (token|secret|key|bearer)[=:] *\S+ → <redacted>; no Keychain access anywhere; usage records summarized as ages/counts only.
• Wiring: bin/omacase usage + dispatch; completion entry; lib/menu.sh "Collect debug bundle".

Tests

1. test_debug_bundle_has_sections_and_no_home_paths: temp HOME sandbox with stubs (brew, omniwmctl, launchctl, sw_vers, ps, pgrep shimmed); omacase debug - → contains each section header; contains NO literal $HOME string and NO real username.
2. test_debug_scrubber: feed a line token=abc123 SECRET: hunter2 /Users/<user>/x through _debug_scrub → all three redacted/rewritten.
3. test_debug_survives_broken_producers: shim everything to fail → command still exits 0 and every section prints (failed) rather than dying.
4. Wiring greps: usage/completion/menu.

Verification / done criteria

Suite green; shellcheck clean. Live: omacase debug writes a bundle; open it and manually confirm: no username, no absolute home paths, no tokens, doctor section matches a direct omacase doctor run. omacase debug - | wc -l sane (< ~300 lines).

Branch + PR; body says Closes #26. Independent — land anytime.