fix: enable --debug for all CLI commands with enhanced debug output

[tomaz-lc]

Details

Previously, --debug only worked for the sync command. This PR fixes --debug to work across all 39+ CLI commands by wiring the debug parameters (print_debug_fn, debug_full_response, debug_curl, debug_verbose) through every command module's _get_org/_get_client helper.

Additionally, the Client now provides three debug output modes:

• --debug - verbose request/response logging to stderr (headers + truncated body)
• --debug-full - like --debug but does not truncate response bodies
• --debug-curl - prints reproducible curl commands for each request

All modes can be combined. Sensitive headers (Authorization, X-Api-Key, Cookie) are masked in verbose output. Curl output uses shlex.quote() for shell safety.

Sample debug output

$ limacharlie --debug search run --query "* | * | *" --end 1773232249 --start 1773231649

2026-03-15 20:46:36Z: JWT cache: checking /home/<user>/.limacharlie_jwt_cache
2026-03-15 20:46:36Z: JWT cache: hit, reusing cached token (expires in 492607s, 8210m)
2026-03-15 20:46:36Z: JWT: reusing current token (136.8h remaining >= 4.0h requested)
2026-03-15 20:46:36Z: --- request GET https://api.limacharlie.io/v1/orgs/<OID>/url ---
  User-agent: lc-cli/5.0.10;python-3.11.2;debian-12;openssl-3.0.0
2026-03-15 20:46:36Z: --- response 200 ---
  access-control-allow-headers: Content-Type, authorization
  access-control-allow-methods: OPTIONS, GET, POST, DELETE, PUT, HEAD, PATCH
  access-control-allow-origin: *
  access-control-expose-headers: x-request-id
  content-type: application/json
  vary: Accept-Encoding
  x-request-id: <REQUEST-ID>
  x-cloud-trace-context: <TRACE-ID>;o=1
  date: Sun, 15 Mar 2026 20:46:38 GMT
  server: Google Frontend
  Content-Length: 585
  Connection: close
  body: {"certs":{"<SITE-PREFIX>.lc.limacharlie.io":"<CERT-HASH>"},
        "site_name":"...","url":{"lc":"<SITE-PREFIX>.lc.limacharlie.io",
        "search":"<SITE-PREFIX>.replay-search.limacharlie.io",
        "region_code":"northamerica-northeast1",...}}
2026-03-15 20:46:36Z: --- request POST https://<SITE-PREFIX>.replay-search.limacharlie.io/v1/search ---
  Authorization: Bearer eyJhb...REDACTED
  User-agent: lc-cli/5.0.10;python-3.11.2;debian-12;openssl-3.0.0
  Content-type: application/json
  body: {"oid": "<OID>", "query": "* | * | *", "startTime": "1773231649",
        "endTime": "1773232249", "paginated": true}
2026-03-15 20:46:38Z: --- response 200 ---
  content-type: application/json
  x-service-version: v1.82.0+8e891fc
  x-cloud-trace-context: <TRACE-ID>;o=1
  date: Sun, 15 Mar 2026 20:46:39 GMT
  server: Google Frontend
  Content-Length: 102
  Connection: close
  body: {"queryId":"<QUERY-ID>","completed":false,"nextPollInMs":1000,"results":[]}

Large responses are automatically truncated (default 2048 chars). Use --debug-full to see the complete body:

2026-03-15 20:48:35Z: --- request GET https://<SITE-PREFIX>.replay-search.limacharlie.io/v1/search/<QUERY-ID> ---
  Authorization: Bearer eyJhb...REDACTED
  User-agent: lc-cli/5.0.10;python-3.11.2;debian-12;openssl-3.0.0
2026-03-15 20:48:36Z: --- response 200 ---
  content-type: application/json
  x-service-version: v1.82.0+8e891fc
  date: Sun, 15 Mar 2026 20:48:37 GMT
  server: Google Frontend
  Transfer-Encoding: chunked
  Connection: close
  body: {"queryId":"<QUERY-ID>","completed":true,"nextPollInMs":1000,
        "results":[{"searchResultId":"<RESULT-ID>","created":"2026-03-15T20:48:35.874",
        "type":"events","rows":[{"mtd":{"id":"<EVENT-ID>","ts":1773231651016,
        "stream":"event"},"data":{"event":{"EVENT":{"System":{"Channel":
        "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational",
        "Computer":"demo-win-2016","EventID":"261",...}}}},
        "routing":{"oid":"<OID>","sid":"<SID>","hostname":"demo-win-2016...",
        "ext_ip":"<IP>","int_ip":"<IP>","event_type":"WEL",
        "tags":["demo","demo-windows","windows","windows server",...]}},
        ... [truncated, 2665679 chars total, use --debug-full to see all]

Blast radius / isolation

• Affected: All 39+ command modules in limacharlie/commands/ - each had a one-line change to pass 4 debug kwargs to Client(). The Client class in client.py gained 3 new methods (_debug_request, _debug_response, _debug_curl_cmd) and header masking logic.
• NOT affected: SDK classes, API behavior, non-debug code paths. When --debug is not passed, print_debug_fn=None and all debug methods are no-ops.

Performance characteristics

Zero overhead when debug flags are not set - all debug methods early-return when _debug_fn is None. When active, the only cost is string formatting and stderr writes per HTTP request.

Notable contracts / APIs

No changes to wire formats, API contracts, or data schemas. The Client.__init__ signature gains 3 new optional kwargs (debug_full_response, debug_curl, debug_verbose) - all with backwards-compatible defaults.

Test plan

• 119 new integration tests in test_debug_flag_integration.py:
  • Source-level AST inspection of all command modules for debug param wiring
  • CLI integration tests via CliRunner for 12 representative commands across all debug modes
  • Flag combination tests (all permutations of --debug, --debug-full, --debug-curl)
  • Position flexibility tests (--debug before/after/between subcommand names)
  • Hive shortcut commands (secret, fp, playbook, note, sop, lookup)
  • Completeness meta-test scanning for any bare Client() calls missing debug params
• 66 unit tests in test_debug_logging.py for Client-level debug methods
• All 1471 existing tests pass

🤖 Generated with Claude Code