Add app diagnostic report

[boudra]

Linked issue

Related: #1086

Type of change

• Bug fix
• New feature (with prior issue + design alignment)
• Refactor / code improvement
• Docs

What does this PR do

Adds a Settings > Diagnostics app diagnostic report that can be copied or refreshed.

The app report collects client/runtime details, desktop daemon status and log tail when running in desktop, saved host connection status, per-connection probe state, active host latency, server info, and daemon diagnostics for connected hosts that advertise the new capability.

The daemon adds a simple diagnostics.request / diagnostics.response RPC. Its collector returns process, runtime config, system, disk, agent, workspace, provider, tool, and daemon log-tail sections. Each section is isolated so one failure becomes a section error instead of failing the whole report, and the app/daemon both redact raw connection strings, relay endpoints, pairing URLs, and common token/key/password shapes.

How did you verify it

• npm run format
• npx vitest run packages/protocol/src/messages.test.ts packages/server/src/server/session/daemon/daemon-session.test.ts packages/app/src/diagnostics/app-diagnostic-report.test.ts --bail=1
• npm run typecheck
• npm run lint
• npm run build:server
• Isolated real daemon smoke:
  • started the built server with temp PASEO_HOME=/tmp/paseo-diag-smoke.qnDth8 on 127.0.0.1:65127, not the packaged daemon on 6767
  • connected with the built DaemonClient over ws://127.0.0.1:65127/ws
  • observed server_info.features.daemonDiagnostics === true
  • called measureLatency() and collectDiagnostics('diag-smoke')
  • observed diagnostics.response, the Paseo diagnostics header, the Daemon log tail section, and no raw 127.0.0.1:65127 leak in the returned report
• Web UI smoke against an isolated new daemon:
  • started a temp daemon on 127.0.0.1:61268
  • started Expo web from this worktree on http://localhost:8095 with temp app state and EXPO_PUBLIC_LOCAL_DAEMON=localhost:61268
  • opened /settings/diagnostics in Playwright, clicked Run, and verified the sheet rendered Paseo app diagnostics, daemon Paseo diagnostics, and Daemon log tail
  • daemon runtime metrics showed inbound diagnostics.request and outbound diagnostics.response
  • local screenshots captured at /tmp/paseo-app-diagnostic-settings-isolated.png and /tmp/paseo-app-diagnostic-sheet-isolated.png

Checklist

• One focused change. Unrelated cleanups split out.
• npm run typecheck passes
• npm run lint passes
• npm run format ran (Biome)
• UI changes include screenshots or video for every affected platform
• Tests added or updated where it made sense

[greptile-apps]

Greptile Summary

This PR adds a Settings > Diagnostics "App diagnostic" entry that collects client, desktop daemon, per-host connection, server info, latency, and daemon diagnostics into a copyable plain-text report.

• A new AppDiagnosticSheet component drives collection with a run-ID cancel token (runIdRef) to guard against concurrent runs; a diagnostics.request / diagnostics.response RPC pair is added to the protocol, wired through DaemonSession and advertised under the daemonDiagnostics server capability.
• Server-side, a new diagnostics.ts module collects process, system, disk, agent, workspace, provider, WebSocket runtime, tool, and log-tail sections with per-section isolation via safeSection, and both the app and server apply layered redaction of connection strings, relay endpoints, pairing URLs, and token/key patterns before the report is returned.
• websocket-server.ts captures each metrics flush as lastRuntimeMetricsSnapshot using a new WebSocketRuntimeDiagnosticSnapshot generic shape, which is forwarded into DaemonSession via a new getWebSocketRuntimeMetrics injection point.

Confidence Score: 5/5

Safe to merge. The run-ID cancel token correctly guards concurrent async runs, redaction is layered and tested on both sides, and section isolation prevents a single collection failure from breaking the whole report.

All new code paths have error isolation and the only realistic failure modes are surfaced gracefully. The two flagged items are edge-case UX polish that do not affect correctness, security, or data integrity.

No files require special attention. app-diagnostic-sheet.tsx has a minor silent-failure gap; diagnostics.ts has a partial-UTF-8 edge case in tailFile.

Important Files Changed

Filename	Overview
packages/app/src/components/app-diagnostic-sheet.tsx	New sheet component with run-ID cancel token guarding concurrent async runs; outer try/finally has no catch, so an unexpected failure leaves the progress view in a stale state.
packages/app/src/diagnostics/app-diagnostic-report.ts	Pure formatting and redaction helpers with layered strategy: exact-match split/join for known sensitive values, then regex patterns for pairing URLs and common secret key-value shapes.
packages/server/src/server/session/daemon/diagnostics.ts	New server-side diagnostic collector with per-section isolation via safeSection. tailFile reads the last 64 KiB of daemon.log with proper finally cleanup; partial UTF-8 edge case on the first line noted.
packages/server/src/server/session/daemon/daemon-session.ts	Adds handleDiagnosticsRequest and wires listAgents, listProjects, listWorkspaces, getWebSocketRuntimeMetrics injections. Error path emits a partial diagnostic response matching existing RPC error patterns.
packages/server/src/server/websocket-server.ts	Refactors inline metrics log payload into named loggedMetrics stored as lastRuntimeMetricsSnapshot for the diagnostics RPC, injected into every new Session via closure.
packages/protocol/src/messages.ts	Adds DiagnosticsRequestSchema and DiagnosticsResponseSchema (with .passthrough()), plus the daemonDiagnostics feature flag with a COMPAT comment and removal date.
packages/client/src/daemon-client.ts	Adds collectDiagnostics() using sendNamespacedCorrelatedSessionRequest, which merges the generated requestId into the message before schema parse — consistent with the existing RPC pattern.

_{Reviews (6): Last reviewed commit: "fix(loop): make stop cancellation test d..." | Re-trigger Greptile}