[CLI] Add Debug Diagnostics

[rasulkireev]

Summary

Readwise CLI runs can now produce a support-safe diagnostic trace on demand. Users can enable --debug or READWISE_CLI_DEBUG=1 and get a run_id, CLI/Node/platform metadata, phase timings, and sanitized error details on stderr without exposing tokens or full tool arguments.

The debug trace covers the paths that mattered in the recent CLI investigation: config load, token validation/refresh, OAuth network steps, MCP connect/list/call phases, and client shutdown. This keeps normal CLI output unchanged while giving support enough detail to separate local auth, MCP connection, and tool-call failures.

Testing

• npm test
• npm run build
• node dist/index.js --debug --version

Post-Deploy Monitoring & Validation

Validation window: first 48 hours after npm publish. Owner: CLI/support on-call.

Search terms/support artifacts to watch:

• [readwise-cli debug]
• READWISE_CLI_DEBUG=1
• run_id
• phase_error
• mcp.connect, mcp.listTools, mcp.callTool, oauth.refreshToken

Expected healthy signals:

• --debug and READWISE_CLI_DEBUG=1 produce structured JSON lines on stderr.
• Normal stdout remains usable for --json, --version, and command output.
• Debug artifacts include timings and sanitized error names/codes/statuses.
• Shared support logs do not include access tokens, refresh tokens, client secrets, authorization headers, or full tool arguments.

Failure signals and mitigation:

• Malformed debug JSON, missing run_id, or debug output on stdout: patch the CLI before broad support rollout.
• Any reported token/secret leakage in debug output: unpublish/deprecate the affected npm version if necessary and ship a sanitizer fix immediately.
• Debug mode changes command behavior or breaks scripts: ask affected users to disable debug and patch the affected phase wrapper.

---