@remcp/remcp 0.2.233 → 0.2.235

package/README.md

@@ -90,7 +90,7 @@ permission, and `remcp doctor` reports the state of each one.
 
 ## Updates
 
-The agent asks the server which versions it should run on every successful connection and every six hours, installs the exact trusted client/runtime release pair in the background, and restarts the managed service so it takes effect. The updater resolves itself and the sibling runtime from the package that is actually running instead of depending on an interactive shell PATH. When a computer has several Node.js environments (for example NVM, FNM or a system installation), ReMCP updates only the canonical managed service packages. It does not upgrade Node.js, rewrite unrelated npm packages, or silently remove old ReMCP copies. `remcp status` counts package roots verified from the current CLI/service and bounded installation history; aliases and vanished paths are not extra installations. `remcp doctor` adds the exact read-only package roots, corresponding client/runtime versions, aliases and historical/cache classifications. These are **physical package copies, not a count of running agents**. Old copies are never automatically removed; verifying process, startup and script dependencies is required before an explicit owner-approved cleanup. A failed install is retried no more often than every thirty minutes and update-check failures are logged, so a broken release cannot become a silent install loop. `remcp update` does the same immediately; `remcp auto-update off` disables automatic checks.
+The agent checks the server on a stable per-device phase within a 30-minute cycle, rather than on every reconnect. New automatic installs are spread over a deterministic 24-hour window per version; older unattended clients are admitted through a shared Redis budget of 120 update hints per minute. The exact trusted client/runtime release pair is installed in the background and the managed service restarts to apply it. An explicit manual `remcp update` remains immediate. The updater resolves itself and the sibling runtime from the package that is actually running instead of depending on an interactive shell PATH. When a computer has several Node.js environments (for example NVM, FNM or a system installation), ReMCP updates only the canonical managed service packages. It does not upgrade Node.js, rewrite unrelated npm packages, or silently remove old ReMCP copies. `remcp status` counts package roots verified from the current CLI/service and bounded installation history; aliases and vanished paths are not extra installations. `remcp doctor` adds the exact read-only package roots, corresponding client/runtime versions, aliases and historical/cache classifications. These are **physical package copies, not a count of running agents**. Old copies are never automatically removed; verifying process, startup and script dependencies is required before an explicit owner-approved cleanup. A failed install is retried no more often than every thirty minutes and update-check failures are logged, so a broken release cannot become a silent install loop. `remcp update` does the same immediately; `remcp auto-update off` disables automatic checks.
 
 ## Computer-use routing
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.233",
+  "version": "0.2.235",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "README.md"
   ],
   "scripts": {
-    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/installation-audit.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/supervised-agent-lifecycle.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-cli-shim.mjs && node --check src/cli/windows-owned-job-source.mjs && node --check src/cli/windows-owned-job.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/cli/windows-update-lock.mjs && node --check src/cli/windows-user-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
+    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update-rollout.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/installation-audit.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/supervised-agent-lifecycle.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-cli-shim.mjs && node --check src/cli/windows-owned-job-source.mjs && node --check src/cli/windows-owned-job.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/cli/windows-update-lock.mjs && node --check src/cli/windows-user-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {

package/src/agent-relay-connection.mjs

@@ -9,6 +9,8 @@ import { nextDeployReconnect } from './agent-deploy-reconnect.mjs';
 const RECONNECT_BASE_MS = 2_000;
 const RECONNECT_FIRST_MS = 500;
 const RECONNECT_MAX_MS = 60_000;
+const HEARTBEAT_INTERVAL_MS = 15_000;
+const HANDSHAKE_TIMEOUT_MS = 12_000;
 // Higher-level agent owns runtime supervision/telemetry; this controller owns only relay transport.
 export function createAgentRelayConnection({
   agentUrl, serverUrl, deviceToken, deviceId, deviceName,
@@ -16,6 +18,8 @@ export function createAgentRelayConnection({
   setSocket, getHelloState, respond, inFlight,
   sendMetricsSample, reportInstallOnce, flushTelemetry,
   checkForUpdate, schedulePostConnectUpdateChecks, clearPostConnectUpdateChecks, stop,
+  checkUpdatesOnConnect = false,
+  heartbeatIntervalMs = HEARTBEAT_INTERVAL_MS, handshakeTimeoutMs = HANDSHAKE_TIMEOUT_MS,
 }) {
   let revoked = false;
   let reconnectTimer = null;
@@ -24,6 +28,13 @@ export function createAgentRelayConnection({
   let requestedReconnectReason = '';
   let connectedAt = 0;
   let rapidDeployDisconnects = 0;
+  // Timing overrides are used only by isolated transport regression tests.
+  const heartbeatInterval = Number.isFinite(heartbeatIntervalMs) && heartbeatIntervalMs >= 20
+    ? Math.min(60_000, Math.floor(heartbeatIntervalMs)) : HEARTBEAT_INTERVAL_MS;
+  const handshakeTimeout = Number.isFinite(handshakeTimeoutMs) && handshakeTimeoutMs >= 100
+    ? Math.min(120_000, Math.floor(handshakeTimeoutMs)) : HANDSHAKE_TIMEOUT_MS;
+  let clearActiveHeartbeat = () => {};
+  let activeSocket = null;
   function scheduleReconnect(delay) {
     if (isStopping() || revoked || reconnectTimer) return;
     // Keep the upper-bound guard in control flow immediately before the timer sink. CodeQL's
@@ -60,15 +71,35 @@ export function createAgentRelayConnection({
   }
 
   function connect() {
-    if (isStopping()) return;
+    if (isStopping() || revoked) return;
+    if (activeSocket && (activeSocket.readyState === WebSocket.OPEN ||
+      activeSocket.readyState === WebSocket.CONNECTING)) return;
     // The device token is intentionally sent only to the configured ReMCP relay during the
     // authenticated WebSocket handshake.
     // codeql[js/file-access-to-http]
-    const ws = new WebSocket(agentUrl, { headers: { Authorization: `Bearer ${deviceToken}` } });
+    const ws = new WebSocket(agentUrl, {
+      headers: { Authorization: `Bearer ${deviceToken}` },
+      handshakeTimeout,
+    });
+    activeSocket = ws;
+    let heartbeatTimer = null;
+    let awaitingPong = false;
+    function clearHeartbeat() {
+      if (heartbeatTimer) clearInterval(heartbeatTimer);
+      heartbeatTimer = null;
+    }
+    clearActiveHeartbeat = clearHeartbeat;
     // The ws client leaves cleanup/retry to the caller when an unexpected-response listener exists.
     // A temporary workspace pause therefore needs an explicit retry; otherwise the first 423 leaves
     // this WebSocket stuck in CONNECTING forever and turning the device back on cannot recover it.
     ws.on('unexpected-response', (request, response) => {
+      if (activeSocket !== ws) {
+        response.resume();
+        request.destroy();
+        return;
+      }
+      activeSocket = null;
+      setSocket(null);
       const handshakeRevoked = String(response.headers['x-remcp-revoked'] || '') === '1';
       const handshakeDisabled = String(response.headers['x-remcp-disabled'] || '') === '1';
       if (handshakeRevoked) revoked = true;
@@ -82,23 +113,42 @@ export function createAgentRelayConnection({
         scheduleReconnect(jitter(RECONNECT_BASE_MS));
         return;
       }
-      const status = Number(response.statusCode || 0);
-      const transientHandshakeFailure = status === 408 || status === 425 || status === 429 || (status >= 500 && status <= 599);
-      if (transientHandshakeFailure && !revoked) {
-        // A reverse proxy or relay deploy can refuse the HTTP upgrade before a WebSocket exists.
-        // With an unexpected-response listener the client does not reliably emit close afterwards,
-        // so this branch must schedule its own retry or a still-running agent can stay offline forever.
+      if (!revoked) {
+        // Even a captive-portal redirect or unexpected proxy rejection may be temporary.
+        // ws does not reliably emit close with an unexpected-response listener, so retry
+        // all non-revocation failures with bounded backoff rather than staying offline forever.
+        // The explicit revocation signal above remains final and cannot be bypassed.
         scheduleBackoffReconnect();
       }
     });
     setSocket(ws);
     ws.on('open', () => {
+      if (activeSocket !== ws || isStopping()) {
+        ws.terminate();
+        return;
+      }
       connectedAt = Date.now();
       if (reconnectTimer) {
         clearTimeout(reconnectTimer);
         reconnectTimer = null;
       }
       setReconnects(0);
+      // A network switch can strand a TCP/WebSocket session without close or error.
+      // Probe relay liveness client-side and terminate a stale socket to reconnect.
+      heartbeatTimer = setInterval(() => {
+        if (ws.readyState !== WebSocket.OPEN) return;
+        if (awaitingPong) {
+          console.error('ReMCP relay heartbeat timeout; terminating stale connection.');
+          ws.terminate();
+          return;
+        }
+        awaitingPong = true;
+        try { ws.ping(); } catch {
+          console.error('ReMCP relay ping failed; terminating stale connection.');
+          ws.terminate();
+        }
+      }, heartbeatInterval);
+      heartbeatTimer.unref?.();
       sendRelayMessage(ws, {
         type: 'hello',
         deviceId,
@@ -114,10 +164,14 @@ export function createAgentRelayConnection({
       sendMetricsSample();
       reportInstallOnce();
       flushTelemetry();
-      void checkForUpdate();
+      // Normal fleet clients poll on a stable per-device phase, not all on
+      // every relay handshake. Explicit short QA rechecks retain hot-path coverage.
+      if (checkUpdatesOnConnect) void checkForUpdate();
       schedulePostConnectUpdateChecks();
     });
+    ws.on('pong', () => { if (activeSocket === ws) awaitingPong = false; });
     ws.on('message', raw => {
+      if (activeSocket !== ws) return;
       let message;
       try { message = JSON.parse(raw.toString()); } catch { return; }
       if (message?.type === 'reconnect') {
@@ -134,6 +188,10 @@ export function createAgentRelayConnection({
       }
     });
     ws.on('close', code => {
+      clearHeartbeat();
+      if (activeSocket !== ws) return;
+      activeSocket = null;
+      setSocket(null);
       clearPostConnectUpdateChecks();
       for (const controller of inFlight.values()) controller.abort();
       if (isStopping()) return;
@@ -173,6 +231,10 @@ export function createAgentRelayConnection({
 
   return {
     connect,
-    clearReconnect() { if (reconnectTimer) clearTimeout(reconnectTimer); reconnectTimer = null; },
+    clearReconnect() {
+      if (reconnectTimer) clearTimeout(reconnectTimer);
+      reconnectTimer = null;
+      clearActiveHeartbeat();
+    },
   };
 }

package/src/agent-update-monitor.mjs

@@ -3,6 +3,7 @@ import { spawn } from 'node:child_process';
 import process from 'node:process';
 import { VERSION } from './version.mjs';
 import { fetchUpdateManifest } from './fetch-update-manifest.mjs';
+import { updateRolloutEligibility } from './agent-update-rollout.mjs';
 import { globalCliEntry, globalInstalledVersion, isNewer, restartToApplyUpdate, updateDecision, updateInvocationArgs } from './agent-update.mjs';
 
 // Poll releases while connected too: relying on reconnect alone can leave a
@@ -11,7 +12,9 @@ export const UPDATE_CHECK_INTERVAL_MS = 30 * 60 * 1000;
 const UPDATE_CHECK_TIMEOUT_MS = 12000;
 // A flapping relay must not trigger update discovery on every successful reconnect.
 const UPDATE_CHECK_RECONNECT_GAP_MS = 30000;
-const POST_CONNECT_UPDATE_RECHECK_DELAYS_MS = Object.freeze([60_000, 5 * 60_000, 15 * 60_000]);
+// Fleet clients already have a per-device wall-clock polling phase. Avoid
+// bursty reconnect-triggered rechecks; explicit short QA fixtures may opt in.
+const POST_CONNECT_UPDATE_RECHECK_DELAYS_MS = Object.freeze([]);
 const POST_CONNECT_UPDATE_RECHECK_JITTER_MS = 30_000;
 const UPDATE_RETRY_COOLDOWN_MS = 30 * 60 * 1000;
 
@@ -99,6 +102,15 @@ export function createAgentUpdateMonitor({ options, serverUrl, queueEvent, getRu
         // proves convergence only after the replacement agent reconnects.
         queueEvent({ event: 'agent_update_available', at: observedAt, reason: decision.reason.slice(0, 32) });
       }
+      const eligible = updateRolloutEligibility({
+        deviceId: options.deviceId,
+        target: availabilityKey,
+        rollout: advertised.rollout,
+        // An explicitly raised minimum version or broken local runtime needs
+        // repair without the normal gradual fleet-release delay.
+        urgent: decision.reason === 'runtime-repair' || Boolean(minimum && isNewer(minimum, VERSION)),
+      }, observedAt);
+      if (!eligible.ready) return;
       const cli = resolveCli();
       if (!cli || !existsSync(cli)) {
         if (announce) console.error(`ReMCP ${target} is available; run: remcp update`);

package/src/agent-update-rollout.mjs

@@ -0,0 +1,92 @@
+import { createHash } from 'node:crypto';
+
+// A 24-hour fleet rollout makes 100,000 downloads roughly 1.16/sec instead
+// of initiating all installers when a new version first becomes visible.
+export const ROLLOUT_WINDOW_MS = 24 * 60 * 60 * 1000;
+const ROLLOUT_MAX_WINDOW_MS = 7 * ROLLOUT_WINDOW_MS;
+const ROLLOUT_STATE_TTL_SECONDS = 120 * 24 * 60 * 60;
+
+export function updateRolloutEligibility({ deviceId, target, rollout, urgent = false }, now = Date.now()) {
+  if (urgent || !rollout) return { ready:true, readyAt:now };
+  const startAtMs = Number(rollout.startAtMs);
+  const windowMs = Number(rollout.windowMs);
+  // A malformed policy must not accidentally release the whole fleet at once.
+  if (!String(deviceId || '').trim() || !String(target || '').trim()
+    || !Number.isSafeInteger(startAtMs) || startAtMs < 1_600_000_000_000
+    || !Number.isSafeInteger(windowMs) || windowMs < 60_000 || windowMs > ROLLOUT_MAX_WINDOW_MS) {
+    return { ready:false, readyAt:null };
+  }
+  // A stable local device identifier is hashed, not transmitted to the public
+  // update endpoint. A distinct release has a distinct deterministic slot.
+  const hash = createHash('sha256').update('remcp-agent-rollout-v1\0')
+    .update(String(deviceId)).update('\0').update(String(target)).digest();
+  const offsetMs = Math.floor(hash.readUInt32BE(0) / 0x100000000 * windowMs);
+  const readyAt = startAtMs + offsetMs;
+  // The response's server timestamp prevents incorrect client wall clocks
+  // from synchronously skipping all fleet slots.
+  const serverNowMs = Number(rollout.serverNowMs);
+  const effectiveNow = Number.isSafeInteger(serverNowMs) && serverNowMs >= 1_600_000_000_000
+    ? serverNowMs : now;
+  return { ready:effectiveNow >= readyAt, readyAt };
+}
+
+// Fleet update checks are phased on the wall clock as well. A 100k-device
+// reconnect wave must not turn into 100k immediate manifest GETs or a synchronized
+// 30-minute polling loop. The phase survives agent restarts with no disk state.
+export function nextFleetManifestDelayMs(deviceId, now = Date.now(), intervalMs = 30 * 60 * 1000) {
+  if (!String(deviceId || '').trim() || !Number.isSafeInteger(intervalMs) || intervalMs < 1000) {
+    throw new Error('Fleet manifest scheduling requires a paired device and a valid interval');
+  }
+  const hash = createHash('sha256').update('remcp-update-check-phase-v1\0').update(String(deviceId)).digest();
+  const phase = Math.floor(hash.readUInt32BE(0) / 0x100000000 * intervalMs);
+  const elapsed = ((now % intervalMs) + intervalMs) % intervalMs;
+  return (phase - elapsed + intervalMs) % intervalMs || intervalMs;
+}
+
+// Legacy clients (before scheduler v1) cannot defer installs themselves.
+// Admit a bounded number of old automatic update checks per minute across the
+// entire HA cluster; the rest retry their next normal check. Manual status,
+// bootstrap and manually requested updates use their own unthrottled paths.
+export async function claimLegacyManifestSlot(command, version, {
+  now = Date.now, limitPerMinute = 120, isClosed = () => false,
+} = {}) {
+  if (isClosed() || !command?.isReady) throw new Error('Shared legacy update admission unavailable');
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(String(version))) {
+    throw new Error('Invalid version for legacy update admission');
+  }
+  if (!Number.isSafeInteger(limitPerMinute) || limitPerMinute < 1 || limitPerMinute > 6000) {
+    throw new Error('Invalid legacy update admission quota');
+  }
+  const minute = Math.floor(now() / 60_000);
+  const key = 'remcp:deploy:legacy-update-admit:v1:' + version + ':' + minute;
+  const script = "local n=redis.call('INCR',KEYS[1]); if n == 1 then redis.call('EXPIRE',KEYS[1],90) end; return n <= tonumber(ARGV[1]) and 1 or 0";
+  return Number(await command.eval(script, { keys:[key], arguments:[String(limitPerMinute)] })) === 1;
+}
+
+// Use only immutable HTTP traits that identify the old agent's no-header
+// automatic fetch. The trusted user-requested manual update uses Accept JSON.
+export function isLegacyAutomaticUpdateRequest(req) {
+  const header = name => String(req?.get?.(name) || req?.headers?.[name.toLowerCase()] || '').toLowerCase();
+  return /^(?:node|undici)(?:\/[0-9.]+)?$/.test(header('user-agent'))
+    && header('accept').trim() === '*/*'
+    && header('x-remcp-update-scheduler') !== 'v1'
+    && !req?.query?.fresh;
+}
+
+// The shared Redis epoch is created exactly once for each released version.
+// A rolling HA deploy or process restart must not reset the fleet schedule.
+// Use the same Redis coordination store as the existing release pause gate.
+export async function getOrCreateRolloutStart(command, version, now = Date.now, isClosed = () => false) {
+  if (isClosed() || !command?.isReady) throw new Error('Shared rollout control plane unavailable');
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(String(version))) {
+    throw new Error('Invalid release version for update rollout');
+  }
+  const key = 'remcp:deploy:agent-rollout-start:v1:' + version;
+  const proposed = String(now());
+  await command.set(key, proposed, { NX:true, EX:ROLLOUT_STATE_TTL_SECONDS });
+  const persisted = Number(await command.get(key));
+  if (!Number.isSafeInteger(persisted) || persisted < 1_600_000_000_000) {
+    throw new Error('Shared rollout start is unavailable');
+  }
+  return persisted;
+}

package/src/agent-utilities.mjs

@@ -12,8 +12,19 @@ export function normalizedServerUrl(value, { allowInsecure = false } = {}) {
   return url.href.replace(/\/$/, '');
 }
 
+// Above the maximum legal runtime response, but bounded so dead links cannot retain
+// unbounded telemetry or concurrent tool results in the agent process.
+export const MAX_RELAY_BUFFERED_BYTES = 64 * 1024 * 1024;
+
 export function sendRelayMessage(socket, message) {
   if (socket?.readyState !== 1) return false;
+  if (socket.bufferedAmount > MAX_RELAY_BUFFERED_BYTES) {
+    // The WebSocket can look OPEN after an interface switch while its TCP send queue
+    // cannot drain. Ending it lets the bounded reconnect loop restore delivery.
+    console.error('ReMCP relay outbound buffer saturated; reconnecting.');
+    socket.terminate?.();
+    return false;
+  }
   // The authenticated relay is ReMCP's explicit data boundary: model-requested tool results are
   // intentionally returned to the paired workspace and never to an arbitrary third-party URL.
   // codeql[js/file-access-to-http]

package/src/agent.mjs

@@ -8,6 +8,7 @@ import { localRuntimeEntry } from './agent-update.mjs';
 export { localRuntimeEntry, supervisorRestart, updateDecision } from './agent-update.mjs';
 import { normalizedServerUrl, sendRelayMessage, jitter, deviceMetrics } from './agent-utilities.mjs';
 import { createAgentUpdateMonitor, UPDATE_CHECK_INTERVAL_MS } from './agent-update-monitor.mjs';
+import { nextFleetManifestDelayMs } from './agent-update-rollout.mjs';
 import { createAgentResponder } from './agent-responder.mjs';
 import { createAgentRelayConnection } from './agent-relay-connection.mjs';
 import { createRuntimeCapabilities, normalizeRuntimeToolNames } from './agent-runtime-capabilities.mjs';
@@ -288,12 +289,20 @@ export async function runAgent(options) {
     }),
     respond, inFlight, sendMetricsSample, reportInstallOnce, flushTelemetry,
     checkForUpdate, schedulePostConnectUpdateChecks, clearPostConnectUpdateChecks, stop,
+    checkUpdatesOnConnect: Array.isArray(options.updateRecheckDelaysMs),
   });
 
   scheduleMetricsSample();
   const telemetryFlushTimer = setInterval(flushTelemetry, TELEMETRY_SEND_INTERVAL_MS);
   telemetryFlushTimer.unref?.();
-  const updateTimer = setInterval(() => void checkForUpdate(), UPDATE_CHECK_INTERVAL_MS);
+  // Spread 100k devices across the entire 30-minute manifest polling cycle.
+  // The stable device phase survives reconnects/restarts without local writes.
+  let recurringUpdateTimer = null;
+  const updateTimer = setTimeout(() => {
+    void checkForUpdate({ scheduled:true });
+    recurringUpdateTimer = setInterval(() => void checkForUpdate({ scheduled:true }), UPDATE_CHECK_INTERVAL_MS);
+    recurringUpdateTimer.unref?.();
+  }, nextFleetManifestDelayMs(deviceId, Date.now(), UPDATE_CHECK_INTERVAL_MS));
   updateTimer.unref?.();
 
   async function stop() {
@@ -305,7 +314,8 @@ export async function runAgent(options) {
     clearPostConnectUpdateChecks();
     if (telemetryTimer) clearTimeout(telemetryTimer);
     clearInterval(telemetryFlushTimer);
-    clearInterval(updateTimer);
+    clearTimeout(updateTimer);
+    if (recurringUpdateTimer) clearInterval(recurringUpdateTimer);
     for (const controller of inFlight.values()) controller.abort();
     activeSocket?.terminate();
     stopPromise = Promise.allSettled([mcp?.close(), transport?.close()]).then(results => {

package/src/cli.mjs

@@ -44,7 +44,7 @@ function printHelp() {
 }
 
 // The running agent snapshots update policy at startup. A saved toggle alone does not
-// change its six-hour polling loop, so reload a managed service after a policy change.
+// change its per-device polling schedule, so reload a managed service after a policy change.
 // Defer Linux handoff to avoid terminating a remote command before it returns.
 export function applyAutoUpdatePreference(cfg, enabled, {
   persist = saveConfig,
@@ -219,7 +219,7 @@ export async function main(argv = process.argv.slice(2)) {
     const action = String(positional[0] || 'status').toLowerCase();
     const cfg = loadConfig(false) || {};
     if (action === 'status') {
-      console.log(JSON.stringify({ autoUpdate: autoUpdateEnabled(cfg), checkIntervalHours: 6 }, null, 2));
+      console.log(JSON.stringify({ autoUpdate: autoUpdateEnabled(cfg), checkIntervalHours: 0.5, fleetRolloutHours:24 }, null, 2));
       return;
     }
     if (['on', 'enable', 'off', 'disable'].includes(action)) {

package/src/fetch-update-manifest.mjs

@@ -29,6 +29,9 @@ export async function fetchUpdateManifest(url, {
       (async () => {
         const response = await fetchImpl(url, {
           redirect: 'error',
+          // Signals support for deterministic fleet rollout; old agents send
+          // plain fetch requests and use a shared Redis admission budget.
+          headers: { 'x-remcp-update-scheduler':'v1' },
           signal: controller.signal,
         });
         if (!response.ok) return null;