fullcourtdefense-cli 1.26.1 → 1.26.2

package/dist/commands/daemon.js

@@ -942,7 +942,11 @@ async function runDaemon(args, config) {
                     bundleState = { mode: bundle.mode, source: bundle.source, policyHash: bundle.policyHash };
                 }
                 catch { /* snapshot still useful without mode context */ }
-                const snapshot = (0, perfSnapshot_1.collectPerfSnapshot)({ cliVersion: cliVersion(), ...bundleState });
+                // Async collection — the benchmark spawns real hook children that ask
+                // THIS daemon for IPC verdicts, so the event loop must stay free or
+                // the snapshot measures its own blockage (2.5s IPC timeout per hook)
+                // instead of the true per-event cost.
+                const snapshot = await (0, perfSnapshot_1.collectPerfSnapshot)({ cliVersion: cliVersion(), ...bundleState });
                 const uploaded = await uploadDiagnostics({ perfSnapshot: snapshot });
                 if (!uploaded)
                     throw new Error('Perf snapshot could not be uploaded (network or backend rejection).');

package/dist/commands/doctor.js

@@ -105,7 +105,7 @@ async function perfCheck(apiUrl, config) {
     else {
         console.log('mode: not enrolled (local defaults, monitor-first)');
     }
-    const snapshot = (0, perfSnapshot_1.collectPerfSnapshot)({ mode, source, policyHash });
+    const snapshot = await (0, perfSnapshot_1.collectPerfSnapshot)({ mode, source, policyHash });
     const hp = snapshot.hotPath;
     console.log(`node spawn floor:      ${hp.nodeSpawnFloorMs}ms median — OS+AV cost of any per-event process`);
     console.log(`hook end-to-end:       ${hp.hookMedianMs}ms median, ${hp.hookMinMs}-${hp.hookMaxMs}ms range — per IDE event (shell/MCP/file)`);

package/dist/perfSnapshot.d.ts

@@ -7,6 +7,17 @@
  * only. Nothing here installs a profiler, starts a timer, or samples in the
  * background — every number is collected in one shot, in a few seconds, and
  * the process that collected it exits.
+ *
+ * NON-BLOCKING BY CONTRACT: everything here uses async `spawn`, never
+ * `spawnSync`. The remote action runs INSIDE the daemon — the same process
+ * that answers verdict IPC for every live hook. A spawnSync benchmark froze
+ * the daemon's event loop, so each benchmarked hook child asked the daemon,
+ * got silence, waited out the full IPC response timeout (~2.5s) and fell back
+ * to local evaluation: the snapshot reported "hook median 2605ms" on a machine
+ * whose real per-event cost was milliseconds — the measurement was poisoning
+ * itself. Async spawns keep the daemon answering during the benchmark, so the
+ * number is the true production path (and real developer hooks keep their
+ * fast path while a snapshot is being collected).
  */
 export interface PerfProcessInfo {
     pid: number;
@@ -67,13 +78,13 @@ export interface PerfSnapshot {
     distress: unknown[];
 }
 /** Micro-bench of the per-event hot path: node spawn floor, hook end-to-end, cmd guard. */
-export declare function benchHotPath(entryJs?: string): PerfHotPathBench;
+export declare function benchHotPath(entryJs?: string): Promise<PerfHotPathBench>;
 /**
  * Per-process footprint of every FullCourtDefense-owned process (daemon, MCP
  * gateways, desktop chat watcher, watchdog): working set, cumulative CPU,
  * uptime, handle count. On-demand only — this spawns ONE OS query and exits.
  */
-export declare function collectProcessFootprint(): PerfProcessInfo[];
+export declare function collectProcessFootprint(): Promise<PerfProcessInfo[]>;
 /** Disk footprint: our logs/spool sizes, spool backlog, update-attempt markers. */
 export declare function collectDiskState(): PerfDiskState;
 export interface CollectPerfSnapshotInput {
@@ -86,6 +97,6 @@ export interface CollectPerfSnapshotInput {
     entryJs?: string;
 }
 /** One-shot collection of the full snapshot. Completes in a few seconds. */
-export declare function collectPerfSnapshot(input?: CollectPerfSnapshotInput): PerfSnapshot;
+export declare function collectPerfSnapshot(input?: CollectPerfSnapshotInput): Promise<PerfSnapshot>;
 /** One-line human summary for machine-action result reporting. */
 export declare function summarizePerfSnapshot(s: PerfSnapshot): string;

package/dist/perfSnapshot.js

@@ -55,23 +55,61 @@ function fileSizeKB(p) {
         return undefined;
     }
 }
+/**
+ * Run one child to completion WITHOUT blocking the event loop, returning
+ * elapsed wall time and captured stdout. The event loop staying free is the
+ * whole point (see the header): the daemon must keep answering verdict IPC
+ * while these children run. Never throws — a spawn failure or timeout still
+ * resolves with whatever elapsed/output there is.
+ */
+function runTimed(cmd, args, opts) {
+    return new Promise((resolve) => {
+        const t0 = Date.now();
+        let stdout = '';
+        let settled = false;
+        let killTimer;
+        const finish = () => {
+            if (settled)
+                return;
+            settled = true;
+            if (killTimer)
+                clearTimeout(killTimer);
+            resolve({ elapsedMs: Date.now() - t0, stdout });
+        };
+        let child;
+        try {
+            child = (0, child_process_1.spawn)(cmd, args, { windowsHide: true, stdio: ['pipe', 'pipe', 'ignore'] });
+        }
+        catch {
+            finish();
+            return;
+        }
+        killTimer = setTimeout(() => { try {
+            child.kill();
+        }
+        catch { /* already gone */ } }, opts.timeoutMs);
+        child.on('error', finish);
+        child.on('close', finish);
+        child.stdout?.on('data', (chunk) => { stdout += String(chunk); });
+        child.stdin?.on('error', () => { });
+        if (opts.input !== undefined)
+            child.stdin?.write(opts.input);
+        child.stdin?.end();
+    });
+}
 /** Micro-bench of the per-event hot path: node spawn floor, hook end-to-end, cmd guard. */
-function benchHotPath(entryJs) {
+async function benchHotPath(entryJs) {
     const entry = entryJs || process.argv[1] || '';
+    // Sequential on purpose: overlapping children would contend for CPU and
+    // inflate each other's numbers.
     const spawnTimes = [];
     for (let i = 0; i < 5; i++) {
-        const t0 = Date.now();
-        (0, child_process_1.spawnSync)(process.execPath, ['-e', '0'], { windowsHide: true, timeout: 30_000 });
-        spawnTimes.push(Date.now() - t0);
+        spawnTimes.push((await runTimed(process.execPath, ['-e', '0'], { timeoutMs: 30_000 })).elapsedMs);
     }
     const hookEvent = JSON.stringify({ hook_event_name: 'beforeShellExecution', command: 'echo fcd-perf-probe' });
     const hookTimes = [];
     for (let i = 0; i < 5; i++) {
-        const t0 = Date.now();
-        (0, child_process_1.spawnSync)(process.execPath, [entry, 'hook', '--event', 'shell', '--fcd-managed', 'true'], {
-            input: hookEvent, encoding: 'utf8', windowsHide: true, timeout: 60_000,
-        });
-        hookTimes.push(Date.now() - t0);
+        hookTimes.push((await runTimed(process.execPath, [entry, 'hook', '--event', 'shell', '--fcd-managed', 'true'], { input: hookEvent, timeoutMs: 60_000 })).elapsedMs);
     }
     let cmdGuardOverheadMs;
     const guardJs = path.join(os.homedir(), '.fullcourtdefense-cmd-guard.js');
@@ -79,12 +117,8 @@ function benchHotPath(entryJs) {
         const direct = [];
         const guarded = [];
         for (let i = 0; i < 4; i++) {
-            let t0 = Date.now();
-            (0, child_process_1.spawnSync)(process.env.ComSpec || 'cmd.exe', ['/d', '/c', 'echo', 'fcd-perf'], { windowsHide: true, timeout: 30_000 });
-            direct.push(Date.now() - t0);
-            t0 = Date.now();
-            (0, child_process_1.spawnSync)(process.execPath, [guardJs, 'echo', 'fcd-perf'], { windowsHide: true, timeout: 30_000 });
-            guarded.push(Date.now() - t0);
+            direct.push((await runTimed(process.env.ComSpec || 'cmd.exe', ['/d', '/c', 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
+            guarded.push((await runTimed(process.execPath, [guardJs, 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
         }
         cmdGuardOverheadMs = Math.max(0, median(guarded) - median(direct));
     }
@@ -102,11 +136,11 @@ function benchHotPath(entryJs) {
  * gateways, desktop chat watcher, watchdog): working set, cumulative CPU,
  * uptime, handle count. On-demand only — this spawns ONE OS query and exits.
  */
-function collectProcessFootprint() {
+async function collectProcessFootprint() {
     try {
         if (process.platform === 'win32') {
             // On-demand action (never a hot path), so one PowerShell query is fine.
-            const ps = (0, child_process_1.spawnSync)('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', `
+            const ps = await runTimed('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', `
         $now = Get-Date
         Get-CimInstance Win32_Process |
           Where-Object { $_.CommandLine -and ($_.CommandLine -match 'fullcourtdefense' -or $_.CommandLine -match 'FullCourtDefense') -and $_.CommandLine -notmatch 'Get-CimInstance' } |
@@ -121,7 +155,7 @@ function collectProcessFootprint() {
               cmd = if ($_.CommandLine.Length -gt 160) { $_.CommandLine.Substring(0,160) } else { $_.CommandLine }
             }
           } | ConvertTo-Json -Compress
-      `], { encoding: 'utf8', windowsHide: true, timeout: 20_000 });
+      `], { timeoutMs: 20_000 });
             const raw = (ps.stdout || '').trim();
             if (!raw)
                 return [];
@@ -138,7 +172,7 @@ function collectProcessFootprint() {
             }));
         }
         // POSIX: rss (KB), cumulative cpu time, elapsed, args.
-        const ps = (0, child_process_1.spawnSync)('ps', ['-eo', 'pid=,rss=,time=,etimes=,args='], { encoding: 'utf8', timeout: 20_000 });
+        const ps = await runTimed('ps', ['-eo', 'pid=,rss=,time=,etimes=,args='], { timeoutMs: 20_000 });
         const lines = (ps.stdout || '').split('\n').filter(l => /fullcourtdefense/i.test(l) && !/ps -eo/.test(l));
         const result = [];
         for (const line of lines) {
@@ -190,8 +224,8 @@ function collectDiskState() {
     };
 }
 /** One-shot collection of the full snapshot. Completes in a few seconds. */
-function collectPerfSnapshot(input = {}) {
-    const processes = collectProcessFootprint();
+async function collectPerfSnapshot(input = {}) {
+    const processes = await collectProcessFootprint();
     return {
         collectedAt: new Date().toISOString(),
         cliVersion: input.cliVersion,
@@ -203,7 +237,7 @@ function collectPerfSnapshot(input = {}) {
             node: process.version,
         },
         enforcement: { mode: input.mode, source: input.source, policyHash: input.policyHash },
-        hotPath: benchHotPath(input.entryJs),
+        hotPath: await benchHotPath(input.entryJs),
         processes,
         totalWorkingSetMB: Math.round(processes.reduce((sum, p) => sum + p.workingSetMB, 0) * 10) / 10,
         disk: collectDiskState(),

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.26.1"
+  "version": "1.26.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.26.1",
+  "version": "1.26.2",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {