fullcourtdefense-cli 1.26.14 → 1.26.15

package/dist/commands/daemon.js

@@ -145,6 +145,14 @@ const HEARTBEAT_DEADLINE_MS = envMs('FCD_DAEMON_HEARTBEAT_DEADLINE_MS', 120_000)
  */
 const RESUME_BEAT_MS = envMs('FCD_DAEMON_RESUME_BEAT_MS', 30_000);
 const RESUME_JUMP_MS = envMs('FCD_DAEMON_RESUME_JUMP_MS', 120_000);
+/**
+ * Report-in attempts after a resume, and the base delay between them (linear
+ * backoff: 10s, 20s, 30s, 40s). Sized to outlast a normal Wi-Fi reassociation
+ * plus DHCP/DNS, so waking on a slow network costs seconds of staleness rather
+ * than a whole reporting window.
+ */
+const RESUME_REPORT_ATTEMPTS = envMs('FCD_DAEMON_RESUME_ATTEMPTS', 5);
+const RESUME_RETRY_BASE_MS = envMs('FCD_DAEMON_RESUME_RETRY_MS', 10_000);
 /** Delay before the one-time initial discovery sweep on a fresh machine. */
 const INITIAL_DISCOVER_DELAY_MS = envMs('FCD_DAEMON_INITIAL_DISCOVER_MS', 2 * 60_000);
 /** A discovery upload older than this is stale — the daemon catches up itself. */
@@ -1298,6 +1306,14 @@ async function runDaemon(args, config) {
         recoverCredentialsIfMissing();
         if (!creds.shieldId)
             return;
+        // Did THIS beat actually record daemon liveness upstream? `flushSpool`
+        // reports every failure by returning null and never throws, so without
+        // this flag a heartbeat that never left the machine was indistinguishable
+        // from a delivered one — and the loop happily waited a full cadence before
+        // trying again. `null` also covers the case where a hook flusher held the
+        // flush lock, which drops the daemon marker specifically (hook flushes do
+        // not set `daemon: true`), so retrying soon is right in that case too.
+        let reported = false;
         try {
             let integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
             // A failing verdict used to be REPORTED and nothing more, so a machine
@@ -1348,6 +1364,7 @@ async function runDaemon(args, config) {
                     }
                     : undefined,
             });
+            reported = result !== null;
             if (result && unreportedCrash)
                 (0, daemonForensics_1.markPostmortemReported)();
             if (result && result.accepted > 0)
@@ -1358,8 +1375,13 @@ async function runDaemon(args, config) {
         }
         catch { /* spool stays on disk for the next tick */ }
         // Settle any in-flight upgrade_cli action (success once the new build is
-        // live, failure when the target never arrived).
+        // live, failure when the target never arrived). Runs BEFORE the failure
+        // signal below so a lost heartbeat can never strand a pending upgrade.
         await verifyPendingUpgrade();
+        // Surface the miss to the caller (poll loop / resume path) so it retries in
+        // seconds. Nothing else can tell them: liveness has exactly one writer.
+        if (!reported)
+            throw new Error('heartbeat did not reach the backend — daemon liveness was not recorded');
     };
     // --- boot ---------------------------------------------------------------
     // Self-heal autostart + watchdog tasks: machines installed by older versions
@@ -1385,7 +1407,19 @@ async function runDaemon(args, config) {
     // would report a false "damaged" state (and fire admin integrity alerts)
     // for a condition the very next line repairs.
     await reprotect(['startup pass']);
-    await heartbeat();
+    // The FIRST beat must not be able to abort the rest of this function.
+    // `heartbeat` throws when the report did not reach the backend (that is how
+    // the poll loop knows to retry in seconds), and an exception here propagates
+    // out of `runDaemon` and skips every loop registered below it — the heartbeat
+    // loop, the resume timer and the bundle poll. The process itself survives on
+    // the `unhandledRejection` handler, which is worse than dying: it holds the
+    // pid lock, so the scheduled task declines to start a replacement, and it
+    // never polls the bundle, so no remote action can reach it. Booting before
+    // the network is up (captive portal, VPN, resumed in a lift) is routine, and
+    // the heartbeat loop below retries within seconds.
+    await heartbeat().catch(error => {
+        log(`First heartbeat did not reach the backend (${error?.message || String(error)}) — the heartbeat loop will retry shortly.`);
+    });
     // Claude Desktop chat guard (Windows, advisory): Claude Desktop's regular
     // chat has no hook and never hits an MCP server, so it is the one machine
     // surface neither hooks nor the gateway can see. Supervise the advisory guard
@@ -1535,6 +1569,39 @@ async function runDaemon(args, config) {
     // closes the reporting gap and removes the evidence of a hang that never
     // happened. Both calls go through runWithDeadline, so a resume that lands on
     // sockets which died during sleep cannot leak an unhandled rejection.
+    // The resume beat is RETRIED, because it fires the instant the wall-clock
+    // jump is noticed — which on a laptop is reliably before Wi-Fi has
+    // reassociated. As a single shot, the one beat whose whole job is to prove
+    // the daemon survived the sleep was also the likeliest to be lost, and modern
+    // standby routinely re-suspends the machine before the next cadence tick, so
+    // liveness could stay stale indefinitely while IDE-hook flushes kept the
+    // machine "online" — a live daemon displayed as down.
+    let resumeReportInFlight = false;
+    const reportInAfterResume = async () => {
+        if (resumeReportInFlight)
+            return; // a previous resume is still catching up
+        resumeReportInFlight = true;
+        try {
+            for (let attempt = 1; attempt <= RESUME_REPORT_ATTEMPTS; attempt++) {
+                let failed = false;
+                const outcome = await (0, pollLoop_1.runWithDeadline)({
+                    run: heartbeat,
+                    deadlineMs: HEARTBEAT_DEADLINE_MS,
+                    onError: () => { failed = true; },
+                });
+                if (outcome === 'settled' && !failed)
+                    return; // liveness recorded
+                if (attempt === RESUME_REPORT_ATTEMPTS) {
+                    log(`Resume report-in did not land after ${attempt} attempt(s) — the scheduled heartbeat keeps retrying.`);
+                    return;
+                }
+                await new Promise(resolve => setTimeout(resolve, RESUME_RETRY_BASE_MS * attempt));
+            }
+        }
+        finally {
+            resumeReportInFlight = false;
+        }
+    };
     let lastResumeBeatMs = Date.now();
     const resumeTimer = setInterval(() => {
         const now = Date.now();
@@ -1544,7 +1611,7 @@ async function runDaemon(args, config) {
             return;
         log(`Resume detected: ${Math.round(drift / 1000)}s of wall time elapsed while suspended — refreshing liveness and reporting in now.`);
         (0, daemonForensics_1.touchDaemonAlive)();
-        void (0, pollLoop_1.runWithDeadline)({ run: heartbeat, deadlineMs: HEARTBEAT_DEADLINE_MS });
+        void reportInAfterResume();
         void (0, pollLoop_1.runWithDeadline)({ run: pollBundle, deadlineMs: BUNDLE_POLL_DEADLINE_MS });
     }, RESUME_BEAT_MS);
     // PowerShell transcript retention (Windows): the Transcription policy FCD

package/dist/pollLoop.d.ts

@@ -51,6 +51,12 @@ export interface PollLoopInput {
     onError?: (error: unknown) => void;
     /** Cadence jitter fraction (0..1, default 0.2) — a proxied fleet must not poll in lockstep. */
     jitter?: number;
+    /**
+     * First delay after an attempt that FAILED or was abandoned, doubled on each
+     * consecutive failure and capped at the normal cadence (so a retry is never
+     * lazier than the ordinary tick). Reset the moment an attempt succeeds.
+     */
+    retryDelayMs?: number;
     /** Injectable timers for tests. */
     timers?: {
         setTimeout: (fn: () => void, ms: number) => unknown;

package/dist/pollLoop.js

@@ -32,6 +32,24 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runWithDeadline = runWithDeadline;
 exports.startPollLoop = startPollLoop;
 const MIN_DELAY_MS = 5_000;
+/**
+ * Default first retry after a failed/abandoned attempt.
+ *
+ * WHY A RETRY EXISTS AT ALL (the "Online · daemon down" bug)
+ * The loop used to reschedule at the full cadence no matter how the attempt
+ * ended, so ONE failed heartbeat left the daemon unreported for 5-6 minutes.
+ * That is not rare on a laptop: the wake-from-sleep path fires a heartbeat the
+ * instant a resume is noticed, which is usually BEFORE Wi-Fi has reassociated,
+ * so the very beat meant to prove the daemon survived the sleep is the one most
+ * likely to fail. Modern standby then re-suspends the machine in ~10-minute
+ * blocks, often before the next cadence tick — so `daemonReportedAt` could stay
+ * stale indefinitely while IDE-hook flushes kept the machine "online", showing
+ * a live daemon as down and making remote actions undeliverable.
+ *
+ * Retrying in seconds (not minutes) means a network that is merely late to come
+ * back costs one short delay instead of a whole reporting window.
+ */
+const RETRY_BASE_MS = 15_000;
 /**
  * Await `run()` but never longer than `deadlineMs`. Resolves 'settled' when the
  * attempt finished (fulfilled or rejected) and 'abandoned' when the deadline
@@ -75,22 +93,42 @@ function startPollLoop(input) {
     let stopped = false;
     let stalled = 0;
     let tickHandle;
-    const nextDelay = () => {
+    /** Consecutive failed/abandoned attempts, driving the retry backoff. */
+    let consecutiveFailures = 0;
+    const cadenceMs = () => {
         const base = input.intervalMs();
-        const safeBase = Number.isFinite(base) && base > 0 ? base : MIN_DELAY_MS;
+        return Number.isFinite(base) && base > 0 ? base : MIN_DELAY_MS;
+    };
+    const nextDelay = () => {
+        const base = cadenceMs();
         const factor = 1 - jitter + random() * jitter * 2;
-        return Math.max(MIN_DELAY_MS, Math.round(safeBase * factor));
+        return Math.max(MIN_DELAY_MS, Math.round(base * factor));
+    };
+    /**
+     * Back off exponentially from RETRY_BASE_MS but never past the ordinary
+     * cadence: a retry may be more eager than a normal tick, never lazier.
+     */
+    const retryDelay = () => {
+        const base = Math.max(1, input.retryDelayMs ?? RETRY_BASE_MS);
+        const backoff = base * Math.pow(2, Math.max(0, consecutiveFailures - 1));
+        return Math.max(MIN_DELAY_MS, Math.round(Math.min(backoff, cadenceMs())));
     };
-    const schedule = () => {
+    const schedule = (delayMs) => {
         if (stopped)
             return;
         tickHandle = timers.setTimeout(async () => {
             if (stopped)
                 return;
+            // `runWithDeadline` reports settled-vs-abandoned; a settled attempt may
+            // still have REJECTED, and for retry purposes that is just as bad.
+            let rejected = false;
             const outcome = await runWithDeadline({
                 run: input.run,
                 deadlineMs: input.deadlineMs,
-                onError: input.onError,
+                onError: error => {
+                    rejected = true;
+                    input.onError?.(error);
+                },
                 timers,
             });
             if (outcome === 'abandoned') {
@@ -100,10 +138,16 @@ function startPollLoop(input) {
                 }
                 catch { /* never break the loop */ }
             }
-            schedule();
-        }, nextDelay());
+            if (outcome === 'abandoned' || rejected) {
+                consecutiveFailures += 1;
+                schedule(retryDelay());
+                return;
+            }
+            consecutiveFailures = 0;
+            schedule(nextDelay());
+        }, delayMs);
     };
-    schedule();
+    schedule(nextDelay());
     return {
         stop() {
             stopped = true;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.26.14"
+  "version": "1.26.15"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.26.14",
+  "version": "1.26.15",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {