fullcourtdefense-cli 1.26.6 → 1.26.7

package/dist/runtimeConfig.d.ts

@@ -90,6 +90,15 @@ export interface FetchBundleInput {
     ttlMs?: number;
     /** Force a network refresh regardless of cache freshness. */
     force?: boolean;
+    /**
+     * Fetch timeout override (ms). Default is the tight hot-path budget
+     * (REFRESH_TIMEOUT_MS = 1.5s) — a hook must never stall a command on a slow
+     * control plane. Diagnostic callers (doctor --health, deep self-test) pass a
+     * generous value instead: a bundle answer at 3s is a healthy backend, not a
+     * "no live bundle" failure. The 2h workday simulation surfaced this — ~1 in
+     * 6 health checkpoints false-alarmed on p95 latency spikes.
+     */
+    timeoutMs?: number;
     /**
      * Hot-path caller (hook / MCP gateway): when the cached mode is monitor or
      * shadow, accept a STALE cache without a synchronous refresh — the resident
@@ -130,6 +139,7 @@ export declare function validateShieldCredentials(input: {
     apiUrl: string;
     shieldId: string;
     shieldKey?: string;
+    timeoutMs?: number;
 }): Promise<CredentialValidationResult>;
 /**
  * Drop every cached runtime bundle at enrollment time.

package/dist/runtimeConfig.js

@@ -258,7 +258,7 @@ async function getRuntimeBundle(input) {
             params.set('machineName', input.machineName);
         if (input.machineId)
             params.set('machineId', input.machineId);
-        const resp = await fetch(`${input.apiUrl}/api/cli/bundle?${params.toString()}`, { method: 'GET', headers, signal: AbortSignal.timeout(REFRESH_TIMEOUT_MS) });
+        const resp = await fetch(`${input.apiUrl}/api/cli/bundle?${params.toString()}`, { method: 'GET', headers, signal: AbortSignal.timeout(input.timeoutMs ?? REFRESH_TIMEOUT_MS) });
         // 304 Not Modified — cache is still valid; refresh its timestamp.
         // Re-assert the marker when the cache says suspended, but NEVER clear it
         // here: a 304 validates the version string, not the (locally editable)
@@ -359,10 +359,12 @@ async function validateShieldCredentials(input) {
     }
     try {
         const params = new URLSearchParams({ shieldId: input.shieldId });
+        // Diagnostic default (10s), not the hot-path 1.5s: onboarding/doctor would
+        // rather wait than misreport a slow-but-healthy backend as unreachable.
         const resp = await fetch(`${input.apiUrl}/api/cli/bundle?${params.toString()}`, {
             method: 'GET',
             headers: { 'Content-Type': 'application/json', 'x-shield-key': input.shieldKey },
-            signal: AbortSignal.timeout(REFRESH_TIMEOUT_MS),
+            signal: AbortSignal.timeout(input.timeoutMs ?? 10_000),
         });
         if (resp.status === 401 || resp.status === 403) {
             (0, distress_1.reportDistress)('bundle', distress_1.DISTRESS.AUTH_BROKEN, `credential validation HTTP ${resp.status}`);

package/dist/selfTest.js

@@ -91,6 +91,8 @@ async function runDeepSelfTest(input) {
                 machineId: input.machineId,
                 force: true,
                 ttlMs: 0,
+                // Diagnostic call — a 3s answer is a healthy backend, not a failure.
+                timeoutMs: 10_000,
             });
             add({
                 id: 'bundle_auth',

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.26.6"
+  "version": "1.26.7"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.26.6",
+  "version": "1.26.7",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {