fix(net): offline hangs, stderr discipline, loopback callback bind

[vreshch]

What

Four verified network-robustness + output-discipline fixes.

• status no longer hangs ~10s on packet-drop networks. checkEndpoint (status-info) and fetchCliLatest (update-check) used fetch + AbortSignal.timeout, where undici keeps a ref'd ~10s connect timer alive after abort and stalls process exit. Extracted the repo's existing node:https + unref'd-timer pattern into a shared fetchJsonUnref(url, timeoutMs) (new src/lib/http.ts) and routed both callers plus update-cache.fetchLatestVersion through it.
• Update hint no longer corrupts piped stdout. The postAction hint (cli.ts) and warnDaemonMismatch (status.ts) now print to stderr via console.error, so agentage memory read x.md > out.txt stays clean.
• OAuth callback server binds loopback only. server.listen(0, '127.0.0.1', ...) instead of all interfaces - the one-shot sign-in callback is no longer LAN-reachable.
• Authed fetches refuse redirects. authedGet/authedPost set redirect: 'manual' so the bearer is never replayed to a redirect target; authedGet treats any 3xx (or opaqueredirect) as an error and reports the status.
• setup --disconnect revoke can't stall. revokeToken gets AbortSignal.timeout(3000) (configurable for tests). It's a POST so it stays on global fetch rather than the GET-only shared helper; residual undici keepalive is acceptable there since the process exits right after and errors are already swallowed.

Why

Offline/packet-drop machines saw status and setup --disconnect block for ~10s; piped reads got polluted by the update hint; the sign-in callback and bearer-bearing redirects were needless attack surface.

Tests

• New http.test.ts (unreachable host resolves null within bound).
• update-check / status-info tests re-pointed at the mocked helper; api.test.ts asserts redirect: 'manual' and a new 302-refused case; oauth.test.ts asserts a stalled revoke aborts within the timeout; callback-server.test.ts asserts loopback reachability.

Scope

Touched only the postAction hook in cli.ts (kept surgical for the sibling Node-version-guard PR). Did not touch memory.ts, vault-sync, file-lock, or daemon files.

Verified: npm run verify green locally.

[github-actions]

🎉 PR Validation ✅ PASSED

Commit: cfb5e05fb93cfdc1e4917aa06a4561bbcaac691b
Branch: fix/net-offline-output

Checks:

• ✅ Release guard (no version/changelog changes)
• ✅ Dependencies installed
• ✅ Type check passed
• ✅ Linting passed
• ✅ Format check passed
• ✅ Tests + coverage passed
• ✅ Build successful

Ready to merge! ✨

---

🔗 View workflow run
⏰ Generated at: 2026-07-07T22:04:19.396Z