fix(cli): home heartbeat fetches one client, not the whole account (#338)

[saadqbal]

Symptom

Bare tracebloc/tb home screen shows a false negative:

⚠ Secure environment "…" · running — couldn't confirm it's connected to tracebloc — run tb doctor

…while tb doctor is fully green (Backend auth ✔, egress ✔, active client resolved). The backend IS reachable — the home probe just can't confirm it in time.

Root cause

realHeartbeat → lookupClientStatus → api.Client.ListClients, which does GET /edge-device/ and paginates through every client in the account (up to maxListPages=100), then filters client-side for the active id — all under homeProbeTimeout=1200ms / homeDetectBudget=1500ms. Enough clients to need multiple pages (or slow prod round-trips) → context deadline → beatUnknown → "couldn't confirm". tb doctor is green because its Backend-auth check is a single GET /userinfo/ with no tight timeout.

Fix

• Add api.Client.GetClient(ctx, id) → GET /edge-device/{id}/ — the O(1) detail route (same one PatchClientClusterID/RevokeClient use); PatchClientClusterID already decodes a single ProvisionedClient from it. 404 → (nil, nil) (not-found, not an error).
• Switch lookupClientStatus to fetch the single active client directly instead of listing the whole account.
• Remove the now-unused findClientByID (blocking deadcode gate). ListClients still backs client list / use / create-collision.

One fast round-trip fits comfortably in the 1.2s budget → the heartbeat returns the honest Online / not-online instead of spurious "couldn't confirm".

Verification

• go build/go vet/gofmt clean; GetClient contract test (2xx decode / 404→nil,nil / 500→APIError, pins the detail path) + the heartbeat/home tests pass. Full internal/cli suite left to CI.

Fixes #338.

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches the shared status lookup used by home heartbeat, client status --wait, and delete guards; behavior is intended to match prior semantics with a different API shape, backed by broad test updates.

Overview
Fixes false “couldn't confirm it's connected” on the bare home screen when the backend is fine but the probe times out (~1.2s).

lookupClientStatus (home heartbeat, client status, delete pre-offboard guard) no longer calls ListClients and scan the account. It uses a new api.Client.GetClient — GET /edge-device/{id}/ — for one round-trip. findClientByID is removed. ListClients is unchanged for client list, create collision, and adopt flows.

GetClient decodes a single ProvisionedClient; 404 → (nil, nil) (missing client, not an error). A non-numeric active client id is treated as not found (no API call) so --wait fails fast instead of polling to timeout.

Tests add TestGetClient and TestClientStatus_WaitFailsFastOnNonNumericID; status/delete stubs expect /edge-device/5/ and object JSON instead of list payloads.

^{Reviewed by Cursor Bugbot for commit c1f50ea. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 40 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#183 — docs: SafeTensors deployment-order & resume-safety runbook (epic feat(auth): logout revokes the token server-side (cli#112) #116) · author: @shujaatTracebloc · reviewer: @saadqbal
• averaging-service#184 — test(weights): shared SafeTensors golden-corpus drift guard + declare safetensors dep (SEC-03) · author: @LukasWodka · no reviewer assigned
• averaging-service#185 — test(weights): average a real SafeTensors edge + a legacy edge in one cycle — SEC-03 §8 · author: @LukasWodka · no reviewer assigned
• averaging-service#190 — chore(release): promote staging → main (week of 2026-07-13) · author: @aptracebloc · no reviewer assigned
• backend#1093 — chore(deps): bump django from 5.2.14 to 5.2.15 · author: @dependabot · no reviewer assigned
• backend#1119 — perf(api): cache ChoiceGroup + score-formula reference endpoints (#981 item 4, part 1) · author: @aptracebloc · reviewer: @saqlainsyed007
• backend#1122 — perf(api): cache the anonymous competition-template list (#981 item 4, part 2) · author: @aptracebloc · reviewer: @saqlainsyed007
• backend#1125 — fix(serializers): confusion_matrix as JSONField in experiment list (Bugbot #1121) · author: @aptracebloc · reviewer: @saqlainsyed007
• data-ingestors#361 — feat(ingest): emit per-column feature_stats for combine-time normalization (#360) · author: @divyasinghds · no reviewer assigned
• data-ingestors#372 — fix(validators): use redaction.column_preview for mask_id error column lists · author: @divyasinghds · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4d633c7. Configure here.}