fix(daemon): fail clearly if listenAvoidingBlockedPorts exhausts all retries

The retry loop only exited via return (bound a usable port) or throw (non-fallback bind error).
If it ever exhausted all 5 attempts it fell through returning undefined with the server closed/
unbound, and the caller (startDaemonServer → getBoundPort) then threw the misleading "Daemon server
is not listening on a TCP port." Add an explicit, descriptive throw after the loop.

Not reachable in practice — the first fallback sets port=0 and OS ephemeral ports (>=32768) are
never in FETCH_BLOCKED_PORTS (all <=10080), so iteration 2 always binds — but the silent fall-through
is fragile (a future change to the blocked set or retry count would make it a real crash with a
confusing error). TDD test forces the exhaustion path and asserts the clear throw.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ARHAEEM

packages/mcp-server/src/daemon/server.js

@@ -105,6 +105,12 @@ export async function listenAvoidingBlockedPorts(server, requestedPort, host) {
     await new Promise((resolve) => server.close(() => resolve()));
     port = 0; // blocked port → next attempt uses an ephemeral port
   }
+
+  // Unreachable in practice — the first fallback sets port=0 and OS ephemeral ports (>=32768) are
+  // never in FETCH_BLOCKED_PORTS (all <=10080), so iteration 2 always binds and returns. But do NOT
+  // fall through returning undefined with the server closed/unbound: the caller reads getBoundPort()
+  // and would throw the misleading "Daemon server is not listening on a TCP port." Fail clearly.
+  throw new Error(`Daemon could not bind a usable (non-browser-blocked) port after 5 attempts (requested port ${requestedPort}).`);
 }
 
 function getBoundPort(server) {

packages/mcp-server/test/test-daemon-port-fallback.test.js

@@ -52,3 +52,20 @@ test('an unrelated fixed-port error is NOT swallowed as a fallback', async () =>
   const server = makeFakeServer((port) => (port === 8723 ? 'EPERM' : 'ok'));
   await assert.rejects(() => listenAvoidingBlockedPorts(server, 8723, '127.0.0.1'), /EPERM/);
 });
+
+test('exhausting every retry on a browser-blocked port throws a clear error (not a silent unbound return)', async () => {
+  // Force the (in-practice-unreachable) case where every bind — including ephemeral — lands on a
+  // browser-blocked port. Ephemeral ports sit above the blocked range so this cannot really happen,
+  // but the loop must not fall through returning undefined with the server unbound: the caller then
+  // reads getBoundPort() and throws the misleading "not listening". An explicit throw fails clearly.
+  const s = new EventEmitter();
+  s._bound = null;
+  s.listen = () => { queueMicrotask(() => { s._bound = 6666; s.emit('listening'); }); }; // always a blocked port
+  s.address = () => (s._bound == null ? null : { port: s._bound, address: '127.0.0.1', family: 'IPv4' });
+  s.close = (cb) => { s._bound = null; if (cb) queueMicrotask(cb); };
+
+  await assert.rejects(
+    () => listenAvoidingBlockedPorts(s, 0, '127.0.0.1'),
+    /could not bind a usable/i,
+  );
+});