@tokenoftrust/cli 2.2.2 → 2.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/mcp.mjs

@@ -12,6 +12,10 @@ import { randomUUID } from "node:crypto";
 import os from "node:os";
 import { CliDiagnosticError, recordDiagnostic, sanitizeDiagnosticText } from "./diagnostics.mjs";
 
+// A server's refusal is written for the person reading it and usually ends with what to do,
+// so it is shown whole. The cap only bounds a runaway body; sanitizing still applies.
+export const MAX_SERVER_MESSAGE = 4000;
+
 const TRACE_HEADER = "X-Trace-Id";
 const REQUEST_ID_HEADERS = ["x-request-id", "x-amzn-trace-id", "x-correlation-id"];
 const DEFAULT_REQUEST_TIMEOUT_MS = 120_000;
@@ -188,7 +192,7 @@ export function createMcpClient(baseUrl, opts = {}) {
       const category = signal.aborted ? "timeout" : "network";
       const message = signal.aborted
         ? `${method} timed out after ${timeoutMs}ms`
-        : `${method} failed before a response arrived: ${sanitizeDiagnosticText(cause?.message || cause, 300)}`;
+        : `${method} failed before a response arrived: ${sanitizeDiagnosticText(cause?.message || cause, MAX_SERVER_MESSAGE)}`;
       throw diagnosticError(message, { operation: method, category, message, traceId }, cause);
     }
     const sid = res.headers.get("Mcp-Session-Id");
@@ -229,7 +233,7 @@ export function createMcpClient(baseUrl, opts = {}) {
       const category = oauth ? "oauth" : res.status === 413 ? "http_413" : `http_${res.status}`;
       const message = sanitizeDiagnosticText(
         failure.message || parsed?.error_description || `${res.status} ${res.statusText}`,
-        300,
+        MAX_SERVER_MESSAGE,
       );
       throw diagnosticError(`${method} failed: HTTP ${res.status}${message ? ` — ${message}` : ""}`, {
         operation: method, category, httpStatus: res.status, statusText: res.statusText,
@@ -249,7 +253,7 @@ export function createMcpClient(baseUrl, opts = {}) {
 
     if (parsed?.error) {
       const failure = safeServerFailure(parsed);
-      const message = sanitizeDiagnosticText(failure.message || "JSON-RPC error", 300);
+      const message = sanitizeDiagnosticText(failure.message || "JSON-RPC error", MAX_SERVER_MESSAGE);
       throw diagnosticError(`${method} failed: ${message}`, {
         operation: method, category: "json_rpc", httpStatus: res.status,
         statusText: res.statusText, serverCode: failure.serverCode, message,
@@ -310,7 +314,7 @@ export function createMcpClient(baseUrl, opts = {}) {
       }
       const message = sanitizeDiagnosticText(
         payload?.message || payload?.error?.message || tb?.text || `${name} failed`,
-        300,
+        MAX_SERVER_MESSAGE,
       );
       throw diagnosticError(`${name} failed: ${message}`, {
         operation: name, category: "tool_error",