@tokenoftrust/cli 2.4.5 → 2.4.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.4.5",
+  "version": "2.4.6",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/submit.mjs

@@ -1101,16 +1101,13 @@ export async function submitCandidate(scoped, { repo, changeId, ref, headSha, ch
     return result;
   } catch (e) {
     if (e instanceof CandidateRegistrationError) throw e;
-    // "502 despite success" (migration DAG §U4): candidate_open's forge write is
-    // idempotent and may have LANDED even though its HTTP response never reached us
-    // (a 5xx between MCP and its own caller, a dropped connection, …). Before reporting
-    // a fatal "candidate not created," re-read it by its stable changeId — if it's
-    // already there with the exact ref/head we just pushed, this submit DID succeed;
-    // report that instead of a false failure. Purely a recovery path: any error from
-    // the re-read (including "not found," which is the ordinary case for a genuine
-    // registration failure) falls through to the original fatal error, unchanged.
-    const httpStatus = /** @type {any} */ (e)?.diagnostic?.httpStatus;
-    if (typeof httpStatus === "number" && httpStatus >= 500) {
+    // candidate_open's forge write is idempotent and may have LANDED even though its
+    // response never reached us (a gateway 5xx, a dropped connection, our own timeout).
+    // Before reporting a fatal "candidate not created," re-read it by its stable changeId
+    // — if it's already there with the exact ref/head we just pushed, this submit DID
+    // succeed. Any error from the re-read (including "not found," the ordinary case for a
+    // genuine registration failure) falls through to the original fatal error, unchanged.
+    if (responseLost(e)) {
       const existing = await fetchCandidateStatus(scoped, { repo, changeId }).catch(() => null);
       if (
         existing
@@ -1127,6 +1124,14 @@ export async function submitCandidate(scoped, { repo, changeId, ref, headSha, ch
   }
 }
 
+/** True when a call's outcome is unknown — the server may have acted, but its answer
+ *  never arrived — as opposed to a refusal the server actually sent. */
+function responseLost(error) {
+  const d = /** @type {any} */ (error)?.diagnostic;
+  if (typeof d?.httpStatus === "number" && d.httpStatus >= 500) return true;
+  return d?.category === "network" || d?.category === "timeout";
+}
+
 /** Print the candidate_open result: the PR the approver reviews, or the MCP's own
  *  refusal message when it couldn't open/update one. `quiet` (--json) suppresses it.
  *  Deliberately does NOT print `result.url` — that's the INTERNAL forge (Gitea) PR