@tokenoftrust/cli 2.4.5 → 2.4.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.4.5",
+  "version": "2.4.7",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/submit.mjs

@@ -1101,16 +1101,13 @@ export async function submitCandidate(scoped, { repo, changeId, ref, headSha, ch
     return result;
   } catch (e) {
     if (e instanceof CandidateRegistrationError) throw e;
-    // "502 despite success" (migration DAG §U4): candidate_open's forge write is
-    // idempotent and may have LANDED even though its HTTP response never reached us
-    // (a 5xx between MCP and its own caller, a dropped connection, …). Before reporting
-    // a fatal "candidate not created," re-read it by its stable changeId — if it's
-    // already there with the exact ref/head we just pushed, this submit DID succeed;
-    // report that instead of a false failure. Purely a recovery path: any error from
-    // the re-read (including "not found," which is the ordinary case for a genuine
-    // registration failure) falls through to the original fatal error, unchanged.
-    const httpStatus = /** @type {any} */ (e)?.diagnostic?.httpStatus;
-    if (typeof httpStatus === "number" && httpStatus >= 500) {
+    // candidate_open's forge write is idempotent and may have LANDED even though its
+    // response never reached us (a gateway 5xx, a dropped connection, our own timeout).
+    // Before reporting a fatal "candidate not created," re-read it by its stable changeId
+    // — if it's already there with the exact ref/head we just pushed, this submit DID
+    // succeed. Any error from the re-read (including "not found," the ordinary case for a
+    // genuine registration failure) falls through to the original fatal error, unchanged.
+    if (responseLost(e)) {
       const existing = await fetchCandidateStatus(scoped, { repo, changeId }).catch(() => null);
       if (
         existing
@@ -1127,6 +1124,14 @@ export async function submitCandidate(scoped, { repo, changeId, ref, headSha, ch
   }
 }
 
+/** True when a call's outcome is unknown — the server may have acted, but its answer
+ *  never arrived — as opposed to a refusal the server actually sent. */
+function responseLost(error) {
+  const d = /** @type {any} */ (error)?.diagnostic;
+  if (typeof d?.httpStatus === "number" && d.httpStatus >= 500) return true;
+  return d?.category === "network" || d?.category === "timeout";
+}
+
 /** Print the candidate_open result: the PR the approver reviews, or the MCP's own
  *  refusal message when it couldn't open/update one. `quiet` (--json) suppresses it.
  *  Deliberately does NOT print `result.url` — that's the INTERNAL forge (Gitea) PR

package/src/update-check.mjs

@@ -21,8 +21,8 @@
  *     result (instant, no network on the hot path); the registry refresh happens in a
  *     DETACHED, unref'd child so it can't add latency or hold the process open.
  *   • Cached in `~/.tot/update-check.json`; refreshed at most once per CHECK_INTERVAL_MS.
- *   • Suppressed when stderr isn't a TTY, in CI, or when TOT_NO_UPDATE_CHECK /
- *     NO_UPDATE_NOTIFIER is set. `TOT_HOME` overrides the home dir (tests).
+ *   • Printed to stderr whether or not it is a TTY; suppressed in CI or when
+ *     TOT_NO_UPDATE_CHECK / NO_UPDATE_NOTIFIER is set. `TOT_HOME` overrides the home dir (tests).
  */
 import { readFileSync, writeFileSync, mkdirSync, renameSync, chmodSync } from "node:fs";
 import { homedir } from "node:os";
@@ -195,11 +195,15 @@ export function renderNotice(notice, current) {
     .join("\n");
 }
 
-/** Whether we should print a nudge at all in this environment. */
-export function shouldShowNudge(env = process.env, stream = process.stderr) {
+/**
+ * Whether we should print a nudge at all in this environment. Deliberately NOT
+ * gated on a TTY: agent-driven sessions run `tot` non-interactively, and a stale
+ * CLI caps the runner it resolves at its own major.minor. The nudge goes to
+ * stderr, so stdout stays parseable.
+ */
+export function shouldShowNudge(env = process.env) {
   if (env.TOT_NO_UPDATE_CHECK || env.NO_UPDATE_NOTIFIER) return false;
   if (env.CI) return false;
-  if (!stream || !stream.isTTY) return false;
   return true;
 }
 
@@ -292,7 +296,7 @@ function refreshInBackground(env) {
  */
 export function maybeNotifyUpdate(current, env = process.env, { stream = process.stderr } = {}) {
   try {
-    if (shouldShowNudge(env, stream)) {
+    if (shouldShowNudge(env)) {
       const notice = updateNotice(current, env);
       if (notice) stream.write(`${renderNotice(notice, current)}\n`);
     }