fix(broadcast): bail on confirmed-with-err to avoid CF 504

[rz1989s]

Summary

Closes #299. When a transaction is confirmed on-chain but the program returns an error (e.g. AccountNotInitialized, slippage exceeded), sendAndConfirmWithRetry used to discard value.err from confirmTransaction and return the signature as a success. If the WS subscription was slow to fire, confirmTransaction polled until blockhash expiry (~90s), exceeding the 100s Cloudflare edge timeout — the user saw a generic CF 504 HTML page instead of a structured error envelope.

This PR implements Option 3 from the issue:

1. confirmInspected — wraps connection.confirmTransaction and throws a new TransactionFailedOnChainError when value.err is non-null, capturing both the signature and the err detail.
2. pollForErr — runs in parallel, calling getSignatureStatuses every interval and returning the same typed error the moment the RPC reports confirmed-with-err. Either path wins the race; /api/tx/broadcast catches the typed error and returns a structured 502 TX_FAILED_ON_CHAIN with the err payload so the FE can render an actionable message.

The poll loop is fire-and-forget on cleanup so successful broadcasts do not pay an extra interval (2s in prod) of latency waiting for the poll to observe stopped=true.

Response envelope on a confirmed-with-err tx

Before:

• Best case: 200 { signature } with a signature whose tx errored — FE proceeded as if success.
• Worst case: CF 504 HTML page after 100s.

After:

{
  "error": {
    "code": "TX_FAILED_ON_CHAIN",
    "message": "Transaction <sig> confirmed on-chain but the program returned an error: {\"InstructionError\":[0,{\"Custom\":3012}]}",
    "signature": "<sig>",
    "err": { "InstructionError": [0, { "Custom": 3012 }] }
  }
}

Test plan

• pnpm test -- --run in packages/agent — 1652 passed (was 1648, +4 new tests: 3 in sendWithRetry, 1 in tx-broadcast)
• pnpm typecheck clean across root + sdk + app + agent
• New tests cover three paths: (a) confirmTransaction returns { value: { err } } → throws; (b) getSignatureStatuses detects err first while confirmTransaction hangs → throws; (c) poll stays quiet on null (tx-not-yet-seen) status while confirmation resolves cleanly.
• routes/tx-broadcast test asserts the structured 502 TX_FAILED_ON_CHAIN envelope shape (code, message, signature, err).
• Post-merge: re-run /tmp/sipher-smoke/smoke5.mjs once VPS deploys — expect /api/tx/broadcast to return the new 502 envelope instead of 200 for the confirmed-with-3012 signature.

Notes

• The winner.kind === 'polled' && !winner.errOrNull branch is structurally unreachable (poll only returns null when stopped=true, set in finally); the code throws an invariant error if it ever fires.
• redact() is reused on err.message to ensure Helius API-key fragments don't escape if a future code path attaches them.
• Smoke evidence from frontier_sip_18 + 19: confirmTransaction typically resolves in ~3s for confirmed-with-err txs, so this is primarily a correctness fix; the parallel poll adds defense-in-depth for the slow-subscription edge case the issue called out.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sipher	Ready	Preview, Comment	May 23, 2026 2:44pm