@alfe.ai/ctrader-mcp 0.3.9 → 0.3.11

package/dist/server.js

@@ -618,6 +618,33 @@ const RECONNECT_BASE_MS = 1e3;
 const RECONNECT_MAX_MS = 3e4;
 const MAX_PENDING_REQUESTS = 256;
 /**
+* How long the TCP + TLS dial may take before we give up. Without this a
+* blackholed SYN or a stalled TLS handshake never settles — `tls.connect`
+* emits neither `secureConnect` nor `error` — so every caller of `start()`
+* hung indefinitely. Observed in prod as MCP `-32001 Request timed out` on
+* every ctrader tool while cron runs burned their whole budget inside one
+* dial (Sentry LOCAL-MCP-K/-M/-N/-P).
+*/
+const CONNECT_TIMEOUT_MS = 1e4;
+/**
+* How long `start()` lets a CALLER wait for a connection attempt (initial or
+* reconnect) before failing that call while the attempt keeps going in the
+* background. The reconnect loop retries forever by design; a tool call must
+* not inherit that patience — the MCP client aborts at 60s (`-32001`) and
+* cron jobs abort mid-call, both of which surface worse errors later than an
+* honest, retryable `CONNECTION_UNAVAILABLE` now.
+*
+* Budget (connect/auth/tool path): 15s here + 20s account-auth request + 20s
+* tool request = 55s worst case, inside the MCP client's 60s default request
+* timeout. The rare `CH_ACCESS_TOKEN_INVALID` refresh+retry path has its own
+* larger budget (refresh POST ≤20s, then a second auth+request pass) that can
+* exceed the 60s window under compounded latency — accepted, because it fires
+* only when the ~30-day grant token expires AND the refresh hop is slow, and
+* it self-heals: the refresh rewrites the registry token even if THIS call is
+* aborted, so the next call skips the refresh and fits the normal budget.
+*/
+const START_WAIT_TIMEOUT_MS = 15e3;
+/**
 * Read-idle watchdog: cTrader echoes our heartbeats and pushes its own traffic,
 * so a *healthy* socket is never silent for long. If NO inbound byte arrives
 * for this long we treat the socket as silently half-dead (a TCP half-open with
@@ -646,16 +673,26 @@ function log$1(msg) {
 function accountIdLong(accountId) {
 	return protobuf.util.LongBits.from(accountId).toLong(false);
 }
-/** Production TLS transport. */
+/** Production TLS transport. The dial is bounded by `CONNECT_TIMEOUT_MS`. */
 const tlsConnect = (host, port) => new Promise((resolve, reject) => {
 	const socket = tls.connect({
 		host,
 		port,
 		servername: host
-	}, () => {
+	});
+	const dialTimer = setTimeout(() => {
+		socket.destroy();
+		reject(new CTraderError("CONNECT_TIMEOUT", `TCP/TLS connect to ${host}:${String(port)} did not complete within ${String(CONNECT_TIMEOUT_MS)}ms`));
+	}, CONNECT_TIMEOUT_MS);
+	dialTimer.unref();
+	socket.once("secureConnect", () => {
+		clearTimeout(dialTimer);
 		resolve(socket);
 	});
-	socket.once("error", reject);
+	socket.once("error", (err) => {
+		clearTimeout(dialTimer);
+		reject(err);
+	});
 });
 /**
 * A single authenticated socket to ONE cTrader host (live or demo).
@@ -699,18 +736,42 @@ var HostSocket = class {
 		this.connectFn = connectFn;
 		this.root = root;
 	}
-	/** Connect the socket and run the app-auth handshake. Idempotent. */
+	/**
+	* Connect the socket and run the app-auth handshake. Idempotent.
+	*
+	* Foreground waits are bounded by `START_WAIT_TIMEOUT_MS`: if the connection
+	* (initial or reconnect) is not up in time the CALLER gets a retryable
+	* `CONNECTION_UNAVAILABLE` while the attempt keeps going in the background —
+	* the next call joins the same in-flight attempt. Without this bound, a
+	* caller arriving during an outage awaited the infinite reconnect loop and
+	* hung until the MCP client's 60s abort.
+	*/
 	async start() {
 		if (this.closing) throw new CTraderError("CLIENT_CLOSED", "Client is shutting down");
 		if (this.conn) return;
-		if (this.reconnectPromise) return this.reconnectPromise;
-		if (this.connectPromise) return this.connectPromise;
+		const pending = this.reconnectPromise ?? this.connectPromise;
+		if (pending) return this.waitForConnection(pending);
 		const attempt = this.establishConnection();
 		this.connectPromise = attempt;
+		attempt.then(() => {
+			if (this.connectPromise === attempt) this.connectPromise = null;
+		}, () => {
+			if (this.connectPromise === attempt) this.connectPromise = null;
+		});
+		return this.waitForConnection(attempt);
+	}
+	/** Await a connection attempt, giving up (without cancelling it) at the deadline. */
+	async waitForConnection(pending) {
+		let deadline;
 		try {
-			await attempt;
+			await Promise.race([pending, new Promise((_, reject) => {
+				deadline = setTimeout(() => {
+					reject(new CTraderError("CONNECTION_UNAVAILABLE", `No connection to ${this.host} within ${String(START_WAIT_TIMEOUT_MS)}ms — still ${this.reconnectPromise ? "reconnecting" : "connecting"} in the background, retry shortly`));
+				}, START_WAIT_TIMEOUT_MS);
+				deadline.unref();
+			})]);
 		} finally {
-			if (this.connectPromise === attempt) this.connectPromise = null;
+			if (deadline) clearTimeout(deadline);
 		}
 	}
 	async establishConnection() {
@@ -1098,7 +1159,7 @@ var CTraderPool = class {
 		} catch (err) {
 			if (retryOnAuthFailure && err instanceof CTraderError && err.errorCode === ACCESS_TOKEN_INVALID && this.refresher !== void 0 && config.accountIdentifier.length > 0) {
 				try {
-					await this.refreshGrant(config.accountIdentifier);
+					await this.waitForRefresh(this.refreshGrant(config.accountIdentifier));
 				} catch (refreshErr) {
 					log$1(`Token refresh failed for account ${accountId}: ${refreshErr instanceof Error ? refreshErr.message : String(refreshErr)}`);
 					throw err;
@@ -1121,9 +1182,31 @@ var CTraderPool = class {
 		const promise = this.refreshGrantInner(accountIdentifier).finally(() => {
 			if (this.inFlightRefreshByGrant.get(accountIdentifier) === promise) this.inFlightRefreshByGrant.delete(accountIdentifier);
 		});
+		promise.catch(() => void 0);
 		this.inFlightRefreshByGrant.set(accountIdentifier, promise);
 		return promise;
 	}
+	/**
+	* Await an in-flight grant refresh, giving up (without cancelling it) after
+	* `REQUEST_TIMEOUT_MS`. A slow refresh hop must not stack onto the caller's
+	* request budget — the caller falls back to the original
+	* `CH_ACCESS_TOKEN_INVALID` — while the refresh keeps running in the
+	* background: when it lands it rewrites the registry token, so the NEXT
+	* call skips the refresh entirely and fits the normal budget.
+	*/
+	async waitForRefresh(pending) {
+		let deadline;
+		try {
+			await Promise.race([pending, new Promise((_, reject) => {
+				deadline = setTimeout(() => {
+					reject(new CTraderError("REFRESH_TIMEOUT", `Token refresh did not complete within ${String(REQUEST_TIMEOUT_MS)}ms — it continues in the background`));
+				}, REQUEST_TIMEOUT_MS);
+				deadline.unref();
+			})]);
+		} finally {
+			if (deadline) clearTimeout(deadline);
+		}
+	}
 	async refreshGrantInner(accountIdentifier) {
 		if (this.refresher === void 0) throw new CTraderError("NO_REFRESHER", "No cTrader token refresher is configured");
 		const { accessToken } = await this.refresher.refreshCTraderAccount(accountIdentifier);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/ctrader-mcp",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "description": "cTrader MCP server — full trading (market/limit/stop/stop-limit orders, trailing stops), Level 2 depth, live quotes, trade history, PnL & margin over the cTrader Open API (protobuf/TLS)",
   "type": "module",
   "main": "./dist/server.js",
@@ -21,7 +21,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "protobufjs": "^8.7.0",
     "zod": "^4.0.5",
-    "@alfe.ai/agent-api-client": "0.16.1",
+    "@alfe.ai/agent-api-client": "0.17.0",
     "@alfe.ai/config": "0.4.1"
   },
   "license": "UNLICENSED",