@labelgrid/mcp 0.2.1 → 0.2.2

package/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to `@labelgrid/mcp` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.2] - 2026-07-16
+
+### Changed
+
+- API requests time out after 60 seconds (structured `TIMEOUT` error) and raw
+  transfers after 10 minutes — a hung call can no longer hang a tool.
+- CI and publish workflows install dependencies with `--ignore-scripts`.
+
 ## [0.2.1] - 2026-07-15
 
 ### Added

package/README.md

@@ -1,6 +1,6 @@
 # LabelGrid MCP Server
 
-[![npm version](https://img.shields.io/npm/v/%40labelgrid%2Fmcp)](https://www.npmjs.com/package/@labelgrid/mcp) [![LabelGrid MCP server](https://glama.ai/mcp/servers/@labelgrid/labelgrid-mcp/badges/score.svg)](https://glama.ai/mcp/servers/@labelgrid/labelgrid-mcp)
+[![npm version](https://img.shields.io/npm/v/%40labelgrid%2Fmcp)](https://www.npmjs.com/package/@labelgrid/mcp) [![CI](https://github.com/labelgrid/labelgrid-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/labelgrid/labelgrid-mcp/actions/workflows/ci.yml) [![LabelGrid MCP server](https://glama.ai/mcp/servers/@labelgrid/labelgrid-mcp/badges/score.svg)](https://glama.ai/mcp/servers/@labelgrid/labelgrid-mcp)
 
 `@labelgrid/mcp` — the official [Model Context Protocol](https://modelcontextprotocol.io) server for [LabelGrid](https://labelgrid.com), the music distribution platform. Point Claude Desktop, Claude Code, Cursor, or any MCP client at your own LabelGrid account and manage your music catalog, releases, files, analytics, royalty accounting, webhooks, and distribution in natural language — it is a thin, typed wrapper over the LabelGrid public API, so every rule and validation stays on the server.
 

package/dist/api/http.d.ts

@@ -28,14 +28,26 @@ export declare class LabelGridClient {
     private readonly token;
     private readonly fetchFn;
     private readonly version;
+    private readonly timeoutMs;
+    private readonly rawTimeoutMs;
     constructor(opts: {
         baseUrl: string;
         token: string;
         fetchFn?: typeof fetch;
         version: string;
+        /** API request timeout (default 60s) — a hung call must never hang a tool. */
+        timeoutMs?: number;
+        /** Timeout for raw transfers like presigned uploads (default 10min). */
+        rawTimeoutMs?: number;
     });
     private authHeaders;
     private send;
+    /**
+     * Reads a response body with the byte ceiling enforced mid-stream. Returns
+     * the decoded text, or the supplied too-large error result when the ceiling
+     * is crossed. Abort/timeout rejections propagate to the caller for mapping.
+     */
+    private readBody;
     get<T>(path: string, query?: Record<string, unknown>): Promise<ApiResult<T>>;
     post<T>(path: string, body?: unknown, opts?: {
         idempotency?: boolean;

package/dist/api/http.js

@@ -166,11 +166,15 @@ export class LabelGridClient {
     token;
     fetchFn;
     version;
+    timeoutMs;
+    rawTimeoutMs;
     constructor(opts) {
         this.baseUrl = opts.baseUrl.replace(/\/+$/, '');
         this.token = opts.token;
         this.fetchFn = opts.fetchFn ?? fetch;
         this.version = opts.version;
+        this.timeoutMs = opts.timeoutMs ?? 60_000;
+        this.rawTimeoutMs = opts.rawTimeoutMs ?? 600_000;
     }
     authHeaders() {
         return {
@@ -187,7 +191,7 @@ export class LabelGridClient {
             // across separate tool calls); otherwise a fresh UUID is generated.
             headers['Idempotency-Key'] = opts.idempotencyKey ?? randomUUID();
         }
-        const init = { method, headers };
+        const init = { method, headers, signal: AbortSignal.timeout(this.timeoutMs) };
         if (opts.rawBody !== undefined) {
             init.body = opts.rawBody;
         }
@@ -200,6 +204,16 @@ export class LabelGridClient {
             res = await this.fetchFn(url, init);
         }
         catch (err) {
+            if (err instanceof DOMException &&
+                (err.name === 'TimeoutError' || err.name === 'AbortError')) {
+                return {
+                    error: {
+                        code: 'TIMEOUT',
+                        message: `The request timed out after ${Math.round(this.timeoutMs / 1000)} seconds. Try again, or narrow the request.`,
+                        status: 0,
+                    },
+                };
+            }
             return {
                 error: {
                     code: 'NETWORK_ERROR',
@@ -229,7 +243,54 @@ export class LabelGridClient {
         // A chunked/streamed response carries no Content-Length, so bound it AS we
         // read: accumulate chunks with a running byte counter and abort the moment
         // the counter crosses the ceiling — never buffering the whole oversized body.
+        // The request timeout keeps running while the body streams, so a read can
+        // also abort here — map that to the same structured TIMEOUT.
         let text;
+        try {
+            text = await this.readBody(res, tooLarge);
+        }
+        catch (err) {
+            if (err instanceof DOMException &&
+                (err.name === 'TimeoutError' || err.name === 'AbortError')) {
+                return {
+                    error: {
+                        code: 'TIMEOUT',
+                        message: `The request timed out after ${Math.round(this.timeoutMs / 1000)} seconds while reading the response. Try again, or narrow the request.`,
+                        status: 0,
+                    },
+                };
+            }
+            return {
+                error: {
+                    code: 'NETWORK_ERROR',
+                    message: err instanceof Error ? err.message : 'Reading the response failed.',
+                    status: 0,
+                },
+            };
+        }
+        if (typeof text !== 'string') {
+            return text; // the bounded reader returned the too-large error result
+        }
+        let body = null;
+        if (text.length > 0) {
+            try {
+                body = JSON.parse(text);
+            }
+            catch {
+                body = text;
+            }
+        }
+        if (res.ok) {
+            return { data: body };
+        }
+        return { error: normalizeError(res, body) };
+    }
+    /**
+     * Reads a response body with the byte ceiling enforced mid-stream. Returns
+     * the decoded text, or the supplied too-large error result when the ceiling
+     * is crossed. Abort/timeout rejections propagate to the caller for mapping.
+     */
+    async readBody(res, tooLarge) {
         if (res.body) {
             const reader = res.body.getReader();
             const chunks = [];
@@ -260,29 +321,15 @@ export class LabelGridClient {
                 merged.set(chunk, offset);
                 offset += chunk.byteLength;
             }
-            text = new TextDecoder('utf-8').decode(merged);
-        }
-        else {
-            // No readable stream (some test stubs) — fall back to text() and measure
-            // the true byte length as a backstop (multi-byte chars exceed char count).
-            text = await res.text();
-            if (Buffer.byteLength(text, 'utf8') > MAX_RESPONSE_BYTES) {
-                return tooLarge;
-            }
-        }
-        let body = null;
-        if (text.length > 0) {
-            try {
-                body = JSON.parse(text);
-            }
-            catch {
-                body = text;
-            }
+            return new TextDecoder('utf-8').decode(merged);
         }
-        if (res.ok) {
-            return { data: body };
+        // No readable stream (some test stubs) — fall back to text() and measure
+        // the true byte length as a backstop (multi-byte chars exceed char count).
+        const text = await res.text();
+        if (Buffer.byteLength(text, 'utf8') > MAX_RESPONSE_BYTES) {
+            return tooLarge;
         }
-        return { error: normalizeError(res, body) };
+        return text;
     }
     get(path, query) {
         return this.send('GET', path, { query });
@@ -340,6 +387,6 @@ export class LabelGridClient {
      * Bearer token would break the signature.
      */
     raw(url, init) {
-        return this.fetchFn(url, init);
+        return this.fetchFn(url, { signal: AbortSignal.timeout(this.rawTimeoutMs), ...init });
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@labelgrid/mcp",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "mcpName": "io.github.labelgrid/labelgrid-mcp",
   "description": "Official LabelGrid MCP server — connect your AI client to your LabelGrid account",
   "type": "module",

package/server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.labelgrid/labelgrid-mcp",
   "description": "Official LabelGrid MCP server — manage your music catalog, releases, analytics and distribution.",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "websiteUrl": "https://labelgrid.com",
   "repository": {
     "url": "https://github.com/labelgrid/labelgrid-mcp",
@@ -12,7 +12,7 @@
     {
       "registryType": "npm",
       "identifier": "@labelgrid/mcp",
-      "version": "0.2.1",
+      "version": "0.2.2",
       "transport": {
         "type": "stdio"
       },