@mindstone/mcp-server-salesforce 0.2.1 → 0.2.2

package/README.md

@@ -9,7 +9,7 @@ Salesforce CRM MCP server — accounts, contacts, opportunities, leads, tasks, u
 
 ## Status
 
-- **Version:** [0.2.1](./CHANGELOG.md) · [npm](https://www.npmjs.com/package/@mindstone/mcp-server-salesforce)
+- **Version:** [0.2.2](./CHANGELOG.md) · [npm](https://www.npmjs.com/package/@mindstone/mcp-server-salesforce)
 - **Auth:** OAuth (local 127.0.0.1 callback) or static access token ([`SALESFORCE_CLIENT_SECRET`](./server.json), [`SALESFORCE_ACCESS_TOKEN`](./server.json))
 - **Tools:** [37](./src/tools/) (accounts, contacts, opportunities, leads, tasks, cases, events, search, notes, campaigns, reports, query)
 - **Surface:** cloud-api

package/dist/bridge.d.ts

@@ -4,8 +4,13 @@
 export declare const BRIDGE_STATE_PATH: string;
 /**
  * Send a request to the host app bridge.
+ *
+ * `timeoutMs` defaults to the ordinary per-call budget (REQUEST_TIMEOUT_MS);
+ * callers that trigger long host-side flows (e.g. interactive OAuth) can opt
+ * into a longer one. The abort itself is never removed — only widened — so a
+ * dead bridge still fails within the chosen bound.
  */
-export declare const bridgeRequest: (urlPath: string, body?: Record<string, unknown>) => Promise<{
+export declare const bridgeRequest: (urlPath: string, body?: Record<string, unknown>, timeoutMs?: number) => Promise<{
     success: boolean;
     username?: string;
     warning?: string;

package/dist/bridge.js

@@ -17,15 +17,20 @@ const loadBridgeState = () => {
 };
 /**
  * Send a request to the host app bridge.
+ *
+ * `timeoutMs` defaults to the ordinary per-call budget (REQUEST_TIMEOUT_MS);
+ * callers that trigger long host-side flows (e.g. interactive OAuth) can opt
+ * into a longer one. The abort itself is never removed — only widened — so a
+ * dead bridge still fails within the chosen bound.
  */
-export const bridgeRequest = async (urlPath, body = {}) => {
+export const bridgeRequest = async (urlPath, body = {}, timeoutMs = REQUEST_TIMEOUT_MS) => {
     const bridge = loadBridgeState();
     if (!bridge) {
         return { success: false, error: 'Bridge not available' };
     }
     const response = await fetch(`http://127.0.0.1:${bridge.port}${urlPath}`, {
         method: 'POST',
-        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        signal: AbortSignal.timeout(timeoutMs),
         headers: {
             'Content-Type': 'application/json',
             Authorization: `Bearer ${bridge.token}`,

package/dist/tools/auth-tools.js

@@ -3,6 +3,7 @@ import { z } from 'zod';
 import { withErrorHandling, sanitizeExternalData } from '../utils.js';
 import { getAuthMode, loadToken, startStandaloneOAuth } from '../auth.js';
 import { bridgeRequest } from '../bridge.js';
+import { BRIDGE_OAUTH_TIMEOUT_MS } from '../types.js';
 import { listConnectedAccounts, removeAccount } from '../client.js';
 // Disconnect needs a raw handle the model can copy verbatim into
 // salesforce_disconnect_account, but the storage id is username-derived
@@ -50,7 +51,11 @@ After connecting, verify with salesforce_list_connected_accounts.`,
             });
         }
         if (mode === 'bridge') {
-            const result = await bridgeRequest(process.env.MCP_BRIDGE_CONFIGURE_ENDPOINT || '/mcp/configure', {});
+            // The host holds this response open until the user completes the
+            // interactive OAuth flow in their browser (up to 5 minutes), so this
+            // call needs the long budget — the default 30s abort would kill the
+            // connect mid-flow while the human is still signing in.
+            const result = await bridgeRequest(process.env.MCP_BRIDGE_CONFIGURE_ENDPOINT || '/mcp/configure', {}, BRIDGE_OAUTH_TIMEOUT_MS);
             if (result.success) {
                 // The bridge username is host/org-authored external text: envelope
                 // it before it reaches model-visible output (AGENTS.md invariant #6).

package/dist/types.d.ts

@@ -1,4 +1,15 @@
 export declare const REQUEST_TIMEOUT_MS = 30000;
+/**
+ * Bridge budget for the OAuth-initiating `/mcp/configure` call. The host
+ * holds that HTTP response open until the user finishes the interactive
+ * browser sign-in — both the host's own OAuth flow and this connector's
+ * standalone flow cap the wait at 5 minutes. The ordinary 30s
+ * REQUEST_TIMEOUT_MS therefore aborts mid-flow on any human-paced connect
+ * and reports a spurious failure. 5 minutes + 30s slack for the host's
+ * post-auth work (token exchange, config write, reload) — deliberately
+ * bounded so a genuinely dead bridge still fails instead of hanging forever.
+ */
+export declare const BRIDGE_OAUTH_TIMEOUT_MS: number;
 export declare const SERVER_NAME = "salesforce-mcp-server";
 /**
  * Salesforce REST API version the connector pins every request to. Pinned

package/dist/types.js

@@ -2,6 +2,17 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const pkg = require('../package.json');
 export const REQUEST_TIMEOUT_MS = 30_000;
+/**
+ * Bridge budget for the OAuth-initiating `/mcp/configure` call. The host
+ * holds that HTTP response open until the user finishes the interactive
+ * browser sign-in — both the host's own OAuth flow and this connector's
+ * standalone flow cap the wait at 5 minutes. The ordinary 30s
+ * REQUEST_TIMEOUT_MS therefore aborts mid-flow on any human-paced connect
+ * and reports a spurious failure. 5 minutes + 30s slack for the host's
+ * post-auth work (token exchange, config write, reload) — deliberately
+ * bounded so a genuinely dead bridge still fails instead of hanging forever.
+ */
+export const BRIDGE_OAUTH_TIMEOUT_MS = 5 * 60 * 1000 + REQUEST_TIMEOUT_MS;
 export const SERVER_NAME = 'salesforce-mcp-server';
 /**
  * Salesforce REST API version the connector pins every request to. Pinned

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindstone/mcp-server-salesforce",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "mcpName": "io.github.mindstone/mcp-server-salesforce",
   "description": "Salesforce CRM MCP server — accounts, contacts, opportunities, leads, tasks, and custom objects via Salesforce API",
   "license": "FSL-1.1-MIT",