@vibecodr/cli 0.2.8 → 0.2.10

package/dist/commands/call.js

@@ -42,12 +42,12 @@ async function readStdin() {
     }
     return Buffer.concat(chunks).toString("utf8");
 }
-export async function callToolWithRetry(context, toolName, input, allowLogin) {
+export async function callToolWithRetry(context, toolName, input, allowLogin, options) {
     const { profileName, serverUrl } = await context.tokenManager.resolveProfile(context.globalOptions);
     const existingSession = await context.tokenManager.getSession(profileName, serverUrl);
     try {
         return {
-            result: await context.runtimeClient.callTool(serverUrl, existingSession?.accessToken, toolName, input),
+            result: await context.runtimeClient.callTool(serverUrl, existingSession?.accessToken, toolName, input, options),
             ...(existingSession ? { session: existingSession } : {})
         };
     }
@@ -57,7 +57,7 @@ export async function callToolWithRetry(context, toolName, input, allowLogin) {
         if (error.machineCode === "auth.required" && existingSession?.refreshToken) {
             const refreshed = await context.tokenManager.refresh(profileName, existingSession);
             return {
-                result: await context.runtimeClient.callTool(serverUrl, refreshed.session.accessToken, toolName, input),
+                result: await context.runtimeClient.callTool(serverUrl, refreshed.session.accessToken, toolName, input, options),
                 session: refreshed.session
             };
         }
@@ -68,7 +68,7 @@ export async function callToolWithRetry(context, toolName, input, allowLogin) {
             });
             const nextSession = await context.tokenManager.getSession(profileName, serverUrl);
             return {
-                result: await context.runtimeClient.callTool(serverUrl, nextSession?.accessToken, toolName, input),
+                result: await context.runtimeClient.callTool(serverUrl, nextSession?.accessToken, toolName, input, options),
                 ...(nextSession ? { session: nextSession } : {})
             };
         }
@@ -98,17 +98,30 @@ async function listToolsWithRetry(context, allowLogin) {
         throw error;
     }
 }
+function parseCallTimeoutSeconds(value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || !value.trim()) {
+        throw new CliError("usage.call_timeout_invalid", "--timeout-sec must be a positive number of seconds.", EXIT_CODES.usage);
+    }
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        throw new CliError("usage.call_timeout_invalid", "--timeout-sec must be a positive number of seconds.", EXIT_CODES.usage);
+    }
+    return parsed;
+}
 export async function runCallCommand(args, context) {
-    if (showHelpIfRequested(args, context, "Usage: vibecodr call <tool-name> [--input-json <json>] [--input-file <path>] [--stdin] [--interactive] [--no-login] [--confirm]"))
+    if (showHelpIfRequested(args, context, "Usage: vibecodr call <tool-name> [--input-json <json>] [--input-file <path>] [--stdin] [--interactive] [--timeout-sec <seconds>] [--no-login] [--confirm]"))
         return;
     const { flags, positionals } = parseFlags(args, {
-        valueFlags: ["input-json", "input-file"],
+        valueFlags: ["input-json", "input-file", "timeout-sec"],
         booleanFlags: ["stdin", "interactive", "no-login", "confirm"]
     });
     const toolName = positionals[0];
     if (!toolName) {
         throw new CliError("usage.tool_name_required", "A tool name is required.", EXIT_CODES.usage);
     }
+    const timeoutSeconds = parseCallTimeoutSeconds(flags["timeout-sec"]);
     let input = {};
     if (typeof flags["input-json"] === "string") {
         input = JSON.parse(flags["input-json"]);
@@ -133,7 +146,7 @@ export async function runCallCommand(args, context) {
     if (CONFIRMED_TOOL_NAMES.has(toolName)) {
         input = { ...input, confirmed: true };
     }
-    const { result } = await callToolWithRetry(context, toolName, input, !flags["no-login"]);
+    const { result } = await callToolWithRetry(context, toolName, input, !flags["no-login"], timeoutSeconds === undefined ? undefined : { timeoutSeconds });
     context.output.success({
         schemaVersion: 1,
         tool: toolName,

package/dist/commands/upload.js

@@ -10,6 +10,7 @@ const CREATE_STAGED_UPLOAD_TOOL_NAME = "create_staged_upload";
 const COMPLETE_STAGED_UPLOAD_TOOL_NAME = "complete_staged_upload";
 const ABORT_STAGED_UPLOAD_TOOL_NAME = "abort_staged_upload";
 const SOURCE_ZIP_CONTENT_TYPE = "application/zip";
+const DEFAULT_STAGED_UPLOAD_TIMEOUT_SECONDS = 600;
 const SOURCE_ZIP_CONTENT_TYPES = new Set(["application/zip", "application/x-zip-compressed"]);
 const COVER_IMAGE_CONTENT_TYPES = new Set(["image/png", "image/jpeg", "image/webp", "image/avif"]);
 const AVATAR_IMAGE_CONTENT_TYPES = new Set(["image/png", "image/jpeg", "image/webp", "image/gif"]);
@@ -79,7 +80,7 @@ function readCompleteResult(result, fallbackUploadId) {
 }
 function parseUploadArgs(args) {
     const { flags, positionals } = parseFlags(args, {
-        valueFlags: ["zip", "image", "file", "kind", "content-type", "idempotency-key", "root-hint", "entry-hint"],
+        valueFlags: ["zip", "image", "file", "kind", "content-type", "idempotency-key", "root-hint", "entry-hint", "timeout-sec"],
         booleanFlags: ["no-login"]
     });
     const zipPath = readString(flags["zip"]);
@@ -98,6 +99,7 @@ function parseUploadArgs(args) {
     const rootHint = readString(flags["root-hint"]);
     const entryHint = readString(flags["entry-hint"]);
     const contentType = readString(flags["content-type"]);
+    const timeoutSeconds = parseUploadTimeoutSeconds(flags["timeout-sec"]);
     const rawKind = readString(flags["kind"]);
     let kind = imagePath ? "cover_image" : "source_zip";
     if (rawKind) {
@@ -116,9 +118,22 @@ function parseUploadArgs(args) {
         ...(idempotencyKey ? { idempotencyKey } : {}),
         ...(rootHint ? { rootHint } : {}),
         ...(entryHint ? { entryHint } : {}),
+        timeoutSeconds,
         allowLogin: flags["no-login"] !== true,
     };
 }
+function parseUploadTimeoutSeconds(value) {
+    if (value === undefined)
+        return DEFAULT_STAGED_UPLOAD_TIMEOUT_SECONDS;
+    if (typeof value !== "string" || !value.trim()) {
+        throw new CliError("usage.upload_timeout_invalid", "--timeout-sec must be a positive number of seconds.", EXIT_CODES.usage);
+    }
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        throw new CliError("usage.upload_timeout_invalid", "--timeout-sec must be a positive number of seconds.", EXIT_CODES.usage);
+    }
+    return parsed;
+}
 function sha256Hex(bytes) {
     return createHash("sha256").update(bytes).digest("hex");
 }
@@ -158,9 +173,9 @@ function toBlob(bytes, contentType) {
     new Uint8Array(buffer).set(bytes);
     return new Blob([buffer], { type: contentType });
 }
-async function abortBestEffort(context, uploadId, allowLogin) {
+async function abortBestEffort(context, uploadId, allowLogin, timeoutSeconds) {
     try {
-        await callToolWithRetry(context, ABORT_STAGED_UPLOAD_TOOL_NAME, { uploadId }, allowLogin);
+        await callToolWithRetry(context, ABORT_STAGED_UPLOAD_TOOL_NAME, { uploadId }, allowLogin, { timeoutSeconds });
     }
     catch {
         // Best-effort cleanup only. Preserve the upload failure as the surfaced error.
@@ -177,7 +192,7 @@ async function putBytesToStagedUpload(input) {
     }
 }
 export async function runUploadCommand(args, context) {
-    if (showHelpIfRequested(args, context, "Usage: vibecodr upload --zip <path> [--idempotency-key <key>] [--root-hint <path>] [--entry-hint <path>] [--no-login]\n       vibecodr upload --image <path> [--kind cover_image|avatar_image] [--content-type <mime>] [--no-login]"))
+    if (showHelpIfRequested(args, context, "Usage: vibecodr upload --zip <path> [--idempotency-key <key>] [--root-hint <path>] [--entry-hint <path>] [--timeout-sec <n>] [--no-login]\n       vibecodr upload --image <path> [--kind cover_image|avatar_image] [--content-type <mime>] [--timeout-sec <n>] [--no-login]"))
         return;
     const input = parseUploadArgs(args);
     const fileInfo = await stat(input.filePath).catch((error) => {
@@ -193,6 +208,7 @@ export async function runUploadCommand(args, context) {
     const fileName = basename(input.filePath) || (input.kind === "source_zip" ? "source.zip" : "image");
     const contentType = inferContentType(input.kind, fileName, input.contentType);
     const hash = sha256Hex(bytes);
+    const mcpRequestOptions = { timeoutSeconds: input.timeoutSeconds };
     const { result: createResult } = await callToolWithRetry(context, CREATE_STAGED_UPLOAD_TOOL_NAME, {
         kind: input.kind,
         fileName,
@@ -201,7 +217,7 @@ export async function runUploadCommand(args, context) {
         sha256: hash,
         createdBySurface: input.kind === "source_zip" ? "cli.upload.zip" : "cli.upload.image",
         ...(input.idempotencyKey ? { idempotencyKey: input.idempotencyKey } : {}),
-    }, input.allowLogin);
+    }, input.allowLogin, mcpRequestOptions);
     const created = readCreateResult(createResult);
     try {
         await putBytesToStagedUpload({
@@ -214,7 +230,7 @@ export async function runUploadCommand(args, context) {
             uploadId: created.uploadId,
             sizeBytes: bytes.byteLength,
             sha256: hash,
-        }, input.allowLogin);
+        }, input.allowLogin, mcpRequestOptions);
         const completed = readCompleteResult(completeResult, created.uploadId);
         const quickPublishPayload = {
             ...(input.kind === "source_zip"
@@ -264,7 +280,7 @@ export async function runUploadCommand(args, context) {
         ]);
     }
     catch (error) {
-        await abortBestEffort(context, created.uploadId, input.allowLogin);
+        await abortBestEffort(context, created.uploadId, input.allowLogin, input.timeoutSeconds);
         throw error;
     }
 }

package/dist/core/mcp-client.js

@@ -13,8 +13,8 @@ export const CLIENT_INFO = {
     name: "vibecodr-mcp",
     version: packageVersion
 };
-export function resolveToolRequestTimeoutMs(args) {
-    const raw = args["timeoutSeconds"];
+export function resolveToolRequestTimeoutMs(args, options) {
+    const raw = options?.timeoutSeconds ?? args["timeoutSeconds"];
     if (raw === undefined)
         return undefined;
     if (typeof raw !== "number" || !Number.isFinite(raw))
@@ -32,9 +32,9 @@ export class McpRuntimeClient {
             return result.tools;
         });
     }
-    async callTool(serverUrl, accessToken, name, args) {
+    async callTool(serverUrl, accessToken, name, args, options) {
         return await this.withClient(serverUrl, accessToken, async (client) => {
-            const timeout = resolveToolRequestTimeoutMs(args);
+            const timeout = resolveToolRequestTimeoutMs(args, options);
             return await client.callTool({
                 name,
                 arguments: args

package/docs/commands.md

@@ -58,7 +58,7 @@ This always reads the live tool catalog from the MCP server.
 
 Syntax:
 
-`vibecodr call <tool-name> [--input-json <json>] [--input-file <path>] [--stdin] [--interactive] [--no-login] [--confirm]`
+`vibecodr call <tool-name> [--input-json <json>] [--input-file <path>] [--stdin] [--interactive] [--timeout-sec <n>] [--no-login] [--confirm]`
 
 `--interactive` currently supports top-level scalar object fields.
 
@@ -66,13 +66,15 @@ For `quick_publish_creation` with `payload.importMode: "direct_files"`, pass fil
 
 Known mutating tools require explicit confirmation through `--confirm`. The CLI redacts secret, token, source, descriptor, and inline file-content fields from displayed arguments and results; the MCP gateway remains the authority boundary for OAuth, owner checks, confirmation, and output shaping.
 
+Use `--timeout-sec <n>` when a protected tool is expected to run longer than the default client wait, such as a build-backed publish retry. This changes only the local MCP transport timeout and is not forwarded as a server tool argument.
+
 ### `upload`
 
 Syntax:
 
-`vibecodr upload --zip <path> [--idempotency-key <key>] [--root-hint <path>] [--entry-hint <path>] [--no-login]`
+`vibecodr upload --zip <path> [--idempotency-key <key>] [--root-hint <path>] [--entry-hint <path>] [--timeout-sec <n>] [--no-login]`
 
-`vibecodr upload --image <path> [--kind cover_image|avatar_image] [--content-type <mime>] [--no-login]`
+`vibecodr upload --image <path> [--kind cover_image|avatar_image] [--content-type <mime>] [--timeout-sec <n>] [--no-login]`
 
 Stages a local ZIP or image through Vibecodr's API-owned upload session flow. The CLI asks the MCP gateway for a short-lived direct R2 PUT URL, uploads the bytes directly to R2, completes server-side verification, and prints safe identifiers only.
 
@@ -80,6 +82,8 @@ ZIP uploads print a `quickPublishPayload` snippet using `payload.importMode: "st
 
 Cover images support PNG, JPEG, WebP, and AVIF. Avatar images support PNG, JPEG, WebP, and GIF.
 
+Staged upload MCP setup and completion calls use a longer client-side wait by default so large ZIP verification does not fail only because the local CLI stopped waiting. Use `--timeout-sec <n>` only when a slower network needs a different local wait; this value is transport behavior and is not forwarded as a server tool argument.
+
 The presigned URL is a bearer credential and is never printed in command output. Legacy `zip_import` / `fileBase64` remains a compatibility path for small payloads, not the preferred CLI path for whole repos or launch images.
 
 ### `pulse-setup`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibecodr/cli",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Vibecodr CLI for login, live MCP tool discovery, and live tool invocation.",
   "license": "Apache-2.0",
   "type": "module",