applaunchflow 0.3.6 → 0.3.8

package/README.md

@@ -68,6 +68,16 @@ Public endpoints:
 - Protected resource metadata: `https://mcp.applaunchflow.com/.well-known/oauth-protected-resource`
 - Health: `https://mcp.applaunchflow.com/healthz`
 
+## Official MCP Registry
+
+AppLaunchFlow is published as `io.github.ynnickw/applaunchflow` in the official
+MCP Registry. The checked-in [`server.json`](server.json) is the canonical
+registry manifest and points clients to the hosted OAuth connector.
+
+Registry publication runs automatically from GitHub Actions when the manifest
+changes on `main`. Keep the manifest version aligned with `package.json`; the
+test suite enforces this before publication.
+
 `APPLAUNCHFLOW_MCP_PUBLIC_URL` may be either the origin or the full `/mcp`
 URL; both services normalize it to the same canonical resource URL. Set
 `APPLAUNCHFLOW_MCP_PUBLIC_URL=https://mcp.applaunchflow.com/mcp` and

package/build/api-client.test.js

@@ -0,0 +1,32 @@
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import test from "node:test";
+import { AppLaunchFlowClient } from "./client/api.js";
+import { runWithRequestSignal } from "./request-context.js";
+async function withUnresponsiveServer(callback) {
+    const server = createServer(() => undefined);
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const address = server.address();
+    try {
+        await callback(`http://127.0.0.1:${address.port}`);
+    }
+    finally {
+        server.closeAllConnections();
+        await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
+    }
+}
+test("dashboard requests honor explicit timeouts", async () => {
+    await withUnresponsiveServer(async (baseUrl) => {
+        const client = new AppLaunchFlowClient({ baseUrl, token: "test-token" });
+        await assert.rejects(client.requestJson("/slow", { timeoutMs: 20 }), (error) => error instanceof Error && error.name === "TimeoutError");
+    });
+});
+test("dashboard requests inherit MCP request cancellation", async () => {
+    await withUnresponsiveServer(async (baseUrl) => {
+        const client = new AppLaunchFlowClient({ baseUrl, token: "test-token" });
+        const controller = new AbortController();
+        const request = runWithRequestSignal(controller.signal, () => client.listProjects());
+        controller.abort();
+        await assert.rejects(request, (error) => error instanceof Error && error.name === "AbortError");
+    });
+});

package/build/cli-core.js

@@ -15,6 +15,18 @@ export function codexLoginArgs() {
 export function codexStatusArgs() {
     return ["mcp", "get", APPLAUNCHFLOW_MCP_NAME];
 }
+export function codexInspectArgs() {
+    return [...codexStatusArgs(), "--json"];
+}
+export function isHostedCodexConfig(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const transport = value.transport;
+    if (!transport || typeof transport !== "object")
+        return false;
+    const { type, url } = transport;
+    return type === "streamable_http" && url === APPLAUNCHFLOW_MCP_URL;
+}
 export function codexDisconnectArgs() {
     return ["mcp", "remove", APPLAUNCHFLOW_MCP_NAME];
 }

package/build/cli-core.test.js

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { APPLAUNCHFLOW_MCP_NAME, APPLAUNCHFLOW_MCP_URL, codexAddArgs, codexDisconnectArgs, codexLoginArgs, codexStatusArgs, } from "./cli-core.js";
+import { APPLAUNCHFLOW_MCP_NAME, APPLAUNCHFLOW_MCP_URL, codexAddArgs, codexDisconnectArgs, codexInspectArgs, codexLoginArgs, codexStatusArgs, isHostedCodexConfig, } from "./cli-core.js";
 test("Codex convenience commands use the hosted OAuth connector", () => {
     assert.deepEqual(codexAddArgs(), [
         "mcp",
@@ -11,12 +11,40 @@ test("Codex convenience commands use the hosted OAuth connector", () => {
     ]);
     assert.deepEqual(codexLoginArgs(), ["mcp", "login", "applaunchflow"]);
     assert.deepEqual(codexStatusArgs(), ["mcp", "get", "applaunchflow"]);
+    assert.deepEqual(codexInspectArgs(), [
+        "mcp",
+        "get",
+        "applaunchflow",
+        "--json",
+    ]);
     assert.deepEqual(codexDisconnectArgs(), [
         "mcp",
         "remove",
         "applaunchflow",
     ]);
 });
+test("detects whether Codex already uses the hosted connector", () => {
+    assert.equal(isHostedCodexConfig({
+        transport: {
+            type: "streamable_http",
+            url: APPLAUNCHFLOW_MCP_URL,
+        },
+    }), true);
+    assert.equal(isHostedCodexConfig({
+        transport: {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@applaunchflow/mcp@latest"],
+        },
+    }), false);
+    assert.equal(isHostedCodexConfig({
+        transport: {
+            type: "streamable_http",
+            url: "https://example.com/mcp",
+        },
+    }), false);
+    assert.equal(isHostedCodexConfig(null), false);
+});
 test("the public connector URL is a secure MCP endpoint", () => {
     const url = new URL(APPLAUNCHFLOW_MCP_URL);
     assert.equal(url.protocol, "https:");

package/build/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { spawnSync } from "node:child_process";
-import { APPLAUNCHFLOW_MCP_URL, codexAddArgs, codexDisconnectArgs, codexLoginArgs, codexStatusArgs, } from "./cli-core.js";
+import { APPLAUNCHFLOW_MCP_URL, codexAddArgs, codexDisconnectArgs, codexInspectArgs, codexLoginArgs, codexStatusArgs, isHostedCodexConfig, } from "./cli-core.js";
 function printHelp() {
     console.log(`AppLaunchFlow MCP
 
@@ -20,16 +20,34 @@ function runCodex(args) {
         throw new Error(`Codex exited with status ${result.status ?? "unknown"}`);
     }
 }
-function codexIsConfigured() {
-    const result = spawnSync("codex", codexStatusArgs(), { stdio: "ignore" });
+function getCodexConfiguration() {
+    const result = spawnSync("codex", codexInspectArgs(), {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+    });
     if (result.error) {
         throw new Error(`Could not run Codex: ${result.error.message}`);
     }
-    return result.status === 0;
+    if (result.status !== 0)
+        return "missing";
+    try {
+        return isHostedCodexConfig(JSON.parse(result.stdout))
+            ? "hosted"
+            : "legacy";
+    }
+    catch {
+        return "legacy";
+    }
 }
 function connectCodex() {
-    if (!codexIsConfigured()) {
+    const configuration = getCodexConfiguration();
+    if (configuration === "legacy") {
+        console.log("Replacing the legacy local AppLaunchFlow MCP configuration...");
+        runCodex(codexDisconnectArgs());
+    }
+    if (configuration !== "hosted") {
         runCodex(codexAddArgs());
+        return;
     }
     runCodex(codexLoginArgs());
 }

package/build/client/api.js

@@ -1,3 +1,7 @@
+import { upstreamSignal } from "../request-context.js";
+const DEFAULT_API_TIMEOUT_MS = 30_000;
+const LONG_RUNNING_API_TIMEOUT_MS = 10 * 60_000;
+const UPLOAD_TIMEOUT_MS = 2 * 60_000;
 export class AppLaunchFlowApiError extends Error {
     status;
     body;
@@ -45,6 +49,7 @@ export class AppLaunchFlowClient {
         const response = await fetch(url, {
             method: options.method || "GET",
             headers,
+            signal: upstreamSignal(options.timeoutMs ?? DEFAULT_API_TIMEOUT_MS, options.signal),
             body: options.body !== undefined ? JSON.stringify(options.body) : undefined,
         });
         const contentType = response.headers.get("content-type") || "";
@@ -74,6 +79,7 @@ export class AppLaunchFlowClient {
                 "Content-Type": contentType,
             },
             body: new Uint8Array(buffer),
+            signal: upstreamSignal(UPLOAD_TIMEOUT_MS),
         });
         if (!response.ok) {
             throw new Error(`Upload failed with status ${response.status}`);
@@ -106,6 +112,7 @@ export class AppLaunchFlowClient {
         return this.requestJson("/api/screenshots/generate", {
             method: "POST",
             body,
+            timeoutMs: LONG_RUNNING_API_TIMEOUT_MS,
         });
     }
     applyScreenshotTemplate(body) {
@@ -163,6 +170,7 @@ export class AppLaunchFlowClient {
         return this.requestJson("/api/promovideo/generate", {
             method: "POST",
             body,
+            timeoutMs: LONG_RUNNING_API_TIMEOUT_MS,
         });
     }
     updatePromoVideo(body) {
@@ -214,6 +222,7 @@ export class AppLaunchFlowClient {
         return this.requestJson("/api/screenshots/translate", {
             method: "POST",
             body,
+            timeoutMs: LONG_RUNNING_API_TIMEOUT_MS,
         });
     }
     listVariants(generationId, contentType) {
@@ -257,6 +266,7 @@ export class AppLaunchFlowClient {
         return this.requestJson("/api/graphics/generate", {
             method: "POST",
             body,
+            timeoutMs: LONG_RUNNING_API_TIMEOUT_MS,
         });
     }
     applyGraphicsTemplate(body) {
@@ -286,6 +296,7 @@ export class AppLaunchFlowClient {
         return this.requestJson("/api/aso/copy", {
             method: "POST",
             body,
+            timeoutMs: LONG_RUNNING_API_TIMEOUT_MS,
         });
     }
     updateAsoCopy(body) {
@@ -298,12 +309,14 @@ export class AppLaunchFlowClient {
         return this.requestJson("/api/aso/translate", {
             method: "POST",
             body,
+            timeoutMs: LONG_RUNNING_API_TIMEOUT_MS,
         });
     }
     suggestCompetitors(body) {
         return this.requestJson("/api/aso/competitors/suggest", {
             method: "POST",
             body,
+            timeoutMs: LONG_RUNNING_API_TIMEOUT_MS,
         });
     }
     listSharedIllustrations(query) {

package/build/http.js

@@ -3,7 +3,9 @@ import { createServer } from "node:http";
 import { pathToFileURL } from "node:url";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { createAppLaunchFlowServer } from "./index.js";
+import { upstreamSignal } from "./request-context.js";
 const DEFAULT_PORT = 8787;
+const INTROSPECTION_TIMEOUT_MS = 10_000;
 const DEFAULT_DASHBOARD_URL = "https://dashboard.applaunchflow.com";
 const REQUIRED_SCOPES = [
     "projects:read",
@@ -63,8 +65,16 @@ function unauthorized(request, response) {
         "www-authenticate": `Bearer resource_metadata="${resourceMetadataUrl(request)}"`,
     });
 }
+function methodNotAllowed(response) {
+    json(response, 405, {
+        jsonrpc: "2.0",
+        error: { code: -32000, message: "Method not allowed" },
+        id: null,
+    }, { allow: "POST" });
+}
 async function introspectToken(request, token) {
     const response = await fetch(`${dashboardBaseUrl()}/api/auth/mcp/introspect`, {
+        signal: upstreamSignal(INTROSPECTION_TIMEOUT_MS),
         headers: {
             authorization: `Bearer ${token}`,
             accept: "application/json",
@@ -113,6 +123,10 @@ async function handleMcp(request, response) {
         unauthorized(request, response);
         return;
     }
+    if (request.method !== "POST") {
+        methodNotAllowed(response);
+        return;
+    }
     const server = createAppLaunchFlowServer({
         baseUrl: dashboardBaseUrl(),
         token,
@@ -184,7 +198,7 @@ async function main() {
     const port = Number(process.env.PORT || DEFAULT_PORT);
     const server = createHttpServer();
     server.listen(port, "0.0.0.0", () => {
-        console.error(`AppLaunchFlow MCP HTTP server listening on port ${port}`);
+        console.log(`AppLaunchFlow MCP HTTP server listening on port ${port}`);
     });
 }
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {

package/build/http.test.js

@@ -116,6 +116,19 @@ test("authenticated Streamable HTTP clients can initialize and discover tools",
     try {
         await withServer(async (baseUrl) => {
             process.env.APPLAUNCHFLOW_MCP_PUBLIC_URL = `${baseUrl}/mcp`;
+            for (const method of ["GET", "DELETE"]) {
+                const response = await fetch(`${baseUrl}/mcp`, {
+                    method,
+                    headers: { authorization: "Bearer test-access-token" },
+                });
+                assert.equal(response.status, 405);
+                assert.equal(response.headers.get("allow"), "POST");
+                assert.deepEqual(await response.json(), {
+                    jsonrpc: "2.0",
+                    error: { code: -32000, message: "Method not allowed" },
+                    id: null,
+                });
+            }
             const transport = new StreamableHTTPClientTransport(new URL(`${baseUrl}/mcp`), {
                 requestInit: {
                     headers: { authorization: "Bearer test-access-token" },

package/build/index.js

@@ -1,4 +1,5 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { createRequire } from "node:module";
 import { AppLaunchFlowClient, } from "./client/api.js";
 import { registerPrompts } from "./prompts/register.js";
 import { registerResources } from "./resources/register.js";
@@ -14,6 +15,7 @@ import { registerLocalizationTools } from "./tools/localization.js";
 import { registerVariantTools } from "./tools/variants.js";
 import { registerKeywordTools } from "./tools/keywords.js";
 import { installToolMetadataPolicy } from "./tool-metadata.js";
+const packageJson = createRequire(import.meta.url)("../package.json");
 export const SERVER_INSTRUCTIONS = `
 AppLaunchFlow MCP supports four content types: app store screenshots, social graphics, promo videos, and mockup animations.
 Use it for project setup, screenshot uploads, AI generation of screenshots/graphics/videos, mockup animation editing, variant management, direct layout editing, and translation.
@@ -106,7 +108,7 @@ export function createAppLaunchFlowServer(credentials) {
     const client = new AppLaunchFlowClient(credentials);
     const server = new McpServer({
         name: "applaunchflow-mcp",
-        version: "0.3.3",
+        version: packageJson.version,
     }, {
         instructions: HOSTED_SERVER_INSTRUCTIONS,
     });

package/build/request-context.js

@@ -0,0 +1,13 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+const requestSignalStorage = new AsyncLocalStorage();
+export function runWithRequestSignal(signal, callback) {
+    return signal ? requestSignalStorage.run(signal, callback) : callback();
+}
+export function upstreamSignal(timeoutMs, explicitSignal) {
+    const signals = [
+        explicitSignal,
+        requestSignalStorage.getStore(),
+        AbortSignal.timeout(timeoutMs),
+    ].filter((signal) => signal !== undefined);
+    return signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+}

package/build/tool-metadata.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { runWithRequestSignal } from "./request-context.js";
 const readOnly = {
     readOnlyHint: true,
     destructiveHint: false,
@@ -94,6 +95,34 @@ export function installToolMetadataPolicy(server, options = {}) {
             throw new Error(`Missing tool safety annotations for ${name}`);
         }
         const existingMeta = (config._meta || {});
+        const toolCallback = callback;
+        const instrumentedCallback = async (...args) => {
+            const startedAt = performance.now();
+            const extra = args[1];
+            try {
+                const result = await runWithRequestSignal(extra?.signal, () => toolCallback(...args));
+                const isError = typeof result === "object" &&
+                    result !== null &&
+                    result.isError === true;
+                console.log(JSON.stringify({
+                    event: "mcp_tool",
+                    tool: name,
+                    outcome: isError ? "error" : "success",
+                    durationMs: Math.round(performance.now() - startedAt),
+                }));
+                return result;
+            }
+            catch (error) {
+                console.error(JSON.stringify({
+                    event: "mcp_tool",
+                    tool: name,
+                    outcome: "exception",
+                    durationMs: Math.round(performance.now() - startedAt),
+                    errorType: error instanceof Error ? error.name : "UnknownError",
+                }));
+                throw error;
+            }
+        };
         return registerTool(name, {
             ...config,
             annotations: {
@@ -107,6 +136,6 @@ export function installToolMetadataPolicy(server, options = {}) {
                     ? { securitySchemes: [OAUTH_SECURITY_SCHEME] }
                     : {}),
             },
-        }, callback);
+        }, instrumentedCallback);
     });
 }

package/build/tool-metadata.test.js

@@ -1,4 +1,6 @@
 import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { createRequire } from "node:module";
 import test from "node:test";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
@@ -24,9 +26,63 @@ test("all registered tools expose submission safety metadata and output schemas"
             assert.ok(tool.description, `${tool.name} must have a description`);
             assert.deepEqual(tool._meta?.securitySchemes?.map((scheme) => scheme.type), ["oauth2"]);
         }
+        assert.equal(client.getServerVersion()?.version, createRequire(import.meta.url)("../package.json")
+            .version);
     }
     finally {
         await client.close();
         await server.close();
     }
 });
+test("hosted tools emit privacy-safe structured outcome logs", async () => {
+    const api = createServer((request, response) => {
+        if (request.url === "/api/projects") {
+            response.writeHead(200, { "content-type": "application/json" });
+            response.end(JSON.stringify({ projects: [] }));
+            return;
+        }
+        if (request.url?.startsWith("/api/app/")) {
+            response.writeHead(500, { "content-type": "application/json" });
+            response.end(JSON.stringify({ error: "synthetic backend failure" }));
+            return;
+        }
+        response.writeHead(404).end();
+    });
+    await new Promise((resolve) => api.listen(0, "127.0.0.1", resolve));
+    const address = api.address();
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+    const server = createAppLaunchFlowServer({
+        baseUrl: `http://127.0.0.1:${address.port}`,
+        token: "secret-test-token",
+    });
+    const client = new Client({ name: "logging-test", version: "1.0.0" });
+    const logs = [];
+    const originalLog = console.log;
+    console.log = (...args) => logs.push(args.map(String).join(" "));
+    try {
+        await server.connect(serverTransport);
+        await client.connect(clientTransport);
+        const result = await client.callTool({ name: "list_projects", arguments: {} });
+        assert.equal(result.isError, undefined);
+        const failed = await client.callTool({
+            name: "get_project",
+            arguments: { projectId: "00000000-0000-4000-8000-000000000001" },
+        });
+        assert.equal(failed.isError, true);
+        assert.equal(logs.length, 2);
+        const entries = logs.map((line) => JSON.parse(line));
+        assert.deepEqual(entries.map(({ event, tool, outcome }) => ({ event, tool, outcome })), [
+            { event: "mcp_tool", tool: "list_projects", outcome: "success" },
+            { event: "mcp_tool", tool: "get_project", outcome: "error" },
+        ]);
+        assert.equal(entries.every((entry) => typeof entry.durationMs === "number"), true);
+        assert.equal(logs.some((line) => line.includes("secret-test-token")), false);
+        assert.equal(logs.some((line) => line.includes("synthetic backend failure")), false);
+    }
+    finally {
+        console.log = originalLog;
+        await client.close();
+        await server.close();
+        await new Promise((resolve, reject) => api.close((error) => (error ? reject(error) : resolve())));
+    }
+});

package/build/tools/assets.js

@@ -3,6 +3,7 @@ import { promises as dns } from "node:dns";
 import { BlockList, isIP } from "node:net";
 import path from "path";
 import { z } from "zod";
+import { upstreamSignal } from "../request-context.js";
 import { fail, ok } from "./utils.js";
 const MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
 const MAX_REMOTE_REDIRECTS = 3;
@@ -87,7 +88,7 @@ async function fetchRemoteAsset(value) {
     for (let redirectCount = 0; redirectCount <= MAX_REMOTE_REDIRECTS; redirectCount += 1) {
         const response = await fetch(current, {
             redirect: "manual",
-            signal: AbortSignal.timeout(20_000),
+            signal: upstreamSignal(20_000),
             headers: { accept: "image/*,font/*;q=0.8" },
         });
         if (response.status < 300 || response.status >= 400) {

package/build/tools/screenshots.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { listPublicTemplateIds } from "../catalog.js";
 import { buildTemplateGalleryUrl } from "../template-previews.js";
 import { openUrl, fail, ok, startProgressHeartbeat } from "./utils.js";
+import { upstreamSignal } from "../request-context.js";
 export function registerScreenshotTools(server, client) {
     server.registerTool("prepare_screenshot_styles", {
         title: "Prepare Personalized Screenshot Styles",
@@ -294,7 +295,10 @@ export function registerScreenshotTools(server, client) {
             const previewUrl = `${client.credentials.baseUrl}/api/preview?path=${encodeURIComponent(fullPath)}&w=320`;
             const headers = new Headers();
             headers.set("Authorization", `Bearer ${client.credentials.token}`);
-            const response = await fetch(previewUrl, { headers });
+            const response = await fetch(previewUrl, {
+                headers,
+                signal: upstreamSignal(30_000),
+            });
             if (!response.ok) {
                 throw new Error(`Failed to fetch image: ${response.status}`);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "applaunchflow",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "Hosted OAuth MCP connector for AppLaunchFlow.",
   "license": "MIT",
   "repository": {