applaunchflow 0.3.7 → 0.3.9

package/README.md

@@ -31,6 +31,23 @@ codex mcp get applaunchflow
 codex mcp remove applaunchflow
 ```
 
+### Claude Code
+
+The same one-command setup is available for Claude Code. It replaces a legacy
+AppLaunchFlow entry when necessary, adds the hosted HTTP connector, and opens
+OAuth sign-in:
+
+```bash
+npx -y applaunchflow connect claude
+```
+
+The equivalent native Claude Code commands are:
+
+```bash
+claude mcp add --transport http applaunchflow https://mcp.applaunchflow.com/mcp
+claude mcp login applaunchflow
+```
+
 ### ChatGPT
 
 ```bash
@@ -48,6 +65,22 @@ Use this Streamable HTTP endpoint and enable OAuth when prompted:
 https://mcp.applaunchflow.com/mcp
 ```
 
+### Claude Code plugin
+
+This repository is also a distributable Claude Code plugin. Its
+`.claude-plugin/plugin.json` manifest bundles the hosted OAuth connector from
+`.mcp.json`, so users do not need to copy a server configuration manually.
+
+To validate or try the plugin directly from a clone:
+
+```bash
+claude plugin validate . --strict
+claude --plugin-dir .
+```
+
+Claude Code starts the hosted connector when the plugin is enabled and opens
+the AppLaunchFlow OAuth flow when authentication is required.
+
 ## Hosted service
 
 The public Streamable HTTP service uses OAuth 2.1 authorization code flow with
@@ -68,6 +101,16 @@ Public endpoints:
 - Protected resource metadata: `https://mcp.applaunchflow.com/.well-known/oauth-protected-resource`
 - Health: `https://mcp.applaunchflow.com/healthz`
 
+## Official MCP Registry
+
+AppLaunchFlow is published as `io.github.ynnickw/applaunchflow` in the official
+MCP Registry. The checked-in [`server.json`](server.json) is the canonical
+registry manifest and points clients to the hosted OAuth connector.
+
+Registry publication runs automatically from GitHub Actions when the manifest
+changes on `main`. Keep the manifest version aligned with `package.json`; the
+test suite enforces this before publication.
+
 `APPLAUNCHFLOW_MCP_PUBLIC_URL` may be either the origin or the full `/mcp`
 URL; both services normalize it to the same canonical resource URL. Set
 `APPLAUNCHFLOW_MCP_PUBLIC_URL=https://mcp.applaunchflow.com/mcp` and

package/build/api-client.test.js

@@ -0,0 +1,32 @@
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import test from "node:test";
+import { AppLaunchFlowClient } from "./client/api.js";
+import { runWithRequestSignal } from "./request-context.js";
+async function withUnresponsiveServer(callback) {
+    const server = createServer(() => undefined);
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const address = server.address();
+    try {
+        await callback(`http://127.0.0.1:${address.port}`);
+    }
+    finally {
+        server.closeAllConnections();
+        await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
+    }
+}
+test("dashboard requests honor explicit timeouts", async () => {
+    await withUnresponsiveServer(async (baseUrl) => {
+        const client = new AppLaunchFlowClient({ baseUrl, token: "test-token" });
+        await assert.rejects(client.requestJson("/slow", { timeoutMs: 20 }), (error) => error instanceof Error && error.name === "TimeoutError");
+    });
+});
+test("dashboard requests inherit MCP request cancellation", async () => {
+    await withUnresponsiveServer(async (baseUrl) => {
+        const client = new AppLaunchFlowClient({ baseUrl, token: "test-token" });
+        const controller = new AbortController();
+        const request = runWithRequestSignal(controller.signal, () => client.listProjects());
+        controller.abort();
+        await assert.rejects(request, (error) => error instanceof Error && error.name === "AbortError");
+    });
+});

package/build/cli-core.js

@@ -30,3 +30,28 @@ export function isHostedCodexConfig(value) {
 export function codexDisconnectArgs() {
     return ["mcp", "remove", APPLAUNCHFLOW_MCP_NAME];
 }
+export function claudeAddArgs() {
+    return [
+        "mcp",
+        "add",
+        "--transport",
+        "http",
+        APPLAUNCHFLOW_MCP_NAME,
+        APPLAUNCHFLOW_MCP_URL,
+    ];
+}
+export function claudeLoginArgs() {
+    return ["mcp", "login", APPLAUNCHFLOW_MCP_NAME];
+}
+export function claudeStatusArgs() {
+    return ["mcp", "get", APPLAUNCHFLOW_MCP_NAME];
+}
+export function claudeDisconnectArgs() {
+    return ["mcp", "remove", APPLAUNCHFLOW_MCP_NAME];
+}
+export function isHostedClaudeConfig(output) {
+    const normalized = output.replace(/\u001B\[[0-?]*[ -/]*[@-~]/g, "");
+    const hasHttpTransport = /^\s*Type:\s*http\s*$/im.test(normalized);
+    const configuredUrl = normalized.match(/^\s*URL:\s*(\S+)\s*$/im)?.[1];
+    return hasHttpTransport && configuredUrl === APPLAUNCHFLOW_MCP_URL;
+}

package/build/cli-core.test.js

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { APPLAUNCHFLOW_MCP_NAME, APPLAUNCHFLOW_MCP_URL, codexAddArgs, codexDisconnectArgs, codexInspectArgs, codexLoginArgs, codexStatusArgs, isHostedCodexConfig, } from "./cli-core.js";
+import { APPLAUNCHFLOW_MCP_NAME, APPLAUNCHFLOW_MCP_URL, claudeAddArgs, claudeDisconnectArgs, claudeLoginArgs, claudeStatusArgs, codexAddArgs, codexDisconnectArgs, codexInspectArgs, codexLoginArgs, codexStatusArgs, isHostedClaudeConfig, isHostedCodexConfig, } from "./cli-core.js";
 test("Codex convenience commands use the hosted OAuth connector", () => {
     assert.deepEqual(codexAddArgs(), [
         "mcp",
@@ -23,6 +23,36 @@ test("Codex convenience commands use the hosted OAuth connector", () => {
         "applaunchflow",
     ]);
 });
+test("Claude Code convenience commands use the hosted OAuth connector", () => {
+    assert.deepEqual(claudeAddArgs(), [
+        "mcp",
+        "add",
+        "--transport",
+        "http",
+        APPLAUNCHFLOW_MCP_NAME,
+        APPLAUNCHFLOW_MCP_URL,
+    ]);
+    assert.deepEqual(claudeLoginArgs(), ["mcp", "login", "applaunchflow"]);
+    assert.deepEqual(claudeStatusArgs(), ["mcp", "get", "applaunchflow"]);
+    assert.deepEqual(claudeDisconnectArgs(), [
+        "mcp",
+        "remove",
+        "applaunchflow",
+    ]);
+});
+test("detects whether Claude Code already uses the hosted connector", () => {
+    assert.equal(isHostedClaudeConfig(`applaunchflow:
+  Scope: Local config
+  Type: http
+  URL: ${APPLAUNCHFLOW_MCP_URL}`), true);
+    assert.equal(isHostedClaudeConfig(`applaunchflow:
+  Type: stdio
+  Command: npx -y @applaunchflow/mcp@latest`), false);
+    assert.equal(isHostedClaudeConfig(`applaunchflow:
+  Type: http
+  URL: https://example.com/mcp`), false);
+    assert.equal(isHostedClaudeConfig(`\u001b[32mType: http\u001b[0m\nURL: ${APPLAUNCHFLOW_MCP_URL}`), true);
+});
 test("detects whether Codex already uses the hosted connector", () => {
     assert.equal(isHostedCodexConfig({
         transport: {

package/build/cli.js

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { spawnSync } from "node:child_process";
-import { APPLAUNCHFLOW_MCP_URL, codexAddArgs, codexDisconnectArgs, codexInspectArgs, codexLoginArgs, codexStatusArgs, isHostedCodexConfig, } from "./cli-core.js";
+import { APPLAUNCHFLOW_MCP_URL, claudeAddArgs, claudeDisconnectArgs, claudeLoginArgs, claudeStatusArgs, codexAddArgs, codexDisconnectArgs, codexInspectArgs, codexLoginArgs, codexStatusArgs, isHostedClaudeConfig, isHostedCodexConfig, } from "./cli-core.js";
 function printHelp() {
     console.log(`AppLaunchFlow MCP
 
 Usage:
   applaunchflow connect codex
+  applaunchflow connect claude
   applaunchflow connect chatgpt
   applaunchflow status
   applaunchflow disconnect
@@ -20,6 +21,15 @@ function runCodex(args) {
         throw new Error(`Codex exited with status ${result.status ?? "unknown"}`);
     }
 }
+function runClaude(args) {
+    const result = spawnSync("claude", args, { stdio: "inherit" });
+    if (result.error) {
+        throw new Error(`Could not run Claude Code: ${result.error.message}`);
+    }
+    if (result.status !== 0) {
+        throw new Error(`Claude Code exited with status ${result.status ?? "unknown"}`);
+    }
+}
 function getCodexConfiguration() {
     const result = spawnSync("codex", codexInspectArgs(), {
         encoding: "utf8",
@@ -51,6 +61,29 @@ function connectCodex() {
     }
     runCodex(codexLoginArgs());
 }
+function getClaudeConfiguration() {
+    const result = spawnSync("claude", claudeStatusArgs(), {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+    });
+    if (result.error) {
+        throw new Error(`Could not run Claude Code: ${result.error.message}`);
+    }
+    if (result.status !== 0)
+        return "missing";
+    return isHostedClaudeConfig(result.stdout) ? "hosted" : "legacy";
+}
+function connectClaude() {
+    const configuration = getClaudeConfiguration();
+    if (configuration === "legacy") {
+        console.log("Replacing the legacy local AppLaunchFlow MCP configuration...");
+        runClaude(claudeDisconnectArgs());
+    }
+    if (configuration !== "hosted") {
+        runClaude(claudeAddArgs());
+    }
+    runClaude(claudeLoginArgs());
+}
 function connectChatGpt() {
     console.log(`Add a custom MCP connector in ChatGPT using this URL:\n${APPLAUNCHFLOW_MCP_URL}`);
 }
@@ -60,6 +93,10 @@ function main() {
         connectCodex();
         return;
     }
+    if (command === "connect" && target === "claude") {
+        connectClaude();
+        return;
+    }
     if (command === "connect" && target === "chatgpt") {
         connectChatGpt();
         return;

package/build/cli.test.js

@@ -0,0 +1,57 @@
+import assert from "node:assert/strict";
+import { chmod, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { APPLAUNCHFLOW_MCP_URL } from "./cli-core.js";
+async function runConnectClaude(getOutput, getStatus = 0) {
+    const directory = await mkdtemp(join(tmpdir(), "applaunchflow-cli-"));
+    const executable = join(directory, "claude");
+    const logPath = join(directory, "claude.log");
+    await writeFile(executable, `#!/bin/sh
+printf '%s\\n' "$*" >> "$CLAUDE_TEST_LOG"
+if [ "$*" = "mcp get applaunchflow" ]; then
+  printf '%s' "$CLAUDE_GET_OUTPUT"
+  exit "$CLAUDE_GET_STATUS"
+fi
+`);
+    await chmod(executable, 0o755);
+    try {
+        const cliPath = fileURLToPath(new URL("./cli.js", import.meta.url));
+        const result = spawnSync(process.execPath, [cliPath, "connect", "claude"], {
+            encoding: "utf8",
+            env: {
+                ...process.env,
+                PATH: `${directory}:${process.env.PATH ?? ""}`,
+                CLAUDE_TEST_LOG: logPath,
+                CLAUDE_GET_OUTPUT: getOutput,
+                CLAUDE_GET_STATUS: String(getStatus),
+            },
+        });
+        assert.equal(result.status, 0, result.stderr);
+        return (await readFile(logPath, "utf8")).trim().split("\n");
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+}
+test("Claude helper adds a missing connector and starts OAuth", async () => {
+    assert.deepEqual(await runConnectClaude("", 1), [
+        "mcp get applaunchflow",
+        `mcp add --transport http applaunchflow ${APPLAUNCHFLOW_MCP_URL}`,
+        "mcp login applaunchflow",
+    ]);
+});
+test("Claude helper replaces a legacy connector before starting OAuth", async () => {
+    assert.deepEqual(await runConnectClaude("Type: stdio\nCommand: npx legacy-server"), [
+        "mcp get applaunchflow",
+        "mcp remove applaunchflow",
+        `mcp add --transport http applaunchflow ${APPLAUNCHFLOW_MCP_URL}`,
+        "mcp login applaunchflow",
+    ]);
+});
+test("Claude helper keeps the hosted connector and refreshes OAuth", async () => {
+    assert.deepEqual(await runConnectClaude(`Type: http\nURL: ${APPLAUNCHFLOW_MCP_URL}\nStatus: Connected`), ["mcp get applaunchflow", "mcp login applaunchflow"]);
+});

package/build/client/api.js

@@ -1,3 +1,7 @@
+import { upstreamSignal } from "../request-context.js";
+const DEFAULT_API_TIMEOUT_MS = 30_000;
+const LONG_RUNNING_API_TIMEOUT_MS = 10 * 60_000;
+const UPLOAD_TIMEOUT_MS = 2 * 60_000;
 export class AppLaunchFlowApiError extends Error {
     status;
     body;
@@ -45,6 +49,7 @@ export class AppLaunchFlowClient {
         const response = await fetch(url, {
             method: options.method || "GET",
             headers,
+            signal: upstreamSignal(options.timeoutMs ?? DEFAULT_API_TIMEOUT_MS, options.signal),
             body: options.body !== undefined ? JSON.stringify(options.body) : undefined,
         });
         const contentType = response.headers.get("content-type") || "";
@@ -74,6 +79,7 @@ export class AppLaunchFlowClient {
                 "Content-Type": contentType,
             },
             body: new Uint8Array(buffer),
+            signal: upstreamSignal(UPLOAD_TIMEOUT_MS),
         });
         if (!response.ok) {
             throw new Error(`Upload failed with status ${response.status}`);
@@ -106,6 +112,7 @@ export class AppLaunchFlowClient {
         return this.requestJson("/api/screenshots/generate", {
             method: "POST",
             body,
+            timeoutMs: LONG_RUNNING_API_TIMEOUT_MS,
         });
     }
     applyScreenshotTemplate(body) {
@@ -163,6 +170,7 @@ export class AppLaunchFlowClient {
         return this.requestJson("/api/promovideo/generate", {
             method: "POST",
             body,
+            timeoutMs: LONG_RUNNING_API_TIMEOUT_MS,
         });
     }
     updatePromoVideo(body) {
@@ -214,6 +222,7 @@ export class AppLaunchFlowClient {
         return this.requestJson("/api/screenshots/translate", {
             method: "POST",
             body,
+            timeoutMs: LONG_RUNNING_API_TIMEOUT_MS,
         });
     }
     listVariants(generationId, contentType) {
@@ -257,6 +266,7 @@ export class AppLaunchFlowClient {
         return this.requestJson("/api/graphics/generate", {
             method: "POST",
             body,
+            timeoutMs: LONG_RUNNING_API_TIMEOUT_MS,
         });
     }
     applyGraphicsTemplate(body) {
@@ -286,6 +296,7 @@ export class AppLaunchFlowClient {
         return this.requestJson("/api/aso/copy", {
             method: "POST",
             body,
+            timeoutMs: LONG_RUNNING_API_TIMEOUT_MS,
         });
     }
     updateAsoCopy(body) {
@@ -298,12 +309,14 @@ export class AppLaunchFlowClient {
         return this.requestJson("/api/aso/translate", {
             method: "POST",
             body,
+            timeoutMs: LONG_RUNNING_API_TIMEOUT_MS,
         });
     }
     suggestCompetitors(body) {
         return this.requestJson("/api/aso/competitors/suggest", {
             method: "POST",
             body,
+            timeoutMs: LONG_RUNNING_API_TIMEOUT_MS,
         });
     }
     listSharedIllustrations(query) {

package/build/http.js

@@ -3,7 +3,9 @@ import { createServer } from "node:http";
 import { pathToFileURL } from "node:url";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { createAppLaunchFlowServer } from "./index.js";
+import { upstreamSignal } from "./request-context.js";
 const DEFAULT_PORT = 8787;
+const INTROSPECTION_TIMEOUT_MS = 10_000;
 const DEFAULT_DASHBOARD_URL = "https://dashboard.applaunchflow.com";
 const REQUIRED_SCOPES = [
     "projects:read",
@@ -63,8 +65,16 @@ function unauthorized(request, response) {
         "www-authenticate": `Bearer resource_metadata="${resourceMetadataUrl(request)}"`,
     });
 }
+function methodNotAllowed(response) {
+    json(response, 405, {
+        jsonrpc: "2.0",
+        error: { code: -32000, message: "Method not allowed" },
+        id: null,
+    }, { allow: "POST" });
+}
 async function introspectToken(request, token) {
     const response = await fetch(`${dashboardBaseUrl()}/api/auth/mcp/introspect`, {
+        signal: upstreamSignal(INTROSPECTION_TIMEOUT_MS),
         headers: {
             authorization: `Bearer ${token}`,
             accept: "application/json",
@@ -113,6 +123,10 @@ async function handleMcp(request, response) {
         unauthorized(request, response);
         return;
     }
+    if (request.method !== "POST") {
+        methodNotAllowed(response);
+        return;
+    }
     const server = createAppLaunchFlowServer({
         baseUrl: dashboardBaseUrl(),
         token,
@@ -184,7 +198,7 @@ async function main() {
     const port = Number(process.env.PORT || DEFAULT_PORT);
     const server = createHttpServer();
     server.listen(port, "0.0.0.0", () => {
-        console.error(`AppLaunchFlow MCP HTTP server listening on port ${port}`);
+        console.log(`AppLaunchFlow MCP HTTP server listening on port ${port}`);
     });
 }
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {

package/build/http.test.js

@@ -116,6 +116,19 @@ test("authenticated Streamable HTTP clients can initialize and discover tools",
     try {
         await withServer(async (baseUrl) => {
             process.env.APPLAUNCHFLOW_MCP_PUBLIC_URL = `${baseUrl}/mcp`;
+            for (const method of ["GET", "DELETE"]) {
+                const response = await fetch(`${baseUrl}/mcp`, {
+                    method,
+                    headers: { authorization: "Bearer test-access-token" },
+                });
+                assert.equal(response.status, 405);
+                assert.equal(response.headers.get("allow"), "POST");
+                assert.deepEqual(await response.json(), {
+                    jsonrpc: "2.0",
+                    error: { code: -32000, message: "Method not allowed" },
+                    id: null,
+                });
+            }
             const transport = new StreamableHTTPClientTransport(new URL(`${baseUrl}/mcp`), {
                 requestInit: {
                     headers: { authorization: "Bearer test-access-token" },

package/build/index.js

@@ -1,4 +1,5 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { createRequire } from "node:module";
 import { AppLaunchFlowClient, } from "./client/api.js";
 import { registerPrompts } from "./prompts/register.js";
 import { registerResources } from "./resources/register.js";
@@ -14,6 +15,7 @@ import { registerLocalizationTools } from "./tools/localization.js";
 import { registerVariantTools } from "./tools/variants.js";
 import { registerKeywordTools } from "./tools/keywords.js";
 import { installToolMetadataPolicy } from "./tool-metadata.js";
+const packageJson = createRequire(import.meta.url)("../package.json");
 export const SERVER_INSTRUCTIONS = `
 AppLaunchFlow MCP supports four content types: app store screenshots, social graphics, promo videos, and mockup animations.
 Use it for project setup, screenshot uploads, AI generation of screenshots/graphics/videos, mockup animation editing, variant management, direct layout editing, and translation.
@@ -106,7 +108,7 @@ export function createAppLaunchFlowServer(credentials) {
     const client = new AppLaunchFlowClient(credentials);
     const server = new McpServer({
         name: "applaunchflow-mcp",
-        version: "0.3.3",
+        version: packageJson.version,
     }, {
         instructions: HOSTED_SERVER_INSTRUCTIONS,
     });

package/build/request-context.js

@@ -0,0 +1,13 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+const requestSignalStorage = new AsyncLocalStorage();
+export function runWithRequestSignal(signal, callback) {
+    return signal ? requestSignalStorage.run(signal, callback) : callback();
+}
+export function upstreamSignal(timeoutMs, explicitSignal) {
+    const signals = [
+        explicitSignal,
+        requestSignalStorage.getStore(),
+        AbortSignal.timeout(timeoutMs),
+    ].filter((signal) => signal !== undefined);
+    return signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+}

package/build/tool-metadata.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { runWithRequestSignal } from "./request-context.js";
 const readOnly = {
     readOnlyHint: true,
     destructiveHint: false,
@@ -94,6 +95,34 @@ export function installToolMetadataPolicy(server, options = {}) {
             throw new Error(`Missing tool safety annotations for ${name}`);
         }
         const existingMeta = (config._meta || {});
+        const toolCallback = callback;
+        const instrumentedCallback = async (...args) => {
+            const startedAt = performance.now();
+            const extra = args[1];
+            try {
+                const result = await runWithRequestSignal(extra?.signal, () => toolCallback(...args));
+                const isError = typeof result === "object" &&
+                    result !== null &&
+                    result.isError === true;
+                console.log(JSON.stringify({
+                    event: "mcp_tool",
+                    tool: name,
+                    outcome: isError ? "error" : "success",
+                    durationMs: Math.round(performance.now() - startedAt),
+                }));
+                return result;
+            }
+            catch (error) {
+                console.error(JSON.stringify({
+                    event: "mcp_tool",
+                    tool: name,
+                    outcome: "exception",
+                    durationMs: Math.round(performance.now() - startedAt),
+                    errorType: error instanceof Error ? error.name : "UnknownError",
+                }));
+                throw error;
+            }
+        };
         return registerTool(name, {
             ...config,
             annotations: {
@@ -107,6 +136,6 @@ export function installToolMetadataPolicy(server, options = {}) {
                     ? { securitySchemes: [OAUTH_SECURITY_SCHEME] }
                     : {}),
             },
-        }, callback);
+        }, instrumentedCallback);
     });
 }

package/build/tool-metadata.test.js

@@ -1,4 +1,6 @@
 import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { createRequire } from "node:module";
 import test from "node:test";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
@@ -24,9 +26,63 @@ test("all registered tools expose submission safety metadata and output schemas"
             assert.ok(tool.description, `${tool.name} must have a description`);
             assert.deepEqual(tool._meta?.securitySchemes?.map((scheme) => scheme.type), ["oauth2"]);
         }
+        assert.equal(client.getServerVersion()?.version, createRequire(import.meta.url)("../package.json")
+            .version);
     }
     finally {
         await client.close();
         await server.close();
     }
 });
+test("hosted tools emit privacy-safe structured outcome logs", async () => {
+    const api = createServer((request, response) => {
+        if (request.url === "/api/projects") {
+            response.writeHead(200, { "content-type": "application/json" });
+            response.end(JSON.stringify({ projects: [] }));
+            return;
+        }
+        if (request.url?.startsWith("/api/app/")) {
+            response.writeHead(500, { "content-type": "application/json" });
+            response.end(JSON.stringify({ error: "synthetic backend failure" }));
+            return;
+        }
+        response.writeHead(404).end();
+    });
+    await new Promise((resolve) => api.listen(0, "127.0.0.1", resolve));
+    const address = api.address();
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+    const server = createAppLaunchFlowServer({
+        baseUrl: `http://127.0.0.1:${address.port}`,
+        token: "secret-test-token",
+    });
+    const client = new Client({ name: "logging-test", version: "1.0.0" });
+    const logs = [];
+    const originalLog = console.log;
+    console.log = (...args) => logs.push(args.map(String).join(" "));
+    try {
+        await server.connect(serverTransport);
+        await client.connect(clientTransport);
+        const result = await client.callTool({ name: "list_projects", arguments: {} });
+        assert.equal(result.isError, undefined);
+        const failed = await client.callTool({
+            name: "get_project",
+            arguments: { projectId: "00000000-0000-4000-8000-000000000001" },
+        });
+        assert.equal(failed.isError, true);
+        assert.equal(logs.length, 2);
+        const entries = logs.map((line) => JSON.parse(line));
+        assert.deepEqual(entries.map(({ event, tool, outcome }) => ({ event, tool, outcome })), [
+            { event: "mcp_tool", tool: "list_projects", outcome: "success" },
+            { event: "mcp_tool", tool: "get_project", outcome: "error" },
+        ]);
+        assert.equal(entries.every((entry) => typeof entry.durationMs === "number"), true);
+        assert.equal(logs.some((line) => line.includes("secret-test-token")), false);
+        assert.equal(logs.some((line) => line.includes("synthetic backend failure")), false);
+    }
+    finally {
+        console.log = originalLog;
+        await client.close();
+        await server.close();
+        await new Promise((resolve, reject) => api.close((error) => (error ? reject(error) : resolve())));
+    }
+});

package/build/tools/assets.js

@@ -3,6 +3,7 @@ import { promises as dns } from "node:dns";
 import { BlockList, isIP } from "node:net";
 import path from "path";
 import { z } from "zod";
+import { upstreamSignal } from "../request-context.js";
 import { fail, ok } from "./utils.js";
 const MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
 const MAX_REMOTE_REDIRECTS = 3;
@@ -87,7 +88,7 @@ async function fetchRemoteAsset(value) {
     for (let redirectCount = 0; redirectCount <= MAX_REMOTE_REDIRECTS; redirectCount += 1) {
         const response = await fetch(current, {
             redirect: "manual",
-            signal: AbortSignal.timeout(20_000),
+            signal: upstreamSignal(20_000),
             headers: { accept: "image/*,font/*;q=0.8" },
         });
         if (response.status < 300 || response.status >= 400) {

package/build/tools/screenshots.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { listPublicTemplateIds } from "../catalog.js";
 import { buildTemplateGalleryUrl } from "../template-previews.js";
 import { openUrl, fail, ok, startProgressHeartbeat } from "./utils.js";
+import { upstreamSignal } from "../request-context.js";
 export function registerScreenshotTools(server, client) {
     server.registerTool("prepare_screenshot_styles", {
         title: "Prepare Personalized Screenshot Styles",
@@ -294,7 +295,10 @@ export function registerScreenshotTools(server, client) {
             const previewUrl = `${client.credentials.baseUrl}/api/preview?path=${encodeURIComponent(fullPath)}&w=320`;
             const headers = new Headers();
             headers.set("Authorization", `Bearer ${client.credentials.token}`);
-            const response = await fetch(previewUrl, { headers });
+            const response = await fetch(previewUrl, {
+                headers,
+                signal: upstreamSignal(30_000),
+            });
             if (!response.ok) {
                 throw new Error(`Failed to fetch image: ${response.status}`);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "applaunchflow",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "description": "Hosted OAuth MCP connector for AppLaunchFlow.",
   "license": "MIT",
   "repository": {