Merge branch 'main' into claude/add-oauth-client-credentials-wdnqt

Author: jancurn

.github/workflows/ci.yml

@@ -60,7 +60,7 @@ jobs:
         # file storage (~/.mcpc/credentials.json, mode 0600).  The keychain code paths
         # are covered by unit tests; e2e tests only need credentials to work, not a
         # specific storage backend.
-        run: ./test/e2e/run.sh --no-build --parallel 4
+        run: ./test/e2e/run.sh --no-build --parallel 6
 
   e2e-bun:
     name: E2E tests (Bun)
@@ -85,4 +85,4 @@ jobs:
         run: npm run build
 
       - name: E2E tests
-        run: ./test/e2e/run.sh --no-build --runtime bun --parallel 4
+        run: ./test/e2e/run.sh --no-build --runtime bun --parallel 6

CHANGELOG.md

@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - E2E tests now run under the Bun runtime (in addition to Node.js); use `./test/e2e/run.sh --runtime bun` or `npm run test:e2e:bun`
 
 ### Fixed
+- `--timeout` flag now correctly propagates to MCP requests via session bridge
 - `parseServerArg()` now handles well Windows drive-letter config paths as well as other ambiguous cases
 
 ### Changed

package.json

@@ -32,7 +32,7 @@
     "build": "tsc",
     "build:watch": "tsc --watch",
     "build:readme": "./scripts/update-readme.sh",
-    "test": "npm run build && npm run test:unit && ./test/e2e/run.sh --no-build --parallel 4 && ./test/e2e/run.sh --no-build --parallel 4 --runtime bun",
+    "test": "npm run build && npm run test:unit && ./test/e2e/run.sh --no-build --parallel 8 && ./test/e2e/run.sh --no-build --parallel 8 --runtime bun",
     "test:unit": "jest",
     "test:watch": "jest --watch",
     "test:coverage": "npm run test:coverage:unit && npm run test:coverage:e2e && npm run test:coverage:merge",

src/bridge/index.ts

@@ -905,6 +905,11 @@ class BridgeProcess {
     }
 
     try {
+      // Apply per-request timeout if provided (from CLI --timeout flag, in seconds → milliseconds)
+      if (message.timeout !== undefined) {
+        this.client.setRequestTimeout(message.timeout * 1000);
+      }
+
       let result: unknown;
 
       // Route to appropriate client method

src/cli/helpers.ts

@@ -171,6 +171,7 @@ export async function withMcpClient<T>(
     outputMode?: OutputMode;
     verbose?: boolean;
     hideTarget?: boolean;
+    timeout?: number;
   },
   callback: (client: IMcpClient, context: McpClientContext) => Promise<T>
 ): Promise<T> {
@@ -205,5 +206,6 @@ export async function withMcpClient<T>(
   }
 
   // Use session client (SessionClient implements IMcpClient interface)
-  return await withSessionClient(target, (client) => callback(client, context));
+  const sessionOpts = options.timeout !== undefined ? { timeout: options.timeout } : undefined;
+  return await withSessionClient(target, (client) => callback(client, context), sessionOpts);
 }

src/core/mcp-client.ts

@@ -106,6 +106,14 @@ export class McpClient implements IMcpClient {
     };
   }
 
+  /**
+   * Override request timeout for subsequent requests (in milliseconds)
+   * Used by bridge to apply per-request timeout from CLI --timeout flag
+   */
+  setRequestTimeout(timeoutMs: number): void {
+    this.requestTimeout = timeoutMs;
+  }
+
   /**
    * Get request options with timeout if configured
    */

src/lib/bridge-client.ts

@@ -184,9 +184,9 @@ export class BridgeClient extends EventEmitter {
 
   /**
    * Send a request to the bridge and wait for response
-   * Uses 3-minute timeout for MCP operations
+   * Uses 3-minute timeout for MCP operations by default, or custom timeout if provided
    */
-  async request(method: string, params?: unknown): Promise<unknown> {
+  async request(method: string, params?: unknown, timeout?: number): Promise<unknown> {
     if (!this.socket) {
       throw new NetworkError('Not connected to bridge');
     }
@@ -198,16 +198,20 @@ export class BridgeClient extends EventEmitter {
       id,
       method,
       params,
+      ...(timeout !== undefined && { timeout }),
     };
 
     logger.debug('Sending request:', { id, method });
 
+    // Use custom timeout (in seconds, convert to ms) or default
+    const timeoutMs = timeout !== undefined ? timeout * 1000 : REQUEST_TIMEOUT;
+
     // Create promise for response
     const promise = new Promise<unknown>((resolve, reject) => {
       const timeoutId = setTimeout(() => {
         this.pendingRequests.delete(id);
         reject(new NetworkError(`Request timeout: ${method}`));
-      }, REQUEST_TIMEOUT);
+      }, timeoutMs);
 
       this.pendingRequests.set(id, { resolve, reject, timeoutId });
     });

src/lib/session-client.ts

@@ -42,6 +42,7 @@ const logger = createLogger('session-client');
 export class SessionClient extends EventEmitter implements IMcpClient {
   private bridgeClient: BridgeClient;
   private sessionName: string;
+  private requestTimeout?: number; // Per-request timeout in seconds
 
   constructor(sessionName: string, bridgeClient: BridgeClient) {
     super();
@@ -50,6 +51,13 @@ export class SessionClient extends EventEmitter implements IMcpClient {
     this.setupNotificationForwarding();
   }
 
+  /**
+   * Set request timeout for all subsequent requests (in seconds)
+   */
+  setRequestTimeout(timeout: number): void {
+    this.requestTimeout = timeout;
+  }
+
   /**
    * Set up notification forwarding from bridge client
    */
@@ -112,34 +120,56 @@ export class SessionClient extends EventEmitter implements IMcpClient {
   // Server info (single IPC call for all server information)
   async getServerDetails(): Promise<ServerDetails> {
     return this.withRetry(
-      () => this.bridgeClient.request('getServerDetails') as Promise<ServerDetails>,
+      () =>
+        this.bridgeClient.request(
+          'getServerDetails',
+          undefined,
+          this.requestTimeout
+        ) as Promise<ServerDetails>,
       'getServerDetails'
     );
   }
 
   // MCP operations
   async ping(): Promise<void> {
-    return this.withRetry(() => this.bridgeClient.request('ping').then(() => undefined), 'ping');
+    return this.withRetry(
+      () => this.bridgeClient.request('ping', undefined, this.requestTimeout).then(() => undefined),
+      'ping'
+    );
   }
 
   async listTools(cursor?: string): Promise<ListToolsResult> {
     return this.withRetry(
-      () => this.bridgeClient.request('listTools', cursor) as Promise<ListToolsResult>,
+      () =>
+        this.bridgeClient.request(
+          'listTools',
+          cursor,
+          this.requestTimeout
+        ) as Promise<ListToolsResult>,
       'listTools'
     );
   }
 
   async callTool(name: string, args?: Record<string, unknown>): Promise<CallToolResult> {
     return this.withRetry(
       () =>
-        this.bridgeClient.request('callTool', { name, arguments: args }) as Promise<CallToolResult>,
+        this.bridgeClient.request(
+          'callTool',
+          { name, arguments: args },
+          this.requestTimeout
+        ) as Promise<CallToolResult>,
       'callTool'
     );
   }
 
   async listResources(cursor?: string): Promise<ListResourcesResult> {
     return this.withRetry(
-      () => this.bridgeClient.request('listResources', cursor) as Promise<ListResourcesResult>,
+      () =>
+        this.bridgeClient.request(
+          'listResources',
+          cursor,
+          this.requestTimeout
+        ) as Promise<ListResourcesResult>,
       'listResources'
     );
   }
@@ -149,54 +179,78 @@ export class SessionClient extends EventEmitter implements IMcpClient {
       () =>
         this.bridgeClient.request(
           'listResourceTemplates',
-          cursor
+          cursor,
+          this.requestTimeout
         ) as Promise<ListResourceTemplatesResult>,
       'listResourceTemplates'
     );
   }
 
   async readResource(uri: string): Promise<ReadResourceResult> {
     return this.withRetry(
-      () => this.bridgeClient.request('readResource', { uri }) as Promise<ReadResourceResult>,
+      () =>
+        this.bridgeClient.request(
+          'readResource',
+          { uri },
+          this.requestTimeout
+        ) as Promise<ReadResourceResult>,
       'readResource'
     );
   }
 
   async subscribeResource(uri: string): Promise<void> {
     return this.withRetry(
-      () => this.bridgeClient.request('subscribeResource', { uri }).then(() => undefined),
+      () =>
+        this.bridgeClient
+          .request('subscribeResource', { uri }, this.requestTimeout)
+          .then(() => undefined),
       'subscribeResource'
     );
   }
 
   async unsubscribeResource(uri: string): Promise<void> {
     return this.withRetry(
-      () => this.bridgeClient.request('unsubscribeResource', { uri }).then(() => undefined),
+      () =>
+        this.bridgeClient
+          .request('unsubscribeResource', { uri }, this.requestTimeout)
+          .then(() => undefined),
       'unsubscribeResource'
     );
   }
 
   async listPrompts(cursor?: string): Promise<ListPromptsResult> {
     return this.withRetry(
-      () => this.bridgeClient.request('listPrompts', cursor) as Promise<ListPromptsResult>,
+      () =>
+        this.bridgeClient.request(
+          'listPrompts',
+          cursor,
+          this.requestTimeout
+        ) as Promise<ListPromptsResult>,
       'listPrompts'
     );
   }
 
   async getPrompt(name: string, args?: Record<string, string>): Promise<GetPromptResult> {
     return this.withRetry(
       () =>
-        this.bridgeClient.request('getPrompt', {
-          name,
-          arguments: args,
-        }) as Promise<GetPromptResult>,
+        this.bridgeClient.request(
+          'getPrompt',
+          {
+            name,
+            arguments: args,
+          },
+          this.requestTimeout
+        ) as Promise<GetPromptResult>,
       'getPrompt'
     );
   }
 
   async setLoggingLevel(level: LoggingLevel): Promise<void> {
     return this.withRetry(
-      () => this.bridgeClient.request('setLoggingLevel', level).then(() => undefined),
+      () =>
+        this.bridgeClient
+          .request('setLoggingLevel', level, this.requestTimeout)
+          .then(() => undefined),
       'setLoggingLevel'
     );
   }
@@ -231,10 +285,15 @@ export async function createSessionClient(sessionName: string): Promise<SessionC
  */
 export async function withSessionClient<T>(
   sessionName: string,
-  callback: (client: IMcpClient) => Promise<T>
+  callback: (client: IMcpClient) => Promise<T>,
+  options?: { timeout?: number }
 ): Promise<T> {
   const client = await createSessionClient(sessionName);
 
+  if (options?.timeout !== undefined) {
+    client.setRequestTimeout(options.timeout);
+  }
+
   try {
     return await callback(client);
   } finally {

src/lib/types.ts

@@ -231,6 +231,7 @@ export interface IpcMessage {
   id?: string; // Request ID for correlation
   method?: string; // MCP method name
   params?: unknown; // Method parameters
+  timeout?: number; // Per-request timeout in seconds (overrides default)
   result?: unknown; // Response result
   notification?: NotificationData; // Notification data (for type='notification')
   authCredentials?: AuthCredentials; // Auth credentials (for type='set-auth-credentials')

test/e2e/suites/basic/timeout.test.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+# Test: --timeout flag causes requests to fail when server is too slow
+
+source "$(dirname "$0")/../../lib/framework.sh"
+test_init "basic/timeout" --isolated
+
+# Start test server
+start_test_server
+
+# =============================================================================
+# Test: tools-call with --timeout shorter than server delay
+# =============================================================================
+
+SESSION=$(create_session "$TEST_SERVER_URL" "timeout-1")
+
+test_case "tools-call times out when server is slower than --timeout"
+run_mcpc "$SESSION" tools-call slow ms:=10000 --timeout 2
+assert_failure
+# The error may mention "timeout", "abort", or "session not found" depending on
+# how the SDK handles the cancellation. The key assertion is that it fails.
+assert_not_empty "$STDERR" "stderr should have an error message"
+test_pass
+
+# Close and recreate session since timeout may have disrupted bridge state
+run_mcpc "$SESSION" close 2>/dev/null || true
+
+# =============================================================================
+# Test: tools-call succeeds when --timeout is generous enough
+# =============================================================================
+
+SESSION2=$(create_session "$TEST_SERVER_URL" "timeout-2")
+
+test_case "tools-call succeeds when --timeout is long enough"
+run_mcpc "$SESSION2" tools-call slow ms:=500 --timeout 10
+assert_success
+assert_contains "$STDOUT" "Waited 500ms"
+test_pass
+
+# =============================================================================
+# Test: tools-list with --timeout works (fast response, no timeout)
+# =============================================================================
+
+test_case "tools-list succeeds with short --timeout (fast server response)"
+run_mcpc "$SESSION2" tools-list --timeout 10
+assert_success
+assert_contains "$STDOUT" "echo"
+test_pass
+
+# =============================================================================
+# Test: ping with --timeout
+# =============================================================================
+
+test_case "ping succeeds with reasonable --timeout"
+run_mcpc "$SESSION2" ping --timeout 10
+assert_success
+test_pass
+
+# =============================================================================
+# Test: --timeout with --json outputs valid JSON error
+# =============================================================================
+
+SESSION3=$(create_session "$TEST_SERVER_URL" "timeout-3")
+
+test_case "timeout error with --json outputs valid JSON to stderr"
+run_mcpc "$SESSION3" --json tools-call slow ms:=10000 --timeout 2
+assert_failure
+assert_json_valid "$STDERR" "timeout error should be valid JSON in --json mode"
+test_pass
+
+test_done