@mcp-abap-adt/proxy 1.3.0 → 1.6.0

package/CHANGELOG.md

@@ -7,6 +7,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.6.0] - 2026-06-04
+
+### Added
+- **Environment-variable interpolation in config + `.env` support.** Config string values (and `--header` values) may now contain `${VAR}` / `${VAR:-default}` placeholders, resolved from `process.env` and an explicitly-pointed `.env` file. This makes `defaultHeaders` the per-user auth-injection point for ABAP credentials (`x-sap-login` / `x-sap-password`) on shared servers like `cloud-llm-hub` — **without** storing secrets as plaintext in the YAML. (#4, #5)
+  - `.env` source is explicit only: `envFile: <path>` in the config (resolved relative to the config file's directory) or `--env-file <path>` on the command line (overrides `envFile`). There is no `cwd` auto-discovery.
+  - Resolution priority: `process.env` → `.env` → `${VAR:-default}`. `process.env` wins over the `.env` file.
+  - **Fail-fast:** a `${VAR}` without a default that cannot be resolved aborts startup with an error naming the variable and the field it came from, so a request never silently goes out with an empty credential.
+  - `Authorization` remains proxy-managed (destination JWT) and cannot be set via `defaultHeaders`.
+
+## [1.5.0] - 2026-06-02
+
+### Added
+- **Exit on incomplete authentication.** When authentication is requested but not completed — at startup (eager auth) or on a request that needs a token — the proxy now logs a categorised reason (timeout / invalid credentials / service key / network) and exits with code 1, so it can be restarted to retry (mirroring the one-shot `mcp-auth` command) instead of running in a permanently unauthenticated state. A downstream/forward error (after auth succeeds) is still returned to the client without exiting.
+
+### Changed
+- Bump `@mcp-abap-adt/auth-broker` `^1.0.5` → `^1.0.6`: the broker no longer starts a redundant second browser login after an interactive session-login failure, so the real cause (e.g. login timeout) is reported instead of a misleading `Port <n> is already in use`.
+
+## [1.4.0] - 2026-06-02
+
+### Added
+- **Manual paste login for `--browser none` / `headless`** (via `@mcp-abap-adt/auth-providers@1.1.0`). When the browser runs on a different machine than the proxy, login can be completed by opening the paste form at `http://<host>:<browser-auth-port>/` and pasting the `code` (or the whole redirected URL), or by pasting the code in the terminal — in addition to the existing automatic localhost callback.
+
+### Fixed
+- **`--browser none` now prints the authorization URL.** The per-destination `AuthorizationCodeProvider` was created without a logger, so the "Open this URL" prompt from `browserAuth` was silently dropped and login could never be completed in headless mode. The proxy now passes its logger to the provider; `auth-providers@1.1.0` additionally falls back to `stderr` when no logger is supplied.
+- **Platform-correct service-key path in `--help` and errors.** The "service key not found" hint and `--help` hard-coded the Unix `~/.config/...` path, which is wrong on Windows (`%USERPROFILE%\Documents\mcp-abap-adt\service-keys`). Both now show the real resolved directory and mention the `AUTH_BROKER_PATH` override.
+
+### Changed
+- Bump `@mcp-abap-adt/auth-providers` `^1.0.5` → `^1.1.0`.
+
 ## [1.3.0] - 2026-05-28
 
 ### Added

package/README.md

@@ -98,7 +98,7 @@ For detailed setup instructions for Cline and GitHub Copilot, see the **[Client
 
 MCP clients like Cline and Claude Code cannot set arbitrary request headers. Use default headers to inject SAP-specific headers (e.g. `x-sap-destination`, `x-sap-client`) that the target MCP server requires.
 
-Client-supplied headers always take precedence over defaults.
+Precedence: client-supplied request headers always win over `defaultHeaders`. `Authorization` is the exception — it is always managed by the proxy (replaced with the destination JWT) and **cannot** be set via `defaultHeaders`.
 
 Via YAML config (`defaultHeaders` map):
 ```yaml
@@ -109,6 +109,28 @@ defaultHeaders:
   x-sap-client: "100"
 ```
 
+**Per-user ABAP credentials.** `defaultHeaders` is the supported place to supply your own SAP login/password for on-premise / `NoAuthentication` destinations. The upstream `cloud-llm-hub` is a **shared** server with no default service user, so it expects each caller's own `x-sap-login` / `x-sap-password` on every request. Because the proxy runs **locally on each user's machine**, it carries *your* identity.
+
+Do not hardcode secrets. Reference environment variables with `${VAR}` (or `${VAR:-default}`); values are resolved from `process.env` or an explicitly-pointed `.env` file:
+
+```yaml
+btpDestination: mcp
+envFile: secrets.env            # resolved relative to this config file's dir
+defaultHeaders:
+  x-sap-destination: S4HANA_E19
+  x-sap-login: ${SAP_USER}
+  x-sap-password: ${SAP_PASSWORD}
+```
+
+`secrets.env` (user-local, `chmod 600`, never committed):
+
+```dotenv
+SAP_USER=MY_SAP_USER
+SAP_PASSWORD=my-sap-password
+```
+
+Resolution order is `process.env` → `.env` → `${VAR:-default}`. `process.env` wins; an unresolved `${VAR}` without a default fails the proxy at startup. Override the `.env` path at launch with `--env-file <path>`. This closes both auth layers from one local config: the **service layer** (`Authorization: Bearer <JWT>`, from the destination service key) and the **ABAP layer** (`x-sap-login` / `x-sap-password`).
+
 Via CLI (`--header`, repeatable):
 ```bash
 mcp-abap-adt-proxy --btp=mcp --url=https://example.com \

package/bin/mcp-abap-adt-proxy.js

@@ -56,9 +56,13 @@ Options:
                            Useful for direct OData service testing or non-standard MCP URLs
   --config=<file>, -c     Load configuration from YAML or JSON file
                            Alternative to command-line parameters
+  --env-file=<path>        Load a .env file for ${VAR} interpolation in config/headers
+                           Overrides the config's "envFile" field
   --unsafe                 Enable file-based session storage (persists tokens to disk)
   --header key=value       Add default header to every forwarded request (repeatable)
+                           Values support ${VAR} / ${VAR:-default} interpolation
                            Example: --header x-sap-destination=S4HANA
+                           Example: --header x-sap-password=${SAP_PASSWORD}
   --help, -h              Show this help message
   --version, -v           Show version number
 

package/dist/index.d.ts

@@ -17,6 +17,7 @@ export declare class McpAbapAdtProxyServer {
     private config;
     private httpServer?;
     private btpProxy?;
+    private authExiting;
     constructor(transportConfig?: TransportConfig, configPath?: string);
     /**
      * Setup MCP handlers
@@ -38,6 +39,13 @@ export declare class McpAbapAdtProxyServer {
      * Start SSE server
      */
     private startSseServer;
+    /**
+     * Authentication was requested but could not be completed. Report the reason
+     * clearly, release resources, and exit(1) so the proxy is restarted (and the
+     * user gets a fresh login prompt) instead of running unauthenticated. Mirrors
+     * the one-shot `mcp-auth` command, which exits on a failed/incomplete login.
+     */
+    private fatalAuthFailure;
     /**
      * Shutdown server
      */

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuBH,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,0BAA0B,CAAC;AAqBlC;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAEhB,eAAe,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM;IAoDlE;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAuE1B;;OAEG;YACW,eAAe;IAgG7B;;OAEG;YACW,kBAAkB;IA8ChC;;OAEG;YACW,cAAc;IA6T5B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAoBhC;AAGD,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAwBH,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,0BAA0B,CAAC;AAgElC;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,CAAW;IAC5B,OAAO,CAAC,WAAW,CAAS;gBAEhB,eAAe,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM;IAoDlE;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IA2E1B;;OAEG;YACW,eAAe;IAgG7B;;OAEG;YACW,kBAAkB;IAgEhC;;OAEG;YACW,cAAc;IA6T5B;;;;;OAKG;YACW,gBAAgB;IAiC9B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAoBhC;AAGD,eAAe,qBAAqB,CAAC"}

package/dist/index.js

@@ -18,6 +18,7 @@ const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
 const reverseProxy_js_1 = require("./proxy/reverseProxy.js");
 const config_js_1 = require("./lib/config.js");
 const logger_js_1 = require("./lib/logger.js");
+const stores_js_1 = require("./lib/stores.js");
 const transportConfig_js_1 = require("./lib/transportConfig.js");
 const btpProxy_js_1 = require("./proxy/btpProxy.js");
 const headerAnalyzer_js_1 = require("./router/headerAnalyzer.js");
@@ -31,6 +32,38 @@ function getBodyId(body) {
     }
     return null;
 }
+/**
+ * Classify an authentication failure into a human-readable reason so the proxy
+ * can report *why* it is exiting (timeout vs bad credentials vs network ...).
+ */
+function classifyAuthFailure(error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    if (/timeout/i.test(msg)) {
+        return {
+            category: 'timeout',
+            reason: 'the login URL was not completed in time',
+        };
+    }
+    if (/service key|missing required fields/i.test(msg)) {
+        return {
+            category: 'service-key',
+            reason: 'service key missing or incomplete',
+        };
+    }
+    if (/invalid_client|unauthorized|\b401\b|invalid credentials/i.test(msg)) {
+        return {
+            category: 'credentials',
+            reason: 'invalid credentials — UAA rejected the client',
+        };
+    }
+    if (/ENOTFOUND|ECONNREFUSED|ETIMEDOUT|network|ENETUNREACH/i.test(msg)) {
+        return {
+            category: 'network',
+            reason: 'network error reaching the authentication server',
+        };
+    }
+    return { category: 'other', reason: msg };
+}
 /**
  * MCP ABAP ADT Proxy Server
  */
@@ -40,6 +73,7 @@ class McpAbapAdtProxyServer {
     config;
     httpServer;
     btpProxy;
+    authExiting = false;
     constructor(transportConfig, configPath) {
         // Load config first to extract transport overrides from YAML/JSON file
         const resolvedConfigPath = configPath || (0, config_js_1.getConfigPath)();
@@ -125,20 +159,24 @@ Authorization source: BTP destination "${this.config.btpDestination}"`;
             });
             return;
         }
-        // Eager initialization of BTP authentication
+        // Eager initialization of BTP authentication. Kept in the background so the
+        // server starts listening immediately (and, for --browser none, the auth URL
+        // is printed right away). If auth is requested but never completed, exit(1)
+        // so the proxy is restarted and the user gets a fresh login prompt.
         if (this.config.btpDestination) {
+            const dest = this.config.btpDestination;
             try {
                 if (!this.btpProxy) {
                     this.btpProxy = await (0, btpProxy_js_1.createBtpProxy)(this.config);
                 }
-                // Trigger initialization (background) - this will open the browser
-                this.btpProxy.initialize(this.config.btpDestination);
             }
             catch (error) {
-                logger_js_1.logger?.error('Failed to initialize BTP proxy for eager auth', {
-                    error: error instanceof Error ? error.message : String(error),
-                });
+                await this.fatalAuthFailure(error, dest, 'startup');
+                return;
             }
+            this.btpProxy
+                .initialize(dest)
+                .catch((error) => this.fatalAuthFailure(error, dest, 'startup'));
         }
         if (this.transportConfig.type === 'streamable-http') {
             await this.startHttpServer();
@@ -246,9 +284,28 @@ Authorization source: ${authSourceObj}`;
         if (!this.btpProxy) {
             this.btpProxy = await (0, btpProxy_js_1.createBtpProxy)(this.config);
         }
+        // Authentication is separated from forwarding: an auth failure is fatal
+        // (the proxy exits so it can be restarted), while a downstream/forward error
+        // is returned to the client without killing the proxy.
+        let jwtToken;
         try {
             // Get JWT token (cached, auto-refresh)
-            const jwtToken = await this.btpProxy.getJwtToken(destination);
+            jwtToken = await this.btpProxy.getJwtToken(destination);
+        }
+        catch (authError) {
+            logger_js_1.logger?.error('Proxy request failed: authentication error', {
+                type: 'PROXY_REQUEST_AUTH_ERROR',
+                destination,
+                error: authError instanceof Error ? authError.message : String(authError),
+            });
+            if (!res.headersSent) {
+                res.writeHead(502, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Authentication failed' }));
+            }
+            await this.fatalAuthFailure(authError, destination, 'request');
+            return;
+        }
+        try {
             // Get target URL
             const targetUrl = intercepted.routingDecision.targetUrl ||
                 (await this.btpProxy.getTargetUrl(destination));
@@ -540,6 +597,37 @@ Authorization source: ${authSourceObj}`;
             });
         });
     }
+    /**
+     * Authentication was requested but could not be completed. Report the reason
+     * clearly, release resources, and exit(1) so the proxy is restarted (and the
+     * user gets a fresh login prompt) instead of running unauthenticated. Mirrors
+     * the one-shot `mcp-auth` command, which exits on a failed/incomplete login.
+     */
+    async fatalAuthFailure(error, destination, phase) {
+        if (this.authExiting)
+            return;
+        this.authExiting = true;
+        const { category, reason } = classifyAuthFailure(error);
+        const detail = error instanceof Error ? error.message : String(error);
+        logger_js_1.logger?.error('Authentication not completed — exiting', {
+            type: 'AUTH_FATAL_EXIT',
+            destination,
+            phase,
+            category,
+            reason,
+            error: detail,
+        });
+        console.error(`[MCP Proxy] ✗ Authentication failed for destination "${destination}" (${phase}): ${reason}.\n` +
+            `[MCP Proxy]   ${detail}\n` +
+            `[MCP Proxy] Exiting (code 1) so the proxy can be restarted to retry authentication.`);
+        try {
+            await this.shutdown();
+        }
+        catch {
+            // best-effort cleanup; exit regardless
+        }
+        process.exit(1);
+    }
     /**
      * Shutdown server
      */
@@ -571,6 +659,9 @@ exports.default = McpAbapAdtProxyServer;
  * Print CLI usage and exit.
  */
 function printHelp() {
+    // Show the real, platform-specific directory where service keys are read from
+    // (Windows: %USERPROFILE%\Documents\mcp-abap-adt\service-keys; Unix: ~/.config/...)
+    const serviceKeyDir = (0, stores_js_1.getPlatformPaths)('service-keys')[0];
     const help = `Usage: mcp-abap-adt-proxy [options]
 
 Authorization proxy for MCP clients (Cline, Claude Code, etc.) that cannot
@@ -582,7 +673,8 @@ CONFIGURATION
 
 AUTHENTICATION (BTP / XSUAA)
   --btp <destination>         BTP destination name. Service key is read from
-                              ~/.config/mcp-abap-adt/service-keys/<dest>.json
+                              ${serviceKeyDir}${require('node:path').sep}<dest>.json
+                              (override the base dir with AUTH_BROKER_PATH)
   --target-url <url>          Override target service URL (default: from service key)
   --url <url>                 Alias for --target-url
   --unsafe                    Persist session/tokens to disk (default: in-memory)
@@ -595,12 +687,18 @@ BROWSER AUTHORIZATION
                                 chrome   - Google Chrome
                                 edge     - Microsoft Edge
                                 firefox  - Firefox
-                                none     - Print URL to console and wait for
-                                           callback (for SSH/headless sessions)
+                                none     - Print URL to console; complete login
+                                           via callback OR by pasting the code
+                                           (for SSH/headless/remote sessions)
                                 headless - Alias for 'none'
   --browser-auth-port <port>  Local OAuth callback port. Must match the
                               redirect_uri registered on XSUAA (default: 3333).
 
+  Run without auto-opening a browser (prints the URL, then completes via the
+  localhost callback, the paste form at http://<host>:<port>/, or by pasting
+  the code in the terminal):
+    mcp-abap-adt-proxy --btp <dest> --browser none --browser-auth-port 3333
+
 TRANSPORT
   --transport <type>          stdio | streamable-http | http | sse
                               (auto-detected from stdin TTY if not set)

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAGxC,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAG/B,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CAyB3D;AAwED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,mBAAmB,CAQrB;AAgBD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAYhC;AA4ID;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAUD;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG;IACnD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAoDA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAYH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAGxC,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAG/B,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CAoC3D;AAwED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,mBAAmB,CAQrB;AAkCD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAYhC;AAmJD;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAUD;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG;IACnD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAoDA"}

package/dist/lib/config.js

@@ -44,6 +44,7 @@ exports.validateConfig = validateConfig;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const yaml = __importStar(require("js-yaml"));
+const envInterpolation_js_1 = require("./envInterpolation.js");
 /**
  * Load configuration from file if --config is provided, otherwise from environment variables and command line
  * Supports both JSON and YAML formats
@@ -64,7 +65,12 @@ function loadConfig(configPath) {
                 throw new Error(`Config file not found: ${finalConfigPath}`);
             }
             const fileConfig = loadConfigFile(finalConfigPath);
-            const base = applyDefaults(fileConfig);
+            const envFilePath = resolveEnvFilePath(fileConfig, finalConfigPath);
+            const envFileMap = envFilePath ? (0, envInterpolation_js_1.loadEnvFile)(envFilePath) : {};
+            const lookup = (0, envInterpolation_js_1.buildLookup)(envFileMap);
+            const interpolated = (0, envInterpolation_js_1.interpolateConfig)(fileConfig, lookup);
+            delete interpolated.envFile;
+            const base = applyDefaults(interpolated);
             const cli = readCliOverrides();
             return mergeCliOverrides(base, cli, finalConfigPath);
         }
@@ -155,6 +161,21 @@ function loadConfigFile(filePath) {
         return JSON.parse(configContent);
     }
 }
+/**
+ * Resolve the .env path for the file-config path: --env-file wins (relative to
+ * cwd); otherwise the YAML `envFile` field, resolved relative to the config
+ * file's directory. Returns undefined when neither is set.
+ */
+function resolveEnvFilePath(rawConfig, configPath) {
+    const cliEnvFile = getArgValue('--env-file');
+    if (cliEnvFile !== undefined)
+        return path.resolve(cliEnvFile);
+    const yamlEnvFile = rawConfig.envFile;
+    if (typeof yamlEnvFile === 'string') {
+        return path.resolve(path.dirname(configPath), yamlEnvFile);
+    }
+    return undefined;
+}
 /**
  * Load raw config from file for transport field extraction
  */
@@ -210,17 +231,20 @@ function loadFromEnv() {
     const browserAuthPort = browserAuthPortStr
         ? parseInt(browserAuthPortStr, 10)
         : undefined;
-    // Parse repeatable --header key=value arguments
+    // Parse repeatable --header key=value arguments, interpolating ${VAR}
     const headerArgs = getAllArgValues('--header');
     let defaultHeaders;
     if (headerArgs.length > 0) {
+        const cliEnvFile = getArgValue('--env-file');
+        const envFileMap = cliEnvFile ? (0, envInterpolation_js_1.loadEnvFile)(path.resolve(cliEnvFile)) : {};
+        const lookup = (0, envInterpolation_js_1.buildLookup)(envFileMap);
         defaultHeaders = {};
         for (const arg of headerArgs) {
             const eqIndex = arg.indexOf('=');
             if (eqIndex > 0) {
                 const key = arg.substring(0, eqIndex).toLowerCase();
-                const value = arg.substring(eqIndex + 1);
-                defaultHeaders[key] = value;
+                const rawValue = arg.substring(eqIndex + 1);
+                defaultHeaders[key] = (0, envInterpolation_js_1.interpolateString)(rawValue, lookup, `--header ${key}`);
             }
         }
     }

package/dist/lib/envInterpolation.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Environment-variable interpolation for proxy configuration.
+ * Supports ${VAR} and ${VAR:-default} in string values.
+ */
+/**
+ * Resolve ${VAR} / ${VAR:-default} placeholders in a single string.
+ * Empty-string follows bash `:-` semantics: an empty value falls back to the
+ * default when one is given. A ${VAR} without a default that resolves to
+ * undefined throws, naming the variable and the field it came from.
+ */
+export declare function interpolateString(input: string, lookup: (key: string) => string | undefined, fieldPath: string): string;
+/**
+ * Recursively interpolate all string values in a parsed config object.
+ * Objects/arrays are walked; non-string scalars are returned unchanged.
+ * The field path (e.g. `defaultHeaders.x-sap-password`) is threaded through for
+ * error messages.
+ */
+export declare function interpolateConfig(value: unknown, lookup: (key: string) => string | undefined, path?: string): unknown;
+/**
+ * Parse a .env file into a flat map. Throws if the path is given but missing —
+ * a specified-yet-absent secret source is a configuration error, not a no-op.
+ */
+export declare function loadEnvFile(envFilePath: string): Record<string, string>;
+/**
+ * Build a lookup over process.env (highest priority) then the parsed .env map.
+ */
+export declare function buildLookup(envFileMap: Record<string, string>): (key: string) => string | undefined;
+//# sourceMappingURL=envInterpolation.d.ts.map

package/dist/lib/envInterpolation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envInterpolation.d.ts","sourceRoot":"","sources":["../../src/lib/envInterpolation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC3C,SAAS,EAAE,MAAM,GAChB,MAAM,CAiBR;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC3C,IAAI,SAAK,GACR,OAAO,CAiBT;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKvE;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAGrC"}

package/dist/lib/envInterpolation.js

@@ -0,0 +1,103 @@
+"use strict";
+/**
+ * Environment-variable interpolation for proxy configuration.
+ * Supports ${VAR} and ${VAR:-default} in string values.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.interpolateString = interpolateString;
+exports.interpolateConfig = interpolateConfig;
+exports.loadEnvFile = loadEnvFile;
+exports.buildLookup = buildLookup;
+const fs = __importStar(require("node:fs"));
+const dotenv = __importStar(require("dotenv"));
+const PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g;
+/**
+ * Resolve ${VAR} / ${VAR:-default} placeholders in a single string.
+ * Empty-string follows bash `:-` semantics: an empty value falls back to the
+ * default when one is given. A ${VAR} without a default that resolves to
+ * undefined throws, naming the variable and the field it came from.
+ */
+function interpolateString(input, lookup, fieldPath) {
+    return input.replace(PLACEHOLDER, (_match, name, defaultVal) => {
+        const value = lookup(name);
+        const isEmpty = value === undefined || value === '';
+        if (defaultVal !== undefined) {
+            return isEmpty ? defaultVal : value;
+        }
+        if (value === undefined) {
+            throw new Error(`Config references undefined env variable: ${name} (referenced in ${fieldPath})`);
+        }
+        return value;
+    });
+}
+/**
+ * Recursively interpolate all string values in a parsed config object.
+ * Objects/arrays are walked; non-string scalars are returned unchanged.
+ * The field path (e.g. `defaultHeaders.x-sap-password`) is threaded through for
+ * error messages.
+ */
+function interpolateConfig(value, lookup, path = '') {
+    if (typeof value === 'string') {
+        return interpolateString(value, lookup, path || '(root)');
+    }
+    if (Array.isArray(value)) {
+        return value.map((item, i) => interpolateConfig(item, lookup, `${path}[${i}]`));
+    }
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const [key, val] of Object.entries(value)) {
+            out[key] = interpolateConfig(val, lookup, path ? `${path}.${key}` : key);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Parse a .env file into a flat map. Throws if the path is given but missing —
+ * a specified-yet-absent secret source is a configuration error, not a no-op.
+ */
+function loadEnvFile(envFilePath) {
+    if (!fs.existsSync(envFilePath)) {
+        throw new Error(`env file not found: ${envFilePath}`);
+    }
+    return dotenv.parse(fs.readFileSync(envFilePath, 'utf-8'));
+}
+/**
+ * Build a lookup over process.env (highest priority) then the parsed .env map.
+ */
+function buildLookup(envFileMap) {
+    return (key) => process.env[key] ?? envFileMap[key];
+}

package/dist/proxy/btpProxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"btpProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/btpProxy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,2BAA2B,CAAC;AAYrE,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AA4CnE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAU3C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAGD,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAa;IACzC,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,UAAU,CACN;IACZ,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAU;gBAEZ,oBAAoB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAqF3E;;;OAGG;IACU,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB3D;;;;OAIG;YACW,wBAAwB;IAqFtC;;OAEG;YACW,uBAAuB;IAyFrC;;;;OAIG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,MAAM,CAAC;IAiHlB;;OAEG;IACH,OAAO,CAAC,YAAY;IAapB;;;OAGG;IACH,OAAO,CAAC,UAAU;IASlB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA6BhC;;OAEG;YACW,gBAAgB;IAU9B;;OAEG;IACI,OAAO,IAAI,IAAI;IAStB;;;OAGG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IAmT/B;;OAEG;IACG,YAAY,CAChB,eAAe,EAAE,YAAY,EAC7B,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,aAAa,CAAC;IAiLzB;;OAEG;WACiB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;CAyB7E;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAEnB"}
+{"version":3,"file":"btpProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/btpProxy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,2BAA2B,CAAC;AAYrE,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AA4CnE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAU3C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAGD,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAa;IACzC,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,UAAU,CACN;IACZ,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAU;gBAEZ,oBAAoB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAqF3E;;;OAGG;IACU,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3D;;;;OAIG;YACW,wBAAwB;IA0FtC;;OAEG;YACW,uBAAuB;IAyFrC;;;;OAIG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,MAAM,CAAC;IAiHlB;;OAEG;IACH,OAAO,CAAC,YAAY;IAapB;;;OAGG;IACH,OAAO,CAAC,UAAU;IASlB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA6BhC;;OAEG;YACW,gBAAgB;IAU9B;;OAEG;IACI,OAAO,IAAI,IAAI;IAStB;;;OAGG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IAmT/B;;OAEG;IACG,YAAY,CAChB,eAAe,EAAE,YAAY,EAC7B,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,aAAa,CAAC;IAiLzB;;OAEG;WACiB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;CA0B7E;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAEnB"}

package/dist/proxy/btpProxy.js

@@ -155,8 +155,9 @@ class BtpProxy {
                 destination,
                 error: error instanceof Error ? error.message : String(error),
             });
-            // We don't throw here to avoid crashing the server on startup,
-            // but the user will see the error in logs/stderr (via getJwtToken)
+            // Re-throw so the server can decide to exit (auth requested but not
+            // completed) instead of running in a permanently unauthenticated state.
+            throw error;
         }
     }
     /**
@@ -199,9 +200,10 @@ class BtpProxy {
             });
         }
         if (!authConfig) {
+            const serviceKeyDir = (0, stores_js_1.getPlatformPaths)('service-keys')[0];
             logger_js_1.logger?.error('Service key not found for destination', {
                 destination,
-                hint: 'Ensure service key file exists in ~/.config/mcp-abap-adt/service-keys/',
+                hint: `Ensure service key file "${destination}.json" exists in ${serviceKeyDir} (override the base dir with AUTH_BROKER_PATH)`,
             });
             // We cannot proceed without config, but we'll let it fail with a clear message
             // Or we could throw here.
@@ -213,6 +215,10 @@ class BtpProxy {
         const providerConfig = {
             browser: this.config.browser,
             redirectPort: this.config.browserAuthPort || 3333,
+            // Pass a logger so browserAuth can surface the "Open this URL" prompt in
+            // 'none'/'headless' mode. Without it, startBrowserAuth gets a null logger
+            // and silently drops the authorization URL.
+            logger: loggerAdapter,
             ...(authConfig
                 ? {
                     uaaUrl: authConfig.uaaUrl,
@@ -924,6 +930,7 @@ class BtpProxy {
                 clientSecret: 'placeholder',
                 browser: loadedConfig.browser,
                 redirectPort: loadedConfig.browserAuthPort,
+                logger: loggerAdapter,
             }),
         }, 'none', loggerAdapter);
         return new BtpProxy(defaultBtpAuthBroker, loadedConfig);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/proxy",
-  "version": "1.3.0",
+  "version": "1.6.0",
   "description": "MCP proxy server for SAP ABAP ADT - proxies local requests to cloud-llm-hub with JWT authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -63,14 +63,15 @@
     "typescript": "^6.0.3"
   },
   "dependencies": {
-    "@mcp-abap-adt/auth-broker": "^1.0.5",
-    "@mcp-abap-adt/auth-providers": "^1.0.5",
+    "@mcp-abap-adt/auth-broker": "^1.0.6",
+    "@mcp-abap-adt/auth-providers": "^1.1.0",
     "@mcp-abap-adt/auth-stores": "^1.0.4",
     "@mcp-abap-adt/header-validator": "^0.1.8",
     "@mcp-abap-adt/interfaces": "^7.0.0",
     "@mcp-abap-adt/logger": "^0.1.4",
     "@modelcontextprotocol/sdk": "^1.26.0",
     "axios": "^1.15.1",
+    "dotenv": "^17.4.2",
     "js-yaml": "^4.1.1",
     "zod": "^4.3.6"
   },