@mcp-abap-adt/proxy 1.6.1 → 1.6.3

package/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.6.3] - 2026-07-27
+
+### Fixed
+- **Stopping the proxy left it running, holding its ports.** `bin/mcp-abap-adt-proxy.js` spawned the server as a child process and forwarded only `SIGINT`. Everything that stops a process with `SIGTERM` — `kill`, `pkill`, a service manager, an MCP client shutting the server down — killed the launcher while the server survived, re-parented to `init`/`systemd`, still holding both the HTTP port and the OAuth callback port. A later start then failed with `Port <n> is already in use`, naming the port from `browserAuthPort`.
+
+  The orphan was easy to miss: in `ps` it appears as `dist/index.js`, not `mcp-abap-adt-proxy`, and it is no longer attached to the terminal it was started from. Only `Ctrl+C` shut down cleanly.
+
+  The launcher no longer spawns anything — it loads the server in the same process, so signals reach the shutdown handler that was already there and already correct. It used the same Node executable, an unmodified environment, inherited stdio and the same arguments, so the child bought nothing.
+
+- **Closing a terminal mid-login left the proxy running for another 30 seconds.** `SIGHUP` is now handled alongside `SIGINT` and `SIGTERM`. It previously did not terminate the proxy at all during a login: `@mcp-abap-adt/auth-providers` registers its own `SIGHUP` listener while the callback server is open, and any registered listener suppresses Node's default terminate. The process lingered — holding its ports — until the authentication timeout exited it with code 1.
+
+### Changed
+- Updated dev/runtime dependencies to latest within their semver ranges (axios, zod, js-yaml, `@mcp-abap-adt/interfaces`, biome, jest toolchain, tsx, `@types/node`). Runtime `dependencies` ranges are unchanged, so consumer installs are unaffected.
+- Bumped `@modelcontextprotocol/inspector` (dev) to `^0.22.0`.
+- Removed unused `commander` dev dependency.
+
+### Notes
+- The `browserAuthPort` collision that remains is by design: the callback port is held for the whole interactive login, so two proxies whose login windows overlap cannot share one. Give each config its own, or stagger the logins.
+- Not addressed here, and tracked for `@mcp-abap-adt/auth-providers`: a callback that arrives without a `code` parameter leaves the callback socket open for the lifetime of the process, and a failed token exchange releases it about 300 ms after the login promise has already been rejected.
+
+## [1.6.2] - 2026-06-08
+
+### Fixed
+- Bumped `@mcp-abap-adt/auth-broker` to `^1.0.7`, which moves `tsx` (and its transitive `esbuild`) out of runtime dependencies. Installing the proxy (including `npm i -g`) no longer pulls `esbuild`, so Windows/macOS package managers stop prompting about esbuild's `allow-scripts` / ignored build script during install. Runtime behavior is unchanged.
+
 ## [1.6.1] - 2026-06-04
 
 ### Fixed

package/README.md

@@ -91,7 +91,7 @@ For detailed setup instructions for Cline and GitHub Copilot, see the **[Client
 - `--btp=<destination>` - Overrides `x-sap-destination` header (takes precedence)
 - `--url=<url>` - Overrides MCP server URL (required if service key lacks URL)
 - `--browser=<browser>` - Browser to use: `system` (default), `chrome`, `edge`, `firefox`, `headless`
-- `--browser-auth-port=<port>` - Port for OAuth2 callback (default: 3333)
+- `--browser-auth-port=<port>` - Port for the OAuth2 callback (default: 3333). Bound only while you are logging in, then released — see [How long the callback port is held](./docs/CONFIGURATION.md#how-long-the-callback-port-is-held)
 - `--unsafe` - Enables file-based session storage (persists tokens to disk). By default, sessions are stored in-memory (secure, lost on restart)
 
 **Default Headers:**

package/bin/mcp-abap-adt-proxy.js

@@ -3,7 +3,7 @@
 /**
  * MCP ABAP ADT Proxy Server Launcher
  *
- * Simple launcher that spawns the main server process.
+ * Parses --help/--version, then loads the main server in-process.
  *
  * Usage:
  *   mcp-abap-adt-proxy [options]
@@ -13,7 +13,6 @@
 
 const path = require('path');
 const fs = require('fs');
-const { spawn } = require('child_process');
 
 // Parse command line arguments
 function parseArgs() {
@@ -158,68 +157,12 @@ function main() {
     return;
   }
 
-  // Pass all arguments to server
-  const serverArgs = process.argv.slice(2);
-  const nodeExecPath = process.execPath;
-  const resolvedServerPath = path.resolve(serverPath);
-
-  // Verify server file exists
-  if (!fs.existsSync(resolvedServerPath)) {
-    process.stderr.write(`[MCP Proxy] ✗ Server file not found: ${resolvedServerPath}\n`);
-    if (process.platform === 'win32') {
-      setTimeout(() => process.exit(1), 30000);
-    } else {
-      process.exit(1);
-    }
-    return;
-  }
-
-  const serverEnv = {
-    ...process.env,
-  };
-
-  // Debug logging for Windows
-  if (process.platform === 'win32') {
-    process.stderr.write(`[MCP Proxy] Spawning server: ${nodeExecPath} ${resolvedServerPath}\n`);
-    process.stderr.write(`[MCP Proxy] CWD: ${process.cwd()}\n`);
-  }
-
-  // Spawn the server process
-  const serverProcess = spawn(nodeExecPath, [resolvedServerPath, ...serverArgs], {
-    stdio: ['inherit', 'inherit', 'inherit'],
-    env: serverEnv,
-    cwd: process.cwd(),
-    shell: false,
-  });
-
-  // Handle server process exit
-  serverProcess.on('close', (code) => {
-    if (code !== 0 && code !== null) {
-      process.stderr.write(`[MCP Proxy] Server exited with code: ${code}\n`);
-    }
-    process.exit(code || 0);
-  });
-
-  // Handle server process errors
-  serverProcess.on('error', (error) => {
-    process.stderr.write(`[MCP Proxy] ✗ Failed to start server: ${error.message}\n`);
-    if (error.stack) {
-      process.stderr.write(error.stack + '\n');
-    }
-    if (process.platform === 'win32') {
-      setTimeout(() => process.exit(1), 30000);
-    } else {
-      process.exit(1);
-    }
-  });
-
-  // Forward SIGINT (Ctrl+C) to server process
-  process.on('SIGINT', () => {
-    serverProcess.kill('SIGINT');
-    setTimeout(() => {
-      process.exit(0);
-    }, 500);
-  });
+  // The server is loaded in this process, not spawned as a child. A child
+  // would be orphaned by any signal the launcher does not forward — SIGTERM
+  // from `kill`/`pkill`, SIGHUP from a closing terminal, or an MCP client
+  // stopping the server — and would keep holding the HTTP and OAuth callback
+  // ports. In-process, signals reach the server's own handler directly.
+  require(serverPath);
 }
 
 // Run launcher

package/dist/index.js

@@ -747,6 +747,9 @@ if (process.env.MCP_SKIP_AUTO_START !== 'true') {
     };
     process.on('SIGINT', onSignal);
     process.on('SIGTERM', onSignal);
+    // A closing terminal should release the OAuth callback port and the HTTP
+    // listener the same way an explicit stop does.
+    process.on('SIGHUP', onSignal);
     server.run().catch((error) => {
         logger_js_1.logger?.error('Fatal error while running MCP proxy server', {
             type: 'SERVER_FATAL_ERROR',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/proxy",
-  "version": "1.6.1",
+  "version": "1.6.3",
   "description": "MCP proxy server for SAP ABAP ADT - proxies local requests to cloud-llm-hub with JWT authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -45,11 +45,10 @@
   "devDependencies": {
     "@biomejs/biome": "^2.4.12",
     "@jest/globals": "^30.2.0",
-    "@modelcontextprotocol/inspector": "^0.21.2",
+    "@modelcontextprotocol/inspector": "^0.22.0",
     "@types/jest": "^30.0.0",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.2.3",
-    "commander": "^14.0.3",
     "cors": "^2.8.6",
     "cross-env": "^10.1.0",
     "express": "^5.1.0",
@@ -63,7 +62,7 @@
     "typescript": "^6.0.3"
   },
   "dependencies": {
-    "@mcp-abap-adt/auth-broker": "^1.0.6",
+    "@mcp-abap-adt/auth-broker": "^1.0.7",
     "@mcp-abap-adt/auth-providers": "^1.1.0",
     "@mcp-abap-adt/auth-stores": "^1.0.4",
     "@mcp-abap-adt/header-validator": "^0.1.8",