abap-mcp 0.3.0 → 0.3.1

package/README.md

@@ -110,7 +110,7 @@ loop condition), per-repo `.mcp.json`, and a GitHub Actions quality gate for aba
 
 ```bash
 npm install
-npm run check     # typecheck + 115 tests + build — the CI gate
+npm run check     # typecheck + 121 tests + build — the CI gate
 node dist/cli.js  # stdio MCP server
 npx @modelcontextprotocol/inspector --cli node dist/cli.js --method tools/list
 ```

package/dist/abap/readiness.js

@@ -65,16 +65,24 @@ export function checkCloudReadiness(files, baselineVersion = "v758") {
  * Cross-check statically-extracted object references against the bundled SAP
  * Cloudification snapshot. Flags two cases:
  *   - `deprecated` — the referenced object is a deprecated released API.
- *   - `not-released` — direct access to a classic/internal table that is not a
- *     released API (the typical "SELECT … FROM mara" case), with a curated CDS
- *     successor hint when one is known.
+ *   - `not-released` — the reference is explicitly recorded as notToBeReleased
+ *     in SAP's list: direct access to a classic/internal table (the typical
+ *     "SELECT … FROM mara" case, with a curated CDS successor hint when one is
+ *     known) or a CALL FUNCTION to an internal-only function module.
  * Released objects and references the snapshot does not recognise are silent —
- * absence from the list is "not known to be a problem", not proof either way.
+ * absence from the list (every customer Z/Y-object, for a start) is "not known
+ * to be a problem", not proof either way.
  */
 function computeReleasedApiFindings(files, baselineVersion) {
     const out = [];
     for (const ref of extractObjectReferences(files, baselineVersion)) {
-        const hit = lookupReleased(ref.name, ref.objectType);
+        let hit = lookupReleased(ref.name, ref.objectType);
+        // An ABAP-SQL FROM clause names either a DDIC table or a CDS entity, but
+        // the extractor labels both TABL — fall back to the CDS record so a
+        // deprecated CDS view in a SELECT is still caught.
+        if (!hit.recorded && ref.objectType === "TABL") {
+            hit = lookupReleased(ref.name, "CDS_STOB");
+        }
         if (hit.state === "released")
             continue;
         if (hit.state === "deprecated") {
@@ -90,10 +98,24 @@ function computeReleasedApiFindings(files, baselineVersion) {
             });
             continue;
         }
-        // not-released. Only flag DB tables (direct table access is the cloud
-        // anti-pattern); a CALL FUNCTION to a module simply absent from the list is
-        // too noisy to report as a finding without a system to confirm against.
-        if (ref.objectType === "TABL") {
+        // not-released. Only flag names SAP's snapshot explicitly records as
+        // notToBeReleased — a name merely absent from the list (every customer
+        // Z/Y-object, for a start) is silent: absence is "not known to be a
+        // problem", not evidence of one.
+        if (!hit.recorded)
+            continue;
+        if (ref.objectType === "FUNC") {
+            out.push({
+                object: ref.name,
+                objectType: ref.objectType,
+                state: "not-released",
+                file: ref.file,
+                line: ref.line,
+                note: `Function module ${ref.name} is recorded as not-to-be-released in SAP's Cloudification list — it will not become a public API in ABAP Cloud; use a released successor API instead.`,
+            });
+            continue;
+        }
+        if (ref.objectType === "TABL" && hit.objectType === "TABL") {
             const successor = suggestSuccessor(ref.name);
             out.push({
                 object: ref.name,

package/dist/abap/released.d.ts

@@ -12,6 +12,13 @@ export interface ReleasedLookup {
     objectType: string | undefined;
     state: ReleasedState;
     applicationComponent?: string | undefined;
+    /**
+     * true when the name was found in SAP's snapshot (under the requested type,
+     * if one was given). false means absent — "not released as of the snapshot"
+     * by omission, which is weaker evidence than an explicit notToBeReleased
+     * record and must not be reported as a violation on its own.
+     */
+    recorded: boolean;
 }
 /**
  * Look up an object in the bundled released-API list. Case-insensitive.
@@ -21,10 +28,13 @@ export interface ReleasedLookup {
  * (typical for classic DDIC tables). A `released`/`deprecated` result is taken
  * verbatim from SAP's published data.
  *
- * When `objectType` is given it disambiguates the few hundred names that exist
- * under more than one object type; otherwise the first recorded entry is used,
- * preferring a `released` or `deprecated` record over a `notToBeReleased` one
- * so a genuinely released API is never masked by a same-named internal object.
+ * When `objectType` is given the lookup is strict: only a record of exactly
+ * that type answers the query — a same-named record under a different type is
+ * a miss (`recorded: false`), never a substitute (a released class must not
+ * make a non-released table look released). Untyped lookups use the first
+ * recorded entry, preferring a `released` or `deprecated` record over a
+ * `notToBeReleased` one so a genuinely released API is never masked by a
+ * same-named internal object.
  */
 export declare function lookupReleased(objectName: string, objectType?: string): ReleasedLookup;
 /**

package/dist/abap/released.js

@@ -44,35 +44,43 @@ function toState(rawState) {
  * (typical for classic DDIC tables). A `released`/`deprecated` result is taken
  * verbatim from SAP's published data.
  *
- * When `objectType` is given it disambiguates the few hundred names that exist
- * under more than one object type; otherwise the first recorded entry is used,
- * preferring a `released` or `deprecated` record over a `notToBeReleased` one
- * so a genuinely released API is never masked by a same-named internal object.
+ * When `objectType` is given the lookup is strict: only a record of exactly
+ * that type answers the query — a same-named record under a different type is
+ * a miss (`recorded: false`), never a substitute (a released class must not
+ * make a non-released table look released). Untyped lookups use the first
+ * recorded entry, preferring a `released` or `deprecated` record over a
+ * `notToBeReleased` one so a genuinely released API is never masked by a
+ * same-named internal object.
  */
 export function lookupReleased(objectName, objectType) {
     const key = objectName.trim().toUpperCase();
     const entries = data.objects[key];
+    const wantedType = objectType?.trim().toUpperCase();
     if (entries === undefined || entries.length === 0) {
-        return { name: objectName, objectType, state: "not-released" };
+        return { name: objectName, objectType: wantedType, state: "not-released", recorded: false };
     }
-    const wantedType = objectType?.trim().toUpperCase();
     let chosen;
     if (wantedType !== undefined) {
         chosen = entries.find((e) => e[0].toUpperCase() === wantedType);
+        if (chosen === undefined) {
+            // Typed query, no record of that type: a miss, not a cross-type answer.
+            return { name: objectName, objectType: wantedType, state: "not-released", recorded: false };
+        }
     }
-    if (chosen === undefined) {
+    else {
         // Prefer a released/deprecated record over notToBeReleased when ambiguous.
         chosen =
             entries.find((e) => e[1] === "released" || e[1] === "deprecated") ?? entries[0];
     }
     if (chosen === undefined) {
-        return { name: objectName, objectType, state: "not-released" };
+        return { name: objectName, objectType: wantedType, state: "not-released", recorded: false };
     }
     return {
         name: objectName,
         objectType: chosen[0],
         state: toState(chosen[1]),
         applicationComponent: chosen[2],
+        recorded: true,
     };
 }
 /**

package/dist/abap.tools.js

@@ -473,6 +473,9 @@ export const checkReleasedApiTool = defineTool({
             state: z
                 .enum(["released", "deprecated", "not-released"])
                 .describe("'released' = safe public API; 'deprecated' = retiring; 'not-released' = not a public API."),
+            recorded: z
+                .boolean()
+                .describe("true = explicitly present in SAP's snapshot (under the requested type, if one was given); false = absent — 'not released as of the snapshot' by omission only."),
             applicationComponent: z
                 .string()
                 .optional()
@@ -504,6 +507,7 @@ export const checkReleasedApiTool = defineTool({
                 name: hit.name,
                 objectType: hit.objectType,
                 state: hit.state,
+                recorded: hit.recorded,
                 applicationComponent: hit.applicationComponent,
                 ...(successor !== undefined ? { successor } : {}),
             };
@@ -511,7 +515,8 @@ export const checkReleasedApiTool = defineTool({
         const text = results
             .map((r) => {
             const tail = r.successor !== undefined ? ` → use ${r.successor}` : "";
-            return `${r.name}: ${r.state}${r.objectType !== undefined ? ` (${r.objectType})` : ""}${tail}`;
+            const provenance = r.recorded ? "" : " (not in snapshot)";
+            return `${r.name}: ${r.state}${r.objectType !== undefined ? ` (${r.objectType})` : ""}${provenance}${tail}`;
         })
             .join("\n");
         return {

package/dist/cli-commands.js

@@ -5,7 +5,7 @@
  * story); the *CLI* is a local developer tool, so reading files from disk here
  * is fine. Both call the identical engine — one definition of "clean".
  */
-import { readdirSync, readFileSync, statSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
+import { readdirSync, readFileSync, realpathSync, statSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
 import { basename, extname, join } from "node:path";
 import { ABAP_VERSIONS, MAX_FILES, runAbaplint } from "./abap/engine.js";
 import { outlineAbap } from "./abap/outline.js";
@@ -17,11 +17,18 @@ const ABAP_FILE_RE = /\.(clas\.abap|clas\.locals_imp\.abap|clas\.locals_def\.aba
 /** Recursively collect analyzable sources from file/dir paths. */
 export function collectFiles(paths, io) {
     const found = [];
+    const visitedDirs = new Set();
     const visit = (p) => {
         const st = statSync(p);
         if (st.isDirectory()) {
             if (basename(p) === ".git" || basename(p) === "node_modules")
                 return;
+            // statSync follows symlinks — track real paths so a symlink cycle
+            // can't recurse forever.
+            const real = realpathSync(p);
+            if (visitedDirs.has(real))
+                return;
+            visitedDirs.add(real);
             for (const entry of readdirSync(p))
                 visit(join(p, entry));
             return;
@@ -214,7 +221,13 @@ export function cmdScaffold(argv, io) {
             writeFileSync(target, f.content, "utf8");
             io.out(`wrote ${target}  [${f.validated}]`);
         }
-        writeFileSync(join(outDir, `${sqlTable.toLowerCase()}.tabl.suggestion.txt`), result.suggestedTableDdl, "utf8");
+        const suggestionTarget = join(outDir, `${sqlTable.toLowerCase()}.tabl.suggestion.txt`);
+        if (existsSync(suggestionTarget) && !flags.has("force")) {
+            io.err(`refusing to overwrite ${suggestionTarget} (use --force)`);
+            return 1;
+        }
+        writeFileSync(suggestionTarget, result.suggestedTableDdl, "utf8");
+        io.out(`wrote ${suggestionTarget}`);
     }
     else {
         for (const f of result.files) {
@@ -288,7 +301,8 @@ export function cmdReleased(argv, io) {
     io.out(`Released-API status (SAP Cloudification snapshot ${RELEASED_API_SNAPSHOT.snapshotDate}):`);
     for (const r of results) {
         const tail = r.successor !== undefined ? `  → use ${r.successor}` : "";
-        io.out(`  ${r.name.padEnd(34)} ${r.state.padEnd(13)} ${(r.objectType ?? "").padEnd(9)}${tail}`);
+        const provenance = r.recorded ? "" : " (not in snapshot)";
+        io.out(`  ${r.name.padEnd(34)} ${r.state.padEnd(13)} ${(r.objectType ?? "").padEnd(9)}${provenance}${tail}`);
     }
     return 0;
 }

package/dist/errors.js

@@ -21,9 +21,15 @@ export function errorResult(err) {
     const e = err instanceof McpToolError
         ? err
         : new McpToolError("internal", err instanceof Error ? err.message : String(err));
+    // IMPORTANT: do NOT attach `structuredContent` here. Every tool declares an `outputSchema`
+    // describing its *success* shape, and the MCP SDK validates `structuredContent` against that
+    // schema even when `isError: true`. An error payload ({ error: … }) cannot satisfy a success
+    // schema, so strict clients (OpenClaw, the MCP inspector, the VSCode/ADT integrations) reject
+    // the whole result with `-32602` and the model never sees the real, actionable message —
+    // it just gives up and answers from memory. The spec permits an absent `structuredContent`
+    // on error results, so the human-readable `code: message` text carries the error instead.
     return {
         isError: true,
         content: [{ type: "text", text: `${e.code}: ${e.message}` }],
-        structuredContent: { error: { code: e.code, message: e.message, details: e.details ?? null } },
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "abap-mcp",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "MCP server for SAP ABAP: offline static analysis (abaplint), ABAP Cloud / Clean Core readiness checks, and RAP scaffolding — no SAP system or credentials required.",
   "license": "MIT",
   "author": "Akshay Palimkar",