arc-1 1.0.2 → 1.1.0

package/dist/adt/abapgit.js

@@ -3,7 +3,9 @@
  *
  * Bridge endpoints live under /sap/bc/adt/abapgit/* and use XML payloads.
  */
+import { isIP } from 'node:net';
 import { AdtApiError, AdtSafetyError, classifyAbapgitError } from './errors.js';
+import { assertCanonicalHostRelativeAdtPath } from './path-safety.js';
 import { checkGit, checkOperation, checkPackage, OperationType } from './safety.js';
 import { escapeXmlAttr, findDeepNodes, parseXml } from './xml-parser.js';
 const ABAPGIT_BASE = '/sap/bc/adt/abapgit';
@@ -21,6 +23,163 @@ const REPO_OBJECT_ACCEPT = `${REPO_OBJECT_V2}, ${REPO_OBJECT_V1}`;
 const NS_REPO = 'http://www.sap.com/adt/abapgit/repositories';
 const NS_STAGING = 'http://www.sap.com/adt/abapgit/staging';
 const NS_ADTCORE = 'http://www.sap.com/adt/core';
+const ABAPGIT_REDACTION_MAX_STRING_LENGTH = 4_096;
+const ABAPGIT_REDACTION_STRING_PREFIX_LENGTH = 2_000;
+const GIT_SECRET_QUERY_FRAGMENTS = [
+    'password',
+    'passwd',
+    'passphrase',
+    'pwd',
+    'token',
+    'secret',
+    'apikey',
+    'api_key',
+    'auth',
+    'credential',
+    'accesskey',
+    'access_key',
+    'privatekey',
+    'private_key',
+    'sshkey',
+    'ssh_key',
+    'signature',
+    'cookie',
+    'session',
+    'sessionid',
+    'jsessionid',
+    'sapsessionid',
+];
+function isCredentialQueryKey(key) {
+    const normalized = key.toLowerCase();
+    return GIT_SECRET_QUERY_FRAGMENTS.some((fragment) => normalized.includes(fragment));
+}
+function redactCredentialAssignments(value) {
+    return value
+        .replace(/\bauthorization\s*([:=])\s*(?:bearer|basic)\s+(?:\\{1,64}"[^"]*\\{1,64}"|\\{1,64}'[^']*\\{1,64}'|"[^"]*"|'[^']*'|[^\s,;&<>"']+)/gi, 'authorization$1[REDACTED]')
+        .replace(/\b(bearer|basic)\s+(?:\\{1,64}"[^"]*\\{1,64}"|\\{1,64}'[^']*\\{1,64}'|"[^"]*"|'[^']*'|[^\s,;&<>"']+)/gi, '$1 [REDACTED]')
+        .replace(/\b(password|passwd|passphrase|pwd|token|secret|api[_-]?key|authorization|credential|access[_-]?key|private[_-]?key|ssh[_-]?key|signature|cookie|jsessionid|sap[_-]?sessionid|sessionid|session|(?:client[_-]?vcs[_-]?)?auth[_-]?(?:pwd|user|token)|remote[_-]?(?:password|user|token))(?:(?:\\{1,64})?["'])?\s*([:=])\s*(?:(?:bearer|basic)\s+)?(?:\\{1,64}"[^"]*\\{1,64}"|\\{1,64}'[^']*\\{1,64}'|"[^"]*"|'[^']*'|[^\s,;&<>"']+)/gi, '$1$2[REDACTED]');
+}
+function normalizeEscapedUrlSlashes(value) {
+    return value.replace(/\\{1,8}\//g, '/').replace(/\\{1,8}u([0-9a-f]{4})/gi, (encoded, hex) => {
+        const decoded = String.fromCharCode(Number.parseInt(hex, 16));
+        return /^[a-z0-9_.-]$/i.test(decoded) ? decoded : encoded;
+    });
+}
+function boundAbapGitString(value, originalLength = value.length) {
+    if (value.length <= ABAPGIT_REDACTION_MAX_STRING_LENGTH && originalLength <= ABAPGIT_REDACTION_MAX_STRING_LENGTH) {
+        return value;
+    }
+    return `${value.slice(0, ABAPGIT_REDACTION_STRING_PREFIX_LENGTH)}... [truncated ${originalLength} chars]`;
+}
+function abapGitStringInput(value) {
+    return value.length <= ABAPGIT_REDACTION_MAX_STRING_LENGTH
+        ? value
+        : value.slice(0, ABAPGIT_REDACTION_MAX_STRING_LENGTH);
+}
+function redactUrlAssignments(value) {
+    return redactCredentialAssignments(value).replace(/(^|[&;])([^=&;]+)(?:=([^&;]*))?/g, (part, separator, rawKey) => {
+        let decodedKey = rawKey;
+        try {
+            decodedKey = decodeURIComponent(rawKey.replace(/\+/g, ' '));
+        }
+        catch {
+            // Keep the raw key for the sensitivity check.
+        }
+        return isCredentialQueryKey(decodedKey) ? `${separator}[REDACTED]=[REDACTED]` : part;
+    });
+}
+export function redactGitUrl(value) {
+    const normalizedValue = normalizeEscapedUrlSlashes(abapGitStringInput(value));
+    try {
+        const parsed = new URL(normalizedValue);
+        parsed.username = '';
+        parsed.password = '';
+        parsed.pathname = redactCredentialAssignments(parsed.pathname);
+        if (parsed.search)
+            parsed.search = `?${redactUrlAssignments(parsed.search.slice(1))}`;
+        if (parsed.hash)
+            parsed.hash = `#${redactUrlAssignments(parsed.hash.slice(1))}`;
+        return parsed.toString();
+    }
+    catch {
+        return '[INVALID URL]';
+    }
+}
+function redactGitText(value) {
+    const withoutXmlCredentials = redactCredentialAssignments(normalizeEscapedUrlSlashes(abapGitStringInput(value)))
+        .replace(/(<(?:[\w.-]+:)?remotePassword\b[^>]*>)[\s\S]*?(<\/(?:[\w.-]+:)?remotePassword>)/gi, '$1[REDACTED]$2')
+        .replace(/(<(?:[\w.-]+:)?remoteUser\b[^>]*>)[\s\S]*?(<\/(?:[\w.-]+:)?remoteUser>)/gi, '$1[REDACTED]$2');
+    const redacted = withoutXmlCredentials.replace(/https?:\/\/[^\s<>"']+/gi, (candidate) => {
+        const trailing = candidate.match(/[),.;]+$/)?.[0] ?? '';
+        const core = trailing ? candidate.slice(0, -trailing.length) : candidate;
+        return `${redactGitUrl(core)}${trailing}`;
+    });
+    return boundAbapGitString(redacted, value.length);
+}
+function sanitizedAbapGitApiError(err, path) {
+    const parsed = classifyAbapgitError(err.responseBody ?? '');
+    const detail = [parsed.namespace ? `[${parsed.namespace}]` : undefined, parsed.message].filter(Boolean).join(' ');
+    return new AdtApiError(redactGitText(detail || err.message), err.statusCode, redactGitText(err.path || path), redactGitText(err.responseBody ?? ''));
+}
+function literalHostIsPrivate(hostname) {
+    const host = hostname
+        .replace(/^\[|\]$/g, '')
+        .replace(/\.+$/, '')
+        .toLowerCase();
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return true;
+    const ipVersion = isIP(host);
+    if (ipVersion === 4) {
+        const octets = host.split('.').map(Number);
+        const [a = 0, b = 0] = octets;
+        return (a === 0 ||
+            a === 10 ||
+            a === 127 ||
+            (a === 100 && b >= 64 && b <= 127) ||
+            (a === 169 && b === 254) ||
+            (a === 172 && b >= 16 && b <= 31) ||
+            (a === 192 && b === 168));
+    }
+    if (ipVersion === 6) {
+        if (host === '::' || host === '::1')
+            return true;
+        if (/^f[cd]/.test(host) || /^fe[89ab]/.test(host))
+            return true;
+        const mappedV4 = host.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/)?.[1];
+        if (mappedV4)
+            return literalHostIsPrivate(mappedV4);
+        // WHATWG URL canonicalizes dotted IPv4-mapped literals to two hexadecimal
+        // hextets (for example ::ffff:127.0.0.1 -> ::ffff:7f00:1).
+        const mappedHex = host.match(/^::ffff:([\da-f]{1,4}):([\da-f]{1,4})$/);
+        if (mappedHex) {
+            const high = Number.parseInt(mappedHex[1] ?? '0', 16);
+            const low = Number.parseInt(mappedHex[2] ?? '0', 16);
+            return literalHostIsPrivate(`${high >>> 8}.${high & 0xff}.${low >>> 8}.${low & 0xff}`);
+        }
+        return false;
+    }
+    return false;
+}
+/** Validate caller-controlled Git URLs before SAP is allowed to contact them. */
+export function validateGitRemoteUrl(value, options = {}) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new AdtSafetyError('Git remote URL is invalid. Use an absolute HTTPS URL.');
+    }
+    if (parsed.protocol !== 'https:') {
+        throw new AdtSafetyError('Git remote URL is blocked: only HTTPS URLs are allowed.');
+    }
+    if (parsed.username || parsed.password) {
+        throw new AdtSafetyError('Git remote URL is blocked: URL userinfo is not allowed; use explicit credential fields.');
+    }
+    if (options.rejectPrivateLiteral && literalHostIsPrivate(parsed.hostname)) {
+        throw new AdtSafetyError('Git remote URL is blocked: localhost and literal private/link-local addresses are not allowed.');
+    }
+    return parsed;
+}
 function boolish(value) {
     if (value === true || value === false)
         return value;
@@ -63,13 +222,32 @@ function authHeaders(user, password) {
     };
 }
 /** Direct children of `node` under `key`, normalised to an array (fast-xml-parser collapses singletons). */
-function childNodes(node, key) {
+function childNodes(node, key, allowEmptyElement = false) {
     const val = node?.[key];
-    if (Array.isArray(val))
-        return val;
-    if (val && typeof val === 'object')
+    const isNode = (entry) => typeof entry === 'object' && entry !== null && !Array.isArray(entry);
+    if (Array.isArray(val)) {
+        if (val.every(isNode))
+            return val;
+        throw new Error(`abapGit bridge returned an invalid <${key}> element shape.`);
+    }
+    if (isNode(val))
         return [val];
-    return [];
+    if (val === undefined)
+        return [];
+    if (allowEmptyElement && typeof val === 'string' && val.trim() === '')
+        return [];
+    throw new Error(`abapGit bridge returned an invalid <${key}> element shape.`);
+}
+function singleChildNode(node, key, allowEmptyElement = false) {
+    const nodes = childNodes(node, key, allowEmptyElement);
+    if (nodes.length > 1)
+        throw new Error(`abapGit bridge returned duplicate <${key}> elements.`);
+    return nodes[0];
+}
+function assertKnownChildren(node, operation, allowed) {
+    const unknown = Object.keys(node).some((key) => !key.startsWith('@_') && !allowed.includes(key));
+    if (unknown)
+        throw new Error(`abapGit bridge returned unexpected child elements in ${operation}.`);
 }
 function attr(name, value) {
     return value ? ` ${name}="${escapeXmlAttr(value)}"` : '';
@@ -102,11 +280,11 @@ function findRepoLink(repo, type) {
         return href.endsWith(`/${relNeedle}`) || href.includes(`/${relNeedle}/`);
     });
     if (!link) {
-        throw new Error(`abapGit repository ${repo.key} does not expose a ${type} HATEOAS link.`);
+        throw new Error(redactGitText(`abapGit repository ${repo.key} does not expose a ${type} HATEOAS link.`));
     }
     return {
         ...link,
-        href: absolutizeLink(link.href),
+        href: assertCanonicalHostRelativeAdtPath(absolutizeLink(link.href), `${ABAPGIT_BASE}/`),
     };
 }
 function parseAbapGitLinks(node) {
@@ -120,17 +298,36 @@ function parseAbapGitLinks(node) {
     }))
         .filter((link) => Boolean(link.rel) && Boolean(link.href));
 }
+function parseAbapGitXml(xml, operation) {
+    try {
+        return parseXml(xml);
+    }
+    catch {
+        // fast-xml-parser includes response prefixes in some syntax errors. SAP may echo remote
+        // credentials in that response, so expose only a fixed diagnostic across MCP/CLI boundaries.
+        throw new Error(`abapGit bridge returned invalid XML for ${operation}. Check the installed ADT backend version.`);
+    }
+}
 export function parseAbapGitRepos(xml) {
-    const parsed = parseXml(xml);
-    const repositories = findDeepNodes(parsed, 'repository');
-    return repositories
-        .map((repo) => {
+    const parsed = parseAbapGitXml(xml, 'repository-list');
+    const root = rootNode(parsed, 'repositories');
+    if (!root)
+        throw unexpectedShape('repository-list', 'repositories');
+    assertKnownChildren(root, 'repository-list', ['repository']);
+    const repositories = childNodes(root, 'repository');
+    return repositories.map((repo) => {
         const links = parseAbapGitLinks(repo);
         const writeProtected = boolish(field(repo, 'writeProtected', 'write_protected'));
+        const key = field(repo, 'key', 'repoKey', 'id') ?? '';
+        const packageName = field(repo, 'package', 'packageName') ?? '';
+        const url = field(repo, 'url') ?? '';
+        if (!key || !packageName || !url) {
+            throw new Error('abapGit bridge returned an incomplete <repository> row; key, package, and url are required.');
+        }
         return {
-            key: field(repo, 'key', 'repoKey', 'id') ?? '',
-            package: field(repo, 'package', 'packageName') ?? '',
-            url: field(repo, 'url') ?? '',
+            key,
+            package: packageName,
+            url,
             branchName: field(repo, 'branchName', 'branch_name', 'branch') ?? '',
             selectedBranch: field(repo, 'selectedBranch', 'selected_branch'),
             deserializedBy: field(repo, 'deserializedBy', 'deserialized_by'),
@@ -140,32 +337,51 @@ export function parseAbapGitRepos(xml) {
             dotAbapGit: field(repo, 'dotAbapGit', 'dot_abapgit'),
             links,
         };
-    })
-        .filter((repo) => repo.key && repo.package && repo.url);
+    });
 }
 export function parseAbapGitExternalInfo(xml) {
-    const parsed = parseXml(xml);
-    const infoNode = findDeepNodes(parsed, 'externalRepoInfo')[0] ?? parsed;
-    const branches = findDeepNodes(infoNode, 'branch').map((branch) => {
+    const parsed = parseAbapGitXml(xml, 'external-info');
+    const infoNode = rootNode(parsed, 'externalRepoInfo');
+    if (!infoNode)
+        throw unexpectedShape('external-info', 'externalRepoInfo');
+    assertKnownChildren(infoNode, 'external-info', [
+        'accessMode',
+        'access_mode',
+        'defaultBranch',
+        'default_branch',
+        'selectedBranch',
+        'selected_branch',
+        'branch',
+        'user',
+    ]);
+    const branches = childNodes(infoNode, 'branch').map((branch) => {
         const name = field(branch, 'name', 'branchName', 'displayName') ?? '';
+        if (!name)
+            throw new Error('abapGit bridge returned an incomplete external branch row.');
         return {
             name,
             isHead: boolish(field(branch, 'head', 'isHead')),
             sha1: field(branch, 'sha1', 'hash'),
         };
     });
-    const userNode = findDeepNodes(infoNode, 'user')[0];
+    const userNode = singleChildNode(infoNode, 'user');
     const user = userNode
         ? {
             name: field(userNode, 'name', 'user'),
             email: field(userNode, 'email', 'mail'),
         }
         : undefined;
+    const accessMode = field(infoNode, 'accessMode', 'access_mode');
+    const defaultBranch = field(infoNode, 'defaultBranch', 'default_branch');
+    const selectedBranch = field(infoNode, 'selectedBranch', 'selected_branch');
+    if (!accessMode && !defaultBranch && !selectedBranch && branches.length === 0) {
+        throw new Error('abapGit bridge returned an incomplete <externalRepoInfo> response.');
+    }
     return {
-        accessMode: field(infoNode, 'accessMode', 'access_mode'),
-        defaultBranch: field(infoNode, 'defaultBranch', 'default_branch'),
-        selectedBranch: field(infoNode, 'selectedBranch', 'selected_branch'),
-        branches: branches.filter((branch) => branch.name),
+        accessMode,
+        defaultBranch,
+        selectedBranch,
+        branches,
         ...(user ? { user } : {}),
     };
 }
@@ -178,14 +394,18 @@ function rootNode(parsed, ...keys) {
         if (!(key in parsed))
             continue;
         const value = parsed[key];
-        return value && typeof value === 'object' ? value : {};
+        if (value && typeof value === 'object' && !Array.isArray(value))
+            return value;
+        if (typeof value === 'string' && value.trim() === '')
+            return {};
+        return undefined;
     }
     return undefined;
 }
 /** An unrecognised 200 body must fail loudly — a silent empty parse is what hid the old wire bugs. */
-function unexpectedShape(what, expected, xml) {
+function unexpectedShape(what, expected) {
     return new Error(`abapGit bridge returned an unexpected ${what} response: no <${expected}> root. ` +
-        `Check the installed abapGit ADT backend version. First 200 chars: ${xml.trim().slice(0, 200)}`);
+        'Check the installed abapGit ADT backend version.');
 }
 /**
  * Parse a clone/pull response (ZABAPGIT_ST_REPO_POST_RES): `abapObjects:abapObjects` → `abapObject`,
@@ -193,32 +413,64 @@ function unexpectedShape(what, expected, xml) {
  * the bridge deserialized into the package, with abapGit's own status message.
  */
 export function parseAbapGitObjects(xml) {
-    const parsed = parseXml(xml);
+    const parsed = parseAbapGitXml(xml, 'clone/pull');
     const root = rootNode(parsed, 'abapObjects', 'objects');
     if (!root)
-        throw unexpectedShape('clone/pull', 'abapObjects', xml);
-    return [...childNodes(root, 'abapObject'), ...childNodes(root, 'object')].map((node) => ({
-        type: field(node, 'type', 'obj_type'),
-        name: field(node, 'name', 'obj_name'),
-        package: field(node, 'package'),
-        status: field(node, 'status', 'obj_status'),
-        msgType: field(node, 'msgType', 'msg_type'),
-        msgText: field(node, 'msgText', 'msg_text'),
-    }));
+        throw unexpectedShape('clone/pull', 'abapObjects');
+    assertKnownChildren(root, 'clone/pull', ['abapObject', 'object']);
+    return [...childNodes(root, 'abapObject'), ...childNodes(root, 'object')].map((node) => {
+        const type = field(node, 'type', 'obj_type');
+        const name = field(node, 'name', 'obj_name');
+        if (!type || !name) {
+            throw new Error('abapGit bridge returned an incomplete object row; type and name are required.');
+        }
+        return {
+            type,
+            name,
+            package: field(node, 'package'),
+            status: field(node, 'status', 'obj_status'),
+            msgType: field(node, 'msgType', 'msg_type'),
+            msgText: field(node, 'msgText', 'msg_text'),
+        };
+    });
+}
+function assertSuccessfulObjectMessages(objects, path, responseBody) {
+    const rejected = objects.filter((object) => /^[EAX]$/i.test(String(object.msgType ?? '').trim()));
+    if (rejected.length === 0)
+        return;
+    const details = rejected
+        .slice(0, 5)
+        .map((object) => {
+        const identity = [object.type, object.name].filter(Boolean).join(' ');
+        return `${object.msgType}${identity ? ` ${identity}` : ''}${object.msgText ? `: ${object.msgText}` : ''}`;
+    })
+        .join('; ');
+    throw new AdtApiError(redactGitText(`abapGit reported rejecting object messages: ${details}`), 500, path, redactGitText(responseBody));
 }
 function parseStagingObjects(root, wrapper) {
-    return childNodes(childNodes(root, wrapper)[0], 'abapgitobject').map((node) => ({
-        name: field(node, 'name'),
-        type: field(node, 'type'),
-        uri: field(node, 'uri'),
-        wbkey: field(node, 'wbkey'),
-        files: childNodes(node, 'abapgitfile').map((file) => ({
-            name: field(file, 'name') ?? '',
-            path: field(file, 'path'),
-            localState: field(file, 'localState'),
-            remoteState: field(file, 'remoteState'),
-        })),
-    }));
+    const wrapperNode = singleChildNode(root, wrapper, true);
+    if (wrapperNode)
+        assertKnownChildren(wrapperNode, `<${wrapper}>`, ['abapgitobject']);
+    return childNodes(wrapperNode, 'abapgitobject').map((node) => {
+        const name = field(node, 'name');
+        const type = field(node, 'type');
+        if (!name || (wrapper !== 'ignored_objects' && !type)) {
+            throw new Error('abapGit bridge returned an incomplete staging object row.');
+        }
+        const files = childNodes(node, 'abapgitfile').map((file) => {
+            const fileName = field(file, 'name');
+            const path = field(file, 'path');
+            if (!fileName || !path)
+                throw new Error('abapGit bridge returned an incomplete staging file row.');
+            return {
+                name: fileName,
+                path,
+                localState: field(file, 'localState'),
+                remoteState: field(file, 'remoteState'),
+            };
+        });
+        return { name, type, uri: field(node, 'uri'), wbkey: field(node, 'wbkey'), files };
+    });
 }
 /**
  * Parse a staging response (`abapgitstaging:abapgitstaging`, ZABAPGIT_ST_REPO_STAGE).
@@ -228,13 +480,14 @@ function parseStagingObjects(root, wrapper) {
  * user, so a push can round-trip them instead of asking the caller for an identity.
  */
 export function parseAbapGitStaging(xml) {
-    const parsed = parseXml(xml);
+    const parsed = parseAbapGitXml(xml, 'staging');
     const root = rootNode(parsed, 'abapgitstaging');
     if (!root)
-        throw unexpectedShape('staging', 'abapgitstaging', xml);
-    const commentNode = childNodes(root, 'abapgit_comment')[0];
+        throw unexpectedShape('staging', 'abapgitstaging');
+    assertKnownChildren(root, 'staging', ['unstaged_objects', 'staged_objects', 'ignored_objects', 'abapgit_comment']);
+    const commentNode = singleChildNode(root, 'abapgit_comment', true);
     const user = (key) => {
-        const node = childNodes(commentNode, key)[0];
+        const node = singleChildNode(commentNode, key);
         if (!node)
             return undefined;
         return { name: field(node, 'name'), email: field(node, 'email') };
@@ -253,13 +506,7 @@ async function requestAbapGit(path, run) {
     }
     catch (err) {
         if (err instanceof AdtApiError) {
-            const parsed = classifyAbapgitError(err.responseBody ?? '');
-            if (parsed.message || parsed.namespace) {
-                const detail = [parsed.namespace ? `[${parsed.namespace}]` : undefined, parsed.message]
-                    .filter(Boolean)
-                    .join(' ');
-                throw new AdtApiError(detail, err.statusCode, err.path || path, err.responseBody);
-            }
+            throw sanitizedAbapGitApiError(err, path);
         }
         throw err;
     }
@@ -324,7 +571,9 @@ export async function listRepos(http, safety) {
     return parseAbapGitRepos(resp.body);
 }
 export async function getExternalInfo(http, safety, url, user, password) {
-    checkOperation(safety, OperationType.Read, 'AbapGitExternalInfo');
+    checkOperation(safety, OperationType.Update, 'AbapGitExternalInfo');
+    checkGit(safety, 'external_info');
+    validateGitRemoteUrl(url, { rejectPrivateLiteral: true });
     const path = `${ABAPGIT_BASE}/externalrepoinfo`;
     const body = buildExternalInfoRequestXml(url, user, password);
     const resp = await requestAbapGit(path, () => http.post(path, body, EXTERNAL_INFO_REQUEST_V2, {
@@ -336,14 +585,17 @@ export async function getExternalInfo(http, safety, url, user, password) {
 export async function createRepo(http, safety, params, resolver) {
     checkOperation(safety, OperationType.Create, 'AbapGitCreateRepo');
     checkGit(safety, 'clone');
-    await checkPackage(safety, params.package, resolver);
+    validateGitRemoteUrl(params.url);
+    await enforceRepoPackageAllowed(safety, params.package, resolver, 'AbapGitCreateRepo');
     const path = `${ABAPGIT_BASE}/repos`;
     const body = buildRepoPayloadXml(params);
     const resp = await requestAbapGit(path, () => http.post(path, body, REPO_V3, {
         Accept: REPO_OBJECT_ACCEPT,
         ...authHeaders(params.user, params.password),
     }));
-    return parseAbapGitObjects(resp.body);
+    const objects = parseAbapGitObjects(resp.body);
+    assertSuccessfulObjectMessages(objects, path, resp.body);
+    return objects;
 }
 /**
  * Enforce the package allowlist against a repository's server-bound package (R9).
@@ -360,11 +612,22 @@ export async function enforceRepoPackageAllowed(safety, repoPackage, resolver, l
     if (!repoPackage) {
         throw new AdtSafetyError(`${label}: cannot resolve the repository's package to check it against allowedPackages (${JSON.stringify(safety.allowedPackages)}); refusing.`);
     }
-    await checkPackage(safety, repoPackage, resolver);
+    const subtreeGrants = safety.allowedPackages.filter((entry) => {
+        const normalized = entry.trim().toUpperCase();
+        return normalized === '*' || normalized.endsWith('/**');
+    });
+    if (subtreeGrants.length === 0) {
+        throw new AdtSafetyError(`${label}: abapGit may create or update subpackages below '${repoPackage}'. ` +
+            `Require a subtree grant that contains '${repoPackage}' or global '*' (configured: ${JSON.stringify(safety.allowedPackages)}); exact-package and prefix-wildcard grants are insufficient.`);
+    }
+    await checkPackage({ ...safety, allowedPackages: subtreeGrants }, repoPackage, resolver);
 }
-export async function pullRepo(http, safety, repoId, params = {}) {
+export async function pullRepo(http, safety, repoId, params = {}, resolver, repoPackage) {
     checkOperation(safety, OperationType.Update, 'AbapGitPullRepo');
     checkGit(safety, 'pull');
+    await enforceRepoPackageAllowed(safety, repoPackage, resolver, 'AbapGitPullRepo');
+    if (params.url)
+        validateGitRemoteUrl(params.url);
     const path = `${ABAPGIT_BASE}/repos/${encodeURIComponent(repoId)}/pull`;
     const body = buildRepoPayloadXml({
         package: params.package ?? '$TMP',
@@ -378,13 +641,19 @@ export async function pullRepo(http, safety, repoId, params = {}) {
         Accept: REPO_OBJECT_ACCEPT,
         ...authHeaders(params.user, params.password),
     }));
-    return parseAbapGitObjects(resp.body);
+    const objects = parseAbapGitObjects(resp.body);
+    assertSuccessfulObjectMessages(objects, path, resp.body);
+    return objects;
 }
-export async function unlinkRepo(http, safety, repoId) {
+export async function unlinkRepo(http, safety, repoId, resolver, repoPackage) {
     checkOperation(safety, OperationType.Delete, 'AbapGitUnlinkRepo');
     checkGit(safety, 'unlink');
+    await enforceRepoPackageAllowed(safety, repoPackage, resolver, 'AbapGitUnlinkRepo');
     const path = `${ABAPGIT_BASE}/repos/${encodeURIComponent(repoId)}`;
-    await requestAbapGit(path, () => http.delete(path, { Accept: REPO_V3 }));
+    const response = await requestAbapGit(path, () => http.delete(path, { Accept: REPO_V3 }));
+    if (response.body.trim() !== '') {
+        throw new Error('abapGit bridge returned an unexpected non-empty unlink response; repository removal was not accepted as verified.');
+    }
 }
 export async function stageRepo(http, safety, repo, user, password) {
     checkOperation(safety, OperationType.Update, 'AbapGitStageRepo');
@@ -401,15 +670,19 @@ export async function stageRepo(http, safety, repo, user, password) {
         ...parseAbapGitStaging(resp.body),
     };
 }
-export async function pushRepo(http, safety, repo, staging, user, password) {
+export async function pushRepo(http, safety, repo, staging, user, password, resolver) {
     checkOperation(safety, OperationType.Update, 'AbapGitPushRepo');
     checkGit(safety, 'push');
+    await enforceRepoPackageAllowed(safety, repo.package, resolver, 'AbapGitPushRepo');
     const link = findRepoLink(repo, 'push_link');
     const body = buildStagingPayloadXml(staging);
-    await requestAbapGit(link.href, () => http.post(link.href, body, REPO_STAGE_V1, {
+    const response = await requestAbapGit(link.href, () => http.post(link.href, body, REPO_STAGE_V1, {
         Accept: REPO_STAGE_V1,
         ...authHeaders(user, password),
     }));
+    if (response.body.trim() !== '') {
+        throw new Error('abapGit bridge returned an unexpected non-empty push response; remote completion was not accepted as verified.');
+    }
 }
 export async function checkRepo(http, safety, repo, user, password) {
     checkOperation(safety, OperationType.Read, 'AbapGitCheckRepo');
@@ -428,8 +701,12 @@ export async function checkRepo(http, safety, repo, user, password) {
         if (err instanceof AdtApiError) {
             const parsed = classifyAbapgitError(err.responseBody ?? '');
             if (parsed.namespace === 'org.abapgit.adt') {
-                return { ok: false, message: parsed.message ?? AdtApiError.extractCleanMessage(err.responseBody ?? '') };
+                return {
+                    ok: false,
+                    message: redactGitText(parsed.message ?? AdtApiError.extractCleanMessage(err.responseBody ?? '')),
+                };
             }
+            throw sanitizedAbapGitApiError(err, link.href);
         }
         throw err;
     }
@@ -439,17 +716,21 @@ export async function checkRepo(http, safety, repo, user, password) {
     const parsed = classifyAbapgitError(resp.body);
     return {
         ok: false,
-        message: parsed.message ?? AdtApiError.extractCleanMessage(resp.body),
+        message: redactGitText(parsed.message ?? AdtApiError.extractCleanMessage(resp.body)),
     };
 }
-export async function switchBranch(http, safety, repoId, branch, create = false, user, password) {
+export async function switchBranch(http, safety, repoId, branch, create = false, user, password, resolver, repoPackage) {
     checkOperation(safety, OperationType.Update, 'AbapGitSwitchBranch');
     checkGit(safety, create ? 'create_branch' : 'switch_branch');
+    await enforceRepoPackageAllowed(safety, repoPackage, resolver, 'AbapGitSwitchBranch');
     const path = `${ABAPGIT_BASE}/repos/${encodeURIComponent(repoId)}/branches/${encodeURIComponent(branch)}?create=${create ? 'true' : 'false'}`;
     // Switching fetches from the remote, so a private repo needs the bridge credentials here too.
-    await requestAbapGit(path, () => http.post(path, '', undefined, { Accept: REPO_V3, ...authHeaders(user, password) }));
+    const response = await requestAbapGit(path, () => http.post(path, '', undefined, { Accept: REPO_V3, ...authHeaders(user, password) }));
+    if (response.body.trim() !== '') {
+        throw new Error(`abapGit bridge returned an unexpected non-empty ${create ? 'create-branch' : 'switch-branch'} response; branch completion was not accepted as verified.`);
+    }
 }
-export async function createBranch(http, safety, repoId, branch, user, password) {
-    await switchBranch(http, safety, repoId, branch, true, user, password);
+export async function createBranch(http, safety, repoId, branch, user, password, resolver, repoPackage) {
+    await switchBranch(http, safety, repoId, branch, true, user, password, resolver, repoPackage);
 }
 //# sourceMappingURL=abapgit.js.map