arc-1 1.0.2 → 1.1.1

package/README.md

@@ -29,7 +29,7 @@ Built for organizations that need AI-assisted SAP development with guardrails. I
 - **HTTP security headers (helmet) on by default** — HSTS, CSP, X-Frame-Options, CORP, X-Content-Type-Options. COOP is deliberately not set so popup-based OAuth flows (Copilot Studio) keep working. No flag to disable.
 - **Opt-in CORS for browser MCP clients** — `ARC1_ALLOWED_ORIGINS` (comma-separated, exact match). Off by default; native MCP clients don't need it
 - **Layered rate limiting** — three layers out of the box: per-IP OAuth and shared MCP HTTP edge limits (Layer 1; MCP inherits the historical derived cap unless `ARC1_MCP_HTTP_RATE_LIMIT` overrides it), per-user MCP quota (Layer 2, **off by default** — multi-user deployments opt in via `ARC1_RATE_LIMIT=60`), and a server-wide SAP-bound semaphore (Layer 3, default 10, **on**). Honors `Retry-After` on 429/503 from SAP / BTP gateways. See the [Rate Limiting Guide](https://docs.arc-1-mcp.com/rate-limiting/)
-- **Supply-chain security** — Dependabot (npm + GitHub Actions + Docker, weekly + same-day security advisories), `npm audit --audit-level=high` PR gate, GitHub Dependency Review on every PR, CodeQL SAST, Trivy container scanning (gating on release, advisory on dev), all third-party GitHub Actions pinned to commit SHA, [`SECURITY.md`](SECURITY.md) policy with severity-tiered SLAs. Image and npm package both ship with [provenance attestations](https://docs.npmjs.com/generating-provenance-statements), and the release workflow publishes a best-effort CycloneDX SBOM for the production npm dependency graph. See the [security guide §13](https://docs.arc-1-mcp.com/security-guide/#13-dependency--supply-chain-security)
+- **Supply-chain security** — Dependabot (npm + GitHub Actions + Docker, weekly + same-day security advisories), `npm audit --audit-level=high` PR gate, GitHub Dependency Review on every PR, CodeQL SAST, Trivy container scanning (scheduled multi-architecture HIGH/CRITICAL gate plus advisory release/dev scans), all third-party GitHub Actions pinned to commit SHA, [`SECURITY.md`](SECURITY.md) policy with severity-tiered SLAs. Image and npm package both ship with [provenance attestations](https://docs.npmjs.com/generating-provenance-statements), and the release workflow publishes a best-effort CycloneDX SBOM for the production npm dependency graph. See the [security guide §13](https://docs.arc-1-mcp.com/security-guide/#13-dependency--supply-chain-security)
 
 ### Authentication
 
@@ -145,6 +145,19 @@ What changed per release: the annotated [Release Notes](https://docs.arc-1-mcp.c
 
 ## Quick Start
 
+**Install as an Agent Plugin** — one portable install for the MCP server and all bundled SAP skills in
+GitHub Copilot, VS Code, Cursor, Codex, and other compatible clients:
+
+```bash
+copilot plugin marketplace add arc-mcp/arc-1
+copilot plugin install arc-1@arc-1
+```
+
+Agent Plugins 1.0 does not define secret prompts, so create the ARC-1 `.env` in the installed
+plugin's persistent data directory before connecting to SAP. See the
+**[Agent Plugin guide](https://docs.arc-1-mcp.com/agent-plugin/)** for client-specific installation,
+safe configuration, and verification.
+
 **Install in Claude** — pick your surface (full guide: [Install in Claude](https://docs.arc-1-mcp.com/install-in-claude/)):
 
 - **Claude Desktop** — download the latest `arc-1-*.mcpb` from [Releases](https://github.com/arc-mcp/arc-1/releases) and double-click it (or Settings → Extensions). Claude prompts for your SAP connection. (The `.mcpb` is attached to releases automatically; if the newest one doesn't have it yet, see [Install in Claude](https://docs.arc-1-mcp.com/install-in-claude/).)
@@ -186,6 +199,7 @@ Full documentation is available at **[docs.arc-1-mcp.com](https://docs.arc-1-mcp
 | Guide | Description |
 |-------|-------------|
 | [Quickstart](https://docs.arc-1-mcp.com/quickstart/) | 5-minute npx + Claude Desktop setup |
+| [Agent Plugin](https://docs.arc-1-mcp.com/agent-plugin/) | Portable server + all skills for Copilot, VS Code, Cursor, Codex, and compatible clients |
 | [Install in Claude](https://docs.arc-1-mcp.com/install-in-claude/) | Desktop `.mcpb`, Claude Code plugin (server + skills), and remote BTP connector |
 | [Local Development](https://docs.arc-1-mcp.com/local-development/) | Full local dev — all install methods, MCP client configs, SSO cookie extractor |
 | [Deployment](https://docs.arc-1-mcp.com/deployment/) | Multi-user deployment — Docker, BTP Cloud Foundry, BTP ABAP |

package/bin/arc1-cli.js

@@ -1,10 +1,6 @@
 #!/usr/bin/env node
 
-// ARC-1 CLI — direct tool invocation entry point
-// Delegates to compiled TypeScript (dist/cli.js).
-//
-// This bin is separate from `arc1` because the MCP server entry (`bin/arc1.js` → dist/index.js)
-// must own stdin/stdout cleanly for the JSON-RPC stream. `arc1-cli` is for command-line use
-// (read, activate, syntax, call, extract-cookies, …) and exits after a single invocation.
+// Back-compatible alias of arc1/arc-1. All names expose the same command set.
 
-import('../dist/cli.js');
+const { main } = await import('../dist/cli.js');
+process.exitCode = await main(process.argv.slice(2));

package/bin/arc1.js

@@ -1,12 +1,7 @@
 #!/usr/bin/env node
 
-// ARC-1 — ABAP Relay Connector
-// CLI entry point — delegates to compiled TypeScript
-//
-// Why a thin JS wrapper instead of direct dist/ reference:
-// The MCP SDK's stdio transport requires the entry process to own stdin/stdout.
-// Using a direct require() (not spawn) ensures no intermediate process layer
-// that could interfere with the JSON-RPC stream.
-// (Learned from fr0ster/mcp-abap-adt bin/mcp-abap-adt.js)
+// ARC-1 — all published executable names share the same strict CLI runtime.
+// Keeping this as an in-process import lets stdio MCP own stdin/stdout directly.
 
-import('../dist/cli.js');
+const { main } = await import('../dist/cli.js');
+process.exitCode = await main(process.argv.slice(2));

package/dist/adt/abapgit.d.ts

@@ -7,6 +7,11 @@ import type { AdtHttpClient } from './http.js';
 import type { PackageHierarchyResolver } from './package-hierarchy.js';
 import { type SafetyConfig } from './safety.js';
 import type { AbapGitExternalInfo, AbapGitObject, AbapGitRepo, AbapGitStaging } from './types.js';
+export declare function redactGitUrl(value: string): string;
+/** Validate caller-controlled Git URLs before SAP is allowed to contact them. */
+export declare function validateGitRemoteUrl(value: string, options?: {
+    rejectPrivateLiteral?: boolean;
+}): URL;
 export declare function parseAbapGitRepos(xml: string): AbapGitRepo[];
 export declare function parseAbapGitExternalInfo(xml: string): AbapGitExternalInfo;
 /**
@@ -50,14 +55,14 @@ export declare function pullRepo(http: AdtHttpClient, safety: SafetyConfig, repo
     transportRequest?: string;
     user?: string;
     password?: string;
-}): Promise<AbapGitObject[]>;
-export declare function unlinkRepo(http: AdtHttpClient, safety: SafetyConfig, repoId: string): Promise<void>;
+}, resolver?: PackageHierarchyResolver | null, repoPackage?: string): Promise<AbapGitObject[]>;
+export declare function unlinkRepo(http: AdtHttpClient, safety: SafetyConfig, repoId: string, resolver?: PackageHierarchyResolver | null, repoPackage?: string): Promise<void>;
 export declare function stageRepo(http: AdtHttpClient, safety: SafetyConfig, repo: AbapGitRepo, user?: string, password?: string): Promise<AbapGitStaging>;
-export declare function pushRepo(http: AdtHttpClient, safety: SafetyConfig, repo: AbapGitRepo, staging: AbapGitStaging, user?: string, password?: string): Promise<void>;
+export declare function pushRepo(http: AdtHttpClient, safety: SafetyConfig, repo: AbapGitRepo, staging: AbapGitStaging, user?: string, password?: string, resolver?: PackageHierarchyResolver | null): Promise<void>;
 export declare function checkRepo(http: AdtHttpClient, safety: SafetyConfig, repo: AbapGitRepo, user?: string, password?: string): Promise<{
     ok: boolean;
     message: string | null;
 }>;
-export declare function switchBranch(http: AdtHttpClient, safety: SafetyConfig, repoId: string, branch: string, create?: boolean, user?: string, password?: string): Promise<void>;
-export declare function createBranch(http: AdtHttpClient, safety: SafetyConfig, repoId: string, branch: string, user?: string, password?: string): Promise<void>;
+export declare function switchBranch(http: AdtHttpClient, safety: SafetyConfig, repoId: string, branch: string, create?: boolean, user?: string, password?: string, resolver?: PackageHierarchyResolver | null, repoPackage?: string): Promise<void>;
+export declare function createBranch(http: AdtHttpClient, safety: SafetyConfig, repoId: string, branch: string, user?: string, password?: string, resolver?: PackageHierarchyResolver | null, repoPackage?: string): Promise<void>;
 //# sourceMappingURL=abapgit.d.ts.map

package/dist/adt/abapgit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"abapgit.d.ts","sourceRoot":"","sources":["../../src/adt/abapgit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAyD,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACvG,OAAO,KAAK,EAEV,mBAAmB,EAEnB,aAAa,EACb,WAAW,EACX,cAAc,EAGf,MAAM,YAAY,CAAC;AAsHpB,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,EAAE,CAwB5D;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CA4BzE;AAuBD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE,CAahE;AAiBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC,CAkBxG;AA4FD,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAKjG;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE;IACN,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,EACD,QAAQ,CAAC,EAAE,wBAAwB,GAAG,IAAI,GACzC,OAAO,CAAC,aAAa,EAAE,CAAC,CAe1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,YAAY,EACpB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,QAAQ,EAAE,wBAAwB,GAAG,IAAI,GAAG,SAAS,EACrD,KAAK,SAAgB,GACpB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,GAAE;IACN,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACd,GACL,OAAO,CAAC,aAAa,EAAE,CAAC,CAsB1B;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzG;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,WAAW,EACjB,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,CAAC,CAkBzB;AAED,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,cAAc,EACvB,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,WAAW,EACjB,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAgClD;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,UAAQ,EACd,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAEf"}
+{"version":3,"file":"abapgit.d.ts","sourceRoot":"","sources":["../../src/adt/abapgit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAEvE,OAAO,EAAyD,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACvG,OAAO,KAAK,EAEV,mBAAmB,EAEnB,aAAa,EACb,WAAW,EACX,cAAc,EAGf,MAAM,YAAY,CAAC;AAsGpB,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAalD;AAgED,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,GAAG,CAmBzG;AAwID,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,EAAE,CA+B5D;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CA+CzE;AAyBD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE,CAqBhE;AA4CD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC,CAmBxG;AAsFD,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAKjG;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,CAAC,CAe9B;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE;IACN,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,EACD,QAAQ,CAAC,EAAE,wBAAwB,GAAG,IAAI,GACzC,OAAO,CAAC,aAAa,EAAE,CAAC,CAkB1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,YAAY,EACpB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,QAAQ,EAAE,wBAAwB,GAAG,IAAI,GAAG,SAAS,EACrD,KAAK,SAAgB,GACpB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,GAAE;IACN,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACd,EACN,QAAQ,CAAC,EAAE,wBAAwB,GAAG,IAAI,EAC1C,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,aAAa,EAAE,CAAC,CA0B1B;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,wBAAwB,GAAG,IAAI,EAC1C,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,WAAW,EACjB,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,CAAC,CAkBzB;AAED,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,cAAc,EACvB,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,wBAAwB,GAAG,IAAI,GACzC,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,WAAW,EACjB,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAoClD;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,UAAQ,EACd,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,wBAAwB,GAAG,IAAI,EAC1C,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,wBAAwB,GAAG,IAAI,EAC1C,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAEf"}