sap-adt-mcp 0.8.47 → 0.8.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-adt-mcp",
-  "version": "0.8.47",
+  "version": "0.8.49",
   "mcpName": "io.github.yzonur/sap-adt-mcp",
   "description": "MCP server giving Claude live access to SAP systems via ADT (ABAP Development Tools) REST. Read source, search, run syntax checks, and edit ABAP objects from any MCP-compatible client.",
   "type": "module",
@@ -21,7 +21,7 @@
   },
   "scripts": {
     "start": "node src/server.js",
-    "test": "node --test test/adt-error.test.js test/atc-bulk.test.js test/audit.test.js test/cds.test.js test/data-preview.test.js test/diff.test.js test/dump-feed.test.js test/grep-source.test.js test/jobs.test.js test/lifecycle-activate.test.js test/lock.test.js test/mcp-bug-fixes.test.js test/node-structure.test.js test/notes.test.js test/object-create.test.js test/object-references.test.js test/object-uris.test.js test/panel.test.js test/prompts.test.js test/provenance.test.js test/rap-scaffold.test.js test/reporter.test.js test/security.test.js test/source-chunked.test.js test/source-guard.test.js test/source-pagination.test.js test/syntax-context.test.js test/tools-shape.test.js test/versions.test.js test/worklist.test.js",
+    "test": "node --test test/adt-error.test.js test/atc-bulk.test.js test/audit.test.js test/cds.test.js test/config.test.js test/data-preview.test.js test/diff.test.js test/dump-feed.test.js test/grep-source.test.js test/jobs.test.js test/lifecycle-activate.test.js test/lock.test.js test/mcp-bug-fixes.test.js test/node-structure.test.js test/notes.test.js test/object-create.test.js test/object-references.test.js test/object-uris.test.js test/panel.test.js test/prompts.test.js test/provenance.test.js test/rap-scaffold.test.js test/reporter.test.js test/security.test.js test/source-chunked.test.js test/source-guard.test.js test/source-pagination.test.js test/syntax-context.test.js test/tools-shape.test.js test/versions.test.js test/worklist.test.js",
     "lint": "eslint src test"
   },
   "keywords": [

package/src/adt-client.js

@@ -168,8 +168,15 @@ export class AdtClient {
     const token = res.headers.get("x-csrf-token");
     if (!token || token.toLowerCase() === "required") {
       const body = await res.text().catch(() => "");
+      // An HTML body means the host answered with a web page (SSO/login form or a
+      // web-dispatcher error), not the ADT service — usually a wrong host/system
+      // or a system fronted by SSO that basic auth can't pass.
+      const looksHtml = /^\s*<(!doctype html|html\b)/i.test(body);
+      const hint = looksHtml
+        ? " — the host returned an HTML page (likely an SSO/login page or wrong host), not the ADT service. Check the system's host and that it accepts basic-auth ADT access."
+        : "";
       throw new Error(
-        `Failed to fetch CSRF token (status ${res.status}): ${body.slice(0, 200)}`
+        `Failed to fetch CSRF token (status ${res.status})${hint}: ${body.slice(0, 200)}`
       );
     }
     this.csrfToken = token;

package/src/config.js

@@ -2,14 +2,18 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 
-const CANDIDATE_PATHS = [
-  process.env.SAP_ADT_MCP_CONFIG,
-  path.join(os.homedir(), ".sap-adt-mcp", "config.json"),
-  path.join(process.cwd(), "config.json"),
-].filter(Boolean);
+// Resolved at call time (not import time) so SAP_ADT_MCP_CONFIG is honoured
+// whenever loadConfig runs, not just whatever it was when this module loaded.
+function candidatePaths() {
+  return [
+    process.env.SAP_ADT_MCP_CONFIG,
+    path.join(os.homedir(), ".sap-adt-mcp", "config.json"),
+    path.join(process.cwd(), "config.json"),
+  ].filter(Boolean);
+}
 
 export function loadConfig() {
-  const configPath = CANDIDATE_PATHS.find((p) => fs.existsSync(p));
+  const configPath = candidatePaths().find((p) => fs.existsSync(p));
   if (!configPath) {
     throw new Error(
       "No config found. Set SAP_ADT_MCP_CONFIG or create ~/.sap-adt-mcp/config.json " +
@@ -31,7 +35,7 @@ export function loadConfig() {
   const systems = {};
   for (const [name, profile] of Object.entries(raw.systems ?? {})) {
     systems[name] = {
-      host: requireString(profile.host, `${name}.host`),
+      host: requireHost(profile.host, name),
       client: profile.client != null ? String(profile.client) : undefined,
       language: profile.language != null ? String(profile.language) : undefined,
       user: requireString(profile.user, `${name}.user`),
@@ -122,6 +126,29 @@ function requireString(value, key) {
   return value;
 }
 
+// A host without an http(s):// scheme (or an otherwise unparseable one) makes
+// every request throw the cryptic "ADT path is not a valid URL component" at
+// call time — once per tool call, far from the real cause. Validate the scheme
+// up front so a bad config fails loudly at load with an actionable message.
+function requireHost(value, systemName) {
+  const host = requireString(value, `${systemName}.host`);
+  let url;
+  try {
+    url = new URL(host);
+  } catch {
+    throw new Error(
+      `Config: ${systemName}.host must be a full URL including scheme, ` +
+        `e.g. "https://sap.example.com:44300" (got "${host}").`
+    );
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error(
+      `Config: ${systemName}.host must use http:// or https:// (got "${url.protocol}//" in "${host}").`
+    );
+  }
+  return host;
+}
+
 function resolveSecret(value, systemName) {
   if (typeof value !== "string") {
     throw new Error(`System ${systemName}: password must be a string`);

package/src/reporter.js

@@ -32,7 +32,11 @@ const SKIP_NAMES = new Set(["ReadOnlyViolationError", "AbortError"]);
 // Configuration / setup mistakes and input-validation errors — the user's
 // environment or a mis-shaped tool call, not a bug in the tool.
 const SKIP_MESSAGE_RE =
-  /(No config found|must be a non-empty string|env var .* is not set|No system specified|Unknown system '|No systems configured|password must be a string|Failed to parse config|is required\b|Unsupported object type|ADT request failed|ADT request timed out|fetch failed)/i;
+  // "Failed to fetch CSRF token": the host didn't behave like an ADT endpoint
+  // (SSO/login page, web dispatcher, wrong host/system) — environmental/auth, not
+  // a tool defect. The CSRF fetch is a fixed simple GET, so it never mis-shapes a
+  // request on our side (#62, and the deleted #58-60 cluster).
+  /(No config found|must be a non-empty string|env var .* is not set|No system specified|Unknown system '|No systems configured|password must be a string|Failed to parse config|is required\b|Unsupported object type|ADT request failed|ADT request timed out|fetch failed|Failed to fetch CSRF token)/i;
 
 // Network / TLS problems live on the user's side (firewall, VPN, cert, host down).
 const NETWORK_CODES = new Set([
@@ -177,7 +181,9 @@ const BUSINESS_T100 = new Set([
   "ADT_DATAPREVIEW_MSG",
 ]);
 const BUSINESS_TYPE_RE =
-  /SaveFailure|Lock|Enqueue|CTS_|ExceptionResourceAlreadyExists|NotFound/i;
+  // NoDependencyGraphDataCalculationPossible: SAP can't compute the dependency
+  // graph for a given CDS entity (system/data-side, not a tool defect — see #22/#61).
+  /SaveFailure|Lock|Enqueue|CTS_|ExceptionResourceAlreadyExists|NotFound|NoDependencyGraphDataCalculation/i;
 
 // Decide whether a non-2xx ADT response that a handler returned (not threw) is
 // likely a defect in *this* tool rather than a user/business condition. Errs

package/src/tools/cds.js

@@ -101,7 +101,10 @@ export function register({ getClient }) {
         method: "POST",
         path: CDS_PREVIEW_PATH,
         query: { ddlSourceName: entity.toUpperCase(), rowNumber: String(max) },
-        accept: "application/xml",
+        // The Data Preview endpoint only serializes a result set as this media
+        // type; plain application/xml 406s (ExceptionResourceNotAcceptable),
+        // same as the adt_read_table fix.
+        accept: "application/vnd.sap.adt.datapreview.table.v1+xml",
       });
       const text = await res.text();
       if (!res.ok) return errorResult(sys, res.status, text, res.headers.get("content-type"));

package/src/tools/quality.js

@@ -1,9 +1,33 @@
 import { objectUri, sourceUri, normalizeType } from "../object-uris.js";
 import { escapeXml } from "../xml.js";
 import { parseObjectReferences } from "../object-references.js";
-import { errorResult, jsonResult } from "../result.js";
+import { errorResult, jsonResult, textResult } from "../result.js";
 import { OBJECT_TYPE_HINT, SYSTEM_HINT } from "./_shared.js";
 
+// Guard the `objects` array before the handlers iterate it. Callers frequently
+// reach for the singular `object`/`type` shape (as adt_get_source uses), which
+// left `args.objects` undefined and crashed on `.map`. Return a clean tool
+// error pointing at the right shape instead of throwing.
+function validateObjects(tool, objects) {
+  if (!Array.isArray(objects) || objects.length === 0) {
+    return textResult(
+      `${tool}: \`objects\` is required — a non-empty array of { name, type[, group] }. ` +
+        "Note the plural: pass `objects: [{ name: '…', type: '…' }]`, not a singular `object`/`type`.",
+      true
+    );
+  }
+  for (let i = 0; i < objects.length; i++) {
+    const o = objects[i];
+    if (!o || typeof o.name !== "string" || typeof o.type !== "string") {
+      return textResult(
+        `${tool}: objects[${i}] must be { name: string, type: string }.`,
+        true
+      );
+    }
+  }
+  return null;
+}
+
 // Parse <atcfinding .../> elements from an ATC worklist result. Attribute names
 // vary slightly across releases — collect them all, normalized without prefix.
 const FINDING_RE = /<(?:atcfinding|atcworklist:finding|finding)\b([\s\S]*?)(?:\/>|>)/gi;
@@ -343,6 +367,8 @@ export function register({ getClient }) {
     },
 
     adt_run_unit_tests: async (args) => {
+      const objectsError = validateObjects("adt_run_unit_tests", args.objects);
+      if (objectsError) return objectsError;
       const { client, name: sys } = getClient(args.system);
       const refs = args.objects
         .map((o) => {
@@ -369,6 +395,8 @@ export function register({ getClient }) {
     },
 
     adt_run_atc: async (args) => {
+      const objectsError = validateObjects("adt_run_atc", args.objects);
+      if (objectsError) return objectsError;
       const { client, name: sys } = getClient(args.system);
       const refs = args.objects
         .map((o) => {