@mcp-abap-adt/proxy 1.2.0 → 1.3.0

package/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.3.0] - 2026-05-28
+
+### Added
+- **CLI flags override values from `--config`** — when a config file is loaded via `--config`/`-c`, explicit CLI flags (`--btp`, `--target-url`/`--url`, `--unsafe`, `--browser`, `--browser-auth-port`, `--header`) now override matching values from the file instead of being silently dropped. `--header` entries merge with `defaultHeaders` (CLI keys win on conflict). The proxy logs which keys were overridden so the precedence is visible.
+- **`--help` / `-h`** — full CLI usage printer covering auth, browser, transport flags and the documented environment variables. Previously the proxy had no help output at all, making the `--browser none` / `--browser-auth-port` flags effectively undiscoverable.
+- **Graceful shutdown on `SIGINT` / `SIGTERM`** — the proxy now wires both signals to `shutdown()`, which closes the MCP server and HTTP listener, clears pending JWT refresh timers, drops the token cache, and releases per-destination auth brokers. Previously these resources were only released on hard process exit.
+
+### Fixed
+- `BtpProxy.dispose()` now clears the token cache and the per-destination broker map in addition to refresh timers, so a clean shutdown actually releases all auth state.
+
+## [1.2.1] - 2026-05-26
+
+### Security
+- **Default bind host changed from `0.0.0.0` to `127.0.0.1`** (loopback) for HTTP and SSE transports. The proxy holds auth tokens and runs locally, so it no longer listens on all network interfaces by default. Set `httpHost`/`sseHost` (or `MCP_HTTP_HOST`/`MCP_SSE_HOST`) to `0.0.0.0` to expose it intentionally.
+
+### Removed
+- **Interactive configuration wizard (TUI)** — removed the `mcp-abap-adt-proxy tui` subcommand and the `src/tui/` module (its `direct`/`mcpUrl` scenario no longer matched the BTP-only proxy and produced unusable configs). Client and proxy configuration is handled by the separate `@mcp-abap-adt/configurator` package (`mcp-conf`). Dropped the `@inquirer/prompts` dependency.
+- **Combined-launch test harness** — removed `tools/start-servers.js` and the `npm run test:servers` script. It started a local `mcp-abap-adt` server with the proxy in front of it via the long-removed `--mcp-url`/`--mcp` flags, which no longer applies to a pure authorization proxy.
+
+### Changed
+- **Documentation synced to the BTP-only model.** Removed stale references to the long-gone `x-mcp-url`/`--mcp-url`, `mcpDestination`, `cloudLlmHubUrl`/`CLOUD_LLM_HUB_URL`, `DEBUG_HTTP_REQUESTS`, and config-file auto-discovery/`MCP_PROXY_CONFIG`. Documented the actual options: `defaultHeaders`, `browser`/`browserAuthPort`, and `targetUrl`/`x-target-url`. Removed the obsolete `IMPLEMENTATION_ANALYSIS.md`.
+
 ## [1.2.0] - 2026-04-20
 
 ### Added

package/README.md

@@ -142,7 +142,6 @@ The proxy uses BTP/XSUAA authentication:
 - **[Architecture](./docs/ARCHITECTURE.md)** - System architecture and design
 - **[Troubleshooting](./docs/TROUBLESHOOTING.md)** - Common issues and solutions
 - **[Routing Logic Specification](./docs/ROUTING_LOGIC.md)** - Detailed routing logic and scenarios
-- **[Implementation Analysis](./docs/IMPLEMENTATION_ANALYSIS.md)** - Current implementation analysis
 - **[Roadmap](./ROADMAP.md)** - Development roadmap and progress
 
 ## How It Works
@@ -226,28 +225,13 @@ See [Configuration Guide](./docs/CONFIGURATION.md) for complete options.
 
 ## Testing Tools
 
-### Start Both Servers for Testing
-
-Use the included script to start both `mcp-abap-adt` and `mcp-abap-adt-proxy` simultaneously:
+Verify a BTP destination's service key and token retrieval:
 
 ```bash
-# Using npm script
-npm run test:servers
-
-# Direct execution
-node tools/start-servers.js
-
-# With SSE transport
-node tools/start-servers.js --transport=sse
+npm run test-destination
 ```
 
-The script automatically:
-- Starts ADT server on port 3000 (HTTP) or 3001 (SSE)
-- Starts Proxy server on port 3001 (HTTP) or 3002 (SSE)
-- Generates `mcpUrl` based on ADT server configuration
-- Ensures both servers use the same transport protocol
-
-See [tools/README.md](./tools/README.md) for complete documentation.
+See [tools/README.md](./tools/README.md) for the available scripts.
 
 ## Development Status
 
@@ -258,7 +242,7 @@ See [tools/README.md](./tools/README.md) for complete documentation.
 - ✅ JWT Token Management & Proxy Forwarding
 - ✅ Configuration & Environment
 - ✅ Error Handling & Resilience
-- ✅ Testing Tools (`tools/start-servers.js`)
+- ✅ Testing Tools (`tools/`)
 - ✅ Documentation
 
 🚧 **Future Work**

package/bin/mcp-abap-adt-proxy.js

@@ -7,7 +7,6 @@
  *
  * Usage:
  *   mcp-abap-adt-proxy [options]
- *   mcp-abap-adt-proxy tui
  *   mcp-abap-adt-proxy --transport=stdio
  *   mcp-abap-adt-proxy --transport=http
  */
@@ -44,17 +43,13 @@ MCP ABAP ADT Proxy Server v${pkg.version}
 
 Usage:
   mcp-abap-adt-proxy [options]
-  mcp-abap-adt-proxy tui
-
-Commands:
-  tui                       Interactive configuration wizard (generates YAML config)
 
 Options:
   --transport=<type>       Transport type: stdio, http, streamable-http, sse
   --http-port=<port>      HTTP server port (default: 3001)
   --sse-port=<port>       SSE server port (default: 3002)
-  --http-host=<host>      HTTP server host (default: 0.0.0.0)
-  --sse-host=<host>       SSE server host (default: 0.0.0.0)
+  --http-host=<host>      HTTP server host (default: 127.0.0.1)
+  --sse-host=<host>       SSE server host (default: 127.0.0.1)
   --btp=<destination>     Override x-sap-destination header (for BTP Cloud authorization)
                            Required for stdio/SSE transports unless provided in headers
   --target-url=<url>      Override target URL (separates Auth from Connection)
@@ -70,8 +65,8 @@ Options:
 Environment Variables:
   MCP_HTTP_PORT           HTTP server port (default: 3001)
   MCP_SSE_PORT            SSE server port (default: 3002)
-  MCP_HTTP_HOST           HTTP server host (default: 0.0.0.0)
-  MCP_SSE_HOST            SSE server host (default: 0.0.0.0)
+  MCP_HTTP_HOST           HTTP server host (default: 127.0.0.1)
+  MCP_SSE_HOST            SSE server host (default: 127.0.0.1)
   MCP_TRANSPORT           Transport type (stdio|http|sse)
   MCP_PROXY_UNSAFE        Enable file-based session storage (set to "true")
 
@@ -85,7 +80,6 @@ Examples:
   mcp-abap-adt-proxy --btp=ai                           # With BTP destination override
   mcp-abap-adt-proxy --btp=ai --unsafe                  # With file-based session storage
   mcp-abap-adt-proxy --btp=ai --header x-sap-destination=S4HANA  # With default SAP headers
-  mcp-abap-adt-proxy tui                                 # Interactive configuration wizard
   mcp-abap-adt-proxy --config=proxy-config.yaml         # Load configuration from YAML file
   mcp-abap-adt-proxy -c proxy-config.yml                # Load configuration from YAML file (short form)
 
@@ -146,30 +140,6 @@ function main() {
     process.exit(0);
   }
 
-  // Handle 'tui' subcommand — interactive configuration wizard
-  if (process.argv[2] === 'tui') {
-    const wizardPath = path.resolve(__dirname, '../dist/tui/index.js');
-    if (!fs.existsSync(wizardPath)) {
-      process.stderr.write(`[MCP Proxy] ✗ Wizard not found at: ${wizardPath}\n`);
-      process.stderr.write(`[MCP Proxy]   Make sure to build the project with 'npm run build' first.\n`);
-      process.exit(1);
-      return;
-    }
-    import(wizardPath).then(({ runWizard }) => {
-      runWizard().catch((err) => {
-        if (err.name === 'ExitPromptError') {
-          process.exit(0);
-        }
-        process.stderr.write(`[MCP Proxy] ✗ Wizard error: ${err.message}\n`);
-        process.exit(1);
-      });
-    }).catch((err) => {
-      process.stderr.write(`[MCP Proxy] ✗ Failed to load wizard: ${err.message}\n`);
-      process.exit(1);
-    });
-    return;
-  }
-
   // Spawn the main server process
   const serverPath = path.resolve(__dirname, '../dist/index.js');
 

package/dist/index.js

@@ -206,7 +206,7 @@ Authorization source: BTP destination "${this.config.btpDestination}"`;
             }
         });
         const port = httpConfig.port || 3001;
-        const host = httpConfig.host || '0.0.0.0';
+        const host = httpConfig.host || '127.0.0.1';
         return new Promise((resolve, reject) => {
             this.httpServer?.listen(port, host, () => {
                 const authSourceObj = this.config.btpDestination
@@ -513,7 +513,7 @@ Authorization source: ${authSourceObj}`;
             res.end('Not found');
         });
         const port = sseConfig.port || 3002;
-        const host = sseConfig.host || '0.0.0.0';
+        const host = sseConfig.host || '127.0.0.1';
         return new Promise((resolve, reject) => {
             httpServer.listen(port, host, () => {
                 const authSourceObj = this.config.btpDestination
@@ -567,9 +567,88 @@ Authorization source: ${authSourceObj}`;
 exports.McpAbapAdtProxyServer = McpAbapAdtProxyServer;
 // Export for use in bin script
 exports.default = McpAbapAdtProxyServer;
+/**
+ * Print CLI usage and exit.
+ */
+function printHelp() {
+    const help = `Usage: mcp-abap-adt-proxy [options]
+
+Authorization proxy for MCP clients (Cline, Claude Code, etc.) that cannot
+authenticate on their own to MCP servers deployed on SAP BTP.
+
+CONFIGURATION
+  -c, --config <path>         Load config from YAML/JSON file. CLI flags below
+                              override values from the file.
+
+AUTHENTICATION (BTP / XSUAA)
+  --btp <destination>         BTP destination name. Service key is read from
+                              ~/.config/mcp-abap-adt/service-keys/<dest>.json
+  --target-url <url>          Override target service URL (default: from service key)
+  --url <url>                 Alias for --target-url
+  --unsafe                    Persist session/tokens to disk (default: in-memory)
+  --header <key=value>        Inject a default header into every forwarded
+                              request. Repeatable. Client-supplied headers win.
+
+BROWSER AUTHORIZATION
+  --browser <mode>            Browser used for OAuth login. One of:
+                                system   - OS default browser (default)
+                                chrome   - Google Chrome
+                                edge     - Microsoft Edge
+                                firefox  - Firefox
+                                none     - Print URL to console and wait for
+                                           callback (for SSH/headless sessions)
+                                headless - Alias for 'none'
+  --browser-auth-port <port>  Local OAuth callback port. Must match the
+                              redirect_uri registered on XSUAA (default: 3333).
+
+TRANSPORT
+  --transport <type>          stdio | streamable-http | http | sse
+                              (auto-detected from stdin TTY if not set)
+  --stdio                     Shortcut for --transport stdio
+  --http                      Shortcut for --transport streamable-http
+  --sse                       Shortcut for --transport sse
+  --http-port <port>          HTTP transport port (default: 3001)
+  --http-host <host>          HTTP transport host (default: 127.0.0.1)
+  --sse-port <port>           SSE transport port (default: 3002)
+  --sse-host <host>           SSE transport host (default: 127.0.0.1)
+
+  -h, --help                  Show this help and exit
+
+ENVIRONMENT VARIABLES
+  MCP_TRANSPORT, MCP_HTTP_PORT, MCP_HTTP_HOST, MCP_SSE_PORT, MCP_SSE_HOST,
+  LOG_LEVEL, MCP_PROXY_UNSAFE, MCP_PROXY_MAX_RETRIES, MCP_PROXY_RETRY_DELAY,
+  MCP_PROXY_REQUEST_TIMEOUT, MCP_PROXY_CIRCUIT_BREAKER_THRESHOLD,
+  MCP_PROXY_CIRCUIT_BREAKER_TIMEOUT
+
+See docs/CONFIGURATION.md for the full configuration reference.
+`;
+    process.stdout.write(help);
+}
 // Auto-start server when run directly (unless MCP_SKIP_AUTO_START is set)
 if (process.env.MCP_SKIP_AUTO_START !== 'true') {
+    if (process.argv.includes('--help') || process.argv.includes('-h')) {
+        printHelp();
+        process.exit(0);
+    }
     const server = new McpAbapAdtProxyServer();
+    // Graceful shutdown: release the OAuth callback port, MCP server, and HTTP listener.
+    let shuttingDown = false;
+    const onSignal = (signal) => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        logger_js_1.logger?.info('Received shutdown signal, releasing resources', { signal });
+        server
+            .shutdown()
+            .catch((error) => {
+            logger_js_1.logger?.error('Error during shutdown', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        })
+            .finally(() => process.exit(0));
+    };
+    process.on('SIGINT', onSignal);
+    process.on('SIGTERM', onSignal);
     server.run().catch((error) => {
         logger_js_1.logger?.error('Fatal error while running MCP proxy server', {
             type: 'SERVER_FATAL_ERROR',

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAGxC,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAG/B,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CAqC3D;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,mBAAmB,CAQrB;AAgBD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAYhC;AA4ID;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAUD;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG;IACnD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAoDA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAGxC,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAG/B,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CAyB3D;AAwED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,mBAAmB,CAQrB;AAgBD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAYhC;AA4ID;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAUD;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG;IACnD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAoDA"}

package/dist/lib/config.js

@@ -56,24 +56,17 @@ function loadConfig(configPath) {
     // Get config path from parameter or command line (--config/-c)
     // Do NOT use environment variable MCP_PROXY_CONFIG - only explicit --config parameter
     const finalConfigPath = configPath || getConfigPath();
-    // If --config is provided, load ONLY from that file (no merge with command line params)
+    // If --config is provided: load from file, apply defaults, then overlay explicit CLI flags.
+    // CLI flags override YAML values (YAML is just the baseline).
     if (finalConfigPath) {
-        // Warn if other CLI parameters are also provided (they will be ignored)
-        const conflictingParams = ['--btp', '--unsafe'].filter((param) => hasArg(param));
-        if (conflictingParams.length > 0) {
-            console.warn(`Warning: --config is specified, but the following CLI parameters will be ignored: ${conflictingParams.join(', ')}. ` +
-                `Configuration will be loaded ONLY from ${finalConfigPath}. ` +
-                `To use CLI parameters, do not specify --config.`);
-        }
         try {
-            if (fs.existsSync(finalConfigPath)) {
-                const fileConfig = loadConfigFile(finalConfigPath);
-                // Apply defaults for missing values in file config
-                return applyDefaults(fileConfig);
-            }
-            else {
+            if (!fs.existsSync(finalConfigPath)) {
                 throw new Error(`Config file not found: ${finalConfigPath}`);
             }
+            const fileConfig = loadConfigFile(finalConfigPath);
+            const base = applyDefaults(fileConfig);
+            const cli = readCliOverrides();
+            return mergeCliOverrides(base, cli, finalConfigPath);
         }
         catch (error) {
             throw new Error(`Failed to load config from file ${finalConfigPath}: ${error instanceof Error ? error.message : String(error)}`);
@@ -82,6 +75,61 @@ function loadConfig(configPath) {
     // No --config provided: load ONLY from command line parameters and environment variables
     return loadFromEnv();
 }
+/**
+ * Read CLI flags that should override file/YAML configuration.
+ * Only includes keys that were explicitly provided on the command line.
+ */
+function readCliOverrides() {
+    const overrides = {};
+    const btp = getArgValue('--btp');
+    if (btp !== undefined)
+        overrides.btpDestination = btp;
+    const targetUrl = getArgValue('--target-url') ?? getArgValue('--url');
+    if (targetUrl !== undefined)
+        overrides.targetUrl = targetUrl;
+    if (hasArg('--unsafe'))
+        overrides.unsafe = true;
+    const browser = getArgValue('--browser');
+    if (browser !== undefined) {
+        overrides.browser = browser;
+    }
+    const browserAuthPortStr = getArgValue('--browser-auth-port');
+    if (browserAuthPortStr !== undefined) {
+        overrides.browserAuthPort = parseInt(browserAuthPortStr, 10);
+    }
+    const headerArgs = getAllArgValues('--header');
+    if (headerArgs.length > 0) {
+        const headers = {};
+        for (const arg of headerArgs) {
+            const eqIndex = arg.indexOf('=');
+            if (eqIndex > 0) {
+                const key = arg.substring(0, eqIndex).toLowerCase();
+                const value = arg.substring(eqIndex + 1);
+                headers[key] = value;
+            }
+        }
+        overrides.defaultHeaders = headers;
+    }
+    return overrides;
+}
+/**
+ * Merge CLI overrides on top of file-based config. Logs which keys were overridden.
+ * `defaultHeaders` is merged per-key (CLI keys override YAML keys); other fields are replaced.
+ */
+function mergeCliOverrides(base, cli, configPath) {
+    const merged = { ...base, ...cli };
+    if (cli.defaultHeaders) {
+        merged.defaultHeaders = {
+            ...(base.defaultHeaders || {}),
+            ...cli.defaultHeaders,
+        };
+    }
+    const overriddenKeys = Object.keys(cli);
+    if (overriddenKeys.length > 0) {
+        console.warn(`Note: CLI flags override values from ${configPath}: ${overriddenKeys.join(', ')}`);
+    }
+    return merged;
+}
 /**
  * Extract transport-related fields from a raw config object
  */
@@ -132,8 +180,8 @@ function applyDefaults(fileConfig) {
     const result = {
         httpPort: fileConfig.httpPort ?? 3001,
         ssePort: fileConfig.ssePort ?? 3002,
-        httpHost: fileConfig.httpHost || '0.0.0.0',
-        sseHost: fileConfig.sseHost || '0.0.0.0',
+        httpHost: fileConfig.httpHost || '127.0.0.1',
+        sseHost: fileConfig.sseHost || '127.0.0.1',
         logLevel: fileConfig.logLevel || 'info',
         btpDestination: fileConfig.btpDestination,
         targetUrl: fileConfig.targetUrl,
@@ -179,8 +227,8 @@ function loadFromEnv() {
     return {
         httpPort: parseInt(process.env.MCP_HTTP_PORT || '3001', 10),
         ssePort: parseInt(process.env.MCP_SSE_PORT || '3002', 10),
-        httpHost: process.env.MCP_HTTP_HOST || '0.0.0.0',
-        sseHost: process.env.MCP_SSE_HOST || '0.0.0.0',
+        httpHost: process.env.MCP_HTTP_HOST || '127.0.0.1',
+        sseHost: process.env.MCP_SSE_HOST || '127.0.0.1',
         logLevel: process.env.LOG_LEVEL || 'info',
         btpDestination,
         targetUrl,

package/dist/lib/transportConfig.js

@@ -64,7 +64,7 @@ function parseTransportConfig(fileOverrides) {
         const host = getArgValue('--sse-host') ||
             fileOverrides?.sseHost ||
             process.env.MCP_SSE_HOST ||
-            '0.0.0.0';
+            '127.0.0.1';
         return {
             type: 'sse',
             host,
@@ -85,7 +85,7 @@ function parseTransportConfig(fileOverrides) {
         const host = getArgValue('--http-host') ||
             fileOverrides?.httpHost ||
             process.env.MCP_HTTP_HOST ||
-            '0.0.0.0';
+            '127.0.0.1';
         return {
             type: 'streamable-http',
             host,

package/dist/proxy/btpProxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"btpProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/btpProxy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,2BAA2B,CAAC;AAYrE,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AA4CnE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAU3C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAGD,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAa;IACzC,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,UAAU,CACN;IACZ,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAU;gBAEZ,oBAAoB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAqF3E;;;OAGG;IACU,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB3D;;;;OAIG;YACW,wBAAwB;IAqFtC;;OAEG;YACW,uBAAuB;IAyFrC;;;;OAIG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,MAAM,CAAC;IAiHlB;;OAEG;IACH,OAAO,CAAC,YAAY;IAapB;;;OAGG;IACH,OAAO,CAAC,UAAU;IASlB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA6BhC;;OAEG;YACW,gBAAgB;IAU9B;;OAEG;IACI,OAAO,IAAI,IAAI;IAOtB;;;OAGG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IAmT/B;;OAEG;IACG,YAAY,CAChB,eAAe,EAAE,YAAY,EAC7B,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,aAAa,CAAC;IAiLzB;;OAEG;WACiB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;CAyB7E;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAEnB"}
+{"version":3,"file":"btpProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/btpProxy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,2BAA2B,CAAC;AAYrE,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AA4CnE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAU3C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAGD,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAa;IACzC,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,UAAU,CACN;IACZ,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAU;gBAEZ,oBAAoB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAqF3E;;;OAGG;IACU,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB3D;;;;OAIG;YACW,wBAAwB;IAqFtC;;OAEG;YACW,uBAAuB;IAyFrC;;;;OAIG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,MAAM,CAAC;IAiHlB;;OAEG;IACH,OAAO,CAAC,YAAY;IAapB;;;OAGG;IACH,OAAO,CAAC,UAAU;IASlB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA6BhC;;OAEG;YACW,gBAAgB;IAU9B;;OAEG;IACI,OAAO,IAAI,IAAI;IAStB;;;OAGG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IAmT/B;;OAEG;IACG,YAAY,CAChB,eAAe,EAAE,YAAY,EAC7B,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,aAAa,CAAC;IAiLzB;;OAEG;WACiB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;CAyB7E;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAEnB"}

package/dist/proxy/btpProxy.js

@@ -474,6 +474,8 @@ class BtpProxy {
             clearTimeout(timer);
         }
         this.refreshTimers.clear();
+        this.tokenCache.clear();
+        this.btpAuthBrokers.clear();
     }
     /**
      * Get the target service URL for a destination.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/proxy",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "MCP proxy server for SAP ABAP ADT - proxies local requests to cloud-llm-hub with JWT authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -19,7 +19,6 @@
     "dev": "npx @modelcontextprotocol/inspector node ./dist/index.js",
     "clean": "rimraf dist tsconfig.tsbuildinfo",
     "prepublishOnly": "npm run build",
-    "test:servers": "node ./tools/start-servers.js",
     "test-destination": "npx tsx tools/test-destination.ts"
   },
   "keywords": [
@@ -64,7 +63,6 @@
     "typescript": "^6.0.3"
   },
   "dependencies": {
-    "@inquirer/prompts": "^8.4.2",
     "@mcp-abap-adt/auth-broker": "^1.0.5",
     "@mcp-abap-adt/auth-providers": "^1.0.5",
     "@mcp-abap-adt/auth-stores": "^1.0.4",

package/dist/tui/index.d.ts

@@ -1,8 +0,0 @@
-/**
- * TUI module barrel export
- */
-export type { ServiceKeyCheckResult } from './serviceKeyCheck.js';
-export { checkServiceKeyExists } from './serviceKeyCheck.js';
-export type { WizardAnswers } from './wizard.js';
-export { generateConfigYaml, runWizard } from './wizard.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/tui/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tui/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}

package/dist/tui/index.js

@@ -1,11 +0,0 @@
-"use strict";
-/**
- * TUI module barrel export
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runWizard = exports.generateConfigYaml = exports.checkServiceKeyExists = void 0;
-var serviceKeyCheck_js_1 = require("./serviceKeyCheck.js");
-Object.defineProperty(exports, "checkServiceKeyExists", { enumerable: true, get: function () { return serviceKeyCheck_js_1.checkServiceKeyExists; } });
-var wizard_js_1 = require("./wizard.js");
-Object.defineProperty(exports, "generateConfigYaml", { enumerable: true, get: function () { return wizard_js_1.generateConfigYaml; } });
-Object.defineProperty(exports, "runWizard", { enumerable: true, get: function () { return wizard_js_1.runWizard; } });

package/dist/tui/serviceKeyCheck.d.ts

@@ -1,25 +0,0 @@
-/**
- * Service key existence checker
- * Checks if a service key file exists for a given BTP destination
- * by searching platform-specific directories.
- */
-/**
- * Result of a service key existence check
- */
-export interface ServiceKeyCheckResult {
-    /** Whether the service key file was found */
-    found: boolean;
-    /** Absolute path to the found service key file (if found) */
-    path?: string;
-    /** Directories that were searched (when not found) */
-    searchedPaths?: string[];
-}
-/**
- * Check if a service key file exists for the given BTP destination.
- * Searches all platform-specific directories returned by getPlatformPaths('service-keys').
- *
- * @param destination - BTP destination name (without .json extension)
- * @returns ServiceKeyCheckResult indicating whether the key was found and where
- */
-export declare function checkServiceKeyExists(destination: string): ServiceKeyCheckResult;
-//# sourceMappingURL=serviceKeyCheck.d.ts.map

package/dist/tui/serviceKeyCheck.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"serviceKeyCheck.d.ts","sourceRoot":"","sources":["../../src/tui/serviceKeyCheck.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,6CAA6C;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,GAClB,qBAAqB,CAYvB"}

package/dist/tui/serviceKeyCheck.js

@@ -1,62 +0,0 @@
-"use strict";
-/**
- * Service key existence checker
- * Checks if a service key file exists for a given BTP destination
- * by searching platform-specific directories.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkServiceKeyExists = checkServiceKeyExists;
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
-const stores_js_1 = require("../lib/stores.js");
-/**
- * Check if a service key file exists for the given BTP destination.
- * Searches all platform-specific directories returned by getPlatformPaths('service-keys').
- *
- * @param destination - BTP destination name (without .json extension)
- * @returns ServiceKeyCheckResult indicating whether the key was found and where
- */
-function checkServiceKeyExists(destination) {
-    const searchDirs = (0, stores_js_1.getPlatformPaths)('service-keys');
-    const fileName = `${destination}.json`;
-    for (const dir of searchDirs) {
-        const filePath = path.join(dir, fileName);
-        if (fs.existsSync(filePath)) {
-            return { found: true, path: filePath };
-        }
-    }
-    return { found: false, searchedPaths: searchDirs };
-}

package/dist/tui/wizard.d.ts

@@ -1,38 +0,0 @@
-/**
- * TUI wizard for interactive proxy configuration
- */
-/**
- * Answers collected by the wizard
- */
-export interface WizardAnswers {
-    scenario: 'btp' | 'direct';
-    btpDestination?: string;
-    targetUrl?: string;
-    mcpDestination?: string;
-    mcpUrl?: string;
-    transport: 'stdio' | 'http' | 'sse';
-    httpHost?: string;
-    httpPort?: number;
-    sseHost?: string;
-    ssePort?: number;
-    browser: 'system' | 'headless' | 'chrome' | 'edge' | 'firefox' | 'none';
-    browserAuthPort: number;
-    unsafe: boolean;
-    logLevel: string;
-    maxRetries?: number;
-    retryDelay?: number;
-    requestTimeout?: number;
-    circuitBreakerThreshold?: number;
-    circuitBreakerTimeout?: number;
-    cloudLlmHubUrl?: string;
-}
-/**
- * Generate a YAML configuration string from wizard answers.
- * The output follows the structure of docs/mcp-proxy-config.example.yaml.
- */
-export declare function generateConfigYaml(answers: WizardAnswers): string;
-/**
- * Run the interactive configuration wizard
- */
-export declare function runWizard(): Promise<WizardAnswers>;
-//# sourceMappingURL=wizard.d.ts.map

package/dist/tui/wizard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"wizard.d.ts","sourceRoot":"","sources":["../../src/tui/wizard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;IACxE,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAWD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CA+FjE;AAeD;;GAEG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC,CAwMxD"}

package/dist/tui/wizard.js

@@ -1,321 +0,0 @@
-"use strict";
-/**
- * TUI wizard for interactive proxy configuration
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateConfigYaml = generateConfigYaml;
-exports.runWizard = runWizard;
-const fs = __importStar(require("node:fs"));
-const serviceKeyCheck_js_1 = require("./serviceKeyCheck.js");
-/** Default values for advanced settings */
-const DEFAULTS = {
-    maxRetries: 3,
-    retryDelay: 1000,
-    requestTimeout: 60000,
-    circuitBreakerThreshold: 5,
-    circuitBreakerTimeout: 60000,
-};
-/**
- * Generate a YAML configuration string from wizard answers.
- * The output follows the structure of docs/mcp-proxy-config.example.yaml.
- */
-function generateConfigYaml(answers) {
-    const lines = [];
-    lines.push('# MCP ABAP ADT Proxy Configuration');
-    lines.push('');
-    // Transport configuration
-    lines.push('# Transport configuration');
-    lines.push(`transport: ${answers.transport}  # stdio | http | sse`);
-    if (answers.transport === 'http' || answers.transport === 'sse') {
-        lines.push(`httpPort: ${answers.httpPort ?? 3001}`);
-        lines.push(`httpHost: "${answers.httpHost ?? '0.0.0.0'}"`);
-    }
-    if (answers.transport === 'sse') {
-        lines.push(`ssePort: ${answers.ssePort ?? 3002}`);
-        lines.push(`sseHost: "${answers.sseHost ?? '0.0.0.0'}"`);
-    }
-    lines.push('');
-    // Destination overrides
-    lines.push('# Destination overrides');
-    if (answers.scenario === 'btp') {
-        if (answers.btpDestination) {
-            lines.push(`btpDestination: "${answers.btpDestination}"`);
-        }
-        if (answers.targetUrl) {
-            lines.push(`targetUrl: "${answers.targetUrl}"`);
-        }
-        if (answers.mcpDestination) {
-            lines.push(`mcpDestination: "${answers.mcpDestination}"`);
-        }
-        if (answers.mcpUrl) {
-            lines.push(`# mcpUrl: "${answers.mcpUrl}"`);
-        }
-        else {
-            lines.push('# mcpUrl:');
-        }
-    }
-    else {
-        lines.push('# btpDestination:');
-        lines.push('# mcpDestination:');
-        if (answers.mcpUrl) {
-            lines.push(`mcpUrl: "${answers.mcpUrl}"`);
-        }
-    }
-    lines.push('');
-    // Browser authentication
-    lines.push('# Browser authentication');
-    lines.push(`browser: "${answers.browser}"`);
-    lines.push(`browserAuthPort: ${answers.browserAuthPort}`);
-    lines.push('');
-    // Session storage mode
-    lines.push('# Session storage mode');
-    lines.push(`unsafe: ${answers.unsafe}  # If true, persists tokens to disk`);
-    lines.push('');
-    // Error handling & resilience
-    lines.push('# Error handling & resilience');
-    lines.push(`maxRetries: ${answers.maxRetries ?? DEFAULTS.maxRetries}`);
-    lines.push(`retryDelay: ${answers.retryDelay ?? DEFAULTS.retryDelay}  # milliseconds`);
-    lines.push(`requestTimeout: ${answers.requestTimeout ?? DEFAULTS.requestTimeout}  # milliseconds`);
-    lines.push(`circuitBreakerThreshold: ${answers.circuitBreakerThreshold ?? DEFAULTS.circuitBreakerThreshold}`);
-    lines.push(`circuitBreakerTimeout: ${answers.circuitBreakerTimeout ?? DEFAULTS.circuitBreakerTimeout}  # milliseconds`);
-    lines.push('');
-    // Logging
-    lines.push('# Logging');
-    lines.push(`logLevel: "${answers.logLevel}"  # debug | info | warn | error`);
-    // Cloud LLM Hub URL
-    if (answers.cloudLlmHubUrl) {
-        lines.push('');
-        lines.push('# Cloud LLM Hub URL');
-        lines.push(`cloudLlmHubUrl: "${answers.cloudLlmHubUrl}"`);
-    }
-    lines.push('');
-    return lines.join('\n');
-}
-/**
- * Print a service key check result to the console.
- */
-function printServiceKeyCheck(destination) {
-    const result = (0, serviceKeyCheck_js_1.checkServiceKeyExists)(destination);
-    if (result.found) {
-        console.log(`  Found: ${result.path}`);
-    }
-    else {
-        console.log(`  Warning: Service key file not found for "${destination}".`);
-        console.log(`  Searched: ${result.searchedPaths?.join(', ') ?? '(none)'}`);
-    }
-}
-/**
- * Run the interactive configuration wizard
- */
-async function runWizard() {
-    try {
-        const { select, input, confirm, number } = await import('@inquirer/prompts');
-        console.log('\n  MCP ABAP ADT Proxy — Configuration Wizard\n');
-        // 1. Scenario
-        const scenario = await select({
-            message: 'Select scenario:',
-            choices: [
-                {
-                    name: 'BTP service (XSUAA auth via service key)',
-                    value: 'btp',
-                },
-                {
-                    name: 'Direct MCP server URL (no auth)',
-                    value: 'direct',
-                },
-            ],
-        });
-        const answers = { scenario };
-        // 2. Scenario-specific questions
-        if (scenario === 'btp') {
-            const btpDestination = await input({
-                message: 'BTP destination name:',
-                required: true,
-            });
-            answers.btpDestination = btpDestination;
-            printServiceKeyCheck(btpDestination);
-            const targetUrl = await input({
-                message: 'Target service URL (leave empty if in service key):',
-                default: '',
-            });
-            if (targetUrl) {
-                answers.targetUrl = targetUrl;
-            }
-            const addMcpDest = await confirm({
-                message: 'Add MCP destination (for ABAP connection params on Cloud)?',
-                default: false,
-            });
-            if (addMcpDest) {
-                const mcpDestination = await input({
-                    message: 'MCP destination name:',
-                    required: true,
-                });
-                answers.mcpDestination = mcpDestination;
-                printServiceKeyCheck(mcpDestination);
-            }
-        }
-        else {
-            const mcpUrl = await input({
-                message: 'MCP server URL:',
-                required: true,
-            });
-            answers.mcpUrl = mcpUrl;
-        }
-        // 3. Transport
-        const transport = await select({
-            message: 'Select transport:',
-            choices: [
-                { name: 'stdio', value: 'stdio' },
-                { name: 'streamable-http', value: 'http' },
-                { name: 'sse', value: 'sse' },
-            ],
-        });
-        answers.transport = transport;
-        // 4. Transport-specific settings
-        if (transport !== 'stdio') {
-            answers.httpHost = await input({
-                message: 'HTTP host:',
-                default: '0.0.0.0',
-            });
-            answers.httpPort = await number({
-                message: 'HTTP port:',
-                default: 3001,
-                min: 1,
-                max: 65535,
-            });
-            if (transport === 'sse') {
-                answers.sseHost = await input({
-                    message: 'SSE host:',
-                    default: '0.0.0.0',
-                });
-                answers.ssePort = await number({
-                    message: 'SSE port:',
-                    default: 3002,
-                    min: 1,
-                    max: 65535,
-                });
-            }
-        }
-        // 5. Browser
-        answers.browser = await select({
-            message: 'Select browser for OAuth2 login:',
-            choices: [
-                { name: 'system (default browser)', value: 'system' },
-                { name: 'chrome', value: 'chrome' },
-                { name: 'edge', value: 'edge' },
-                { name: 'firefox', value: 'firefox' },
-                { name: 'headless', value: 'headless' },
-                { name: 'none (disable)', value: 'none' },
-            ],
-        });
-        // 6. OAuth2 callback port
-        answers.browserAuthPort = await number({
-            message: 'OAuth2 callback port:',
-            default: 3333,
-        });
-        // 7. Unsafe mode
-        answers.unsafe = await confirm({
-            message: 'Unsafe mode (persist tokens to disk)?',
-            default: false,
-        });
-        // 8. Log level
-        answers.logLevel = await select({
-            message: 'Log level:',
-            choices: [
-                { name: 'debug', value: 'debug' },
-                { name: 'info', value: 'info' },
-                { name: 'warn', value: 'warn' },
-                { name: 'error', value: 'error' },
-            ],
-            default: 'info',
-        });
-        // 9. Advanced settings
-        const configureAdvanced = await confirm({
-            message: 'Configure advanced settings?',
-            default: false,
-        });
-        if (configureAdvanced) {
-            answers.maxRetries = await number({
-                message: 'Max retries:',
-                default: DEFAULTS.maxRetries,
-            });
-            answers.retryDelay = await number({
-                message: 'Retry delay (ms):',
-                default: DEFAULTS.retryDelay,
-            });
-            answers.requestTimeout = await number({
-                message: 'Request timeout (ms):',
-                default: DEFAULTS.requestTimeout,
-            });
-            answers.circuitBreakerThreshold = await number({
-                message: 'Circuit breaker threshold:',
-                default: DEFAULTS.circuitBreakerThreshold,
-            });
-            answers.circuitBreakerTimeout = await number({
-                message: 'Circuit breaker timeout (ms):',
-                default: DEFAULTS.circuitBreakerTimeout,
-            });
-            const setCloudUrl = await confirm({
-                message: 'Set Cloud LLM Hub URL?',
-                default: false,
-            });
-            if (setCloudUrl) {
-                answers.cloudLlmHubUrl = await input({
-                    message: 'Cloud LLM Hub URL:',
-                    required: true,
-                });
-            }
-        }
-        // 10. Output file
-        const outputPath = await input({
-            message: 'Output file path:',
-            default: './mcp-proxy-config.yaml',
-        });
-        // Generate and write config
-        const fullAnswers = answers;
-        const yaml = generateConfigYaml(fullAnswers);
-        fs.writeFileSync(outputPath, yaml, 'utf-8');
-        console.log(`\nConfig saved to: ${outputPath}`);
-        console.log(`Run with: mcp-abap-adt-proxy --config ${outputPath}`);
-        return fullAnswers;
-    }
-    catch (error) {
-        if (error instanceof Error && error.name === 'ExitPromptError') {
-            process.exit(0);
-        }
-        throw error;
-    }
-}