@oobe-protocol-labs/sap-mcp-server 0.2.1 → 0.7.0

package/dist/config/mcp-client-injection.js

@@ -2,6 +2,14 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from
 import { homedir } from 'os';
 import { dirname, join } from 'path';
 const SAP_SERVER_NAME = 'sap';
+const SAP_PAYMENT_BRIDGE_SERVER_NAME = 'sap_payments';
+const X402_PAID_CALL_ADDON_ID = 'x402-paid-call';
+const X402_PAID_CALL_COMMAND = 'sap-mcp-x402-paid-call';
+const X402_PAYMENT_BRIDGE_TOOLS = [
+    'sap_x402_paid_call',
+    'sap_profile_current',
+    'sap_x402_estimate_cost',
+];
 /**
  * @name HOSTED_SAP_MCP_URL
  * @description Public OOBE hosted SAP MCP Streamable HTTP endpoint used in manual client setup snippets.
@@ -30,6 +38,16 @@ function isRecord(value) {
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
+/**
+ * @name shellQuote
+ * @description Quotes a command argument for copy/paste shell snippets.
+ */
+function shellQuote(value) {
+    if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) {
+        return value;
+    }
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
 /**
  * @name readTargetContent
  * @description Reads an existing target file or returns a format-appropriate empty config.
@@ -81,19 +99,55 @@ export function createCanonicalServerConfig(workspaceRoot = process.cwd()) {
  * @description Builds copy/paste JSON snippets for hosted remote and local active-profile MCP client setup.
  */
 export function createManualMcpJsonSnippets(canonical, hostedUrl = HOSTED_SAP_MCP_URL) {
+    const hostedConfig = {
+        url: hostedUrl,
+        transport: 'streamable-http',
+    };
     return [
         {
-            title: 'Hosted SAP MCP JSON',
-            description: 'Use this after creating the user SAP profile with the wizard; the agent connects remotely while signatures stay user-controlled.',
+            title: 'Hosted SAP MCP JSON (Claude and generic MCP clients)',
+            description: 'Use this for clients whose config expects a root mcpServers map. Do not paste this into Codex config.toml or OpenClaw gateway config.',
             content: formatJson({
                 mcpServers: {
-                    [SAP_SERVER_NAME]: {
-                        url: hostedUrl,
-                        transport: 'streamable-http',
-                    },
+                    [SAP_SERVER_NAME]: hostedConfig,
                 },
             }),
         },
+        {
+            title: 'Hosted SAP MCP TOML (Codex config.toml)',
+            description: 'Use this for Codex ~/.codex/config.toml. Codex supports Streamable HTTP MCP servers with a url-based TOML entry.',
+            content: hostedTomlServerBlock(hostedConfig),
+        },
+        {
+            title: 'Hosted SAP MCP JSON (Hermes global mcp.json)',
+            description: 'Use this for ~/.hermes/mcp.json, which expects flat server entries rather than a nested mcpServers map.',
+            content: formatJson({
+                [SAP_SERVER_NAME]: hostedConfig,
+            }),
+        },
+        {
+            title: 'Hosted SAP MCP YAML (Hermes profile config.yaml)',
+            description: 'Use this inside Hermes profile YAML files under the top-level mcp_servers section.',
+            content: [
+                'mcp_servers:',
+                `  ${SAP_SERVER_NAME}:`,
+                `    url: ${hostedUrl}`,
+                '    transport: streamable-http',
+                '',
+            ].join('\n'),
+        },
+        {
+            title: 'Hosted SAP MCP YAML (OpenClaw gateway config)',
+            description: 'Use this inside OpenClaw gateway YAML config under the top-level mcp.servers section.',
+            content: [
+                'mcp:',
+                '  servers:',
+                `    ${SAP_SERVER_NAME}:`,
+                `      url: ${hostedUrl}`,
+                '      transport: streamable-http',
+                '',
+            ].join('\n'),
+        },
         {
             title: 'Local SAP MCP JSON',
             description: 'Use this when the agent runs SAP MCP locally and follows ~/.config/mcp-sap/.active-profile.',
@@ -103,28 +157,267 @@ export function createManualMcpJsonSnippets(canonical, hostedUrl = HOSTED_SAP_MC
                 },
             }),
         },
+        {
+            title: 'Local SAP MCP TOML (Codex config.toml)',
+            description: 'Use this when you specifically want Codex to launch the local stdio SAP MCP server through npx and follow the active profile manager.',
+            content: tomlServerBlock(createNpxCodexServerConfig()),
+        },
     ];
 }
 /**
- * @name getKnownClientTargets
- * @description Returns known MCP client config paths for the current operating system.
+ * @name createNpxCodexServerConfig
+ * @description Builds a portable Codex stdio config that works without a source checkout.
  */
-export function getKnownClientTargets(homeDir = homedir()) {
-    const targets = [
+export function createNpxCodexServerConfig() {
+    const command = process.platform === 'win32' ? 'npx.cmd' : 'npx';
+    return {
+        command,
+        args: [
+            '--yes',
+            '--package',
+            '@oobe-protocol-labs/sap-mcp-server',
+            'sap-mcp-server',
+        ],
+        env: {
+            SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE: 'false',
+            SAP_LOG_LEVEL: 'info',
+        },
+    };
+}
+/**
+ * @name createNpxPaymentBridgeServerConfig
+ * @description Builds a portable local stdio MCP config that exposes only x402 payment helper tools.
+ */
+export function createNpxPaymentBridgeServerConfig() {
+    const command = process.platform === 'win32' ? 'npx.cmd' : 'npx';
+    return {
+        command,
+        args: [
+            '--yes',
+            '--package',
+            '@oobe-protocol-labs/sap-mcp-server',
+            'sap-mcp-server',
+        ],
+        env: {
+            SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE: 'false',
+            SAP_ALLOWED_TOOLS: X402_PAYMENT_BRIDGE_TOOLS.join(','),
+            SAP_LOG_LEVEL: 'info',
+        },
+    };
+}
+/**
+ * @name createX402PaidCallAddonSnippets
+ * @description Builds manual plugin/addon snippets for clients that can call a local x402 payment helper.
+ */
+export function createX402PaidCallAddonSnippets() {
+    const paymentBridge = createNpxPaymentBridgeServerConfig();
+    return [
+        {
+            title: 'Codex Payment Bridge TOML',
+            description: 'Use this in ~/.codex/config.toml beside the hosted [mcp_servers.sap] entry. Codex will see only payment helper tools from this local bridge.',
+            content: codexPaymentBridgeTomlBlock(paymentBridge),
+        },
+        {
+            title: 'Claude Code Payment Bridge Commands',
+            description: 'Use the official Claude Code MCP CLI flow: add hosted SAP MCP over HTTP, then add this local stdio bridge for x402 payment retries.',
+            content: [
+                `claude mcp add --transport http ${SAP_SERVER_NAME} ${HOSTED_SAP_MCP_URL}`,
+                `claude mcp add --transport stdio ${SAP_PAYMENT_BRIDGE_SERVER_NAME} -- ${paymentBridge.command} ${paymentBridge.args.map(shellQuote).join(' ')}`,
+                '',
+                'Then ask Claude to call sap_payments.sap_x402_paid_call for hosted paid/write SAP MCP tools.',
+                '',
+            ].join('\n'),
+        },
+        {
+            title: 'Claude Desktop Payment Bridge JSON',
+            description: 'Use this for Claude-style JSON config files with a root mcpServers map.',
+            content: formatJson({
+                mcpServers: {
+                    [SAP_SERVER_NAME]: {
+                        type: 'http',
+                        url: HOSTED_SAP_MCP_URL,
+                    },
+                    [SAP_PAYMENT_BRIDGE_SERVER_NAME]: paymentBridge,
+                },
+            }),
+        },
+        {
+            title: 'Hermes Payment Bridge YAML',
+            description: 'Use this inside Hermes profile config.yaml under mcp_servers when Hermes does not already have the x402 plugin installed.',
+            content: [
+                'mcp_servers:',
+                `  ${SAP_SERVER_NAME}:`,
+                `    url: ${HOSTED_SAP_MCP_URL}`,
+                '    transport: streamable-http',
+                `  ${SAP_PAYMENT_BRIDGE_SERVER_NAME}:`,
+                `    command: ${paymentBridge.command}`,
+                '    args:',
+                ...paymentBridge.args.map((arg) => `    - ${arg}`),
+                '    env:',
+                ...Object.entries(paymentBridge.env).map(([key, value]) => `      ${key}: ${value === 'false' || value === 'true' ? `"${value}"` : value}`),
+                '',
+            ].join('\n'),
+        },
+        {
+            title: 'OpenClaw Payment Bridge JSON',
+            description: 'Use this for OpenClaw gateway JSON config, which expects named servers under mcp.servers.',
+            content: formatJson({
+                mcp: {
+                    servers: {
+                        [SAP_SERVER_NAME]: {
+                            url: HOSTED_SAP_MCP_URL,
+                            transport: 'streamable-http',
+                        },
+                        [SAP_PAYMENT_BRIDGE_SERVER_NAME]: paymentBridge,
+                    },
+                },
+            }),
+        },
+        {
+            title: 'Generic Payment Bridge JSON',
+            description: 'Use this only for MCP clients that explicitly accept JSON mcpServers entries for one remote server plus one local stdio bridge.',
+            content: formatJson({
+                mcpServers: {
+                    [SAP_SERVER_NAME]: {
+                        url: HOSTED_SAP_MCP_URL,
+                        transport: 'streamable-http',
+                    },
+                    [SAP_PAYMENT_BRIDGE_SERVER_NAME]: paymentBridge,
+                },
+            }),
+        },
+        {
+            title: 'Hermes Addon: x402_paid_call',
+            description: 'Use this concept for Hermes plugin/addon registries that expose local command-backed tools.',
+            content: formatJson({
+                plugins: {
+                    x402_paid_call: {
+                        command: X402_PAID_CALL_COMMAND,
+                        description: 'Pay and retry hosted SAP MCP x402 tool calls with the active local SAP MCP profile.',
+                        args: [],
+                        env: {
+                            SAP_MCP_ALLOW_ENV_CONFIG_OVERRIDE: 'false',
+                        },
+                    },
+                },
+            }),
+        },
+        {
+            title: 'Claude/Codex/OpenClaw Addon Command',
+            description: 'Use this command from a local tool/plugin wrapper when the client supports command-backed addons.',
+            content: [
+                `${X402_PAID_CALL_COMMAND} \\`,
+                '  --tool sap_list_all_agents \\',
+                '  --arguments \'{"limit":5}\' \\',
+                '  --max-usd 0.02 \\',
+                '  --confirm',
+                '',
+            ].join('\n'),
+        },
+        {
+            title: 'Local MCP Tool Alternative',
+            description: 'When the local SAP MCP stdio server is installed, agents can call sap_x402_paid_call instead of using a runtime-specific plugin.',
+            content: formatJson({
+                name: 'sap_x402_paid_call',
+                arguments: {
+                    toolName: 'sap_list_all_agents',
+                    arguments: { limit: 5 },
+                    maxPriceUsd: 0.02,
+                    confirm: true,
+                },
+            }),
+        },
+    ];
+}
+/**
+ * @name installX402PaidCallAddon
+ * @description Installs a portable local addon bundle with manifest and client snippets.
+ */
+export function installX402PaidCallAddon(targetDir = join(homedir(), '.config', 'mcp-sap', 'addons', X402_PAID_CALL_ADDON_ID)) {
+    mkdirSync(targetDir, { recursive: true, mode: 0o700 });
+    const manifestPath = join(targetDir, 'manifest.json');
+    const readmePath = join(targetDir, 'README.md');
+    const snippetsPath = join(targetDir, 'client-snippets.json');
+    const files = [manifestPath, readmePath, snippetsPath];
+    writeFileSync(manifestPath, formatJson({
+        id: X402_PAID_CALL_ADDON_ID,
+        name: 'SAP MCP x402 Paid Call',
+        command: X402_PAID_CALL_COMMAND,
+        toolName: 'x402_paid_call',
+        localMcpToolName: 'sap_x402_paid_call',
+        description: 'Local payment helper for hosted SAP MCP paid tools. It signs x402 payment payloads with the user-controlled SAP MCP profile signer.',
+        security: {
+            readsLocalKeypairFileForSigning: true,
+            printsKeypairBytes: false,
+            sendsKeypairBytesToHostedServer: false,
+            requiresConfirm: true,
+            requiresMaxPriceUsd: true,
+        },
+    }), { encoding: 'utf-8', mode: 0o600 });
+    writeFileSync(readmePath, [
+        '# SAP MCP x402 Paid Call Addon',
+        '',
+        'This addon lets local agent runtimes pay hosted SAP MCP x402 tool challenges without giving OOBE or the hosted server user keypair bytes.',
+        '',
+        'Use the command directly from a runtime-specific plugin wrapper:',
+        '',
+        '```bash',
+        `${X402_PAID_CALL_COMMAND} --tool sap_list_all_agents --arguments '{"limit":5}' --max-usd 0.02 --confirm`,
+        '```',
+        '',
+        'Or call the local SAP MCP tool `sap_x402_paid_call` when local stdio SAP MCP is available.',
+        '',
+        'Security rules:',
+        '',
+        '- keep keypair files under `~/.config/mcp-sap` or use a future external signing bridge;',
+        '- never paste keypair bytes into agent config;',
+        '- always set `maxPriceUsd` / `--max-usd`;',
+        '- `confirm: true` / `--confirm` is required because a payment payload is signed.',
+        '',
+    ].join('\n'), { encoding: 'utf-8', mode: 0o600 });
+    writeFileSync(snippetsPath, formatJson({
+        snippets: createX402PaidCallAddonSnippets(),
+    }), { encoding: 'utf-8', mode: 0o600 });
+    return {
+        addonId: X402_PAID_CALL_ADDON_ID,
+        targetDir,
+        files,
+    };
+}
+/**
+ * @name getClaudeConfigTargets
+ * @description Returns Claude config targets for the host platform without relying on shell-specific environment variables.
+ */
+function getClaudeConfigTargets(homeDir, platform) {
+    const baseDir = platform === 'win32'
+        ? join(homeDir, 'AppData', 'Roaming', 'Claude')
+        : platform === 'darwin'
+            ? join(homeDir, 'Library', 'Application Support', 'Claude')
+            : join(homeDir, '.config', 'Claude');
+    return [
         {
             id: 'claude',
             label: 'Claude Desktop',
-            path: join(homeDir, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json'),
+            path: join(baseDir, 'claude_desktop_config.json'),
             format: 'json',
             exists: false,
         },
         {
             id: 'claude',
             label: 'Claude App Config',
-            path: join(homeDir, 'Library', 'Application Support', 'Claude', 'config.json'),
+            path: join(baseDir, 'config.json'),
             format: 'json',
             exists: false,
         },
+    ];
+}
+/**
+ * @name getKnownClientTargets
+ * @description Returns known MCP client config paths for the current operating system.
+ */
+export function getKnownClientTargets(homeDir = homedir(), platform = process.platform) {
+    const targets = [
+        ...getClaudeConfigTargets(homeDir, platform),
         {
             id: 'hermes',
             label: 'Hermes Global MCP',
@@ -177,13 +470,15 @@ export function getKnownClientTargets(homeDir = homedir()) {
  * @name discoverMcpClientTargets
  * @description Finds existing client config files and keeps create-capable standard targets.
  */
-export function discoverMcpClientTargets(homeDir = homedir()) {
-    const targets = getKnownClientTargets(homeDir);
+export function discoverMcpClientTargets(homeDir = homedir(), platform = process.platform) {
+    const targets = getKnownClientTargets(homeDir, platform);
     return targets.filter((target) => {
         if (target.exists) {
             return true;
         }
         return target.path.endsWith('claude_desktop_config.json')
+            || target.path.endsWith(join('.hermes', 'mcp.json'))
+            || target.path.endsWith(join('.codex', 'config.toml'))
             || target.path.endsWith(join('.openclaw', 'mcp.json'));
     });
 }
@@ -250,9 +545,91 @@ function buildJsonContent(content, canonical, mode) {
         hadSapConfig,
     };
 }
+/**
+ * @name hostedJsonServerConfig
+ * @description Builds the hosted SAP MCP server object for JSON-based clients.
+ */
+function hostedJsonServerConfig(target) {
+    if (target.id === 'claude') {
+        return {
+            type: 'http',
+            url: HOSTED_SAP_MCP_URL,
+        };
+    }
+    return {
+        url: HOSTED_SAP_MCP_URL,
+        transport: 'streamable-http',
+    };
+}
+/**
+ * @name buildHostedPaymentBridgeJsonContent
+ * @description Builds JSON config with hosted SAP MCP plus local x402 payment bridge.
+ */
+function buildHostedPaymentBridgeJsonContent(content, target) {
+    const parsed = content.trim() ? JSON.parse(content) : {};
+    const root = isRecord(parsed) ? parsed : {};
+    const paymentBridge = createNpxPaymentBridgeServerConfig();
+    if (target.id === 'openclaw') {
+        return buildOpenClawHostedPaymentBridgeJsonContent(root, paymentBridge);
+    }
+    if (target.id === 'hermes') {
+        const hadSapConfig = isRecord(root[SAP_SERVER_NAME]) || isRecord(root[SAP_PAYMENT_BRIDGE_SERVER_NAME]);
+        return {
+            nextContent: formatJson({
+                ...root,
+                [SAP_SERVER_NAME]: hostedJsonServerConfig(target),
+                [SAP_PAYMENT_BRIDGE_SERVER_NAME]: paymentBridge,
+            }),
+            hadSapConfig,
+        };
+    }
+    const serversRaw = root.mcpServers;
+    const servers = isRecord(serversRaw) ? { ...serversRaw } : {};
+    const hadSapConfig = isRecord(servers[SAP_SERVER_NAME]) || isRecord(servers[SAP_PAYMENT_BRIDGE_SERVER_NAME]);
+    servers[SAP_SERVER_NAME] = hostedJsonServerConfig(target);
+    servers[SAP_PAYMENT_BRIDGE_SERVER_NAME] = paymentBridge;
+    return {
+        nextContent: formatJson({ ...root, mcpServers: servers }),
+        hadSapConfig,
+    };
+}
+/**
+ * @name buildOpenClawHostedPaymentBridgeJsonContent
+ * @description Builds OpenClaw gateway JSON using the documented `mcp.servers` shape.
+ */
+function buildOpenClawHostedPaymentBridgeJsonContent(root, paymentBridge) {
+    const mcp = isRecord(root.mcp) ? { ...root.mcp } : {};
+    const servers = isRecord(mcp.servers) ? { ...mcp.servers } : {};
+    const legacyServers = isRecord(root.mcpServers) ? { ...root.mcpServers } : undefined;
+    const hadSapConfig = isRecord(servers[SAP_SERVER_NAME])
+        || isRecord(servers[SAP_PAYMENT_BRIDGE_SERVER_NAME])
+        || Boolean(legacyServers && (isRecord(legacyServers[SAP_SERVER_NAME])
+            || isRecord(legacyServers[SAP_PAYMENT_BRIDGE_SERVER_NAME])));
+    servers[SAP_SERVER_NAME] = hostedJsonServerConfig({ id: 'openclaw' });
+    servers[SAP_PAYMENT_BRIDGE_SERVER_NAME] = paymentBridge;
+    mcp.servers = servers;
+    const nextRoot = {
+        ...root,
+        mcp,
+    };
+    if (legacyServers) {
+        delete legacyServers[SAP_SERVER_NAME];
+        delete legacyServers[SAP_PAYMENT_BRIDGE_SERVER_NAME];
+        if (Object.keys(legacyServers).length > 0) {
+            nextRoot.mcpServers = legacyServers;
+        }
+        else {
+            delete nextRoot.mcpServers;
+        }
+    }
+    return {
+        nextContent: formatJson(nextRoot),
+        hadSapConfig,
+    };
+}
 /**
  * @name yamlServerBlock
- * @description Renders a Hermes/OpenClaw-compatible YAML MCP server block.
+ * @description Renders a Hermes-compatible YAML MCP server block.
  */
 function yamlServerBlock(canonical, baseIndent = 0) {
     const indent = ' '.repeat(baseIndent);
@@ -276,6 +653,45 @@ function yamlServerBlock(canonical, baseIndent = 0) {
     }
     return lines;
 }
+/**
+ * @name yamlHostedServerBlock
+ * @description Renders a hosted Streamable HTTP MCP server block for Hermes/OpenClaw YAML configs.
+ */
+function yamlHostedServerBlock(serverName, baseIndent = 0) {
+    const indent = ' '.repeat(baseIndent);
+    const child = ' '.repeat(baseIndent + 2);
+    return [
+        `${indent}${serverName}:`,
+        `${child}url: ${HOSTED_SAP_MCP_URL}`,
+        `${child}transport: streamable-http`,
+    ];
+}
+/**
+ * @name yamlCommandServerBlock
+ * @description Renders a command-backed MCP server block for Hermes/OpenClaw YAML configs.
+ */
+function yamlCommandServerBlock(serverName, canonical, baseIndent = 0) {
+    const indent = ' '.repeat(baseIndent);
+    const child = ' '.repeat(baseIndent + 2);
+    const grandchild = ' '.repeat(baseIndent + 4);
+    const lines = [
+        `${indent}${serverName}:`,
+        `${child}command: ${canonical.command}`,
+        `${child}args:`,
+    ];
+    for (const arg of canonical.args) {
+        lines.push(`${child}- ${arg}`);
+    }
+    if (canonical.cwd) {
+        lines.push(`${child}cwd: ${canonical.cwd}`);
+    }
+    lines.push(`${child}env:`);
+    for (const [key, value] of Object.entries(canonical.env)) {
+        const rendered = value === 'false' || value === 'true' ? `"${value}"` : value;
+        lines.push(`${grandchild}${key}: ${rendered}`);
+    }
+    return lines;
+}
 /**
  * @name countLeadingSpaces
  * @description Counts indentation spaces at the start of a YAML line.
@@ -322,6 +738,99 @@ function replaceYamlSapBlock(content, canonical) {
         hadSapConfig: true,
     };
 }
+/**
+ * @name replaceYamlHostedPaymentBridgeBlocks
+ * @description Replaces or appends hosted SAP MCP plus local x402 bridge blocks under mcp_servers.
+ */
+function replaceYamlHostedPaymentBridgeBlocks(content) {
+    const lines = content.split(/\r?\n/);
+    const paymentBridge = createNpxPaymentBridgeServerConfig();
+    const replacement = [
+        ...yamlHostedServerBlock(SAP_SERVER_NAME, 2),
+        ...yamlCommandServerBlock(SAP_PAYMENT_BRIDGE_SERVER_NAME, paymentBridge, 2),
+    ];
+    const mcpIndex = lines.findIndex((line) => /^mcp_servers:\s*$/.test(line));
+    if (mcpIndex === -1) {
+        const prefix = content.trimEnd();
+        const appended = ['mcp_servers:', ...replacement].join('\n');
+        return {
+            nextContent: `${prefix ? `${prefix}\n` : ''}${appended}\n`,
+            hadSapConfig: false,
+        };
+    }
+    const nextLines = [...lines];
+    let hadSapConfig = false;
+    for (const serverName of [SAP_SERVER_NAME, SAP_PAYMENT_BRIDGE_SERVER_NAME]) {
+        const serverIndex = nextLines.findIndex((line, index) => index > mcpIndex && new RegExp(`^ {2}${escapeRegExp(serverName)}:\\s*$`).test(line));
+        if (serverIndex === -1) {
+            continue;
+        }
+        hadSapConfig = true;
+        let endIndex = serverIndex + 1;
+        while (endIndex < nextLines.length) {
+            const line = nextLines[endIndex];
+            if (line.trim() && countLeadingSpaces(line) <= 2) {
+                break;
+            }
+            endIndex += 1;
+        }
+        nextLines.splice(serverIndex, endIndex - serverIndex);
+    }
+    nextLines.splice(mcpIndex + 1, 0, ...replacement);
+    return {
+        nextContent: `${nextLines.join('\n').replace(/\n*$/, '')}\n`,
+        hadSapConfig,
+    };
+}
+/**
+ * @name replaceOpenClawYamlHostedPaymentBridgeBlocks
+ * @description Replaces or appends hosted SAP MCP plus local x402 bridge blocks under OpenClaw `mcp.servers`.
+ */
+function replaceOpenClawYamlHostedPaymentBridgeBlocks(content) {
+    const lines = content.split(/\r?\n/);
+    const paymentBridge = createNpxPaymentBridgeServerConfig();
+    const replacement = [
+        ...yamlHostedServerBlock(SAP_SERVER_NAME, 4),
+        ...yamlCommandServerBlock(SAP_PAYMENT_BRIDGE_SERVER_NAME, paymentBridge, 4),
+    ];
+    const mcpIndex = lines.findIndex((line) => /^mcp:\s*$/.test(line));
+    if (mcpIndex === -1) {
+        const prefix = content.trimEnd();
+        const appended = ['mcp:', '  servers:', ...replacement].join('\n');
+        return {
+            nextContent: `${prefix ? `${prefix}\n` : ''}${appended}\n`,
+            hadSapConfig: false,
+        };
+    }
+    const nextLines = [...lines];
+    let serversIndex = nextLines.findIndex((line, index) => index > mcpIndex && /^ {2}servers:\s*$/.test(line));
+    if (serversIndex === -1) {
+        serversIndex = mcpIndex + 1;
+        nextLines.splice(serversIndex, 0, '  servers:');
+    }
+    let hadSapConfig = false;
+    for (const serverName of [SAP_SERVER_NAME, SAP_PAYMENT_BRIDGE_SERVER_NAME]) {
+        const serverIndex = nextLines.findIndex((line, index) => index > serversIndex && new RegExp(`^ {4}${escapeRegExp(serverName)}:\\s*$`).test(line));
+        if (serverIndex === -1) {
+            continue;
+        }
+        hadSapConfig = true;
+        let endIndex = serverIndex + 1;
+        while (endIndex < nextLines.length) {
+            const line = nextLines[endIndex];
+            if (line.trim() && countLeadingSpaces(line) <= 4) {
+                break;
+            }
+            endIndex += 1;
+        }
+        nextLines.splice(serverIndex, endIndex - serverIndex);
+    }
+    nextLines.splice(serversIndex + 1, 0, ...replacement);
+    return {
+        nextContent: `${nextLines.join('\n').replace(/\n*$/, '')}\n`,
+        hadSapConfig,
+    };
+}
 /**
  * @name tomlServerBlock
  * @description Renders a Codex-compatible TOML MCP server block.
@@ -343,6 +852,38 @@ function tomlServerBlock(canonical) {
     }
     return lines.join('\n');
 }
+/**
+ * @name hostedTomlServerBlock
+ * @description Renders a Codex-compatible TOML block for a hosted Streamable HTTP MCP server.
+ */
+function hostedTomlServerBlock(hosted) {
+    return [
+        `[mcp_servers.${SAP_SERVER_NAME}]`,
+        `url = ${JSON.stringify(hosted.url)}`,
+        '',
+    ].join('\n');
+}
+/**
+ * @name codexPaymentBridgeTomlBlock
+ * @description Renders the Codex TOML block for the local x402 payment bridge MCP server.
+ */
+function codexPaymentBridgeTomlBlock(canonical) {
+    const args = `[${canonical.args.map((arg) => JSON.stringify(arg)).join(', ')}]`;
+    const enabledTools = `[${X402_PAYMENT_BRIDGE_TOOLS.map((tool) => JSON.stringify(tool)).join(', ')}]`;
+    const lines = [
+        `[mcp_servers.${SAP_PAYMENT_BRIDGE_SERVER_NAME}]`,
+        `command = ${JSON.stringify(canonical.command)}`,
+        `args = ${args}`,
+        `enabled_tools = ${enabledTools}`,
+        'tool_timeout_sec = 300',
+    ];
+    lines.push('');
+    lines.push(`[mcp_servers.${SAP_PAYMENT_BRIDGE_SERVER_NAME}.env]`);
+    for (const [key, value] of Object.entries(canonical.env)) {
+        lines.push(`${key} = ${JSON.stringify(value)}`);
+    }
+    return lines.join('\n');
+}
 /**
  * @name removeTomlSapSections
  * @description Removes existing Codex SAP MCP TOML sections before appending the canonical one.
@@ -370,6 +911,34 @@ function removeTomlSapSections(content) {
         hadSapConfig,
     };
 }
+/**
+ * @name removeTomlMcpServerSections
+ * @description Removes named Codex MCP server TOML sections before appending canonical blocks.
+ */
+function removeTomlMcpServerSections(content, serverNames) {
+    const lines = content.split(/\r?\n/);
+    const nextLines = [];
+    let skipping = false;
+    let hadConfig = false;
+    const escapedNames = serverNames.map(escapeRegExp).join('|');
+    const header = new RegExp(`^\\[mcp_servers\\.(${escapedNames})(?:\\.|\\])`);
+    for (const line of lines) {
+        if (/^\[/.test(line)) {
+            skipping = header.test(line);
+            if (skipping) {
+                hadConfig = true;
+                continue;
+            }
+        }
+        if (!skipping) {
+            nextLines.push(line);
+        }
+    }
+    return {
+        content: nextLines.join('\n').replace(/\n*$/, ''),
+        hadConfig,
+    };
+}
 /**
  * @name buildTomlContent
  * @description Builds a merged TOML MCP client config.
@@ -382,6 +951,113 @@ function buildTomlContent(content, canonical) {
         hadSapConfig: stripped.hadSapConfig,
     };
 }
+/**
+ * @name buildCodexHostedPaymentBridgeContent
+ * @description Builds Codex TOML with hosted SAP MCP plus a local sap_payments x402 bridge.
+ */
+export function buildCodexHostedPaymentBridgeContent(content, hostedUrl = HOSTED_SAP_MCP_URL) {
+    const stripped = removeTomlMcpServerSections(content, [SAP_SERVER_NAME, SAP_PAYMENT_BRIDGE_SERVER_NAME]);
+    const hosted = {
+        url: hostedUrl,
+        transport: 'streamable-http',
+    };
+    const prefix = stripped.content.trimEnd();
+    const nextContent = [
+        prefix,
+        hostedTomlServerBlock(hosted).trimEnd(),
+        codexPaymentBridgeTomlBlock(createNpxPaymentBridgeServerConfig()).trimEnd(),
+    ].filter(Boolean).join('\n\n');
+    return {
+        nextContent: `${nextContent}\n`,
+        hadSapConfig: stripped.hadConfig,
+    };
+}
+/**
+ * @name installCodexHostedPaymentBridgeConfig
+ * @description Writes Codex config.toml with hosted SAP MCP and the local x402 payment bridge.
+ */
+export function installCodexHostedPaymentBridgeConfig(homeDir = homedir()) {
+    const target = {
+        id: 'codex',
+        label: 'Codex',
+        path: join(homeDir, '.codex', 'config.toml'),
+        format: 'toml',
+        exists: existsSync(join(homeDir, '.codex', 'config.toml')),
+    };
+    const before = readTargetContent(target);
+    const built = buildCodexHostedPaymentBridgeContent(before);
+    const backupPath = target.exists ? `${target.path}.bak-${Date.now()}` : undefined;
+    mkdirSync(dirname(target.path), { recursive: true });
+    if (backupPath) {
+        writeFileSync(backupPath, before, 'utf-8');
+    }
+    writeFileSync(target.path, built.nextContent, 'utf-8');
+    return {
+        target,
+        mode: built.hadSapConfig ? 'override' : 'merge',
+        written: true,
+        backupPath,
+        message: built.hadSapConfig
+            ? 'Updated Codex hosted SAP MCP and local x402 payment bridge config'
+            : 'Created Codex hosted SAP MCP and local x402 payment bridge config',
+    };
+}
+/**
+ * @name buildHostedPaymentBridgeContent
+ * @description Builds runtime-specific config with hosted SAP MCP and local x402 bridge.
+ */
+export function buildHostedPaymentBridgeContent(target, content) {
+    if (target.format === 'toml') {
+        return buildCodexHostedPaymentBridgeContent(content);
+    }
+    if (target.format === 'json') {
+        return buildHostedPaymentBridgeJsonContent(content, target);
+    }
+    if (target.id === 'openclaw') {
+        return replaceOpenClawYamlHostedPaymentBridgeBlocks(content);
+    }
+    return replaceYamlHostedPaymentBridgeBlocks(content);
+}
+/**
+ * @name installHostedPaymentBridgeConfig
+ * @description Installs or repairs hosted SAP MCP plus local x402 bridge config for a concrete runtime target.
+ */
+export function installHostedPaymentBridgeConfig(target) {
+    if (target.id === 'codex') {
+        return installCodexHostedPaymentBridgeConfig(dirname(dirname(target.path)));
+    }
+    const currentTarget = {
+        ...target,
+        exists: existsSync(target.path),
+    };
+    const before = readTargetContent(currentTarget);
+    const built = buildHostedPaymentBridgeContent(currentTarget, before);
+    const backupPath = currentTarget.exists ? `${currentTarget.path}.bak-${Date.now()}` : undefined;
+    mkdirSync(dirname(currentTarget.path), { recursive: true, mode: 0o700 });
+    if (backupPath) {
+        writeFileSync(backupPath, before, 'utf-8');
+    }
+    writeFileSync(currentTarget.path, built.nextContent, { encoding: 'utf-8', mode: 0o600 });
+    return {
+        target: currentTarget,
+        mode: built.hadSapConfig ? 'override' : 'merge',
+        written: true,
+        backupPath,
+        message: built.hadSapConfig
+            ? `Repaired hosted SAP MCP and local x402 payment bridge config in ${currentTarget.label}`
+            : `Installed hosted SAP MCP and local x402 payment bridge config in ${currentTarget.label}`,
+    };
+}
+/**
+ * @name installHostedPaymentBridgeConfigs
+ * @description Installs payment bridge configs for all selected runtime ids and detected/create-capable targets.
+ */
+export function installHostedPaymentBridgeConfigs(runtimeIds, homeDir = homedir(), platform = process.platform) {
+    const selected = new Set(runtimeIds);
+    const targets = discoverMcpClientTargets(homeDir, platform)
+        .filter((target) => selected.has(target.id));
+    return targets.map((target) => installHostedPaymentBridgeConfig(target));
+}
 /**
  * @name summarizeContent
  * @description Produces a short safe summary for wizard preview output.