abap-local-client 1.0.0

package/sso-sap-client.mjs

@@ -0,0 +1,687 @@
+#!/usr/bin/env node
+/**
+ * SSO SAP Client — WebSocket Bridge with Basic, SPNEGO, X.509, SAML & SNC
+ *
+ * Connects to abap-mcp via WebSocket and routes SAP ADT calls through
+ * the configured authentication mechanism:
+ *
+ *   Auth Mode           Description
+ *   ──────────────────  ──────────────────────────────────────────────────
+ *   basic               HTTP Basic Auth (username + password)
+ *                       The most common scenario. Supports SAProuter RFC.
+ *
+ *   spnego              Kerberos SPNEGO HTTP Negotiate (RFC 4559)
+ *                       Uses Windows SSPI on Windows, GSSAPI on Linux.
+ *
+ *   x509                X.509 mTLS Principal Propagation
+ *                       Ephemeral client certificates signed by CA.
+ *
+ *   saml                SAML 2.0 Browser Login (S/4HANA Public Cloud)
+ *                       Opens Chromium via Puppeteer, captures session
+ *                       cookies after SAML flow completes.
+ *
+ *   snc                 SNC Kerberos via RFC (SAPGUI-like SSO)
+ *                       Uses sapnwrfc.dll with SNC_MODE=1.
+ *
+ * Systems are configured via the encrypted config manager.
+ * Run: node config-cli.mjs --help
+ *
+ * Usage:
+ *   node sso-sap-client.mjs
+ */
+
+import WebSocket from 'ws';
+import axios from 'axios';
+import { parseSAPResponse } from './xml-utils.js';
+import { BasicSession } from './basic-auth.mjs';
+import { SpnegoSession, resolveServicePrincipal } from './spnego-auth.mjs';
+import { X509Session, loadCA, generateCA } from './x509-auth.mjs';
+import { SamlSession } from './saml-login.mjs';
+import { SNCSession, getWindowsIdentity, getKerberosRealm } from './snc-auth.mjs';
+import { SAPRFCClient } from './sap-rfc-client.js';
+import * as config from './config-manager.mjs';
+
+// Load .env as fallback if config is not initialized
+try { process.loadEnvFile?.(); } catch { /* no .env */ }
+const env = process.env;
+
+// ════════════════════════════════════════════════════════════════════════════
+//  Configuration — from encrypted store, with .env fallback
+// ════════════════════════════════════════════════════════════════════════════
+
+let MCP_API_KEY = '';
+let RECONNECT_DELAY = 5000;
+let WS_URL = env.WS_URL || 'ws://localhost:8080';
+
+function loadGlobalConfig() {
+    if (config.isConfigInitialized()) {
+        MCP_API_KEY = config.getMcpApiKey();
+        RECONNECT_DELAY = config.getReconnectDelay();
+        WS_URL = config.getWsUrl();
+        console.log('🔑 Config loaded from encrypted store.');
+    } else {
+        // Fallback to .env
+        MCP_API_KEY = env.API_KEY || '';
+        RECONNECT_DELAY = parseInt(env.RECONNECT_DELAY_MS || '5000', 10);
+        WS_URL = env.WS_URL || 'ws://localhost:8080';
+        console.log('⚠️  Encrypted config not found — using .env fallback.');
+        console.log('   Run: node config-cli.mjs --help to set up the config.');
+    }
+
+    if (!MCP_API_KEY) {
+        console.error('❌ No MCP API key configured.');
+        console.error('   Run: node config-cli.mjs set-mcp-key <your-api-key>');
+        process.exit(1);
+    }
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  Auth Session Cache (per systemId)
+// ════════════════════════════════════════════════════════════════════════════
+
+/**
+ * Each entry: {
+ *   httpSession: SpnegoSession|X509Session|SamlSession|BasicSession|null,
+ *   rfcClient: SAPRFCClient|null,
+ *   authMode: string,
+ * }
+ * For RFC modes (snc, or any mode with saprouter), rfcClient is set.
+ * For HTTP modes, httpSession is set.
+ */
+const sessions = new Map();
+const pendingSessions = new Map();  // in-flight init promises to prevent race
+
+// Default system ID (used when MCP message has no "system" field)
+let defaultSystemId = null;
+
+function getDefaultSystemId() {
+    if (defaultSystemId) return defaultSystemId;
+    const allSystems = config.listSystems();
+    if (allSystems.length === 1) {
+        defaultSystemId = allSystems[0].systemId;
+    }
+    return defaultSystemId;
+}
+
+/**
+ * Get or create the auth session for a system ID.
+ * @returns {{ useRfc: boolean, rfcClient: SAPRFCClient|null, httpSession: object|null }}
+ */
+async function getSessionForSystem(systemId) {
+    // Resolve system ID
+    let resolvedId = systemId;
+    let sysConfig = null;
+
+    if (systemId) {
+        sysConfig = config.getSystem(systemId);
+    }
+
+    // If no systemId in message, try default
+    if (!sysConfig && !systemId) {
+        resolvedId = getDefaultSystemId();
+        if (resolvedId) {
+            sysConfig = config.getSystem(resolvedId);
+        }
+    }
+
+    if (!sysConfig) {
+        // Try Arcanum fallback if enabled
+        if (config.getArcanumFallback()) {
+            console.log(`   ⚡ System "${systemId || resolvedId}" not found locally — Arcanum fallback not yet implemented`);
+        }
+        throw new Error(`Unknown system: "${systemId || resolvedId}". Configure with: node config-cli.mjs add-system <id> <mode>`);
+    }
+
+    if (!config.isSystemEnabled(systemId || resolvedId)) {
+        throw new Error(`System "${systemId || resolvedId}" is disabled.`);
+    }
+
+    const cacheKey = resolvedId;
+
+    // Return cached session if available
+    if (sessions.has(cacheKey)) {
+        return sessions.get(cacheKey);
+    }
+
+    // Prevent concurrent init for the same system
+    if (pendingSessions.has(cacheKey)) {
+        return await pendingSessions.get(cacheKey);
+    }
+
+    const initPromise = _createSessionInternal(cacheKey, sysConfig);
+    pendingSessions.set(cacheKey, initPromise);
+
+    try {
+        const sessionEntry = await initPromise;
+        sessions.set(cacheKey, sessionEntry);
+        return sessionEntry;
+    } finally {
+        pendingSessions.delete(cacheKey);
+    }
+}
+
+async function _createSessionInternal(resolvedId, sysConfig) {
+    const conn = sysConfig.connection || {};
+    const authMode = sysConfig.authMode || 'basic';
+    const hasSaprouter = !!(conn.saprouter);
+
+    console.log(`\n🔐 Creating auth session for system "${resolvedId}" (${authMode})`);
+
+    let httpSession = null;
+    let rfcClient = null;
+    let useRfc = false;
+
+    // Determine if RFC tunnel should be used.
+    // SNC and modes with saprouter always use RFC.
+    // For other modes, if saprouter is set, we use RFC.
+    if (authMode === 'snc' || hasSaprouter) {
+        useRfc = true;
+    }
+
+    // ════════════════════════════════════════════════════════════════════════
+    //  Instantiate session by auth mode
+    // ════════════════════════════════════════════════════════════════════════
+
+    switch (authMode) {
+        // ── BASIC ────────────────────────────────────────────────────────
+        case 'basic': {
+            const baseUrl = `https://${conn.host}:${conn.port || '44301'}`;
+
+            if (useRfc) {
+                // RFC tunnel with Basic Auth
+                rfcClient = new SAPRFCClient({
+                    host:      conn.host,
+                    sysnr:     conn.sysnr || '00',
+                    client:    conn.client || '100',
+                    username:  conn.username || '',
+                    password:  conn.password || '',
+                    language:  conn.language || 'EN',
+                    saprouter: conn.saprouter || '',
+                });
+                await rfcClient.connect();
+                console.log(`   ✅ Basic Auth RFC connection established`);
+            } else {
+                // Direct HTTP Basic Auth
+                httpSession = new BasicSession(
+                    axios, baseUrl,
+                    conn.client || '100',
+                    conn.username || '',
+                    conn.password || '',
+                    { language: conn.language || 'EN' }
+                );
+                await httpSession.init();
+                console.log(`   ✅ Basic Auth HTTP session established`);
+            }
+            break;
+        }
+
+        // ── SPNEGO ───────────────────────────────────────────────────────
+        case 'spnego': {
+            const baseUrl = `https://${conn.host}:${conn.port || '44301'}`;
+
+            if (useRfc) {
+                rfcClient = new SAPRFCClient({
+                    host:      conn.host,
+                    sysnr:     conn.sysnr || '00',
+                    client:    conn.client || '100',
+                    username:  conn.username || '',
+                    password:  conn.password || '',
+                    language:  conn.language || 'EN',
+                    saprouter: conn.saprouter || '',
+                });
+                await rfcClient.connect();
+            } else {
+                let spn = conn.servicePrincipal;
+                if (!spn) {
+                    spn = await resolveServicePrincipal(conn.host);
+                }
+                console.log(`   🎫 SPNEGO SPN: ${spn}`);
+                httpSession = new SpnegoSession(axios, conn.host, {
+                    baseUrl,
+                    client:   conn.client || '100',
+                    language: conn.language || 'EN',
+                });
+                await httpSession.init();
+            }
+            console.log(`   ✅ SPNEGO session established`);
+            break;
+        }
+
+        // ── X.509 ────────────────────────────────────────────────────────
+        case 'x509': {
+            const baseUrl = `https://${conn.host}:${conn.port || '44301'}`;
+
+            let caCertPem = conn.caCertPem || '';
+            let caKeyPem = conn.caKeyPem || '';
+
+            if (!caCertPem || !caKeyPem) {
+                console.log('   🔧 Generating self-signed CA for development...');
+                const ca = generateCA();
+                caCertPem = ca.caCertPem;
+                caKeyPem = ca.caKeyPem;
+            }
+
+            console.log(`   📜 CA loaded, login identifier: ${conn.loginIdentifier}`);
+            httpSession = new X509Session(
+                axios, caCertPem, caKeyPem,
+                conn.loginIdentifier || conn.username || '',
+                {
+                    baseUrl,
+                    client:            conn.client || '100',
+                    language:          conn.language || 'EN',
+                    validityMinutes:   conn.validityMinutes || 5,
+                    rejectUnauthorized: env.NODE_TLS_REJECT_UNAUTHORIZED !== '0',
+                }
+            );
+            await httpSession.init();
+            console.log('   ✅ X.509 session established');
+            break;
+        }
+
+        // ── SAML ─────────────────────────────────────────────────────────
+        case 'saml': {
+            const baseUrl = conn.baseUrl || `https://${conn.host}:${conn.port || '44301'}`;
+            console.log(`   🌐 SAML browser login → ${baseUrl}`);
+            httpSession = new SamlSession(axios, baseUrl, conn.client || '100', {
+                language:  conn.language || 'EN',
+                headless:  conn.headless !== false,
+                timeoutMs: conn.loginTimeoutMs || 600_000,
+                onStatus:  (msg) => console.log(`   ${msg}`),
+            });
+            await httpSession.init();
+            console.log(`   ✅ SAML session established`);
+            break;
+        }
+
+        // ── SNC ──────────────────────────────────────────────────────────
+        case 'snc': {
+            const identity = getWindowsIdentity();
+            const realm = getKerberosRealm();
+
+            console.log(`   🔐 SNC Kerberos — ${identity.domain}\\${identity.user}`);
+            console.log(`   Realm: ${realm}`);
+
+            const sncPartnerName = conn.sncPartnerName;
+            if (!sncPartnerName) {
+                throw new Error('SNC mode requires sncPartnerName in connection config.');
+            }
+
+            const sncSession = new SNCSession(
+                {
+                    host:      conn.host,
+                    sysnr:     conn.sysnr || '00',
+                    client:    conn.client || '100',
+                    username:  identity.user,
+                    password:  '',
+                    language:  conn.language || 'EN',
+                    saprouter: conn.saprouter || '',
+                },
+                {
+                    sncPartnerName,
+                    sncMyName:  conn.sncMyName || undefined,
+                    sncQop:     conn.sncQop || '3',
+                    sncLib:     conn.sncLib || undefined,
+                    user:       identity.user,
+                    domain:     identity.domain,
+                    realm,
+                },
+                SAPRFCClient
+            );
+            await sncSession.init();
+            rfcClient = sncSession.rfc;
+            useRfc = true;   // SNC always uses RFC
+            console.log('   ✅ SNC Kerberos RFC connection established');
+            break;
+        }
+
+        default:
+            throw new Error(`Unknown auth mode: ${authMode}`);
+    }
+
+    const sessionEntry = { useRfc, rfcClient, httpSession, authMode };
+    return sessionEntry;
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  Execute a single callspec
+// ════════════════════════════════════════════════════════════════════════════
+
+async function executeCallspec(callspec, prevExtracted = {}, systemId) {
+    let { method, url, headers = {}, body, extract_from_response } = callspec;
+
+    for (const [k, v] of Object.entries(prevExtracted)) {
+        // Convert camelCase key to UPPER_SNAKE_CASE placeholder: lockHandle → LOCK_HANDLE
+        const placeholder = k.replace(/([A-Z])/g, '_$1').toUpperCase();
+        url = url.replace(`<${placeholder}>`, v);
+        // Also replace the raw key (in case it's already the correct format)
+        url = url.replace(`<${k.toUpperCase()}>`, v);
+    }
+
+    const relUrl = url.startsWith('http') ? new URL(url).pathname + (new URL(url).search || '') : url;
+
+    console.log(`   📡 ${method} ${relUrl}`);
+
+    try {
+        // Resolve system & session
+        const resolvedSystemId = callspec.system || systemId || '';
+        let sessionEntry;
+
+        try {
+            sessionEntry = await getSessionForSystem(resolvedSystemId);
+        } catch (err) {
+            return { success: false, status: 0, error: err.message, data: null };
+        }
+
+        const { useRfc, rfcClient, httpSession } = sessionEntry;
+
+        // ── RFC tunnel path ─────────────────────────────────────────────
+        if (useRfc && rfcClient) {
+            const conn = config.getSystem(resolvedSystemId)?.connection || {};
+            const finalHeaders = {
+                ...headers,
+                'sap-client':   conn.client || '100',
+                'sap-language': conn.language || 'EN',
+            };
+
+            if (finalHeaders['X-CSRF-Token'] === '<CSRF_TOKEN>') {
+                if (!rfcClient.csrfToken) await rfcClient.fetchCsrfToken();
+                finalHeaders['X-CSRF-Token'] = rfcClient.csrfToken || '';
+            } else if (httpSession?.csrfToken && method !== 'GET') {
+                finalHeaders['X-CSRF-Token'] = httpSession.csrfToken;
+            }
+            delete finalHeaders['Cookie'];
+            delete finalHeaders['Authorization'];
+
+            const resp = await rfcClient.callADT(method, relUrl, finalHeaders, body || null);
+            console.log(`   📡 RFC ${resp.status} ${resp.statusText} (${resp.data.length} chars)`);
+            if (resp.status >= 400) {
+                console.log(`   ⚠️  Response body (first 500): ${resp.data?.substring(0, 500)}`);
+                console.log(`   ⚠️  Response headers: ${JSON.stringify(resp.headers)}`);
+            }
+            return parseCallspecResult(resp, resp.data, extract_from_response);
+        }
+
+        // ── Direct HTTP path ────────────────────────────────────────────
+        if (!httpSession) {
+            return { success: false, status: 0, error: 'No HTTP session available', data: null };
+        }
+
+        const httpHeaders = { ...headers };
+
+        if (httpHeaders['X-CSRF-Token'] === '<CSRF_TOKEN>') {
+            if (httpSession.csrfToken) {
+                httpHeaders['X-CSRF-Token'] = httpSession.csrfToken;
+            } else if (httpSession.refreshCsrf) {
+                await httpSession.refreshCsrf();
+                httpHeaders['X-CSRF-Token'] = httpSession.csrfToken || '';
+            }
+        }
+
+        let response;
+        switch (method.toUpperCase()) {
+            case 'GET':
+                response = await httpSession.get(relUrl, httpHeaders);
+                break;
+            case 'POST':
+                response = await httpSession.post(relUrl, body || null, httpHeaders);
+                break;
+            case 'PUT':
+                response = await httpSession.put(relUrl, body || null, httpHeaders);
+                break;
+            default:
+                throw new Error(`Unsupported HTTP method: ${method}`);
+        }
+
+        const respData = typeof response.data === 'string'
+            ? response.data
+            : JSON.stringify(response.data);
+
+        console.log(`   📡 HTTP ${response.status} ${response.statusText} (${respData.length} chars)`);
+        if (response.status >= 400) {
+            console.log(`   ⚠️  Response body (first 500): ${respData?.substring(0, 500)}`);
+            console.log(`   ⚠️  Response headers: ${JSON.stringify(response.headers)}`);
+        }
+
+        return parseCallspecResult(
+            { status: response.status, statusText: response.statusText, headers: response.headers },
+            respData,
+            extract_from_response
+        );
+
+    } catch (err) {
+        console.error(`   ❌ Error: ${err.message}`);
+        if (err.response) {
+            console.log(`   ⚠️  HTTP ${err.response.status}: ${err.response.statusText}`);
+            console.log(`   ⚠️  Body (first 500): ${typeof err.response.data === 'string' ? err.response.data.substring(0, 500) : JSON.stringify(err.response.data).substring(0, 500)}`);
+        }
+        return { success: false, status: err.response?.status || 0, error: err.message, data: null };
+    }
+}
+
+function parseCallspecResult(response, data, extract_from_response) {
+    const extracted = {};
+    if (extract_from_response && typeof data === 'string') {
+        if (extract_from_response?.lock_handle) {
+            const m = data.match(/<(?:adtcore:)?(?:lock[Hh]andle|LOCK_HANDLE)>(.*?)<\/(?:adtcore:)?(?:lock[Hh]andle|LOCK_HANDLE)>/);
+            if (m) extracted.lockHandle = m[1];
+        }
+        if (extract_from_response?.transport_request) {
+            const m = data.match(/<(?:adtcore:)?(?:corrNr|CORRNR)>(.*?)<\/(?:adtcore:)?(?:corrNr|CORRNR)>/);
+            if (m) extracted.transportRequest = m[1];
+        }
+        if (extract_from_response?.function_group) {
+            const m = data.match(/PNAME[^>]*>([^<]*)</i);
+            if (m) extracted.functionGroup = m[1].replace(/^SAPL/, '');
+        }
+    }
+
+    const { hasErrors, errorMessages } = parseSAPResponse(data);
+
+    return {
+        success: !hasErrors,  // old client behavior: success based on SAP errors, not HTTP status
+        status:  response.status,
+        statusText: response.statusText,
+        headers: response.headers,
+        data:    { raw: data, ...extracted },
+        ...(errorMessages.length > 0 && {
+            error: `SAP error: ${errorMessages.join('; ')}`,
+            errorDetails: errorMessages,
+        }),
+    };
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  Handle a full MCP request (array of callspecs)
+// ════════════════════════════════════════════════════════════════════════════
+
+async function handleRequest(payload) {
+    const { action, callspecs = [], requestId, system } = payload;
+    // Resolve systemId from message root OR from first callspec's system field
+    const systemId = system || (callspecs[0]?.system) || '';
+
+    console.log(`\n📨 Action: ${action} (${callspecs.length} step(s))${systemId ? ` → ${systemId}` : ''}`);
+
+    // ── switch_system: change the default system ID ───────────────────────────
+    if (action === 'switch_system') {
+        if (!systemId) {
+            return { requestId, success: false, error: 'switch_system requires a "system" field', data: [] };
+        }
+        const sys = config.getSystem(systemId);
+        if (!sys) {
+            return { requestId, success: false, error: `Unknown system: "${systemId}"`, data: [] };
+        }
+        if (!config.isSystemEnabled(systemId)) {
+            return { requestId, success: false, error: `System "${systemId}" is disabled`, data: [] };
+        }
+        defaultSystemId = systemId;
+        console.log(`   ✅ Switched to system: ${systemId} (${sys.authMode})`);
+        // Pre-warm the session for this system
+        try { await getSessionForSystem(systemId); } catch { /* will retry on first call */ }
+        return { requestId, success: true, data: [{ success: true, data: { system: systemId, authMode: sys.authMode, message: `Switched to ${systemId}` } }] };
+    }
+
+    // ── Direct RFC FM call ─────────────────────────────────────────────────
+    if (action === 'invoke_rfc') {
+        if (!systemId) {
+            return { requestId, success: false, error: 'invoke_rfc requires a "system" field in the message', data: [] };
+        }
+        let sessionEntry;
+        try {
+            sessionEntry = await getSessionForSystem(systemId);
+        } catch (err) {
+            return { requestId, success: false, error: err.message, data: [{ success: false, error: err.message }] };
+        }
+
+        if (!sessionEntry.rfcClient) {
+            return { requestId, success: false, error: `System "${systemId}" does not support RFC calls`, data: [] };
+        }
+
+        const spec = callspecs[0] || {};
+        const { fm, importing = {}, tables = [], table_fields = ['LINE'] } = spec;
+        console.log(`   🔧 RFC FM: ${fm}`, importing);
+        try {
+            const tableResult = await sessionEntry.rfcClient.callFM(fm, importing, tables, table_fields);
+            const firstTable = tables[0] || '';
+            const lines = (tableResult[firstTable] || []).map(l => (l || '').trimEnd());
+            const source = lines.join('\n');
+            console.log(`   ✅ ${fm}: ${lines.length} lines returned`);
+            return { requestId, success: true, data: [{ success: true, data: { raw: source } }] };
+        } catch (err) {
+            console.error(`   ❌ RFC FM call failed: ${err.message}`);
+            return { requestId, success: false, error: err.message, data: [{ success: false, error: err.message }] };
+        }
+    }
+
+    // ── Standard callspec execution ──────────────────────────────────────────
+    // Validate that callspecs have the required fields
+    if (!Array.isArray(callspecs) || callspecs.length === 0) {
+        return { requestId, success: false, error: `No callspecs provided for action "${action}"`, data: [] };
+    }
+    for (let i = 0; i < callspecs.length; i++) {
+        const cs = callspecs[i];
+        if (!cs.method && !cs.url && !cs.command) {
+            console.error(`   ❌ callspec[${i}] has no method, url, or command`);
+        }
+    }
+
+    const results = [];
+    let extractedValues = {};
+
+    for (let i = 0; i < callspecs.length; i++) {
+        const cs = callspecs[i];
+        console.log(`\n   Step ${i + 1}/${callspecs.length}: ${cs.name || cs.description || cs.method}`);
+
+        if (extractedValues.functionGroup) {
+            cs.url = cs.url?.replace('<FUNCTION_GROUP>', extractedValues.functionGroup);
+        }
+
+        const result = await executeCallspec(cs, extractedValues, systemId);
+        results.push(result);
+
+        if (result.data && typeof result.data === 'object') {
+            Object.assign(extractedValues, result.data);
+        }
+
+        if (!result.success && !cs.continueOnError) break;
+    }
+
+    const allOk = results.every(r => r.success);
+    return { requestId, success: allOk, data: results };
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  WebSocket connection loop
+// ════════════════════════════════════════════════════════════════════════════
+
+let ws = null;
+
+async function connect() {
+    console.log(`\n🔌 Connecting to ${WS_URL} ...`);
+
+    ws = new WebSocket(WS_URL, {
+        headers: { Authorization: `Bearer ${MCP_API_KEY}` },
+    });
+
+    ws.on('open', () => {
+        console.log('✅ Connected to abap-mcp WebSocket server');
+
+        const allSystems = config.listSystems();
+        if (allSystems.length > 0) {
+            console.log(`   Configured systems: ${allSystems.map(s => s.systemId).join(', ')}`);
+            // List enabled systems
+            const enabled = allSystems.filter(s => s.enabled);
+            console.log(`   Enabled: ${enabled.map(s => `${s.systemId} (${s.authMode})`).join(', ')}`);
+        } else {
+            console.log('   No systems configured. Run: node config-cli.mjs add-system');
+        }
+
+        if (defaultSystemId || getDefaultSystemId()) {
+            console.log(`   Default system: ${defaultSystemId || getDefaultSystemId()}`);
+        }
+    });
+
+    ws.on('message', async (raw) => {
+        let msg;
+        try { msg = JSON.parse(raw.toString()); } catch { return; }
+
+        if (msg.type === 'welcome') {
+            console.log(`   Server: ${msg.message}`);
+            return;
+        }
+
+        if (msg.type === 'ping') {
+            ws.send(JSON.stringify({ type: 'pong' }));
+            return;
+        }
+
+        if (msg.action || msg.callspecs) {
+            // Debug: log full incoming message
+            console.log(`\n📨 INCOMING: ${JSON.stringify(msg, null, 2).substring(0, 500)}`);
+
+            try {
+                const result = await handleRequest(msg);
+                ws.send(JSON.stringify({ type: 'response', ...result }));
+            } catch (err) {
+                ws.send(JSON.stringify({
+                    type: 'response',
+                    requestId: msg.requestId,
+                    success: false,
+                    error: err.message,
+                }));
+            }
+        }
+    });
+
+    ws.on('error', (err) => {
+        console.error(`⚠️  WebSocket error: ${err.message}`);
+    });
+
+    ws.on('close', () => {
+        console.log(`\n🔴 Disconnected. Reconnecting in ${RECONNECT_DELAY / 1000}s...`);
+        // Disconnect all RFC clients
+        for (const [, entry] of sessions) {
+            if (entry.rfcClient) {
+                try { entry.rfcClient.disconnect(); } catch {}
+            }
+        }
+        sessions.clear();
+        setTimeout(connect, RECONNECT_DELAY);
+    });
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  Start
+// ════════════════════════════════════════════════════════════════════════════
+
+console.log('╔═══════════════════════════════════════════════════════════╗');
+console.log('║  SAP Local Client — Multi-System SSO Bridge              ║');
+console.log('╚═══════════════════════════════════════════════════════════╝');
+
+loadGlobalConfig();
+
+console.log(`  WS URL:     ${WS_URL}`);
+console.log(`  API Key:    ${MCP_API_KEY.substring(0, 10)}...`);
+console.log(`  Store:      ${config.getConfigFilePath()}`);
+console.log(`  Fallback:   ${config.getArcanumFallback() ? 'Arcanum' : 'local config only'}`);
+
+connect();