abap-local-client 1.3.1 → 1.4.1

package/sso-sap-client.mjs

@@ -1,727 +1,835 @@
-#!/usr/bin/env node
-/**
- * SSO SAP Client — WebSocket Bridge with Basic, SPNEGO, X.509, SAML & SNC
- *
- * Connects to abap-mcp via WebSocket and routes SAP ADT calls through
- * the configured authentication mechanism:
- *
- *   Auth Mode           Description
- *   ──────────────────  ──────────────────────────────────────────────────
- *   basic               HTTP Basic Auth (username + password)
- *                       The most common scenario. Supports SAProuter RFC.
- *
- *   spnego              Kerberos SPNEGO HTTP Negotiate (RFC 4559)
- *                       Uses Windows SSPI on Windows, GSSAPI on Linux.
- *
- *   x509                X.509 mTLS Principal Propagation
- *                       Ephemeral client certificates signed by CA.
- *
- *   saml                SAML 2.0 Browser Login (S/4HANA Public Cloud)
- *                       Opens Chromium via Puppeteer, captures session
- *                       cookies after SAML flow completes.
- *
- *   snc                 SNC Kerberos via RFC (SAPGUI-like SSO)
- *                       Uses sapnwrfc.dll with SNC_MODE=1.
- *
- * Systems are configured via the encrypted config manager.
- * Run: node config-cli.mjs --help
- *
- * Usage:
- *   node sso-sap-client.mjs
- */
-
-import WebSocket from 'ws';
-import axios from 'axios';
-import { parseSAPResponse } from './xml-utils.js';
-import { BasicSession } from './basic-auth.mjs';
-import { SpnegoSession, resolveServicePrincipal } from './spnego-auth.mjs';
-import { X509Session, loadCA, generateCA } from './x509-auth.mjs';
-import { SamlSession } from './saml-login.mjs';
-import { SNCSession, getWindowsIdentity, getKerberosRealm } from './snc-auth.mjs';
-import { SAPRFCClient } from './sap-rfc-client.js';
-import * as config from './config-manager.mjs';
-
-// Load .env as fallback if config is not initialized
-try { process.loadEnvFile?.(); } catch { /* no .env */ }
-const env = process.env;
-
-// ════════════════════════════════════════════════════════════════════════════
-//  Configuration — from encrypted store, with .env fallback
-// ════════════════════════════════════════════════════════════════════════════
-
-let MCP_API_KEY = '';
-let RECONNECT_DELAY = 5000;
-let WS_URL = env.WS_URL || 'ws://localhost:8080';
-
-function loadGlobalConfig() {
-    if (config.isConfigInitialized()) {
-        MCP_API_KEY = config.getMcpApiKey();
-        RECONNECT_DELAY = config.getReconnectDelay();
-        WS_URL = config.getWsUrl();
-        console.log('🔑 Config loaded from encrypted store.');
-    } else {
-        // Fallback to .env
-        MCP_API_KEY = env.API_KEY || '';
-        RECONNECT_DELAY = parseInt(env.RECONNECT_DELAY_MS || '5000', 10);
-        WS_URL = env.WS_URL || 'ws://localhost:8080';
-        console.log('⚠️  Encrypted config not found — using .env fallback.');
-        console.log('   Run: node config-cli.mjs --help to set up the config.');
-    }
-
-    if (!MCP_API_KEY) {
-        console.error('❌ No MCP API key configured.');
-        console.error('   Run: node config-cli.mjs set-mcp-key <your-api-key>');
-        process.exit(1);
-    }
-}
-
-// ════════════════════════════════════════════════════════════════════════════
-//  Auth Session Cache (per systemId)
-// ════════════════════════════════════════════════════════════════════════════
-
-/**
- * Each entry: {
- *   httpSession: SpnegoSession|X509Session|SamlSession|BasicSession|null,
- *   rfcClient: SAPRFCClient|null,
- *   authMode: string,
- * }
- * For RFC modes (snc, or any mode with saprouter), rfcClient is set.
- * For HTTP modes, httpSession is set.
- */
-const sessions = new Map();
-const pendingSessions = new Map();  // in-flight init promises to prevent race
-
-// Default system ID (used when MCP message has no "system" field)
-let defaultSystemId = null;
-
-function getDefaultSystemId() {
-    if (defaultSystemId) return defaultSystemId;
-    const allSystems = config.listSystems();
-    if (allSystems.length === 1) {
-        defaultSystemId = allSystems[0].systemId;
-    }
-    return defaultSystemId;
-}
-
-/**
- * Get or create the auth session for a system ID.
- * @returns {{ useRfc: boolean, rfcClient: SAPRFCClient|null, httpSession: object|null }}
- */
-async function getSessionForSystem(systemId) {
-    // Resolve system ID
-    let resolvedId = systemId;
-    let sysConfig = null;
-
-    if (systemId) {
-        sysConfig = config.getSystem(systemId);
-    }
-
-    // If no systemId in message, try default
-    if (!sysConfig && !systemId) {
-        resolvedId = getDefaultSystemId();
-        if (resolvedId) {
-            sysConfig = config.getSystem(resolvedId);
-        }
-    }
-
-    if (!sysConfig) {
-        // Try Arcanum fallback if enabled
-        if (config.getArcanumFallback()) {
-            console.log(`   ⚡ System "${systemId || resolvedId}" not found locally — Arcanum fallback not yet implemented`);
-        }
-        throw new Error(`Unknown system: "${systemId || resolvedId}". Configure with: node config-cli.mjs add-system <id> <mode>`);
-    }
-
-    if (!config.isSystemEnabled(systemId || resolvedId)) {
-        throw new Error(`System "${systemId || resolvedId}" is disabled.`);
-    }
-
-    const cacheKey = resolvedId;
-
-    // Return cached session if available
-    if (sessions.has(cacheKey)) {
-        return sessions.get(cacheKey);
-    }
-
-    // Prevent concurrent init for the same system
-    if (pendingSessions.has(cacheKey)) {
-        return await pendingSessions.get(cacheKey);
-    }
-
-    const initPromise = _createSessionInternal(cacheKey, sysConfig);
-    pendingSessions.set(cacheKey, initPromise);
-
-    try {
-        const sessionEntry = await initPromise;
-        sessions.set(cacheKey, sessionEntry);
-        return sessionEntry;
-    } finally {
-        pendingSessions.delete(cacheKey);
-    }
-}
-
-async function _createSessionInternal(resolvedId, sysConfig) {
-    const conn = sysConfig.connection || {};
-    const authMode = sysConfig.authMode || 'basic';
-    const hasSaprouter = !!(conn.saprouter);
-
-    console.log(`\n🔐 Creating auth session for system "${resolvedId}" (${authMode})`);
-
-    let httpSession = null;
-    let rfcClient = null;
-    let useRfc = false;
-
-    // Determine if RFC tunnel should be used.
-    // SNC and modes with saprouter always use RFC.
-    // For other modes, if saprouter is set, we use RFC.
-    if (authMode === 'snc' || hasSaprouter) {
-        useRfc = true;
-    }
-
-    // ════════════════════════════════════════════════════════════════════════
-    //  Instantiate session by auth mode
-    // ════════════════════════════════════════════════════════════════════════
-
-    switch (authMode) {
-        // ── BASIC ────────────────────────────────────────────────────────
-        case 'basic': {
-            const baseUrl = `https://${conn.host}:${conn.port || '44301'}`;
-
-            if (useRfc) {
-                // RFC tunnel with Basic Auth
-                rfcClient = new SAPRFCClient({
-                    host:      conn.host,
-                    sysnr:     conn.sysnr || '00',
-                    client:    conn.client || '100',
-                    username:  conn.username || '',
-                    password:  conn.password || '',
-                    language:  conn.language || 'EN',
-                    saprouter: conn.saprouter || '',
-                });
-                await rfcClient.connect();
-                console.log(`   ✅ Basic Auth RFC connection established`);
-            } else {
-                // Direct HTTP Basic Auth
-                httpSession = new BasicSession(
-                    axios, baseUrl,
-                    conn.client || '100',
-                    conn.username || '',
-                    conn.password || '',
-                    { language: conn.language || 'EN' }
-                );
-                await httpSession.init();
-                console.log(`   ✅ Basic Auth HTTP session established`);
-            }
-            break;
-        }
-
-        // ── SPNEGO ───────────────────────────────────────────────────────
-        case 'spnego': {
-            const baseUrl = `https://${conn.host}:${conn.port || '44301'}`;
-
-            if (useRfc) {
-                rfcClient = new SAPRFCClient({
-                    host:      conn.host,
-                    sysnr:     conn.sysnr || '00',
-                    client:    conn.client || '100',
-                    username:  conn.username || '',
-                    password:  conn.password || '',
-                    language:  conn.language || 'EN',
-                    saprouter: conn.saprouter || '',
-                });
-                await rfcClient.connect();
-            } else {
-                let spn = conn.servicePrincipal;
-                if (!spn) {
-                    spn = await resolveServicePrincipal(conn.host);
-                }
-                console.log(`   🎫 SPNEGO SPN: ${spn}`);
-                httpSession = new SpnegoSession(axios, conn.host, {
-                    baseUrl,
-                    client:   conn.client || '100',
-                    language: conn.language || 'EN',
-                });
-                await httpSession.init();
-            }
-            console.log(`   ✅ SPNEGO session established`);
-            break;
-        }
-
-        // ── X.509 ────────────────────────────────────────────────────────
-        case 'x509': {
-            const baseUrl = `https://${conn.host}:${conn.port || '44301'}`;
-
-            let caCertPem = conn.caCertPem || '';
-            let caKeyPem = conn.caKeyPem || '';
-
-            if (!caCertPem || !caKeyPem) {
-                console.log('   🔧 Generating self-signed CA for development...');
-                const ca = generateCA();
-                caCertPem = ca.caCertPem;
-                caKeyPem = ca.caKeyPem;
-            }
-
-            console.log(`   📜 CA loaded, login identifier: ${conn.loginIdentifier}`);
-            httpSession = new X509Session(
-                axios, caCertPem, caKeyPem,
-                conn.loginIdentifier || conn.username || '',
-                {
-                    baseUrl,
-                    client:            conn.client || '100',
-                    language:          conn.language || 'EN',
-                    validityMinutes:   conn.validityMinutes || 5,
-                    rejectUnauthorized: env.NODE_TLS_REJECT_UNAUTHORIZED !== '0',
-                }
-            );
-            await httpSession.init();
-            console.log('   ✅ X.509 session established');
-            break;
-        }
-
-        // ── SAML ─────────────────────────────────────────────────────────
-        case 'saml': {
-            const baseUrl = conn.baseUrl || `https://${conn.host}:${conn.port || '44301'}`;
-            console.log(`   🌐 SAML browser login → ${baseUrl}`);
-            httpSession = new SamlSession(axios, baseUrl, conn.client || '100', {
-                language:  conn.language || 'EN',
-                headless:  conn.headless !== false,
-                timeoutMs: conn.loginTimeoutMs || 600_000,
-                onStatus:  (msg) => console.log(`   ${msg}`),
-            });
-            await httpSession.init();
-            console.log(`   ✅ SAML session established`);
-            break;
-        }
-
-        // ── SNC ──────────────────────────────────────────────────────────
-        case 'snc': {
-            const identity = getWindowsIdentity();
-            const realm = getKerberosRealm();
-
-            console.log(`   🔐 SNC Kerberos — ${identity.domain}\\${identity.user}`);
-            console.log(`   Realm: ${realm}`);
-
-            const sncPartnerName = conn.sncPartnerName;
-            if (!sncPartnerName) {
-                throw new Error('SNC mode requires sncPartnerName in connection config.');
-            }
-
-            const sncSession = new SNCSession(
-                {
-                    host:      conn.host,
-                    sysnr:     conn.sysnr || '00',
-                    client:    conn.client || '100',
-                    username:  identity.user,
-                    password:  '',
-                    language:  conn.language || 'EN',
-                    saprouter: conn.saprouter || '',
-                },
-                {
-                    sncPartnerName,
-                    sncMyName:  conn.sncMyName || undefined,
-                    sncQop:     conn.sncQop || '3',
-                    sncLib:     conn.sncLib || undefined,
-                    user:       identity.user,
-                    domain:     identity.domain,
-                    realm,
-                },
-                SAPRFCClient
-            );
-            await sncSession.init();
-            rfcClient = sncSession.rfc;
-            useRfc = true;   // SNC always uses RFC
-            console.log('   ✅ SNC Kerberos RFC connection established');
-            break;
-        }
-
-        default:
-            throw new Error(`Unknown auth mode: ${authMode}`);
-    }
-
-    const sessionEntry = { useRfc, rfcClient, httpSession, authMode };
-    return sessionEntry;
-}
-
-// ════════════════════════════════════════════════════════════════════════════
-//  Execute a single callspec
-// ════════════════════════════════════════════════════════════════════════════
-
-async function executeCallspec(callspec, prevExtracted = {}, systemId) {
-    let { method, url, headers = {}, body, extract_from_response } = callspec;
-
-    for (const [k, v] of Object.entries(prevExtracted)) {
-        // Convert camelCase key to UPPER_SNAKE_CASE placeholder: lockHandle → LOCK_HANDLE
-        const placeholder = k.replace(/([A-Z])/g, '_$1').toUpperCase();
-        url = url.replace(`<${placeholder}>`, v);
-        // Also replace the raw key (in case it's already the correct format)
-        url = url.replace(`<${k.toUpperCase()}>`, v);
-    }
-
-    const relUrl = url.startsWith('http') ? new URL(url).pathname + (new URL(url).search || '') : url;
-
-    console.log(`   📡 ${method} ${relUrl}`);
-
-    try {
-        // Resolve system & session
-        const resolvedSystemId = callspec.system || systemId || '';
-        let sessionEntry;
-
-        try {
-            sessionEntry = await getSessionForSystem(resolvedSystemId);
-        } catch (err) {
-            return { success: false, status: 0, error: err.message, data: null };
-        }
-
-        const { useRfc, rfcClient, httpSession } = sessionEntry;
-
-        // ── RFC tunnel path ─────────────────────────────────────────────
-        if (useRfc && rfcClient) {
-            const conn = config.getSystem(resolvedSystemId)?.connection || {};
-            const finalHeaders = {
-                ...headers,
-                'sap-client':   conn.client || '100',
-                'sap-language': conn.language || 'EN',
-            };
-
-            if (finalHeaders['X-CSRF-Token'] === '<CSRF_TOKEN>') {
-                if (!rfcClient.csrfToken) await rfcClient.fetchCsrfToken();
-                finalHeaders['X-CSRF-Token'] = rfcClient.csrfToken || '';
-            } else if (httpSession?.csrfToken && method !== 'GET') {
-                finalHeaders['X-CSRF-Token'] = httpSession.csrfToken;
-            }
-            delete finalHeaders['Cookie'];
-            delete finalHeaders['Authorization'];
-
-            const resp = await rfcClient.callADT(method, relUrl, finalHeaders, body || null);
-            console.log(`   📡 RFC ${resp.status} ${resp.statusText} (${resp.data.length} chars)`);
-            if (resp.status >= 400) {
-                console.log(`   ⚠️  Response body (first 500): ${resp.data?.substring(0, 500)}`);
-                console.log(`   ⚠️  Response headers: ${JSON.stringify(resp.headers)}`);
-            }
-            return parseCallspecResult(resp, resp.data, extract_from_response);
-        }
-
-        // ── Direct HTTP path ────────────────────────────────────────────
-        if (!httpSession) {
-            return { success: false, status: 0, error: 'No HTTP session available', data: null };
-        }
-
-        const httpHeaders = { ...headers };
-
-        if (httpHeaders['X-CSRF-Token'] === '<CSRF_TOKEN>') {
-            if (httpSession.csrfToken) {
-                httpHeaders['X-CSRF-Token'] = httpSession.csrfToken;
-            } else if (httpSession.refreshCsrf) {
-                await httpSession.refreshCsrf();
-                httpHeaders['X-CSRF-Token'] = httpSession.csrfToken || '';
-            }
-        }
-
-        let response;
-        switch (method.toUpperCase()) {
-            case 'GET':
-                response = await httpSession.get(relUrl, httpHeaders);
-                break;
-            case 'POST':
-                response = await httpSession.post(relUrl, body || null, httpHeaders);
-                break;
-            case 'PUT':
-                response = await httpSession.put(relUrl, body || null, httpHeaders);
-                break;
-            default:
-                throw new Error(`Unsupported HTTP method: ${method}`);
-        }
-
-        const respData = typeof response.data === 'string'
-            ? response.data
-            : JSON.stringify(response.data);
-
-        console.log(`   📡 HTTP ${response.status} ${response.statusText} (${respData.length} chars)`);
-        if (response.status >= 400) {
-            console.log(`   ⚠️  Response body (first 500): ${respData?.substring(0, 500)}`);
-            console.log(`   ⚠️  Response headers: ${JSON.stringify(response.headers)}`);
-        }
-
-        return parseCallspecResult(
-            { status: response.status, statusText: response.statusText, headers: response.headers },
-            respData,
-            extract_from_response
-        );
-
-    } catch (err) {
-        console.error(`   ❌ Error: ${err.message}`);
-        if (err.response) {
-            console.log(`   ⚠️  HTTP ${err.response.status}: ${err.response.statusText}`);
-            console.log(`   ⚠️  Body (first 500): ${typeof err.response.data === 'string' ? err.response.data.substring(0, 500) : JSON.stringify(err.response.data).substring(0, 500)}`);
-        }
-        return { success: false, status: err.response?.status || 0, error: err.message, data: null };
-    }
-}
-
-function parseCallspecResult(response, data, extract_from_response) {
-    const extracted = {};
-    if (extract_from_response && typeof data === 'string') {
-        if (extract_from_response?.lock_handle) {
-            const m = data.match(/<(?:adtcore:)?(?:lock[Hh]andle|LOCK_HANDLE)>(.*?)<\/(?:adtcore:)?(?:lock[Hh]andle|LOCK_HANDLE)>/);
-            if (m) extracted.lockHandle = m[1];
-        }
-        if (extract_from_response?.transport_request) {
-            const m = data.match(/<(?:adtcore:)?(?:corrNr|CORRNR)>(.*?)<\/(?:adtcore:)?(?:corrNr|CORRNR)>/);
-            if (m) extracted.transportRequest = m[1];
-        }
-        if (extract_from_response?.function_group) {
-            const m = data.match(/PNAME[^>]*>([^<]*)</i);
-            if (m) extracted.functionGroup = m[1].replace(/^SAPL/, '');
-        }
-    }
-
-    const { hasErrors, errorMessages } = parseSAPResponse(data);
-
-    return {
-        success: !hasErrors,  // old client behavior: success based on SAP errors, not HTTP status
-        status:  response.status,
-        statusText: response.statusText,
-        headers: response.headers,
-        data:    { raw: data, ...extracted },
-        ...(errorMessages.length > 0 && {
-            error: `SAP error: ${errorMessages.join('; ')}`,
-            errorDetails: errorMessages,
-        }),
-    };
-}
-
-// ════════════════════════════════════════════════════════════════════════════
-//  Handle a full MCP request (array of callspecs)
-// ════════════════════════════════════════════════════════════════════════════
-
-async function handleRequest(payload) {
-    const { action, callspecs = [], requestId, system } = payload;
-    // Resolve systemId from message root OR from first callspec's system field
-    const systemId = system || (callspecs[0]?.system) || '';
-
-    console.log(`\n📨 Action: ${action} (${callspecs.length} step(s))${systemId ? ` → ${systemId}` : ''}`);
-
-    // ── switch_system: change the default system ID ───────────────────────────
-    if (action === 'switch_system') {
-        if (!systemId) {
-            return { requestId, success: false, error: 'switch_system requires a "system" field', data: [] };
-        }
-        const sys = config.getSystem(systemId);
-        if (!sys) {
-            return { requestId, success: false, error: `Unknown system: "${systemId}"`, data: [] };
-        }
-        if (!config.isSystemEnabled(systemId)) {
-            return { requestId, success: false, error: `System "${systemId}" is disabled`, data: [] };
-        }
-        defaultSystemId = systemId;
-        console.log(`   ✅ Switched to system: ${systemId} (${sys.authMode})`);
-        // Pre-warm the session for this system
-        try { await getSessionForSystem(systemId); } catch { /* will retry on first call */ }
-        return { requestId, success: true, data: [{ success: true, data: { system: systemId, authMode: sys.authMode, message: `Switched to ${systemId}` } }] };
-    }
-
-    // ── Direct RFC FM call ─────────────────────────────────────────────────
-    if (action === 'invoke_rfc') {
-        if (!systemId) {
-            return { requestId, success: false, error: 'invoke_rfc requires a "system" field in the message', data: [] };
-        }
-        let sessionEntry;
-        try {
-            sessionEntry = await getSessionForSystem(systemId);
-        } catch (err) {
-            return { requestId, success: false, error: err.message, data: [{ success: false, error: err.message }] };
-        }
-
-        if (!sessionEntry.rfcClient) {
-            return { requestId, success: false, error: `System "${systemId}" does not support RFC calls`, data: [] };
-        }
-
-        const spec = callspecs[0] || {};
-        const { fm, importing = {}, tables = [], table_fields = ['LINE'] } = spec;
-        console.log(`   🔧 RFC FM: ${fm}`, importing);
-        try {
-            const tableResult = await sessionEntry.rfcClient.callFM(fm, importing, tables, table_fields);
-            const firstTable = tables[0] || '';
-            const lines = (tableResult[firstTable] || []).map(l => (l || '').trimEnd());
-            const source = lines.join('\n');
-            console.log(`   ✅ ${fm}: ${lines.length} lines returned`);
-            return { requestId, success: true, data: [{ success: true, data: { raw: source } }] };
-        } catch (err) {
-            console.error(`   ❌ RFC FM call failed: ${err.message}`);
-            return { requestId, success: false, error: err.message, data: [{ success: false, error: err.message }] };
-        }
-    }
-
-    // ── Standard callspec execution ──────────────────────────────────────────
-    // Validate that callspecs have the required fields
-    if (!Array.isArray(callspecs) || callspecs.length === 0) {
-        return { requestId, success: false, error: `No callspecs provided for action "${action}"`, data: [] };
-    }
-    for (let i = 0; i < callspecs.length; i++) {
-        const cs = callspecs[i];
-        if (!cs.method && !cs.url && !cs.command) {
-            console.error(`   ❌ callspec[${i}] has no method, url, or command`);
-        }
-    }
-
-    const results = [];
-    let extractedValues = {};
-
-    for (let i = 0; i < callspecs.length; i++) {
-        const cs = callspecs[i];
-        console.log(`\n   Step ${i + 1}/${callspecs.length}: ${cs.name || cs.description || cs.method}`);
-
-        if (extractedValues.functionGroup) {
-            cs.url = cs.url?.replace('<FUNCTION_GROUP>', extractedValues.functionGroup);
-        }
-
-        const result = await executeCallspec(cs, extractedValues, systemId);
-        results.push(result);
-
-        if (result.data && typeof result.data === 'object') {
-            Object.assign(extractedValues, result.data);
-        }
-
-        if (!result.success && !cs.continueOnError) break;
-    }
-
-    const allOk = results.every(r => r.success);
-    return { requestId, success: allOk, data: results };
-}
-
-// ════════════════════════════════════════════════════════════════════════════
-//  WebSocket connection loop
-// ════════════════════════════════════════════════════════════════════════════
-
-let ws = null;
-
-async function connect() {
-    console.log(`\n🔌 Connecting to ${WS_URL} ...`);
-
-    ws = new WebSocket(WS_URL, {
-        headers: { Authorization: `Bearer ${MCP_API_KEY}` },
-    });
-
-    ws.on('open', () => {
-        console.log('✅ Connected to abap-mcp WebSocket server');
-
-        const allSystems = config.listSystems();
-        if (allSystems.length > 0) {
-            console.log(`   Configured systems: ${allSystems.map(s => s.systemId).join(', ')}`);
-            // List enabled systems
-            const enabled = allSystems.filter(s => s.enabled);
-            console.log(`   Enabled: ${enabled.map(s => `${s.systemId} (${s.authMode})`).join(', ')}`);
-        } else {
-            console.log('   No systems configured. Run: node config-cli.mjs add-system');
-        }
-
-        if (defaultSystemId || getDefaultSystemId()) {
-            console.log(`   Default system: ${defaultSystemId || getDefaultSystemId()}`);
-        }
-    });
-
-    ws.on('message', async (raw) => {
-        let msg;
-        try { msg = JSON.parse(raw.toString()); } catch { return; }
-
-        if (msg.type === 'welcome') {
-            console.log(`   Server: ${msg.message}`);
-            return;
-        }
-
-        if (msg.type === 'ping') {
-            ws.send(JSON.stringify({ type: 'pong' }));
-            return;
-        }
-
-        if (msg.action || msg.callspecs) {
-            // Debug: log full incoming message
-            console.log(`\n📨 INCOMING: ${JSON.stringify(msg, null, 2).substring(0, 500)}`);
-
-            try {
-                const result = await handleRequest(msg);
-                ws.send(JSON.stringify({ type: 'response', ...result }));
-            } catch (err) {
-                ws.send(JSON.stringify({
-                    type: 'response',
-                    requestId: msg.requestId,
-                    success: false,
-                    error: err.message,
-                }));
-            }
-        }
-    });
-
-    ws.on('error', (err) => {
-        console.error(`⚠️  WebSocket error: ${err.message}`);
-    });
-
-    ws.on('close', () => {
-        console.log(`\n🔴 Disconnected. Reconnecting in ${RECONNECT_DELAY / 1000}s...`);
-        // Disconnect all RFC clients
-        for (const [, entry] of sessions) {
-            if (entry.rfcClient) {
-                try { entry.rfcClient.disconnect(); } catch {}
-            }
-        }
-        sessions.clear();
-        setTimeout(connect, RECONNECT_DELAY);
-    });
-}
-
-// ════════════════════════════════════════════════════════════════════════════
-//  Start — with inline CLI for setup/config when run directly
-// ════════════════════════════════════════════════════════════════════════════
-
-const args = process.argv.slice(2);
-const command = args[0];
-
-// If the user ran "node sso-sap-client.mjs setup" or "npx abap-local-client config xyz",
-// delegate to the config CLI instead of starting the WebSocket client.
-if (command === 'setup' || command === 'config' || command === 'add-system' || command === 'set-mcp-key' ||
-    command === 'list-systems' || command === 'remove-system' || command === 'enable-system' ||
-    command === 'disable-system' || command === 'show-config' || command === 'arcanum-fallback' ||
-    command === 'set-ws-url' || command === 'help') {
-    // Dynamically import the config CLI so it processes the same argv
-    await import('./config-cli.mjs');
-    process.exit(0);
-}
-
-// If no config exists, use built-in default (S4D Piracanjuba SNC + API key)
-if (!config.isConfigInitialized()) {
-    console.log('╔═══════════════════════════════════════════════════════════╗');
-    console.log('║  SAP Local Client — First Run                           ║');
-    console.log('║  Using default config: S4D (Piracanjuba) via SNC        ║');
-    console.log('╚═══════════════════════════════════════════════════════════╝');
-
-    // Save the default config so it persists across restarts
-    config.addOrUpdateSystem('S4D', {
-        authMode: 'snc',
-        connection: {
-            host: 'vhlbvs4dci.sap.piracanjuba.com.br',
-            sysnr: '00',
-            client: '100',
-            username: '',
-            sncPartnerName: 'p:CN=svc.ssoS4D',
-            sncQop: '3',
-            language: 'PT',
-        },
-        enabled: true,
-    });
-    config.setMcpApiKey('arc_de2fb7965d536a5911ffd7d9ba39d70c');
-    console.log('   Config saved. Edit with: node sso-sap-client.mjs help');
-    console.log('');
-}
-
-console.log('╔═══════════════════════════════════════════════════════════╗');
-console.log('║  SAP Local Client — Multi-System SSO Bridge              ║');
-console.log('╚═══════════════════════════════════════════════════════════╝');
-
-loadGlobalConfig();
-
-console.log(`  WS URL:     ${WS_URL}`);
-console.log(`  API Key:    ${MCP_API_KEY.substring(0, 10)}...`);
-console.log(`  Store:      ${config.getConfigFilePath()}`);
-console.log(`  Fallback:   ${config.getArcanumFallback() ? 'Arcanum' : 'local config only'}`);
-
-connect();
+/**
+ * SSO SAP Client — websocket-client.js with multi-auth
+ * 
+ * Uses the proven websocket-client.js SAPClient, LockManager, executeCallspecs
+ * (6 months production), with multi-system auth injected via config-manager.
+ */
+
+import WebSocket from 'ws';
+import axios from 'axios';
+import https from 'https';
+import { parseSAPResponse } from './xml-utils.js';
+import { BasicSession } from './basic-auth.mjs';
+import { SAPRFCClient } from './sap-rfc-client.js';
+import * as config from './config-manager.mjs';
+
+try { process.loadEnvFile?.(); } catch {}
+const env = process.env;
+
+// ════════════════════════════════════════════════════════════════════════════
+// Multi-system auth session cache
+// ════════════════════════════════════════════════════════════════════════════
+
+const sessions = new Map();
+const pendingSessions = new Map();
+let defaultSystemId = null;
+
+function getDefaultSystemId() {
+    if (defaultSystemId) return defaultSystemId;
+    const allSystems = config.listSystems();
+    return defaultSystemId;
+}
+
+async function getSessionForSystem(systemId) {
+    if (!systemId) throw new Error('No system selected. Use switch_system first.');
+    const cacheKey = systemId;
+    if (sessions.has(cacheKey)) return sessions.get(cacheKey);
+    if (pendingSessions.has(cacheKey)) return await pendingSessions.get(cacheKey);
+
+    const initPromise = _createSession(systemId);
+    pendingSessions.set(cacheKey, initPromise);
+    try {
+        const entry = await initPromise;
+        sessions.set(cacheKey, entry);
+        return entry;
+    } finally {
+        pendingSessions.delete(cacheKey);
+    }
+}
+
+async function _createSession(resolvedId) {
+    const sysConfig = config.getSystem(resolvedId);
+    if (!sysConfig) throw new Error(`Unknown system: ${resolvedId}`);
+    const conn = sysConfig.connection || {};
+    const authMode = sysConfig.authMode || 'basic';
+    const hasSaprouter = !!(conn.saprouter);
+
+    console.log(`\n🔐 Creating auth session for "${resolvedId}" (${authMode})`);
+
+    const baseUrl = `https://${conn.host}:${conn.port || '44301'}`;
+
+    let httpSession = null;
+    let rfcClient = null;
+    let useRfc = (authMode === 'snc' || hasSaprouter);
+
+    if (useRfc) {
+        console.log(`   🛰️  RFC mode (${authMode === 'snc' ? 'SNC' : 'Basic'})`);
+        const rfcParams = {
+            host: conn.host, sysnr: conn.sysnr || '00',
+            client: conn.client || '100', username: conn.username || '',
+            password: conn.password || '', language: conn.language || 'EN',
+            saprouter: conn.saprouter || '',
+        };
+        if (authMode === 'snc') {
+            rfcParams.sncMode = '1';
+            if (conn.sncPartnerName) rfcParams.sncPartnerName = conn.sncPartnerName;
+            if (conn.sncMyName)      rfcParams.sncMyName      = conn.sncMyName;
+            if (conn.sncQop)         rfcParams.sncQop         = conn.sncQop;
+            if (conn.sncLib)         rfcParams.sncLib         = conn.sncLib;
+            console.log(`   🔐 SNC partner: ${conn.sncPartnerName || '(not set)'}`);
+        }
+        rfcClient = new SAPRFCClient(rfcParams);
+        try {
+            await rfcClient.connect();
+            console.log(`   ✅ RFC connection established`);
+        } catch (err) {
+            console.error(`   ⚠️  RFC connection failed: ${err.message}`);
+            rfcClient = null;
+            useRfc = false;
+        }
+    }
+
+    if (!useRfc && authMode === 'basic') {
+        httpSession = new BasicSession(axios, baseUrl, conn.client || '100',
+            conn.username || '', conn.password || '',
+            { language: conn.language || 'EN' });
+        await httpSession.init();
+    } else if (!useRfc) {
+        throw new Error(`RFC connection required for auth mode "${authMode}" but failed to connect`);
+    }
+
+    return { useRfc, rfcClient, httpSession, authMode, sysConfig, resolvedId };
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+// SAP Systems Registry — Arcanum
+// ════════════════════════════════════════════════════════════════════════════
+
+const ARCANUM_ADMIN_URL = 'https://arcanum.mcps.b2rise.com';
+
+const sapSystems = new Map();
+
+async function fetchSapSystems() {
+    try {
+        const response = await axios.post(
+            `${ARCANUM_ADMIN_URL}/api/sap-environments/by-api-key`,
+            { key: MCP_API_KEY }, { timeout: 15_000 }
+        );
+        if (!response.data.valid) return;
+        for (const [key, cfg] of Object.entries(response.data.systems || {})) {
+            sapSystems.set(key, cfg);
+        }
+        console.log(`🌐 SAP systems loaded from Arcanum: ${sapSystems.size} system(s)`);
+    } catch (err) {
+        console.warn(`⚠️  Could not fetch SAP systems: ${err.message}`);
+    }
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+// HTTP Session Manager — cookie jar + CSRF cache (for http_call)
+// ════════════════════════════════════════════════════════════════════════════
+
+const SESSION_TTL_MS = 30 * 60 * 1000;
+const SESSION_CLEANUP_MS = 60 * 1000;
+
+class SessionManager {
+    constructor() {
+        this.sessions = new Map();
+        this._cleanup = setInterval(() => this._evict(), SESSION_CLEANUP_MS);
+        this._cleanup.unref?.();
+    }
+    _key(sid, sys) { return `${sid}__${sys}`; }
+    getOrCreate(sid, sys) {
+        const key = this._key(sid, sys);
+        if (!this.sessions.has(key))
+            this.sessions.set(key, { cookieJar: new Map(), csrfToken: null, system: sys, lastUsedAt: Date.now() });
+        const s = this.sessions.get(key);
+        s.lastUsedAt = Date.now();
+        return s;
+    }
+    _evict() {
+        const now = Date.now();
+        for (const [k, s] of this.sessions)
+            if (now - s.lastUsedAt > SESSION_TTL_MS) this.sessions.delete(k);
+    }
+}
+const sessionManager = new SessionManager();
+
+// ════════════════════════════════════════════════════════════════════════════
+// HTTP Call Handler (http_call action)
+// ════════════════════════════════════════════════════════════════════════════
+
+function mapNetError(err, timeoutMs) {
+    const code = err.code || '';
+    if (code === 'ECONNABORTED' || err.message?.includes('timeout')) return `timeout after ${timeoutMs}ms`;
+    if (code === 'ENOTFOUND') return `DNS resolution failed`;
+    if (code === 'ECONNREFUSED') return 'connection refused';
+    if (err.message?.toLowerCase().includes('ssl') || err.message?.toLowerCase().includes('certificate'))
+        return `SSL handshake failed`;
+    return err.message || 'unknown network error';
+}
+
+function makeHttpEnvelope(partial) {
+    return { status: 0, status_text: '', headers: {}, body: null, body_raw: '',
+        duration_ms: 0, session_id: 'default', csrf_token_cached: false,
+        cookies_count: 0, request_url_resolved: '', error: null, ...partial };
+}
+
+function wrapHttpResult(env) {
+    return { success: env.error == null || env.status > 0, data: { success: env.error == null || env.status > 0, data: env } };
+}
+
+function parseResponseBody(res) {
+    const ct = (res.headers?.['content-type'] || '').toLowerCase();
+    const raw = typeof res.data === 'string' ? res.data : (res.data != null ? JSON.stringify(res.data) : '');
+    let parsed = null;
+    if (ct.includes('json')) {
+        try { parsed = typeof res.data === 'object' ? res.data : JSON.parse(raw); } catch {}
+    }
+    return { body: parsed, body_raw: raw };
+}
+
+async function fetchCsrfForSession(session, sysCfg, httpsAgent) {
+    try {
+        const res = await axios.get(`${sysCfg.baseUrl}/sap/bc/adt/discovery`, {
+            headers: { 'X-CSRF-Token': 'Fetch', 'Accept': 'application/atomsvc+xml', 'sap-client': sysCfg.client,
+                'Cookie': [...session.cookieJar.values()].join('; ') },
+            auth: { username: sysCfg.username, password: sysCfg.password },
+            httpsAgent, timeout: 15_000, validateStatus: () => true
+        });
+        const token = res.headers['x-csrf-token'];
+        if (token && token.toLowerCase() !== 'required') session.csrfToken = token;
+        const setCookies = res.headers['set-cookie'];
+        if (Array.isArray(setCookies))
+            for (const c of setCookies) { const name = c.split('=')[0].trim(); session.cookieJar.set(name, c.split(';')[0].trim()); }
+    } catch {}
+}
+
+async function doAxiosCall(callspec, sysCfg, session, httpsAgent) {
+    const isAbsolute = callspec.path.startsWith('http');
+    const url = isAbsolute ? callspec.path : `${sysCfg.baseUrl}${callspec.path}`;
+    const reqHeaders = { ...(callspec.headers || {}) };
+    delete reqHeaders['Authorization']; delete reqHeaders['authorization'];
+    reqHeaders['sap-client'] = sysCfg.client;
+    reqHeaders['sap-language'] = sysCfg.language || 'EN';
+    if (session.csrfToken) reqHeaders['X-CSRF-Token'] = session.csrfToken;
+    if (session.cookieJar.size > 0) reqHeaders['Cookie'] = [...session.cookieJar.values()].join('; ');
+    let bodyData = callspec.body ?? null;
+    if (bodyData !== null && typeof bodyData === 'object') {
+        if (!reqHeaders['Content-Type'] && !reqHeaders['content-type']) reqHeaders['Content-Type'] = 'application/json';
+        bodyData = JSON.stringify(bodyData);
+    }
+    const res = await axios({
+        method: callspec.method.toLowerCase(), url, headers: reqHeaders, data: bodyData,
+        auth: { username: sysCfg.username, password: sysCfg.password },
+        httpsAgent, timeout: callspec.timeout_ms ?? 30_000,
+        maxRedirects: callspec.follow_redirects === false ? 0 : 5,
+        validateStatus: () => true
+    });
+    const setCookies = res.headers['set-cookie'];
+    if (Array.isArray(setCookies))
+        for (const c of setCookies) { const name = c.split('=')[0].trim(); session.cookieJar.set(name, c.split(';')[0].trim()); }
+    if (res.headers['x-csrf-token']) session.csrfToken = res.headers['x-csrf-token'];
+    return res;
+}
+
+async function handleHttpCall(callspec, httpsAgent) {
+    const sessionId = callspec.session_id || 'default';
+    const systemKey = callspec.system || '';
+    const start = Date.now();
+    const sysCfg = sapSystems.get(systemKey);
+    if (!sysCfg) return wrapHttpResult(makeHttpEnvelope({ status: 0, error: `Unknown system: ${systemKey}`, duration_ms: 0, session_id: sessionId }));
+    if (callspec.path.startsWith('http')) {
+        try { if (new URL(callspec.path).host !== new URL(sysCfg.baseUrl).host) return wrapHttpResult(makeHttpEnvelope({ status: 0, error: 'forbidden_url', session_id: sessionId, duration_ms: 0 })); }
+        catch { return wrapHttpResult(makeHttpEnvelope({ status: 0, error: 'invalid_path', session_id: sessionId, duration_ms: 0 })); }
+    } else if (!callspec.path.startsWith('/'))
+        return wrapHttpResult(makeHttpEnvelope({ status: 0, error: 'invalid_path', session_id: sessionId, duration_ms: 0 }));
+    const session = sessionManager.getOrCreate(sessionId, systemKey);
+    const stateChanging = !['GET', 'HEAD', 'OPTIONS'].includes(callspec.method?.toUpperCase());
+    if (callspec.auto_csrf !== false && stateChanging && !session.csrfToken) await fetchCsrfForSession(session, sysCfg, httpsAgent);
+    let res;
+    try { res = await doAxiosCall(callspec, sysCfg, session, httpsAgent); }
+    catch (err) { return wrapHttpResult(makeHttpEnvelope({ status: 0, error: mapNetError(err, callspec.timeout_ms ?? 30_000), duration_ms: Date.now() - start, session_id: sessionId })); }
+    const csrfHeader = (res.headers['x-csrf-token'] || '').toLowerCase();
+    if (res.status === 403 && csrfHeader === 'required' && callspec.auto_csrf !== false) {
+        session.csrfToken = null; await fetchCsrfForSession(session, sysCfg, httpsAgent);
+        if (!session.csrfToken) return wrapHttpResult(makeHttpEnvelope({ status: 403, error: 'csrf_failed', duration_ms: Date.now() - start, session_id: sessionId }));
+        try { res = await doAxiosCall(callspec, sysCfg, session, httpsAgent); }
+        catch (err) { return wrapHttpResult(makeHttpEnvelope({ status: 0, error: mapNetError(err, callspec.timeout_ms ?? 30_000), duration_ms: Date.now() - start, session_id: sessionId })); }
+    }
+    const { body, body_raw } = parseResponseBody(res);
+    return wrapHttpResult(makeHttpEnvelope({ status: res.status, status_text: res.statusText || '', headers: res.headers || {},
+        body, body_raw, duration_ms: Date.now() - start, session_id: sessionId,
+        csrf_token_cached: !!session.csrfToken, cookies_count: session.cookieJar.size,
+        request_url_resolved: callspec.path.startsWith('http') ? callspec.path : `${sysCfg.baseUrl}${callspec.path.split('?')[0]}`, error: null }));
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+// Lock Manager — IDENTICAL to websocket-client.js
+// ════════════════════════════════════════════════════════════════════════════
+
+class LockManager {
+  constructor() { this.locks = new Map(); this.lockTTL = 30 * 60 * 1000; }
+  getLock(objectName, objectType) {
+    const key = `${objectName.toUpperCase()}:${objectType.toUpperCase()}`;
+    const lock = this.locks.get(key);
+    if (!lock) return null;
+    if (Date.now() - lock.timestamp >= this.lockTTL) { console.log(`   ⏰ Lock expired for ${key}`); this.locks.delete(key); return null; }
+    console.log(`   🔓 Found cached lock for ${key}`);
+    return lock;
+  }
+  saveLock(objectName, objectType, lockHandle, transportRequest) {
+    this.locks.set(`${objectName.toUpperCase()}:${objectType.toUpperCase()}`, { lockHandle, transportRequest, timestamp: Date.now() });
+  }
+  clearLock(objectName, objectType) { this.locks.delete(`${objectName.toUpperCase()}:${objectType.toUpperCase()}`); }
+  clearAll() { const c = this.locks.size; this.locks.clear(); if (c > 0) console.log(`   🧹 All locks cleared (${c} lock(s))`); }
+  getStats() { return { activeLocks: this.locks.size, locks: Array.from(this.locks.keys()) }; }
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+// SAP HTTP Client — IDENTICAL to websocket-client.js, but config from session
+// ════════════════════════════════════════════════════════════════════════════
+
+class SAPClient {
+  constructor(sessionEntry) {
+    this.session = sessionEntry;
+    this.csrfToken = null;
+    this.cookies = new Map();
+
+    const conn = sessionEntry.sysConfig?.connection || {};
+    const baseUrl = `https://${conn.host}:${conn.port || '44301'}`;
+
+    if (sessionEntry.useRfc && sessionEntry.rfcClient) {
+        this.rfcClient = sessionEntry.rfcClient;
+        console.log('🔀 SAPClient running in RFC mode (SAProuter)');
+    } else {
+        this.rfcClient = null;
+    }
+
+    // Keep cookies from HTTP session if available
+    const hs = sessionEntry.httpSession;
+    if (sessionEntry.httpSession) {
+        if (hs.csrfToken) {
+            this.csrfToken = hs.csrfToken;
+            console.log(`   🔑 CSRF token seeded from HTTP session: ${this.csrfToken.substring(0, 15)}...`);
+        }
+        if (hs.cookies?.size > 0) {
+            // BasicSession stores cookies as Map<name, value> (just the value, no "name=" prefix)
+            for (const [name, value] of hs.cookies) {
+                // Normalise to "name=value" format (same as what the interceptor stores)
+                this.cookies.set(name, value.includes('=') ? value : `${name}=${value}`);
+            }
+            console.log(`   🍪 ${this.cookies.size} cookie(s) seeded from BasicSession`);
+        }
+    }
+
+    this.client = axios.create({
+      baseURL: baseUrl,
+      headers: {
+        'sap-client': conn.client || '100',
+        'sap-language': conn.language || 'EN',
+        'Accept': 'application/xml,text/plain,*/*',
+        'X-sap-adt-sessiontype': 'stateful'
+      },
+      httpsAgent: new https.Agent({ rejectUnauthorized: false }),
+      auth: { username: conn.username || '', password: conn.password || '' }
+    });
+
+    this.client.interceptors.response.use(
+      response => {
+        if (response.headers['set-cookie']) {
+          response.headers['set-cookie'].forEach(cookieString => {
+            const cv = cookieString.split(';')[0];
+            this.cookies.set(cv.split('=')[0], cv);
+          });
+        }
+        if (response.headers['x-csrf-token']) {
+          this.csrfToken = response.headers['x-csrf-token'];
+          console.log(`   🔑 CSRF token obtained: ${this.csrfToken.substring(0, 15)}...`);
+        }
+        return response;
+      },
+      error => {
+        if (error.response?.status === 401 || error.response?.status === 403) {
+          console.error(`   ⚠️  Session error (${error.response.status}) - clearing...`);
+          this.clearSession();
+        }
+        return Promise.reject(error);
+      }
+    );
+
+    this.client.interceptors.request.use(request => {
+      if (this.cookies.size > 0)
+        request.headers['Cookie'] = Array.from(this.cookies.values()).join('; ');
+      return request;
+    });
+  }
+
+  async executeCallspec(callspec) {
+    if (this.rfcClient) return this._executeCallspecViaRFC(callspec);
+    return this._executeCallspecViaHTTP(callspec);
+  }
+
+  async _executeCallspecViaRFC(callspec) {
+    const { method, url, headers, extract_from_response } = callspec;
+    const conn = this.session.sysConfig?.connection || {};
+    let finalHeaders = { ...headers };
+    finalHeaders['sap-client']   = finalHeaders['sap-client']   || conn.client   || '100';
+    finalHeaders['sap-language'] = finalHeaders['sap-language'] || conn.language || 'EN';
+    if (finalHeaders['X-CSRF-Token'] === '<CSRF_TOKEN>') {
+        if (!this.rfcClient.csrfToken) {
+            this.rfcClient.csrfToken = this.csrfToken;
+        }
+        if (!this.rfcClient.csrfToken) {
+            await this.rfcClient.fetchCsrfToken();
+        }
+        if (this.rfcClient.csrfToken) {
+            finalHeaders['X-CSRF-Token'] = this.rfcClient.csrfToken;
+            console.log(`   🔑 RFC CSRF token: "${finalHeaders['X-CSRF-Token'].substring(0,20)}..."`);
+        } else {
+            delete finalHeaders['X-CSRF-Token'];
+            console.log(`   ⚠️  No CSRF token available — removing X-CSRF-Token header (RFC uses Basic Auth)`);
+        }
+    }
+    delete finalHeaders['Authorization'];
+    if (finalHeaders['Cookie'] === '<SESSION_COOKIE>') delete finalHeaders['Cookie'];
+    const creds = Buffer.from(`${conn.username || ''}:${conn.password || ''}`).toString('base64');
+    finalHeaders['Authorization'] = `Basic ${creds}`;
+
+    // ── Substitute body placeholders ────────────────────────────────────────
+    // abap-mcp-local sends placeholders like <SAP_LANGUAGE>, <SAP_CLIENT> in
+    // the XML body.  Replace them with real values from the connection config.
+    let body = callspec.body ?? null;
+    if (typeof body === 'string') {
+        const lang = conn.language || 'EN';
+        const client = conn.client || '100';
+        const user = (conn.username || '').toUpperCase();
+        body = body
+            .replace(/<SAP_LANGUAGE>/g,      lang)
+            .replace(/<SAP_CLIENT>/g,        client)
+            .replace(/<SAP_USER>/g,          user)
+            .replace(/<SAP_USERNAME>/g,      user)
+            .replace(/<SAP_RESPONSIBLE>/g,   user)
+            .replace(/<SAP_MASTER_LANG>/g,   lang)
+            .replace(/<SAP_MASTER_SYSTEM>/g, conn.systemId || '');
+    }
+
+    let uriPath = url;
+    try { const p = new URL(url); uriPath = p.pathname + (p.search || ''); } catch {}
+
+    console.log(`\n   ╔══════════════════════════════════════════════════════════════`);
+    console.log(`   ║ 📡 RFC ${method} ${uriPath}`);
+    console.log(`   ╠══════════════════════════════════════════════════════════════`);
+    console.log(`   ║ HEADERS:`);
+    for (const [k, v] of Object.entries(finalHeaders)) {
+        if (k === 'Authorization') console.log(`   ║   ${k}: Basic ***`);
+        else console.log(`   ║   ${k}: ${v}`);
+    }
+    if (body) {
+        console.log(`   ╠══════════════════════════════════════════════════════════════`);
+        console.log(`   ║ BODY (${body.length} chars):`);
+        body.split('\n').forEach(line => console.log(`   ║   ${line}`));
+    }
+    console.log(`   ╚══════════════════════════════════════════════════════════════\n`);
+    try {
+        const response = await this.rfcClient.callADT(method, uriPath, finalHeaders, body || null);
+        console.log(`   ✅ RFC response: ${response.status} ${response.statusText}`);
+        if (response.data && response.status >= 400) {
+            console.log(`   📄 RFC response body: ${typeof response.data === 'string' ? response.data.substring(0, 500) : JSON.stringify(response.data).substring(0, 500)}`);
+        }
+        const extractedData = {};
+        if (extract_from_response && typeof response.data === 'string') {
+            if (extract_from_response.lock_handle) { const m = response.data.match(/<(?:adtcore:)?(?:lock[Hh]andle|LOCK_HANDLE)>(.*?)<\/(?:adtcore:)?(?:lock[Hh]andle|LOCK_HANDLE)>/); if (m) extractedData.lockHandle = m[1]; }
+            if (extract_from_response.transport_request) { const m = response.data.match(/<(?:adtcore:)?(?:corrNr|CORRNR)>(.*?)<\/(?:adtcore:)?(?:corrNr|CORRNR)>/); if (m) extractedData.transportRequest = m[1]; }
+            if (extract_from_response.function_group) { const m = response.data.match(/PNAME[^>]*>([^<]*)</i); if (m) extractedData.functionGroup = m[1].replace(/^SAPL/, ''); }
+        }
+        const { hasErrors, errorMessages } = parseSAPResponse(response.data);
+        return { success: !hasErrors && response.status >= 200 && response.status < 300, status: response.status, statusText: response.statusText, headers: response.headers, data: { raw: response.data, ...extractedData }, ...(errorMessages.length > 0 && { error: `SAP validation failed: ${errorMessages.join('; ')}`, errorDetails: errorMessages }) };
+    } catch (err) {
+        console.error(`   ❌ RFC error: ${err.message}`);
+        return { success: false, status: 0, error: err.message, data: null };
+    }
+  }
+
+  async _executeCallspecViaHTTP(callspec) {
+    const { method, url, headers, extract_from_response } = callspec;
+    let finalUrl = url;
+    let finalHeaders = { ...headers };
+
+    // ── CSRF injection ──────────────────────────────────────────────────────
+    // Inject on: (a) explicit <CSRF_TOKEN> placeholder, OR
+    //            (b) any state-changing request (POST/PUT/PATCH/DELETE) so the
+    //                client works even when abap-mcp-local omits the placeholder.
+    const isStateChanging = !['GET', 'HEAD', 'OPTIONS'].includes((method || '').toUpperCase());
+    const hasPlaceholder  = finalHeaders['X-CSRF-Token'] === '<CSRF_TOKEN>';
+    if (hasPlaceholder || isStateChanging) {
+      if (!this.csrfToken) await this.fetchCsrfToken();
+      finalHeaders['X-CSRF-Token'] = this.csrfToken;
+    }
+
+    delete finalHeaders['Authorization'];
+    if (finalHeaders['Cookie'] === '<SESSION_COOKIE>') delete finalHeaders['Cookie'];
+
+    // ── Substitute body placeholders (same as RFC path) ────────────────────
+    let rawBody = callspec.body ?? undefined;
+    if (typeof rawBody === 'string') {
+        const conn2 = this.session?.sysConfig?.connection || {};
+        const lang2 = conn2.language || 'EN';
+        const user2 = (conn2.username || '').toUpperCase();
+        rawBody = rawBody
+            .replace(/<SAP_LANGUAGE>/g,      lang2)
+            .replace(/<SAP_CLIENT>/g,        conn2.client || '100')
+            .replace(/<SAP_USER>/g,          user2)
+            .replace(/<SAP_USERNAME>/g,      user2)
+            .replace(/<SAP_RESPONSIBLE>/g,   user2)
+            .replace(/<SAP_MASTER_LANG>/g,   lang2)
+            .replace(/<SAP_MASTER_SYSTEM>/g, conn2.systemId || '');
+    }
+
+    // ── body: use ?? so empty-string bodies (LOCK, ACTIVATE) are preserved ──
+    const bodyData = rawBody;
+
+    // ── Full request dump ───────────────────────────────────────────────────
+    console.log(`\n   ╔══════════════════════════════════════════════════════════════`);
+    console.log(`   ║ 📤 REQUEST: ${method} ${finalUrl}`);
+    console.log(`   ╠══════════════════════════════════════════════════════════════`);
+    console.log(`   ║ HEADERS SENT:`);
+    // Merge: instance defaults + per-request headers (axios will do the same)
+    const instanceDefaults = this.client.defaults?.headers || {};
+    const merged = {
+      ...(instanceDefaults.common || {}),
+      ...((instanceDefaults[(method || '').toLowerCase()]) || {}),
+      ...finalHeaders,
+    };
+    for (const [k, v] of Object.entries(merged)) {
+      if (k === 'Authorization') console.log(`   ║   ${k}: Basic ***`);
+      else console.log(`   ║   ${k}: ${v}`);
+    }
+    console.log(`   ╠══════════════════════════════════════════════════════════════`);
+    console.log(`   ║ CSRF token in session: ${this.csrfToken ? this.csrfToken.substring(0, 20) + '...' : 'NONE ⚠️'}`);
+    console.log(`   ║ Cookies in jar: ${this.cookies.size}`);
+    if (this.cookies.size > 0) {
+      for (const [k] of this.cookies) console.log(`   ║   cookie: ${k}`);
+    }
+    console.log(`   ╠══════════════════════════════════════════════════════════════`);
+    if (bodyData !== undefined && bodyData !== null) {
+      const bodyStr = typeof bodyData === 'string' ? bodyData : JSON.stringify(bodyData);
+      console.log(`   ║ BODY (${bodyStr.length} chars, type=${typeof bodyData}):`);
+      bodyStr.split('\n').slice(0, 40).forEach(line => console.log(`   ║   ${line}`));
+      if (bodyStr.split('\n').length > 40) console.log(`   ║   ... (truncated)`);
+    } else {
+      console.log(`   ║ BODY: (none)`);
+    }
+    console.log(`   ╚══════════════════════════════════════════════════════════════\n`);
+
+    try {
+      const response = await this.client.request({ method, url: finalUrl, headers: finalHeaders, data: bodyData, timeout: 60000 });
+      console.log(`   ✅ ${response.status} ${response.statusText}`);
+
+      // Log response headers + body
+      console.log(`   ║ RESPONSE HEADERS:`);
+      for (const [k, v] of Object.entries(response.headers || {})) console.log(`   ║   ${k}: ${v}`);
+      const resBodyStr = typeof response.data === 'string' ? response.data : JSON.stringify(response.data);
+      console.log(`   ║ RESPONSE BODY (${resBodyStr?.length || 0} chars): ${resBodyStr?.substring(0, 800)}`);
+
+      const extractedData = {};
+      if (extract_from_response && typeof response.data === 'string') {
+        if (extract_from_response.lock_handle) { const m = response.data.match(/<(?:adtcore:)?(?:lock[Hh]andle|LOCK_HANDLE)>(.*?)<\/(?:adtcore:)?(?:lock[Hh]andle|LOCK_HANDLE)>/); if (m) extractedData.lockHandle = m[1]; }
+        if (extract_from_response.transport_request) { const m = response.data.match(/<(?:adtcore:)?(?:corrNr|CORRNR)>(.*?)<\/(?:adtcore:)?(?:corrNr|CORRNR)>/); if (m) extractedData.transportRequest = m[1]; }
+      }
+      const { hasErrors, errorMessages } = parseSAPResponse(response.data);
+      if (hasErrors) { console.log(`   ⚠️  Found ${errorMessages.length} error(s)`); errorMessages.forEach((m, i) => console.log(`   ❌ Error ${i + 1}: ${m}`)); }
+      return { success: !hasErrors && response.status >= 200 && response.status < 300, status: response.status, statusText: response.statusText, headers: response.headers, data: { raw: response.data, ...extractedData }, ...(errorMessages.length > 0 && { error: `SAP validation failed: ${errorMessages.join('; ')}`, errorDetails: errorMessages }) };
+    } catch (error) {
+      const status = error.response?.status;
+      console.error(`   ❌ HTTP ${status || 'network error'}: ${error.message}`);
+      if (error.response?.headers) {
+        console.error(`   ❌ RESPONSE HEADERS:`);
+        for (const [k, v] of Object.entries(error.response.headers)) console.error(`   ❌   ${k}: ${v}`);
+      }
+      const resBody = typeof error.response?.data === 'string'
+        ? error.response.data
+        : JSON.stringify(error.response?.data);
+      if (resBody) console.error(`   ❌ RESPONSE BODY:\n${resBody}`);
+      return { success: false, status, error: error.message, data: error.response?.data };
+    }
+  }
+
+  async fetchCsrfToken() {
+    console.log('   🔑 Fetching CSRF token...');
+    try { await this.client.get('/sap/bc/adt/compatibility/graph', { headers: { 'X-CSRF-Token': 'Fetch' } }); }
+    catch (error) { if (error.response?.headers['x-csrf-token']) this.csrfToken = error.response.headers['x-csrf-token']; }
+  }
+
+  clearSession() { this.csrfToken = null; this.cookies.clear(); console.log('   🧹 Session cleared'); }
+
+  async ping() {
+    try { const r = await this.client.get('/sap/bc/adt/compatibility/graph', { timeout: 5000 }); return { success: true, status: r.status }; }
+    catch (e) { return { success: false, error: e.message }; }
+  }
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+// WebSocket Client — IDENTICAL to websocket-client.js
+// ════════════════════════════════════════════════════════════════════════════
+
+class WebSocketClient {
+  constructor() {
+    this.ws = null;
+    this.sapClient = null;
+    this.reconnectTimer = null;
+    this.keepAliveTimer = null;
+    this.isReconnecting = false;
+    this.lockManager = new LockManager();
+    this.currentSystemId = null;
+  }
+
+  async initSapClient() {
+    const sid = this.currentSystemId;
+    if (!sid) { console.error('❌ No system selected'); return false; }
+    try {
+        const sessionEntry = await getSessionForSystem(sid);
+        this.sapClient = new SAPClient(sessionEntry);
+        console.log(`✅ SAPClient initialized for ${sid}`);
+        return true;
+    } catch (err) {
+        console.error(`❌ Failed to init SAPClient: ${err.message}`);
+        return false;
+    }
+  }
+
+  connect() {
+    if (this.ws) {
+      if (this.ws.readyState === WebSocket.CONNECTING) { console.log('⚠️  Already connecting'); return; }
+      if (this.ws.readyState === WebSocket.OPEN) { console.log('⚠️  Already connected'); return; }
+    }
+    if (this.isReconnecting) { console.log('⚠️  Reconnection already scheduled'); return; }
+    console.log(`\n🔌 Connecting to MCP Cloud...`);
+    console.log(`   URL: ${WS_URL}`);
+    this.ws = new WebSocket(WS_URL, { headers: { 'Authorization': `Bearer ${MCP_API_KEY}` } });
+    this.ws.on('open', () => this.onOpen());
+    this.ws.on('message', (data) => this.onMessage(data));
+    this.ws.on('error', (error) => this.onError(error));
+    this.ws.on('close', () => this.onClose());
+  }
+
+  onOpen() {
+    console.log(`✅ Connected to MCP Cloud!\n`);
+    if (this.reconnectTimer) { clearTimeout(this.reconnectTimer); this.reconnectTimer = null; }
+    this.isReconnecting = false;
+    this.startKeepAlive();
+  }
+
+  startKeepAlive() {
+    if (this.keepAliveTimer) clearInterval(this.keepAliveTimer);
+    this.keepAliveTimer = setInterval(async () => {
+      if (!this.sapClient) return;
+      const r = await this.sapClient.ping();
+    }, parseInt(env.SAP_KEEPALIVE_INTERVAL || '300000', 10));
+  }
+
+  stopKeepAlive() { if (this.keepAliveTimer) { clearInterval(this.keepAliveTimer); this.keepAliveTimer = null; } }
+
+  async onMessage(data) {
+    let message;
+    try { message = JSON.parse(data.toString()); } catch { return; }
+    try {
+      if (message.type === 'welcome') { console.log(`👋 Welcome:`, message.message); return; }
+
+      if (message.type === 'command') {
+        if (message.command === 'clear_locks') { this.lockManager.clearAll(); return; }
+        if (message.command === 'lock_stats') { const s = this.lockManager.getStats(); console.log(`\n📊 Lock Stats: ${s.activeLocks} active`); return; }
+      }
+
+      const { requestId, action, callspecs, system } = message;
+      if (!requestId || !action) { console.error('❌ Invalid message format'); return; }
+      console.log(`\n📥 Received: ${action} (request: ${requestId})`);
+
+      // ── switch_system ──────────────────────────────────────────────────
+      if (action === 'switch_system') {
+        const sid = system || (callspecs?.[0]?.system) || '';
+        if (!sid) { this.sendResponse(requestId, false, { error: 'system required' }); return; }
+        const sys = config.getSystem(sid);
+        if (!sys) { this.sendResponse(requestId, false, { error: `Unknown system: ${sid}` }); return; }
+        this.currentSystemId = sid;
+        this.lockManager.clearAll();
+        const ok = await this.initSapClient();
+        if (!ok) { this.sendResponse(requestId, false, { error: `Failed to connect to ${sid}. Check RFC/SNC config and logs.` }); return; }
+        this.sendResponse(requestId, true, [{ success: true, data: { system: sid, authMode: sys.authMode } }]);
+        return;
+      }
+
+      // ── invoke_rfc ─────────────────────────────────────────────────────
+      if (action === 'invoke_rfc') {
+        if (!this.sapClient?.rfcClient) { this.sendResponse(requestId, false, { error: 'No RFC session' }); return; }
+        const spec = Array.isArray(callspecs) ? callspecs[0] : callspecs || {};
+        const { fm, importing = {}, tables = [], table_fields = ['LINE'] } = spec;
+        try {
+          const tr = await this.sapClient.rfcClient.callFM(fm, importing, tables, table_fields);
+          const ft = tables[0] || '';
+          const lines = (tr[ft] || []).map(l => (l || '').trimEnd());
+          this.sendResponse(requestId, true, [{ success: true, data: { raw: lines.join('\n') } }]);
+        } catch (err) { this.sendResponse(requestId, false, { error: err.message }); }
+        return;
+      }
+
+      // ── http_call ──────────────────────────────────────────────────────
+      if (action === 'http_call') {
+        const specs = Array.isArray(callspecs) ? callspecs : [callspecs];
+        const results = [];
+        for (const cs of specs) {
+          const r = await handleHttpCall(cs, this.sapClient?.client?.defaults?.httpsAgent);
+          results.push(r);
+        }
+        this.sendResponse(requestId, results.every(r => r.success), results);
+        return;
+      }
+
+      // ── Standard callspec execution ────────────────────────────────────
+      if (!this.sapClient) {
+        if (!await this.initSapClient()) { this.sendResponse(requestId, false, { error: 'No system selected. Use switch_system first.' }); return; }
+      }
+      const exec = await this.executeCallspecs(action, callspecs);
+      this.sendResponse(requestId, exec.allSuccessful, exec.results);
+      console.log(`✅ Done: ${action}\n`);
+    } catch (error) {
+      console.error(`❌ Error: ${error.message}`);
+      if (message?.requestId) this.sendResponse(message.requestId, false, { error: error.message });
+    }
+  }
+
+  async executeCallspecs(action, callspecs) {
+    console.log(`   Executing ${action} on SAP...`);
+    console.log(`   📦 RAW CALLSPECS (first 500): ${JSON.stringify(callspecs).substring(0, 500)}`);
+    if (Array.isArray(callspecs)) {
+      const results = [];
+      const extractedValues = {};
+      let allSuccessful = true;
+      let objectName = null, objectType = null;
+      if (callspecs.length > 0 && callspecs[0].url) {
+        const m = callspecs[0].url.match(/\/adt\/(?:ddic\/(?:tables|structures)|oo\/(?:classes|interfaces)|programs\/(?:programs|includes))\/([^\/\?]+)/i);
+        if (m) {
+          objectName = m[1];
+          if (callspecs[0].url.includes('/ddic/tables/')) objectType = 'TABL';
+          else if (callspecs[0].url.includes('/ddic/structures/')) objectType = 'STRU';
+          else if (callspecs[0].url.includes('/oo/classes/')) objectType = 'CLAS';
+          else if (callspecs[0].url.includes('/oo/interfaces/')) objectType = 'INTF';
+          else if (callspecs[0].url.includes('/programs/programs/')) objectType = 'PROG';
+          else if (callspecs[0].url.includes('/programs/includes/')) objectType = 'INCL';
+          console.log(`   🏷️  Detected: ${objectName} (${objectType})`);
+        }
+      }
+      for (let i = 0; i < callspecs.length; i++) {
+        const cs = callspecs[i];
+        console.log(`\n   📋 Step: ${cs.name || cs.step}`);
+        const isLockOp = cs.name === 'LOCK' || cs.url?.includes('_action=LOCK');
+        if (isLockOp && objectName && objectType) {
+          const cached = this.lockManager.getLock(objectName, objectType);
+          if (cached) {
+            console.log(`   ⚡ SKIPPING LOCK - cached!`);
+            extractedValues.lockHandle = cached.lockHandle;
+            extractedValues.transportRequest = cached.transportRequest;
+            results.push({ success: true, status: 200, statusText: 'OK (cached)', data: { lockHandle: cached.lockHandle, transportRequest: cached.transportRequest, cached: true } });
+            continue;
+          }
+        }
+        let pcs = { ...cs };
+        if (pcs.url) {
+          if (extractedValues.lockHandle) pcs.url = pcs.url.replace(/<LOCK_HANDLE>/g, extractedValues.lockHandle);
+          if (extractedValues.transportRequest) pcs.url = pcs.url.replace(/<TRANSPORT_REQUEST>/g, extractedValues.transportRequest);
+        }
+        // For UNLOCK: inject lockHandle from cache if not already present in URL
+        if (pcs.url?.includes('_action=UNLOCK') && !pcs.url.includes('lockHandle=') && !pcs.url.includes('<LOCK_HANDLE>')) {
+          const cachedLock = objectName && objectType ? this.lockManager.getLock(objectName, objectType) : null;
+          if (cachedLock?.lockHandle) {
+            pcs.url = pcs.url + (pcs.url.includes('?') ? '&' : '?') + 'lockHandle=' + cachedLock.lockHandle;
+            console.log(`   🔓 Injected lockHandle into UNLOCK URL from cache: ${cachedLock.lockHandle.substring(0,10)}...`);
+          }
+        }
+        const result = await this.sapClient.executeCallspec(pcs);
+        results.push(result);
+        if (result.success && result.data) {
+          if (result.data.lockHandle) {
+            extractedValues.lockHandle = result.data.lockHandle;
+            if (isLockOp && objectName && objectType) this.lockManager.saveLock(objectName, objectType, result.data.lockHandle, result.data.transportRequest || '');
+          }
+          if (result.data.transportRequest) extractedValues.transportRequest = result.data.transportRequest;
+        }
+        if (!result.success) { allSuccessful = false; break; }
+      }
+      return { results, allSuccessful };
+    } else {
+      const r = await this.sapClient.executeCallspec(callspecs);
+      return { results: [r], allSuccessful: r.success };
+    }
+  }
+
+  sendResponse(requestId, success, data) {
+    if (!this.ws || this.ws.readyState !== WebSocket.OPEN) { console.error('❌ WS not connected'); return; }
+    this.ws.send(JSON.stringify({ type: 'response', requestId, success, data, timestamp: new Date().toISOString() }));
+  }
+
+  onError(error) { console.error(`❌ WS error: ${error.message}`); }
+
+  onClose() {
+    console.log(`\n⚠️  Disconnected`);
+    this.ws = null; this.stopKeepAlive();
+    if (this.sapClient) this.sapClient.clearSession();
+    this.lockManager.clearAll();
+    if (!this.isReconnecting && !this.reconnectTimer) {
+      console.log(`   Reconnecting in 5s...`);
+      this.isReconnecting = true;
+      this.reconnectTimer = setTimeout(() => { this.isReconnecting = false; this.connect(); }, 5000);
+    }
+  }
+
+  disconnect() {
+    if (this.reconnectTimer) { clearTimeout(this.reconnectTimer); this.reconnectTimer = null; }
+    this.isReconnecting = false; this.stopKeepAlive();
+    if (this.ws) { this.ws.close(); this.ws = null; }
+  }
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+// Main
+// ════════════════════════════════════════════════════════════════════════════
+
+let MCP_API_KEY = '';
+let WS_URL = env.WS_URL || 'ws://localhost:8080';
+
+function loadGlobalConfig() {
+    if (config.isConfigInitialized()) { MCP_API_KEY = config.getMcpApiKey(); WS_URL = config.getWsUrl(); console.log('🔑 Config from encrypted store.'); }
+    else { MCP_API_KEY = env.API_KEY || ''; WS_URL = env.WS_URL || 'ws://localhost:8080'; console.log('⚠️  Using .env fallback.'); }
+    if (!MCP_API_KEY) { console.error('❌ No MCP API key'); process.exit(1); }
+}
+
+const args = process.argv.slice(2);
+if (args[0] === 'setup' || args[0] === 'config' || args[0] === 'add-system' || args[0] === 'set-mcp-key' ||
+    args[0] === 'list-systems' || args[0] === 'remove-system' || args[0] === 'enable-system' ||
+    args[0] === 'disable-system' || args[0] === 'show-config' || args[0] === 'arcanum-fallback' ||
+    args[0] === 'set-ws-url' || args[0] === 'help') {
+    await import('./config-cli.mjs'); process.exit(0);
+}
+
+if (!config.isConfigInitialized()) {
+    config.addOrUpdateSystem('S4D', { authMode: 'snc', connection: { host: 'vhlbvs4dci.sap.piracanjuba.com.br', sysnr: '00', client: '100', username: '', sncPartnerName: 'p:CN=svc.ssoS4D', sncQop: '3', language: 'PT' }, enabled: true });
+    config.setMcpApiKey('arc_de2fb7965d536a5911ffd7d9ba39d70c');
+}
+
+console.log('╔═══════════════════════════════════════════════════════════╗');
+console.log('║  SAP Local Client — Multi-System SSO Bridge              ║');
+console.log('╚═══════════════════════════════════════════════════════════╝');
+loadGlobalConfig();
+console.log(`  WS URL:     ${WS_URL}`);
+console.log(`  API Key:    ${MCP_API_KEY.substring(0, 10)}...`);
+console.log(`  Store:      ${config.getConfigFilePath()}`);
+const enabled = (config.listSystems() || []).filter(s => s.enabled);
+console.log(`  Systems:    ${enabled.map(s => `${s.systemId} (${s.authMode})`).join(', ') || 'none'}`);
+console.log('  Use:        switch_system <systemId> to select a system');
+
+const client = new WebSocketClient();
+await fetchSapSystems();
+client.connect();
+
+process.on('SIGINT', () => { client.disconnect(); process.exit(0); });
+process.on('SIGTERM', () => { client.disconnect(); process.exit(0); });