sap-ai-dev-toolkit 0.2.5

package/test/copilot-content.test.mjs

@@ -0,0 +1,145 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile, readdir, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+
+const root = process.cwd();
+const agentsRoot = join(root, '.github', 'agents');
+const agentPath = join(agentsRoot, 'abap-developer.agent.md');
+const skillsRoot = join(root, '.github', 'skills');
+const expectedAgents = [
+  'abap-developer.agent.md',
+  'abap-runtime-debugger.agent.md',
+  'rap-service-developer.agent.md',
+  'sap-solution-architect.agent.md'
+];
+const expectedSkills = [
+  'abap-debugging',
+  'abap-development',
+  'abap-runtime-analysis',
+  'abap-testing-quality',
+  'cds-development',
+  'clean-core-extensibility',
+  'rap-development',
+  'rap-service-delivery',
+  'sap-sdlc-orchestration',
+  'sap-standard-api-analysis',
+  'sap-transport-release'
+];
+
+async function readMarkdown(path) {
+  return readFile(path, 'utf8');
+}
+
+function parseFrontmatter(markdown, path) {
+  const match = /^---\n([\s\S]*?)\n---\n/.exec(markdown);
+  assert.ok(match, `${path} must start with YAML frontmatter`);
+  const metadata = {};
+  for (const line of match[1].split('\n')) {
+    const separator = line.indexOf(':');
+    assert.ok(separator > 0, `${path} has invalid frontmatter line: ${line}`);
+    metadata[line.slice(0, separator).trim()] = line.slice(separator + 1).trim();
+  }
+  return metadata;
+}
+
+function assertMentionsLiveToolDiscovery(markdown, path) {
+  assert.match(markdown, /tools\/list/i, `${path} must require live MCP tool discovery`);
+  assert.match(markdown, /destination-prefixed|destination-prefixed names/i, `${path} must tell agents to use actual destination-prefixed tool names`);
+  assert.match(markdown, /schema/i, `${path} must tell agents to follow live tool schemas`);
+}
+
+function assertValidationPolicy(markdown, path) {
+  assert.match(markdown, /ABAP Unit|RunUnitTests/i, `${path} must include ABAP Unit or test execution guidance`);
+  assert.match(markdown, /runtime validation|Self-validate|executable validation|reproduce/i, `${path} must require executable/runtime validation evidence`);
+  assert.match(markdown, /activate|activation/i, `${path} must handle activation state or blockers`);
+  assert.match(markdown, /report|Record|document/i, `${path} must require observed outcome reporting`);
+}
+
+function assertNoUnsafeTransportClaims(markdown, path) {
+  const releaseMentions = markdown.match(/ReleaseTransport|release\/deletion|release and deletion|release is unavailable|release action/gi) || [];
+  assert.ok(releaseMentions.length > 0 || !/transport/i.test(markdown), `${path} transport guidance should explicitly handle release limitations when transport is discussed`);
+  assert.doesNotMatch(markdown, /use\s+`?ReleaseTransport`?|call\s+`?ReleaseTransport`?|with\s+`?ReleaseTransport`?/i, `${path} must not instruct the agent to release transports through this addon`);
+  assert.doesNotMatch(markdown, /use\s+`?DeleteTransport`?|call\s+`?DeleteTransport`?|with\s+`?DeleteTransport`?/i, `${path} must not instruct the agent to delete transports through this addon`);
+}
+
+test('packaged Copilot agent and skill inventory is complete and canonical', async () => {
+  assert.equal((await stat(agentPath)).isFile(), true);
+  assert.deepEqual((await readdir(agentsRoot)).sort(), expectedAgents);
+  const actualSkills = (await readdir(skillsRoot)).sort();
+  assert.deepEqual(actualSkills, expectedSkills);
+  for (const skill of expectedSkills) {
+    assert.equal((await stat(join(skillsRoot, skill, 'SKILL.md'))).isFile(), true, `${skill} must have SKILL.md`);
+  }
+});
+
+test('ABAP Developer agent has valid metadata and invokes the packaged skills', async () => {
+  const markdown = await readMarkdown(agentPath);
+  const metadata = parseFrontmatter(markdown, agentPath);
+  assert.deepEqual(Object.keys(metadata).sort(), ['description', 'name', 'target', 'user-invocable']);
+  assert.equal(metadata.name, 'ABAP Developer');
+  assert.equal(metadata.target, 'vscode');
+  assert.equal(metadata['user-invocable'], 'true');
+  assert.match(metadata.description, /ABAP/i);
+  assert.match(metadata.description, /BAS|SAP/i);
+
+  for (const skill of ['ABAP implementation', 'RAP', 'CDS', 'debugging', 'transport']) {
+    assert.match(markdown, new RegExp(skill, 'i'), `agent should route to ${skill} skill guidance`);
+  }
+  assertMentionsLiveToolDiscovery(markdown, agentPath);
+  assertValidationPolicy(markdown, agentPath);
+  assertNoUnsafeTransportClaims(markdown, agentPath);
+});
+
+test('SAP Solution Architect agent has valid metadata and planning/handoff policy', async () => {
+  const path = join(agentsRoot, 'sap-solution-architect.agent.md');
+  const markdown = await readMarkdown(path);
+  const metadata = parseFrontmatter(markdown, path);
+  assert.deepEqual(Object.keys(metadata).sort(), ['description', 'name', 'target', 'user-invocable']);
+  assert.equal(metadata.name, 'SAP Solution Architect');
+  assert.equal(metadata.target, 'vscode');
+  assert.equal(metadata['user-invocable'], 'true');
+  assert.match(metadata.description, /standard|Clean Core|side-by-side|SDLC/i);
+  assertMentionsLiveToolDiscovery(markdown, path);
+  assert.match(markdown, /GetAPIReleaseState/i);
+  assert.match(markdown, /Clean Core/i);
+  assert.match(markdown, /side-by-side/i);
+  assert.match(markdown, /ABAP Developer/i);
+  assert.match(markdown, /RAP Service Developer/i);
+  assert.match(markdown, /ABAP Runtime Debugger/i);
+  assert.match(markdown, /SDLC|lifecycle/i);
+  assertNoUnsafeTransportClaims(markdown, path);
+});
+
+test('each skill has valid metadata, matching name, and enforceable live-tool validation policy', async () => {
+  for (const skill of expectedSkills) {
+    const path = join(skillsRoot, skill, 'SKILL.md');
+    const markdown = await readMarkdown(path);
+    const metadata = parseFrontmatter(markdown, path);
+    assert.deepEqual(Object.keys(metadata).sort(), ['description', 'name']);
+    assert.equal(metadata.name, skill, `${skill} frontmatter name must match its directory`);
+    assert.ok(metadata.description.length >= 40, `${skill} needs a useful description`);
+    assert.match(markdown, /^#\s+\S.+$/m, `${skill} must have a top-level heading`);
+    assertMentionsLiveToolDiscovery(markdown, path);
+    assertNoUnsafeTransportClaims(markdown, path);
+  }
+});
+
+test('implementation-oriented skills require tests, runtime evidence, activation, and separate reporting', async () => {
+  for (const skill of ['abap-development', 'abap-testing-quality', 'cds-development', 'rap-development', 'sap-transport-release']) {
+    const path = join(skillsRoot, skill, 'SKILL.md');
+    const markdown = await readMarkdown(path);
+    assertValidationPolicy(markdown, path);
+    assert.match(markdown, /do not (?:treat|present|claim)|never report|not replace|not .*substitutes?/i, `${skill} must explicitly prevent substituting static checks for behavior evidence`);
+  }
+});
+
+test('debugging skill requires evidence before fixes and bounded debugger use', async () => {
+  const path = join(skillsRoot, 'abap-debugging', 'SKILL.md');
+  const markdown = await readMarkdown(path);
+  assert.match(markdown, /reproduce/i);
+  assert.match(markdown, /dumps?|ListDumps/i);
+  assert.match(markdown, /DebuggerDetach/i);
+  assert.match(markdown, /Avoid attaching to another user's session|do not.*another user's session/i);
+  assert.match(markdown, /before changing code|before proposing a cause/i);
+});

package/test/discovery.test.mjs

@@ -0,0 +1,199 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createServer } from 'node:http';
+import { normalizeDestination, destinationUrl, discoverDestinations, fetchDestinationList, redact, sanitizeChildEnv, slugifyDestination } from '../src/bas-discovery.mjs';
+
+test('normalizes destination metadata case-insensitively', () => {
+  const destination = normalizeDestination({
+    Name: 'DEV-ABAP',
+    Properties: { 'WebIDEEnabled': 'true', 'HTML5.DynamicDestination': true, 'WebIDEUsage': 'dev_abap', 'SAP-Client': '200', Authentication: 'PrincipalPropagation', URL: 'https://backend.example' }
+  });
+  assert.deepEqual(destination, {
+    name: 'DEV-ABAP', authentication: 'PrincipalPropagation', client: '200',
+    url: 'http://DEV-ABAP.dest', rawKeys: ['Name', 'Properties']
+  });
+});
+
+test('returns every named destination regardless of ADT probe and preserves allowlists', async () => {
+  const body = { DESTINATIONS: [
+    { Name: 'z-system', WebIDEEnabled: true, 'HTML5.DynamicDestination': false, WebIDEUsage: 'ui5' },
+    { Name: 'b-system', WebIDEEnabled: false, 'HTML5.DynamicDestination': false, WebIDEUsage: 'ui5' },
+    { Name: 'a-system', WebIDEEnabled: false, 'HTML5.DynamicDestination': false, WebIDEUsage: 'ui5' }
+  ] };
+  const probeImpl = async url => ({ status: url.includes('a-system') ? 403 : url.includes('b-system') ? 200 : 404 });
+  const allowlisted = await discoverDestinations({
+    body,
+    env: { BAS_VSP_DESTINATION: 'a-system,b-system' },
+    probeImpl
+  });
+  assert.deepEqual(allowlisted.map(item => [item.name, item.client, item.probe.status]), [
+    ['a-system', '001', 'auth-required'],
+    ['b-system', '001', 'available']
+  ]);
+
+  const all = await discoverDestinations({ body, env: {}, probeImpl });
+  assert.deepEqual(all.map(item => [item.name, item.probe.status]), [
+    ['a-system', 'auth-required'],
+    ['b-system', 'available'],
+    ['z-system', 'not-found']
+  ]);
+});
+test('parses sample-style destination records and enables every ADT heartbeat response', async () => {
+  const body = [
+    {
+      Type: 'HTTP',
+      'HTML5.DynamicDestination': 'true',
+      Authentication: 'PrincipalPropagation',
+      'sap-client': '200',
+      Name: 'DGT_200',
+      WebIDEUsage: 'odata_abap,ui5_execute_abap,dev_abap',
+      WebIDEEnabled: 'true'
+    },
+    {
+      Name: 'S4D_100',
+      Type: 'HTTP',
+      Authentication: 'PrincipalPropagation',
+      'HTML5.DynamicDestination': 'true',
+      'sap-client': '100',
+      WebIDEUsage: 'odata_abap',
+      WebIDEEnabled: 'true'
+    },
+    {
+      Name: 'SUP_BACKEND',
+      Type: 'HTTP',
+      Authentication: 'OAuth2ClientCredentials',
+      'HTML5.DynamicDestination': 'true',
+      WebIDEUsage: 'true',
+      WebIDEEnabled: 'true'
+    }
+  ];
+  const probed = [];
+  const destinations = await discoverDestinations({
+    body,
+    env: {},
+    probeImpl: async url => {
+      probed.push(url);
+      if (url.includes('DGT_200.dest')) return { status: 200 };
+      if (url.includes('S4D_100.dest')) return { status: 403 };
+      return { status: 404 };
+    }
+  });
+
+  assert.deepEqual(probed, [
+    'http://DGT_200.dest/sap/bc/adt/discovery',
+    'http://S4D_100.dest/sap/bc/adt/discovery',
+    'http://SUP_BACKEND.dest/sap/bc/adt/discovery'
+  ]);
+  assert.deepEqual(destinations.map(({ name, client, authentication, probe }) => [
+    name, client, authentication, probe.status, probe.available
+  ]), [
+    ['DGT_200', '200', 'PrincipalPropagation', 'available', true],
+    ['S4D_100', '100', 'PrincipalPropagation', 'auth-required', true],
+    ['SUP_BACKEND', '001', 'OAuth2ClientCredentials', 'not-found', false]
+  ]);
+});
+
+test('keeps T4D destinations when their ADT probes fail', async () => {
+  const destinations = await discoverDestinations({
+    body: [
+      { Name: 'T4D_100', 'sap-client': '100' },
+      { Name: 'T4D_200', 'sap-client': '200' }
+    ],
+    env: {},
+    probeImpl: async url => ({ status: url.includes('T4D_100') ? 503 : 404 })
+  });
+
+  assert.deepEqual(destinations.map(({ name, client, probe }) => [
+    name, client, probe.status, probe.httpStatus, probe.available
+  ]), [
+    ['T4D_100', '100', 'unavailable', 503, false],
+    ['T4D_200', '200', 'not-found', 404, false]
+  ]);
+});
+
+
+test('rejects invalid destination URL names and creates deterministic collision slugs', () => {
+  assert.equal(destinationUrl('A-1_2'), 'http://A-1_2.dest');
+  assert.throws(() => destinationUrl('backend.example/path'), /Invalid BAS destination name/);
+  const used = new Map();
+  assert.deepEqual(['Dev System', 'dev-system', 'DEV_SYSTEM'].map(name => slugifyDestination(name, used)), ['dev-system', 'dev-system-2', 'dev-system-3']);
+});
+
+test('sanitizes child identity material and preserves caller proxy safety settings', () => {
+  const env = sanitizeChildEnv({ HTTP_PROXY: 'http://proxy:8887', NO_PROXY: 'localhost,.dest,127.0.0.1', Authorization: 'Bearer secret', Cookie: 'SAP_SESSION=secret', SAP_USER: 'alice', SAP_PASSWORD: 'secret', SAP_READ_ONLY: 'true' });
+  assert.equal(env.SAP_PROXY_CONTEXTID_GUARD, 'true');
+  assert.equal(env.HTTP_PROXY, 'http://proxy:8887');
+  assert.equal(env.NO_PROXY, 'localhost,127.0.0.1');
+  assert.equal(env.SAP_READ_ONLY, 'true');
+  assert.equal(env.Authorization, undefined);
+  assert.equal(env.Cookie, undefined);
+  assert.equal(env.SAP_USER, undefined);
+  assert.equal(env.SAP_PASSWORD, undefined);
+});
+
+test('probes .dest only through configured HTTP proxy and accepts proxy-auth responses', async () => {
+  const requests = [];
+  const proxy = createServer((request, response) => {
+    requests.push({ host: request.headers.host, path: request.url });
+    response.writeHead(401);
+    response.end();
+  });
+  await new Promise(resolve => proxy.listen(0, '127.0.0.1', resolve));
+  const port = proxy.address().port;
+  const found = await discoverDestinations({
+    body: [{ Name: 'proxy-system' }],
+    env: { HTTP_PROXY: `http://127.0.0.1:${port}` }
+  });
+  await new Promise(resolve => proxy.close(resolve));
+  assert.equal(found[0].probe.status, 'auth-required');
+  assert.deepEqual(requests, [{ host: 'proxy-system.dest', path: 'http://proxy-system.dest/sap/bc/adt/discovery' }]);
+});
+
+test('fetches BAS destination lists through configured HTTP and HTTPS proxies', async t => {
+  const proxyRequests = [];
+  const directRequests = [];
+  const target = createServer((request, response) => {
+    directRequests.push({ method: request.method, host: request.headers.host, path: request.url });
+    response.writeHead(200, { 'content-type': 'application/json' });
+    response.end(JSON.stringify([{ Name: 'direct-system' }]));
+  });
+  await new Promise(resolve => target.listen(0, '127.0.0.1', resolve));
+  const proxy = createServer((request, response) => {
+    proxyRequests.push({ method: request.method, host: request.headers.host, path: request.url });
+    response.writeHead(200, { 'content-type': 'application/json' });
+    response.end(JSON.stringify([{ Name: 'proxied-system' }]));
+  });
+  proxy.on('connect', (request, socket) => {
+    proxyRequests.push({ method: request.method, host: request.url });
+    socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
+  });
+  await new Promise(resolve => proxy.listen(0, '127.0.0.1', resolve));
+  t.after(async () => {
+    await Promise.all([target, proxy].map(server => new Promise(resolve => server.close(resolve))));
+  });
+  const proxyUrl = `http://127.0.0.1:${proxy.address().port}`;
+  const env = { http_proxy: proxyUrl, https_proxy: proxyUrl, no_proxy: '' };
+  const body = await fetchDestinationList('http://bas.example', { env, timeoutMs: 1000 });
+  assert.deepEqual(body, [{ Name: 'proxied-system' }]);
+  await assert.rejects(fetchDestinationList('https://bas.example', { env, timeoutMs: 1000 }));
+  assert.deepEqual(proxyRequests, [
+    { method: 'GET', host: 'bas.example', path: 'http://bas.example/api/listDestinations' },
+    { method: 'CONNECT', host: 'bas.example:443' }
+  ]);
+  const directBody = await fetchDestinationList(`http://127.0.0.1:${target.address().port}`, {
+    env: { HTTP_PROXY: proxyUrl, NO_PROXY: '127.0.0.1' },
+    timeoutMs: 1000
+  });
+  assert.deepEqual(directBody, [{ Name: 'direct-system' }]);
+  assert.deepEqual(directRequests, [{
+    method: 'GET',
+    host: `127.0.0.1:${target.address().port}`,
+    path: '/api/listDestinations'
+  }]);
+  assert.equal(proxyRequests.length, 2);
+});
+
+test('redacts credential-bearing diagnostics without exposing payloads', () => {
+  const value = redact({ name: 'dev', password: 'secret', authorization: 'Bearer abc', nested: { cookie: 'x', ok: 'visible' } });
+  assert.deepEqual(value, { name: 'dev', password: '[redacted]', authorization: '[redacted]', nested: { cookie: '[redacted]', ok: 'visible' } });
+});

package/test/fixtures/fake-vsp.mjs

@@ -0,0 +1,244 @@
+#!/usr/bin/env node
+import { appendFileSync } from 'node:fs';
+import { request as httpRequest } from 'node:http';
+
+const args = process.argv.slice(2);
+const mode = args[args.indexOf('--mode') + 1] || 'focused';
+const url = args[args.indexOf('--url') + 1] || 'unknown';
+const destination = url.replace(/^https?:\/\//, '').replace(/\.dest$/, '');
+const logPath = process.env.FAKE_LOG;
+function log(entry) { if (logPath) appendFileSync(logPath, `${JSON.stringify({ destination, ...entry })}\n`); }
+function reply(id, result) { process.stdout.write(`${JSON.stringify({ jsonrpc: '2.0', id, result })}\n`); }
+function requestADTThroughProxy(targetUrl, proxyUrl) {
+  const target = new URL(targetUrl);
+  const proxy = new URL(proxyUrl);
+  if (target.protocol !== 'http:') throw new Error('fixture ADT request supports HTTP only');
+  const headers = { host: target.host, accept: 'application/xml,text/xml,*/*' };
+  if (process.env.SAP_USER && process.env.SAP_PASSWORD) {
+    headers.authorization = `Basic ${Buffer.from(`${process.env.SAP_USER}:${process.env.SAP_PASSWORD}`).toString('base64')}`;
+  }
+  return new Promise((resolve, reject) => {
+    const request = httpRequest({
+      hostname: proxy.hostname,
+      port: Number(proxy.port),
+      method: 'GET',
+      path: target.href,
+      headers
+    }, response => {
+      let body = '';
+      response.setEncoding('utf8');
+      response.on('data', chunk => { body += chunk; });
+      response.on('end', () => resolve({ status: response.statusCode || 0, body }));
+    });
+    request.setTimeout(5_000, () => request.destroy(new Error('fixture ADT request timed out')));
+    request.on('error', reject);
+    request.end();
+  });
+}
+const toolNames = [
+  'GetSource',
+  'WriteSource',
+  'EditSource',
+  'SearchObject',
+  'GrepObjects',
+  'GrepPackages',
+  'FindDefinition',
+  'FindReferences',
+  'GetContext',
+  'SyntaxCheck',
+  'Activate',
+  'ActivatePackage',
+  'CompareSource',
+  'GetClassInfo',
+  'CreatePackage',
+  'CreateTable',
+  'GetTable',
+  'GetTableContents',
+  'GetTransport',
+  'ListTransports',
+  'GetTransportInfo',
+  'GetUserTransports',
+  'RunQuery',
+  'GetPackage',
+  'GetFunctionGroup',
+  'GetCDSDependencies',
+  'GetCDSImpactAnalysis',
+  'GetAPIReleaseState',
+  'GetCDSElementInfo',
+  'GetMessages',
+  'GetFeatures',
+  'PrettyPrint',
+  'GetSystemInfo',
+  'GetInstalledComponents',
+  'RunUnitTests',
+  'RunATCCheck',
+  'GetInactiveObjects',
+  'DeleteObject',
+  'DebuggerAttach',
+  'ListSQLTraces',
+  'CreateTransport',
+  'ReleaseTransport',
+  'DeleteTransport',
+  'AnalyzeABAPCode',
+  'AnalyzeCallGraph',
+  'CodeCompletion',
+  'GetAbapHelp',
+  'GetCallGraph',
+  'GetCalleesOf',
+  'GetCallersOf',
+  'GetCodeCoverage',
+  'GetConnectionInfo',
+  'GetObjectStructure',
+  'GetTypeHierarchy',
+  'GetTypeInfo',
+  'GrepObject',
+  'GrepPackage',
+  'CallRFC',
+  'DebuggerDetach',
+  'DebuggerGetStack',
+  'DebuggerGetVariables',
+  'DebuggerListen',
+  'DebuggerStep',
+  'DeleteBreakpoint',
+  'GetBreakpoints',
+  'GetDump',
+  'GetSQLTraceState',
+  'GetTrace',
+  'ListDumps',
+  'SetBreakpoint',
+  'CloneObject',
+  'CreateAndActivateProgram',
+  'CreateClassWithTests',
+  'CreateObject',
+  'CreateTestInclude',
+  'ExecuteABAP',
+  'GetClass',
+  'GetClassComponents',
+  'GetClassInclude',
+  'GetFunction',
+  'GetInclude',
+  'GetInterface',
+  'GetProgram',
+  'GetStructure',
+  'GetTransaction',
+  'LockObject',
+  'MoveObject',
+  'RecoverFailedCreate',
+  'RenameObject',
+  'SaveToFile',
+  'UnlockObject',
+  'UpdateClassInclude',
+  'UpdateSource',
+  'WriteClass',
+  'WriteProgram',
+  'ListDependencies',
+  'PublishServiceBinding',
+  'UnpublishServiceBinding'
+];
+if (mode === 'expert') toolNames.push('ActivateMultiple', 'SAP');
+
+function toolDefinition(name) {
+  const schemas = {
+    RunQuery: {
+      type: 'object',
+      properties: {
+        sql_query: { type: 'string' },
+        max_rows: { type: 'number' },
+        all_rows: { type: 'boolean' }
+      },
+      required: ['sql_query']
+    },
+    GetAPIReleaseState: { type: 'object', properties: { object_uri: { type: 'string' } }, required: ['object_uri'] },
+    PrettyPrint: { type: 'object', properties: { source: { type: 'string' } }, required: ['source'] },
+    GetTransport: { type: 'object', properties: { transport: { type: 'string' } }, required: ['transport'] },
+    GetTransportInfo: {
+      type: 'object',
+      properties: { object_url: { type: 'string' }, dev_class: { type: 'string' } },
+      required: ['object_url', 'dev_class']
+    },
+    GetUserTransports: {
+      type: 'object',
+      properties: { user_name: { type: 'string' } },
+      required: []
+    },
+    ActivateMultiple: {
+      type: 'object',
+      properties: {
+        objects: {
+          type: 'array',
+          items: {
+            anyOf: [
+              {
+                type: 'object',
+                properties: { url: { type: 'string' }, name: { type: 'string' } },
+                required: ['url', 'name']
+              },
+              { type: 'string' }
+            ]
+          }
+        }
+      },
+      required: ['objects']
+    }
+  };
+  return { name, description: name, inputSchema: schemas[name] || { type: 'object', properties: {}, required: [] } };
+}
+
+let buffer = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', async chunk => {
+  buffer += chunk;
+  let end;
+  while ((end = buffer.indexOf('\n')) >= 0) {
+    const line = buffer.slice(0, end).trim();
+    buffer = buffer.slice(end + 1);
+    if (!line) continue;
+    const message = JSON.parse(line);
+    if (message.method === 'initialize') {
+      log({ event: 'initialize', argv: args, env: { guard: process.env.SAP_PROXY_CONTEXTID_GUARD, authorization: process.env.Authorization, cookie: process.env.Cookie, user: process.env.SAP_USER, password: process.env.SAP_PASSWORD, verbose: process.env.SAP_VERBOSE, httpProxy: process.env.HTTP_PROXY, httpsProxy: process.env.HTTPS_PROXY, noProxy: process.env.NO_PROXY, allowTransportableEdits: process.env.SAP_ALLOW_TRANSPORTABLE_EDITS } });
+      if (destination === 'broken') process.exit(2);
+      reply(message.id, { protocolVersion: '2024-11-05', capabilities: { tools: {} }, serverInfo: { name: destination, version: 'fixture' } });
+    } else if (message.method === 'tools/list') {
+      reply(message.id, message.params?.cursor
+        ? { tools: toolNames.slice(15).map(toolDefinition) }
+        : { tools: toolNames.slice(0, 15).map(toolDefinition), nextCursor: 'page-2' });
+    } else if (message.method === 'tools/call') {
+      const name = message.params?.name;
+      log({ event: 'call', name, arguments: message.params?.arguments });
+      if (message.params?.arguments?.emitNotification) {
+        process.stdout.write(`${JSON.stringify({
+          jsonrpc: '2.0',
+          method: 'notifications/message',
+          params: { level: 'info', logger: 'fake-vsp', data: 'fixture log notification' }
+        })}\n`);
+      }
+      const transportTools = [
+        'ListTransports', 'GetTransport', 'GetUserTransports', 'GetTransportInfo',
+        'CreateTransport', 'ReleaseTransport', 'DeleteTransport'
+      ];
+      const disabledTransportOperation = transportTools.includes(name)
+        && (!args.includes('--enable-transports')
+          || (['CreateTransport', 'ReleaseTransport', 'DeleteTransport'].includes(name) && args.includes('--transport-read-only')));
+      if (disabledTransportOperation) {
+        reply(message.id, { content: [{ type: 'text', text: 'transport operation is not enabled' }], isError: true });
+      } else if (message.params?.arguments?.object === 'RPC_ERROR') {
+        process.stdout.write(`${JSON.stringify({ jsonrpc: '2.0', id: message.id, error: { code: -32042, message: 'backend connection refused; password=must-not-log' } })}\n`);
+      } else if (message.params?.arguments?.object === 'TOOL_ERROR') {
+        reply(message.id, { content: [{ type: 'text', text: 'backend timeout; token=must-not-log' }], isError: true });
+      } else if (process.env.FAKE_CF_ADT_TEST === 'true' && name === 'GetSystemInfo') {
+        try {
+          const target = new URL('/sap/bc/adt/discovery', url);
+          const proxy = process.env.HTTP_PROXY || process.env.http_proxy;
+          const adt = await requestADTThroughProxy(target.href, proxy);
+          reply(message.id, { content: [{ type: 'text', text: adt.body }], isError: false });
+        } catch {
+          reply(message.id, { content: [{ type: 'text', text: 'fixture ADT request failed' }], isError: true });
+        }
+      } else {
+        reply(message.id, { content: [{ type: 'text', text: `${destination}:${name}` }], isError: false });
+      }
+    } else if (message.id !== undefined) reply(message.id, {});
+  }
+});
+process.stdin.on('end', () => { log({ event: 'end' }); });
+process.on('SIGTERM', () => { log({ event: 'term' }); process.exit(0); });