sap-ai-dev-toolkit 0.2.5

package/dist/checksums.txt

@@ -0,0 +1,5 @@
+78c0f6b7adf151a4c83ee3a757752aa409225fc75af64dfe728aed68dc5cf598  vsp-linux-x64
+4ceaf3ef3519431aa5ebe7d7c14569cf7c7035956dbfc9342c8fa9b6343a5380  vsp-linux-arm64
+f8d075f1ef955f8bb4be5b1d9ec3ffc86e84349b8a141265cf39e74c9fd83246  vsp-darwin-x64
+25e19e0d7317fe5adcb3c670b5fcf1da1caafa3c1bf8a6783c4ff00b312b5194  vsp-darwin-arm64
+c67c921ae884abeacaa39782c5524f58ec58bdbccc0d7097ee8a2499c04331ac  vsp-win32-x64.exe

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "sap-ai-dev-toolkit",
+  "version": "0.2.5",
+  "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, Fiori, UI5, and MCP",
+  "author": "Gurkan Yilmaz",
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@abaplint/core": "2.119.0",
+    "@inquirer/checkbox": "4.2.0",
+    "undici": "^6.21.3"
+  },
+  "bin": {
+    "sap-ai-dev": "src/launcher.mjs"
+  },
+  "scripts": {
+    "postinstall": "node scripts/postinstall.mjs",
+    "test": "node --test test/*.test.mjs",
+    "test:visibility": "node --test test/setup.test.mjs test/terminal-ui.test.mjs",
+    "test:mutation": "node scripts/mutation-terminal-ui.mjs",
+    "publish:npm": "node scripts/publish-npm.mjs",
+    "ensure:go": "node scripts/ensure-go.mjs",
+    "build:vsp": "node scripts/build-vsp.mjs"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/grknylmz/sap-ai-dev-toolkit.git"
+  },
+  "homepage": "https://github.com/grknylmz/sap-ai-dev-toolkit#readme",
+  "bugs": {
+    "url": "https://github.com/grknylmz/sap-ai-dev-toolkit/issues"
+  },
+  "license": "MIT",
+  "files": [
+    "src/",
+    "scripts/",
+    "patches/",
+    "dist/",
+    "test/",
+    "LICENSE",
+    "NOTICE",
+    "LICENSE-APACHE-2.0.txt",
+    "tools.md",
+    ".github/agents/",
+    ".github/skills/"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/patches/vsp-bas-proxy-auth.patch

@@ -0,0 +1,310 @@
+diff --git a/cmd/vsp/main.go b/cmd/vsp/main.go
+--- a/cmd/vsp/main.go
++++ b/cmd/vsp/main.go
+@@ -102,1 +102,2 @@
+ 	// Authentication flags
++	rootCmd.Flags().BoolVar(&cfg.ProxyAuth, "proxy-auth", false, "Use BAS destination proxy authentication; do not send local credentials")
+@@ -172,1 +172,2 @@
+ 	// Bind flags to viper for environment variable support
++	viper.BindPFlag("proxy-auth", rootCmd.Flags().Lookup("proxy-auth"))
+@@ -235,1 +235,4 @@
+ 	// Browser-based SSO authentication (must run before processCookieAuth)
++	if err := validateProxyAuth(cmd); err != nil {
++		return err
++	}
+@@ -348,1 +348,2 @@
+ func resolveConfig(cmd *cobra.Command) {
++	cfg.ProxyAuth = cfg.ProxyAuth || viper.GetBool("PROXY_AUTH")
+@@ -533,1 +533,19 @@
++func validateProxyAuth(cmd *cobra.Command) error {
++	if !cfg.ProxyAuth {
++		return nil
++	}
++	for _, flag := range []string{"user", "password", "pass", "cookie-file", "cookie-string", "browser-auth", "sso", "saml-auth", "saml-user", "saml-password", "credential-cmd"} {
++		if cmd.Flags().Changed(flag) {
++			return fmt.Errorf("--proxy-auth cannot be combined with local authentication option --%s", flag)
++		}
++	}
++	for _, key := range []string{"USER", "USERNAME", "PASSWORD", "PASS", "COOKIE_FILE", "COOKIE_STRING", "BROWSER_AUTH", "SSO", "SAML_AUTH", "SAML_USER", "SAML_PASSWORD", "CREDENTIAL_CMD"} {
++		if os.Getenv("SAP_"+key) != "" {
++			return fmt.Errorf("--proxy-auth cannot be combined with SAP_%s; BAS supplies destination authentication", key)
++		}
++	}
++	cfg.Username, cfg.Password = "", ""
++	cfg.Cookies = nil
++	return nil
++}
+ func processBrowserAuth(cmd *cobra.Command) error {
+@@ -601,1 +601,4 @@
+ func processSSOAuth(cmd *cobra.Command) error {
++	if cfg.ProxyAuth {
++		return nil
++	}
+@@ -659,1 +659,4 @@
+ func processSAMLAuth(cmd *cobra.Command) error {
++	if cfg.ProxyAuth {
++		return nil
++	}
+@@ -754,1 +754,4 @@
+ func processCookieAuth(cmd *cobra.Command) error {
++	if cfg.ProxyAuth {
++		return nil
++	}
+diff --git a/internal/mcp/server.go b/internal/mcp/server.go
+--- a/internal/mcp/server.go
++++ b/internal/mcp/server.go
+@@ -71,2 +71,5 @@
+ 	// Cookie authentication (alternative to basic auth)
++	// ProxyAuth delegates identity to a BAS destination proxy. Local credentials are rejected.
++	ProxyAuth bool
++
+ 	Cookies map[string]string
+@@ -154,1 +154,4 @@
++	if cfg.ProxyAuth {
++		opts = append(opts, adt.WithProxyContextIDGuard())
++	}
+ 	if len(cfg.Cookies) > 0 {
+diff --git a/pkg/adt/client.go b/pkg/adt/client.go
+--- a/pkg/adt/client.go
++++ b/pkg/adt/client.go
+@@ -1586 +1586 @@
+-		Accept: "application/xml",
++		Accept: "application/atom+xml;type=feed",
+@@ -1592,27 +1592,27 @@
+-	type componentXML struct {
+-		Name        string `xml:"name,attr"`
+-		Release     string `xml:"release,attr"`
+-		SupportPack string `xml:"supportPack,attr"`
+-		Description string `xml:"description,attr"`
+-	}
+-	type componentsXML struct {
+-		XMLName    xml.Name       `xml:"components"`
+-		Components []componentXML `xml:"component"`
+-	}
+-
+-	var comps componentsXML
+-	if err := xml.Unmarshal(resp.Body, &comps); err != nil {
+-		return nil, fmt.Errorf("parsing components: %w", err)
+-	}
+-
+-	result := make([]InstalledComponent, len(comps.Components))
+-	for i, c := range comps.Components {
+-		result[i] = InstalledComponent{
+-			Name:        c.Name,
+-			Release:     c.Release,
+-			SupportPack: c.SupportPack,
+-			Description: c.Description,
+-		}
+-	}
+-
+-	return result, nil
++	type componentEntry struct {
++		ID    string `xml:"id"`
++		Title string `xml:"title"`
++	}
++	type componentsFeed struct {
++		Entries []componentEntry `xml:"entry"`
++	}
++	var feed componentsFeed
++	if err := xml.Unmarshal(resp.Body, &feed); err != nil {
++		return nil, fmt.Errorf("parsing components: %w", err)
++	}
++
++	result := make([]InstalledComponent, 0, len(feed.Entries))
++	for i, entry := range feed.Entries {
++		fields := strings.SplitN(entry.Title, ";", 4)
++		name := strings.TrimSpace(entry.ID)
++		if name == "" || len(fields) != 4 {
++			return nil, fmt.Errorf("parsing components: malformed feed entry %d", i+1)
++		}
++		result = append(result, InstalledComponent{
++			Name:        name,
++			Release:     strings.TrimSpace(fields[0]),
++			SupportPack: strings.TrimSpace(fields[2]),
++			Description: strings.TrimSpace(fields[3]),
++		})
++	}
++	return result, nil
+diff --git a/pkg/adt/client_components_test.go b/pkg/adt/client_components_test.go
+new file mode 100644
+--- /dev/null
++++ b/pkg/adt/client_components_test.go
+@@ -0,0 +1,40 @@
++package adt
++
++import (
++	"context"
++	"io"
++	"net/http"
++	"net/http/httptest"
++	"testing"
++)
++
++func TestGetInstalledComponentsUsesADTFeed(t *testing.T) {
++	const accept = "application/atom+xml;type=feed"
++	const response = `<atom:feed xmlns:atom="http://www.w3.org/2005/Atom"><atom:entry><atom:id>SAP_BASIS</atom:id><atom:title>758;SAPK-75802INSAPBASIS;0002;SAP Basis &gt; 2022; patch</atom:title></atom:entry></atom:feed>`
++	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++		if r.URL.Path != "/sap/bc/adt/system/components" {
++			t.Errorf("unexpected request path: %s", r.URL.Path)
++			w.WriteHeader(http.StatusNotFound)
++			return
++		}
++		if got := r.Header.Get("Accept"); got != accept {
++			t.Errorf("Accept = %q, want %q", got, accept)
++			w.WriteHeader(http.StatusNotAcceptable)
++			return
++		}
++		w.Header().Set("Content-Type", accept)
++		_, _ = io.WriteString(w, response)
++	}))
++	defer server.Close()
++
++	components, err := NewClient(server.URL, "user", "pass").GetInstalledComponents(context.Background())
++	if err != nil {
++		t.Fatalf("GetInstalledComponents returned an error: %v", err)
++	}
++	if len(components) != 1 {
++		t.Fatalf("got %d components, want 1", len(components))
++	}
++	if got := components[0]; got.Name != "SAP_BASIS" || got.Release != "758" || got.SupportPack != "0002" || got.Description != "SAP Basis > 2022; patch" {
++		t.Errorf("got component %#v", got)
++	}
++}
+diff --git a/internal/mcp/server_test.go b/internal/mcp/server_test.go
+--- a/internal/mcp/server_test.go
++++ b/internal/mcp/server_test.go
+@@ -159,3 +159,112 @@ func TestDebuggerGetVariablesSchemaIncludesItems(t *testing.T) {
+ 		t.Fatalf("expected variableIDs.items.type to be 'string', got %v", items["type"])
+ 	}
+ }
++
++func TestActivateMultipleObjectsSchemaIncludesItems(t *testing.T) {
++	cfg := &Config{
++		BaseURL:  "https://sap.example.com:44300",
++		Username: "testuser",
++		Password: "testpass",
++		Client:   "001",
++		Language: "EN",
++		Mode:     "expert",
++	}
++
++	server := NewServer(cfg)
++	if server == nil || server.mcpServer == nil {
++		t.Fatal("server or MCP server is nil")
++	}
++
++	rawResponse := server.mcpServer.HandleMessage(context.Background(), []byte(`{
++		"jsonrpc": "2.0",
++		"id": 1,
++		"method": "tools/list",
++		"params": {}
++	}`))
++	response, ok := rawResponse.(mcp.JSONRPCResponse)
++	if !ok {
++		t.Fatalf("expected JSONRPCResponse, got %T", rawResponse)
++	}
++
++	var tools []mcp.Tool
++	switch result := response.Result.(type) {
++	case mcp.ListToolsResult:
++		tools = result.Tools
++	case *mcp.ListToolsResult:
++		tools = result.Tools
++	default:
++		t.Fatalf("expected ListToolsResult, got %T", response.Result)
++	}
++
++	var activateMultipleTool *mcp.Tool
++	for i := range tools {
++		if tools[i].Name == "ActivateMultiple" {
++			activateMultipleTool = &tools[i]
++			break
++		}
++	}
++	if activateMultipleTool == nil {
++		t.Fatal("ActivateMultiple tool not found")
++	}
++
++	objectsRaw, ok := activateMultipleTool.InputSchema.Properties["objects"]
++	if !ok {
++		t.Fatal("objects property not found in ActivateMultiple schema")
++	}
++	objects, ok := objectsRaw.(map[string]interface{})
++	if !ok {
++		t.Fatalf("expected objects schema to be map[string]interface{}, got %T", objectsRaw)
++	}
++	if objects["type"] != "array" {
++		t.Fatalf("expected objects type to be 'array', got %v", objects["type"])
++	}
++
++	itemsRaw, ok := objects["items"]
++	if !ok {
++		t.Fatal("objects array schema is missing items")
++	}
++	items, ok := itemsRaw.(map[string]interface{})
++	if !ok {
++		t.Fatalf("expected objects.items to be map[string]interface{}, got %T", itemsRaw)
++	}
++	anyOf, ok := items["anyOf"].([]interface{})
++	if !ok || len(anyOf) != 2 {
++		t.Fatalf("expected objects.items.anyOf to contain string and object variants, got %v", items["anyOf"])
++	}
++	hasObject, hasString := false, false
++	for _, variant := range anyOf {
++		schema, ok := variant.(map[string]interface{})
++		if !ok {
++			t.Fatalf("expected item variant to be a schema object, got %T", variant)
++		}
++		switch schema["type"] {
++		case "object":
++			hasObject = true
++			properties, ok := schema["properties"].(map[string]interface{})
++			if !ok {
++				t.Fatal("object item schema is missing properties")
++			}
++			for _, propertyName := range []string{"url", "name"} {
++				propertyRaw, ok := properties[propertyName]
++				if !ok {
++					t.Fatalf("object item schema is missing %q", propertyName)
++				}
++				property, ok := propertyRaw.(map[string]interface{})
++				if !ok || property["type"] != "string" {
++					t.Fatalf("object item %q must have type string", propertyName)
++				}
++			}
++			required, ok := schema["required"].([]string)
++			if !ok || len(required) != 2 || required[0] != "url" || required[1] != "name" {
++				t.Fatalf("object item schema must require url and name, got %v", schema["required"])
++			}
++		case "string":
++			hasString = true
++		default:
++			t.Fatalf("unexpected ActivateMultiple item type %v", schema["type"])
++		}
++	}
++	if !hasObject || !hasString {
++		t.Fatalf("expected object and string item variants, got object=%t string=%t", hasObject, hasString)
++	}
++}
+diff --git a/internal/mcp/tools_register.go b/internal/mcp/tools_register.go
+--- a/internal/mcp/tools_register.go
++++ b/internal/mcp/tools_register.go
+@@ -837,6 +837,19 @@ func (s *Server) registerDevTools(shouldRegister func(string) bool) {
+ 				mcp.Description(`Objects to activate. Each item can be:
+   - {"url": "/sap/bc/adt/programs/programs/zprog", "name": "ZPROG"}
+   - "TYPE NAME" shorthand, e.g. "PROG ZPROG", "INCL ZPROG_TOP", "CLAS ZCL_X"`),
++				mcp.Items(map[string]any{
++					"anyOf": []any{
++						map[string]any{
++							"type": "object",
++							"properties": map[string]any{
++								"url":  map[string]any{"type": "string"},
++								"name": map[string]any{"type": "string"},
++							},
++							"required": []string{"url", "name"},
++						},
++						map[string]any{"type": "string"},
++					},
++				}),
+ 			),
+ 		), s.handleActivateMultiple)

package/scripts/build-vsp.mjs

@@ -0,0 +1,52 @@
+import { execFile } from 'node:child_process';
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { promisify } from 'node:util';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createHash } from 'node:crypto';
+import { ensureGo } from './ensure-go.mjs';
+
+const exec = promisify(execFile);
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
+const source = join(root, '.build', 'vibing-steampunk');
+const dist = join(root, 'dist');
+const commit = '9886d2727f47506368b0a3c2f1c1766f1200f747';
+const upstream = 'https://github.com/oisee/vibing-steampunk.git';
+const targets = [
+  ['linux', 'amd64', 'linux', 'x64', ''],
+  ['linux', 'arm64', 'linux', 'arm64', ''],
+  ['darwin', 'amd64', 'darwin', 'x64', ''],
+  ['darwin', 'arm64', 'darwin', 'arm64', ''],
+  ['windows', 'amd64', 'win32', 'x64', '.exe']
+];
+
+async function run(command, args, options = {}) {
+  return exec(command, args, { cwd: root, stdio: 'inherit', ...options });
+}
+
+async function main() {
+  const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
+  if (!pkg.repository?.url) throw new Error('package.json repository.url is required before publishing binaries');
+  const goPath = await ensureGo();
+  await rm(join(root, '.build'), { recursive: true, force: true });
+  await mkdir(dirname(source), { recursive: true });
+  await run('git', ['clone', '--filter=blob:none', upstream, source]);
+  await run('git', ['-C', source, 'checkout', '--detach', commit]);
+  await run('patch', ['-p1', '-i', join(root, 'patches', 'vsp-bas-proxy-auth.patch')], { cwd: source });
+  await mkdir(dist, { recursive: true });
+  const checksums = [];
+  for (const [goos, goarch, os, arch, extension] of targets) {
+    const output = join(dist, `vsp-${os}-${arch}${extension}`);
+    await exec(goPath, ['build', '-trimpath', '-ldflags', `-s -w -X main.Commit=${commit}`, '-o', output, './cmd/vsp'], {
+      cwd: source,
+      env: { ...process.env, CGO_ENABLED: '0', GOOS: goos, GOARCH: goarch },
+      stdio: 'inherit'
+    });
+    const bytes = await (await import('node:fs/promises')).readFile(output);
+    checksums.push(`${createHash('sha256').update(bytes).digest('hex')}  ${output.slice(dist.length + 1)}`);
+  }
+  await writeFile(join(dist, 'checksums.txt'), `${checksums.join('\n')}\n`);
+  console.error(`Built ${targets.length} patched VSP binaries at ${dist}`);
+}
+
+main().catch(error => { console.error(`build-vsp: ${error.message}`); process.exitCode = 1; });

package/scripts/ensure-go.mjs

@@ -0,0 +1,59 @@
+import { createHash } from 'node:crypto';
+import { execFile, spawnSync } from 'node:child_process';
+import { chmod, mkdir, rm, symlink, writeFile } from 'node:fs/promises';
+import { homedir, tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+
+const exec = promisify(execFile);
+export const GO_VERSION = process.env.BAS_VSP_GO_VERSION || 'go1.27.1';
+const GO_RELEASES = {
+  'linux:x64': { archive: `${GO_VERSION}.linux-amd64.tar.gz`, sha256: '63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445' },
+  'linux:arm64': { archive: `${GO_VERSION}.linux-arm64.tar.gz`, sha256: '3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec' }
+};
+
+function localGoPath() {
+  return join(process.env.BAS_VSP_GO_ROOT || join(homedir(), '.local', 'go'), GO_VERSION, 'bin', process.platform === 'win32' ? 'go.exe' : 'go');
+}
+
+function candidateGo() {
+  if (process.env.GO_BINARY) return process.env.GO_BINARY;
+  const result = spawnSync('go', ['version'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  if (result.status === 0) return 'go';
+  const local = localGoPath();
+  const localResult = spawnSync(local, ['version'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  return localResult.status === 0 ? local : null;
+}
+
+export async function installGo() {
+  const release = GO_RELEASES[`${process.platform}:${process.arch}`];
+  if (!release) throw new Error(`Go is missing and automatic installation is supported only for Linux x64/arm64. Install ${GO_VERSION} manually and ensure go is on PATH.`);
+  const response = await fetch(`https://go.dev/dl/${release.archive}`);
+  if (!response.ok) throw new Error(`Go download failed with HTTP ${response.status}; install ${GO_VERSION} manually and ensure go is on PATH.`);
+  const bytes = Buffer.from(await response.arrayBuffer());
+  const actual = createHash('sha256').update(bytes).digest('hex');
+  const expected = process.env.BAS_VSP_GO_SHA256 || release.sha256;
+  if (actual !== expected) throw new Error(`Go checksum mismatch for ${release.archive}`);
+  const root = join(process.env.BAS_VSP_GO_ROOT || join(homedir(), '.local', 'go'), GO_VERSION);
+  await mkdir(root, { recursive: true, mode: 0o755 });
+  const archive = join(tmpdir(), `${release.archive}.${process.pid}`);
+  await writeFile(archive, bytes, { mode: 0o600 });
+  await exec('tar', ['-xzf', archive, '-C', root, '--strip-components=1'], { stdio: 'inherit' });
+  await rm(archive, { force: true });
+  const goPath = join(root, 'bin', 'go');
+  await chmod(goPath, 0o755);
+  const userBin = join(homedir(), '.local', 'bin');
+  await mkdir(userBin, { recursive: true, mode: 0o755 });
+  try { await symlink(goPath, join(userBin, process.platform === 'win32' ? 'go.exe' : 'go')); } catch {}
+  return goPath;
+}
+
+export async function ensureGo() {
+  const existing = candidateGo();
+  if (existing) return existing;
+  return installGo();
+}
+
+if (process.argv[1]?.endsWith('ensure-go.mjs')) {
+  ensureGo().then(path => console.error(`Go available at ${path}`)).catch(error => { console.error(`ensure-go: ${error.message}`); process.exitCode = 1; });
+}

package/scripts/install-user-copilot-assets.mjs

@@ -0,0 +1,110 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+const manifestName = '.sap-ai-dev-toolkit-assets.json';
+
+function digest(content) {
+  return createHash('sha256').update(content).digest('hex');
+}
+
+async function collectFiles(sourceRoot, targetPrefix, relativePath = '') {
+  const files = [];
+  const entries = await readdir(join(sourceRoot, relativePath), { withFileTypes: true });
+  entries.sort((left, right) => left.name.localeCompare(right.name));
+  for (const entry of entries) {
+    const childPath = join(relativePath, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...await collectFiles(sourceRoot, targetPrefix, childPath));
+    } else if (entry.isFile()) {
+      files.push({ source: join(sourceRoot, childPath), target: join(targetPrefix, childPath) });
+    }
+  }
+  return files;
+}
+
+async function readManagedFiles(path) {
+  try {
+    const manifest = JSON.parse(await readFile(path, 'utf8'));
+    if (manifest === null || typeof manifest !== 'object' || manifest.version !== 1 || manifest.files === null || typeof manifest.files !== 'object' || Array.isArray(manifest.files)) return {};
+    return manifest.files;
+  } catch (error) {
+    if (error.code === 'ENOENT' || error instanceof SyntaxError) return {};
+    throw error;
+  }
+}
+
+async function replaceFile(path, content) {
+  const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, content, { flag: 'wx', mode: 0o644 });
+    await rename(temporary, path);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+
+export async function installUserCopilotAssets({ home = process.env.HOME || homedir(), root = packageRoot } = {}) {
+  const sourceRoot = join(root, '.github');
+  const files = [
+    ...await collectFiles(join(sourceRoot, 'agents'), 'agents'),
+    ...await collectFiles(join(sourceRoot, 'skills'), 'skills')
+  ];
+  if (!files.some(file => file.target === join('agents', 'abap-developer.agent.md'))) {
+    throw new Error('Packaged ABAP Developer agent profile is missing');
+  }
+  if (!files.some(file => file.target.startsWith(`skills${sep}`) && file.target.endsWith('SKILL.md'))) {
+    throw new Error('Packaged Agent Skills are missing');
+  }
+
+  const copilotRoot = join(home, '.copilot');
+  const manifestPath = join(copilotRoot, manifestName);
+  await mkdir(copilotRoot, { recursive: true, mode: 0o755 });
+  const previousFiles = await readManagedFiles(manifestPath);
+  const managedFiles = { ...previousFiles };
+  const conflicts = [];
+  let installed = 0;
+  let updated = 0;
+  let unchanged = 0;
+
+  for (const file of files) {
+    const destination = join(copilotRoot, file.target);
+    const content = await readFile(file.source);
+    const contentHash = digest(content);
+    await mkdir(dirname(destination), { recursive: true, mode: 0o755 });
+
+    let existing;
+    try {
+      existing = await readFile(destination);
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+      try {
+        await writeFile(destination, content, { flag: 'wx', mode: 0o644 });
+        managedFiles[file.target] = contentHash;
+        installed += 1;
+        continue;
+      } catch (writeError) {
+        if (writeError.code !== 'EEXIST') throw writeError;
+        existing = await readFile(destination);
+      }
+    }
+
+    const existingHash = digest(existing);
+    if (existingHash === contentHash) {
+      managedFiles[file.target] = contentHash;
+      unchanged += 1;
+    } else if (previousFiles[file.target] === existingHash) {
+      await replaceFile(destination, content);
+      managedFiles[file.target] = contentHash;
+      updated += 1;
+    } else {
+      conflicts.push(file.target);
+    }
+  }
+
+  await replaceFile(manifestPath, `${JSON.stringify({ version: 1, files: managedFiles }, null, 2)}\n`);
+  return { root: copilotRoot, installed, updated, unchanged, conflicts };
+}

package/scripts/mutation-terminal-ui.mjs

@@ -0,0 +1,69 @@
+import { mkdtemp, cp, readFile, rm, writeFile } from 'node:fs/promises';
+import { spawn } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const mutants = [
+  {
+    name: 'wide progress emoji returns',
+    mutate: source => source.replace("progress: { icon: '…', color: 'cyan' }", "progress: { icon: '⏳', color: 'cyan' }")
+  },
+  {
+    name: 'animated spinner frames return',
+    mutate: source => source.replace("spinner: { interval: 80, frames: [''] }", "spinner: { interval: 80, frames: ['⠇'] }")
+  },
+  {
+    name: 'prompt output no longer exposes terminal columns',
+    mutate: source => source.replace("for (const property of ['isTTY', 'columns', 'rows'])", "for (const property of ['isTTY', 'rows'])")
+  },
+  {
+    name: 'prompt output no longer exposes terminal rows',
+    mutate: source => source.replace("for (const property of ['isTTY', 'columns', 'rows'])", "for (const property of ['isTTY', 'columns'])")
+  }
+];
+
+function run(command, args, options) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { ...options, stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', chunk => { stdout += chunk; });
+    child.stderr.on('data', chunk => { stderr += chunk; });
+    child.on('error', reject);
+    child.on('exit', code => resolve({ code, stdout, stderr }));
+  });
+}
+
+const root = process.cwd();
+let survived = 0;
+
+for (const mutant of mutants) {
+  const directory = await mkdtemp(join(tmpdir(), 'bas-mutation-'));
+  try {
+    await cp(join(root, 'src'), join(directory, 'src'), { recursive: true });
+    await cp(join(root, 'test'), join(directory, 'test'), { recursive: true });
+    const path = join(directory, 'src', 'terminal-ui.mjs');
+    const original = await readFile(path, 'utf8');
+    const mutated = mutant.mutate(original);
+    if (mutated === original) throw new Error(`Mutant did not change source: ${mutant.name}`);
+    await writeFile(path, mutated);
+
+    const result = await run(process.execPath, ['--test', join(directory, 'test', 'terminal-ui.test.mjs')], { cwd: directory });
+    if (result.code === 0) {
+      survived += 1;
+      console.error(`SURVIVED: ${mutant.name}`);
+      console.error(result.stdout);
+      console.error(result.stderr);
+    } else {
+      console.log(`KILLED: ${mutant.name}`);
+    }
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+}
+
+if (survived > 0) {
+  console.error(`${survived} mutation(s) survived`);
+  process.exit(1);
+}
+console.log(`All ${mutants.length} terminal UI mutants killed.`);