sap-ai-dev-toolkit 0.2.5

package/src/mcp-proxy.mjs

@@ -0,0 +1,388 @@
+import { spawn as nodeSpawn } from 'node:child_process';
+import { once } from 'node:events';
+import { sanitizeChildEnv, slugifyDestination } from './bas-discovery.mjs';
+import { ABAP_LINT_TOOL, runABAPLint } from './abaplint.mjs';
+
+const JSONRPC = '2.0';
+const FORWARDED_METHODS = new Set(['ping', 'resources/list', 'resources/read', 'resources/templates/list', 'prompts/list', 'completion/complete', 'logging/setLevel']);
+const APPLICATION_LOG_PARAMETERS = [
+  'program',
+  'user',
+  'object',
+  'subobject',
+  'from',
+  'to',
+  'max_results',
+  'messages'
+];
+const APPLICATION_LOG_SCHEMA = {
+  type: 'object',
+  properties: {
+    program: { type: 'string', description: 'ABAP program recorded in the log.' },
+    user: { type: 'string', description: 'SAP user recorded in the log.' },
+    object: { type: 'string', description: 'SLG1 application-log object.' },
+    subobject: { type: 'string', description: 'SLG1 application-log subobject.' },
+    from: { type: 'string', description: 'Inclusive lower date/time: YYYY-MM-DD, YYYYMMDD, or timestamp.' },
+    to: { type: 'string', description: 'Inclusive upper date/time; a date-only value includes the full day.' },
+    max_results: { type: 'number', description: 'Maximum log entries to return; defaults to 100.' },
+    messages: { type: 'boolean', description: 'Include BALDAT message details and T100 texts instead of headers only.' }
+  },
+  required: []
+};
+const APPLICATION_LOG_DESCRIPTION = 'Read SAP application log (SLG1) entries. Results are newest first and limited to 100 by default; set messages=true to include log message details.';
+
+function applicationLogArguments(arguments_ = {}) {
+  const filters = arguments_ && typeof arguments_ === 'object' && !Array.isArray(arguments_) ? arguments_ : {};
+  const params = { type: 'application_log' };
+  for (const key of APPLICATION_LOG_PARAMETERS) {
+    if (Object.hasOwn(filters, key)) params[key] = filters[key];
+  }
+  return { action: 'analyze', params };
+}
+
+function rpcResult(id, result) { return { jsonrpc: JSONRPC, id, result }; }
+function rpcError(id, code, message, data) { return { jsonrpc: JSONRPC, id, error: { code, message, ...(data === undefined ? {} : { data }) } }; }
+function redactText(text) { return String(text).replace(/(authorization|cookie|password|secret|token)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]'); }
+function diagnosticText(text) { return redactText(text || 'unknown error').replace(/\s+/g, ' ').slice(0, 500); }
+
+const closedRoutes = new WeakMap();
+
+function closeDestinationRoute(destination) {
+  if (!destination || typeof destination.close !== 'function') return Promise.resolve();
+  if (!closedRoutes.has(destination)) {
+    const closing = Promise.resolve().then(() => destination.close()).catch(() => {});
+    closedRoutes.set(destination, closing);
+  }
+  return closedRoutes.get(destination);
+}
+
+function childEnvironment(destination, env) {
+  return { ...sanitizeChildEnv(env), ...(destination.childEnv || {}) };
+}
+
+
+export function childArguments(destination, env = process.env) {
+  // The proxy allowlist keeps transport mutations to CreateTransport.
+  // Transportable source edits are controlled by SAP_ALLOW_TRANSPORTABLE_EDITS.
+  const mode = env.BAS_VSP_MODE || 'expert';
+  const args = ['--url', destination.url, '--client', destination.client || '001', '--mode', mode];
+  if (destination.source !== 'cloud-foundry' || destination.authentication === 'PrincipalPropagation') args.push('--proxy-auth');
+  args.push('--enable-transports');
+  return args;
+}
+
+class Child {
+  constructor(binary, destination, options) {
+    this.destination = destination;
+    this.options = options;
+    this.pending = new Map();
+    this.nextId = 1;
+    this.buffer = '';
+    this.exited = false;
+    this.closing = false;
+    this.process = (options.spawn || nodeSpawn)(binary, options.args || childArguments(destination, options.env), {
+      env: childEnvironment(destination, options.env),
+      stdio: ['pipe', 'pipe', 'pipe']
+    });
+    this.process.stdout.setEncoding('utf8');
+    this.process.stdout.on('data', chunk => this.onData(chunk));
+    this.process.stderr.setEncoding('utf8');
+    this.process.stderr.on('data', chunk => {
+      if (options.log) options.log(`[${destination.name}] ${redactText(chunk).trimEnd()}`);
+    });
+    this.process.on('error', error => {
+      if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] VSP child process error: ${diagnosticText(error.message)}`);
+      this.fail(error);
+      void closeDestinationRoute(destination);
+    });
+    this.process.on('exit', (code, signal) => {
+      if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] VSP child exited (${code ?? signal})`);
+      this.fail(new Error(`child exited (${code ?? signal})`));
+      void closeDestinationRoute(destination);
+    });
+  }
+
+  onData(chunk) {
+    this.buffer += chunk;
+    let newline;
+    while ((newline = this.buffer.indexOf('\n')) >= 0) {
+      const line = this.buffer.slice(0, newline).trim();
+      this.buffer = this.buffer.slice(newline + 1);
+      if (!line) continue;
+      try { this.onMessage(JSON.parse(line)); } catch (error) { this.fail(new Error(`invalid child JSON-RPC response: ${error.message}`)); }
+    }
+  }
+
+  onMessage(message) {
+    if (message.id === undefined || message.id === null) {
+      if (message.method?.startsWith('notifications/')) {
+        try { this.options.onNotification?.(message); }
+        catch (error) { this.options.log?.(`[${this.destination.name}] child notification forwarding failed: ${diagnosticText(error.message)}`); }
+      }
+      return;
+    }
+    const pending = this.pending.get(message.id);
+    if (!pending) return;
+    this.pending.delete(message.id);
+    if (message.error) pending.reject(Object.assign(new Error(message.error.message || 'child JSON-RPC error'), { rpcError: message.error }));
+    else pending.resolve(message);
+  }
+
+  fail(error) {
+    if (this.exited) return;
+    this.exited = true;
+    for (const pending of this.pending.values()) pending.reject(error);
+    this.pending.clear();
+  }
+
+  request(method, params) {
+    if (this.exited || !this.process.stdin.writable) return Promise.reject(new Error(`destination ${this.destination.name} child is not running`));
+    const id = this.nextId++;
+    return new Promise((resolve, reject) => {
+      this.pending.set(id, { resolve, reject });
+      try { this.process.stdin.write(`${JSON.stringify({ jsonrpc: JSONRPC, id, method, ...(params === undefined ? {} : { params })})}\n`); }
+      catch (error) { this.pending.delete(id); reject(error); }
+    });
+  }
+
+  notify(method, params) {
+    if (this.exited || !this.process.stdin.writable) return;
+    try { this.process.stdin.write(`${JSON.stringify({ jsonrpc: JSONRPC, method, ...(params === undefined ? {} : { params })})}\n`); } catch {}
+  }
+
+  async initialize(params) {
+    const response = await this.request('initialize', params);
+    this.notify('notifications/initialized');
+    return response.result;
+  }
+
+  async listTools() {
+    const tools = [];
+    let cursor;
+    do {
+      const response = await this.request('tools/list', cursor ? { cursor } : {});
+      tools.push(...(response.result?.tools || []));
+      cursor = response.result?.nextCursor;
+    } while (cursor);
+    return tools;
+  }
+
+  async close() {
+    if (this.exited) return;
+    this.closing = true;
+    this.notify('notifications/cancelled', { reason: 'proxy shutdown' });
+    this.process.kill('SIGTERM');
+    let timeout;
+    try {
+      await Promise.race([
+        once(this.process, 'exit').catch(() => {}),
+        new Promise(resolve => { timeout = setTimeout(resolve, 1000); })
+      ]);
+    } finally {
+      clearTimeout(timeout);
+    }
+    if (!this.exited) this.process.kill('SIGKILL');
+  }
+}
+
+export class MCPProxy {
+  constructor({ binary, destinations, env = process.env, spawn = nodeSpawn, log = message => console.error(message), output = line => process.stdout.write(`${line}\n`) }) {
+    this.binary = binary;
+    this.destinations = destinations;
+    this.env = env;
+    this.spawn = spawn;
+    this.log = log;
+    this.output = output;
+    this.children = [];
+    this.started = false;
+    this.namespace = new Map();
+    this.initialized = false;
+    this.clientInitialized = false;
+    this.pendingNotifications = [];
+    this.shuttingDown = false;
+    this.usedSlugs = new Map();
+  }
+
+  start() {
+    if (this.started) return this;
+    this.started = true;
+    for (const destination of this.destinations) {
+      try {
+        this.log(`[${destination.name}] starting VSP child (client=${destination.client || '001'})`);
+        this.children.push({
+          destination,
+          child: new Child(this.binary, destination, {
+            env: this.env,
+            spawn: this.spawn,
+            log: this.log,
+            onNotification: notification => {
+              if (this.clientInitialized) this.output(JSON.stringify(notification));
+              else this.pendingNotifications.push(notification);
+            }
+          })
+        });
+      } catch (error) {
+        this.log(`[${destination.name}] failed to start child: ${diagnosticText(error.message)}`);
+        void closeDestinationRoute(destination);
+      }
+    }
+    if (!this.children.length) {
+      this.started = false;
+      for (const destination of this.destinations) void closeDestinationRoute(destination);
+      throw new Error('No destination child could be started');
+    }
+    return this;
+  }
+
+  async initializeChildren(params) {
+    const healthy = [];
+    for (const entry of this.children) {
+      this.log(`[${entry.destination.name}] initializing VSP MCP session`);
+      try {
+        entry.server = await entry.child.initialize(params);
+        this.log(`[${entry.destination.name}] VSP MCP session initialized`);
+        healthy.push(entry);
+      } catch (error) {
+        this.log(`[${entry.destination.name}] initialization failed: ${diagnosticText(error.message)}`);
+        await entry.child.close();
+        await closeDestinationRoute(entry.destination);
+      }
+    }
+    this.children = healthy;
+    if (!healthy.length) throw new Error('No destination child initialized successfully');
+    this.initialized = true;
+    return healthy;
+  }
+
+  async mergedTools() {
+    this.namespace.clear();
+    this.usedSlugs.clear();
+    const merged = [];
+    for (const entry of this.children) {
+      const slug = slugifyDestination(entry.destination.name, this.usedSlugs);
+      const lintName = `${slug}__${ABAP_LINT_TOOL.name}`;
+      this.namespace.set(lintName, { handler: runABAPLint });
+      merged.push({ ...ABAP_LINT_TOOL, name: lintName });
+      try {
+        for (const tool of await entry.child.listTools()) {
+          if (tool.name === 'SAP') {
+            const applicationLogName = `${slug}__GetApplicationLog`;
+            this.namespace.set(applicationLogName, {
+              entry,
+              upstream: 'SAP',
+              publicName: 'GetApplicationLog',
+              transformArguments: applicationLogArguments
+            });
+            merged.push({
+              name: applicationLogName,
+              description: `${APPLICATION_LOG_DESCRIPTION} [destination: ${entry.destination.name}]`,
+              inputSchema: APPLICATION_LOG_SCHEMA
+            });
+          }
+
+          const name = `${slug}__${tool.name}`;
+          this.namespace.set(name, { entry, upstream: tool.name });
+          merged.push({ ...tool, name, description: `${tool.description || tool.name} [destination: ${entry.destination.name}]` });
+        }
+      } catch (error) {
+        this.log(`[${entry.destination.name}] tools/list failed: ${redactText(error.message)}`);
+      }
+    }
+    if (!merged.length && this.children.length) throw new Error('No destination child provided tools');
+    return merged;
+  }
+
+  async handle(message) {
+    if (message.method?.startsWith('notifications/')) {
+      for (const entry of this.children) entry.child.notify(message.method, message.params);
+      return null;
+    }
+    if (message.id === undefined) return null;
+    try {
+      if (message.method === 'initialize') {
+        await this.initializeChildren(message.params || {});
+        return rpcResult(message.id, { protocolVersion: message.params?.protocolVersion || '2024-11-05', capabilities: { tools: {} }, serverInfo: { name: this.env.BAS_VSP_DESTINATION || this.children[0].destination.name, version: '0.1.0' } });
+      }
+      if (!this.initialized) return rpcError(message.id, -32002, 'MCP proxy is not initialized');
+      if (message.method === 'tools/list') return rpcResult(message.id, { tools: await this.mergedTools() });
+      if (message.method === 'tools/call') {
+        const name = message.params?.name;
+        const mapped = this.namespace.get(name);
+        if (!mapped) return rpcError(message.id, -32602, `Unknown namespaced tool: ${name}`);
+        if (mapped.handler) return rpcResult(message.id, await mapped.handler(message.params?.arguments));
+        const toolName = mapped.publicName || mapped.upstream;
+        const upstreamParams = { ...message.params, name: mapped.upstream };
+        if (mapped.transformArguments) upstreamParams.arguments = mapped.transformArguments(message.params?.arguments);
+        const startedAt = Date.now();
+        this.log(`[${mapped.entry.destination.name}] tools/call ${toolName} started`);
+        try {
+          const response = await mapped.entry.child.request('tools/call', upstreamParams);
+          if (response.result?.isError) {
+            const detail = Array.isArray(response.result.content)
+              ? response.result.content.filter(item => item.type === 'text').map(item => item.text).join(' ')
+              : '';
+            this.log(`[${mapped.entry.destination.name}] tools/call ${toolName} returned an error in ${Date.now() - startedAt}ms${detail ? `: ${diagnosticText(detail)}` : ''}`);
+          } else {
+            this.log(`[${mapped.entry.destination.name}] tools/call ${toolName} completed in ${Date.now() - startedAt}ms`);
+          }
+          return response.error ? { ...response, id: message.id } : rpcResult(message.id, response.result);
+        } catch (error) {
+          this.log(`[${mapped.entry.destination.name}] tools/call ${toolName} failed after ${Date.now() - startedAt}ms: ${diagnosticText(error.rpcError?.message || error.message)}`);
+          return error.rpcError ? rpcError(message.id, error.rpcError.code || -32001, error.rpcError.message || error.message, error.rpcError.data) : rpcError(message.id, -32001, `Destination ${mapped.entry.destination.name} failed: ${error.message}`);
+        }
+      }
+      if (!FORWARDED_METHODS.has(message.method)) return rpcError(message.id, -32601, `Method not found: ${message.method}`);
+      const responses = [];
+      for (const entry of this.children) {
+        try { responses.push((await entry.child.request(message.method, message.params)).result); } catch (error) { this.log(`[${entry.destination.name}] ${message.method} failed: ${redactText(error.message)}`); }
+      }
+      return rpcResult(message.id, responses.length === 1 ? responses[0] : responses);
+    } catch (error) {
+      this.log(`[MCP] ${message.method || 'request'} failed: ${diagnosticText(error.message)}`);
+      return rpcError(message.id, -32000, redactText(error.message));
+    }
+  }
+
+  async serve(input = process.stdin, output = this.output) {
+    this.output = output;
+    this.start();
+    let buffer = '';
+    const onData = async chunk => {
+      buffer += chunk;
+      let newline;
+      while ((newline = buffer.indexOf('\n')) >= 0) {
+        const line = buffer.slice(0, newline).trim();
+        buffer = buffer.slice(newline + 1);
+        if (!line) continue;
+        try {
+          const message = JSON.parse(line);
+          const response = await this.handle(message);
+          if (response) {
+            output(JSON.stringify(response));
+            if (message.method === 'initialize') {
+              this.clientInitialized = true;
+              for (const notification of this.pendingNotifications) output(JSON.stringify(notification));
+              this.pendingNotifications.length = 0;
+            }
+          }
+        } catch (error) { this.log(redactText(error.message)); }
+      }
+    };
+    input.setEncoding('utf8');
+    let queue = Promise.resolve();
+    input.on('data', chunk => { queue = queue.then(() => onData(chunk)); });
+    await once(input, 'end');
+    await queue;
+    await this.close();
+  }
+
+  async close() {
+    if (this.shuttingDown) return;
+    this.shuttingDown = true;
+    await Promise.all(this.destinations.map(async destination => {
+      const entry = this.children.find(candidate => candidate.destination === destination);
+      await entry?.child.close();
+      await closeDestinationRoute(destination);
+    }));
+  }
+}

package/src/setup.mjs

@@ -0,0 +1,275 @@
+import checkbox from '@inquirer/checkbox';
+import { createInterface } from 'node:readline/promises';
+import { stdin, stdout } from 'node:process';
+import { colorText, formatStatus, promptOutput, quietSpinnerTheme } from './terminal-ui.mjs';
+import { discoverDestinations, remediation } from './bas-discovery.mjs';
+import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys } from './cf-destination.mjs';
+import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
+
+const SETUP_COMMAND = 'sap-ai-dev --setup';
+
+function print(output, message) {
+  output.write(`${message}\n`);
+}
+
+
+async function confirmCloudFoundryImport({ input = stdin, output = stdout } = {}) {
+  const readline = createInterface({ input, output });
+  try {
+    print(output, formatStatus("Optional import from the current space's Destination service.", 'step', output, 'Cloud Foundry'));
+    const answer = await readline.question("Include destinations from the current CF space's Destination service? (y + Enter = import; Enter = skip) ");
+    return /^y(?:es)?$/i.test(answer.trim());
+  } finally {
+    readline.close();
+  }
+}
+
+function safeProbe(probe) {
+  const result = {};
+  if (typeof probe?.status === 'string') result.status = probe.status;
+  if (typeof probe?.available === 'boolean') result.available = probe.available;
+  if (Number.isFinite(probe?.httpStatus)) result.httpStatus = probe.httpStatus;
+  return result;
+}
+
+function safeBasDestination(destination) {
+  return {
+    source: 'bas',
+    name: destination.name,
+    serverName: destination.name,
+    url: destination.url,
+    client: destination.client,
+    authentication: destination.authentication,
+    probe: safeProbe(destination.probe)
+  };
+}
+
+function safeCloudFoundryDestination(destination) {
+  const cf = destination.cf || {};
+  return {
+    source: 'cloud-foundry',
+    name: destination.name,
+    serverName: destination.serverName,
+    client: destination.client,
+    authentication: destination.authentication,
+    proxyType: destination.proxyType,
+    probe: safeProbe(destination.probe),
+    cf: {
+      spaceGuid: cf.spaceGuid,
+      destinationInstanceGuid: cf.destinationInstanceGuid,
+      destinationInstanceName: cf.destinationInstanceName,
+      destinationKeyName: cf.destinationKeyName,
+      ...(cf.connectivityInstanceGuid ? {
+        connectivityInstanceGuid: cf.connectivityInstanceGuid,
+        connectivityInstanceName: cf.connectivityInstanceName,
+        connectivityKeyName: cf.connectivityKeyName
+      } : {})
+    },
+    ...(destination.disabledReason ? { disabledReason: destination.disabledReason } : {})
+  };
+}
+
+function printConnectionInstructions(output, result) {
+  const servers = Object.entries(result?.servers || {});
+  if (!servers.length) {
+    print(output, '');
+    print(output, formatStatus('No destinations were selected; no MCP servers were added.', 'info', output, 'BAS setup'));
+    return;
+  }
+  print(output, '');
+  print(output, colorText('📡 MCP servers now available:', 'cyan', output));
+  for (const [name, entry] of servers) {
+    const detail = entry.env?.BAS_VSP_DESTINATION
+      ? `destination: ${entry.env.BAS_VSP_DESTINATION}`
+      : (entry.displayName ? `tool server: ${entry.displayName}` : 'tool server');
+    print(output, `  • ${name} — ${detail}`);
+  }
+  print(output, formatStatus('Open the Command Palette → “MCP: List Servers”, select a generated server, and choose “Start Server”.', 'step', output, 'Next'));
+  print(output, formatStatus('Inspect or edit entries with “MCP: Open User Configuration”.', 'info', output, 'Config'));
+}
+
+
+export async function runSetup({
+  env = process.env,
+  input = stdin,
+  output = stdout,
+  discover = discoverDestinations,
+  discoverCf = discoverCloudFoundryDestinations,
+  confirmCfImport = confirmCloudFoundryImport,
+  install = installMcpConfig,
+  includeSapDevelopmentToolsPrompt = false
+} = {}) {
+  if (!env.H2O_URL) {
+    print(output, formatStatus(`Setup skipped: H2O_URL is not set. Run ${SETUP_COMMAND} in a BAS dev space.`, 'info', output, 'BAS setup'));
+    return { skipped: true, reason: 'non-bas' };
+  }
+  if (!input.isTTY || !output.isTTY) {
+    print(output, formatStatus(`Interactive setup needs a terminal. Rerun ${SETUP_COMMAND} from a BAS terminal.`, 'warning', output, 'BAS setup'));
+    return { skipped: true, reason: 'non-tty' };
+  }
+  print(output, '');
+  print(output, formatStatus('Contacting BAS to discover destinations; this may take a moment.', 'progress', output, 'Setup'));
+
+  let basDestinations;
+  try {
+    basDestinations = await discover({ env: { ...env, BAS_VSP_DESTINATION: '' } });
+  } catch (error) {
+    throw new Error(`BAS discovery failed: ${error.message}`);
+  }
+  const destinations = basDestinations.map(safeBasDestination);
+  const warnings = [];
+  let createdKeys = [];
+  let configPath;
+  let managedKeys = [];
+  try {
+    configPath = await resolveMcpConfigPath(env);
+    managedKeys = collectManagedCloudFoundryKeyReferences(await readMcpConfig(configPath));
+  } catch {
+    warnings.push('Existing MCP config could not be read before setup; existing CF service keys will not be reused.');
+  }
+
+  const target = await getCloudFoundryTarget({ env });
+  if (!target.available) {
+    warnings.push(target.reason);
+  } else {
+    let shouldImport = false;
+    try {
+      shouldImport = await confirmCfImport({ input, output });
+    } catch {
+      warnings.push('Cloud Foundry import prompt failed; CF destinations were skipped.');
+    }
+    if (shouldImport) {
+      print(output, formatStatus('Reading destinations from Cloud Foundry.', 'progress', output, 'Cloud Foundry'));
+      try {
+        const result = await discoverCf({ env, input, output, spaceGuid: target.spaceGuid, managedKeys });
+        createdKeys = Array.isArray(result?.createdKeys) ? result.createdKeys : [];
+        const cfDestinations = Array.isArray(result?.destinations) ? result.destinations : [];
+        destinations.push(...cfDestinations.map(safeCloudFoundryDestination));
+        warnings.push(...(Array.isArray(result?.warnings) ? result.warnings.filter(value => typeof value === 'string') : []));
+      } catch {
+        warnings.push('Cloud Foundry import failed; BAS setup can continue.');
+      }
+    } else if (!warnings.some(message => message.includes('Cloud Foundry import prompt failed'))) {
+      warnings.push('Cloud Foundry destinations were skipped because import was not confirmed.');
+    }
+  }
+
+  const reportWarnings = async messages => {
+    for (const message of messages) print(output, formatStatus(message, 'warning', output, 'Warning'));
+  };
+  const cleanupKeys = async (keys, config) => {
+    const referenced = collectCloudFoundryKeyReferencesFromAllEntries(config);
+    const referenceIds = new Set(referenced.map(reference => `${reference.kind}\0${reference.spaceGuid}\0${reference.instanceGuid}\0${reference.keyName}`));
+    const candidates = keys.filter(key => !referenceIds.has(`${key.kind}\0${key.spaceGuid}\0${key.instanceGuid}\0${key.keyName}`));
+    if (!candidates.length) return [];
+    const result = await deleteManagedCloudFoundryServiceKeys({ env, keys: candidates });
+    return result.warnings || [];
+  };
+  const cleanupNewKeysWithoutConfigChange = async () => {
+    if (!createdKeys.length) return [];
+    const result = await deleteManagedCloudFoundryServiceKeys({ env, keys: createdKeys });
+    return result.warnings || [];
+  };
+  const selectable = destinations.filter(destination => !destination.disabledReason);
+  if (!selectable.length) {
+    print(output, formatStatus('No selectable BAS or Cloud Foundry destinations were found.', 'warning', output, 'Setup'));
+    print(output, remediation);
+    await reportWarnings(warnings);
+    const cleanupWarnings = await cleanupNewKeysWithoutConfigChange();
+    await reportWarnings(cleanupWarnings);
+    return { skipped: true, reason: 'no-destinations', warnings: [...warnings, ...cleanupWarnings] };
+  }
+
+  const orderedDestinations = [...destinations].sort((left, right) => {
+    const leftRank = left.disabledReason ? 2 : (left.probe?.available === false ? 1 : 0);
+    const rightRank = right.disabledReason ? 2 : (right.probe?.available === false ? 1 : 0);
+    return leftRank - rightRank || String(left.name).localeCompare(String(right.name));
+  });
+  const choices = orderedDestinations.map(destination => {
+    const probe = destination.probe?.status || 'unknown';
+    const source = destination.source === 'cloud-foundry'
+      ? `CF ${destination.cf.destinationInstanceName}`
+      : 'BAS';
+    const disabled = destination.disabledReason;
+    const state = disabled ? 'disabled' : (destination.probe?.available === false ? `fail:${probe}` : `ok:${probe}`);
+    return {
+      value: destination,
+      name: `${destination.name} (${source}, client ${destination.client}, ${state})`,
+      ...(disabled ? { disabled } : {}),
+      checked: false
+    };
+  });
+  print(output, '');
+  print(output, formatStatus('Choose the destinations to add. Reachable destinations are shown first.', 'step', output, 'Setup'));
+  print(output, '');
+  print(output, '  Space = select/deselect · a = toggle all · Enter = confirm.');
+  print(output, '  Nothing selected removes this add-on’s MCP entries.');
+  print(output, '');
+  const selected = await checkbox({
+    message: colorText('🧭 Select destinations', 'cyan', output),
+    choices,
+    required: false,
+    shortcuts: { all: 'a', invert: null },
+    theme: quietSpinnerTheme
+  }, { input, output: promptOutput(output) });
+
+  let sapDevelopmentServers = [];
+  if (includeSapDevelopmentToolsPrompt) {
+    print(output, '');
+    print(output, formatStatus('Optionally add companion MCP servers for full-stack SAP development.', 'step', output, 'Tools'));
+    print(output, '  Recommended for RAP/Fiori/CAP/UI validation work. Leave empty to only configure ABAP/ADT destination servers.');
+    print(output, '');
+    sapDevelopmentServers = await checkbox({
+      message: colorText('🧰 Select companion tools', 'cyan', output),
+      choices: SAP_DEVELOPMENT_MCP_SERVERS.map(server => ({
+        value: server.id,
+        name: `${server.name} — ${server.description}`,
+        checked: false
+      })),
+      required: false,
+      shortcuts: { all: 'a', invert: null },
+      theme: quietSpinnerTheme
+    }, { input, output: promptOutput(output) });
+  }
+  try {
+    const result = await install(selected, { env, sapDevelopmentServers });
+    const location = result?.path ? ` in ${result.path}` : '';
+    print(output, '');
+    const configuredCount = selected.length + sapDevelopmentServers.length;
+    print(output, formatStatus(`Configured ${configuredCount} MCP server${configuredCount === 1 ? '' : 's'}${location}.`, 'success', output, 'BAS setup'));
+    printConnectionInstructions(output, result);
+    let cleanupWarnings = [];
+    const finalPath = result?.path || configPath;
+    if (!finalPath) {
+      cleanupWarnings.push('CF service-key cleanup skipped because the final MCP config path is unavailable.');
+    } else {
+      try {
+        const finalConfig = await readMcpConfig(finalPath);
+        cleanupWarnings = await cleanupKeys([...managedKeys, ...createdKeys], finalConfig);
+      } catch {
+        cleanupWarnings.push('CF service-key cleanup skipped because the final MCP config could not be read.');
+      }
+    }
+    await reportWarnings(warnings);
+    await reportWarnings(cleanupWarnings);
+    return { selected, ...(result || {}), warnings: [...warnings, ...cleanupWarnings] };
+  } catch (error) {
+    const cleanupWarnings = [];
+    if (createdKeys.length) {
+      const finalPath = configPath;
+      if (!finalPath) {
+        cleanupWarnings.push('CF service-key cleanup skipped because the MCP config path is unavailable.');
+      } else {
+        try {
+          const actualConfig = await readMcpConfig(finalPath);
+          cleanupWarnings.push(...await cleanupKeys(createdKeys, actualConfig));
+        } catch {
+          cleanupWarnings.push('CF service-key cleanup skipped because the MCP config could not be read.');
+        }
+      }
+    }
+    await reportWarnings([...warnings, ...cleanupWarnings]);
+    throw new Error(`MCP config writing failed: ${error.message}`);
+  }
+}
+