sap-ai-dev-toolkit 0.3.0 → 0.3.3

package/src/bas-destination-relay.mjs

@@ -0,0 +1,271 @@
+import http from 'node:http';
+import { fetch as undiciFetch, ProxyAgent } from 'undici';
+
+const DEFAULT_PROXY = 'http://127.0.0.1:8887';
+const MAX_BODY_BYTES = 64 * 1024 * 1024;
+const HOP_BY_HOP = new Set([
+  'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
+  'proxy-connection', 'te', 'trailer', 'transfer-encoding', 'upgrade', 'host'
+]);
+const UNSAFE = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+// SAP ties CSRF tokens to the session that fetched them. The BAS .dest proxy
+// authenticates each hop, so the relay pairs every token with the exact
+// Set-Cookie state SAP returned alongside it and replays both on the unsafe
+// request. Without this pairing SAP sees a token from a foreign session and
+// answers "CSRF token validation failed" with HTTP 403.
+const TOKEN_TTL_MS = 15 * 60 * 1000;
+const MAX_TOKEN_FAILURES = 3;
+const MAX_TUNNEL_FALLBACKS = 2;
+// Carrying a POST's content-length on the token-fetch GET would make the
+// proxy wait for a body that never arrives, so the relay drops body headers.
+const BODY_HEADERS = new Set(['content-length', 'content-type']);
+// The forwarded request's content-length must describe the body undici is
+// about to send. Forwarding the inbound value alongside a re-buffered body
+// makes undici reject the request (UND_ERR_INVALID_ARG), so it is always
+// recomputed from the actual payload.
+const LENGTH_HEADERS = new Set(['content-length', 'transfer-encoding']);
+// undici transparently decompresses gzip/deflate/br responses but keeps the
+// content-encoding header, so forwarding the client's accept-encoding would
+// hand VSP a "gzip" body that is actually plain bytes. Dropping the header
+// lets undici request identity encoding and keeps bodies consistent.
+const ENCODING_HEADERS = new Set(['accept-encoding', 'content-encoding']);
+
+function headersFrom(requestHeaders, extra = {}) {
+  const headers = {};
+  for (const [name, value] of Object.entries(requestHeaders || {})) {
+    const lower = name.toLowerCase();
+    if (HOP_BY_HOP.has(lower) || LENGTH_HEADERS.has(lower) || ENCODING_HEADERS.has(lower)) continue;
+    if (value !== undefined) headers[name] = Array.isArray(value) ? value.join(', ') : String(value);
+  }
+  return { ...headers, ...extra };
+}
+
+function fetchHeaders(requestHeaders, extra = {}) {
+  const headers = {};
+  for (const [name, value] of Object.entries(requestHeaders || {})) {
+    const lower = name.toLowerCase();
+    if (HOP_BY_HOP.has(lower) || BODY_HEADERS.has(lower) || ENCODING_HEADERS.has(lower)) continue;
+    if (value !== undefined) headers[name] = Array.isArray(value) ? value.join(', ') : String(value);
+  }
+  return { ...headers, ...extra };
+}
+
+function tunnelFailure(status) {
+  // 502/504 from the proxy itself means the absolute-form .dest request is
+  // being refused; worth retrying through a CONNECT tunnel.
+  return status === 502 || status === 504;
+}
+
+function csrfFailure(status, headers, body) {
+  return status === 403 && (
+    String(headers.get?.('x-csrf-token') || '').toLowerCase() === 'required' ||
+    String(body || '').toLowerCase().includes('csrf token validation failed')
+  );
+}
+
+function authFailure(status) {
+  return status === 401 || status === 403;
+}
+
+function cookieHeader(jar) {
+  return jar.size ? [...jar].map(([name, value]) => `${name}=${value}`).join('; ') : undefined;
+}
+
+function recordCookies(jar, headers) {
+  for (const value of headers.getSetCookie?.() || []) {
+    const [pair] = String(value).split(';');
+    const separator = pair.indexOf('=');
+    if (separator <= 0) continue;
+    const name = pair.slice(0, separator).trim();
+    if (!name) continue;
+    if (/expires=thu, 01 jan 1970/i.test(String(value))) jar.delete(name);
+    else jar.set(name, pair.slice(separator + 1).trim());
+  }
+}
+
+async function readRequestBody(req) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    size += chunk.length;
+    if (size > MAX_BODY_BYTES) throw new Error('request body is too large for BAS destination relay');
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+export function createBasDestinationRelay(destination, { env = process.env, fetchImpl = undiciFetch, log = () => {} } = {}) {
+  if (!destination?.url) throw new Error('Destination relay requires a BAS destination URL');
+  const base = new URL(destination.url);
+  // Self-healing mode 5 (direct connect): the BAS .dest proxy strips
+  // Set-Cookie, which makes SAP CSRF session binding impossible. When the
+  // operator stored credentials for this destination (setup prompts for
+  // Internet destinations), the relay connects straight to the backend host
+  // with Basic auth — cookies survive, CSRF pairing works, and writes go
+  // through exactly like they do from Eclipse/ADT.
+  const credentials = destination.credentials;
+  const directBase = credentials?.host ? new URL(String(credentials.host)) : null;
+  const effectiveBase = directBase || base;
+  if (directBase) log(`[${destination.name}] BAS relay direct connect active (${directBase.origin}); BAS proxy cookie stripping bypassed`);
+  // Proxy resolution: an explicitly configured proxy wins (an explicit empty
+  // value means "go direct"). Without configuration, BAS virtual .dest hosts
+  // imply the default BAS proxy; any other host (tests, direct URLs) is
+  // reached directly so the relay never routes loopback traffic through a
+  // foreign proxy.
+  const explicitProxy = env.HTTP_PROXY ?? env.http_proxy;
+  const proxyUrl = directBase ? '' : (explicitProxy !== undefined ? String(explicitProxy) : (/\.dest$/i.test(base.hostname) ? DEFAULT_PROXY : ''));
+  const dispatcher = proxyUrl ? new ProxyAgent({ uri: proxyUrl, proxyTunnel: false }) : undefined;
+  // Self-healing mode 2: if the BAS proxy refuses absolute-form proxied
+  // requests (its own 502/504), retry through a CONNECT tunnel so the relay
+  // keeps working through the same egress.
+  const tunnelDispatcher = proxyUrl ? new ProxyAgent({ uri: proxyUrl, proxyTunnel: true }) : undefined;
+  let tunneled = false;
+  // Observable self-healing counters, surfaced by --doctor and tests.
+  const stats = { requests: 0, csrfFetches: 0, csrfRetries: 0, tunnelFallbacks: 0, direct: Boolean(directBase) };
+  // Per-path CSRF sessions: { token, jar, fetchedAt } where jar holds the
+  // Set-Cookie state SAP returned together with the token.
+  const tokenCache = new Map();
+
+  function rememberSession(key, token, headers) {
+    const jar = new Map();
+    recordCookies(jar, headers);
+    tokenCache.set(key, { token, jar, fetchedAt: Date.now() });
+  }
+
+  async function send(target, method, headers, body) {
+    const useTunnel = tunneled && tunnelDispatcher;
+    return fetchImpl(target, {
+      method,
+      headers,
+      body: body?.length ? body : undefined,
+      ...(useTunnel ? { dispatcher: tunnelDispatcher } : dispatcher ? { dispatcher } : {})
+    });
+  }
+
+  // Try absolute-form first; on transport errors or proxy-level failures,
+  // flip to tunneled mode once and retry (sticky for later requests).
+  async function sendWithFallback(target, method, headers, body) {
+    if (tunneled) return send(target, method, headers, body);
+    try {
+      const response = await send(target, method, headers, body);
+      if (!tunnelFailure(response.status)) return response;
+      log(`[${destination.name}] BAS relay proxy returned HTTP ${response.status} for ${target.pathname}; switching to proxy tunnel`);
+    } catch (error) {
+      log(`[${destination.name}] BAS relay absolute-form request failed for ${target.pathname} (${error.message}); switching to proxy tunnel`);
+    }
+    tunneled = true;
+    stats.tunnelFallbacks += 1;
+    return send(target, method, headers, body);
+  }
+
+  async function fetchToken(requestUrl, requestHeaders) {
+    const key = requestUrl.pathname;
+    const cached = tokenCache.get(key);
+    if (cached && Date.now() - cached.fetchedAt < TOKEN_TTL_MS) return cached;
+    stats.csrfFetches += 1;
+    const response = await sendWithFallback(resolveTarget(requestUrl), 'GET', authHeaders(fetchHeaders(requestHeaders, {
+      'x-csrf-token': 'Fetch',
+      accept: requestHeaders.accept || 'application/xml,*/*',
+      ...(cached?.jar?.size ? { cookie: cookieHeader(cached.jar) } : {})
+    })));
+    await response.arrayBuffer().catch(() => undefined);
+    const token = response.headers.get('x-csrf-token');
+    if (token && token.toLowerCase() !== 'required') {
+      rememberSession(key, token, response.headers);
+      return tokenCache.get(key);
+    }
+    return null;
+  }
+
+  // Rewrite an incoming .dest target onto the direct backend host when
+  // credentials are configured, keeping path and query intact.
+  function resolveTarget(target) {
+    if (!directBase) return target;
+    return new URL(`${target.pathname}${target.search}`, directBase);
+  }
+
+  function authHeaders(extra = {}) {
+    if (!credentials?.user || !credentials?.password) return extra;
+    const basic = Buffer.from(`${credentials.user}:${credentials.password}`).toString('base64');
+    return { authorization: `Basic ${basic}`, ...extra };
+  }
+
+  async function forward(method, requestUrl, requestHeaders, body, session) {
+    const headers = authHeaders(headersFrom(requestHeaders, {
+      ...(session?.token ? { 'x-csrf-token': session.token } : {}),
+      ...(session?.jar?.size ? { cookie: cookieHeader(session.jar) } : {})
+    }));
+    const response = await sendWithFallback(resolveTarget(requestUrl), method, headers, body);
+    const responseBody = Buffer.from(await response.arrayBuffer());
+    if (session) recordCookies(session.jar, response.headers);
+    return { response, body: responseBody };
+  }
+
+  // Self-healing mode 1: when SAP rejects a token (expired, rotated, or
+  // invalidated server-side), drop the cached session and retry with a
+  // freshly fetched token paired with its own cookies. Bounded retries keep
+  // a failing destination from looping forever.
+  async function forwardWithRetry(method, requestUrl, requestHeaders, body, failures = 0) {
+    const unsafe = UNSAFE.has(method);
+    const session = unsafe ? await fetchToken(requestUrl, requestHeaders) : null;
+    if (unsafe && !session) log(`[${destination.name}] BAS relay could not obtain CSRF token for ${requestUrl.pathname}`);
+    const { response, body: responseBody } = await forward(method, requestUrl, requestHeaders, body, session);
+    const rejected = csrfFailure(response.status, response.headers, responseBody) || (authFailure(response.status) && session);
+    if (unsafe && rejected && failures < MAX_TOKEN_FAILURES) {
+      log(`[${destination.name}] BAS relay CSRF session rejected for ${requestUrl.pathname}; re-establishing token and session (attempt ${failures + 1}/${MAX_TOKEN_FAILURES})`);
+      stats.csrfRetries += 1;
+      tokenCache.delete(requestUrl.pathname);
+      return forwardWithRetry(method, requestUrl, requestHeaders, body, failures + 1);
+    }
+    return { response, body: responseBody };
+  }
+
+  const server = http.createServer((req, res) => {
+    void (async () => {
+      const method = String(req.method || 'GET').toUpperCase();
+      const requestUrl = new URL(req.url || '/', base);
+      stats.requests += 1;
+      const body = UNSAFE.has(method) ? await readRequestBody(req) : Buffer.alloc(0);
+      const { response, body: responseBody } = await forwardWithRetry(method, requestUrl, req.headers, body);
+      const responseHeaders = {};
+      for (const [name, value] of response.headers) {
+        const lower = name.toLowerCase();
+        // undici decompresses response bodies; the stale content-encoding and
+        // content-length would misdescribe the plain bytes handed to VSP.
+        if (HOP_BY_HOP.has(lower) || lower === 'content-encoding' || lower === 'content-length') continue;
+        responseHeaders[name] = value;
+      }
+      responseHeaders['x-sap-ai-dev-toolkit-relay'] = 'bas-destination';
+      res.writeHead(response.status, response.statusText, responseHeaders);
+      res.end(responseBody);
+    })().catch(error => {
+      if (!res.headersSent) res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8', 'connection': 'close' });
+      res.end(`BAS destination relay failed: ${error.message}\n`);
+    });
+  });
+
+  // Bind eagerly and report the real port through `ready`. Callers must
+  // await `ready` before handing the URL to a VSP child; binding failures
+  // surface as a rejected promise instead of a silently wrong guessed port.
+  const listening = new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      server.removeListener('error', reject);
+      resolve(server.address().port);
+    });
+  });
+  const ready = listening.then(port => `http://127.0.0.1:${port}`).catch(error => {
+    log(`[${destination.name}] BAS relay failed to start: ${error.message}`);
+    throw error;
+  });
+  return {
+    ready,
+    stats,
+    close: async () => {
+      await dispatcher?.close?.();
+      await tunnelDispatcher?.close?.();
+      server.closeAllConnections?.();
+      await new Promise(resolve => server.close(() => resolve()));
+    }
+  };
+}

package/src/bas-discovery.mjs

@@ -52,11 +52,15 @@ export function normalizeDestination(item) {
   const name = text(values.name || values.destinationname || values.destname);
   const authentication = text(values.authentication || values.authtype || values.auth);
   const client = text(values.sapclient || values.client) || '001';
+  const backendUrl = text(values.url || values.host || values.webideexposedhost);
+  const proxyType = text(values.proxytype || values.proxy);
   return {
     name,
     authentication: authentication || 'Unknown',
     client,
     url: name ? destinationUrl(name) : null,
+    backendUrl: backendUrl || null,
+    proxyType: proxyType || null,
     rawKeys: Object.keys(item || {}).map(String)
   };
 }

package/src/credentials-store.mjs

@@ -0,0 +1,114 @@
+import { randomUUID } from 'node:crypto';
+import { chmod, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { basename, dirname, join } from 'node:path';
+import { brandedEnvValue } from './branding.mjs';
+
+// Credentials for direct-connect destinations live next to the MCP config
+// (never inside it), with 0600 permissions and no tokens or cookies. The
+// file maps destination names to { host, user, password, updatedAt }.
+const CREDENTIALS_FILENAME = 'sap-ai-dev-toolkit-credentials.json';
+
+const SECRET_PATTERN = /(authorization|cookie|password|secret|token|bearer|credential)/i;
+
+async function exists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch (error) {
+    if (error?.code === 'ENOENT') return false;
+    throw error;
+  }
+}
+
+export function redactCredentialValue(value) {
+  return SECRET_PATTERN.test(String(value)) ? '[redacted]' : value;
+}
+
+export async function resolveCredentialsPath(env = process.env, mcpConfigPath) {
+  const configured = brandedEnvValue(env, 'CREDENTIALS_FILE');
+  if (configured) return configured;
+  if (mcpConfigPath) return join(dirname(mcpConfigPath), CREDENTIALS_FILENAME);
+  const home = env.HOME || homedir();
+  const candidates = [
+    join(home, '.vscode', 'data', 'User'),
+    join(home, '.vscode-server', 'data', 'User'),
+    join(home, '.code-server', 'data', 'User')
+  ];
+  for (const candidate of candidates) if (await exists(candidate)) return join(candidate, CREDENTIALS_FILENAME);
+  return join(candidates[0], CREDENTIALS_FILENAME);
+}
+
+function sanitizeEntry(entry) {
+  const result = {};
+  if (typeof entry?.host === 'string' && entry.host) result.host = entry.host;
+  if (typeof entry?.user === 'string' && entry.user) result.user = entry.user;
+  if (typeof entry?.password === 'string' && entry.password) result.password = entry.password;
+  if (typeof entry?.updatedAt === 'string') result.updatedAt = entry.updatedAt;
+  return result;
+}
+
+export async function readCredentials(path) {
+  let raw;
+  try {
+    raw = await readFile(path, 'utf8');
+  } catch (error) {
+    if (error?.code === 'ENOENT') return {};
+    throw new Error(`Credentials file ${path} could not be read: ${error.message}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    throw new Error(`Credentials file ${path} contains invalid JSON: ${error.message}`);
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new Error(`Credentials file ${path} must contain a top-level JSON object`);
+  }
+  const destinations = {};
+  for (const [name, entry] of Object.entries(parsed.destinations || {})) {
+    const clean = sanitizeEntry(entry);
+    if (clean.user && clean.password) destinations[name] = clean;
+  }
+  return { destinations };
+}
+
+async function writeCredentials(path, destinations) {
+  const directory = dirname(path);
+  await mkdir(directory, { recursive: true });
+  const temporary = join(directory, `.${basename(path)}.${process.pid}.${randomUUID()}.tmp`);
+  try {
+    await writeFile(temporary, `${JSON.stringify({ version: 1, destinations }, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await rename(temporary, path);
+    await chmod(path, 0o600).catch(() => {});
+  } catch (error) {
+    await rm(temporary, { force: true }).catch(() => {});
+    throw new Error(`Credentials file ${path} could not be written: ${error.message}`);
+  }
+}
+
+export async function storeDestinationCredentials(path, name, { host, user, password }) {
+  const current = await readCredentials(path).catch(error => { throw error; });
+  const destinations = { ...current.destinations };
+  destinations[String(name)] = { host: String(host || ''), user: String(user || ''), password: String(password || ''), updatedAt: new Date().toISOString() };
+  await writeCredentials(path, destinations);
+  return { path, name };
+}
+
+export async function removeDestinationCredentials(path, names) {
+  const current = await readCredentials(path);
+  const destinations = { ...current.destinations };
+  const removed = [];
+  for (const name of names) {
+    if (Object.hasOwn(destinations, String(name))) {
+      delete destinations[String(name)];
+      removed.push(String(name));
+    }
+  }
+  if (removed.length) await writeCredentials(path, destinations);
+  return { path, removed };
+}
+
+export function listCredentialDestinations(credentials) {
+  return Object.entries(credentials?.destinations || {}).map(([name, entry]) => ({ name, host: entry.host, user: entry.user, updatedAt: entry.updatedAt }));
+}

package/src/launcher.mjs

@@ -10,10 +10,36 @@ import { installMcpConfig } from './mcp-config.mjs';
 import { runSetup } from './setup.mjs';
 import { resolveConfiguredCloudFoundryDestination } from './cf-destination.mjs';
 import { withBrandedEnvironment } from './branding.mjs';
+import { readCredentials, resolveCredentialsPath } from './credentials-store.mjs';
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
 const runtimeEnv = withBrandedEnvironment(process.env);
 
+// Attach stored direct-connect credentials (setup prompts for Internet
+// destinations) to matching discovered destinations. Credentials stay in
+// memory only; nothing is logged or written to the MCP config.
+async function enrichWithStoredCredentials(destinations, env = runtimeEnv) {
+  const needingCredentials = destinations.filter(destination =>
+    destination.source !== 'cloud-foundry'
+    && destination.url
+    && String(destination.url).includes('.dest'));
+  if (!needingCredentials.length) return destinations;
+  let stored;
+  try {
+    const path = await resolveCredentialsPath(env);
+    stored = await readCredentials(path);
+  } catch (error) {
+    console.error(`[sap-ai-dev] stored credentials could not be read: ${String(error.message).slice(0, 200)}`);
+    return destinations;
+  }
+  return destinations.map(destination => {
+    const entry = stored.destinations?.[destination.name];
+    if (!entry?.host || !entry.user || !entry.password) return destination;
+    if (!destination.backendUrl) return destination;
+    return { ...destination, credentials: { host: entry.host, user: entry.user, password: entry.password } };
+  });
+}
+
 function hasFlag(name) { return process.argv.slice(2).includes(name); }
 function json(value) { process.stdout.write(`${JSON.stringify(value)}\n`); }
 
@@ -75,6 +101,19 @@ async function runDoctor(destinations) {
       const initialized = await proxy.handle({ jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2024-11-05' } });
       if (initialized?.error) throw new Error(initialized.error.message || 'MCP initialization failed');
       checks.push(doctorRow(destination.name, 'VSP MCP startup', 'passed', 'initialized'));
+      const relayedDestination = proxy.children[0]?.destination;
+      if (relayedDestination?.relay) {
+        checks.push(doctorRow(destination.name, 'BAS destination relay', 'passed', `enabled (${relayedDestination.url}); CSRF token/session pairing active`));
+      } else if (destination.source === 'cloud-foundry') {
+        checks.push(doctorRow(destination.name, 'BAS destination relay', 'skipped', 'Cloud Foundry destinations connect through the connectivity proxy directly.'));
+      } else if (String(runtimeEnv.SAP_AI_DEV_TOOLKIT_DISABLE_BAS_RELAY || '').toLowerCase() === 'true') {
+        checks.push(doctorRow(destination.name, 'BAS destination relay', 'skipped', 'Disabled through SAP_AI_DEV_TOOLKIT_DISABLE_BAS_RELAY.'));
+      } else {
+        checks.push(doctorRow(destination.name, 'BAS destination relay', 'skipped', 'Not applicable for this destination.'));
+      }
+      if (relayedDestination?.credentials) {
+        checks.push(doctorRow(destination.name, 'Direct connect', 'passed', `active (${new URL(relayedDestination.credentials.host).origin}); ADT writes use stored credentials`));
+      }
       const listed = await proxy.handle({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} });
       if (listed?.error) throw new Error(listed.error.message || 'MCP tools/list failed');
       const tools = listed.result?.tools || [];
@@ -165,7 +204,7 @@ async function main() {
     try {
       const destinations = runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry'
         ? [await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })]
-        : await discoverForCommand();
+        : await enrichWithStoredCredentials(await discoverForCommand());
       report = await runDoctor(destinations);
     } catch (error) {
       report = { ok: false, destinations: 0, checks: [doctorRow('-', 'destination discovery', 'failed', redactText(error.message || error).slice(0, 300))] };
@@ -231,12 +270,15 @@ async function main() {
 
   const discovered = await discoverDestinations({ env: runtimeEnv });
   for (const destination of discovered) console.error(probeDiagnostic(destination));
-  const destinations = discovered;
+  const destinations = await enrichWithStoredCredentials(discovered);
   if (!destinations.length) {
     console.error('[sap-ai-dev] destination discovery returned no named BAS destinations');
     throw new Error(remediation);
   }
   const binary = await binaryOrError();
+  for (const destination of destinations) {
+    if (destination.credentials) console.error(`[sap-ai-dev] ${destination.name}: direct connect enabled through stored credentials`);
+  }
   console.error(`[sap-ai-dev] starting MCP proxy for ${destinations.map(destination => `${destination.name} (client=${destination.client})`).join(', ')}`);
   const proxy = new MCPProxy({ binary, destinations, env: process.env, log: message => console.error(message) });
   const shutdown = signal => { void proxy.close().finally(() => process.exit(signal === 'SIGINT' ? 130 : 143)); };