sap-ai-dev-toolkit 0.3.1 → 0.3.4

package/src/mcp-proxy.mjs

@@ -4,6 +4,7 @@ import { sanitizeChildEnv, slugifyDestination } from './bas-discovery.mjs';
 import { ABAP_LINT_TOOL, runABAPLint } from './abaplint.mjs';
 import { createEngineeringTools } from './engineering-tools.mjs';
 import { brandedEnvValue } from './branding.mjs';
+import { createBasDestinationRelay } from './bas-destination-relay.mjs';
 
 const JSONRPC = '2.0';
 const FORWARDED_METHODS = new Set(['ping', 'resources/list', 'resources/read', 'resources/templates/list', 'prompts/list', 'completion/complete', 'logging/setLevel']);
@@ -58,8 +59,27 @@ function closeDestinationRoute(destination) {
   return closedRoutes.get(destination);
 }
 
+function useBasDestinationRelay(destination, env = process.env) {
+  if (String(brandedEnvValue(env, 'DISABLE_BAS_RELAY') || '').toLowerCase() === 'true') return false;
+  if (destination.source === 'cloud-foundry') return false;
+  if (!destination.authentication) return false;
+  return Boolean(destination.url && String(destination.url).includes('.dest'));
+}
+
 function childEnvironment(destination, env) {
-  return { ...sanitizeChildEnv(env), ...(destination.childEnv || {}) };
+  const childEnv = { ...sanitizeChildEnv(env), ...(destination.childEnv || {}) };
+  // The VSP child must reach the local BAS relay directly, never through the
+  // BAS .dest proxy. Without a loopback exception every child request would
+  // be double-proxied and the relay's session pairing could never apply.
+  if (destination.relay) {
+    const loopback = '127.0.0.1,localhost';
+    for (const key of ['NO_PROXY', 'no_proxy']) {
+      const entries = String(childEnv[key] || '').split(',').map(value => value.trim()).filter(Boolean);
+      for (const host of loopback.split(',')) if (!entries.some(entry => entry.toLowerCase() === host)) entries.push(host);
+      childEnv[key] = entries.join(',');
+    }
+  }
+  return childEnv;
 }
 
 
@@ -95,12 +115,14 @@ class Child {
     this.process.on('error', error => {
       if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] VSP child process error: ${diagnosticText(error.message)}`);
       this.fail(error);
-      void closeDestinationRoute(destination);
+      // Relay routes survive child crashes so self-healing restarts can reuse
+      // them; they are closed by the proxy shutdown path instead.
+      if (!destination.relay) void closeDestinationRoute(destination);
     });
     this.process.on('exit', (code, signal) => {
       if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] VSP child exited (${code ?? signal})`);
       this.fail(new Error(`child exited (${code ?? signal})`));
-      void closeDestinationRoute(destination);
+      if (!destination.relay) void closeDestinationRoute(destination);
     });
   }
 
@@ -209,36 +231,87 @@ export class MCPProxy {
   start() {
     if (this.started) return this;
     this.started = true;
-    for (const destination of this.destinations) {
-      try {
-        this.log(`[${destination.name}] starting VSP child (client=${destination.client || '001'})`);
-        this.children.push({
-          destination,
-          child: new Child(this.binary, destination, {
-            env: this.env,
-            spawn: this.spawn,
-            args: this.childArgs?.(destination),
-            log: this.log,
-            onNotification: notification => {
-              if (this.clientInitialized) this.output(JSON.stringify(notification));
-              else this.pendingNotifications.push(notification);
-            }
-          })
-        });
-      } catch (error) {
-        this.log(`[${destination.name}] failed to start child: ${diagnosticText(error.message)}`);
-        void closeDestinationRoute(destination);
+    this.starting = (async () => {
+      for (const originalDestination of this.destinations) {
+        let destination = originalDestination;
+        try {
+          if (useBasDestinationRelay(originalDestination, this.env)) {
+            const relay = createBasDestinationRelay(originalDestination, { env: this.env, log: this.log });
+            const originalClose = originalDestination.close;
+            const relayUrl = await relay.ready;
+            destination = {
+              ...originalDestination,
+              url: relayUrl,
+              relay: true,
+              async close() {
+                await originalClose?.();
+                await relay.close();
+              }
+            };
+            this.log(`[${originalDestination.name}] BAS destination relay enabled (${relayUrl})`);
+          }
+          this.log(`[${destination.name}] starting VSP child (client=${destination.client || '001'})`);
+          this.children.push({
+            destination,
+            child: new Child(this.binary, destination, {
+              env: this.env,
+              spawn: this.spawn,
+              args: this.childArgs?.(destination),
+              log: this.log,
+              onNotification: notification => {
+                if (this.clientInitialized) this.output(JSON.stringify(notification));
+                else this.pendingNotifications.push(notification);
+              }
+            })
+          });
+        } catch (error) {
+          this.log(`[${destination.name}] failed to start child: ${diagnosticText(error.message)}`);
+          void closeDestinationRoute(destination);
+        }
       }
-    }
-    if (!this.children.length) {
-      this.started = false;
-      for (const destination of this.destinations) void closeDestinationRoute(destination);
-      throw new Error('No destination child could be started');
-    }
+      if (!this.children.length) {
+        this.started = false;
+        for (const destination of this.destinations) void closeDestinationRoute(destination);
+        throw new Error('No destination child could be started');
+      }
+      return this;
+    })();
+    // Mark the startup promise as handled here; initializeChildren re-awaits
+    // it so startup failures still surface as MCP initialization errors
+    // without triggering an unhandled rejection in between.
+    this.starting.catch(() => {});
     return this;
   }
 
+  // Self-healing mode 3: transparently restart a crashed VSP child so an
+  // MCP tools/call does not permanently fail after a single crash. The
+  // restarted child re-initializes and re-registers tools before the call
+  // is retried once.
+  async restartChild(entry) {
+    if (this.shuttingDown) throw new Error('MCP proxy is shutting down');
+    const name = entry.destination.name;
+    this.log(`[${name}] VSP child crashed; self-healing restart in progress`);
+    await entry.child.close().catch(() => {});
+    const child = new Child(this.binary, entry.destination, {
+      env: this.env,
+      spawn: this.spawn,
+      args: this.childArgs?.(entry.destination),
+      log: this.log,
+      onNotification: notification => {
+        if (this.clientInitialized) this.output(JSON.stringify(notification));
+        else this.pendingNotifications.push(notification);
+      }
+    });
+    entry.child = child;
+    entry.server = await child.initialize(this.lastInitializeParams || {});
+    await child.listTools().catch(() => {});
+    this.log(`[${name}] VSP child self-healing restart complete`);
+    return entry;
+  }
+
   async initializeChildren(params) {
+    await this.starting;
+    this.lastInitializeParams = params;
     const healthy = [];
     for (const entry of this.children) {
       this.log(`[${entry.destination.name}] initializing VSP MCP session`);
@@ -342,6 +415,19 @@ export class MCPProxy {
           return response.error ? { ...response, id: message.id } : rpcResult(message.id, response.result);
         } catch (error) {
           this.log(`[${mapped.entry.destination.name}] tools/call ${toolName} failed after ${Date.now() - startedAt}ms: ${diagnosticText(error.rpcError?.message || error.message)}`);
+          // Self-healing: a dead child (crash, OOM, transient pipe break) is
+          // restarted and the call retried once before surfacing the error.
+          const childBroken = mapped.entry.child.exited || !mapped.entry.child.process.stdin.writable;
+          if (childBroken && !this.shuttingDown) {
+            try {
+              await this.restartChild(mapped.entry);
+              this.log(`[${mapped.entry.destination.name}] tools/call ${toolName} retried after self-healing restart`);
+              const retried = await mapped.entry.child.request('tools/call', upstreamParams);
+              return retried.error ? { ...retried, id: message.id } : rpcResult(message.id, retried.result);
+            } catch (restartError) {
+              this.log(`[${mapped.entry.destination.name}] tools/call ${toolName} self-healing restart failed: ${diagnosticText(restartError.message)}`);
+            }
+          }
           return error.rpcError ? rpcError(message.id, error.rpcError.code || -32001, error.rpcError.message || error.message, error.rpcError.data) : rpcError(message.id, -32001, `Destination ${mapped.entry.destination.name} failed: ${error.message}`);
         }
       }
@@ -393,10 +479,12 @@ export class MCPProxy {
   async close() {
     if (this.shuttingDown) return;
     this.shuttingDown = true;
-    await Promise.all(this.destinations.map(async destination => {
-      const entry = this.children.find(candidate => candidate.destination === destination);
-      await entry?.child.close();
-      await closeDestinationRoute(destination);
+    const closed = new Set();
+    await Promise.all(this.children.map(async entry => {
+      await entry.child.close();
+      await closeDestinationRoute(entry.destination);
+      closed.add(entry.destination);
     }));
+    await Promise.all(this.destinations.filter(destination => !closed.has(destination)).map(destination => closeDestinationRoute(destination)));
   }
 }

package/src/setup.mjs

@@ -1,9 +1,12 @@
 import { createInterface } from 'node:readline/promises';
 import { stdin, stdout } from 'node:process';
-import { checkboxPrompt, colorText, formatStatus } from './terminal-ui.mjs';
+import { checkboxPrompt, colorText, formatStatus, textPrompt } from './terminal-ui.mjs';
 import { discoverDestinations, remediation } from './bas-discovery.mjs';
 import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys } from './cf-destination.mjs';
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
+import { readCredentials, removeDestinationCredentials, resolveCredentialsPath, storeDestinationCredentials } from './credentials-store.mjs';
+import { canPromptForCredentials, credentialKeyForDestination, credentialModeForDestination } from './credential-overrides.mjs';
+import { createBasDestinationRelay } from './bas-destination-relay.mjs';
 
 const SETUP_COMMAND = 'sap-ai-dev --setup';
 
@@ -23,6 +26,90 @@ async function confirmCloudFoundryImport({ input = stdin, output = stdout } = {}
   }
 }
 
+async function probeBasOnPremCredentialRoute({ destination, user, password, env }) {
+  const relay = createBasDestinationRelay({
+    ...destination,
+    credentials: { user, password, mode: 'bas-tunnel' }
+  }, { env, log: () => {} });
+  try {
+    await relay.ready;
+    return await relay.probeCsrfSession();
+  } finally {
+    await relay.close();
+  }
+}
+
+async function promptForDestinationCredentials({ destinations, credentialsPath, existing = {}, input = stdin, output = stdout, env = process.env, verifyOnPremCredentialRoute = probeBasOnPremCredentialRoute } = {}) {
+  const eligible = destinations.filter(canPromptForCredentials);
+  const retained = new Set();
+  if (!eligible.length) return retained;
+
+  print(output, '');
+  print(output, formatStatus('Credential overrides are optional and apply only to selected BasicAuthentication destinations.', 'step', output, 'Credentials'));
+  print(output, `  Overrides are stored beside your MCP config in ${credentialsPath} with owner-only permissions (never inside mcp.json).`);
+  print(output, '  For OnPremise destinations, BAS/Cloud Foundry proxy credentials remain separate from the SAP backend credentials.');
+  print(output, '');
+
+  for (const destination of eligible) {
+    const key = credentialKeyForDestination(destination);
+    if (!key) continue;
+    const mode = credentialModeForDestination(destination);
+    const known = existing[key];
+    const routeLabel = `${destination.source === 'cloud-foundry' ? 'Cloud Foundry' : 'BAS'} ${destination.proxyType} — ${destination.name}`;
+    const answer = await textPrompt({
+      message: colorText(`🔐 ${routeLabel} — override SAP credentials? (y/n)`, 'cyan', output),
+      required: true,
+      validate: value => /^(?:y|yes|n|no)$/i.test(value.trim()) || 'Enter y or n.'
+    }, { input, output });
+    if (/^n/i.test(answer.trim())) {
+      await removeDestinationCredentials(credentialsPath, [key]);
+      print(output, formatStatus(`Credential override disabled for ${destination.name}.`, 'info', output, 'Credentials'));
+      continue;
+    }
+
+    if (known?.user && known?.password) {
+      print(output, formatStatus(`Credentials for ${destination.name} are already stored. Press Enter at both prompts to keep them.`, 'info', output, 'Credentials'));
+    }
+    const userAnswer = await textPrompt({
+      message: colorText(`👤 ${routeLabel} — SAP user`, 'cyan', output),
+      required: false,
+      placeholder: known ? 'Enter keeps the stored user' : 'SAP user name'
+    }, { input, output });
+    const user = userAnswer.trim() || known?.user || '';
+    const passwordAnswer = await textPrompt({
+      message: colorText(`🔒 ${routeLabel} — SAP password${known ? ' (Enter keeps stored password)' : ''}`, 'cyan', output),
+      secret: true,
+      required: false
+    }, { input, output });
+    const password = passwordAnswer || known?.password || '';
+    if (!user || !password) {
+      await removeDestinationCredentials(credentialsPath, [key]);
+      print(output, formatStatus(`No complete credentials for ${destination.name}; no override was stored.`, 'warning', output, 'Credentials'));
+      continue;
+    }
+
+    if (mode === 'bas-tunnel') {
+      let route;
+      try {
+        route = await verifyOnPremCredentialRoute({ destination, user, password, env });
+      } catch {
+        route = null;
+      }
+      if (!(route?.httpStatus >= 200 && route.httpStatus < 300) || !route.tokenReceived || !(route.cookieCount > 0)) {
+        await removeDestinationCredentials(credentialsPath, [key]);
+        print(output, formatStatus(`No override stored for ${destination.name}: the BAS/Cloud Connector route did not return both a CSRF token and session cookie.`, 'warning', output, 'Credentials'));
+        continue;
+      }
+    }
+
+    const host = mode === 'direct' ? (destination.backendUrl || known?.host || '') : '';
+    await storeDestinationCredentials(credentialsPath, key, { host, user, password, mode });
+    retained.add(key);
+    print(output, formatStatus(`Stored credential override for ${destination.name}.`, 'success', output, 'Credentials'));
+  }
+  return retained;
+}
+
 function safeProbe(probe) {
   const result = {};
   if (typeof probe?.status === 'string') result.status = probe.status;
@@ -39,6 +126,8 @@ function safeBasDestination(destination) {
     url: destination.url,
     client: destination.client,
     authentication: destination.authentication,
+    proxyType: destination.proxyType,
+    backendUrl: destination.backendUrl || null,
     probe: safeProbe(destination.probe)
   };
 }
@@ -84,6 +173,7 @@ function printConnectionInstructions(output, result) {
     print(output, `  • ${name} — ${detail}`);
   }
   print(output, formatStatus('Open the Command Palette → “MCP: List Servers”, select a generated server, and choose “Start Server”.', 'step', output, 'Next'));
+  print(output, formatStatus('In GitHub Copilot Chat, select an agent, open the Chat tools picker, and enable each selected destination server for this chat.', 'step', output, 'Copilot Chat'));
   print(output, formatStatus('Inspect or edit entries with “MCP: Open User Configuration”.', 'info', output, 'Config'));
 }
 
@@ -96,6 +186,7 @@ export async function runSetup({
   discoverCf = discoverCloudFoundryDestinations,
   confirmCfImport = confirmCloudFoundryImport,
   install = installMcpConfig,
+  verifyOnPremCredentialRoute = probeBasOnPremCredentialRoute,
   includeSapDevelopmentToolsPrompt = false
 } = {}) {
   if (!env.H2O_URL) {
@@ -117,6 +208,7 @@ export async function runSetup({
   }
   const destinations = basDestinations.map(safeBasDestination);
   const warnings = [];
+  const credentialWarnings = [];
   let createdKeys = [];
   let configPath;
   let managedKeys = [];
@@ -228,6 +320,26 @@ export async function runSetup({
       shortcuts: { all: 'a' }
     }, { input, output });
   }
+
+  // Ask for an explicit credential override choice for each selected supported destination.
+  const credentialsPath = await resolveCredentialsPath(env, configPath);
+  try {
+    const existingMap = (await readCredentials(credentialsPath).catch(() => ({ destinations: {} }))).destinations || {};
+    const retained = await promptForDestinationCredentials({
+      destinations: selected,
+      credentialsPath,
+      existing: existingMap,
+      input,
+      output,
+      env,
+      verifyOnPremCredentialRoute
+    });
+    const stale = Object.keys(existingMap).filter(name => !retained.has(name));
+    if (stale.length) await removeDestinationCredentials(credentialsPath, stale);
+  } catch (error) {
+    if (/Prompt interrupted/.test(error.message)) throw error;
+    credentialWarnings.push(`Credential overrides could not be stored: ${error.message}`);
+  }
   try {
     const result = await install(selected, { env, sapDevelopmentServers });
     const location = result?.path ? ` in ${result.path}` : '';
@@ -248,8 +360,9 @@ export async function runSetup({
       }
     }
     await reportWarnings(warnings);
+    await reportWarnings(credentialWarnings);
     await reportWarnings(cleanupWarnings);
-    return { selected, ...(result || {}), warnings: [...warnings, ...cleanupWarnings] };
+    return { selected, ...(result || {}), warnings: [...warnings, ...credentialWarnings, ...cleanupWarnings] };
   } catch (error) {
     const cleanupWarnings = [];
     if (createdKeys.length) {

package/src/terminal-ui.mjs

@@ -210,3 +210,87 @@ export async function checkboxPrompt({ message, choices, required = false, short
     }
   });
 }
+
+// Single-line text/secret prompt matching the checkbox prompt's interaction
+// style. Secrets are masked with ●, support backspace, and can be re-prompted
+// through `validate`. Ctrl+C rejects with 'Prompt interrupted'.
+export async function textPrompt({ message, secret = false, required = true, placeholder = '', validate } = {}, { input = process.stdin, output = process.stdout } = {}) {
+  let value = '';
+  let renderedLines = 0;
+  let done = false;
+  let previousRawMode;
+
+  const write = text => output.write(text);
+  const masked = () => '●'.repeat(value.length);
+  const clearRendered = () => {
+    if (!renderedLines) return;
+    write(`\u001b[${renderedLines}A\u001b[J`);
+    renderedLines = 0;
+  };
+  const render = (error = '') => {
+    const columns = Number.isFinite(output?.columns) ? output.columns : 80;
+    const lines = [];
+    const hint = secret ? ' (input is hidden)' : '';
+    lines.push(truncateToColumns(`${message}${hint}`, columns));
+    const shown = secret ? masked() : value;
+    const display = shown || colorText(placeholder, 'cyan', output);
+    lines.push(truncateToColumns(`❯ ${display}`, columns));
+    if (error) lines.push(colorText(`  ${error}`, 'red', output));
+    clearRendered();
+    write(`${lines.join('\n')}\n`);
+    renderedLines = lines.length;
+  };
+
+  return new Promise((resolve, reject) => {
+    const cleanup = () => {
+      input.off('keypress', onKeypress);
+      if (typeof input.setRawMode === 'function' && previousRawMode !== undefined) input.setRawMode(previousRawMode);
+      if (typeof input.pause === 'function') input.pause();
+      write('\u001b[?25h');
+    };
+    const finish = result => {
+      if (done) return;
+      done = true;
+      clearRendered();
+      const summary = secret ? '✓ saved' : (result || '(empty)');
+      write(`${stripAnsi(message)} ${summary}\n`);
+      cleanup();
+      resolve(result);
+    };
+    const fail = error => {
+      if (done) return;
+      done = true;
+      cleanup();
+      reject(error);
+    };
+    const onKeypress = (chunk, key = {}) => {
+      if (key.ctrl && key.name === 'c') return fail(new Error('Prompt interrupted'));
+      if (key.name === 'return' || key.name === 'enter') {
+        const validation = typeof validate === 'function' ? validate(value) : true;
+        if (validation !== true) return render(String(validation));
+        if (required && !value.length) return render('Enter a value (or press Ctrl+C to skip).');
+        return finish(value);
+      }
+      if (key.name === 'backspace' || key.name === 'delete') {
+        value = value.slice(0, -1);
+      } else if (key.sequence && !key.ctrl && !key.meta && /^.$/u.test(key.sequence)) {
+        value += key.sequence;
+      } else {
+        return;
+      }
+      render();
+    };
+
+    try {
+      readline.emitKeypressEvents(input);
+      previousRawMode = input.isRaw;
+      if (typeof input.setRawMode === 'function') input.setRawMode(true);
+      if (typeof input.resume === 'function') input.resume();
+      write('\u001b[?25l');
+      input.on('keypress', onKeypress);
+      render();
+    } catch (error) {
+      fail(error);
+    }
+  });
+}