sap-ai-dev-toolkit 0.3.3 → 0.3.4

package/.github/agents/abap-developer.agent.md

@@ -7,9 +7,11 @@ user-invocable: true
 
 You are an ABAP development agent for SAP Business Application Studio (BAS). Follow this workflow in order. Use only capabilities actually exposed by the current workspace and SAP MCP server.
 
+**Direct MCP invocation is mandatory.** The Copilot host initializes MCP and supplies its live `tools/list` and schemas in the Chat tools picker. Invoke the attached destination-prefixed tools directly. Do not launch `sap-ai-dev` or another server binary, drive stdio/JSON-RPC from a terminal, or handcraft a JSON-RPC handshake for MCP operations. If a needed server or tool is visible in the picker but is not callable by this agent, stop and report the host/session binding issue; do not substitute CLI access.
+
 1. **Clarify the contract.** For every request, state the understood outcome, observable acceptance criteria, assumptions, and required SAP target details. For SAP-targeted changes, identify the destination/system, package, and transport or temporary target. Ask a focused question only when a material requirement or target detail is missing or ambiguous; when the contract is clear, proceed without a confirmation round.
 2. **Plan before implementing.** Before writing any code, present a concise plan: the objects to create or change, the ABAP Unit test approach, the local authoring and validation plan (workspace files plus `LintABAP` and LSP), and the SAP write and activation steps with the authorizations they require. Proceed without a confirmation round while the work stays read-only or workspace-local; wait for explicit user approval before implementing a plan that writes to, activates in, or publishes to the SAP system.
-3. **Inspect and select tools once per MCP server.** Read the relevant workspace source, tests, callers, dependencies, and conventions. Query the active MCP server's live `tools/list` once; build a shortlist for each target destination and reuse it while the server configuration is unchanged. Use the exact destination-prefixed names and input schemas returned. Refresh only when the destination or configuration changes, or a call reports the tool unavailable. Prefer:
+3. **Inspect and select tools once per MCP server.** Read the relevant workspace source, tests, callers, dependencies, and conventions. Use the active chat's live `tools/list` from the Chat tools picker once; build a shortlist for each target destination and reuse it while the server configuration is unchanged. Use the exact destination-prefixed names and input schemas shown there. Refresh only when the destination or configuration changes, or a call reports the tool unavailable. Prefer:
    - **Inspect/search:** `GetSource`, `SearchObject`, `GrepObjects`, `GrepPackages`, `GetContext`, `FindDefinition`, `FindReferences`.
    - **Implement/verify:** `EditSource` for localized edits, `WriteSource` for larger rewrites, and `PrepareABAPChangeSet` / `ApplyABAPChangeSet` for reviewed multi-object source changes, used to send locally authored, locally linted sources to SAP; then `SyntaxCheck`, `RunUnitTests`, and `RunATCCheck` when relevant. Show and review the staged diffs before applying. Use `Activate` or `ActivateMultiple` only when activation was requested.
    - **CDS/RAP:** `GetSystemInfo` and `GetFeatures` for target capabilities; `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, and `GetObjectStructure` for model/impact inspection; `RunQuery` or `GetTableContents` for read-only CDS/table runtime validation. Use `PublishServiceBinding` only when publication was requested.

package/.github/agents/abap-runtime-debugger.agent.md

@@ -7,8 +7,10 @@ user-invocable: true
 
 You are a specialized ABAP runtime debugging and performance diagnosis agent for SAP Business Application Studio (BAS). Follow this workflow in order and use only capabilities actually exposed by the current workspace and active SAP MCP server.
 
+**Direct MCP invocation is mandatory.** The Copilot host initializes MCP and supplies its live `tools/list` and schemas in the Chat tools picker. Invoke the attached destination-prefixed tools directly. Do not launch `sap-ai-dev` or another server binary, drive stdio/JSON-RPC from a terminal, or handcraft a JSON-RPC handshake for MCP operations. If a needed server or tool is visible in the picker but is not callable by this agent, stop and report the host/session binding issue; do not substitute CLI access.
+
 1. **Clarify the incident contract.** State the observed failure/symptom, expected behavior, impacted object/service/user flow, reproducibility, time window, destination/system, client/user context if relevant, and safety constraints. Ask only for missing material details such as target system, reproduction input, or authorization to run/debug a reproduction.
-2. **Inspect live MCP tools once per server.** Query the active MCP server's live `tools/list` once and use the exact destination-prefixed names and schemas returned. Re-query only if destination/configuration changes or a tool is reported unavailable. Prefer this runtime tool map when present:
+2. **Inspect live MCP tools once per server.** Use the active chat's live `tools/list` from the Chat tools picker once and use the exact destination-prefixed names and schemas shown there. Re-query only if destination/configuration changes or a call reports the tool unavailable. Prefer this runtime tool map when present:
    - **System/context:** `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`, `GetContext`.
    - **Dumps/logs/traces:** `ListDumps`, `GetDump`, `GetApplicationLog`, `GetTrace`, `GetSQLTraceState`.
    - **Debugger/breakpoints:** `DebuggerListen`, `DebuggerAttach`, `DebuggerGetStack`, `DebuggerGetVariables`, `DebuggerStep`, `DebuggerDetach`, `SetBreakpoint`, `DeleteBreakpoint`, `GetBreakpoints`.

package/.github/agents/rap-service-developer.agent.md

@@ -7,9 +7,11 @@ user-invocable: true
 
 You are a specialized SAP RAP service development agent for SAP Business Application Studio (BAS). Follow this workflow in order and use only capabilities actually exposed by the current workspace and active SAP MCP server.
 
+**Direct MCP invocation is mandatory.** The Copilot host initializes MCP and supplies its live `tools/list` and schemas in the Chat tools picker. Invoke the attached destination-prefixed tools directly. Do not launch `sap-ai-dev` or another server binary, drive stdio/JSON-RPC from a terminal, or handcraft a JSON-RPC handshake for MCP operations. If a needed server or tool is visible in the picker but is not callable by this agent, stop and report the host/session binding issue; do not substitute CLI access.
+
 1. **Clarify the RAP contract.** State the requested business outcome, RAP artifacts in scope, acceptance criteria, assumptions, and target details. For SAP-targeted changes, identify the destination/system, package, transport or temporary target, service binding/publication expectations, and whether data mutation for validation is authorized. Ask only when a material target or authorization detail is missing.
 2. **Plan before implementing.** Before writing any artifact, present a concise plan: the RAP object chain to create or change in dependency order, the ABAP Unit test approach, the local authoring and validation plan (workspace files plus `LintABAP` and LSP), and the SAP write, activation, and publication steps with the authorizations they require. Proceed without a confirmation round while the work stays read-only or workspace-local; wait for explicit user approval before implementing a plan that writes to, activates in, or publishes to the SAP system.
-3. **Inspect live MCP tools once per server.** Query the active MCP server's live `tools/list` once and use the exact destination-prefixed names and schemas returned. Re-query only if destination/configuration changes or a tool is reported unavailable. Prefer this RAP tool map when present:
+3. **Inspect live MCP tools once per server.** Use the active chat's live `tools/list` from the Chat tools picker once and use the exact destination-prefixed names and schemas shown there. Re-query only if destination/configuration changes or a call reports the tool unavailable. Prefer this RAP tool map when present:
    - **Capability/system inspection:** `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`.
    - **Search/source inspection:** `SearchObject`, `GrepObjects`, `GrepPackages`, `GrepObject`, `GrepPackage`, `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`.
    - **RAP/CDS model inspection:** `GetObjectStructure`, `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, `GetClass`, `GetClassComponents`, `GetClassInclude`, `GetInterface`, `GetTypeInfo`, `GetTypeHierarchy`.

package/.github/agents/sap-solution-architect.agent.md

@@ -9,8 +9,10 @@ You are an SAP solution architecture and SDLC orchestration agent for SAP Busine
 
 Follow this workflow in order and use only capabilities actually exposed by the current workspace and active SAP MCP server.
 
+**Direct MCP invocation is mandatory.** The Copilot host initializes MCP and supplies its live `tools/list` and schemas in the Chat tools picker. Invoke the attached destination-prefixed tools directly. Do not launch `sap-ai-dev` or another server binary, drive stdio/JSON-RPC from a terminal, or handcraft a JSON-RPC handshake for MCP operations. If a needed server or tool is visible in the picker but is not callable by this agent, stop and report the host/session binding issue; do not substitute CLI access.
+
 1. **Clarify the requirement and target landscape.** State the business outcome, affected SAP product/system, process area, acceptance criteria, integration boundaries, data ownership, non-functional requirements, security/compliance needs, operational expectations, and assumptions. Identify destination/system, package namespace, cloud/on-premise constraints, transport expectations, and whether implementation is requested now or only a plan is needed. Ask only for missing material details.
-2. **Inspect live MCP tools once per server and investigate the system.** Query the active MCP server's live `tools/list` once and use the exact destination-prefixed names and schemas returned. Re-query only when destination/configuration changes or a tool is reported unavailable. Build a system fact base before recommending anything: installed capabilities, object conventions, existing APIs, released status, dependencies, data model, runtime symptoms, and transport context. Prefer this analysis tool map when present:
+2. **Inspect live MCP tools once per server and investigate the system.** Use the active chat's live `tools/list` from the Chat tools picker once and use the exact destination-prefixed names and schemas shown there. Re-query only when destination/configuration changes or a call reports the tool unavailable. Build a system fact base before recommending anything: installed capabilities, object conventions, existing APIs, released status, dependencies, data model, runtime symptoms, and transport context. Prefer this analysis tool map when present:
    - **System and capability context:** `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`.
    - **Repository and implementation discovery:** `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`, `GetObjectStructure`, `GetClass`, `GetInterface`, `GetTypeInfo`, `GetTypeHierarchy`.
    - **CDS/RAP/API analysis:** `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, `RunQuery`, `GetTableContents`, and `GetAPIReleaseState` for relevant dependencies and candidate APIs.

package/README.md

@@ -66,6 +66,8 @@ Then connect a destination in SAP Business Application Studio:
 5. In the Chat tools picker, enable the server for that BAS destination.
 6. Ask Copilot to inspect, build, test, or verify something in your SAP landscape.
 
+Use the attached destination-prefixed tools directly in chat. Do not launch `sap-ai-dev` or handcraft MCP JSON-RPC in a terminal to discover or call them.
+
 **Prerequisite:** Node.js 20 or newer. If Go is not already available, the installer can provision the pinned supported Go release automatically.
 
 ## 🤖 Available agents and skills
@@ -374,7 +376,7 @@ The sample values sketch an on-premise ABAP backend routed through SAP Cloud Con
 | `WebIDEUsage` | `dev_abap,odata_abap` | Include `dev_abap` for ABAP development; add other usages required by your BAS scenario. |
 | `CloudConnectorLocationId` | `DEMO-LOCATION` | Optional; set only when the Cloud Connector uses a location ID. |
 
-For on-premise systems, configure Cloud Connector access to the backend host and port first. Keep credentials and authentication material in the BAS destination configuration; never put them in `mcp.json`.
+For on-premise systems, configure Cloud Connector access to the backend host and port first. BAS Destination and Connectivity service credentials remain in their respective services; optional SAP backend overrides are stored in the owner-only credentials file beside `mcp.json`, never in `mcp.json`. The BAS OnPremise override is saved only when its tunnel route returns a CSRF token and session cookie.
 
 Think of `H2O_URL` as BAS's front door: it must point to the endpoint serving `/api/listDestinations`, not to the SAP backend.
 
@@ -660,11 +662,13 @@ The MCP client discovers the schemas; callers do not need to memorize every argu
 | Destination availability only | `sap-ai-dev --check` |
 | Generated server names and destination mapping | **MCP: Open User Configuration**; look for entries named after the BAS destination and `BAS_VSP_DESTINATION`. |
 | Running server | **MCP: List Servers**; select the server and choose **Start Server**. |
-| Tools and exact schemas | Expand that server in the Chat tools picker. At the protocol level, MCP clients request `tools/list`, whose entries include `name`, `description`, and `inputSchema`. |
+| Tools and exact schemas | Expand that server in the Chat tools picker. The MCP host requests `tools/list`, whose entries include `name`, `description`, and `inputSchema`; the agent should call those tools through chat, not reproduce the protocol in a terminal. |
 | Runtime and tool-call logs | Select the MCP server in the Output view. Startup, call lifecycle, and child stderr logs are written to stderr; child MCP log notifications are forwarded to the client. Tool arguments and result contents are not logged. |
 | Installed package version | `npm list --global sap-ai-dev-toolkit` |
 
-After MCP initialization, a raw inspection request has this shape (normally sent by the client, not typed into the terminal):
+If the server is running but an agent reports that SAP tools are unavailable, verify that the same chat is in Agent mode, the generated server is enabled in that chat's tools picker, and concrete names such as `s4h__GetSystemInfo` are listed. Reselect the agent or start a new chat if the tool binding is stale, then inspect the MCP server's Output log for startup or `tools/list` errors. Do not try to work around a missing chat binding by starting the server or handcrafting JSON-RPC from the terminal.
+
+After MCP initialization, the host internally sends a request like this; agents should not reproduce it in the terminal:
 
 ```json
 {"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}
@@ -699,7 +703,7 @@ The response contains a `tools` array. A `RunQuery` entry resembles this excerpt
 | `SAP_AI_DEV_TOOLKIT_MODE` | VSP child mode (`expert` by default; `focused` omits `ActivateMultiple`, `GetUserTransports`, and `GetTransportInfo`). The proxy exposes its curated tools plus tools listed in `tools.md` when registered by that mode, including local `LintABAP`. |
 | `SAP_ALLOW_TRANSPORTABLE_EDITS` | Generated MCP entries set this to `true` to permit source edits in transportable packages; VSP safety checks and SAP authorizations still apply. |
 | `SAP_AI_DEV_TOOLKIT_DISABLE_BAS_RELAY=true` | Disable the built-in BAS destination relay. By default the add-on self-heals `.dest` destinations through a local relay that keeps all access destination-based while handling ADT CSRF fetch/retry behavior before VSP calls SAP. |
-| `SAP_AI_DEV_TOOLKIT_HTTP_PROXY` | Egress proxy for relay and discovery traffic (falls back to `HTTP_PROXY`/`http_proxy`; unset means the default BAS proxy for `.dest` hosts, empty means direct). |
+| `SAP_AI_DEV_TOOLKIT_HTTP_PROXY` | Egress proxy for relay and discovery traffic (falls back to `HTTP_PROXY`/`http_proxy`; unset means the default BAS proxy for `.dest` hosts, empty means direct except for OnPremise credential overrides, which require a BAS proxy tunnel). |
 | `SAP_AI_DEV_TOOLKIT_MAX_CSRF_RETRIES` | Bounded CSRF/session self-healing retries per unsafe request (default 3). |
 
 #### Self-healing modes
@@ -710,7 +714,8 @@ The relay between the VSP child and each BAS destination recovers from the failu
 2. **Session refresh** — when SAP rejects or rotates a session (401/403 after a token was already accepted), the cached session is dropped, a fresh token+cookie pair is fetched, and the request retried, bounded by the retry limit.
 3. **Proxy tunnel fallback** — when the BAS proxy refuses absolute-form requests (502/504 or transport errors), the relay switches to a CONNECT tunnel through the same proxy and keeps going.
 4. **Child crash recovery** — a crashed VSP child is restarted transparently, re-initialized, tools re-registered, and the interrupted `tools/call` retried once before any error reaches the client.
-5. **Direct connect for Internet destinations** — the BAS `.dest` proxy strips SAP `Set-Cookie` headers, which makes CSRF token/session binding impossible for ADT writes (`403 CSRF token validation failed`). When you select an Internet destination with basic authentication, setup prompts for a SAP user and password and stores them in `sap-ai-dev-toolkit-credentials.json` **next to** `mcp.json` (never inside it, permissions `0600`). The relay then connects straight to the backend host with Basic auth — cookies survive, CSRF pairing works, and writes behave like they do from Eclipse/ADT. Rerun `sap-ai-dev --setup` to change or clear stored credentials; re-selecting nothing removes stale entries.
+5. **Direct connect for Internet destinations** — the BAS `.dest` proxy strips SAP `Set-Cookie` headers, which makes CSRF token/session binding impossible for ADT writes (`403 CSRF token validation failed`). When you select an Internet destination with BasicAuthentication, setup asks whether to override its credentials. A Yes prompts for SAP user/password and stores them in `sap-ai-dev-toolkit-credentials.json` **next to** `mcp.json` (never inside it, permissions `0600`). The relay connects straight to the backend host so cookies survive and ADT writes can use the paired CSRF session.
+6. **Cloud Connector credential overrides** — setup also offers per-destination overrides for BasicAuthentication OnPremise destinations. BAS OnPremise credentials travel through an HTTP CONNECT tunnel to the BAS `.dest` endpoint, retaining its Cloud Connector mapping; setup saves the override only after a read-only probe returns both a CSRF token and a session cookie. If that route check fails, the override is not saved. Cloud Foundry OnPremise overrides replace only the SAP backend user/password; Connectivity service-key authentication and its proxy route remain unchanged. PrincipalPropagation is never overridden. Rerun `sap-ai-dev --setup` to change credentials or answer No to disable a stored override. Deselecting a destination (or selecting none) removes stale overrides.
 | `SAP_AI_DEV_MCP_CONFIG` | Explicit MCP user configuration path. |
 | `BAS_VSP_MCP_CONFIG` | Backward-compatible alias for the MCP user configuration path. |
 | `BAS_VSP_BINARY` | Trusted prebuilt VSP executable; skips Go and binary provisioning. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/src/bas-destination-relay.mjs

@@ -97,16 +97,15 @@ async function readRequestBody(req) {
 export function createBasDestinationRelay(destination, { env = process.env, fetchImpl = undiciFetch, log = () => {} } = {}) {
   if (!destination?.url) throw new Error('Destination relay requires a BAS destination URL');
   const base = new URL(destination.url);
-  // Self-healing mode 5 (direct connect): the BAS .dest proxy strips
-  // Set-Cookie, which makes SAP CSRF session binding impossible. When the
-  // operator stored credentials for this destination (setup prompts for
-  // Internet destinations), the relay connects straight to the backend host
-  // with Basic auth — cookies survive, CSRF pairing works, and writes go
-  // through exactly like they do from Eclipse/ADT.
   const credentials = destination.credentials;
-  const directBase = credentials?.host ? new URL(String(credentials.host)) : null;
-  const effectiveBase = directBase || base;
+  const tunnelMode = credentials?.mode === 'bas-tunnel';
+  const directHost = tunnelMode ? '' : credentials?.host;
+  // Internet overrides retain the direct-backend path. OnPremise overrides
+  // must keep the BAS .dest route (and its Cloud Connector mapping), so they
+  // use HTTP CONNECT through the BAS proxy instead of credentials.host.
+  const directBase = directHost ? new URL(String(directHost)) : null;
   if (directBase) log(`[${destination.name}] BAS relay direct connect active (${directBase.origin}); BAS proxy cookie stripping bypassed`);
+  if (tunnelMode) log(`[${destination.name}] BAS relay using a BAS proxy tunnel for the OnPremise destination`);
   // Proxy resolution: an explicitly configured proxy wins (an explicit empty
   // value means "go direct"). Without configuration, BAS virtual .dest hosts
   // imply the default BAS proxy; any other host (tests, direct URLs) is
@@ -114,22 +113,23 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
   // foreign proxy.
   const explicitProxy = env.HTTP_PROXY ?? env.http_proxy;
   const proxyUrl = directBase ? '' : (explicitProxy !== undefined ? String(explicitProxy) : (/\.dest$/i.test(base.hostname) ? DEFAULT_PROXY : ''));
+  if (tunnelMode && !proxyUrl) throw new Error('OnPremise credential overrides require the BAS destination proxy to preserve the Cloud Connector route');
   const dispatcher = proxyUrl ? new ProxyAgent({ uri: proxyUrl, proxyTunnel: false }) : undefined;
   // Self-healing mode 2: if the BAS proxy refuses absolute-form proxied
   // requests (its own 502/504), retry through a CONNECT tunnel so the relay
   // keeps working through the same egress.
   const tunnelDispatcher = proxyUrl ? new ProxyAgent({ uri: proxyUrl, proxyTunnel: true }) : undefined;
-  let tunneled = false;
+  let tunneled = tunnelMode;
   // Observable self-healing counters, surfaced by --doctor and tests.
-  const stats = { requests: 0, csrfFetches: 0, csrfRetries: 0, tunnelFallbacks: 0, direct: Boolean(directBase) };
+  const stats = { requests: 0, csrfFetches: 0, csrfRetries: 0, tunnelFallbacks: 0, direct: Boolean(directBase), proxyTunnel: tunnelMode };
   // Per-path CSRF sessions: { token, jar, fetchedAt } where jar holds the
   // Set-Cookie state SAP returned together with the token.
   const tokenCache = new Map();
 
-  function rememberSession(key, token, headers) {
+  function rememberSession(key, token, headers, httpStatus) {
     const jar = new Map();
     recordCookies(jar, headers);
-    tokenCache.set(key, { token, jar, fetchedAt: Date.now() });
+    tokenCache.set(key, { token, jar, fetchedAt: Date.now(), httpStatus });
   }
 
   async function send(target, method, headers, body) {
@@ -171,12 +171,22 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
     await response.arrayBuffer().catch(() => undefined);
     const token = response.headers.get('x-csrf-token');
     if (token && token.toLowerCase() !== 'required') {
-      rememberSession(key, token, response.headers);
+      rememberSession(key, token, response.headers, response.status);
       return tokenCache.get(key);
     }
     return null;
   }
 
+  async function probeCsrfSession(path = '/sap/bc/adt/discovery') {
+    const requestUrl = new URL(path, base);
+    const session = await fetchToken(requestUrl, { accept: 'application/xml,text/xml,*/*' });
+    return {
+      httpStatus: session?.httpStatus || 0,
+      tokenReceived: Boolean(session?.token),
+      cookieCount: session?.jar?.size || 0
+    };
+  }
+
   // Rewrite an incoming .dest target onto the direct backend host when
   // credentials are configured, keeping path and query intact.
   function resolveTarget(target) {
@@ -261,6 +271,7 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
   return {
     ready,
     stats,
+    probeCsrfSession,
     close: async () => {
       await dispatcher?.close?.();
       await tunnelDispatcher?.close?.();

package/src/credential-overrides.mjs

@@ -0,0 +1,75 @@
+import { readCredentials, resolveCredentialsPath } from './credentials-store.mjs';
+
+const CLOUD_FOUNDRY_KEY_PREFIX = 'cloud-foundry:';
+
+function isBasicAuthentication(value) {
+  return /^basic(?:authentication)?$/i.test(String(value || '').replace(/\s+/g, ''));
+}
+
+export function credentialKeyForDestination(destination = {}) {
+  if (destination.source === 'cloud-foundry') {
+    const serverName = String(destination.serverName || '').trim();
+    return serverName ? `${CLOUD_FOUNDRY_KEY_PREFIX}${serverName}` : '';
+  }
+  return String(destination.name || '').trim();
+}
+
+export function credentialModeForDestination(destination = {}) {
+  if (!isBasicAuthentication(destination.authentication)) return null;
+  const proxyType = String(destination.proxyType || '').trim().toLowerCase();
+  if (destination.source === 'cloud-foundry') {
+    return proxyType === 'onpremise' ? 'cf-connectivity' : null;
+  }
+  if (proxyType === 'internet') return 'direct';
+  if (proxyType === 'onpremise') return 'bas-tunnel';
+  return null;
+}
+
+export function canPromptForCredentials(destination = {}) {
+  const mode = credentialModeForDestination(destination);
+  return Boolean(mode && (mode !== 'direct' || destination.backendUrl));
+}
+
+export async function enrichWithStoredCredentials(destinations, env = process.env, log = message => console.error(message)) {
+  const needingCredentials = destinations.filter(destination => {
+    const mode = credentialModeForDestination(destination);
+    if (!mode || !canPromptForCredentials(destination)) return false;
+    if (mode === 'cf-connectivity') return Boolean(destination.serverName);
+    return Boolean(destination.url && String(destination.url).includes('.dest'));
+  });
+  if (!needingCredentials.length) return destinations;
+  let stored;
+  try {
+    const path = await resolveCredentialsPath(env);
+    stored = await readCredentials(path);
+  } catch (error) {
+    log(`[sap-ai-dev] stored credentials could not be read: ${String(error.message).slice(0, 200)}`);
+    return destinations;
+  }
+  return destinations.map(destination => {
+    const mode = credentialModeForDestination(destination);
+    const key = credentialKeyForDestination(destination);
+    const entry = key ? stored.destinations?.[key] : undefined;
+    if (!mode || !entry?.user || !entry?.password) return destination;
+    if (mode === 'cf-connectivity') {
+      if (entry.mode !== mode || destination.source !== 'cloud-foundry') return destination;
+      return {
+        ...destination,
+        childEnv: {
+          ...(destination.childEnv || {}),
+          SAP_USER: entry.user,
+          SAP_PASSWORD: entry.password,
+          SAP_VERBOSE: 'false'
+        }
+      };
+    }
+    if (mode === 'bas-tunnel') {
+      if (entry.mode !== mode) return destination;
+      return { ...destination, credentials: { user: entry.user, password: entry.password, mode } };
+    }
+    if (!destination.backendUrl || !destination.url || !String(destination.url).includes('.dest')) return destination;
+    if (entry.mode && entry.mode !== 'direct') return destination;
+    const host = entry.host || destination.backendUrl;
+    return { ...destination, credentials: { host, user: entry.user, password: entry.password, mode: 'direct' } };
+  });
+}

package/src/credentials-store.mjs

@@ -4,10 +4,11 @@ import { homedir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import { brandedEnvValue } from './branding.mjs';
 
-// Credentials for direct-connect destinations live next to the MCP config
-// (never inside it), with 0600 permissions and no tokens or cookies. The
-// file maps destination names to { host, user, password, updatedAt }.
+// Optional SAP backend credential overrides live next to the MCP config
+// (never inside it), with 0600 permissions and no tokens or cookies. Entries
+// are keyed by a stable destination identity and may include a route mode.
 const CREDENTIALS_FILENAME = 'sap-ai-dev-toolkit-credentials.json';
+const CREDENTIAL_MODES = new Set(['direct', 'bas-tunnel', 'cf-connectivity']);
 
 const SECRET_PATTERN = /(authorization|cookie|password|secret|token|bearer|credential)/i;
 
@@ -44,6 +45,7 @@ function sanitizeEntry(entry) {
   if (typeof entry?.host === 'string' && entry.host) result.host = entry.host;
   if (typeof entry?.user === 'string' && entry.user) result.user = entry.user;
   if (typeof entry?.password === 'string' && entry.password) result.password = entry.password;
+  if (CREDENTIAL_MODES.has(entry?.mode)) result.mode = entry.mode;
   if (typeof entry?.updatedAt === 'string') result.updatedAt = entry.updatedAt;
   return result;
 }
@@ -87,10 +89,17 @@ async function writeCredentials(path, destinations) {
   }
 }
 
-export async function storeDestinationCredentials(path, name, { host, user, password }) {
+export async function storeDestinationCredentials(path, name, { host, user, password, mode }) {
+  if (mode != null && !CREDENTIAL_MODES.has(mode)) throw new Error('Credential override route mode is unsupported');
   const current = await readCredentials(path).catch(error => { throw error; });
   const destinations = { ...current.destinations };
-  destinations[String(name)] = { host: String(host || ''), user: String(user || ''), password: String(password || ''), updatedAt: new Date().toISOString() };
+  destinations[String(name)] = {
+    host: String(host || ''),
+    user: String(user || ''),
+    password: String(password || ''),
+    ...(mode ? { mode } : {}),
+    updatedAt: new Date().toISOString()
+  };
   await writeCredentials(path, destinations);
   return { path, name };
 }

package/src/launcher.mjs

@@ -10,36 +10,11 @@ import { installMcpConfig } from './mcp-config.mjs';
 import { runSetup } from './setup.mjs';
 import { resolveConfiguredCloudFoundryDestination } from './cf-destination.mjs';
 import { withBrandedEnvironment } from './branding.mjs';
-import { readCredentials, resolveCredentialsPath } from './credentials-store.mjs';
+import { enrichWithStoredCredentials } from './credential-overrides.mjs';
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
 const runtimeEnv = withBrandedEnvironment(process.env);
 
-// Attach stored direct-connect credentials (setup prompts for Internet
-// destinations) to matching discovered destinations. Credentials stay in
-// memory only; nothing is logged or written to the MCP config.
-async function enrichWithStoredCredentials(destinations, env = runtimeEnv) {
-  const needingCredentials = destinations.filter(destination =>
-    destination.source !== 'cloud-foundry'
-    && destination.url
-    && String(destination.url).includes('.dest'));
-  if (!needingCredentials.length) return destinations;
-  let stored;
-  try {
-    const path = await resolveCredentialsPath(env);
-    stored = await readCredentials(path);
-  } catch (error) {
-    console.error(`[sap-ai-dev] stored credentials could not be read: ${String(error.message).slice(0, 200)}`);
-    return destinations;
-  }
-  return destinations.map(destination => {
-    const entry = stored.destinations?.[destination.name];
-    if (!entry?.host || !entry.user || !entry.password) return destination;
-    if (!destination.backendUrl) return destination;
-    return { ...destination, credentials: { host: entry.host, user: entry.user, password: entry.password } };
-  });
-}
-
 function hasFlag(name) { return process.argv.slice(2).includes(name); }
 function json(value) { process.stdout.write(`${JSON.stringify(value)}\n`); }
 
@@ -111,7 +86,9 @@ async function runDoctor(destinations) {
       } else {
         checks.push(doctorRow(destination.name, 'BAS destination relay', 'skipped', 'Not applicable for this destination.'));
       }
-      if (relayedDestination?.credentials) {
+      if (relayedDestination?.credentials?.mode === 'bas-tunnel') {
+        checks.push(doctorRow(destination.name, 'OnPremise credential override', 'passed', 'Basic auth is routed through a BAS proxy tunnel; Cloud Connector routing is retained'));
+      } else if (relayedDestination?.credentials?.host) {
         checks.push(doctorRow(destination.name, 'Direct connect', 'passed', `active (${new URL(relayedDestination.credentials.host).origin}); ADT writes use stored credentials`));
       }
       const listed = await proxy.handle({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} });
@@ -203,8 +180,8 @@ async function main() {
     let report;
     try {
       const destinations = runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry'
-        ? [await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })]
-        : await enrichWithStoredCredentials(await discoverForCommand());
+        ? await enrichWithStoredCredentials([await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })], runtimeEnv)
+        : await enrichWithStoredCredentials(await discoverForCommand(), runtimeEnv);
       report = await runDoctor(destinations);
     } catch (error) {
       report = { ok: false, destinations: 0, checks: [doctorRow('-', 'destination discovery', 'failed', redactText(error.message || error).slice(0, 300))] };
@@ -240,7 +217,7 @@ async function main() {
   }
 
   if (runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry') {
-    const destination = await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv });
+    const destination = (await enrichWithStoredCredentials([await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })], runtimeEnv))[0];
     let proxy;
     try {
       const binary = await binaryOrError();
@@ -270,14 +247,15 @@ async function main() {
 
   const discovered = await discoverDestinations({ env: runtimeEnv });
   for (const destination of discovered) console.error(probeDiagnostic(destination));
-  const destinations = await enrichWithStoredCredentials(discovered);
+  const destinations = await enrichWithStoredCredentials(discovered, runtimeEnv);
   if (!destinations.length) {
     console.error('[sap-ai-dev] destination discovery returned no named BAS destinations');
     throw new Error(remediation);
   }
   const binary = await binaryOrError();
   for (const destination of destinations) {
-    if (destination.credentials) console.error(`[sap-ai-dev] ${destination.name}: direct connect enabled through stored credentials`);
+    if (destination.credentials?.mode === 'bas-tunnel') console.error(`[sap-ai-dev] ${destination.name}: Basic credentials enabled through the BAS proxy tunnel`);
+    else if (destination.credentials?.host) console.error(`[sap-ai-dev] ${destination.name}: direct connect enabled through stored credentials`);
   }
   console.error(`[sap-ai-dev] starting MCP proxy for ${destinations.map(destination => `${destination.name} (client=${destination.client})`).join(', ')}`);
   const proxy = new MCPProxy({ binary, destinations, env: process.env, log: message => console.error(message) });

package/src/setup.mjs

@@ -5,6 +5,8 @@ import { discoverDestinations, remediation } from './bas-discovery.mjs';
 import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys } from './cf-destination.mjs';
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
 import { readCredentials, removeDestinationCredentials, resolveCredentialsPath, storeDestinationCredentials } from './credentials-store.mjs';
+import { canPromptForCredentials, credentialKeyForDestination, credentialModeForDestination } from './credential-overrides.mjs';
+import { createBasDestinationRelay } from './bas-destination-relay.mjs';
 
 const SETUP_COMMAND = 'sap-ai-dev --setup';
 
@@ -24,54 +26,88 @@ async function confirmCloudFoundryImport({ input = stdin, output = stdout } = {}
   }
 }
 
-// Internet destinations reach SAP through the BAS .dest proxy, which strips
-// Set-Cookie and makes ADT CSRF-protected writes impossible. Ask once for
-// direct-connection credentials and store them next to the MCP config; the
-// relay then connects straight to the backend host with Basic auth.
-async function promptForInternetDestinationCredentials({ destinations, credentialsPath, existing = {}, input = stdin, output = stdout } = {}) {
-  const stored = {};
-  const internetDestinations = destinations.filter(destination =>
-    destination.source !== 'cloud-foundry'
-    && String(destination.proxyType || '').toLowerCase() === 'internet'
-    && /^basicauthentication$/i.test(String(destination.authentication || '')));
-  if (!internetDestinations.length) return stored;
+async function probeBasOnPremCredentialRoute({ destination, user, password, env }) {
+  const relay = createBasDestinationRelay({
+    ...destination,
+    credentials: { user, password, mode: 'bas-tunnel' }
+  }, { env, log: () => {} });
+  try {
+    await relay.ready;
+    return await relay.probeCsrfSession();
+  } finally {
+    await relay.close();
+  }
+}
+
+async function promptForDestinationCredentials({ destinations, credentialsPath, existing = {}, input = stdin, output = stdout, env = process.env, verifyOnPremCredentialRoute = probeBasOnPremCredentialRoute } = {}) {
+  const eligible = destinations.filter(canPromptForCredentials);
+  const retained = new Set();
+  if (!eligible.length) return retained;
 
   print(output, '');
-  print(output, formatStatus('Some selected destinations are Internet type with basic authentication.', 'step', output, 'Direct connect'));
-  print(output, '  The BAS proxy strips SAP session cookies, which blocks ADT writes (CSRF validation).');
-  print(output, '  Providing a user and password enables a direct connection for those destinations.');
-  print(output, `  Credentials are stored beside your MCP config in ${credentialsPath} (never inside mcp.json).`);
+  print(output, formatStatus('Credential overrides are optional and apply only to selected BasicAuthentication destinations.', 'step', output, 'Credentials'));
+  print(output, `  Overrides are stored beside your MCP config in ${credentialsPath} with owner-only permissions (never inside mcp.json).`);
+  print(output, '  For OnPremise destinations, BAS/Cloud Foundry proxy credentials remain separate from the SAP backend credentials.');
   print(output, '');
 
-  for (const destination of internetDestinations) {
-    const known = existing[destination.name];
+  for (const destination of eligible) {
+    const key = credentialKeyForDestination(destination);
+    if (!key) continue;
+    const mode = credentialModeForDestination(destination);
+    const known = existing[key];
+    const routeLabel = `${destination.source === 'cloud-foundry' ? 'Cloud Foundry' : 'BAS'} ${destination.proxyType} — ${destination.name}`;
+    const answer = await textPrompt({
+      message: colorText(`🔐 ${routeLabel} — override SAP credentials? (y/n)`, 'cyan', output),
+      required: true,
+      validate: value => /^(?:y|yes|n|no)$/i.test(value.trim()) || 'Enter y or n.'
+    }, { input, output });
+    if (/^n/i.test(answer.trim())) {
+      await removeDestinationCredentials(credentialsPath, [key]);
+      print(output, formatStatus(`Credential override disabled for ${destination.name}.`, 'info', output, 'Credentials'));
+      continue;
+    }
+
     if (known?.user && known?.password) {
-      print(output, formatStatus(`Credentials for ${destination.name} are already stored (user ${known.user}). Press Enter at both prompts to keep them.`, 'info', output, 'Direct connect'));
+      print(output, formatStatus(`Credentials for ${destination.name} are already stored. Press Enter at both prompts to keep them.`, 'info', output, 'Credentials'));
     }
     const userAnswer = await textPrompt({
-      message: colorText(`👤 ${destination.name} — SAP user`, 'cyan', output),
+      message: colorText(`👤 ${routeLabel} — SAP user`, 'cyan', output),
       required: false,
-      placeholder: known ? `${known.user} (Enter keeps stored user)` : 'SAP user name'
+      placeholder: known ? 'Enter keeps the stored user' : 'SAP user name'
     }, { input, output });
     const user = userAnswer.trim() || known?.user || '';
     const passwordAnswer = await textPrompt({
-      message: colorText(`🔒 ${destination.name} — SAP password${known ? ' (Enter keeps stored password)' : ''}`, 'cyan', output),
+      message: colorText(`🔒 ${routeLabel} — SAP password${known ? ' (Enter keeps stored password)' : ''}`, 'cyan', output),
       secret: true,
       required: false
     }, { input, output });
     const password = passwordAnswer || known?.password || '';
     if (!user || !password) {
-      print(output, formatStatus(`No complete credentials for ${destination.name}; direct connect stays inactive for it.`, 'warning', output, 'Direct connect'));
+      await removeDestinationCredentials(credentialsPath, [key]);
+      print(output, formatStatus(`No complete credentials for ${destination.name}; no override was stored.`, 'warning', output, 'Credentials'));
       continue;
     }
-    stored[destination.name] = {
-      host: destination.backendUrl || known?.host || '',
-      user,
-      password
-    };
-    print(output, formatStatus(`Stored credentials for ${destination.name}.`, 'success', output, 'Direct connect'));
+
+    if (mode === 'bas-tunnel') {
+      let route;
+      try {
+        route = await verifyOnPremCredentialRoute({ destination, user, password, env });
+      } catch {
+        route = null;
+      }
+      if (!(route?.httpStatus >= 200 && route.httpStatus < 300) || !route.tokenReceived || !(route.cookieCount > 0)) {
+        await removeDestinationCredentials(credentialsPath, [key]);
+        print(output, formatStatus(`No override stored for ${destination.name}: the BAS/Cloud Connector route did not return both a CSRF token and session cookie.`, 'warning', output, 'Credentials'));
+        continue;
+      }
+    }
+
+    const host = mode === 'direct' ? (destination.backendUrl || known?.host || '') : '';
+    await storeDestinationCredentials(credentialsPath, key, { host, user, password, mode });
+    retained.add(key);
+    print(output, formatStatus(`Stored credential override for ${destination.name}.`, 'success', output, 'Credentials'));
   }
-  return stored;
+  return retained;
 }
 
 function safeProbe(probe) {
@@ -137,6 +173,7 @@ function printConnectionInstructions(output, result) {
     print(output, `  • ${name} — ${detail}`);
   }
   print(output, formatStatus('Open the Command Palette → “MCP: List Servers”, select a generated server, and choose “Start Server”.', 'step', output, 'Next'));
+  print(output, formatStatus('In GitHub Copilot Chat, select an agent, open the Chat tools picker, and enable each selected destination server for this chat.', 'step', output, 'Copilot Chat'));
   print(output, formatStatus('Inspect or edit entries with “MCP: Open User Configuration”.', 'info', output, 'Config'));
 }
 
@@ -149,6 +186,7 @@ export async function runSetup({
   discoverCf = discoverCloudFoundryDestinations,
   confirmCfImport = confirmCloudFoundryImport,
   install = installMcpConfig,
+  verifyOnPremCredentialRoute = probeBasOnPremCredentialRoute,
   includeSapDevelopmentToolsPrompt = false
 } = {}) {
   if (!env.H2O_URL) {
@@ -283,37 +321,24 @@ export async function runSetup({
     }, { input, output });
   }
 
-  // Ask for direct-connect credentials for selected Internet destinations
-  // so ADT writes work despite the BAS proxy stripping session cookies.
+  // Ask for an explicit credential override choice for each selected supported destination.
   const credentialsPath = await resolveCredentialsPath(env, configPath);
-  const internetSelected = selected.filter(destination =>
-    destination.source !== 'cloud-foundry'
-    && String(destination.proxyType || '').toLowerCase() === 'internet'
-    && /^basicauthentication$/i.test(String(destination.authentication || '')));
-  if (internetSelected.length) {
-    try {
-      const existingMap = (await readCredentials(credentialsPath).catch(() => ({ destinations: {} }))).destinations || {};
-      const storedNow = await promptForInternetDestinationCredentials({
-        destinations: selected,
-        credentialsPath,
-        existing: existingMap,
-        input,
-        output
-      });
-      for (const [name, entry] of Object.entries(storedNow)) {
-        await storeDestinationCredentials(credentialsPath, name, entry);
-      }
-      // Remove stored credentials for Internet destinations that are no
-      // longer selected, so the file only tracks active servers.
-      const stillSelected = new Set(selected.map(destination => destination.name));
-      const stale = Object.keys(existingMap)
-        .filter(name => !stillSelected.has(name))
-        .filter(name => internetSelected.every(destination => destination.name !== name));
-      if (stale.length) await removeDestinationCredentials(credentialsPath, stale);
-    } catch (error) {
-      if (/Prompt interrupted/.test(error.message)) throw error;
-      credentialWarnings.push(`Direct-connect credentials could not be stored: ${error.message}`);
-    }
+  try {
+    const existingMap = (await readCredentials(credentialsPath).catch(() => ({ destinations: {} }))).destinations || {};
+    const retained = await promptForDestinationCredentials({
+      destinations: selected,
+      credentialsPath,
+      existing: existingMap,
+      input,
+      output,
+      env,
+      verifyOnPremCredentialRoute
+    });
+    const stale = Object.keys(existingMap).filter(name => !retained.has(name));
+    if (stale.length) await removeDestinationCredentials(credentialsPath, stale);
+  } catch (error) {
+    if (/Prompt interrupted/.test(error.message)) throw error;
+    credentialWarnings.push(`Credential overrides could not be stored: ${error.message}`);
   }
   try {
     const result = await install(selected, { env, sapDevelopmentServers });

package/test/bas-destination-relay.test.mjs

@@ -1,6 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import http from 'node:http';
+import net from 'node:net';
 import { request as httpRequest } from 'node:http';
 import { createBasDestinationRelay } from '../src/bas-destination-relay.mjs';
 
@@ -186,3 +187,52 @@ test('falls back to a proxy tunnel when the absolute-form request is refused', a
     await new Promise(resolve => server.close(resolve));
   }
 });
+
+test('keeps OnPremise Basic auth on a BAS proxy tunnel and verifies the CSRF session', async t => {
+  const { state, server } = sapLikeBackend();
+  const backendPort = await startServer(server);
+  const connectTargets = [];
+  const proxy = http.createServer();
+  proxy.on('connect', (request, clientSocket, head) => {
+    connectTargets.push(request.url);
+    const upstream = net.connect(backendPort, '127.0.0.1', () => {
+      clientSocket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+      if (head.length) upstream.write(head);
+      clientSocket.pipe(upstream);
+      upstream.pipe(clientSocket);
+    });
+    clientSocket.on('error', () => upstream.destroy());
+    upstream.on('error', () => clientSocket.destroy());
+  });
+  const proxyPort = await startServer(proxy);
+  const logs = [];
+  const relay = createBasDestinationRelay({
+    name: 'CC-SYSTEM',
+    url: 'http://cc-system.dest',
+    authentication: 'BasicAuthentication',
+    credentials: { user: 'DEVELOPER', password: 'secret123', mode: 'bas-tunnel' }
+  }, {
+    env: { HTTP_PROXY: `http://127.0.0.1:${proxyPort}` },
+    log: message => logs.push(message)
+  });
+  const relayUrl = await relay.ready;
+  t.after(async () => {
+    await relay.close();
+    proxy.closeAllConnections?.();
+    await new Promise(resolve => proxy.close(resolve));
+    await new Promise(resolve => server.close(resolve));
+  });
+
+  const probe = await relay.probeCsrfSession();
+  assert.deepEqual(probe, { httpStatus: 200, tokenReceived: true, cookieCount: 2 });
+  const response = await relayFetch(relayUrl, '/sap/bc/adt/oo/classes', { method: 'POST', body: '<x/>' });
+  assert.equal(response.status, 201, `expected a paired CSRF session, got ${response.status}: ${response.body}`);
+  const post = state.requests.find(request => request.method === 'POST');
+  assert.match(post.headers.authorization, /^Basic /);
+  assert.match(String(post.headers.cookie), /sap-session-\d+=/);
+  assert.ok(connectTargets.length >= 2);
+  assert.ok(connectTargets.every(target => target === 'cc-system.dest:80'));
+  assert.equal(relay.stats.direct, false);
+  assert.equal(relay.stats.proxyTunnel, true);
+  assert.ok(logs.some(message => message.includes('BAS proxy tunnel')));
+});

package/test/cf-runtime.test.mjs

@@ -6,6 +6,7 @@ import { spawn } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { storeDestinationCredentials } from '../src/credentials-store.mjs';
 
 const launcher = fileURLToPath(new URL('../src/launcher.mjs', import.meta.url));
 const fakeVsp = fileURLToPath(new URL('./fixtures/fake-vsp.mjs', import.meta.url));
@@ -257,6 +258,12 @@ test('routes a PrincipalPropagation MCP call through CF Connectivity to the SAP
     connectivityProxyPort,
     connectivityTokenUrl: `${serviceOrigin}/connectivity/oauth/token`
   });
+  const credentialsPath = join(directory, 'sap-ai-dev-toolkit-credentials.json');
+  await storeDestinationCredentials(credentialsPath, `cloud-foundry:cf:${SPACE_GUID}:${INSTANCE_GUID}:pp-target`, {
+    user: 'must-not-override',
+    password: 'must-not-override-secret',
+    mode: 'cf-connectivity'
+  });
   const childLog = join(directory, 'vsp-children.jsonl');
   t.after(async () => {
     await new Promise(resolve => service.close(resolve));
@@ -271,6 +278,7 @@ test('routes a PrincipalPropagation MCP call through CF Connectivity to the SAP
     SAP_AI_DEV_TOOLKIT_BINARY: fakeVsp,
     SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE: 'cloud-foundry',
     SAP_AI_DEV_TOOLKIT_DESTINATION: 'pp-target',
+    SAP_AI_DEV_TOOLKIT_CREDENTIALS_FILE: credentialsPath,
     BAS_CF_SPACE_GUID: SPACE_GUID,
     BAS_CF_DESTINATION_INSTANCE_GUID: INSTANCE_GUID,
     BAS_CF_DESTINATION_INSTANCE: INSTANCE_NAME,
@@ -313,17 +321,17 @@ test('routes a PrincipalPropagation MCP call through CF Connectivity to the SAP
   assert.equal(initialized.argv.includes('--proxy-auth'), true);
   assert.equal(initialized.env.user, undefined);
   assert.equal(initialized.env.password, undefined);
-  for (const secret of ['destination-key-secret', 'destination-api-token', 'connectivity-key-secret', 'user-exchange-token', 'current-cf-user-jwt', 'parent-user-secret', 'parent-password-secret']) {
+  for (const secret of ['must-not-override', 'must-not-override-secret', 'destination-key-secret', 'destination-api-token', 'connectivity-key-secret', 'user-exchange-token', 'current-cf-user-jwt', 'parent-user-secret', 'parent-password-secret']) {
     assert.equal(`${result.stdout}\\n${result.stderr}\\n${JSON.stringify(initialized.argv)}`.includes(secret), false);
   }
 });
 
-test('routes a CF Basic OnPremise MCP call through the HTTP Connectivity proxy', async t => {
+test('overrides CF Basic OnPremise backend auth while retaining the HTTP Connectivity proxy', async t => {
   const directory = await mkdtemp(join(tmpdir(), 'bas-cf-basic-onprem-'));
   const observed = { destinationToken: [], destinationList: [], connectivityToken: [], proxy: [], connect: [], target: [] };
   const target = createServer((request, response) => {
     observed.target.push({ path: request.url, authorization: request.headers.authorization });
-    response.writeHead(request.headers.authorization === `Basic ${Buffer.from('sap-user:sap-password').toString('base64')}` ? 200 : 401, {
+    response.writeHead(request.headers.authorization === `Basic ${Buffer.from('override-user:override-password').toString('base64')}` ? 200 : 401, {
       'content-type': 'text/plain'
     });
     response.end('SAP system information: client=100');
@@ -409,6 +417,12 @@ test('routes a CF Basic OnPremise MCP call through the HTTP Connectivity proxy',
     connectivityProxyPort,
     connectivityTokenUrl: `${serviceOrigin}/connectivity/oauth/token`
   });
+  const credentialsPath = join(directory, 'sap-ai-dev-toolkit-credentials.json');
+  await storeDestinationCredentials(credentialsPath, `cloud-foundry:cf:${SPACE_GUID}:${INSTANCE_GUID}:basic-onprem`, {
+    user: 'override-user',
+    password: 'override-password',
+    mode: 'cf-connectivity'
+  });
   const childLog = join(directory, 'vsp-children.jsonl');
   const servers = [service, target, connectivityProxy];
   t.after(async () => {
@@ -423,6 +437,7 @@ test('routes a CF Basic OnPremise MCP call through the HTTP Connectivity proxy',
     SAP_AI_DEV_TOOLKIT_BINARY: fakeVsp,
     SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE: 'cloud-foundry',
     SAP_AI_DEV_TOOLKIT_DESTINATION: 'basic-onprem',
+    SAP_AI_DEV_TOOLKIT_CREDENTIALS_FILE: credentialsPath,
     BAS_CF_SPACE_GUID: SPACE_GUID,
     BAS_CF_DESTINATION_INSTANCE_GUID: INSTANCE_GUID,
     BAS_CF_DESTINATION_INSTANCE: INSTANCE_NAME,
@@ -461,13 +476,20 @@ test('routes a CF Basic OnPremise MCP call through the HTTP Connectivity proxy',
     'GET',
     `${targetOrigin}/sap/bc/adt/discovery`,
     'Bearer application-proxy-token',
-    `Basic ${Buffer.from('sap-user:sap-password').toString('base64')}`
+    `Basic ${Buffer.from('override-user:override-password').toString('base64')}`
   ]]);
   assert.deepEqual(observed.connect, []);
   assert.deepEqual(observed.target, [{
     path: '/sap/bc/adt/discovery',
-    authorization: `Basic ${Buffer.from('sap-user:sap-password').toString('base64')}`
+    authorization: `Basic ${Buffer.from('override-user:override-password').toString('base64')}`
   }]);
+  const events = (await readFile(childLog, 'utf8')).trim().split('\n').map(line => JSON.parse(line));
+  const initialized = events.find(event => event.event === 'initialize');
+  assert.deepEqual([initialized.env.user, initialized.env.password], ['override-user', 'override-password']);
+  assert.equal(initialized.argv.includes('--proxy-auth'), false);
+  for (const secret of ['override-user', 'override-password', 'sap-password', 'connectivity-key-secret', 'application-proxy-token']) {
+    assert.equal(`${result.stdout}\n${result.stderr}\n${JSON.stringify(initialized.argv)}`.includes(secret), false, `${secret} must not appear in output or argv`);
+  }
 });
 
 test('CF list-destinations clears the CF name filter and remains BAS-only', async t => {

package/test/copilot-content.test.mjs

@@ -49,6 +49,12 @@ function assertMentionsLiveToolDiscovery(markdown, path) {
   assert.match(markdown, /schema/i, `${path} must tell agents to follow live tool schemas`);
 }
 
+function assertDirectMcpUsage(markdown, path) {
+  assert.match(markdown, /Direct MCP invocation is mandatory/i, `${path} must require direct MCP calls`);
+  assert.match(markdown, /Do not launch `sap-ai-dev`.*MCP operations/i, `${path} must forbid terminal-driven MCP discovery/calls`);
+  assert.match(markdown, /host\/session binding issue/i, `${path} must report host tool-binding failures instead of using a CLI fallback`);
+}
+
 function assertValidationPolicy(markdown, path) {
   assert.match(markdown, /ABAP Unit|RunUnitTests/i, `${path} must include ABAP Unit or test execution guidance`);
   assert.match(markdown, /runtime validation|Self-validate|executable validation|reproduce/i, `${path} must require executable/runtime validation evidence`);
@@ -85,6 +91,15 @@ test('packaged Copilot agent and skill inventory is complete and canonical', asy
   }
 });
 
+test('all bundled agents invoke chat-attached MCP tools without terminal JSON-RPC fallbacks', async () => {
+  for (const name of expectedAgents) {
+    const path = join(agentsRoot, name);
+    const markdown = await readMarkdown(path);
+    assertDirectMcpUsage(markdown, path);
+    assertMentionsLiveToolDiscovery(markdown, path);
+  }
+});
+
 test('ABAP Developer agent has valid metadata and invokes the packaged skills', async () => {
   const markdown = await readMarkdown(agentPath);
   const metadata = parseFrontmatter(markdown, agentPath);

package/test/credentials-store.test.mjs

@@ -7,6 +7,7 @@ import http from 'node:http';
 import { request as httpRequest } from 'node:http';
 import { createBasDestinationRelay } from '../src/bas-destination-relay.mjs';
 import { readCredentials, removeDestinationCredentials, resolveCredentialsPath, storeDestinationCredentials } from '../src/credentials-store.mjs';
+import { canPromptForCredentials, credentialKeyForDestination, credentialModeForDestination } from '../src/credential-overrides.mjs';
 
 const UNSAFE_METHODS = ['POST', 'PUT', 'PATCH', 'DELETE'];
 
@@ -105,6 +106,36 @@ test('credentials file with malformed entries keeps only complete records', asyn
   assert.deepEqual(Object.keys(stored.destinations), ['GOOD']);
 });
 
+test('credential overrides use route-aware modes and distinct CF destination keys', async t => {
+  const directory = await mkdtemp(join(tmpdir(), 'bas-creds-modes-'));
+  const path = join(directory, 'sap-ai-dev-toolkit-credentials.json');
+  t.after(async () => { await rm(directory, { recursive: true, force: true }); });
+
+  const basDestination = { name: 'shared-name', source: 'bas', proxyType: 'Internet', authentication: 'BasicAuthentication', backendUrl: 'https://internet.example' };
+  const basOnPremise = { name: 'shared-name', source: 'bas', proxyType: 'OnPremise', authentication: 'BasicAuthentication' };
+  const cfOnPremise = { name: 'shared-name', serverName: 'cf:space-one:instance-one:shared-name', source: 'cloud-foundry', proxyType: 'OnPremise', authentication: 'BasicAuthentication' };
+  const principalPropagation = { ...cfOnPremise, authentication: 'PrincipalPropagation' };
+
+  assert.equal(canPromptForCredentials(basDestination), true);
+  assert.equal(credentialModeForDestination(basDestination), 'direct');
+  assert.equal(credentialModeForDestination(basOnPremise), 'bas-tunnel');
+  assert.equal(credentialModeForDestination(cfOnPremise), 'cf-connectivity');
+  assert.equal(canPromptForCredentials(principalPropagation), false);
+  assert.equal(credentialModeForDestination({ ...cfOnPremise, proxyType: 'Internet' }), null);
+  assert.equal(canPromptForCredentials({ ...basDestination, backendUrl: null }), false);
+  assert.notEqual(credentialKeyForDestination(basOnPremise), credentialKeyForDestination(cfOnPremise));
+
+  const cfKey = credentialKeyForDestination(cfOnPremise);
+  await storeDestinationCredentials(path, cfKey, { user: 'OVERRIDE', password: 'secret', mode: 'cf-connectivity' });
+  const stored = await readCredentials(path);
+  assert.equal(stored.destinations[cfKey].mode, 'cf-connectivity');
+  assert.equal(stored.destinations[cfKey].host, undefined);
+  await assert.rejects(
+    () => storeDestinationCredentials(path, 'INVALID', { user: 'U', password: 'P', mode: 'bypass-cloud-connector' }),
+    /route mode is unsupported/
+  );
+});
+
 test('relay direct connect sends Basic auth and CSRF pairing succeeds', async t => {
   const { state, server } = authedBackend();
   await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));

package/test/launcher.test.mjs

@@ -7,6 +7,8 @@ import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { spawnWithPty } from './pty.mjs';
+import { storeDestinationCredentials } from '../src/credentials-store.mjs';
+import { credentialKeyForDestination, enrichWithStoredCredentials } from '../src/credential-overrides.mjs';
 
 const launcher = fileURLToPath(new URL('../src/launcher.mjs', import.meta.url));
 const fakeVsp = fileURLToPath(new URL('./fixtures/fake-vsp.mjs', import.meta.url));
@@ -43,6 +45,56 @@ function runLauncherTty(env, input, args = ['--setup']) {
   });
 }
 
+test('enriches stored credentials without switching BAS OnPremise or CF Connectivity routes', async t => {
+  const directory = await mkdtemp(join(tmpdir(), 'bas-launcher-credentials-'));
+  const credentialsPath = join(directory, 'credentials.json');
+  t.after(async () => { await rm(directory, { recursive: true, force: true }); });
+
+  const internet = {
+    name: 'internet-system', url: 'http://internet-system.dest', backendUrl: 'https://internet.example:44300',
+    authentication: 'BasicAuthentication', proxyType: 'Internet'
+  };
+  const basOnPremise = {
+    name: 'shared-system', url: 'http://shared-system.dest', backendUrl: 'https://internal.example:44300',
+    authentication: 'BasicAuthentication', proxyType: 'OnPremise'
+  };
+  const cfOnPremise = {
+    source: 'cloud-foundry', name: 'shared-system', serverName: 'cf:space-one:instance-one:shared-system',
+    url: 'https://sap.internal:44300', authentication: 'BasicAuthentication', proxyType: 'OnPremise',
+    childEnv: { HTTP_PROXY: 'http://127.0.0.1:3333', SAP_USER: 'configured-user', SAP_PASSWORD: 'configured-password' }
+  };
+  const principalPropagation = { ...cfOnPremise, name: 'principal-system', serverName: 'cf:space-one:instance-one:principal-system', authentication: 'PrincipalPropagation' };
+
+  await storeDestinationCredentials(credentialsPath, 'internet-system', {
+    host: internet.backendUrl, user: 'INTERNET_USER', password: 'internet-secret'
+  });
+  await storeDestinationCredentials(credentialsPath, 'shared-system', {
+    user: 'BAS_USER', password: 'bas-secret', mode: 'bas-tunnel'
+  });
+  await storeDestinationCredentials(credentialsPath, credentialKeyForDestination(cfOnPremise), {
+    user: 'CF_USER', password: 'cf-secret', mode: 'cf-connectivity'
+  });
+  await storeDestinationCredentials(credentialsPath, credentialKeyForDestination(principalPropagation), {
+    user: 'SHOULD_NOT_APPLY', password: 'pp-secret', mode: 'cf-connectivity'
+  });
+
+  const result = await enrichWithStoredCredentials(
+    [internet, basOnPremise, cfOnPremise, principalPropagation],
+    { SAP_AI_DEV_TOOLKIT_CREDENTIALS_FILE: credentialsPath },
+    () => {}
+  );
+  assert.deepEqual(result[0].credentials, {
+    host: internet.backendUrl, user: 'INTERNET_USER', password: 'internet-secret', mode: 'direct'
+  });
+  assert.deepEqual(result[1].credentials, { user: 'BAS_USER', password: 'bas-secret', mode: 'bas-tunnel' });
+  assert.equal(result[1].credentials.host, undefined, 'OnPremise must not bypass the BAS destination route');
+  assert.deepEqual(result[2].childEnv, {
+    HTTP_PROXY: 'http://127.0.0.1:3333', SAP_USER: 'CF_USER', SAP_PASSWORD: 'cf-secret', SAP_VERBOSE: 'false'
+  });
+  assert.equal(result[3].childEnv.SAP_USER, 'configured-user', 'PrincipalPropagation must not receive a Basic override');
+  assert.equal(result[3].childEnv.SAP_PASSWORD, 'configured-password');
+});
+
 test('help exits before BAS destination discovery', async t => {
   let requests = 0;
   const server = createServer((_request, response) => {

package/test/setup-cf.test.mjs

@@ -6,6 +6,8 @@ import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { installMcpConfig } from '../src/mcp-config.mjs';
 import { destinationTable } from '../scripts/postinstall.mjs';
+import { readCredentials, resolveCredentialsPath, storeDestinationCredentials } from '../src/credentials-store.mjs';
+import { credentialKeyForDestination } from '../src/credential-overrides.mjs';
 import { spawnWithPty } from './pty.mjs';
 
 const setupModule = fileURLToPath(new URL('../src/setup.mjs', import.meta.url));
@@ -28,6 +30,22 @@ function cloudFoundryDestination({ name, serverName, instanceGuid, instanceName,
   };
 }
 
+function cloudFoundryOnPremiseDestination() {
+  const destination = cloudFoundryDestination({
+    name: 'shared-name',
+    serverName: 'cf:space-one:cf-destination:shared-name',
+    instanceGuid: 'cf-destination',
+    instanceName: 'destination-service',
+    keyName: 'destination-key'
+  });
+  destination.authentication = 'BasicAuthentication';
+  destination.proxyType = 'OnPremise';
+  destination.cf.connectivityInstanceGuid = 'cf-connectivity';
+  destination.cf.connectivityInstanceName = 'connectivity-service';
+  destination.cf.connectivityKeyName = 'connectivity-key';
+  return destination;
+}
+
 async function makeFixture(t, { version = 'cf version 8.18.0', space = 'space-one', deleteMode = 'success' } = {}) {
   const directory = await mkdtemp(join(tmpdir(), 'bas-cf-setup-'));
   const bin = join(directory, 'bin');
@@ -63,6 +81,7 @@ await runSetup({
     await writeFile(process.env.CF_DISCOVERY_LOG, JSON.stringify({ spaceGuid, managedKeys }));
     return JSON.parse(process.env.TEST_CF_RESULT);
   },
+  verifyOnPremCredentialRoute: async () => JSON.parse(process.env.TEST_ONPREM_CSRF_RESULT),
   ...(process.env.TEST_INSTALL_FAIL === 'true' ? {
     install: async () => { throw new Error('simulated config write failure'); }
   } : {})
@@ -81,13 +100,14 @@ await runSetup({
     TEST_CF_DELETE_MODE: deleteMode,
     TEST_INSTALL_FAIL: 'false',
     TEST_BAS_DESTINATIONS: JSON.stringify([]),
-    TEST_CF_RESULT: JSON.stringify({ destinations: [], createdKeys: [], warnings: [] })
+    TEST_CF_RESULT: JSON.stringify({ destinations: [], createdKeys: [], warnings: [] }),
+    TEST_ONPREM_CSRF_RESULT: JSON.stringify({ httpStatus: 200, tokenReceived: true, cookieCount: 1 })
   };
   t.after(() => rm(directory, { recursive: true, force: true }));
   return { directory, configPath, callLog, discoveryLog, harness, env };
 }
 
-function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r' } = {}) {
+function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r', promptAnswers = [] } = {}) {
   return new Promise((resolve, reject) => {
     const command = `${JSON.stringify(process.execPath)} ${JSON.stringify(fixture.harness)}`;
     const child = spawnWithPty(command, { env: fixture.env, stdio: ['pipe', 'pipe', 'pipe'] });
@@ -95,6 +115,7 @@ function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r' } = {}
     let stderr = '';
     let importSent = false;
     let selectionSent = false;
+    let promptAnswerIndex = 0;
     const timeout = setTimeout(() => child.kill('SIGKILL'), 15000);
     child.stdout.on('data', chunk => {
       stdout += chunk.toString();
@@ -104,7 +125,16 @@ function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r' } = {}
       }
       if (!selectionSent && stdout.includes('Select destinations')) {
         selectionSent = true;
-        child.stdin.end(selection);
+        if (promptAnswers.length) child.stdin.write(selection);
+        else child.stdin.end(selection);
+      }
+      if (selectionSent && promptAnswerIndex < promptAnswers.length) {
+        const answer = promptAnswers[promptAnswerIndex];
+        if (stdout.includes(answer.when)) {
+          promptAnswerIndex++;
+          child.stdin.write(answer.value);
+          if (promptAnswerIndex === promptAnswers.length) child.stdin.end();
+        }
       }
     });
     child.stderr.on('data', chunk => { stderr += chunk.toString(); });
@@ -114,7 +144,7 @@ function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r' } = {}
     });
     child.on('exit', (code, signal) => {
       clearTimeout(timeout);
-      resolve({ code, signal, stdout, stderr, importSent, selectionSent });
+      resolve({ code, signal, stdout, stderr, importSent, selectionSent, promptAnswersSent: promptAnswerIndex });
     });
   });
 }
@@ -145,6 +175,7 @@ test('imports selected CF destinations, passes managed key references, and remov
   assert.equal(result.selectionSent, true, result.stdout);
   assert.match(result.stdout, /CF new-destination-service/);
   assert.match(result.stdout, /Configured 1 MCP server/);
+  assert.match(result.stdout, /GitHub Copilot Chat.*Chat tools picker.*enable each selected destination server/s);
   assert.doesNotMatch(`${result.stdout}\n${result.stderr}`, /SECRET|clientSecret|Password/);
 
   const snapshot = JSON.parse(await readFile(fixture.discoveryLog, 'utf8'));
@@ -163,6 +194,102 @@ test('imports selected CF destinations, passes managed key references, and remov
   assert.equal(calls.some(args => args.at(-1) === 'new-key'), false);
 });
 
+test('prompts for BAS and CF OnPremise overrides separately and keeps their routes distinct', async t => {
+  const fixture = await makeFixture(t);
+  const cfDestination = cloudFoundryOnPremiseDestination();
+  fixture.env.TEST_BAS_DESTINATIONS = JSON.stringify([
+    {
+      name: 'internet-system', url: 'http://internet-system.dest', backendUrl: 'https://internet.example:44300',
+      client: '100', authentication: 'BasicAuthentication', proxyType: 'Internet',
+      probe: { status: 'available', available: true }
+    },
+    {
+      name: 'shared-name', url: 'http://shared-name.dest', backendUrl: 'https://internal.example:44300',
+      client: '101', authentication: 'BasicAuthentication', proxyType: 'OnPremise',
+      probe: { status: 'available', available: true }
+    },
+    {
+      name: 'principal-system', url: 'http://principal-system.dest',
+      client: '102', authentication: 'PrincipalPropagation', proxyType: 'OnPremise',
+      probe: { status: 'available', available: true }
+    }
+  ]);
+  fixture.env.TEST_CF_RESULT = JSON.stringify({ destinations: [cfDestination], createdKeys: [], warnings: [] });
+
+  const result = await runSetupInPty(fixture, {
+    selection: 'a\r',
+    promptAnswers: [
+      { when: 'BAS Internet — internet-system — override SAP credentials?', value: 'y\r' },
+      { when: 'BAS Internet — internet-system — SAP user', value: 'INTERNET_USER\r' },
+      { when: 'BAS Internet — internet-system — SAP password', value: 'internet-password-secret\r' },
+      { when: 'BAS OnPremise — shared-name — override SAP credentials?', value: 'y\r' },
+      { when: 'BAS OnPremise — shared-name — SAP user', value: 'BAS_CC_USER\r' },
+      { when: 'BAS OnPremise — shared-name — SAP password', value: 'bas-cc-password-secret\r' },
+      { when: 'Cloud Foundry OnPremise — shared-name — override SAP credentials?', value: 'y\r' },
+      { when: 'Cloud Foundry OnPremise — shared-name — SAP user', value: 'CF_CC_USER\r' },
+      { when: 'Cloud Foundry OnPremise — shared-name — SAP password', value: 'cf-cc-password-secret\r' }
+    ]
+  });
+  assert.equal(result.code, 0, `${result.stdout}\n${result.stderr}`);
+  assert.equal(result.promptAnswersSent, 9, result.stdout);
+  assert.doesNotMatch(result.stdout, /PrincipalPropagation — principal-system — override SAP credentials/);
+  assert.doesNotMatch(`${result.stdout}\n${result.stderr}`, /internet-password-secret|bas-cc-password-secret|cf-cc-password-secret/);
+
+  const credentialsPath = await resolveCredentialsPath(fixture.env, fixture.configPath);
+  const stored = (await readCredentials(credentialsPath)).destinations;
+  assert.equal(stored['internet-system'].mode, 'direct');
+  assert.equal(stored['internet-system'].host, 'https://internet.example:44300');
+  assert.equal(stored['shared-name'].mode, 'bas-tunnel');
+  assert.equal(stored['shared-name'].host, undefined, 'BAS OnPremise must not store or use the backend URL');
+  const cfKey = credentialKeyForDestination(cfDestination);
+  assert.equal(stored[cfKey].mode, 'cf-connectivity');
+  assert.equal(stored[cfKey].host, undefined);
+  assert.deepEqual(
+    [stored['shared-name'].user, stored[cfKey].user],
+    ['BAS_CC_USER', 'CF_CC_USER'],
+    'same destination names from BAS and CF must remain distinct'
+  );
+
+  const mcpConfig = JSON.parse(await readFile(fixture.configPath, 'utf8'));
+  assert.equal(JSON.stringify(mcpConfig).includes('bas-cc-password-secret'), false);
+  assert.equal(JSON.stringify(mcpConfig).includes('cf-cc-password-secret'), false);
+});
+
+test('No removes a stored BAS OnPremise override and failed CSRF preflight refuses a new one', async t => {
+  const fixture = await makeFixture(t);
+  fixture.env.TEST_BAS_DESTINATIONS = JSON.stringify([{
+    name: 'shared-name', url: 'http://shared-name.dest', backendUrl: 'https://internal.example:44300',
+    client: '100', authentication: 'BasicAuthentication', proxyType: 'OnPremise',
+    probe: { status: 'available', available: true }
+  }]);
+  fixture.env.TEST_CF_RESULT = JSON.stringify({ destinations: [], createdKeys: [], warnings: [] });
+  const credentialsPath = await resolveCredentialsPath(fixture.env, fixture.configPath);
+  await storeDestinationCredentials(credentialsPath, 'shared-name', {
+    user: 'OLD_USER', password: 'old-password-secret', mode: 'bas-tunnel'
+  });
+
+  const declined = await runSetupInPty(fixture, {
+    selection: ' \r',
+    promptAnswers: [{ when: 'BAS OnPremise — shared-name — override SAP credentials?', value: 'n\r' }]
+  });
+  assert.equal(declined.code, 0, `${declined.stdout}\n${declined.stderr}`);
+  assert.equal((await readCredentials(credentialsPath)).destinations['shared-name'], undefined);
+
+  fixture.env.TEST_ONPREM_CSRF_RESULT = JSON.stringify({ httpStatus: 200, tokenReceived: true, cookieCount: 0 });
+  const rejected = await runSetupInPty(fixture, {
+    selection: ' \r',
+    promptAnswers: [
+      { when: 'BAS OnPremise — shared-name — override SAP credentials?', value: 'y\r' },
+      { when: 'BAS OnPremise — shared-name — SAP user', value: 'NEW_USER\r' },
+      { when: 'BAS OnPremise — shared-name — SAP password', value: 'new-password-secret\r' }
+    ]
+  });
+  assert.equal(rejected.code, 0, `${rejected.stdout}\n${rejected.stderr}`);
+  assert.match(rejected.stdout, /did not return both a CSRF token and session cookie/);
+  assert.equal((await readCredentials(credentialsPath)).destinations['shared-name'], undefined);
+  assert.doesNotMatch(`${rejected.stdout}\n${rejected.stderr}`, /new-password-secret/);
+});
+
 test('declining CF import keeps BAS setup and does not create CF keys', async t => {
   const fixture = await makeFixture(t);
   fixture.env.TEST_BAS_DESTINATIONS = JSON.stringify([{