sap-ai-dev-toolkit 0.3.3 → 0.3.7

package/test/live-s4h.test.mjs

@@ -0,0 +1,202 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { once } from 'node:events';
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const launcher = fileURLToPath(new URL('../src/launcher.mjs', import.meta.url));
+const LIVE = /^(1|true|yes)$/iu.test(process.env.SAP_AI_DEV_LIVE_S4H || '');
+const DESTINATION = process.env.SAP_AI_DEV_LIVE_DESTINATION || 'S4H';
+const SLUG = process.env.SAP_AI_DEV_LIVE_DESTINATION_SLUG || DESTINATION.toLowerCase().replace(/[^a-z0-9_-]+/gu, '-');
+const REQUEST_TIMEOUT_MS = Number(process.env.SAP_AI_DEV_LIVE_TIMEOUT_MS || 45_000);
+
+async function readConfiguredServer() {
+  if (/^(0|false|no)$/iu.test(process.env.SAP_AI_DEV_LIVE_USE_MCP_CONFIG || '')) return null;
+  const candidates = [
+    process.env.SAP_AI_DEV_MCP_CONFIG,
+    process.env.BAS_VSP_MCP_CONFIG,
+    join(homedir(), '.vscode', 'data', 'User', 'mcp.json'),
+    join(homedir(), '.vscode-server', 'data', 'User', 'mcp.json'),
+    join(homedir(), '.code-server', 'data', 'User', 'mcp.json')
+  ].filter(Boolean);
+  for (const path of candidates) {
+    let parsed;
+    try {
+      parsed = JSON.parse(await readFile(path, 'utf8'));
+    } catch {
+      continue;
+    }
+    const server = parsed?.servers?.[DESTINATION];
+    if (server?.command) return { path, server };
+  }
+  return null;
+}
+
+class StdioMcpClient {
+  constructor(command, args, env) {
+    this.child = spawn(command, args, { env, stdio: ['pipe', 'pipe', 'pipe'] });
+    this.nextId = 1;
+    this.pending = new Map();
+    this.stdout = '';
+    this.stderr = '';
+    this.notifications = [];
+    this.child.stdout.setEncoding('utf8');
+    this.child.stderr.setEncoding('utf8');
+    this.child.stdout.on('data', chunk => this.#onStdout(chunk));
+    this.child.stderr.on('data', chunk => { this.stderr += chunk; });
+    this.child.on('exit', (code, signal) => {
+      const error = new Error(`MCP process exited (${code ?? signal})\n${this.stderr.slice(-4000)}`);
+      for (const pending of this.pending.values()) pending.reject(error);
+      this.pending.clear();
+    });
+  }
+
+  #onStdout(chunk) {
+    this.stdout += chunk;
+    let newline;
+    while ((newline = this.stdout.indexOf('\n')) >= 0) {
+      const line = this.stdout.slice(0, newline).trim();
+      this.stdout = this.stdout.slice(newline + 1);
+      if (!line) continue;
+      let message;
+      try {
+        message = JSON.parse(line);
+      } catch (error) {
+        for (const pending of this.pending.values()) pending.reject(new Error(`Invalid JSON-RPC line: ${line}`));
+        this.pending.clear();
+        return;
+      }
+      if (message.id === undefined || message.id === null) {
+        this.notifications.push(message);
+        continue;
+      }
+      const pending = this.pending.get(message.id);
+      if (!pending) continue;
+      this.pending.delete(message.id);
+      clearTimeout(pending.timeout);
+      if (message.error) pending.reject(Object.assign(new Error(message.error.message), { response: message }));
+      else pending.resolve(message.result);
+    }
+  }
+
+  request(method, params) {
+    const id = this.nextId++;
+    const payload = { jsonrpc: '2.0', id, method, ...(params === undefined ? {} : { params }) };
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        this.pending.delete(id);
+        reject(new Error(`Timed out waiting for ${method}\n${this.stderr.slice(-4000)}`));
+      }, REQUEST_TIMEOUT_MS);
+      this.pending.set(id, { resolve, reject, timeout });
+      this.child.stdin.write(`${JSON.stringify(payload)}\n`);
+    });
+  }
+
+  notify(method, params) {
+    this.child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', method, ...(params === undefined ? {} : { params }) })}\n`);
+  }
+
+  async close() {
+    this.child.stdin.end();
+    this.child.kill('SIGTERM');
+    await Promise.race([
+      once(this.child, 'exit').catch(() => {}),
+      new Promise(resolve => setTimeout(resolve, 1500))
+    ]);
+    if (!this.child.killed) this.child.kill('SIGKILL');
+  }
+}
+
+function textPayload(result) {
+  return (result?.content || []).filter(item => item.type === 'text').map(item => item.text).join('\n');
+}
+
+async function withLiveClient(t) {
+  const configured = await readConfiguredServer();
+  const server = configured?.server;
+  const command = process.env.SAP_AI_DEV_LIVE_COMMAND || server?.command || process.execPath;
+  const args = process.env.SAP_AI_DEV_LIVE_COMMAND
+    ? (process.env.SAP_AI_DEV_LIVE_ARGS ? JSON.parse(process.env.SAP_AI_DEV_LIVE_ARGS) : [])
+    : (server?.command ? (server.args || []) : [launcher]);
+  const client = new StdioMcpClient(command, args, {
+    ...process.env,
+    ...(server?.env || {}),
+    SAP_AI_DEV_TOOLKIT_DESTINATION: server?.env?.SAP_AI_DEV_TOOLKIT_DESTINATION || DESTINATION,
+    SAP_AI_DEV_TOOLKIT_MODE: process.env.SAP_AI_DEV_TOOLKIT_MODE || server?.env?.SAP_AI_DEV_TOOLKIT_MODE || 'expert',
+    SAP_ALLOW_TRANSPORTABLE_EDITS: process.env.SAP_ALLOW_TRANSPORTABLE_EDITS || server?.env?.SAP_ALLOW_TRANSPORTABLE_EDITS || 'true'
+  });
+  t.after(() => client.close());
+  const initialized = await client.request('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'sap-ai-dev-live-test', version: '1.0.0' } });
+  client.notify('notifications/initialized');
+  assert.equal(initialized.serverInfo.name, DESTINATION);
+  return client;
+}
+
+test('live S4H MCP exposes a curated ABAP lifecycle surface under 60 tools', { skip: LIVE ? false : 'set SAP_AI_DEV_LIVE_S4H=1 to run against a live BAS/S4H destination' }, async t => {
+  const client = await withLiveClient(t);
+  const listed = await client.request('tools/list', {});
+  const tools = listed.tools || [];
+  const names = new Set(tools.map(tool => tool.name));
+  const prefix = `${SLUG}__`;
+
+  assert.ok(tools.length > 25, `expected a useful ABAP lifecycle surface, got ${tools.length}`);
+  assert.ok(tools.length < 60, `curated destination tool count must stay below 60, got ${tools.length}`);
+  assert.ok(tools.every(tool => tool.name.startsWith(prefix)), 'every tool is destination-prefixed for the selected S4H server');
+
+  for (const required of [
+    'LintABAP', 'GetSystemInfo', 'GetConnectionInfo', 'GetFeatures',
+    'SearchObject', 'GrepObjects', 'GrepPackages', 'GetSource', 'WriteSource', 'EditSource', 'CompareSource',
+    'SyntaxCheck', 'PrettyPrint', 'Activate', 'RunUnitTests', 'RunATCCheck', 'GetInactiveObjects',
+    'GetClass', 'GetProgram', 'GetPackage', 'GetTable', 'GetTableContents', 'RunQuery',
+    'GetTransport', 'GetTransportInfo', 'ListTransports', 'CreateTransport',
+    'GetApplicationLog', 'PrepareABAPChangeSet', 'ApplyABAPChangeSet', 'CheckTransportReadiness', 'PlanABAPCloudMigration'
+  ]) {
+    assert.ok(names.has(`${prefix}${required}`), `expected curated lifecycle tool ${required}`);
+  }
+
+  for (const hidden of [
+    'SAP', 'ReleaseTransport', 'DeleteTransport', 'DeleteObject', 'ExecuteABAP', 'CallRFC',
+    'ListSQLTraces', 'AnalyzeABAPCode', 'CreateObject', 'CreateClassWithTests', 'WriteClass', 'UpdateSource'
+  ]) {
+    assert.equal(names.has(`${prefix}${hidden}`), false, `broad/destructive tool ${hidden} must remain hidden`);
+  }
+});
+
+test('live S4H MCP handles safe local and read-only SAP calls', { skip: LIVE ? false : 'set SAP_AI_DEV_LIVE_S4H=1 to run against a live BAS/S4H destination' }, async t => {
+  const client = await withLiveClient(t);
+  const prefix = `${SLUG}__`;
+  await client.request('tools/list', {});
+
+  const lint = await client.request('tools/call', {
+    name: `${prefix}LintABAP`,
+    arguments: { files: [{ filename: 'zlive_probe.prog.abap', source: "REPORT zlive_probe.\nWRITE / 'ok'.\n" }] }
+  });
+  const lintJson = JSON.parse(textPayload(lint));
+  assert.equal(lintJson.filesChecked, 1);
+
+  for (const [tool, args] of [
+    ['GetSystemInfo', {}],
+    ['GetConnectionInfo', {}],
+    ['GetFeatures', {}],
+    ['GetInstalledComponents', {}]
+  ]) {
+    const result = await client.request('tools/call', { name: `${prefix}${tool}`, arguments: args });
+    assert.notEqual(result.isError, true, `${tool} returned an MCP tool error: ${textPayload(result)}`);
+  }
+
+  const query = await client.request('tools/call', {
+    name: `${prefix}RunQuery`,
+    arguments: { sql_query: 'SELECT * FROM T000', max_rows: 1 }
+  });
+  assert.notEqual(query.isError, true, `RunQuery returned an MCP tool error: ${textPayload(query)}`);
+  assert.match(textPayload(query), /T000|MANDT|client|rows|\[/iu);
+
+  const appLog = await client.request('tools/call', {
+    name: `${prefix}GetApplicationLog`,
+    arguments: { max_results: 1 }
+  });
+  assert.notEqual(appLog.isError, true, `GetApplicationLog returned an MCP tool error: ${textPayload(appLog)}`);
+});

package/test/mcp-config-cf.test.mjs

@@ -100,6 +100,17 @@ test('builds SAP development companion MCP entries', () => {
   assert.throws(() => buildSapDevelopmentMcpEntries(['missing-tool']), /Unknown SAP development MCP server id/);
 });
 
+test('configures the HANA inspector without persisting credentials', () => {
+  const entry = buildSapDevelopmentMcpEntries(['hana-cloud-inspector'])['hana-cloud-inspector'];
+  assert.equal(entry.command, 'npx');
+  assert.deepEqual(entry.args, ['--yes', '--ignore-scripts', '--package=sap-ai-dev-toolkit', 'sap-ai-hana']);
+  assert.equal(entry.BAS_EXT_KIND, 'sap-development-companion');
+  assert.equal(entry.displayName, 'HANA Cloud inspector');
+  assert.equal(entry.env, undefined);
+  assert.doesNotMatch(JSON.stringify(entry), /"(?:HANA_RO_PASSWORD|VCAP_SERVICES)"\s*:/);
+  assert.doesNotMatch(JSON.stringify(entry), /"(?:password|pwd)"\s*:/i);
+});
+
 test('installs and removes SAP development companion entries', async t => {
   const directory = await mkdtemp(join(tmpdir(), 'bas-mcp-tools-config-'));
   const path = join(directory, 'mcp.json');
@@ -120,6 +131,35 @@ test('installs and removes SAP development companion entries', async t => {
   assert.deepEqual(Object.keys(cleared.servers), ['userServer']);
 });
 
+test('installs and removes the HANA inspector without changing unrelated MCP servers', async t => {
+  const directory = await mkdtemp(join(tmpdir(), 'bas-mcp-hana-config-'));
+  const path = join(directory, 'mcp.json');
+  const initial = {
+    custom: true,
+    servers: { userServer: { type: 'stdio', command: 'custom-server' } }
+  };
+  await writeFile(path, JSON.stringify(initial));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+
+  const installed = await installMcpConfig([], {
+    env: { H2O_URL: 'http://h2o.example' },
+    path,
+    sapDevelopmentServers: ['hana-cloud-inspector']
+  });
+  assert.deepEqual(Object.keys(installed.servers), ['hana-cloud-inspector']);
+  const configured = await readMcpConfig(path);
+  assert.deepEqual(Object.keys(configured.servers).sort(), ['hana-cloud-inspector', 'userServer']);
+  assert.equal(configured.custom, true);
+  assert.equal(configured.servers['hana-cloud-inspector'].env, undefined);
+  assert.doesNotMatch(JSON.stringify(configured), /"(?:HANA_RO_PASSWORD|VCAP_SERVICES)"\s*:/);
+  assert.doesNotMatch(JSON.stringify(configured), /"(?:password|pwd)"\s*:/i);
+
+  await installMcpConfig([], { env: { H2O_URL: 'http://h2o.example' }, path });
+  const removed = await readMcpConfig(path);
+  assert.deepEqual(removed.servers, initial.servers);
+  assert.equal(removed.custom, true);
+});
+
 test('installs and removes CF entries without deleting unrelated MCP servers', async t => {
   const directory = await mkdtemp(join(tmpdir(), 'bas-mcp-cf-config-'));
   const path = join(directory, 'mcp.json');

package/test/mcp-proxy.test.mjs

@@ -5,24 +5,13 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { once } from 'node:events';
-import { childArguments, MCPProxy } from '../src/mcp-proxy.mjs';
+import { childArguments, MCPProxy, PUBLIC_VSP_TOOLS } from '../src/mcp-proxy.mjs';
 import { PassThrough } from 'node:stream';
 
 const fixture = fileURLToPath(new URL('./fixtures/fake-vsp.mjs', import.meta.url));
-const REQUESTED_TOOLS = [
-  'AnalyzeABAPCode', 'AnalyzeCallGraph', 'CodeCompletion', 'GetAbapHelp',
-  'GetCallGraph', 'GetCalleesOf', 'GetCallersOf', 'GetCodeCoverage',
-  'GetConnectionInfo', 'GetObjectStructure', 'GetTypeHierarchy', 'GetTypeInfo',
-  'GrepObject', 'GrepPackage', 'CallRFC', 'DebuggerAttach', 'DebuggerDetach',
-  'DebuggerGetStack', 'DebuggerGetVariables', 'DebuggerListen', 'DebuggerStep',
-  'DeleteBreakpoint', 'GetBreakpoints', 'GetDump', 'GetSQLTraceState', 'GetTrace',
-  'ListDumps', 'SetBreakpoint', 'CloneObject', 'CreateAndActivateProgram',
-  'CreateClassWithTests', 'CreateObject', 'CreateTestInclude', 'DeleteObject',
-  'ExecuteABAP', 'GetClass', 'GetClassComponents', 'GetClassInclude', 'GetFunction',
-  'GetInclude', 'GetInterface', 'GetProgram', 'GetStructure', 'GetTransaction',
-  'LockObject', 'MoveObject', 'RecoverFailedCreate', 'RenameObject', 'SaveToFile',
-  'UnlockObject', 'UpdateClassInclude', 'UpdateSource', 'WriteClass', 'WriteProgram',
-  'CreateTransport', 'ListDependencies', 'PublishServiceBinding', 'UnpublishServiceBinding'
+const HIDDEN_VSP_TOOLS = [
+  'AnalyzeABAPCode', 'DebuggerListen', 'DeleteBreakpoint', 'DeleteObject', 'ExecuteABAP', 'ReleaseTransport',
+  'DeleteTransport', 'SAP', 'ListSQLTraces', 'PublishServiceBinding', 'UnpublishServiceBinding'
 ];
 
 
@@ -166,22 +155,23 @@ test('merges paged tools and routes calls to the selected child', async t => {
   assert.deepEqual(lintTool.inputSchema.required, ['files']);
   assert.deepEqual(lintTool.inputSchema.properties.files.items.required, ['filename', 'source']);
 
+  const localWorkflowTools = [
+    'LintABAP', 'GetApplicationLog', 'PrepareABAPChangeSet', 'ApplyABAPChangeSet',
+    'CheckTransportReadiness', 'PlanABAPCloudMigration', 'GenerateRAPRegressionSuite', 'RunRAPRegressionSuite'
+  ];
   for (const destination of ['alpha', 'beta']) {
-    for (const toolName of REQUESTED_TOOLS) {
-      assert.ok(names.has(`${destination}__${toolName}`), `${destination} exposes ${toolName}`);
+    for (const toolName of PUBLIC_VSP_TOOLS) {
+      assert.ok(names.has(`${destination}__${toolName}`), `${destination} exposes curated ${toolName}`);
     }
-    for (const coreTool of [
-      'GetSource', 'RunQuery', 'GetSystemInfo', 'GetInstalledComponents',
-      'GetFeatures', 'GetAPIReleaseState', 'PrettyPrint', 'ListTransports',
-      'GetTransport', 'GetUserTransports', 'GetTransportInfo',
-      'GetApplicationLog', 'ActivateMultiple'
-    ]) {
-      assert.ok(names.has(`${destination}__${coreTool}`), `${destination} exposes ${coreTool}`);
+    for (const toolName of localWorkflowTools) {
+      assert.ok(names.has(`${destination}__${toolName}`), `${destination} exposes local ${toolName}`);
     }
-    for (const formerlyExcludedTool of ['ListSQLTraces', 'ReleaseTransport', 'DeleteTransport', 'SAP']) {
-      assert.ok(names.has(`${destination}__${formerlyExcludedTool}`), `${destination} exposes ${formerlyExcludedTool}`);
+    for (const hiddenTool of HIDDEN_VSP_TOOLS) {
+      assert.equal(names.has(`${destination}__${hiddenTool}`), false, `${destination} hides ${hiddenTool}`);
     }
   }
+  assert.equal(listed.result.tools.filter(tool => tool.name.startsWith('alpha__')).length, PUBLIC_VSP_TOOLS.size + localWorkflowTools.length);
+  assert.equal(PUBLIC_VSP_TOOLS.size + localWorkflowTools.length, 59);
 
   const requiredArguments = {
     GetFeatures: [],
@@ -234,11 +224,7 @@ test('merges paged tools and routes calls to the selected child', async t => {
       params: { type: 'delete' }
     }],
     ['ActivateMultiple', { objects: ['PROG ZDEMO'] }],
-    ['CreateTransport', {}],
-    ['ReleaseTransport', {}],
-    ['DeleteTransport', {}],
-    ['ListSQLTraces', {}],
-    ['SAP', { action: 'analyze', params: { type: 'application_log' } }]
+    ['CreateTransport', {}]
   ];
   for (const [index, [name, arguments_]] of additionalCalls.entries()) {
     const response = await proxy.handle({

package/test/setup-cf.test.mjs

@@ -6,6 +6,8 @@ import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { installMcpConfig } from '../src/mcp-config.mjs';
 import { destinationTable } from '../scripts/postinstall.mjs';
+import { readCredentials, resolveCredentialsPath, storeDestinationCredentials } from '../src/credentials-store.mjs';
+import { credentialKeyForDestination } from '../src/credential-overrides.mjs';
 import { spawnWithPty } from './pty.mjs';
 
 const setupModule = fileURLToPath(new URL('../src/setup.mjs', import.meta.url));
@@ -28,6 +30,22 @@ function cloudFoundryDestination({ name, serverName, instanceGuid, instanceName,
   };
 }
 
+function cloudFoundryOnPremiseDestination() {
+  const destination = cloudFoundryDestination({
+    name: 'shared-name',
+    serverName: 'cf:space-one:cf-destination:shared-name',
+    instanceGuid: 'cf-destination',
+    instanceName: 'destination-service',
+    keyName: 'destination-key'
+  });
+  destination.authentication = 'BasicAuthentication';
+  destination.proxyType = 'OnPremise';
+  destination.cf.connectivityInstanceGuid = 'cf-connectivity';
+  destination.cf.connectivityInstanceName = 'connectivity-service';
+  destination.cf.connectivityKeyName = 'connectivity-key';
+  return destination;
+}
+
 async function makeFixture(t, { version = 'cf version 8.18.0', space = 'space-one', deleteMode = 'success' } = {}) {
   const directory = await mkdtemp(join(tmpdir(), 'bas-cf-setup-'));
   const bin = join(directory, 'bin');
@@ -63,6 +81,7 @@ await runSetup({
     await writeFile(process.env.CF_DISCOVERY_LOG, JSON.stringify({ spaceGuid, managedKeys }));
     return JSON.parse(process.env.TEST_CF_RESULT);
   },
+  verifyOnPremCredentialRoute: async () => JSON.parse(process.env.TEST_ONPREM_CSRF_RESULT),
   ...(process.env.TEST_INSTALL_FAIL === 'true' ? {
     install: async () => { throw new Error('simulated config write failure'); }
   } : {})
@@ -81,13 +100,14 @@ await runSetup({
     TEST_CF_DELETE_MODE: deleteMode,
     TEST_INSTALL_FAIL: 'false',
     TEST_BAS_DESTINATIONS: JSON.stringify([]),
-    TEST_CF_RESULT: JSON.stringify({ destinations: [], createdKeys: [], warnings: [] })
+    TEST_CF_RESULT: JSON.stringify({ destinations: [], createdKeys: [], warnings: [] }),
+    TEST_ONPREM_CSRF_RESULT: JSON.stringify({ httpStatus: 200, tokenReceived: true, cookieCount: 1 })
   };
   t.after(() => rm(directory, { recursive: true, force: true }));
   return { directory, configPath, callLog, discoveryLog, harness, env };
 }
 
-function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r' } = {}) {
+function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r', promptAnswers = [] } = {}) {
   return new Promise((resolve, reject) => {
     const command = `${JSON.stringify(process.execPath)} ${JSON.stringify(fixture.harness)}`;
     const child = spawnWithPty(command, { env: fixture.env, stdio: ['pipe', 'pipe', 'pipe'] });
@@ -95,6 +115,7 @@ function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r' } = {}
     let stderr = '';
     let importSent = false;
     let selectionSent = false;
+    let promptAnswerIndex = 0;
     const timeout = setTimeout(() => child.kill('SIGKILL'), 15000);
     child.stdout.on('data', chunk => {
       stdout += chunk.toString();
@@ -104,7 +125,16 @@ function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r' } = {}
       }
       if (!selectionSent && stdout.includes('Select destinations')) {
         selectionSent = true;
-        child.stdin.end(selection);
+        if (promptAnswers.length) child.stdin.write(selection);
+        else child.stdin.end(selection);
+      }
+      if (selectionSent && promptAnswerIndex < promptAnswers.length) {
+        const answer = promptAnswers[promptAnswerIndex];
+        if (stdout.includes(answer.when)) {
+          promptAnswerIndex++;
+          child.stdin.write(answer.value);
+          if (promptAnswerIndex === promptAnswers.length) child.stdin.end();
+        }
       }
     });
     child.stderr.on('data', chunk => { stderr += chunk.toString(); });
@@ -114,7 +144,7 @@ function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r' } = {}
     });
     child.on('exit', (code, signal) => {
       clearTimeout(timeout);
-      resolve({ code, signal, stdout, stderr, importSent, selectionSent });
+      resolve({ code, signal, stdout, stderr, importSent, selectionSent, promptAnswersSent: promptAnswerIndex });
     });
   });
 }
@@ -145,6 +175,7 @@ test('imports selected CF destinations, passes managed key references, and remov
   assert.equal(result.selectionSent, true, result.stdout);
   assert.match(result.stdout, /CF new-destination-service/);
   assert.match(result.stdout, /Configured 1 MCP server/);
+  assert.match(result.stdout, /GitHub Copilot Chat.*Chat tools picker.*enable each selected destination server/s);
   assert.doesNotMatch(`${result.stdout}\n${result.stderr}`, /SECRET|clientSecret|Password/);
 
   const snapshot = JSON.parse(await readFile(fixture.discoveryLog, 'utf8'));
@@ -163,6 +194,102 @@ test('imports selected CF destinations, passes managed key references, and remov
   assert.equal(calls.some(args => args.at(-1) === 'new-key'), false);
 });
 
+test('prompts for BAS and CF OnPremise overrides separately and keeps their routes distinct', async t => {
+  const fixture = await makeFixture(t);
+  const cfDestination = cloudFoundryOnPremiseDestination();
+  fixture.env.TEST_BAS_DESTINATIONS = JSON.stringify([
+    {
+      name: 'internet-system', url: 'http://internet-system.dest', backendUrl: 'https://internet.example:44300',
+      client: '100', authentication: 'BasicAuthentication', proxyType: 'Internet',
+      probe: { status: 'available', available: true }
+    },
+    {
+      name: 'shared-name', url: 'http://shared-name.dest', backendUrl: 'https://internal.example:44300',
+      client: '101', authentication: 'BasicAuthentication', proxyType: 'OnPremise',
+      probe: { status: 'available', available: true }
+    },
+    {
+      name: 'principal-system', url: 'http://principal-system.dest',
+      client: '102', authentication: 'PrincipalPropagation', proxyType: 'OnPremise',
+      probe: { status: 'available', available: true }
+    }
+  ]);
+  fixture.env.TEST_CF_RESULT = JSON.stringify({ destinations: [cfDestination], createdKeys: [], warnings: [] });
+
+  const result = await runSetupInPty(fixture, {
+    selection: 'a\r',
+    promptAnswers: [
+      { when: 'BAS Internet — internet-system — override SAP credentials?', value: 'y\r' },
+      { when: 'BAS Internet — internet-system — SAP user', value: 'INTERNET_USER\r' },
+      { when: 'BAS Internet — internet-system — SAP password', value: 'internet-password-secret\r' },
+      { when: 'BAS OnPremise — shared-name — override SAP credentials?', value: 'y\r' },
+      { when: 'BAS OnPremise — shared-name — SAP user', value: 'BAS_CC_USER\r' },
+      { when: 'BAS OnPremise — shared-name — SAP password', value: 'bas-cc-password-secret\r' },
+      { when: 'Cloud Foundry OnPremise — shared-name — override SAP credentials?', value: 'y\r' },
+      { when: 'Cloud Foundry OnPremise — shared-name — SAP user', value: 'CF_CC_USER\r' },
+      { when: 'Cloud Foundry OnPremise — shared-name — SAP password', value: 'cf-cc-password-secret\r' }
+    ]
+  });
+  assert.equal(result.code, 0, `${result.stdout}\n${result.stderr}`);
+  assert.equal(result.promptAnswersSent, 9, result.stdout);
+  assert.doesNotMatch(result.stdout, /PrincipalPropagation — principal-system — override SAP credentials/);
+  assert.doesNotMatch(`${result.stdout}\n${result.stderr}`, /internet-password-secret|bas-cc-password-secret|cf-cc-password-secret/);
+
+  const credentialsPath = await resolveCredentialsPath(fixture.env, fixture.configPath);
+  const stored = (await readCredentials(credentialsPath)).destinations;
+  assert.equal(stored['internet-system'].mode, 'direct');
+  assert.equal(stored['internet-system'].host, 'https://internet.example:44300');
+  assert.equal(stored['shared-name'].mode, 'bas-tunnel');
+  assert.equal(stored['shared-name'].host, undefined, 'BAS OnPremise must not store or use the backend URL');
+  const cfKey = credentialKeyForDestination(cfDestination);
+  assert.equal(stored[cfKey].mode, 'cf-connectivity');
+  assert.equal(stored[cfKey].host, undefined);
+  assert.deepEqual(
+    [stored['shared-name'].user, stored[cfKey].user],
+    ['BAS_CC_USER', 'CF_CC_USER'],
+    'same destination names from BAS and CF must remain distinct'
+  );
+
+  const mcpConfig = JSON.parse(await readFile(fixture.configPath, 'utf8'));
+  assert.equal(JSON.stringify(mcpConfig).includes('bas-cc-password-secret'), false);
+  assert.equal(JSON.stringify(mcpConfig).includes('cf-cc-password-secret'), false);
+});
+
+test('No removes a stored BAS OnPremise override and failed CSRF preflight refuses a new one', async t => {
+  const fixture = await makeFixture(t);
+  fixture.env.TEST_BAS_DESTINATIONS = JSON.stringify([{
+    name: 'shared-name', url: 'http://shared-name.dest', backendUrl: 'https://internal.example:44300',
+    client: '100', authentication: 'BasicAuthentication', proxyType: 'OnPremise',
+    probe: { status: 'available', available: true }
+  }]);
+  fixture.env.TEST_CF_RESULT = JSON.stringify({ destinations: [], createdKeys: [], warnings: [] });
+  const credentialsPath = await resolveCredentialsPath(fixture.env, fixture.configPath);
+  await storeDestinationCredentials(credentialsPath, 'shared-name', {
+    user: 'OLD_USER', password: 'old-password-secret', mode: 'bas-tunnel'
+  });
+
+  const declined = await runSetupInPty(fixture, {
+    selection: ' \r',
+    promptAnswers: [{ when: 'BAS OnPremise — shared-name — override SAP credentials?', value: 'n\r' }]
+  });
+  assert.equal(declined.code, 0, `${declined.stdout}\n${declined.stderr}`);
+  assert.equal((await readCredentials(credentialsPath)).destinations['shared-name'], undefined);
+
+  fixture.env.TEST_ONPREM_CSRF_RESULT = JSON.stringify({ httpStatus: 200, tokenReceived: true, cookieCount: 0 });
+  const rejected = await runSetupInPty(fixture, {
+    selection: ' \r',
+    promptAnswers: [
+      { when: 'BAS OnPremise — shared-name — override SAP credentials?', value: 'y\r' },
+      { when: 'BAS OnPremise — shared-name — SAP user', value: 'NEW_USER\r' },
+      { when: 'BAS OnPremise — shared-name — SAP password', value: 'new-password-secret\r' }
+    ]
+  });
+  assert.equal(rejected.code, 0, `${rejected.stdout}\n${rejected.stderr}`);
+  assert.match(rejected.stdout, /did not return both a CSRF token and session cookie/);
+  assert.equal((await readCredentials(credentialsPath)).destinations['shared-name'], undefined);
+  assert.doesNotMatch(`${rejected.stdout}\n${rejected.stderr}`, /new-password-secret/);
+});
+
 test('declining CF import keeps BAS setup and does not create CF keys', async t => {
   const fixture = await makeFixture(t);
   fixture.env.TEST_BAS_DESTINATIONS = JSON.stringify([{

package/test/setup.test.mjs

@@ -70,7 +70,7 @@ function runPostinstallInPty(env, keys, assetsAnswer = '\r') {
         selectionSent = true;
         child.stdin.write(keys);
       }
-      if (!assetsAnswerSent && stdout.includes('Install the bundled agents and eleven skills')) {
+      if (!assetsAnswerSent && stdout.includes('Install the bundled agents and all skills')) {
         assetsAnswerSent = true;
         child.stdin.write(assetsAnswer);
       }
@@ -90,6 +90,7 @@ function runPostinstallInPty(env, keys, assetsAnswer = '\r') {
 async function assertUserCopilotAssets(home) {
   const copilotRoot = join(home, '.copilot');
   assert.equal((await stat(join(copilotRoot, 'agents', 'abap-developer.agent.md'))).isFile(), true);
+  assert.equal((await stat(join(copilotRoot, 'agents', 'hana-cloud-hdi-specialist.agent.md'))).isFile(), true);
   const skillNames = (await readdir(join(copilotRoot, 'skills'))).sort();
   assert.deepEqual(skillNames, [
     'abap-debugging',
@@ -98,6 +99,9 @@ async function assertUserCopilotAssets(home) {
     'abap-testing-quality',
     'cds-development',
     'clean-core-extensibility',
+    'hana-cloud-inspection',
+    'hana-cloud-native-development',
+    'hana-cloud-validation',
     'rap-development',
     'rap-service-delivery',
     'sap-sdlc-orchestration',
@@ -279,13 +283,13 @@ test('global postinstall completes BAS selection before optional Copilot assets'
   const declineLogs = `${declined.stdout}\n${declined.stderr}`;
   assert.match(declineLogs, /Configured 0 MCP servers/);
   assert.match(declineLogs, /\[Y\/n\]/);
-  assert.match(declineLogs, /Press Enter to install the bundled agents and eleven skills in the path shown below; type n then press Enter to skip/);
+  assert.match(declineLogs, /Press Enter to install the bundled agents and all skills in the path shown below; type n then press Enter to skip/);
   assert.match(declineLogs, /🤖 sap-ai-dev-toolkit/);
   assert.match(declineLogs, /\u001b\[1;35m/);
   assert.match(declineLogs, /Optional Copilot setup is waiting for your choice/);
   assert.match(declineLogs, /Copilot agent and skills were skipped\. Your files were not changed/);
   assert.ok(declineLogs.indexOf('Optional Copilot setup is waiting for your choice') > declineLogs.indexOf('Configured 0 MCP servers'), declineLogs);
-  assert.ok(declineLogs.indexOf('Install the bundled agents and eleven skills') > declineLogs.indexOf('Optional Copilot setup is waiting for your choice'), declineLogs);
+  assert.ok(declineLogs.indexOf('Install the bundled agents and all skills') > declineLogs.indexOf('Optional Copilot setup is waiting for your choice'), declineLogs);
   assert.ok(declineLogs.indexOf('No MCP server entries are configured for this add-on.') > declineLogs.indexOf('Copilot agent and skills were skipped'), declineLogs);
   assert.ok(declineLogs.includes(`MCP config file: ${config}`), declineLogs);
   const configAfterDecline = JSON.parse(await readFile(config, 'utf8'));
@@ -297,9 +301,9 @@ test('global postinstall completes BAS selection before optional Copilot assets'
   assert.equal(accepted.selectionSent, true, accepted.stdout);
   assert.equal(accepted.assetsAnswerSent, true, accepted.stdout);
   const acceptLogs = `${accepted.stdout}\n${accepted.stderr}`;
-  assert.ok(acceptLogs.indexOf('Install the bundled agents and eleven skills') > acceptLogs.indexOf('Configured 1 MCP server'), acceptLogs);
-  assert.match(acceptLogs, /Installed 15 Copilot files/);
-  assert.ok(acceptLogs.indexOf('Installation configuration summary') > acceptLogs.indexOf('Installed 15 Copilot files'), acceptLogs);
+  assert.ok(acceptLogs.indexOf('Install the bundled agents and all skills') > acceptLogs.indexOf('Configured 1 MCP server'), acceptLogs);
+  assert.match(acceptLogs, /Installed 19 Copilot files/);
+  assert.ok(acceptLogs.indexOf('Installation configuration summary') > acceptLogs.indexOf('Installed 19 Copilot files'), acceptLogs);
   assert.ok(acceptLogs.includes(`MCP config file: ${config}`), acceptLogs);
   assert.ok(acceptLogs.includes('Destination: BAS · alpha-system · client 100 · Basic'), acceptLogs);
   assert.ok(acceptLogs.includes('Launch: stdio · sap-ai-dev'), acceptLogs);