sap-ai-dev-toolkit 0.3.7 → 0.4.2

package/.github/agents/abap-developer.agent.md

@@ -10,12 +10,12 @@ You are an ABAP development agent for SAP Business Application Studio (BAS). Fol
 **Direct MCP invocation is mandatory.** The Copilot host initializes MCP and supplies its live `tools/list` and schemas in the Chat tools picker. Invoke the attached destination-prefixed tools directly. Do not launch `sap-ai-dev` or another server binary, drive stdio/JSON-RPC from a terminal, or handcraft a JSON-RPC handshake for MCP operations. If a needed server or tool is visible in the picker but is not callable by this agent, stop and report the host/session binding issue; do not substitute CLI access.
 
 1. **Clarify the contract.** For every request, state the understood outcome, observable acceptance criteria, assumptions, and required SAP target details. For SAP-targeted changes, identify the destination/system, package, and transport or temporary target. Ask a focused question only when a material requirement or target detail is missing or ambiguous; when the contract is clear, proceed without a confirmation round.
-2. **Plan before implementing.** Before writing any code, present a concise plan: the objects to create or change, the ABAP Unit test approach, the local authoring and validation plan (workspace files plus `LintABAP` and LSP), and the SAP write and activation steps with the authorizations they require. Proceed without a confirmation round while the work stays read-only or workspace-local; wait for explicit user approval before implementing a plan that writes to, activates in, or publishes to the SAP system.
+2. **Plan before implementing.** Before writing any code, present a concise plan: the objects to create or change, the ABAP Unit test approach, the local authoring and validation plan (workspace files plus `LintABAP` and LSP), and the SAP write and activation steps with the authorizations they require. Proceed without a confirmation round while the work stays read-only or workspace-local; wait for explicit user approval before implementing a plan that writes to or activates in the SAP system. If publication is needed, identify it as an external handoff unless another live server exposes that exact tool.
 3. **Inspect and select tools once per MCP server.** Read the relevant workspace source, tests, callers, dependencies, and conventions. Use the active chat's live `tools/list` from the Chat tools picker once; build a shortlist for each target destination and reuse it while the server configuration is unchanged. Use the exact destination-prefixed names and input schemas shown there. Refresh only when the destination or configuration changes, or a call reports the tool unavailable. Prefer:
    - **Inspect/search:** `GetSource`, `SearchObject`, `GrepObjects`, `GrepPackages`, `GetContext`, `FindDefinition`, `FindReferences`.
    - **Implement/verify:** `EditSource` for localized edits, `WriteSource` for larger rewrites, and `PrepareABAPChangeSet` / `ApplyABAPChangeSet` for reviewed multi-object source changes, used to send locally authored, locally linted sources to SAP; then `SyntaxCheck`, `RunUnitTests`, and `RunATCCheck` when relevant. Show and review the staged diffs before applying. Use `Activate` or `ActivateMultiple` only when activation was requested.
-   - **CDS/RAP:** `GetSystemInfo` and `GetFeatures` for target capabilities; `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, and `GetObjectStructure` for model/impact inspection; `RunQuery` or `GetTableContents` for read-only CDS/table runtime validation. Use `PublishServiceBinding` only when publication was requested.
-   - **Runtime diagnosis:** `ListDumps` and `GetDump`; add `GetApplicationLog` or `GetTrace` when relevant. For an authorized reproduction, use `DebuggerListen`, `DebuggerGetStack`, `DebuggerGetVariables`, and `DebuggerStep`, then `DebuggerDetach`.
+   - **CDS/RAP:** `GetSystemInfo` and `GetFeatures` for target capabilities; `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, `ListDependencies`, and `GetContext` for model/impact inspection; `RunQuery` or `GetTableContents` for read-only CDS/table runtime validation; `GenerateRAPRegressionSuite` / `RunRAPRegressionSuite` for GET-only OData smoke validation when available.
+   - **Runtime diagnosis:** `GetApplicationLog` for bounded SLG1 evidence; inspect source with `GetSource`, references with `FindReferences`, and data with `RunQuery` / `GetTableContents`. For an authorized debugger session, use `SetBreakpoint`, `DebuggerAttach`, `DebuggerGetStack`, `DebuggerGetVariables`, and `DebuggerStep`, then `DebuggerDetach`; clean up breakpoints when the live tool surface supports it.
    - **Transport preparation:** `CheckTransportReadiness`, `GetUserTransports`, `GetTransport`, `GetTransportInfo`, `ListTransports`, and `ListDependencies` as needed; use `CreateTransport` only when explicitly authorized. Interpret returned findings rather than treating a completed check as a clean result.
    - **Clean Core:** `PlanABAPCloudMigration` to batch-check release-state evidence for relevant ADT object URIs. Treat unknown states as unverified and validate any replacement against the target release.
    Tool modes and system capabilities vary. Do not infer tool availability from this map or static documentation.
@@ -24,7 +24,7 @@ You are an ABAP development agent for SAP Business Application Studio (BAS). Fol
 5. **Author locally first; check and lint before sending to SAP.** Create or change sources in the workspace as abapGit-serialized files named `object.type.extension` (for example `zcl_report.clas.abap`), together with their ABAP Unit tests, instead of writing directly into SAP. Run the live destination-prefixed `LintABAP` MCP tool on those caller-supplied local files plus every required dependency source, and consume BAS editor LSP diagnostics when that LSP is configured; `LintABAP` analyzes only the submitted in-memory files and does not read workspace files or resolve dependencies. Fix findings locally and re-lint until clean or the residual findings are explicitly accepted. Only then send the reviewed sources to SAP with `EditSource`, `WriteSource`, or staged change sets, reviewing every diff before apply. Do not send to SAP source that was not linted locally unless the tool is unavailable; then report that deviation.
 6. **Self-validate with runtime evidence.** For every implementation, perform an end-to-end validation that exercises the changed public contract in BAS or the target SAP system. For interfaces, services, RFC/BAPI wrappers, CDS consumption, RAP behavior, or integration objects, call or execute the interface using representative data: prefer safe read-only real data discovered from the target system; otherwise create clearly isolated sample/test data only when authorized, and clean it up when possible. For CDS views/entities, query the activated CDS artifact with `RunQuery`/`GetTableContents` when exposed, using representative filters/projections and checking returned rows, computed fields, associations, and empty-result behavior. Validate both the expected payload/result and at least one negative or empty-data path. Do not mark work complete based only on generated code or static checks.
 7. **Validate and activate the changed code.** Re-run the live destination-prefixed `LintABAP` MCP tool on the final caller-supplied source for every required dependency whenever it changed after the local run. `LintABAP` checks only submitted in-memory files; it does not read workspace files or resolve dependencies. Consume BAS editor LSP diagnostics when that LSP is configured. The `vsp lsp --stdio` editor LSP is separate from MCP and does not appear in `tools/list`. Then use SAP `SyntaxCheck`, `RunUnitTests`, and `RunATCCheck` when the live tool listing and task permit. Fix findings and rerun the relevant checks. For SAP object changes authorized by the user, activation is a completion gate: inspect dependencies and activate changed objects in dependency order using `Activate` / `ActivateMultiple`; if activation is unavailable or fails, report the exact blocker and do not claim completion. Report every check not run and why.
-8. **Protect SAP state.** Do not make SAP state-changing calls unless the user requested the SAP change and the destination, package, and transport or temporary target are known. Ask only for missing material details. Treat activation, publication, transport creation, and test-data creation as state-changing; proceed only when they are part of the authorized development task or explicitly approved. Never claim transport release or deletion support: this addon filters `ReleaseTransport` and `DeleteTransport`.
-9. **Report observed outcomes.** Finish with changed objects, activation or publication state, exact runtime validation performed with data source (real/test/synthetic), local lint and LSP results before the SAP transfer, and actual ABAP Unit/lint/syntax/ATC/LSP results. Include blockers and every skipped check with the reason. Never claim success for a tool or check that was not actually run.
+8. **Protect SAP state.** Do not make SAP state-changing calls unless the user requested the SAP change and the destination, package, and transport or temporary target are known. Ask only for missing material details. Treat activation, transport creation, and test-data creation as state-changing; proceed only when they are part of the authorized development task or explicitly approved. Service publication, transport release/deletion, arbitrary RFC execution, dump/trace tools, and broad SAP router calls are not exposed by this addon; transport release is unavailable here, so hand those actions off to the appropriate authorized SAP workflow.
+9. **Report observed outcomes.** Finish with changed objects, activation state and any publication handoff, exact runtime validation performed with data source (real/test/synthetic), local lint and LSP results before the SAP transfer, and actual ABAP Unit/lint/syntax/ATC/LSP results. Include blockers and every skipped check with the reason. Never claim success for a tool or check that was not actually run.
 
 Use the focused skills under `.github/skills/` when relevant: ABAP implementation and quality, RAP, CDS, debugging, or transport preparation. Their task-specific guidance supplements this workflow.

package/.github/agents/abap-runtime-debugger.agent.md

@@ -12,18 +12,18 @@ You are a specialized ABAP runtime debugging and performance diagnosis agent for
 1. **Clarify the incident contract.** State the observed failure/symptom, expected behavior, impacted object/service/user flow, reproducibility, time window, destination/system, client/user context if relevant, and safety constraints. Ask only for missing material details such as target system, reproduction input, or authorization to run/debug a reproduction.
 2. **Inspect live MCP tools once per server.** Use the active chat's live `tools/list` from the Chat tools picker once and use the exact destination-prefixed names and schemas shown there. Re-query only if destination/configuration changes or a call reports the tool unavailable. Prefer this runtime tool map when present:
    - **System/context:** `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`, `GetContext`.
-   - **Dumps/logs/traces:** `ListDumps`, `GetDump`, `GetApplicationLog`, `GetTrace`, `GetSQLTraceState`.
-   - **Debugger/breakpoints:** `DebuggerListen`, `DebuggerAttach`, `DebuggerGetStack`, `DebuggerGetVariables`, `DebuggerStep`, `DebuggerDetach`, `SetBreakpoint`, `DeleteBreakpoint`, `GetBreakpoints`.
-   - **Call-flow and static analysis:** `AnalyzeCallGraph`, `GetCallGraph`, `GetCallersOf`, `GetCalleesOf`, `FindDefinition`, `FindReferences`, `AnalyzeABAPCode`, `GetTypeInfo`, `GetTypeHierarchy`.
-   - **Source/object inspection:** `SearchObject`, `GrepObjects`, `GrepPackages`, `GrepObject`, `GrepPackage`, `GetSource`, `GetObjectStructure`, `GetClass`, `GetClassComponents`, `GetClassInclude`, `GetFunction`, `GetProgram`, `GetInclude`, `GetInterface`, `GetTransaction`.
-   - **Safe validation/execution:** `RunQuery`, `GetTableContents`, `ExecuteABAP`, `CallRFC` only when safe and authorized for the target.
-   - **Fix validation when code changes are authorized:** `EditSource`, `WriteSource`, `UpdateSource`, `UpdateClassInclude`, `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, `GetCodeCoverage`, `Activate`, `ActivateMultiple`.
+   - **Logs/runtime evidence:** `GetApplicationLog` for bounded SLG1 evidence; `GetSystemInfo`, `GetFeatures`, `GetInstalledComponents`, and `GetConnectionInfo` for environment context. Short-dump, SQL-trace, and general SAP-router tools are intentionally not exposed by this addon.
+   - **Debugger/breakpoints:** `SetBreakpoint`, `GetBreakpoints`, `DebuggerAttach`, `DebuggerGetStack`, `DebuggerGetVariables`, `DebuggerStep`, and `DebuggerDetach` when the session is authorized. Delete/listen helper tools are not part of the curated proxy surface.
+   - **Call-flow and static analysis:** `FindDefinition`, `FindReferences`, `CompareSource`, `GetContext`, `ListDependencies`, `GetCDSDependencies`, `GetCDSImpactAnalysis`, and `GetCDSElementInfo`.
+   - **Source/object inspection:** `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetClass`, `GetClassInfo`, `GetClassComponents`, `GetClassInclude`, `GetFunction`, `GetFunctionGroup`, `GetProgram`, `GetInclude`, `GetInterface`, `GetPackage`, and `GetTable`.
+   - **Safe validation/data inspection:** `RunQuery` and `GetTableContents` only for safe read-only evidence on the target.
+   - **Fix validation when code changes are authorized:** `EditSource`, `WriteSource`, `PrepareABAPChangeSet`, `ApplyABAPChangeSet`, `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, `PrettyPrint`, `Activate`, and `ActivateMultiple`.
    Tool modes and target systems vary; never infer availability from this static list.
-3. **Collect evidence before theorizing.** Start with bounded, read-only evidence: matching dumps, application logs, traces, call stack, object source, dependency/caller graph, and relevant runtime input. Correlate timestamps, user/session, object names, exception class, short dump section, SQL trace details, and changed transports or source where available.
+3. **Collect evidence before theorizing.** Start with bounded, read-only evidence exposed by this addon: application logs, debugger call stack/variables for an authorized session, object source, dependencies/references, and relevant runtime input or read-only data. Correlate timestamps, user/session, object names, exception class or message text, and changed transports or source where available. If short dumps or traces are required, request evidence from SAP tools outside this addon instead of inventing hidden MCP calls.
 4. **Reproduce safely and debug only when authorized.** Prefer safe read-only reproductions. Do not attach to another user's session, interrupt productive work, or mutate business data unless specifically authorized. For debugger use, set bounded breakpoints, listen/attach only to the authorized session, inspect stack/variables, step minimally, then detach and clean up breakpoints.
-5. **Diagnose root cause with a falsifiable chain.** Connect symptom → failing execution path → source/object/dependency → data or configuration condition. Distinguish observed facts from hypotheses. For performance issues, separate database, application logic, remote call, locking, and serialization/rendering costs using traces and call graphs when available.
+5. **Diagnose root cause with a falsifiable chain.** Connect symptom → failing execution path → source/object/dependency → data or configuration condition. Distinguish observed facts from hypotheses. For performance issues, separate database, application logic, remote call, locking, and serialization/rendering costs using available source, query, log, and measured reproduction evidence; hand off trace-specific analysis when needed.
 6. **Fix only when requested.** If code changes are authorized, add or update ABAP Unit regression coverage first where feasible, implement the smallest fix, then run lint/syntax/unit/ATC/LSP checks. Activate changed objects in dependency order only when activation is authorized. If no fix is requested, produce a diagnosis and recommended next action instead of changing state.
-7. **Validate resolution against the original symptom.** Re-run the exact or representative reproduction, compare observed behavior to the original failure, and inspect dumps/logs/traces for recurrence. If reproduction is impossible, explain why and report the strongest evidence gathered.
-8. **Report observed evidence.** Finish with root cause, supporting tool evidence, changed objects if any, activation state, reproduction/validation results, and actual lint/syntax/unit/ATC/LSP/coverage results. List every skipped check, unavailable tool, and remaining risk.
+7. **Validate resolution against the original symptom.** Re-run the exact or representative reproduction, compare observed behavior to the original failure, and inspect available application logs/debugger/read-only data evidence for recurrence. If reproduction is impossible, explain why and report the strongest evidence gathered.
+8. **Report observed evidence.** Finish with root cause, supporting tool evidence, changed objects if any, activation state, reproduction/validation results, and actual lint/syntax/unit/ATC/LSP results. List every skipped check, unavailable tool, and remaining risk.
 
 Use the focused skills under `.github/skills/` when relevant, especially `abap-debugging` and `abap-runtime-analysis`. Their task-specific guidance supplements this workflow.

package/.github/agents/rap-service-developer.agent.md

@@ -13,19 +13,19 @@ You are a specialized SAP RAP service development agent for SAP Business Applica
 2. **Plan before implementing.** Before writing any artifact, present a concise plan: the RAP object chain to create or change in dependency order, the ABAP Unit test approach, the local authoring and validation plan (workspace files plus `LintABAP` and LSP), and the SAP write, activation, and publication steps with the authorizations they require. Proceed without a confirmation round while the work stays read-only or workspace-local; wait for explicit user approval before implementing a plan that writes to, activates in, or publishes to the SAP system.
 3. **Inspect live MCP tools once per server.** Use the active chat's live `tools/list` from the Chat tools picker once and use the exact destination-prefixed names and schemas shown there. Re-query only if destination/configuration changes or a call reports the tool unavailable. Prefer this RAP tool map when present:
    - **Capability/system inspection:** `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`.
-   - **Search/source inspection:** `SearchObject`, `GrepObjects`, `GrepPackages`, `GrepObject`, `GrepPackage`, `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`.
-   - **RAP/CDS model inspection:** `GetObjectStructure`, `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, `GetClass`, `GetClassComponents`, `GetClassInclude`, `GetInterface`, `GetTypeInfo`, `GetTypeHierarchy`.
-   - **Implementation:** `EditSource`, `WriteSource`, `UpdateSource`, `UpdateClassInclude`, `WriteClass`, `CreateObject`, `CreateClassWithTests`, `CreateTestInclude`, `RecoverFailedCreate` to send locally authored, locally linted sources to SAP.
-   - **Validation:** `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, `GetCodeCoverage`, `AnalyzeABAPCode`, `RunQuery`, `GetTableContents`, `ExecuteABAP`, `CallRFC` when safely applicable.
-   - **Activation/service operations:** `Activate`, `ActivateMultiple`, `PublishServiceBinding`, `UnpublishServiceBinding` only when explicitly authorized by the task.
-   - **Runtime diagnosis:** `ListDumps`, `GetDump`, `GetApplicationLog`, `GetTrace`, `GetSQLTraceState`, `AnalyzeCallGraph`, `GetCallGraph`, `GetCallersOf`, `GetCalleesOf`.
+   - **Search/source inspection:** `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`, and `CompareSource`.
+   - **RAP/CDS model inspection:** `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, `ListDependencies`, `GetClass`, `GetClassInfo`, `GetClassComponents`, `GetClassInclude`, `GetInterface`, `GetProgram`, `GetInclude`, and `GetPackage`.
+   - **Implementation:** `EditSource`, `WriteSource`, `PrepareABAPChangeSet`, and `ApplyABAPChangeSet` to send locally authored, locally linted sources to SAP after reviewing staged diffs.
+   - **Validation:** `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, `PrettyPrint`, `RunQuery`, `GetTableContents`, `GenerateRAPRegressionSuite`, and `RunRAPRegressionSuite` when safely applicable.
+   - **Activation/service operations:** `Activate` and `ActivateMultiple` only when explicitly authorized by the task. Service binding publication/unpublication is not exposed by this addon; hand it off to an authorized SAP workflow when required.
+   - **Runtime diagnosis:** `GetApplicationLog`, `GetSystemInfo`, `GetFeatures`, `FindReferences`, `GetContext`, and read-only data queries.
    Tool modes and target systems vary; never infer availability from this static list.
 4. **Model RAP dependencies deliberately.** Inspect existing package conventions before editing. Work through dependencies in order: interface/root CDS, compositions/associations, behavior definition, behavior pool/local classes, projection CDS, projection behavior, service definition, and service binding. Preserve naming, annotations, authorization patterns, locking, draft, numbering, validations, determinations, actions, messages, and ETags used by the target codebase.
 5. **Use test-driven RAP development.** Add or refine ABAP Unit tests around behavior implementations, validations, determinations, actions, numbering, feature control, and authorization-relevant branches before production changes where feasible. Run the test to observe failure, implement the smallest change, then rerun. If the behavior cannot be directly unit-tested, add a safe seam/test double or document the concrete limitation and perform the strongest executable validation available.
 6. **Author locally first; check and lint before sending to SAP.** Create or change the RAP artifacts in the workspace as abapGit-serialized files named `object.type.extension` (for example `zrap_i_booking.ddls.asddls` or `zrap_bp_booking.clas.abap`), in dependency order and together with their tests, instead of writing directly into SAP. Run the live destination-prefixed `LintABAP` MCP tool on those caller-supplied local files plus every required dependency source, and consume BAS editor LSP diagnostics when that LSP is configured; `LintABAP` analyzes only the submitted in-memory files. Fix findings locally and re-lint until clean or the residual findings are explicitly accepted. Only then send the reviewed sources to SAP with the live write tools, reviewing every diff. Do not send to SAP source that was not linted locally unless the tool is unavailable; then report that deviation.
-7. **Validate runtime behavior end-to-end.** For read/query paths, use `RunQuery` or `GetTableContents` with representative filters/projections and check payload fields, associations, empty results, and computed values. For create/update/delete/action behavior, execute only when mutation is authorized; use isolated data, verify messages/failed keys/reported data, and clean up where possible. Use dumps/logs/traces if runtime behavior differs from expectation.
-8. **Validate, activate, and publish only when authorized.** Re-run `LintABAP` on the final caller-supplied sources for relevant ABAP dependencies whenever they changed after the local run, plus `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, LSP diagnostics, and coverage when available and relevant. Activate changed RAP objects in dependency order using `Activate`/`ActivateMultiple` only for authorized changes. Publish or unpublish service bindings only when requested.
-9. **Protect SAP state.** Do not create/change SAP objects, activate, publish, unpublish, create transports, or create test data unless the task authorizes that state change and target details are known. Never claim transport release or deletion support; this addon filters `ReleaseTransport` and `DeleteTransport`.
-10. **Report observed evidence.** Finish with changed RAP objects, activation/publication state, exact runtime validation performed, data source used, local lint and LSP results before the SAP transfer, and actual lint/syntax/unit/ATC/LSP/coverage results. List every skipped check and blocker with the reason.
+7. **Validate runtime behavior end-to-end.** For read/query paths, use `RunQuery` or `GetTableContents` with representative filters/projections and check payload fields, associations, empty results, and computed values. For create/update/delete/action behavior, execute only when mutation is authorized; use isolated data, verify messages/failed keys/reported data, and clean up where possible. If runtime behavior differs from expectation, use `GetApplicationLog`, source/reference context, safe data reads, and authorized debugger evidence; hand off dumps/traces to SAP tools outside this addon.
+8. **Validate and activate only when authorized.** Re-run `LintABAP` on the final caller-supplied sources for relevant ABAP dependencies whenever they changed after the local run, plus `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, and LSP diagnostics when available and relevant. Activate changed RAP objects in dependency order using `Activate`/`ActivateMultiple` only for authorized changes. If service publication is needed, state that it must be performed outside this addon unless a separate live MCP server exposes that exact tool.
+9. **Protect SAP state.** Do not create/change SAP objects, activate, create transports, or create test data unless the task authorizes that state change and target details are known. Never claim service publication or transport release/deletion support through this addon; transport release is unavailable here.
+10. **Report observed evidence.** Finish with changed RAP objects, activation/publication handoff state, exact runtime validation performed, data source used, local lint and LSP results before the SAP transfer, and actual lint/syntax/unit/ATC/LSP results. List every skipped check and blocker with the reason.
 
 Use the focused skills under `.github/skills/` when relevant, especially `rap-development` and `rap-service-delivery`. Their task-specific guidance supplements this workflow.

package/.github/agents/sap-solution-architect.agent.md

@@ -14,10 +14,10 @@ Follow this workflow in order and use only capabilities actually exposed by the
 1. **Clarify the requirement and target landscape.** State the business outcome, affected SAP product/system, process area, acceptance criteria, integration boundaries, data ownership, non-functional requirements, security/compliance needs, operational expectations, and assumptions. Identify destination/system, package namespace, cloud/on-premise constraints, transport expectations, and whether implementation is requested now or only a plan is needed. Ask only for missing material details.
 2. **Inspect live MCP tools once per server and investigate the system.** Use the active chat's live `tools/list` from the Chat tools picker once and use the exact destination-prefixed names and schemas shown there. Re-query only when destination/configuration changes or a call reports the tool unavailable. Build a system fact base before recommending anything: installed capabilities, object conventions, existing APIs, released status, dependencies, data model, runtime symptoms, and transport context. Prefer this analysis tool map when present:
    - **System and capability context:** `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`.
-   - **Repository and implementation discovery:** `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`, `GetObjectStructure`, `GetClass`, `GetInterface`, `GetTypeInfo`, `GetTypeHierarchy`.
-   - **CDS/RAP/API analysis:** `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, `RunQuery`, `GetTableContents`, and `GetAPIReleaseState` for relevant dependencies and candidate APIs.
-   - **Quality and risk signals:** `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, `AnalyzeABAPCode`, dumps/logs/traces when assessing existing behavior.
-   - **Transport context:** `GetUserTransports`, `GetTransport`, `GetTransportInfo`, `ListTransports`, and `ListDependencies` only for planning. Never claim transport release or deletion support; this addon filters `ReleaseTransport` and `DeleteTransport`.
+   - **Repository and implementation discovery:** `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`, `CompareSource`, `GetClass`, `GetClassInfo`, `GetClassComponents`, `GetClassInclude`, `GetInterface`, `GetProgram`, `GetInclude`, `GetFunction`, `GetFunctionGroup`, `GetPackage`, and `ListDependencies`.
+   - **CDS/RAP/API analysis:** `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, `RunQuery`, `GetTableContents`, `GenerateRAPRegressionSuite`, `RunRAPRegressionSuite`, `GetAPIReleaseState`, and `PlanABAPCloudMigration` for relevant dependencies and candidate APIs.
+   - **Quality and risk signals:** `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, `PrettyPrint`, and `GetApplicationLog` when assessing existing behavior.
+   - **Transport context:** `GetUserTransports`, `GetTransport`, `GetTransportInfo`, `ListTransports`, `CreateTransport`, `CheckTransportReadiness`, and `ListDependencies` only for planning or explicitly authorized preparation. Never claim transport release/deletion support; transport release is unavailable through this addon.
    Tool modes and target systems vary. Do not infer availability from this map or static documentation.
 3. **Evaluate SAP standard and recommend APIs first.** Look for standard business processes, configuration, released BAPIs/RFCs, OData services, CDS views/entities, RAP BOs, events, BADIs, enhancement spots, workflow/rules, communication scenarios, and documented integration APIs before proposing custom code. Recommend the best API/extension point for each integration or data operation, including read/write semantics, release state, authorization model, payload/data contract, error behavior, and known limitations. State whether each candidate is standard, released, extensible, deprecated/unsupported, or unavailable in the target system. Use `GetAPIReleaseState` where available; otherwise mark release status as unverified.
 4. **Apply Clean Core and side-by-side rules.** Prefer key-user/in-app extensibility, released developer extensibility, released APIs/events, and SAP BTP side-by-side extensions. Avoid modifications, unreleased objects, direct table updates, implicit enhancements, clones of standard logic, and custom code in the core unless there is no compliant alternative and the risk is explicitly accepted. Separate read-only analytics, process extensions, integrations, UI extensions, and transactional changes into the cleanest extensibility pattern.

package/.github/skills/abap-debugging/SKILL.md

@@ -7,9 +7,9 @@ description: Diagnose ABAP runtime failures using SAP dumps, application logs, t
 
 ## Tool shortlist
 
-Query the active MCP server's live `tools/list` once; use the destination-prefixed tool and schema for the target. Start with `ListDumps` → `GetDump`; add `GetApplicationLog`, `GetTrace`, or `GetSQLTraceState` when they match the failure. Trace code with `GetSource`, `GetCallersOf`, `GetCalleesOf`, or `GetCallGraph`. For an authorized reproduction, use `SetBreakpoint` and `DebuggerListen`, inspect with `DebuggerGetStack` / `DebuggerGetVariables`, step with `DebuggerStep`, and finish with `DebuggerDetach`. Avoid attaching to another user's session.
+Query the active MCP server's live `tools/list` once; use the destination-prefixed tool and schema for the target. Start with `GetApplicationLog`, source/object inspection (`SearchObject`, `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`, `ListDependencies`), and safe data inspection (`RunQuery`, `GetTableContents`). For an authorized debugger session, use `SetBreakpoint`, `DebuggerAttach`, inspect with `DebuggerGetStack` / `DebuggerGetVariables`, step with `DebuggerStep`, and finish with `DebuggerDetach`. Avoid attaching to another user's session. Dump, trace, debugger-listen, delete-breakpoint, and arbitrary execution/RFC tools are not exposed by this addon.
 
 1. Reproduce the reported failure when safe and within the requested target. Establish the observed input, outcome, and execution context before changing code.
-2. Inspect relevant dumps, application logs, traces, call/reference context, and debugger state using only the current live MCP tool listing and schemas. Correlate evidence to the failing path before proposing a cause.
+2. Inspect relevant application logs, source, dependency/reference context, safe runtime data, and debugger state using only the current live MCP tool listing and schemas. Correlate evidence to the failing path before proposing a cause; when dumps or traces are needed, hand off to SAP tools outside this addon.
 3. Keep debugger sessions and execution bounded. Do not change business data or attach to, interrupt, or alter another user's session. Prefer read-only diagnostics unless a change is specifically authorized.
 4. Verify a fix against the reproduced failure when possible and distinguish reproduced behavior from diagnostic inference. When a code fix is made, add or update ABAP Unit coverage for the defect, run the regression, activate authorized object changes in dependency order, and perform a bounded runtime reproduction using the same or representative safe data before declaring the defect fixed.

package/.github/skills/abap-runtime-analysis/SKILL.md

@@ -7,11 +7,11 @@ description: Analyze ABAP runtime incidents, dumps, traces, debugger state, call
 
 ## MCP tool shortlist
 
-Query the active MCP server's live `tools/list` once and use exact destination-prefixed names and schemas. Prefer these tools when available: `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`, `GetContext`, `ListDumps`, `GetDump`, `GetApplicationLog`, `GetTrace`, `GetSQLTraceState`, `DebuggerListen`, `DebuggerAttach`, `DebuggerGetStack`, `DebuggerGetVariables`, `DebuggerStep`, `DebuggerDetach`, `SetBreakpoint`, `DeleteBreakpoint`, `GetBreakpoints`, `AnalyzeCallGraph`, `GetCallGraph`, `GetCallersOf`, `GetCalleesOf`, `FindDefinition`, `FindReferences`, `AnalyzeABAPCode`, `GetTypeInfo`, `GetTypeHierarchy`, `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetObjectStructure`, `RunQuery`, `GetTableContents`, `ExecuteABAP`, and `CallRFC`. For authorized fixes, also use `EditSource`, `WriteSource`, `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, `GetCodeCoverage`, `Activate`, and `ActivateMultiple`.
+Query the active MCP server's live `tools/list` once and use exact destination-prefixed names and schemas. Prefer these curated addon tools when available: `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`, `GetInstalledComponents`, `GetContext`, `GetApplicationLog`, `DebuggerAttach`, `DebuggerGetStack`, `DebuggerGetVariables`, `DebuggerStep`, `DebuggerDetach`, `SetBreakpoint`, `GetBreakpoints`, `FindDefinition`, `FindReferences`, `CompareSource`, `ListDependencies`, `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetClass`, `GetClassInfo`, `GetClassComponents`, `GetClassInclude`, `GetFunction`, `GetFunctionGroup`, `GetProgram`, `GetInclude`, `GetInterface`, `GetPackage`, `GetTable`, `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, `RunQuery`, and `GetTableContents`. For authorized fixes, also use `EditSource`, `WriteSource`, `PrepareABAPChangeSet`, `ApplyABAPChangeSet`, `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, `PrettyPrint`, `Activate`, and `ActivateMultiple`. Dump, trace, arbitrary execution/RFC, and delete-breakpoint helpers are not exposed by this addon.
 
 1. Establish incident boundaries: symptom, expected result, object/service, destination, user/session, input, time window, frequency, and whether reproduction/debugging is authorized.
-2. Gather read-only evidence first. Correlate dumps, logs, traces, call graph, source, and data conditions by timestamp and object path. Do not start with source edits.
-3. For debugger sessions, use bounded breakpoints and attach/listen only to the authorized session. Inspect stack and variables, step minimally, then detach and remove breakpoints. Never attach to another user's unrelated session.
-4. For performance symptoms, separate database access, ABAP logic, remote calls, locking, and payload/serialization cost using traces, SQL trace state, call graphs, and measured reproduction evidence when available.
+2. Gather read-only evidence first. Correlate logs, source/reference context, dependencies, debugger state, and data conditions by timestamp and object path. Do not start with source edits.
+3. For debugger sessions, use bounded breakpoints and attach only to the authorized session. Inspect stack and variables, step minimally, then detach. Never attach to another user's unrelated session.
+4. For performance symptoms, separate database access, ABAP logic, remote calls, locking, and payload/serialization cost using available source/data evidence and measured reproduction evidence. If dumps or traces are required, hand them off to SAP tooling outside this addon.
 5. Convert evidence into a falsifiable root-cause chain. Clearly label facts, assumptions, and unverified hypotheses.
 6. If a fix is authorized, create a regression test where feasible, implement the smallest change, validate with lint/syntax/unit/ATC/LSP checks, activate only when authorized, and rerun the reproduction or strongest available runtime check.

package/.github/skills/clean-core-extensibility/SKILL.md

@@ -7,7 +7,7 @@ description: Design SAP extensions using Clean Core principles, released extensi
 
 ## Tool shortlist
 
-Query the active MCP server's live `tools/list` once; use task-relevant, destination-prefixed tools with their returned schemas. Inspect system capabilities with `GetSystemInfo` and `GetFeatures`; inspect source and dependencies with `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`, `GetObjectStructure`, `GetCDSDependencies`, and `GetCDSImpactAnalysis`. Check release status with `GetAPIReleaseState` where exposed. Use transport tools only for planning context and never claim transport release or deletion support; this addon filters `ReleaseTransport` and `DeleteTransport`.
+Query the active MCP server's live `tools/list` once; use task-relevant, destination-prefixed tools with their returned schemas. Inspect system capabilities with `GetSystemInfo`, `GetFeatures`, and `GetInstalledComponents`; inspect source and dependencies with `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`, `CompareSource`, `ListDependencies`, `GetCDSDependencies`, and `GetCDSImpactAnalysis`. Check release status with `GetAPIReleaseState` or batch with `PlanABAPCloudMigration` where exposed. Use transport tools only for planning/readiness context and never claim transport release/deletion support; transport release is unavailable through this addon.
 
 1. Classify the requirement as configuration, in-app/key-user extensibility, developer extensibility, side-by-side extension, integration, analytics, UI extension, or unavoidable core change.
 2. Prefer the cleanest pattern in this order: SAP standard configuration, released in-app extensibility, released developer extensibility, released APIs/events, side-by-side SAP BTP extension, then carefully isolated custom ABAP only if no compliant option exists.

package/.github/skills/rap-development/SKILL.md

@@ -7,12 +7,12 @@ description: Develop SAP RAP business objects, behavior, projections, and OData
 
 ## Tool shortlist
 
-Query the active MCP server's live `tools/list` once; use task-relevant, destination-prefixed tools with their returned schemas. Check support with `GetSystemInfo` / `GetFeatures`; inspect sources and structure with `GetSource`, `GetObjectStructure`, `GetCDSDependencies`, `GetCDSImpactAnalysis`, and `GetCDSElementInfo`. Edit with `EditSource` / `WriteSource`; validate with `SyntaxCheck`, `RunUnitTests`, and `RunATCCheck` when exposed. Activate with `Activate` / `ActivateMultiple` only when requested. Use `PublishServiceBinding` only when publication was requested and authorized.
+Query the active MCP server's live `tools/list` once; use task-relevant, destination-prefixed tools with their returned schemas. Check support with `GetSystemInfo` / `GetFeatures`; inspect sources and structure with `GetSource`, `GetContext`, `ListDependencies`, `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, `GetClassInfo`, and related class/include tools. Edit with `EditSource` / `WriteSource` or reviewed `PrepareABAPChangeSet` / `ApplyABAPChangeSet`; validate with `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, `RunQuery`, `GetTableContents`, and RAP regression-suite tools when exposed. Activate with `Activate` / `ActivateMultiple` only when requested. Service publication is not exposed by this addon; hand it off unless another live server exposes that exact tool.
 
 1. Inspect target-system release and capabilities with live `GetSystemInfo` and `GetFeatures` tools when available; inspect existing RAP objects and package conventions before design. Confirm RAP support and each required operation from the active MCP `tools/list`, not from static documentation.
 2. Plan before implementing. Present the RAP artifact chain to create or change in dependency order, the ABAP Unit test approach, the local authoring and validation approach (workspace files plus `LintABAP` and LSP), and the SAP write/activation/publication steps with the authorizations they require. Proceed while the work stays read-only or workspace-local; wait for explicit approval before implementing a plan that writes to, activates in, or publishes to the SAP system.
 3. Author locally first; check and lint before sending to SAP. Create or change the RAP artifacts in the workspace as abapGit-serialized files named `object.type.extension` (for example `zrap_i_booking.ddls.asddls` or `zrap_bp_booking.clas.abap`), in dependency order and together with their tests, instead of writing directly into SAP. Run the live `LintABAP` tool on those caller-supplied local files plus every required dependency source, and consume BAS editor LSP diagnostics when configured; `LintABAP` analyzes only the submitted in-memory files. Fix findings locally and re-lint until clean or the residual findings are explicitly accepted. Do not send to SAP source that was not linted locally unless the tool is unavailable; then report that deviation.
 4. Build the requested model through the required dependencies: CDS entities, behavior definitions and implementations, projections, service definitions, and service bindings. Follow existing object patterns and validate objects in dependency order with operations actually exposed by the system. Add or update ABAP Unit tests for behavior implementations, validations, determinations, actions, and authorization-relevant logic where applicable.
 5. Send the locally authored, locally linted artifacts to SAP and self-validate RAP behavior end-to-end against the live system. Exercise read/query paths and any changed create/update/delete/action behavior using representative data. Prefer safe read-only real data for query validation; create isolated sample data only when the task authorizes mutation and clean it up when possible. Verify response payloads, messages, failed validations, and at least one negative/empty scenario.
-6. Activate authorized RAP object changes in dependency order. Publish a service only when the user requested and authorized publication. Validate the service end-to-end using the live tools available for that system; report actual activation, publication, and runtime state.
+6. Activate authorized RAP object changes in dependency order. If service publication is needed, state the external handoff because this addon does not expose publish/unpublish tools. Validate the service end-to-end using the live tools available for that system; report actual activation, publication handoff, and runtime state.
 7. If RAP support or a required object operation is unavailable, stop that path and report the exact capability gap. Do not claim completion based on source text or inferred support.

package/.github/skills/rap-service-delivery/SKILL.md

@@ -7,7 +7,7 @@ description: Validate and deliver SAP RAP OData services, behavior implementatio
 
 ## MCP tool shortlist
 
-Query the active MCP server's live `tools/list` once and use exact destination-prefixed names and schemas. Prefer these tools when available: `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`, `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetObjectStructure`, `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, `EditSource`, `WriteSource`, `UpdateSource`, `UpdateClassInclude`, `CreateClassWithTests`, `CreateTestInclude`, `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, `GetCodeCoverage`, `RunQuery`, `GetTableContents`, `ExecuteABAP`, `GenerateRAPRegressionSuite`, `RunRAPRegressionSuite`, `ListDumps`, `GetDump`, `GetApplicationLog`, `GetTrace`, `Activate`, `ActivateMultiple`, and `PublishServiceBinding`. Use `UnpublishServiceBinding` only when explicitly requested.
+Query the active MCP server's live `tools/list` once and use exact destination-prefixed names and schemas. Prefer these curated addon tools when available: `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`, `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetContext`, `ListDependencies`, `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, `GetClass`, `GetClassInfo`, `GetClassComponents`, `GetClassInclude`, `GetInterface`, `EditSource`, `WriteSource`, `PrepareABAPChangeSet`, `ApplyABAPChangeSet`, `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, `PrettyPrint`, `RunQuery`, `GetTableContents`, `GenerateRAPRegressionSuite`, `RunRAPRegressionSuite`, `GetApplicationLog`, `Activate`, and `ActivateMultiple`. Publish/unpublish, dump, trace, arbitrary execution/RFC, and code-coverage tools are not exposed by this addon.
 
 1. Confirm target destination, package, transport/temporary target, RAP object names, and whether activation/publication/data mutation is authorized. Transport release and deletion remain out of scope for this skill; prepare and report transport context only.
 2. Plan before implementing. Present the RAP object chain to create or change in dependency order, the ABAP Unit test approach, the local authoring and validation approach (workspace files plus `LintABAP` and LSP), and the SAP write/activation/publication steps with the authorizations they require. Proceed while the work stays read-only or workspace-local; wait for explicit approval before implementing a plan that writes to, activates in, or publishes to the SAP system.
@@ -16,7 +16,7 @@ Query the active MCP server's live `tools/list` once and use exact destination-p
 5. Validate behavior implementations with tests first where feasible. Cover validations, determinations, actions, feature control, numbering, authorization-relevant branches, reported/failed messages, and negative or empty paths.
 6. Validate runtime service behavior end-to-end after the locally linted sources were sent to SAP. Use read-only `RunQuery`/`GetTableContents` for query paths. For mutating behavior, proceed only when authorized, use isolated data, verify persisted state/messages, and clean up when possible.
    Generate a reusable GET-only OData smoke suite with `GenerateRAPRegressionSuite`, save its returned JSON with the change, and rerun it with `RunRAPRegressionSuite`. Add JSON-path assertions for business behavior that metadata alone cannot prove.
-7. Activate in dependency order only when authorized: lower CDS/model dependencies first, then behavior artifacts, projections, service definition, and service binding. Publish only when explicitly requested.
-8. If runtime validation fails, inspect dumps/logs/traces with `ListDumps`, `GetDump`, `GetApplicationLog`, and `GetTrace` before guessing. Report exact evidence, not inferred success.
+7. Activate in dependency order only when authorized: lower CDS/model dependencies first, then behavior artifacts, projections, service definition, and service binding. If publication is requested, hand it off unless another live server exposes an exact publish tool.
+8. If runtime validation fails, inspect `GetApplicationLog`, source/reference context, dependencies, debugger state when authorized, and safe runtime data before guessing. Report exact evidence, not inferred success.
 
 Transport release is unavailable through this workflow. Report transport readiness and creation separately, and never claim that a transport was released or deleted.

package/.github/skills/sap-sdlc-orchestration/SKILL.md

@@ -7,7 +7,7 @@ description: Orchestrate the SAP delivery lifecycle from requirement analysis th
 
 ## Tool shortlist
 
-Query the active MCP server's live `tools/list` once; use task-relevant, destination-prefixed tools with their returned schemas. Investigate system and repository context with `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`, `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`, and dependency tools. Validate with `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, runtime queries, dumps/logs/traces, and service validation tools when exposed. Use transport tools for readiness planning only; never claim transport release or deletion support because this addon filters `ReleaseTransport` and `DeleteTransport`.
+Query the active MCP server's live `tools/list` once; use task-relevant, destination-prefixed tools with their returned schemas. Investigate system and repository context with `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`, `GetInstalledComponents`, `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`, `CompareSource`, and dependency tools (`ListDependencies`, CDS dependency/impact tools). Validate with `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, runtime queries, `GetApplicationLog`, and RAP regression-suite tools when exposed. Use transport tools for readiness planning only; never claim transport release/deletion support because transport release is unavailable through this addon.
 
 1. Convert the requirement into an SDLC plan: discovery, fit-gap/API recommendation, architecture, implementation packages, test strategy, validation gates, activation/publication gates, transport readiness, deployment notes, rollback, and operations handover.
 2. Require a planning phase before implementation for every work package. Each package starts with a presented plan of objects, tests, and validation steps; no SAP state-changing package proceeds before the user approves it. Every implementation package includes a local quality gate: sources are authored locally as abapGit-style workspace files (`object.type.extension`) and must pass `LintABAP` plus LSP checks before they are sent to the SAP system.

package/.github/skills/sap-standard-api-analysis/SKILL.md

@@ -7,7 +7,7 @@ description: Assess requirements against SAP standard capabilities, released API
 
 ## Tool shortlist
 
-Query the active MCP server's live `tools/list` once; use task-relevant, destination-prefixed tools with their returned schemas. Inspect target capabilities with `GetSystemInfo`, `GetFeatures`, and `GetConnectionInfo`. Search candidates with `SearchObject`, `GrepObjects`, `GrepPackages`, `FindDefinition`, `FindReferences`, `GetObjectStructure`, `GetCDSDependencies`, `GetCDSImpactAnalysis`, and `GetCDSElementInfo`. Verify released API status with `GetAPIReleaseState` when exposed. Use `RunQuery` or `GetTableContents` only for safe read-only evidence. Never claim transport release or deletion support; this addon filters `ReleaseTransport` and `DeleteTransport`.
+Query the active MCP server's live `tools/list` once; use task-relevant, destination-prefixed tools with their returned schemas. Inspect target capabilities with `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`, and `GetInstalledComponents`. Search candidates with `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`, `ListDependencies`, `GetCDSDependencies`, `GetCDSImpactAnalysis`, and `GetCDSElementInfo`. Verify released API status with `GetAPIReleaseState` or batch with `PlanABAPCloudMigration` when exposed. Use `RunQuery` or `GetTableContents` only for safe read-only evidence. Never claim transport release/deletion support; transport release is unavailable through this addon.
 
 1. Translate the requirement into business capabilities, integration contracts, data entities, and observable acceptance criteria before choosing implementation objects.
 2. Prefer SAP standard configuration, standard processes, communication scenarios, released OData/RFC/BAPI APIs, released CDS views/entities, RAP BOs, business events, BADIs, and documented extension points. Record all inspected candidates and whether each is standard, released, deprecated, unavailable, or unverified.

package/.github/skills/sap-transport-release/SKILL.md

@@ -11,4 +11,4 @@ Query the active MCP server's live `tools/list` once; use task-relevant, destina
 
 1. Use `CheckTransportReadiness` with exactly one `GetTransport` check for the requested ID and applicable dependency, inactive-object, test, and ATC checks. Review each returned evidence item; a completed call can still contain findings. Verify the destination, package, complete object set, dependencies, and an eligible modifiable request before preparing changes.
 2. Create a transport only when the user specifically authorized its creation. Before transport handoff, ensure changed objects have been activated in dependency order when activation is authorized, ABAP Unit tests have been run or blockers documented, runtime validation evidence exists for changed public contracts, and ATC/syntax checks have been run where available. Do not treat request contents, syntax, ATC, or activation as substitutes for behavior and runtime validation evidence. Report actual request contents and validation state.
-3. This addon filters `ReleaseTransport` and `DeleteTransport`. Do not invent or claim release/deletion support. When release is requested, report that release is unavailable through this addon and hand off the release action to an authorized SAP transport workflow.
+3. This addon does not expose transport release or deletion tools. Do not invent or claim release/deletion support. When release is requested, report that release is unavailable through this addon and hand off the release action to an authorized SAP transport workflow.

package/README.md

@@ -558,7 +558,8 @@ For an ABAP Cloud assessment, get object URIs from `SearchObject` and pass them
 | `GetPackage` | Read package details. |
 | `GetAPIReleaseState` | Check whether an object is released for S/4HANA Clean Core / ABAP Cloud development; use the URI returned by `SearchObject`. |
 | `GetFunctionGroup` | Read function-group source. |
-| `GetMessages` | Read the messages defined by an ABAP message class (SE91). |
+| `GetFunction`, `GetClass`, `GetClassComponents`, `GetClassInclude`, `GetProgram`, `GetInclude`, `GetInterface` | Read supported object-specific source or metadata views. |
+| `ListDependencies` | List dependencies for impact and transport-readiness planning. |
 | `GetInactiveObjects` | List objects changed by the current user but not yet activated. |
 
 ### 🗃️ Read SAP tables and metadata
@@ -582,14 +583,13 @@ SAP authorizations and the destination's available APIs still apply.
 | --- | --- |
 | `WriteSource` | Create or update supported ABAP source objects; detects create versus update in upsert mode. |
 | `EditSource` | Replace a specific source fragment; syntax checking is enabled by default. |
-| `CreatePackage` | Create a package; transportable packages need a transport and software component. |
-| `CreateTable` | Create a transparent DDIC table from a JSON field definition. |
+| `PrepareABAPChangeSet` | Stage reviewed full-source diffs for up to 12 `WriteSource` changes. |
+| `ApplyABAPChangeSet` | Re-read each staged object and apply reviewed writes when the source still matches. |
 | `SyntaxCheck` | Ask SAP to syntax-check source before saving or activation. |
 | `Activate` | Activate one named ABAP object. |
-| `ActivatePackage` | Activate inactive objects in dependency order. If package is omitted, it can activate all inactive objects for the current user. |
 | `ActivateMultiple` | Activate related objects together while resolving mutual dependencies, such as an include and its main program. |
 
-The write, create, and activation tools change SAP state. Confirm the target, package, and transport before using them. `EditSource` performs a focused replacement; its default syntax check prevents saving when syntax errors are reported.
+The write and activation tools change SAP state. Confirm the target, package, and transport before using them. `EditSource` performs a focused replacement; its default syntax check prevents saving when syntax errors are reported.
 
 ### ✅ Test and inspect the system
 
@@ -611,8 +611,9 @@ The write, create, and activation tools change SAP state. Confirm the target, pa
 | `GetTransport` | Read a transport request's details, objects, and tasks. |
 | `GetTransportInfo` | Find eligible transports and lock status for an ABAP object or package. |
 | `CreateTransport` | Create a transport request. |
-| `ReleaseTransport` | Not exposed by the curated proxy surface; release transports outside this add-on after review. |
-| `DeleteTransport` | Not exposed by the curated proxy surface; delete transports outside this add-on after review. |
+| `CheckTransportReadiness` | Collect a whitelisted bundle of transport, dependency, inactive-object, ABAP Unit, and ATC evidence. |
+
+Transport release and deletion are not exposed by the curated proxy surface; release or delete transports outside this add-on after review.
 
 The proxy starts VSP with `--enable-transports` and omits `--transport-read-only`. Generated MCP entries set `SAP_ALLOW_TRANSPORTABLE_EDITS=true` so source edits in transportable packages are permitted. VSP safety checks and SAP authorizations still apply.
 
@@ -627,7 +628,7 @@ The proxy starts VSP with `--enable-transports` and omits `--transport-read-only
 - `messages: true` adds BALDAT details and T100 message text; otherwise, the tool returns log headers only.
 - The proxy maps this convenience tool to the single upstream `SAP(action="analyze", type="application_log")` operation. The general-purpose `SAP` router itself is hidden from direct calls.
 
-The proxy intentionally does not expose the full child VSP process. Object deletion, debugger, trace, general-purpose SAP router, and transport release/delete tools are hidden from direct MCP calls. Direct VSP invocation without `H2O_URL` retains the VSP binary's own tool surface.
+The proxy intentionally does not expose the full child VSP process. Object deletion, broad trace surfaces, arbitrary SAP router/RFC calls, debugger helper/delete-breakpoint routes, and transport release/delete tools are hidden from direct MCP calls. The curated debugger tools (`SetBreakpoint`, `GetBreakpoints`, `DebuggerAttach`, `DebuggerGetStack`, `DebuggerGetVariables`, `DebuggerStep`, and `DebuggerDetach`) remain available when VSP and the target system expose them. Direct VSP invocation without `H2O_URL` retains the VSP binary's own tool surface.
 
 ### 🚀 Ready to put the tools to work from chat?
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.3.7",
+  "version": "0.4.2",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/scripts/install-local.mjs

@@ -61,6 +61,9 @@ async function verify() {
   const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
   const prefix = await resolveGlobalBinaryPath();
   const expected = resolvePath(prefix, 'lib', 'node_modules', pkg.name);
+  const serverCommand = process.platform === 'win32'
+    ? join(prefix, 'sap-ai-dev.cmd')
+    : join(prefix, 'bin', 'sap-ai-dev');
   const installedRoot = await new Promise((resolve, reject) => {
     const child = spawn(process.platform === 'win32' ? 'npm.cmd' : 'npm', ['list', '-g', pkg.name, '--parseable'], {
       cwd: root,
@@ -73,14 +76,16 @@ async function verify() {
     child.once('error', reject);
     child.once('close', code => resolve(code === 0 ? stdout.trim().split('\n').filter(Boolean).pop() : null));
   });
-  console.log(`Global prefix:      ${prefix}`);
-  console.log(`Installed location: ${installedRoot || '(not installed)'}`);
+  console.log(`MCP server location: ${serverCommand}`);
   console.log(`Workspace root:     ${root}`);
   if (!installedRoot) throw new Error(`${pkg.name} is not installed globally`);
   if (installedRoot !== expected) {
     console.log(`Expected location:  ${expected}`);
     throw new Error('Global installation does not match the expected npm layout');
   }
+  if (!await lstat(serverCommand).catch(() => null)) {
+    throw new Error(`Global sap-ai-dev command is missing at ${serverCommand}`);
+  }
   const stats = await lstat(installedRoot).catch(() => null);
   console.log(`Install mode:       ${stats?.isSymbolicLink() ? 'npm link (live workspace)' : 'tarball (snapshot)'}`);
   return 0;

package/src/mcp-config.mjs

@@ -1,7 +1,8 @@
 import { randomUUID } from 'node:crypto';
-import { mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { access, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { basename, dirname, join } from 'node:path';
+import { basename, delimiter, dirname, join, resolve } from 'node:path';
 import { brandedEnvValue } from './branding.mjs';
 
 const LEGACY_MCP_SERVER_PREFIXES = ['sapAiDev_', 'basVspMcp_'];
@@ -61,6 +62,25 @@ async function exists(path) {
   }
 }
 
+export async function resolveMcpServerCommand(env = process.env) {
+  const executableNames = process.platform === 'win32'
+    ? ['sap-ai-dev.cmd', 'sap-ai-dev.exe', 'sap-ai-dev']
+    : ['sap-ai-dev'];
+  const searchPath = String(env.PATH || env.Path || '').split(delimiter).filter(Boolean);
+  for (const directory of searchPath) {
+    for (const executableName of executableNames) {
+      const candidate = resolve(directory, executableName);
+      try {
+        await access(candidate, constants.X_OK);
+        return candidate;
+      } catch {
+        // Continue searching PATH; use the command name as a portable fallback.
+      }
+    }
+  }
+  return 'sap-ai-dev';
+}
+
 export async function resolveMcpConfigPath(env = process.env) {
   const configuredPath = brandedEnvValue(env, 'MCP_CONFIG');
   if (configuredPath) return configuredPath;
@@ -149,13 +169,31 @@ function isCompanionServer(entry) {
 }
 
 function isPackageLauncher(entry) {
-  const commands = new Set(['sap-ai-dev', 'sap-ai-dev-toolkit', 'bas-vsp-mcp']);
-  const packages = [/^--package=sap-ai-dev-toolkit(?:@[^/]+)?$/, /^--package=bas-mcp-addon(?:@[^/]+)?$/];
-  const npxLauncher = entry?.command === 'npx'
+  const currentCommands = new Set(['sap-ai-dev', 'sap-ai-dev-toolkit']);
+  const legacyCommands = new Set(['bas-vsp-mcp']);
+  const commandName = typeof entry?.command === 'string'
+    ? entry.command.slice(Math.max(entry.command.lastIndexOf('/'), entry.command.lastIndexOf('\\')) + 1).replace(/\.(?:cmd|exe)$/i, '')
+    : '';
+  const currentCommand = currentCommands.has(entry?.command) || currentCommands.has(commandName);
+  const legacyCommand = legacyCommands.has(entry?.command) || legacyCommands.has(commandName);
+  const currentPackages = [/^--package=sap-ai-dev-toolkit(?:@[^/]+)?$/];
+  const legacyPackages = [/^--package=bas-mcp-addon(?:@[^/]+)?$/];
+  const hasPackage = patterns => Array.isArray(entry?.args)
+    && entry.args.some(argument => typeof argument === 'string' && patterns.some(pattern => pattern.test(argument)));
+  const currentNpxLauncher = entry?.command === 'npx'
+    && Array.isArray(entry.args)
+    && entry.args.some(argument => currentCommands.has(argument))
+    && hasPackage(currentPackages);
+  const legacyNpxLauncher = entry?.command === 'npx'
     && Array.isArray(entry.args)
-    && entry.args.some(argument => commands.has(argument))
-    && entry.args.some(argument => typeof argument === 'string' && packages.some(pattern => pattern.test(argument)));
-  return entry?.BAS_EXT === 'true' && (commands.has(entry?.command) || npxLauncher);
+    && entry.args.some(argument => legacyCommands.has(argument))
+    && hasPackage(legacyPackages);
+  // Current launchers are treated as managed only when tagged by this add-on.
+  // Some early bas-mcp-addon entries were not tagged with BAS_EXT, though, and
+  // leaving them behind keeps advertising the old full VSP surface (~159 tools).
+  return (entry?.BAS_EXT === 'true' && (currentCommand || currentNpxLauncher || legacyCommand || legacyNpxLauncher))
+    || legacyCommand
+    || legacyNpxLauncher;
 }
 
 function destinationValue(env) {
@@ -240,11 +278,12 @@ export async function installMcpConfig(destinationsOrOptions, options = {}) {
     ...buildMcpEntries(destinations, env),
     ...buildSapDevelopmentMcpEntries(options.sapDevelopmentServers || [])
   };
-  if (options.command) {
+  const launcherCommand = options.command || (destinations.length ? await resolveMcpServerCommand(env) : null);
+  if (launcherCommand) {
     for (const entry of Object.values(generated)) {
       if (isCompanionServer(entry)) continue;
-      entry.command = options.command;
-      if (options.args?.length) entry.args = [...options.args];
+      entry.command = launcherCommand;
+      if (options.command && options.args?.length) entry.args = [...options.args];
     }
   }
   const servers = Object.create(null);

package/test/mcp-config-cf.test.mjs

@@ -61,6 +61,23 @@ test('writes source-qualified CF entries beside same-named BAS destinations', ()
   assert.equal(onPremise['cf:space-one:onprem-instance:shared'].env.BAS_CF_CONNECTIVITY_KEY, 'connectivity-key');
 });
 
+test('stores and reconciles the MCP launcher executable location', async t => {
+  const directory = await mkdtemp(join(tmpdir(), 'bas-mcp-launcher-location-'));
+  const path = join(directory, 'mcp.json');
+  const command = join(directory, 'sap-ai-dev');
+  await writeFile(command, '#!/bin/sh\nexit 0\n', { mode: 0o755 });
+  await writeFile(path, JSON.stringify({ servers: { userServer: { command: 'custom-server' } } }));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+
+  const env = { H2O_URL: 'http://h2o.example', PATH: directory };
+  const installed = await installMcpConfig([bas], { env, path });
+  assert.equal(installed.servers.shared.command, command);
+  assert.equal((await readMcpConfig(path)).servers.shared.command, command);
+
+  await installMcpConfig([], { env, path });
+  assert.deepEqual(Object.keys((await readMcpConfig(path)).servers), ['userServer']);
+});
+
 test('extracts key references only from package-managed Cloud Foundry entries', () => {
   const cloudFoundry = buildMcpEntries([
     cfDestination('space-one', 'instance-one', 'destination-key', 'OnPremise')
@@ -225,9 +242,38 @@ test('recognizes old npx Cloud Foundry entries so setup can reuse their service
       BAS_VSP_DESTINATION: current.env.SAP_AI_DEV_TOOLKIT_DESTINATION
     }
   };
+  delete legacy.BAS_EXT;
   delete legacy.env.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE;
   delete legacy.env.SAP_AI_DEV_TOOLKIT_DESTINATION;
   assert.deepEqual(collectManagedCloudFoundryKeyReferences({ servers: { legacy } }), [
     { kind: 'destination', spaceGuid: 'space-one', instanceGuid: 'instance-one', instanceName: 'destination-instance-one', keyName: 'old-key' }
   ]);
 });
+
+test('setup removes untagged legacy bas-mcp-addon launchers that expose the full VSP surface', async t => {
+  const directory = await mkdtemp(join(tmpdir(), 'sap-ai-toolkit-untagged-legacy-'));
+  const path = join(directory, 'mcp.json');
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  await writeFile(path, JSON.stringify({
+    servers: {
+      shared: {
+        type: 'stdio',
+        command: 'npx',
+        args: ['--yes', '--package=bas-mcp-addon@0.2.0', 'bas-vsp-mcp'],
+        env: { H2O_URL: 'http://old-h2o.example', BAS_VSP_DESTINATION: 'shared' }
+      },
+      legacyCommand: {
+        type: 'stdio',
+        command: 'bas-vsp-mcp',
+        env: { H2O_URL: 'http://old-h2o.example', BAS_VSP_DESTINATION: 'other' }
+      },
+      userServer: { type: 'stdio', command: 'custom-server' }
+    }
+  }));
+
+  await installMcpConfig([bas], { env: { H2O_URL: 'http://h2o.example' }, path });
+  const migrated = await readMcpConfig(path);
+  assert.deepEqual(Object.keys(migrated.servers).sort(), ['shared', 'userServer']);
+  assert.equal(migrated.servers.shared.command, 'sap-ai-dev');
+  assert.equal(migrated.servers.shared.env.SAP_AI_DEV_TOOLKIT_DESTINATION, 'shared');
+});

package/test/setup.test.mjs

@@ -306,7 +306,7 @@ test('global postinstall completes BAS selection before optional Copilot assets'
   assert.ok(acceptLogs.indexOf('Installation configuration summary') > acceptLogs.indexOf('Installed 19 Copilot files'), acceptLogs);
   assert.ok(acceptLogs.includes(`MCP config file: ${config}`), acceptLogs);
   assert.ok(acceptLogs.includes('Destination: BAS · alpha-system · client 100 · Basic'), acceptLogs);
-  assert.ok(acceptLogs.includes('Launch: stdio · sap-ai-dev'), acceptLogs);
+  assert.match(acceptLogs, /Launch: stdio · (?:[^\r\n]*[\\/])?sap-ai-dev(?:\.cmd)?(?:\r?\n|$)/, acceptLogs);
   assert.ok(acceptLogs.includes('Environment keys: H2O_URL, SAP_AI_DEV_TOOLKIT_DESTINATION, SAP_ALLOW_TRANSPORTABLE_EDITS'), acceptLogs);
   const configAfterAccept = JSON.parse(await readFile(config, 'utf8'));
   assert.deepEqual(Object.values(configAfterAccept.servers)