sap-ai-dev-toolkit 0.5.0 → 0.5.6

package/test/copilot-content.test.mjs

@@ -1,249 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { readFile, readdir, stat } from 'node:fs/promises';
-import { join } from 'node:path';
-
-const root = process.cwd();
-const agentsRoot = join(root, '.github', 'agents');
-const agentPath = join(agentsRoot, 'abap-developer.agent.md');
-const skillsRoot = join(root, '.github', 'skills');
-const expectedAgents = [
-  'abap-developer.agent.md',
-  'abap-runtime-debugger.agent.md',
-  'hana-cloud-hdi-specialist.agent.md',
-  'rap-service-developer.agent.md',
-  'sap-solution-architect.agent.md'
-];
-const expectedSkills = [
-  'abap-debugging',
-  'abap-development',
-  'abap-runtime-analysis',
-  'abap-testing-quality',
-  'cds-development',
-  'clean-core-extensibility',
-  'hana-cloud-inspection',
-  'hana-cloud-native-development',
-  'hana-cloud-validation',
-  'rap-development',
-  'rap-service-delivery',
-  'sap-sdlc-orchestration',
-  'sap-standard-api-analysis',
-  'sap-transport-release'
-];
-
-async function readMarkdown(path) {
-  return readFile(path, 'utf8');
-}
-
-function parseFrontmatter(markdown, path) {
-  const match = /^---\n([\s\S]*?)\n---\n/.exec(markdown);
-  assert.ok(match, `${path} must start with YAML frontmatter`);
-  const metadata = {};
-  for (const line of match[1].split('\n')) {
-    const separator = line.indexOf(':');
-    assert.ok(separator > 0, `${path} has invalid frontmatter line: ${line}`);
-    metadata[line.slice(0, separator).trim()] = line.slice(separator + 1).trim();
-  }
-  return metadata;
-}
-
-function assertMentionsLiveToolDiscovery(markdown, path) {
-  assert.match(markdown, /tools\/list/i, `${path} must require live MCP tool discovery`);
-  assert.match(markdown, /destination-prefixed|destination-prefixed names/i, `${path} must tell agents to use actual destination-prefixed tool names`);
-  assert.match(markdown, /schema/i, `${path} must tell agents to follow live tool schemas`);
-}
-
-function assertDirectMcpUsage(markdown, path) {
-  assert.match(markdown, /Direct MCP invocation is mandatory/i, `${path} must require direct MCP calls`);
-  assert.match(markdown, /Do not launch `sap-ai-dev`.*MCP operations/i, `${path} must forbid terminal-driven MCP discovery/calls`);
-  assert.match(markdown, /host\/session binding issue/i, `${path} must report host tool-binding failures instead of using a CLI fallback`);
-}
-
-function assertValidationPolicy(markdown, path) {
-  assert.match(markdown, /ABAP Unit|RunUnitTests/i, `${path} must include ABAP Unit or test execution guidance`);
-  assert.match(markdown, /runtime validation|Self-validate|executable validation|reproduce/i, `${path} must require executable/runtime validation evidence`);
-  assert.match(markdown, /activate|activation/i, `${path} must handle activation state or blockers`);
-  assert.match(markdown, /report|Record|document/i, `${path} must require observed outcome reporting`);
-}
-
-function assertPlanFirstPolicy(markdown, path) {
-  assert.match(markdown, /[Pp]lan before implementing|[Pp]lanning phase before implementation/, `${path} must require a plan to be presented before implementation starts`);
-  assert.match(markdown, /wait for explicit (?:user )?approval|no SAP state-changing package proceeds before the user approves/i, `${path} must gate SAP state-changing implementation on explicit approval`);
-}
-
-function assertLocalFirstPolicy(markdown, path) {
-  assert.match(markdown, /abapGit[- ]serialized|abapGit-style/, `${path} must require local abapGit-style source files`);
-  assert.match(markdown, /object\.type\.extension/, `${path} must document the object.type.extension file naming`);
-  assert.match(markdown, /LintABAP/, `${path} must require local linting with LintABAP`);
-  assert.match(markdown, /before (?:they are )?sent to the SAP system|before sending to SAP|check and lint before sending/i, `${path} must require local checks before the SAP transfer`);
-}
-
-function assertNoUnsafeTransportClaims(markdown, path) {
-  const releaseMentions = markdown.match(/ReleaseTransport|release\/deletion|release and deletion|release is unavailable|release action/gi) || [];
-  assert.ok(releaseMentions.length > 0 || !/transport/i.test(markdown), `${path} transport guidance should explicitly handle release limitations when transport is discussed`);
-  assert.doesNotMatch(markdown, /use\s+`?ReleaseTransport`?|call\s+`?ReleaseTransport`?|with\s+`?ReleaseTransport`?/i, `${path} must not instruct the agent to release transports through this addon`);
-  assert.doesNotMatch(markdown, /use\s+`?DeleteTransport`?|call\s+`?DeleteTransport`?|with\s+`?DeleteTransport`?/i, `${path} must not instruct the agent to delete transports through this addon`);
-}
-
-test('packaged Copilot agent and skill inventory is complete and canonical', async () => {
-  assert.equal((await stat(agentPath)).isFile(), true);
-  assert.deepEqual((await readdir(agentsRoot)).sort(), expectedAgents);
-  const actualSkills = (await readdir(skillsRoot)).sort();
-  assert.deepEqual(actualSkills, expectedSkills);
-  for (const skill of expectedSkills) {
-    assert.equal((await stat(join(skillsRoot, skill, 'SKILL.md'))).isFile(), true, `${skill} must have SKILL.md`);
-  }
-});
-
-test('all bundled agents invoke chat-attached MCP tools without terminal JSON-RPC fallbacks', async () => {
-  for (const name of expectedAgents) {
-    const path = join(agentsRoot, name);
-    const markdown = await readMarkdown(path);
-    assertDirectMcpUsage(markdown, path);
-    assertMentionsLiveToolDiscovery(markdown, path);
-  }
-});
-
-test('ABAP Developer agent has valid metadata and invokes the packaged skills', async () => {
-  const markdown = await readMarkdown(agentPath);
-  const metadata = parseFrontmatter(markdown, agentPath);
-  assert.deepEqual(Object.keys(metadata).sort(), ['description', 'name', 'target', 'user-invocable']);
-  assert.equal(metadata.name, 'ABAP Developer');
-  assert.equal(metadata.target, 'vscode');
-  assert.equal(metadata['user-invocable'], 'true');
-  assert.match(metadata.description, /ABAP/i);
-  assert.match(metadata.description, /BAS|SAP/i);
-
-  for (const skill of ['ABAP implementation', 'RAP', 'CDS', 'debugging', 'transport']) {
-    assert.match(markdown, new RegExp(skill, 'i'), `agent should route to ${skill} skill guidance`);
-  }
-  assertMentionsLiveToolDiscovery(markdown, agentPath);
-  assertValidationPolicy(markdown, agentPath);
-  assertPlanFirstPolicy(markdown, agentPath);
-  assertLocalFirstPolicy(markdown, agentPath);
-  assertNoUnsafeTransportClaims(markdown, agentPath);
-});
-
-test('SAP Solution Architect agent has valid metadata and planning/handoff policy', async () => {
-  const path = join(agentsRoot, 'sap-solution-architect.agent.md');
-  const markdown = await readMarkdown(path);
-  const metadata = parseFrontmatter(markdown, path);
-  assert.deepEqual(Object.keys(metadata).sort(), ['description', 'name', 'target', 'user-invocable']);
-  assert.equal(metadata.name, 'SAP Solution Architect');
-  assert.equal(metadata.target, 'vscode');
-  assert.equal(metadata['user-invocable'], 'true');
-  assert.match(metadata.description, /standard|Clean Core|side-by-side|SDLC/i);
-  assertMentionsLiveToolDiscovery(markdown, path);
-  assert.match(markdown, /GetAPIReleaseState/i);
-  assert.match(markdown, /Clean Core/i);
-  assert.match(markdown, /side-by-side/i);
-  assert.match(markdown, /ABAP Developer/i);
-  assert.match(markdown, /RAP Service Developer/i);
-  assert.match(markdown, /ABAP Runtime Debugger/i);
-  assert.match(markdown, /HANA Cloud\/HDI Specialist/i);
-  assert.match(markdown, /SDLC|lifecycle/i);
-  assertPlanFirstPolicy(markdown, path);
-  assertLocalFirstPolicy(markdown, path);
-  assertNoUnsafeTransportClaims(markdown, path);
-});
-
-test('RAP Service Developer agent has valid metadata and plan-first local-first policy', async () => {
-  const path = join(agentsRoot, 'rap-service-developer.agent.md');
-  const markdown = await readMarkdown(path);
-  const metadata = parseFrontmatter(markdown, path);
-  assert.deepEqual(Object.keys(metadata).sort(), ['description', 'name', 'target', 'user-invocable']);
-  assert.equal(metadata.name, 'RAP Service Developer');
-  assert.equal(metadata.target, 'vscode');
-  assert.equal(metadata['user-invocable'], 'true');
-  assert.match(metadata.description, /RAP/i);
-  assertMentionsLiveToolDiscovery(markdown, path);
-  assertValidationPolicy(markdown, path);
-  assertPlanFirstPolicy(markdown, path);
-  assertLocalFirstPolicy(markdown, path);
-  assertNoUnsafeTransportClaims(markdown, path);
-});
-
-test('HANA Cloud/HDI Specialist agent has a read-only target-bound workflow', async () => {
-  const path = join(agentsRoot, 'hana-cloud-hdi-specialist.agent.md');
-  const markdown = await readMarkdown(path);
-  const metadata = parseFrontmatter(markdown, path);
-  assert.deepEqual(Object.keys(metadata).sort(), ['description', 'name', 'target', 'user-invocable']);
-  assert.equal(metadata.name, 'HANA Cloud/HDI Specialist');
-  assert.equal(metadata.target, 'vscode');
-  assert.equal(metadata['user-invocable'], 'true');
-  assert.match(metadata.description, /HANA Cloud/i);
-  assertDirectMcpUsage(markdown, path);
-  assertMentionsLiveToolDiscovery(markdown, path);
-  for (const tool of ['hana_connection_info', 'hana_list_objects', 'hana_describe_object', 'hana_read_rows']) {
-    assert.match(markdown, new RegExp(tool));
-  }
-  assert.match(markdown, /read-only/i);
-  assert.match(markdown, /HANA_RO_\*/);
-  assert.match(markdown, /cds build --for hana/);
-  assert.match(markdown, /user-run deployment|deployment is performed by the user/i);
-  assert.match(markdown, /never execute HANA DDL\/DML|Never execute HANA DDL\/DML/i);
-});
-
-test('each skill has valid metadata, matching name, and enforceable live-tool validation policy', async () => {
-  for (const skill of expectedSkills) {
-    const path = join(skillsRoot, skill, 'SKILL.md');
-    const markdown = await readMarkdown(path);
-    const metadata = parseFrontmatter(markdown, path);
-    assert.deepEqual(Object.keys(metadata).sort(), ['description', 'name']);
-    assert.equal(metadata.name, skill, `${skill} frontmatter name must match its directory`);
-    assert.ok(metadata.description.length >= 40, `${skill} needs a useful description`);
-    assert.match(markdown, /^#\s+\S.+$/m, `${skill} must have a top-level heading`);
-    assertMentionsLiveToolDiscovery(markdown, path);
-    assertNoUnsafeTransportClaims(markdown, path);
-  }
-});
-
-test('implementation-oriented skills require tests, runtime evidence, activation, and separate reporting', async () => {
-  for (const skill of ['abap-development', 'abap-testing-quality', 'cds-development', 'rap-development', 'sap-transport-release']) {
-    const path = join(skillsRoot, skill, 'SKILL.md');
-    const markdown = await readMarkdown(path);
-    assertValidationPolicy(markdown, path);
-    assert.match(markdown, /do not (?:treat|present|claim)|never report|not replace|not .*substitutes?/i, `${skill} must explicitly prevent substituting static checks for behavior evidence`);
-  }
-});
-
-test('implementation and delivery skills require planning first and local-first authoring', async () => {
-  for (const skill of ['abap-development', 'rap-development', 'rap-service-delivery', 'sap-sdlc-orchestration']) {
-    const path = join(skillsRoot, skill, 'SKILL.md');
-    const markdown = await readMarkdown(path);
-    assertPlanFirstPolicy(markdown, path);
-    assertLocalFirstPolicy(markdown, path);
-  }
-});
-
-test('debugging skill requires evidence before fixes and bounded debugger use', async () => {
-  const path = join(skillsRoot, 'abap-debugging', 'SKILL.md');
-  const markdown = await readMarkdown(path);
-  assert.match(markdown, /reproduce/i);
-  assert.match(markdown, /dumps?|ListDumps/i);
-  assert.match(markdown, /DebuggerDetach/i);
-  assert.match(markdown, /Avoid attaching to another user's session|do not.*another user's session/i);
-  assert.match(markdown, /before changing code|before proposing a cause/i);
-});
-
-test('HANA skills describe the read-only tool surface and safe CAP/HDI generation', async () => {
-  const inspection = await readMarkdown(join(skillsRoot, 'hana-cloud-inspection', 'SKILL.md'));
-  for (const tool of ['hana_connection_info', 'hana_list_objects', 'hana_describe_object', 'hana_read_rows']) {
-    assert.match(inspection, new RegExp(tool));
-  }
-  assert.match(inspection, /200-row limit/);
-  assert.match(inspection, /Do not launch `sap-ai-dev` or `sap-ai-hana` for MCP operations/);
-  assert.match(inspection, /schema-bound/);
-  assert.match(inspection, /credential-like columns/);
-
-  const development = await readMarkdown(join(skillsRoot, 'hana-cloud-native-development', 'SKILL.md'));
-  assert.match(development, /cds build --for hana/);
-  assert.match(development, /CAP-owned database models/);
-  assert.match(development, /Never execute `cds deploy` against HANA/);
-  assert.match(development, /HANA DDL\/DML/);
-
-  const validation = await readMarkdown(join(skillsRoot, 'hana-cloud-validation', 'SKILL.md'));
-  assert.match(validation, /deployment handoff/);
-  assert.match(validation, /HANA tools are metadata and bounded read-only inspection only/);
-  assert.match(validation, /Never claim HANA activation\/deployment/);
-});

package/test/credentials-store.test.mjs

@@ -1,187 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import http from 'node:http';
-import { request as httpRequest } from 'node:http';
-import { createBasDestinationRelay } from '../src/bas-destination-relay.mjs';
-import { readCredentials, removeDestinationCredentials, resolveCredentialsPath, storeDestinationCredentials } from '../src/credentials-store.mjs';
-import { canPromptForCredentials, credentialKeyForDestination, credentialModeForDestination } from '../src/credential-overrides.mjs';
-
-const UNSAFE_METHODS = ['POST', 'PUT', 'PATCH', 'DELETE'];
-
-// SAP-like backend that requires Basic auth AND token+cookie pairing —
-// the semantics that only work when the relay connects directly.
-function authedBackend({ expectedUser = 'DEVELOPER', expectedPassword = 'secret123' } = {}) {
-  const state = { sessionCounter: 0, requests: [] };
-  const server = http.createServer((req, res) => {
-    state.requests.push({ method: req.method, headers: { ...req.headers } });
-    const authorization = String(req.headers.authorization || '');
-    const basic = authorization.replace(/^Basic /i, '');
-    const [user, password] = Buffer.from(basic, 'base64').toString().split(':');
-    if (user !== expectedUser || password !== expectedPassword) {
-      res.writeHead(401, { 'www-authenticate': 'Basic' });
-      res.end('credentials required');
-      return;
-    }
-    if (req.method === 'GET' && req.headers['x-csrf-token'] === 'Fetch') {
-      state.sessionCounter += 1;
-      res.writeHead(200, {
-        'x-csrf-token': `token-${state.sessionCounter}`,
-        'set-cookie': [`sap-session-${state.sessionCounter}=s${state.sessionCounter}; path=/`]
-      });
-      res.end('<ok/>');
-      return;
-    }
-    if (UNSAFE_METHODS.includes(req.method)) {
-      const match = String(req.headers['x-csrf-token'] || '').match(/^token-(\d+)$/);
-      const valid = match && String(req.headers.cookie || '').includes(`sap-session-${match[1]}=`);
-      if (!valid) {
-        res.writeHead(403, { 'x-csrf-token': 'Required' });
-        res.end('CSRF token validation failed');
-        return;
-      }
-      res.writeHead(201);
-      res.end('<created/>');
-      return;
-    }
-    res.writeHead(200);
-    res.end('<read/>');
-  });
-  return { state, server };
-}
-
-function relayFetch(relayUrl, path, options = {}) {
-  const target = new URL(path, relayUrl);
-  return new Promise((resolve, reject) => {
-    const req = httpRequest(target, { method: options.method || 'GET', headers: options.headers || {} }, response => {
-      let body = '';
-      response.setEncoding('utf8');
-      response.on('data', chunk => { body += chunk; });
-      response.on('end', () => resolve({ status: response.statusCode, body }));
-    });
-    req.on('error', reject);
-    if (options.body) req.write(options.body);
-    req.end();
-  });
-}
-
-test('credentials file resolves next to the MCP config and stores entries with 0600', async t => {
-  const directory = await mkdtemp(join(tmpdir(), 'bas-creds-'));
-  t.after(async () => { await rm(directory, { recursive: true, force: true }); });
-  const mcpConfig = join(directory, 'mcp.json');
-  const path = await resolveCredentialsPath({ HOME: '/nonexistent' }, mcpConfig);
-  assert.equal(path, join(directory, 'sap-ai-dev-toolkit-credentials.json'));
-
-  await storeDestinationCredentials(path, 'S4H', { host: 'https://backend.example:44300', user: 'DEVELOPER', password: 'secret123' });
-  const stored = await readCredentials(path);
-  assert.equal(stored.destinations.S4H.user, 'DEVELOPER');
-  assert.equal(stored.destinations.S4H.host, 'https://backend.example:44300');
-  const permissions = (await stat(path)).mode & 0o777;
-  assert.equal(permissions, 0o600, 'credentials file must be owner-only');
-
-  const raw = JSON.parse(await readFile(path, 'utf8'));
-  assert.equal(raw.version, 1);
-  assert.ok(Object.hasOwn(raw.destinations, 'S4H'));
-
-  const { removed } = await removeDestinationCredentials(path, ['S4H']);
-  assert.deepEqual(removed, ['S4H']);
-  assert.equal((await readCredentials(path)).destinations.S4H, undefined);
-});
-
-test('credentials file with malformed entries keeps only complete records', async t => {
-  const directory = await mkdtemp(join(tmpdir(), 'bas-creds-bad-'));
-  t.after(async () => { await rm(directory, { recursive: true, force: true }); });
-  const path = join(directory, 'sap-ai-dev-toolkit-credentials.json');
-  await writeFile(path, JSON.stringify({
-    version: 1,
-    destinations: {
-      GOOD: { host: 'https://good.example', user: 'u', password: 'p', updatedAt: '2026-01-01T00:00:00.000Z' },
-      NO_PASSWORD: { host: 'https://bad.example', user: 'u' },
-      NOT_OBJECT: 'nope'
-    }
-  }));
-  const stored = await readCredentials(path);
-  assert.deepEqual(Object.keys(stored.destinations), ['GOOD']);
-});
-
-test('credential overrides use route-aware modes and distinct CF destination keys', async t => {
-  const directory = await mkdtemp(join(tmpdir(), 'bas-creds-modes-'));
-  const path = join(directory, 'sap-ai-dev-toolkit-credentials.json');
-  t.after(async () => { await rm(directory, { recursive: true, force: true }); });
-
-  const basDestination = { name: 'shared-name', source: 'bas', proxyType: 'Internet', authentication: 'BasicAuthentication', backendUrl: 'https://internet.example' };
-  const basOnPremise = { name: 'shared-name', source: 'bas', proxyType: 'OnPremise', authentication: 'BasicAuthentication' };
-  const cfOnPremise = { name: 'shared-name', serverName: 'cf:space-one:instance-one:shared-name', source: 'cloud-foundry', proxyType: 'OnPremise', authentication: 'BasicAuthentication' };
-  const principalPropagation = { ...cfOnPremise, authentication: 'PrincipalPropagation' };
-
-  assert.equal(canPromptForCredentials(basDestination), true);
-  assert.equal(credentialModeForDestination(basDestination), 'direct');
-  assert.equal(credentialModeForDestination(basOnPremise), 'bas-tunnel');
-  assert.equal(credentialModeForDestination(cfOnPremise), 'cf-connectivity');
-  assert.equal(canPromptForCredentials(principalPropagation), false);
-  assert.equal(credentialModeForDestination({ ...cfOnPremise, proxyType: 'Internet' }), null);
-  assert.equal(canPromptForCredentials({ ...basDestination, backendUrl: null }), false);
-  assert.notEqual(credentialKeyForDestination(basOnPremise), credentialKeyForDestination(cfOnPremise));
-
-  const cfKey = credentialKeyForDestination(cfOnPremise);
-  await storeDestinationCredentials(path, cfKey, { user: 'OVERRIDE', password: 'secret', mode: 'cf-connectivity' });
-  const stored = await readCredentials(path);
-  assert.equal(stored.destinations[cfKey].mode, 'cf-connectivity');
-  assert.equal(stored.destinations[cfKey].host, undefined);
-  await assert.rejects(
-    () => storeDestinationCredentials(path, 'INVALID', { user: 'U', password: 'P', mode: 'bypass-cloud-connector' }),
-    /route mode is unsupported/
-  );
-});
-
-test('relay direct connect sends Basic auth and CSRF pairing succeeds', async t => {
-  const { state, server } = authedBackend();
-  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
-  const backendUrl = `http://127.0.0.1:${server.address().port}`;
-  const relay = createBasDestinationRelay(
-    {
-      name: 'S4H',
-      url: 'http://S4H.dest',
-      authentication: 'BasicAuthentication',
-      credentials: { host: backendUrl, user: 'DEVELOPER', password: 'secret123' }
-    },
-    { env: { HTTP_PROXY: '' }, log: () => {} }
-  );
-  const relayUrl = await relay.ready;
-  t.after(async () => { await relay.close(); await new Promise(resolve => server.close(resolve)); });
-  try {
-    const read = await relayFetch(relayUrl, '/sap/bc/adt/discovery');
-    assert.equal(read.status, 200, 'authenticated read must succeed');
-    const write = await relayFetch(relayUrl, '/sap/bc/adt/datapreview/freestyle', { method: 'POST', body: '<q/>' });
-    assert.equal(write.status, 201, `CSRF-protected write must succeed, got ${write.status}: ${write.body}`);
-    const post = state.requests.find(request => request.method === 'POST');
-    assert.match(post.headers.authorization, /^Basic /);
-    assert.match(String(post.headers.cookie), /sap-session-\d+=/);
-    assert.equal(relay.stats.direct, true);
-  } finally {
-    void relayUrl;
-  }
-});
-
-test('relay direct connect with wrong credentials surfaces 401 without retries', async t => {
-  const { state, server } = authedBackend();
-  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
-  const backendUrl = `http://127.0.0.1:${server.address().port}`;
-  const relay = createBasDestinationRelay(
-    {
-      name: 'S4H',
-      url: 'http://S4H.dest',
-      authentication: 'BasicAuthentication',
-      credentials: { host: backendUrl, user: 'DEVELOPER', password: 'wrong' }
-    },
-    { env: { HTTP_PROXY: '' }, log: () => {} }
-  );
-  const relayUrl = await relay.ready;
-  t.after(async () => { await relay.close(); await new Promise(resolve => server.close(resolve)); });
-  const write = await relayFetch(relayUrl, '/sap/bc/adt/datapreview/freestyle', { method: 'POST', body: '<q/>' });
-  assert.equal(write.status, 401);
-  assert.equal(relay.stats.csrfRetries, 0, '401 without a session must not trigger CSRF retries');
-  void state;
-});