sap-ai-dev-toolkit 0.5.5 → 0.5.6

package/scripts/build-vsp.mjs

@@ -5,12 +5,13 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createHash } from 'node:crypto';
 import { ensureGo } from './ensure-go.mjs';
+import { UPSTREAM_COMMIT } from '../src/binary.mjs';
 
 const exec = promisify(execFile);
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const source = join(root, '.build', 'vibing-steampunk');
 const dist = join(root, 'dist');
-const commit = '9886d2727f47506368b0a3c2f1c1766f1200f747';
+const commit = UPSTREAM_COMMIT;
 const upstream = 'https://github.com/oisee/vibing-steampunk.git';
 const targets = [
   ['linux', 'amd64', 'linux', 'x64', ''],

package/scripts/postinstall.mjs

@@ -2,7 +2,6 @@ import { open, readFile } from 'node:fs/promises';
 import { closeSync, openSync, realpathSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { ensureGo } from './ensure-go.mjs';
 import { installBinary } from '../src/binary.mjs';
 import { runSetup } from '../src/setup.mjs';
 import { installUserCopilotAssets } from './install-user-copilot-assets.mjs';
@@ -12,6 +11,7 @@ import { homedir } from 'node:os';
 import { colorText, formatStatus } from '../src/terminal-ui.mjs';
 import { brandedEnvValue, withBrandedEnvironment } from '../src/branding.mjs';
 import { generatedServerName } from '../src/mcp-config.mjs';
+import { redactText } from '../src/redact.mjs';
 
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
@@ -77,10 +77,10 @@ async function runCopilotAssetInstall() {
     await announce([
       'Optional Copilot setup is waiting for your choice.',
       '',
-      'Press Enter to install the bundled agents and all skills in the path shown below; type n then press Enter to skip.',
+      'Type y then press Enter to install the bundled agents and all skills in the path shown below; press Enter alone to skip.',
       '',
-      `${colorText('✅ Press Enter', 'green', true)} to install the bundled agents and all skills.`,
-      `${colorText('⏭️  Type n then Enter', 'yellow', true)} to skip this optional step.`,
+      `${colorText('✅ Type y then Enter', 'green', true)} to install the bundled agents and all skills.`,
+      `${colorText('⏭️  Press Enter', 'yellow', true)} to skip this optional step (default).`,
       '',
       `${colorText('📁 Target folder:', 'cyan', true)}`,
       `   ${copilotRoot}`,
@@ -89,11 +89,13 @@ async function runCopilotAssetInstall() {
     const prompt = createInterface({ input: terminal.input, output: terminal.output });
     let answer;
     try {
-      answer = await prompt.question(`${colorText('🤖 Install the bundled agents and all skills?', 'magenta', terminal.output)} ${colorText('[Y/n]', 'yellow', terminal.output)} `);
+      answer = await prompt.question(`${colorText('🤖 Install the bundled agents and all skills?', 'magenta', terminal.output)} ${colorText('[y/N]', 'yellow', terminal.output)} `);
     } finally {
       prompt.close();
     }
-    if (/^n(?:o)?$/i.test(answer.trim())) {
+    // Default is skip: writing instruction files into ~/.copilot affects
+    // every Copilot session on the machine, so it needs an explicit yes.
+    if (!/^y(?:es)?$/i.test(answer.trim())) {
       await announce('Copilot agent and skills were skipped. Your files were not changed.', 'info');
       return;
     }
@@ -111,8 +113,7 @@ async function runCopilotAssetInstall() {
 function probeCell(destination) {
   const probe = destination.probe || {};
   if (probe.status === 'skipped') return { text: 'SKIPPED (probe disabled)', color: 'yellow' };
-  const error = destination.source === 'cloud-foundry' ? '' : String(probe.error || '')
-    .replace(/(authorization|cookie|password|secret|token)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]')
+  const error = destination.source === 'cloud-foundry' ? '' : redactText(probe.error || '')
     .replace(/[\u0000-\u001f\u007f]/g, ' ')
     .replace(/\s+/g, ' ')
     .slice(0, 100);
@@ -219,17 +220,14 @@ async function announceSetup(result) {
 async function main() {
   if (process.env.npm_config_ignore_scripts === 'true') return;
 
+  // Go is intentionally NOT provisioned here: the installed package never
+  // runs `go` (only the repository-only build:vsp script does), so a toolchain
+  // download at install time was pure cost. The pinned, checksum-verified VSP
+  // binary ships with the package; the download below is the fallback.
   try {
     if (brandedEnvValue(runtimeEnv, 'BINARY')) {
       await announce('Using the SAP_AI_DEV_TOOLKIT_BINARY override.', 'info');
     } else {
-      await announce('Checking for Go. The supported version installs automatically if needed; this may take a few minutes.', 'progress');
-      try {
-        await ensureGo();
-        await announce('Go is ready.', 'success');
-      } catch (error) {
-        throw new Error(`Go provisioning failed: ${error.message}`);
-      }
       await announce('Preparing the pinned VSP runtime for this platform.', 'progress');
       try {
         await installBinary(pkg, { env: runtimeEnv });
@@ -240,7 +238,7 @@ async function main() {
     }
   } catch (error) {
     await announce(error.message, 'error');
-    await announce('Go is provisioned automatically. Set SAP_AI_DEV_TOOLKIT_BINARY only when supplying a trusted prebuilt VSP executable.', 'info');
+    await announce('Set SAP_AI_DEV_TOOLKIT_BINARY only when supplying a trusted prebuilt VSP executable.', 'info');
     process.exitCode = 1;
     return;
   }

package/src/bas-destination-relay.mjs

@@ -2,6 +2,7 @@ import http from 'node:http';
 import { fetch as undiciFetch, ProxyAgent } from 'undici';
 import { CookieJar } from 'tough-cookie';
 import { brandedEnvValue } from './branding.mjs';
+import { redactText } from './redact.mjs';
 
 const DEFAULT_PROXY = 'http://127.0.0.1:8887';
 const MAX_BODY_BYTES = 64 * 1024 * 1024;
@@ -274,7 +275,14 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
   function authHeaders(extra = {}) {
     if (!credentials?.user || !credentials?.password) return extra;
     const basic = Buffer.from(`${credentials.user}:${credentials.password}`).toString('base64');
-    return { authorization: `Basic ${basic}`, ...extra };
+    // The stored credential override wins over any inbound authorization
+    // header: the override exists precisely to pair Basic auth with the
+    // relay's CSRF session, and silently forwarding a caller-supplied header
+    // would disable that pairing without any diagnostic.
+    const headers = { ...extra };
+    delete headers.authorization;
+    delete headers.Authorization;
+    return { ...headers, authorization: `Basic ${basic}` };
   }
 
   async function forward(method, requestUrl, requestHeaders, body, session) {
@@ -339,11 +347,17 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
       const body = UNSAFE.has(method) ? await readRequestBody(req) : Buffer.alloc(0);
       const { response, body: responseBody } = await forwardWithRetry(method, requestUrl, req.headers, body);
       const responseHeaders = {};
+      // SAP sessions commonly set several cookies at once; a plain object
+      // assignment would collapse them to the last value. undici exposes the
+      // full list via getSetCookie, and Node's http server serializes an
+      // array as repeated headers.
+      const setCookies = response.headers.getSetCookie?.() || [];
+      if (setCookies.length) responseHeaders['set-cookie'] = setCookies;
       for (const [name, value] of response.headers) {
         const lower = name.toLowerCase();
         // undici decompresses response bodies; the stale content-encoding and
         // content-length would misdescribe the plain bytes handed to VSP.
-        if (HOP_BY_HOP.has(lower) || lower === 'content-encoding' || lower === 'content-length') continue;
+        if (lower === 'set-cookie' || HOP_BY_HOP.has(lower) || lower === 'content-encoding' || lower === 'content-length') continue;
         responseHeaders[name] = value;
       }
       responseHeaders['x-sap-ai-dev-toolkit-relay'] = 'bas-destination';
@@ -351,10 +365,18 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
       res.end(responseBody);
     })().catch(error => {
       if (!res.headersSent) res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8', 'connection': 'close' });
-      res.end(`BAS destination relay failed: ${error.message}\n`);
+      // Proxy and transport errors can embed the full proxy URL including
+      // userinfo; redact before the body reaches the child (and the tool result).
+      res.end(`BAS destination relay failed: ${redactText(error.message)}\n`);
     });
   });
 
+  // Keep an error listener for the server's whole lifetime: after listen()
+  // succeeds, a later 'error' event (port collision cleanup, socket reset)
+  // with no listener would be an uncaught exception that kills the process.
+  server.on('error', error => {
+    log(`[${destination.name}] BAS relay server error: ${redactText(error.message)}`);
+  });
   // Bind eagerly and report the real port through `ready`. Callers must
   // await `ready` before handing the URL to a VSP child; binding failures
   // surface as a rejected promise instead of a silently wrong guessed port.

package/src/bas-discovery.mjs

@@ -92,9 +92,15 @@ export function sanitizeChildEnv(input = process.env) {
     if (!SECRET_KEY.test(key)) env[key] = value;
   }
   env.SAP_PROXY_CONTEXTID_GUARD = 'true';
-  const proxy = env.HTTP_PROXY || env.http_proxy || DEFAULT_PROXY;
-  if (!env.HTTP_PROXY && !env.http_proxy) env.HTTP_PROXY = proxy;
-  if (!env.HTTPS_PROXY && !env.https_proxy) env.HTTPS_PROXY = proxy;
+  // The BAS dev-space proxy (127.0.0.1:8887) is only implied inside BAS
+  // (H2O_URL present). Outside a dev space the default would route every
+  // child request — including SAP Basic credentials — to whatever local
+  // process happens to own that port, so it is not applied there.
+  const proxy = env.HTTP_PROXY || env.http_proxy || (env.H2O_URL ? DEFAULT_PROXY : undefined);
+  if (proxy) {
+    if (!env.HTTP_PROXY && !env.http_proxy) env.HTTP_PROXY = proxy;
+    if (!env.HTTPS_PROXY && !env.https_proxy) env.HTTPS_PROXY = proxy;
+  }
   const noProxyKey = env.NO_PROXY != null ? 'NO_PROXY' : (env.no_proxy != null ? 'no_proxy' : 'NO_PROXY');
   const entries = String(env[noProxyKey] || '').split(',').map(value => value.trim()).filter(Boolean).filter(value => !value.toLowerCase().includes('.dest'));
   env[noProxyKey] = entries.join(',');

package/src/binary.mjs

@@ -1,11 +1,13 @@
 import { createHash } from 'node:crypto';
-import { chmod, mkdir, rename, stat, writeFile } from 'node:fs/promises';
+import { chmod, mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises';
 import { homedir, tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { brandedEnvValue } from './branding.mjs';
 
 const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+// Single source of truth for the upstream VSP commit; scripts/build-vsp.mjs
+// imports this constant so the built artifact and the runtime cannot drift.
 export const UPSTREAM_COMMIT = '9886d2727f47506368b0a3c2f1c1766f1200f747';
 
 const platformMap = {
@@ -26,6 +28,46 @@ export function bundledBinaryPath(platform = process.platform, arch = process.ar
   return join(packageRoot, 'dist', binaryTarget(platform, arch).asset);
 }
 
+// The npm-published dist/checksums.txt is the trust anchor: unlike a GitHub
+// release (mutable) or a downloaded checksum file (same origin as the
+// binary), its content is fixed the moment the package version is published.
+let packagedChecksumsCache;
+async function packagedChecksums() {
+  if (packagedChecksumsCache !== undefined) return packagedChecksumsCache;
+  const map = new Map();
+  try {
+    const text = await readFile(join(packageRoot, 'dist', 'checksums.txt'), 'utf8');
+    for (const line of text.split(/\r?\n/)) {
+      const parts = line.trim().split(/\s+/);
+      if (parts.length >= 2) map.set(parts[1], parts[0].toLowerCase());
+    }
+  } catch {
+    // Development checkouts without a dist/ fall through to the remote
+    // release checksum during install; local candidates stay unverified.
+  }
+  packagedChecksumsCache = map;
+  return map;
+}
+
+async function sha256File(path) {
+  const bytes = await readFile(path);
+  return createHash('sha256').update(bytes).digest('hex');
+}
+
+// Verifies a locally present binary against the packaged checksum manifest.
+// Returns true (verified), false (mismatch — must not be executed), or null
+// (no packaged entry; caller decides whether to trust the candidate).
+async function verifyAgainstPackagedChecksums(path, target) {
+  const checksums = await packagedChecksums();
+  const expected = checksums.get(target.asset);
+  if (!expected) return null;
+  try {
+    return (await sha256File(path)) === expected;
+  } catch {
+    return false;
+  }
+}
+
 export function packageRepositoryUrl(pkg) {
   const raw = typeof pkg.repository === 'string' ? pkg.repository : pkg.repository?.url;
   if (!raw) throw new Error('package.json repository.url is required to resolve VSP release assets');
@@ -36,12 +78,12 @@ export function releaseBaseUrl(pkg, version = pkg.version) {
   const override = brandedEnvValue(process.env, 'RELEASE_BASE_URL');
   if (override) return `${override.replace(/\/$/, '')}/v${version}`;
   const repo = packageRepositoryUrl(pkg).replace(/^ssh:\/\/git@github.com:/, 'https://github.com/').replace(/^git@github.com:/, 'https://github.com/');
-  if (!repo.startsWith('http')) throw new Error('package repository URL must be an HTTPS URL for release assets');
+  if (!repo.startsWith('https://')) throw new Error('package repository URL must be an HTTPS URL for release assets');
   return `${repo}/releases/download/v${version}`;
 }
 
-export function cacheDirectory() {
-  return process.env.BAS_VSP_CACHE_DIR || join(process.env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'sap-ai-dev-toolkit');
+export function cacheDirectory(env = process.env) {
+  return brandedEnvValue(env, 'CACHE_DIR') || join(env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'sap-ai-dev-toolkit');
 }
 
 export function cachedBinaryPath(pkg, platform = process.platform, arch = process.arch, env = process.env) {
@@ -51,22 +93,49 @@ export function cachedBinaryPath(pkg, platform = process.platform, arch = proces
 
 function legacyCachedBinaryPath(pkg, platform, arch, env) {
   const target = binaryTarget(platform, arch);
-  const configuredCache = brandedEnvValue(env, 'CACHE_DIR');
-  const cacheRoot = configuredCache || join(env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'bas-mcp-addon');
+  const cacheRoot = join(env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'bas-mcp-addon');
   return join(cacheRoot, `bas-mcp-addon-${pkg.version}-${target.asset}`);
 }
 
 export async function findBinary(pkg, options = {}) {
   const env = options.env || process.env;
+  const log = options.log || (() => {});
+  const target = binaryTarget(options.platform, options.arch);
   if (brandedEnvValue(env, 'BINARY')) return brandedEnvValue(env, 'BINARY');
   if (!brandedEnvValue(env, 'BINARY_URL')) {
     const bundled = bundledBinaryPath(options.platform, options.arch);
-    try { await stat(bundled); return bundled; } catch {}
+    try {
+      await stat(bundled);
+      const verified = await verifyAgainstPackagedChecksums(bundled, target);
+      if (verified === false) {
+        log(`bundled VSP binary ${target.asset} failed checksum verification; ignoring it`);
+      } else {
+        if (verified === null) log(`bundled VSP binary ${target.asset} has no packaged checksum entry; using it unverified`);
+        return bundled;
+      }
+    } catch {}
   }
   const path = cachedBinaryPath(pkg, options.platform, options.arch, env);
-  try { await stat(path); return path; } catch {}
+  try {
+    await stat(path);
+    const verified = await verifyAgainstPackagedChecksums(path, target);
+    if (verified === false) {
+      log(`cached VSP binary ${target.asset} failed checksum verification; ignoring it`);
+    } else {
+      if (verified === null) log(`cached VSP binary ${target.asset} has no packaged checksum entry; using it unverified`);
+      return path;
+    }
+  } catch {}
+  // The legacy bas-mcp-addon cache was written by an older release this code
+  // never verified; only execute it when the packaged checksum confirms it.
   const legacyPath = legacyCachedBinaryPath(pkg, options.platform, options.arch, env);
-  try { await stat(legacyPath); return legacyPath; } catch { return null; }
+  try {
+    await stat(legacyPath);
+    const verified = await verifyAgainstPackagedChecksums(legacyPath, target);
+    if (verified === true) return legacyPath;
+    log(`legacy cached VSP binary ${legacyPath} has no packaged checksum match; ignoring it`);
+  } catch {}
+  return null;
 }
 
 export async function installBinary(pkg, options = {}) {
@@ -74,22 +143,37 @@ export async function installBinary(pkg, options = {}) {
   if (brandedEnvValue(env, 'BINARY')) return brandedEnvValue(env, 'BINARY');
   if (!brandedEnvValue(env, 'BINARY_URL')) {
     const bundled = bundledBinaryPath(options.platform, options.arch);
-    try { await stat(bundled); return bundled; } catch {}
+    try {
+      await stat(bundled);
+      const target0 = binaryTarget(options.platform, options.arch);
+      if (await verifyAgainstPackagedChecksums(bundled, target0) !== false) return bundled;
+      throw new Error(`bundled VSP binary ${target0.asset} failed checksum verification`);
+    } catch (error) {
+      if (String(error?.message || '').includes('checksum verification')) throw error;
+    }
   }
   const target = binaryTarget(options.platform, options.arch);
   const base = releaseBaseUrl(pkg, pkg.version);
   const assetUrl = brandedEnvValue(env, 'BINARY_URL') || `${base}/${target.asset}`;
-  const checksumUrl = `${base}/checksums.txt`;
   const response = await fetch(assetUrl);
   if (!response.ok) throw new Error(`VSP binary download failed (${response.status}); set SAP_AI_DEV_TOOLKIT_BINARY or SAP_AI_DEV_TOOLKIT_BINARY_URL`);
   const bytes = Buffer.from(await response.arrayBuffer());
-  const checksumResponse = await fetch(checksumUrl);
-  if (!checksumResponse.ok) throw new Error(`VSP checksum download failed (${checksumResponse.status}); set SAP_AI_DEV_TOOLKIT_BINARY or SAP_AI_DEV_TOOLKIT_BINARY_URL`);
-  const checksumText = await checksumResponse.text();
-  const expected = checksumText.split(/\r?\n/).map(line => line.trim().split(/\s+/)).find(parts => parts.length >= 2 && (parts[1] === target.asset || parts[1].endsWith(`/${target.asset}`)))?.[0];
-  if (!expected) throw new Error(`checksums.txt has no entry for ${target.asset}; set SAP_AI_DEV_TOOLKIT_BINARY or SAP_AI_DEV_TOOLKIT_BINARY_URL`);
   const actual = createHash('sha256').update(bytes).digest('hex');
-  if (actual.toLowerCase() !== expected.toLowerCase()) throw new Error(`VSP checksum mismatch for ${target.asset}`);
+  // Prefer the packaged checksum manifest (immutable per published version)
+  // as the anchor; only when it has no entry fall back to the release's own
+  // checksums.txt so pre-release builds keep working.
+  let expected = (await packagedChecksums()).get(target.asset);
+  let expectedSource = 'packaged checksums.txt';
+  if (!expected) {
+    const checksumUrl = `${base}/checksums.txt`;
+    const checksumResponse = await fetch(checksumUrl);
+    if (!checksumResponse.ok) throw new Error(`VSP checksum download failed (${checksumResponse.status}); set SAP_AI_DEV_TOOLKIT_BINARY or SAP_AI_DEV_TOOLKIT_BINARY_URL`);
+    const checksumText = await checksumResponse.text();
+    expected = checksumText.split(/\r?\n/).map(line => line.trim().split(/\s+/)).find(parts => parts.length >= 2 && (parts[1] === target.asset || parts[1].endsWith(`/${target.asset}`)))?.[0]?.toLowerCase();
+    expectedSource = 'release checksums.txt';
+    if (!expected) throw new Error(`checksums.txt has no entry for ${target.asset}; set SAP_AI_DEV_TOOLKIT_BINARY or SAP_AI_DEV_TOOLKIT_BINARY_URL`);
+  }
+  if (actual !== expected) throw new Error(`VSP checksum mismatch for ${target.asset} (verified against ${expectedSource})`);
   const dir = cacheDirectory(env);
   await mkdir(dir, { recursive: true, mode: 0o700 });
   await chmod(dir, 0o700);

package/src/cf-destination.mjs

@@ -114,6 +114,51 @@ export async function deleteManagedCloudFoundryServiceKeys({ env = process.env,
   return { warnings };
 }
 
+async function listToolkitServiceKeys({ env = process.env, spaceGuid, execFileImpl = nodeExecFile } = {}) {
+  const options = { env, execFileImpl };
+  const keys = [];
+  let path = `/v3/service_credential_instances?space_guids=${encodeURIComponent(spaceGuid)}&type=key&per_page=500`;
+  const visited = new Set();
+  while (path && !visited.has(path)) {
+    visited.add(path);
+    const page = await cfJson(path, options);
+    if (!Array.isArray(page?.resources)) return keys;
+    for (const resource of page.resources) {
+      const name = text(resource?.name);
+      const instanceGuid = resource?.relationships?.service_instance?.data?.guid;
+      if (!name.startsWith(KEY_PREFIX) || !instanceGuid) continue;
+      keys.push({ keyName: name, instanceGuid: String(instanceGuid) });
+    }
+    path = page?.metadata?.pagination?.next?.href ? apiPath(page.metadata.pagination.next.href) : '';
+  }
+  return keys;
+}
+
+// Reconcile toolkit-created service keys against the references recorded in
+// the MCP config. A Destination-instance service key exposes client
+// credentials for every destination in the instance, so a key orphaned by an
+// interrupted setup must not linger unnoticed.
+export async function findOrphanedCloudFoundryServiceKeys({ env = process.env, spaceGuid, managedKeys = [], execFileImpl = nodeExecFile } = {}) {
+  const listed = await listToolkitServiceKeys({ env, spaceGuid, execFileImpl });
+  const referenced = new Set((managedKeys || [])
+    .filter(ref => ref?.spaceGuid === spaceGuid && ref?.instanceGuid && ref?.keyName)
+    .map(ref => `${ref.instanceGuid}\0${ref.keyName}`));
+  const orphans = [];
+  const instanceNames = new Map();
+  for (const key of listed) {
+    if (referenced.has(`${key.instanceGuid}\0${key.keyName}`)) continue;
+    if (!instanceNames.has(key.instanceGuid)) {
+      try {
+        instanceNames.set(key.instanceGuid, text((await cfJson(`/v3/service_instances/${encodeURIComponent(key.instanceGuid)}`, { env, execFileImpl })).name));
+      } catch {
+        instanceNames.set(key.instanceGuid, '');
+      }
+    }
+    orphans.push({ kind: 'toolkit-created', spaceGuid, instanceGuid: key.instanceGuid, instanceName: instanceNames.get(key.instanceGuid) || key.instanceGuid, keyName: key.keyName });
+  }
+  return orphans;
+}
+
 async function cfJson(path, options) {
   const value = await runCf(['curl', path], options);
   try {
@@ -493,10 +538,19 @@ function probeResult(status) {
   return { status: 'unavailable', available: false, httpStatus: status };
 }
 
+function isLoopbackHostname(hostname) {
+  const host = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+  return host === '127.0.0.1' || host === 'localhost' || host === '::1';
+}
+
 async function probeRecord(record, env, { forcedProxy, fetchImpl = undiciFetch } = {}) {
   const target = new URL('/sap/bc/adt/discovery', record.url);
   const headers = { accept: 'application/xml,text/xml,*/*' };
-  if (record.authentication === 'BasicAuthentication') {
+  // Never send SAP Basic credentials over cleartext HTTP to a remote host:
+  // an http:// destination URL is allowed for reachability probing, but the
+  // probe runs unauthenticated then (401/403 still counts as reachable).
+  const plaintextRemote = target.protocol === 'http:' && !isLoopbackHostname(target.hostname);
+  if (record.authentication === 'BasicAuthentication' && !plaintextRemote) {
     headers.authorization = `Basic ${Buffer.from(`${record.user}:${record.password}`).toString('base64')}`;
   }
   let dispatcher;

package/src/credentials-store.mjs

@@ -10,8 +10,6 @@ import { brandedEnvValue } from './branding.mjs';
 const CREDENTIALS_FILENAME = 'sap-ai-dev-toolkit-credentials.json';
 const CREDENTIAL_MODES = new Set(['direct', 'bas-tunnel', 'cf-connectivity']);
 
-const SECRET_PATTERN = /(authorization|cookie|password|secret|token|bearer|credential)/i;
-
 async function exists(path) {
   try {
     await stat(path);
@@ -22,10 +20,6 @@ async function exists(path) {
   }
 }
 
-export function redactCredentialValue(value) {
-  return SECRET_PATTERN.test(String(value)) ? '[redacted]' : value;
-}
-
 export async function resolveCredentialsPath(env = process.env, mcpConfigPath) {
   const configured = brandedEnvValue(env, 'CREDENTIALS_FILE');
   if (configured) return configured;
@@ -117,7 +111,3 @@ export async function removeDestinationCredentials(path, names) {
   if (removed.length) await writeCredentials(path, destinations);
   return { path, removed };
 }
-
-export function listCredentialDestinations(credentials) {
-  return Object.entries(credentials?.destinations || {}).map(([name, entry]) => ({ name, host: entry.host, user: entry.user, updatedAt: entry.updatedAt }));
-}

package/src/engineering-tools.mjs

@@ -1,12 +1,14 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { ProxyAgent, fetch as undiciFetch } from 'undici';
 import { sanitizeChildEnv } from './bas-discovery.mjs';
+import { redactText } from './redact.mjs';
 
 const CHANGESET_WRITE_TOOLS = new Set(['WriteSource']);
 const TRANSPORT_CHECK_TOOLS = new Set(['GetTransport', 'GetTransportInfo', 'ListDependencies', 'GetInactiveObjects', 'RunUnitTests', 'RunATCCheck']);
 const MAX_CHANGE_BYTES = 128 * 1024;
 const MAX_CHANGESET_SIZE = 12;
 const MAX_REMOTE_BODY_BYTES = 2 * 1024 * 1024;
+const MAX_SUITE_CASES = 30;
 
 function object(value) {
   return value !== null && typeof value === 'object' && !Array.isArray(value);
@@ -21,9 +23,7 @@ function toolJson(value) {
 }
 
 function safeDiagnostic(value) {
-  return String(value?.message || value || 'unknown error')
-    .replace(/(authorization|proxy-authorization)\s*[:=]\s*(?:bearer\s+|basic\s+)?[^\s,;]+/gi, '$1=[redacted]')
-    .replace(/(cookie|password|secret|token)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]')
+  return redactText(value?.message || value || 'unknown error')
     .replace(/\s+/g, ' ')
     .slice(0, 300);
 }
@@ -339,27 +339,43 @@ function responseForDemo(path) {
   return { status: 200, contentType: 'application/json', body: JSON.stringify({ value: [{ ID: '10000001', Description: 'Sample order' }] }) };
 }
 
+function isLoopbackHost(hostname) {
+  const host = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+  return host === '127.0.0.1' || host === 'localhost' || host === '::1';
+}
+
+// OData reads follow the same egress rules as the relay: loopback targets
+// (the local BAS relay the child talks to) must go direct, NO_PROXY
+// exemptions are honored, and everything else uses the configured proxy.
+function proxyUrlFor(target, env) {
+  if (isLoopbackHost(target.hostname)) return '';
+  const host = target.hostname.toLowerCase();
+  const noProxy = String(env.NO_PROXY || env.no_proxy || '').split(',').map(value => value.trim().toLowerCase()).filter(Boolean);
+  if (noProxy.some(entry => entry === '*' || host === entry || host.endsWith(entry.startsWith('.') ? entry : `.${entry}`))) return '';
+  return String(env.HTTP_PROXY || env.http_proxy || env.HTTPS_PROXY || env.https_proxy || '');
+}
+
 async function fetchOData(entry, path, accept, env) {
   if (entry.destination.demo) return responseForDemo(path);
   const childEnv = { ...sanitizeChildEnv(env), ...(entry.destination.childEnv || {}) };
-  const proxyUrl = childEnv.HTTP_PROXY || childEnv.http_proxy;
-  if (!proxyUrl) throw new Error('No HTTP proxy is configured for the destination');
   const target = new URL(path, entry.destination.url);
   const base = new URL(entry.destination.url);
   if (target.origin !== base.origin || target.username || target.password || target.hash) throw new Error('OData request escaped the connected destination');
-  const dispatcher = new ProxyAgent(proxyUrl);
+  const proxyUrl = proxyUrlFor(target, childEnv);
+  if (!proxyUrl && /\.dest$/i.test(target.hostname)) throw new Error('No HTTP proxy is configured for the .dest destination');
+  const dispatcher = proxyUrl ? new ProxyAgent(proxyUrl) : undefined;
   try {
     const response = await undiciFetch(target, {
       method: 'GET',
       headers: { accept },
-      dispatcher,
+      ...(dispatcher ? { dispatcher } : {}),
       signal: AbortSignal.timeout(10_000),
       redirect: 'manual'
     });
     const body = await readBody(response);
     return { status: response.status, contentType: response.headers.get('content-type') || '', body };
   } finally {
-    await dispatcher.close();
+    await dispatcher?.close();
   }
 }
 
@@ -576,17 +592,23 @@ export function createEngineeringTools(entry, upstreamTools, { env = process.env
     if (response.status < 200 || response.status >= 300) throw new Error(`OData metadata request returned HTTP ${response.status}`);
     const entitySets = parseEntitySets(response.body);
     if (!entitySets.length) throw new Error('OData metadata did not contain entity sets');
+    // Cap generation so the emitted suite is always accepted by
+    // RunRAPRegressionSuite's own 30-case limit; report what was omitted.
+    const included = entitySets.slice(0, MAX_SUITE_CASES - 1);
     return toolJson({
       suite: {
         name: `${entry.destination.name} RAP smoke suite`,
         service_root: serviceRoot,
         cases: [
           { name: 'OData metadata', path: '$metadata', expected_status: 200, expected_content_type: 'xml' },
-          ...entitySets.map(name => ({ name: `Read ${name}`, path: `${name}?$top=1`, expected_status: 200, expected_content_type: 'json' }))
+          ...included.map(name => ({ name: `Read ${name}`, path: `${name}?$top=1`, expected_status: 200, expected_content_type: 'json' }))
         ]
       },
       entity_set_count: entitySets.length,
-      destination: entry.destination.name
+      destination: entry.destination.name,
+      ...(entitySets.length > included.length
+        ? { note: `${entitySets.length - included.length} entity sets were omitted to keep the suite within the ${MAX_SUITE_CASES}-case limit; generate targeted suites for them separately.` }
+        : {})
     });
   });
 

package/src/hana-tools.mjs

@@ -7,7 +7,11 @@ const MAX_COLUMNS = 40;
 const MAX_FILTERS = 20;
 const MAX_SELECTED_COLUMN_WIDTH = 8192;
 const UNBOUNDED_COLUMN_TYPES = new Set(['BLOB', 'CLOB', 'NCLOB', 'BINARY', 'VARBINARY', 'ST_GEOMETRY', 'ST_POINT']);
-const SENSITIVE_COLUMN_NAME = /(?:PASS(?:WORD|WD)|SECRET|(?:ACCESS|REFRESH|AUTH)?_?TOKEN|API_?KEY|PRIVATE_?KEY|CREDENTIAL)/i;
+// Denylist of credential-like column names. This is a heuristic — the real
+// control is the dedicated read-only HANA identity — but it keeps obvious
+// secret material (password hashes, salts, signatures, certificates, JWTs,
+// session ids) out of tool results even under that identity.
+const SENSITIVE_COLUMN_NAME = /(?:PASS(?:WORD|WD)?|PWD|PASSPHRASE|SECRET|CREDENTIAL|(?:ACCESS|REFRESH|AUTH|SESSION)?_?TOKEN|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|SIGNATURE|SALT|CERT(?:IFICATE)?|JWT|BEARER)/i;
 const SAFE_INSPECTION_ERRORS = new Set([
   'HANA result is too large to return safely; request fewer rows or columns.',
   'The requested object was not found in the bound HDI schema.',
@@ -181,7 +185,10 @@ async function readRows(database, schema, args) {
   const where = conditions.length ? ` WHERE ${conditions.join(' AND ')}` : '';
   const sql = `SELECT ${selected} FROM ${quoteHanaIdentifier(schema)}.${quoteHanaIdentifier(args.objectName)}${where}${order} LIMIT ${args.limit}`;
   const values = args.filters.map(filter => filter.value);
-  const rows = rowsOf(await database.query(sql, values));
+  // Defense in depth: the SQL LIMIT and the zod cap already bound the read,
+  // but the returned rows are sliced again so no future query-shape change
+  // can smuggle more than HANA_MAX_ROWS into a tool result.
+  const rows = rowsOf(await database.query(sql, values)).slice(0, HANA_MAX_ROWS);
   return {
     schema,
     ...target,