sap-ai-dev-toolkit 0.5.5 → 0.5.6

package/src/launcher.mjs

@@ -5,12 +5,13 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { discoverDestinations, remediation, slugifyDestination, statusRows } from './bas-discovery.mjs';
 import { findBinary } from './binary.mjs';
-import { MCPProxy, TOOL_NAME_PREFIX } from './mcp-proxy.mjs';
+import { MCPProxy } from './mcp-proxy.mjs';
 import { installMcpConfig, repairManagedMcpConfig } from './mcp-config.mjs';
 import { runSetup } from './setup.mjs';
 import { resolveConfiguredCloudFoundryDestination } from './cf-destination.mjs';
 import { withBrandedEnvironment } from './branding.mjs';
 import { enrichWithStoredCredentials } from './credential-overrides.mjs';
+import { redactText } from './redact.mjs';
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
 const runtimeEnv = withBrandedEnvironment(process.env);
@@ -47,10 +48,6 @@ function doctorRow(name, stage, status, detail) {
   return { name, stage, status, ...(detail ? { detail } : {}) };
 }
 
-function redactText(value) {
-  return String(value).replace(/(authorization|cookie|password|secret|token)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]');
-}
-
 async function runDoctor(destinations) {
   const checks = [];
   if (!destinations.length) {
@@ -111,7 +108,7 @@ async function runDoctor(destinations) {
       const listed = await proxy.handle({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} });
       if (listed?.error) throw new Error(listed.error.message || 'MCP tools/list failed');
       const tools = listed.result?.tools || [];
-      const toolPrefix = `${TOOL_NAME_PREFIX}${slugifyDestination(destination.name)}_`;
+      const toolPrefix = `${slugifyDestination(destination.name)}_`;
       const localSegments = new Set(['lint_abap', 'get_application_log', 'prepare_abap_change_set', 'apply_abap_change_set', 'check_transport_readiness', 'plan_abap_cloud_migration', 'generate_rap_regression_suite', 'run_rap_regression_suite']);
       const upstreamCount = tools.filter(tool => tool.name.startsWith(toolPrefix) && !localSegments.has(tool.name.slice(toolPrefix.length))).length;
       checks.push(doctorRow(destination.name, 'MCP tools/list', upstreamCount ? 'passed' : 'failed', `${upstreamCount} VSP tools and ${tools.length} total MCP tools returned; chat-picker binding is host-managed`));
@@ -167,7 +164,8 @@ async function runOfflineDemo() {
     childArgs: () => [demoPath],
     destinations: [{ name: 'demo', url: 'http://demo.dest', client: '001', demo: true }],
     env: { ...runtimeEnv, SAP_AI_DEV_TOOLKIT_DESTINATION: 'demo' },
-    log: message => console.error(message)
+    log: message => console.error(message),
+    version: pkg.version
   });
   console.error('[sap-ai-dev-toolkit] offline demo active; all SAP changes are simulated in memory');
   const shutdown = signal => { void proxy.close().finally(() => process.exit(signal === 'SIGINT' ? 130 : 143)); };
@@ -181,8 +179,7 @@ function probeDiagnostic(destination) {
   const details = [];
   if (probe.httpStatus) details.push(`HTTP ${probe.httpStatus}`);
   if (probe.error) {
-    const error = String(probe.error)
-      .replace(/(authorization|cookie|password|secret|token)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]')
+    const error = redactText(probe.error)
       .replace(/\s+/g, ' ')
       .slice(0, 400);
     details.push(error);
@@ -262,7 +259,7 @@ async function main() {
     let proxy;
     try {
       const binary = await binaryOrError();
-      proxy = new MCPProxy({ binary, destinations: [destination], env: runtimeEnv, log: logLine });
+      proxy = new MCPProxy({ binary, destinations: [destination], env: runtimeEnv, log: logLine, version: pkg.version });
       const shutdown = signal => { void proxy.close().finally(() => process.exit(signal === 'SIGINT' ? 130 : 143)); };
       process.once('SIGINT', () => shutdown('SIGINT'));
       process.once('SIGTERM', () => shutdown('SIGTERM'));
@@ -301,7 +298,7 @@ async function main() {
     else if (destination.credentials?.host) logLine(`[sap-ai-dev] ${destination.name}: direct connect enabled through stored credentials`);
   }
   logLine(`[sap-ai-dev] starting MCP proxy for ${destinations.map(destination => `${destination.name} (client=${destination.client})`).join(', ')}`);
-  const proxy = new MCPProxy({ binary, destinations, env: process.env, log: logLine });
+  const proxy = new MCPProxy({ binary, destinations, env: process.env, log: logLine, version: pkg.version });
   const shutdown = signal => { void proxy.close().finally(() => process.exit(signal === 'SIGINT' ? 130 : 143)); };
   process.once('SIGINT', () => shutdown('SIGINT'));
   process.once('SIGTERM', () => shutdown('SIGTERM'));

package/src/mcp-config.mjs

@@ -3,11 +3,27 @@ import { constants } from 'node:fs';
 import { access, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, delimiter, dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { brandedEnvValue } from './branding.mjs';
 import { slugifyDestination } from './bas-discovery.mjs';
 
 const LEGACY_MCP_SERVER_PREFIXES = ['sapAiDev_', 'basVspMcp_'];
 const COMPANION_SERVER_KIND = 'sap-development-companion';
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+// The self-package companion (HANA inspector) must launch the exact version
+// the user installed; an unpinned `npx sap-ai-dev-toolkit` would re-resolve
+// executable code from the registry at every MCP host start.
+let selfPackageVersion;
+async function runningPackageVersion() {
+  if (selfPackageVersion !== undefined) return selfPackageVersion;
+  try {
+    selfPackageVersion = String(JSON.parse(await readFile(join(packageRoot, 'package.json'), 'utf8')).version || '');
+  } catch {
+    selfPackageVersion = '';
+  }
+  return selfPackageVersion;
+}
 
 export const SAP_DEVELOPMENT_MCP_SERVERS = Object.freeze([
   Object.freeze({
@@ -294,9 +310,11 @@ export async function installMcpConfig(destinationsOrOptions, options = {}) {
   const env = options.env || process.env;
   const path = options.path || await resolveMcpConfigPath(env);
   const config = await readConfig(path);
+  const selfVersion = await runningPackageVersion();
+  const companionVersions = selfVersion ? { 'sap-ai-dev-toolkit': selfVersion, 'hana-cloud-inspector': selfVersion } : {};
   const generated = {
     ...buildMcpEntries(destinations, env),
-    ...buildSapDevelopmentMcpEntries(options.sapDevelopmentServers || [])
+    ...buildSapDevelopmentMcpEntries(options.sapDevelopmentServers || [], { packageVersions: companionVersions })
   };
   const launcherCommand = options.command || (destinations.length ? await resolveMcpServerCommand(env) : null);
   if (launcherCommand) {

package/src/mcp-proxy.mjs

@@ -5,6 +5,7 @@ import { ABAP_LINT_TOOL, runABAPLint } from './abaplint.mjs';
 import { createEngineeringTools } from './engineering-tools.mjs';
 import { brandedEnvValue } from './branding.mjs';
 import { createBasDestinationRelay } from './bas-destination-relay.mjs';
+import { diagnosticText, redactText } from './redact.mjs';
 
 const JSONRPC = '2.0';
 const FORWARDED_METHODS = new Set(['ping', 'resources/list', 'resources/read', 'resources/templates/list', 'prompts/list', 'completion/complete', 'logging/setLevel']);
@@ -37,6 +38,51 @@ const APPLICATION_LOG_SCHEMA = {
 };
 const APPLICATION_LOG_DESCRIPTION = 'Read SAP application log (SLG1) entries. Results are newest first and limited to 100 by default; set messages=true to include log message details.';
 
+// Read-only mode (SAP_AI_DEV_TOOLKIT_READ_ONLY=true) removes every tool that
+// changes SAP state from the public surface and starts VSP with
+// --transport-read-only, so an exploration destination cannot be written to
+// through this proxy even if a chat prompt asks for it.
+const READ_ONLY_HIDDEN_VSP_TOOLS = new Set([
+  'Activate',
+  'ActivateMultiple',
+  'CreateTransport',
+  'EditSource',
+  'SetBreakpoint',
+  'WriteSource'
+]);
+
+// Self-healing restarts retry the interrupted tools/call once. Retrying a
+// state-changing tool after a crash can apply the same write twice (the child
+// may have completed the side effect before dying), so these are never retried;
+// the original error is surfaced instead.
+const NON_RETRIABLE_VSP_TOOLS = new Set([
+  'Activate',
+  'ActivateMultiple',
+  'CreateTransport',
+  'EditSource',
+  'WriteSource'
+]);
+
+const MAX_CHILD_BUFFER_BYTES = 16 * 1024 * 1024;
+const MAX_PENDING_NOTIFICATIONS = 200;
+const DEFAULT_REQUEST_TIMEOUT_MS = 10 * 60 * 1000;
+const MAX_RESTARTS_PER_WINDOW = 5;
+const RESTART_WINDOW_MS = 5 * 60 * 1000;
+
+function requestTimeoutMs(env) {
+  const raw = brandedEnvValue(env, 'REQUEST_TIMEOUT_MS');
+  if (raw === undefined || raw === '') return DEFAULT_REQUEST_TIMEOUT_MS;
+  const parsed = Number(raw);
+  // 0 or a negative value disables the timeout; invalid values fall back.
+  if (!Number.isFinite(parsed)) return DEFAULT_REQUEST_TIMEOUT_MS;
+  return parsed > 0 ? Math.floor(parsed) : 0;
+}
+
+export function readOnlyMode(env = process.env) {
+  const raw = brandedEnvValue(env, 'READ_ONLY');
+  return raw !== undefined && ['1', 'true', 'yes'].includes(String(raw).trim().toLowerCase());
+}
+
 // Keep the default public VSP surface small enough for developer-lifecycle use.
 // Hidden upstream tools can still be used by local workflow tools when needed.
 export const PUBLIC_VSP_TOOLS = new Set([
@@ -93,8 +139,11 @@ export const PUBLIC_VSP_TOOLS = new Set([
   'WriteSource'
 ]);
 
-function exposeVspTool(tool) {
-  return PUBLIC_VSP_TOOLS.has(tool?.name);
+function exposeVspTool(tool, readOnly = false) {
+  if (!PUBLIC_VSP_TOOLS.has(tool?.name)) return false;
+  // Read-only destinations never expose the write/activate/transport-create
+  // surface, even when VSP registers it.
+  return !(readOnly && READ_ONLY_HIDDEN_VSP_TOOLS.has(tool.name));
 }
 
 // Public tool names are lowercase snake_case. BAS/VS Code chat tool references
@@ -108,10 +157,7 @@ export function snakeCaseName(value) {
 }
 
 // Every generated tool is prefixed with the destination it targets:
-// sap_system_<destination-slug>_<tool>, for example
-// sap_system_actions4d_get_table_contents.
-export const TOOL_NAME_PREFIX = 'sap_system_';
-
+// <destination-slug>_<tool>, for example demo-abap_get_table_contents.
 function publicToolSegment(name) {
   return snakeCaseName(name) || String(name).toLowerCase();
 }
@@ -127,8 +173,6 @@ function applicationLogArguments(arguments_ = {}) {
 
 function rpcResult(id, result) { return { jsonrpc: JSONRPC, id, result }; }
 function rpcError(id, code, message, data) { return { jsonrpc: JSONRPC, id, error: { code, message, ...(data === undefined ? {} : { data }) } }; }
-function redactText(text) { return String(text).replace(/(authorization|cookie|password|secret|token)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]'); }
-function diagnosticText(text) { return redactText(text || 'unknown error').replace(/\s+/g, ' ').slice(0, 500); }
 
 const closedRoutes = new WeakMap();
 
@@ -171,7 +215,8 @@ export function childArguments(destination, env = process.env) {
   const mode = brandedEnvValue(env, 'MODE') || 'expert';
   const args = ['--url', destination.url, '--client', destination.client || '001', '--mode', mode];
   if (destination.source !== 'cloud-foundry' || destination.authentication === 'PrincipalPropagation') args.push('--proxy-auth');
-  args.push('--enable-transports');
+  if (readOnlyMode(env)) args.push('--transport-read-only');
+  else args.push('--enable-transports');
   return args;
 }
 
@@ -184,6 +229,7 @@ class Child {
     this.buffer = '';
     this.exited = false;
     this.closing = false;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? 0;
     this.process = (options.spawn || nodeSpawn)(binary, options.args || childArguments(destination, options.env), {
       env: childEnvironment(destination, options.env),
       stdio: ['pipe', 'pipe', 'pipe']
@@ -194,6 +240,13 @@ class Child {
     this.process.stderr.on('data', chunk => {
       if (options.log) options.log(`[${destination.name}] ${redactText(chunk).trimEnd()}`);
     });
+    // A write racing child death surfaces as an EPIPE 'error' event on stdin.
+    // Without a listener that is an uncaught exception that kills the whole
+    // MCP server — exactly the crash window self-healing is meant to cover.
+    this.process.stdin.on('error', error => {
+      if (!this.closing && this.options.log) this.options.log(`[${destination.name}] VSP child stdin error: ${diagnosticText(error.message)}`);
+      this.fail(new Error(`child stdin failed: ${error.message}`));
+    });
     this.process.on('error', error => {
       if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] VSP child process error: ${diagnosticText(error.message)}`);
       this.fail(error);
@@ -210,12 +263,21 @@ class Child {
 
   onData(chunk) {
     this.buffer += chunk;
+    if (this.buffer.length > MAX_CHILD_BUFFER_BYTES) {
+      // A child streaming non-JSON garbage would grow this buffer unbounded.
+      this.fail(new Error('child stdout exceeded the buffered line limit'));
+      return;
+    }
     let newline;
     while ((newline = this.buffer.indexOf('\n')) >= 0) {
       const line = this.buffer.slice(0, newline).trim();
       this.buffer = this.buffer.slice(newline + 1);
       if (!line) continue;
-      try { this.onMessage(JSON.parse(line)); } catch (error) { this.fail(new Error(`invalid child JSON-RPC response: ${error.message}`)); }
+      // One garbled line (interleaved stderr, partial write) must not reject
+      // every in-flight request: skip it and let the per-request timeout or
+      // child exit handle a genuinely desynchronized stream.
+      try { this.onMessage(JSON.parse(line)); }
+      catch (error) { this.options.log?.(`[${this.destination.name}] dropped a non-JSON child line: ${diagnosticText(error.message)}`); }
     }
   }
 
@@ -250,9 +312,22 @@ class Child {
     if (this.exited || !this.process.stdin.writable) return Promise.reject(new Error(`destination ${this.destination.name} child is not running`));
     const id = this.nextId++;
     return new Promise((resolve, reject) => {
-      this.pending.set(id, { resolve, reject });
+      // A hung child (network stall, backend deadlock) must not hang the call
+      // forever. The timeout only fails this request; the child is left alone
+      // because killing it would also kill unrelated in-flight requests.
+      let timeout;
+      const cancel = () => clearTimeout(timeout);
+      this.pending.set(id, {
+        resolve: value => { cancel(); resolve(value); },
+        reject: error => { cancel(); reject(error); }
+      });
+      if (this.requestTimeoutMs > 0) {
+        timeout = setTimeout(() => {
+          if (this.pending.delete(id)) reject(new Error(`destination ${this.destination.name} did not answer ${method} within ${this.requestTimeoutMs}ms`));
+        }, this.requestTimeoutMs);
+      }
       try { this.process.stdin.write(`${JSON.stringify({ jsonrpc: JSONRPC, id, method, ...(params === undefined ? {} : { params })})}\n`); }
-      catch (error) { this.pending.delete(id); reject(error); }
+      catch (error) { cancel(); this.pending.delete(id); reject(error); }
     });
   }
 
@@ -310,7 +385,7 @@ class Child {
 }
 
 export class MCPProxy {
-  constructor({ binary, destinations, env = process.env, spawn = nodeSpawn, childArgs, log = message => console.error(message), output = line => process.stdout.write(`${line}\n`) }) {
+  constructor({ binary, destinations, env = process.env, spawn = nodeSpawn, childArgs, log = message => console.error(message), output = line => process.stdout.write(`${line}\n`), version = '0.0.0' }) {
     this.binary = binary;
     this.destinations = destinations;
     this.env = env;
@@ -318,6 +393,9 @@ export class MCPProxy {
     this.childArgs = childArgs;
     this.log = log;
     this.output = output;
+    this.version = version;
+    this.readOnly = readOnlyMode(env);
+    this.requestTimeoutMs = requestTimeoutMs(env);
     this.children = [];
     this.started = false;
     this.namespace = new Map();
@@ -338,13 +416,32 @@ export class MCPProxy {
   // notifications/message log event, in the host's MCP server output channel
   // (VS Code/BAS and Claude Code both render these). Events raised before the
   // client initializes are buffered so the channel still shows the full
-  // startup picture once it opens.
+  // startup picture once it opens. Everything passes through redactText so no
+  // lane can leak a credential that reached a diagnostic string.
   eventSink(message, level = 'info', logger = 'sap-ai-dev-toolkit') {
-    this.log(message);
+    const text = redactText(message);
+    this.log(text);
     if (!this.mcpLogEnabled(level)) return;
-    const notification = { jsonrpc: JSONRPC, method: 'notifications/message', params: { level, logger, data: message } };
+    const notification = { jsonrpc: JSONRPC, method: 'notifications/message', params: { level, logger, data: text } };
     if (this.clientInitialized) this.output(JSON.stringify(notification));
-    else this.pendingNotifications.push(notification);
+    else if (this.pendingNotifications.length < MAX_PENDING_NOTIFICATIONS) this.pendingNotifications.push(notification);
+  }
+
+  // Shared spawn options for initial start and self-healing restarts, so the
+  // replacement child behaves exactly like the one it replaces.
+  childSpawnOptions(destination) {
+    return {
+      env: this.env,
+      spawn: this.spawn,
+      args: this.childArgs?.(destination),
+      requestTimeoutMs: this.requestTimeoutMs,
+      log: message => this.eventSink(message),
+      onNotification: notification => {
+        if (notification.method === 'notifications/tools/list_changed') this.toolsCache = null;
+        if (this.clientInitialized) this.output(JSON.stringify(notification));
+        else if (this.pendingNotifications.length < MAX_PENDING_NOTIFICATIONS) this.pendingNotifications.push(notification);
+      }
+    };
   }
 
   start() {
@@ -370,8 +467,11 @@ export class MCPProxy {
                 stats: relay.stats
               },
               async close() {
-                await originalClose?.();
-                await relay.close();
+                try {
+                  await originalClose?.();
+                } finally {
+                  await relay.close();
+                }
               }
             };
             this.eventSink(`[${originalDestination.name}] BAS destination relay enabled (${relayUrl})`);
@@ -379,17 +479,7 @@ export class MCPProxy {
           this.eventSink(`[${destination.name}] starting VSP child (client=${destination.client || '001'})`);
           return {
             destination,
-            child: new Child(this.binary, destination, {
-              env: this.env,
-              spawn: this.spawn,
-              args: this.childArgs?.(destination),
-              log: message => this.eventSink(message),
-              onNotification: notification => {
-                if (notification.method === 'notifications/tools/list_changed') this.toolsCache = null;
-                if (this.clientInitialized) this.output(JSON.stringify(notification));
-                else this.pendingNotifications.push(notification);
-              }
-            })
+            child: new Child(this.binary, destination, this.childSpawnOptions(destination))
           };
         } catch (error) {
           this.eventSink(`[${destination.name}] failed to start child: ${diagnosticText(error.message)}`, 'error');
@@ -417,30 +507,38 @@ export class MCPProxy {
   // Self-healing mode 3: transparently restart a crashed VSP child so an
   // MCP tools/call does not permanently fail after a single crash. The
   // restarted child re-initializes and re-registers tools before the call
-  // is retried once.
+  // is retried once. Concurrent triggers share one restart (no orphaned
+  // children), and a bounded budget within a rolling window stops a
+  // crash-looping child from respawning forever.
   async restartChild(entry) {
     if (this.shuttingDown) throw new Error('MCP proxy is shutting down');
-    const name = entry.destination.name;
-    this.eventSink(`[${name}] VSP child crashed; self-healing restart in progress`, 'warning');
-    await entry.child.close().catch(() => {});
-    const child = new Child(this.binary, entry.destination, {
-      env: this.env,
-      spawn: this.spawn,
-      args: this.childArgs?.(entry.destination),
-      log: message => this.eventSink(message),
-      onNotification: notification => {
-        if (notification.method === 'notifications/tools/list_changed') this.toolsCache = null;
-        if (this.clientInitialized) this.output(JSON.stringify(notification));
-        else this.pendingNotifications.push(notification);
+    entry.restartState ||= { inFlight: null, timestamps: [] };
+    const state = entry.restartState;
+    if (state.inFlight) return state.inFlight;
+    const now = Date.now();
+    state.timestamps = state.timestamps.filter(at => now - at < RESTART_WINDOW_MS);
+    if (state.timestamps.length >= MAX_RESTARTS_PER_WINDOW) {
+      throw new Error(`VSP child restart budget exhausted (${MAX_RESTARTS_PER_WINDOW} in ${RESTART_WINDOW_MS / 1000}s); surfacing the failure instead of respawning`);
+    }
+    state.inFlight = (async () => {
+      const name = entry.destination.name;
+      this.eventSink(`[${name}] VSP child crashed; self-healing restart in progress`, 'warning');
+      try {
+        await entry.child.close().catch(() => {});
+        const child = new Child(this.binary, entry.destination, this.childSpawnOptions(entry.destination));
+        entry.child = child;
+        entry.server = await child.initialize(this.lastInitializeParams || {});
+        this.toolsCache = null;
+        await child.listToolsCached().catch(() => {});
+        state.timestamps.push(Date.now());
+        this.eventSink(`[${name}] VSP child self-healing restart complete`);
+        this.emitToolsListChanged();
+        return entry;
+      } finally {
+        state.inFlight = null;
       }
-    });
-    entry.child = child;
-    entry.server = await child.initialize(this.lastInitializeParams || {});
-    this.toolsCache = null;
-    await child.listToolsCached().catch(() => {});
-    this.eventSink(`[${name}] VSP child self-healing restart complete`);
-    this.emitToolsListChanged();
-    return entry;
+    })();
+    return state.inFlight;
   }
 
   emitToolsListChanged() {
@@ -494,11 +592,14 @@ export class MCPProxy {
     if (this.mergedToolsPromise) return this.mergedToolsPromise;
     if (this.toolsCacheValid()) return Promise.resolve([...this.toolsCache.tools]);
     const childrenAtBuild = this.children.map(entry => entry.child);
-    this.mergedToolsPromise = this.buildMergedTools()
+    // A build whose child listing failed is incomplete; caching it would pin
+    // the destination's missing tools until a restart or list_changed.
+    const buildState = { complete: true };
+    this.mergedToolsPromise = this.buildMergedTools(buildState)
       .then(tools => {
         // Cache only when the child set is unchanged; a restart that landed
         // mid-build invalidates the result and the next list rebuilds.
-        if (!this.shuttingDown && this.children.length === childrenAtBuild.length
+        if (!this.shuttingDown && buildState.complete && this.children.length === childrenAtBuild.length
           && this.children.every((entry, index) => entry.child === childrenAtBuild[index])) {
           this.toolsCache = { children: childrenAtBuild, tools };
         }
@@ -508,7 +609,7 @@ export class MCPProxy {
     return this.mergedToolsPromise;
   }
 
-  async buildMergedTools() {
+  async buildMergedTools(buildState = { complete: true }) {
     const namespace = new Map();
     const usedSlugs = new Map();
     const merged = [];
@@ -524,7 +625,7 @@ export class MCPProxy {
     };
     for (const entry of this.children) {
       const slug = slugifyDestination(entry.destination.name, usedSlugs);
-      const publicName = name => `${TOOL_NAME_PREFIX}${slug}_${publicToolSegment(name)}`;
+      const publicName = name => `${slug}_${publicToolSegment(name)}`;
       const lintName = publicName(ABAP_LINT_TOOL.name);
       publish(lintName, { handler: runABAPLint }, { ...ABAP_LINT_TOOL, name: lintName });
       try {
@@ -544,7 +645,7 @@ export class MCPProxy {
             });
           }
 
-          if (!exposeVspTool(tool)) continue;
+          if (!exposeVspTool(tool, this.readOnly)) continue;
           const name = publicName(tool.name);
           publish(name, { entry, upstream: tool.name }, { ...tool, name, description: `${tool.description || tool.name} [destination: ${entry.destination.name}]` });
         }
@@ -557,6 +658,7 @@ export class MCPProxy {
           });
         }
       } catch (error) {
+        buildState.complete = false;
         this.eventSink(`[${entry.destination.name}] tools/list failed: ${redactText(error.message)}`, 'error');
       }
     }
@@ -578,7 +680,7 @@ export class MCPProxy {
       if (message.method === 'initialize') {
         await this.initializeChildren(message.params || {});
         this.eventSink('[MCP] initialize complete; server ready', 'info');
-        return rpcResult(message.id, { protocolVersion: message.params?.protocolVersion || '2024-11-05', capabilities: { tools: { listChanged: true } }, serverInfo: { name: slugifyDestination(brandedEnvValue(this.env, 'DESTINATION') || this.children[0].destination.name), version: '0.1.0' } });
+        return rpcResult(message.id, { protocolVersion: message.params?.protocolVersion || '2024-11-05', capabilities: { tools: { listChanged: true } }, serverInfo: { name: slugifyDestination(brandedEnvValue(this.env, 'DESTINATION') || this.children[0].destination.name), version: this.version } });
       }
       if (!this.initialized) return rpcError(message.id, -32002, 'MCP proxy is not initialized');
       if (message.method === 'logging/setLevel' && MCP_LOG_LEVELS.includes(message.params?.level)) {
@@ -592,6 +694,10 @@ export class MCPProxy {
       }
       if (message.method === 'tools/call') {
         const name = message.params?.name;
+        // Concurrent dispatch means a tools/call can race the first
+        // tools/list that builds the tool namespace; ensure the surface
+        // exists before resolving the name.
+        if (!this.namespace.size) await this.mergedTools().catch(() => {});
         const mapped = this.namespace.get(name);
         if (!mapped) return rpcError(message.id, -32602, `Unknown namespaced tool: ${name}`);
         if (mapped.handler) return rpcResult(message.id, await mapped.handler(message.params?.arguments));
@@ -615,8 +721,15 @@ export class MCPProxy {
           this.eventSink(`[${mapped.entry.destination.name}] tools/call ${toolName} failed after ${Date.now() - startedAt}ms: ${diagnosticText(error.rpcError?.message || error.message)}`, 'error');
           // Self-healing: a dead child (crash, OOM, transient pipe break) is
           // restarted and the call retried once before surfacing the error.
+          // State-changing tools are never retried: the child may have
+          // completed the write before dying, and a blind re-send would
+          // apply it twice.
           const childBroken = mapped.entry.child.exited || !mapped.entry.child.process.stdin.writable;
-          if (childBroken && !this.shuttingDown) {
+          const retriable = !NON_RETRIABLE_VSP_TOOLS.has(mapped.upstream);
+          if (!retriable) {
+            this.eventSink(`[${mapped.entry.destination.name}] tools/call ${toolName} is state-changing; not retried after a child crash (possible duplicate write)`, 'warning');
+          }
+          if (childBroken && retriable && !this.shuttingDown) {
             try {
               await this.restartChild(mapped.entry);
               this.eventSink(`[${mapped.entry.destination.name}] tools/call ${toolName} retried after self-healing restart`);
@@ -645,33 +758,74 @@ export class MCPProxy {
     this.output = output;
     this.start();
     let buffer = '';
-    const onData = async chunk => {
+    // Requests are dispatched concurrently so one slow tools/call (an ATC
+    // run, a big query) cannot block ping, tools/list, or notifications and
+    // make the host declare the server unresponsive. JSON-RPC ids make
+    // response order irrelevant to the client; only the initialize handshake
+    // must finish first, so every request awaits the gate captured at parse
+    // time. In-flight requests are awaited on stream end so their responses
+    // are still written before shutdown.
+    let initGate = Promise.resolve();
+    const inFlight = new Set();
+    const dispatch = async message => {
+      try {
+        const response = await this.handle(message);
+        if (!response) return;
+        output(JSON.stringify(response));
+        if (message.method === 'initialize') {
+          this.clientInitialized = true;
+          for (const notification of this.pendingNotifications) output(JSON.stringify(notification));
+          this.pendingNotifications.length = 0;
+        }
+      } catch (error) {
+        // One failed dispatch must never poison the stream: log and keep
+        // serving whatever the client sends next.
+        this.eventSink(`[MCP] failed to answer client message: ${diagnosticText(error.message)}`, 'error');
+      }
+    };
+    const track = promise => {
+      inFlight.add(promise);
+      promise.finally(() => inFlight.delete(promise)).catch(() => {});
+    };
+    const onData = chunk => {
       buffer += chunk;
       let newline;
       while ((newline = buffer.indexOf('\n')) >= 0) {
         const line = buffer.slice(0, newline).trim();
         buffer = buffer.slice(newline + 1);
         if (!line) continue;
-        try {
-          const message = JSON.parse(line);
-          const response = await this.handle(message);
-          if (response) {
-            output(JSON.stringify(response));
-            if (message.method === 'initialize') {
-              this.clientInitialized = true;
-              for (const notification of this.pendingNotifications) output(JSON.stringify(notification));
-              this.pendingNotifications.length = 0;
-            }
-          }
-        } catch (error) { this.eventSink(`[MCP] invalid client message dropped: ${redactText(error.message)}`, 'error'); }
+        let message;
+        try { message = JSON.parse(line); }
+        catch (error) {
+          this.eventSink(`[MCP] invalid client message dropped: ${redactText(error.message)}`, 'error');
+          continue;
+        }
+        if (message?.method === 'initialize' && message.id !== undefined) {
+          // Serialize the handshake itself so a second initialize cannot
+          // race the first into initializeChildren.
+          const run = initGate.then(() => dispatch(message));
+          initGate = run;
+          track(run);
+        } else if (message?.id !== undefined) {
+          track(initGate.then(() => dispatch(message)));
+        } else {
+          track(dispatch(message));
+        }
       }
     };
     input.setEncoding('utf8');
-    let queue = Promise.resolve();
-    input.on('data', chunk => { queue = queue.then(() => onData(chunk)); });
-    await once(input, 'end');
-    await queue;
-    await this.close();
+    input.on('error', error => {
+      this.eventSink(`[MCP] client input stream failed: ${diagnosticText(error.message)}`, 'error');
+      void this.close();
+    });
+    input.on('data', onData);
+    try {
+      await once(input, 'end');
+      await Promise.allSettled([...inFlight]);
+    } finally {
+      input.off('data', onData);
+      await this.close();
+    }
   }
 
   async close() {

package/src/redact.mjs

@@ -0,0 +1,28 @@
+// Shared credential redaction for every diagnostic lane (stderr, MCP log
+// notifications, tool errors, relay responses). One implementation so a fix
+// applies everywhere; the old per-file copies each missed a different case.
+//
+// Covered patterns:
+// - authorization: Basic <base64> / Bearer <token> / proxy-authorization
+// - cookie: a=b; c=d (the whole pair list, not just the first pair)
+// - password=... / secret=... / token=... / x-csrf-token: ... style keys
+// - URLs with embedded userinfo, https://user:pass@host
+// Bare credential blobs without a recognizable key cannot be detected
+// generically and are out of scope.
+const URL_USERINFO = /([a-z][a-z0-9+.-]*:\/\/)([^\s/@:?=&]+):([^\s/@]+)@/gi;
+const NAMED_VALUE = /((?:proxy-)?authorization|cookie|passwd|password|secret|token)\s*[:=]\s*(?:bearer\s+|basic\s+)?[^\s,;"']+/gi;
+// Header-shaped values may carry lists (cookie pairs); after the first pass
+// redacts the leading pair, this pass drops the remainder of the line.
+const HEADER_TAIL = /^((?:proxy-)?authorization|cookie)\s*[:=].*$/gim;
+
+export function redactText(value) {
+  return String(value ?? '')
+    .replace(URL_USERINFO, '$1[redacted]@')
+    .replace(NAMED_VALUE, '$1=[redacted]')
+    .replace(HEADER_TAIL, '$1=[redacted]');
+}
+
+// Redact, collapse whitespace, and clamp to a diagnostic-friendly length.
+export function diagnosticText(value, limit = 500) {
+  return redactText(value?.message || value || 'unknown error').replace(/\s+/g, ' ').trim().slice(0, limit);
+}