sap-ai-dev-toolkit 0.5.5 → 0.5.7

package/src/binary.mjs

@@ -1,11 +1,13 @@
 import { createHash } from 'node:crypto';
-import { chmod, mkdir, rename, stat, writeFile } from 'node:fs/promises';
+import { chmod, mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises';
 import { homedir, tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { brandedEnvValue } from './branding.mjs';
 
 const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+// Single source of truth for the upstream VSP commit; scripts/build-vsp.mjs
+// imports this constant so the built artifact and the runtime cannot drift.
 export const UPSTREAM_COMMIT = '9886d2727f47506368b0a3c2f1c1766f1200f747';
 
 const platformMap = {
@@ -26,6 +28,46 @@ export function bundledBinaryPath(platform = process.platform, arch = process.ar
   return join(packageRoot, 'dist', binaryTarget(platform, arch).asset);
 }
 
+// The npm-published dist/checksums.txt is the trust anchor: unlike a GitHub
+// release (mutable) or a downloaded checksum file (same origin as the
+// binary), its content is fixed the moment the package version is published.
+let packagedChecksumsCache;
+async function packagedChecksums() {
+  if (packagedChecksumsCache !== undefined) return packagedChecksumsCache;
+  const map = new Map();
+  try {
+    const text = await readFile(join(packageRoot, 'dist', 'checksums.txt'), 'utf8');
+    for (const line of text.split(/\r?\n/)) {
+      const parts = line.trim().split(/\s+/);
+      if (parts.length >= 2) map.set(parts[1], parts[0].toLowerCase());
+    }
+  } catch {
+    // Development checkouts without a dist/ fall through to the remote
+    // release checksum during install; local candidates stay unverified.
+  }
+  packagedChecksumsCache = map;
+  return map;
+}
+
+async function sha256File(path) {
+  const bytes = await readFile(path);
+  return createHash('sha256').update(bytes).digest('hex');
+}
+
+// Verifies a locally present binary against the packaged checksum manifest.
+// Returns true (verified), false (mismatch — must not be executed), or null
+// (no packaged entry; caller decides whether to trust the candidate).
+async function verifyAgainstPackagedChecksums(path, target) {
+  const checksums = await packagedChecksums();
+  const expected = checksums.get(target.asset);
+  if (!expected) return null;
+  try {
+    return (await sha256File(path)) === expected;
+  } catch {
+    return false;
+  }
+}
+
 export function packageRepositoryUrl(pkg) {
   const raw = typeof pkg.repository === 'string' ? pkg.repository : pkg.repository?.url;
   if (!raw) throw new Error('package.json repository.url is required to resolve VSP release assets');
@@ -36,12 +78,12 @@ export function releaseBaseUrl(pkg, version = pkg.version) {
   const override = brandedEnvValue(process.env, 'RELEASE_BASE_URL');
   if (override) return `${override.replace(/\/$/, '')}/v${version}`;
   const repo = packageRepositoryUrl(pkg).replace(/^ssh:\/\/git@github.com:/, 'https://github.com/').replace(/^git@github.com:/, 'https://github.com/');
-  if (!repo.startsWith('http')) throw new Error('package repository URL must be an HTTPS URL for release assets');
+  if (!repo.startsWith('https://')) throw new Error('package repository URL must be an HTTPS URL for release assets');
   return `${repo}/releases/download/v${version}`;
 }
 
-export function cacheDirectory() {
-  return process.env.BAS_VSP_CACHE_DIR || join(process.env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'sap-ai-dev-toolkit');
+export function cacheDirectory(env = process.env) {
+  return brandedEnvValue(env, 'CACHE_DIR') || join(env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'sap-ai-dev-toolkit');
 }
 
 export function cachedBinaryPath(pkg, platform = process.platform, arch = process.arch, env = process.env) {
@@ -51,22 +93,49 @@ export function cachedBinaryPath(pkg, platform = process.platform, arch = proces
 
 function legacyCachedBinaryPath(pkg, platform, arch, env) {
   const target = binaryTarget(platform, arch);
-  const configuredCache = brandedEnvValue(env, 'CACHE_DIR');
-  const cacheRoot = configuredCache || join(env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'bas-mcp-addon');
+  const cacheRoot = join(env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'bas-mcp-addon');
   return join(cacheRoot, `bas-mcp-addon-${pkg.version}-${target.asset}`);
 }
 
 export async function findBinary(pkg, options = {}) {
   const env = options.env || process.env;
+  const log = options.log || (() => {});
+  const target = binaryTarget(options.platform, options.arch);
   if (brandedEnvValue(env, 'BINARY')) return brandedEnvValue(env, 'BINARY');
   if (!brandedEnvValue(env, 'BINARY_URL')) {
     const bundled = bundledBinaryPath(options.platform, options.arch);
-    try { await stat(bundled); return bundled; } catch {}
+    try {
+      await stat(bundled);
+      const verified = await verifyAgainstPackagedChecksums(bundled, target);
+      if (verified === false) {
+        log(`bundled VSP binary ${target.asset} failed checksum verification; ignoring it`);
+      } else {
+        if (verified === null) log(`bundled VSP binary ${target.asset} has no packaged checksum entry; using it unverified`);
+        return bundled;
+      }
+    } catch {}
   }
   const path = cachedBinaryPath(pkg, options.platform, options.arch, env);
-  try { await stat(path); return path; } catch {}
+  try {
+    await stat(path);
+    const verified = await verifyAgainstPackagedChecksums(path, target);
+    if (verified === false) {
+      log(`cached VSP binary ${target.asset} failed checksum verification; ignoring it`);
+    } else {
+      if (verified === null) log(`cached VSP binary ${target.asset} has no packaged checksum entry; using it unverified`);
+      return path;
+    }
+  } catch {}
+  // The legacy bas-mcp-addon cache was written by an older release this code
+  // never verified; only execute it when the packaged checksum confirms it.
   const legacyPath = legacyCachedBinaryPath(pkg, options.platform, options.arch, env);
-  try { await stat(legacyPath); return legacyPath; } catch { return null; }
+  try {
+    await stat(legacyPath);
+    const verified = await verifyAgainstPackagedChecksums(legacyPath, target);
+    if (verified === true) return legacyPath;
+    log(`legacy cached VSP binary ${legacyPath} has no packaged checksum match; ignoring it`);
+  } catch {}
+  return null;
 }
 
 export async function installBinary(pkg, options = {}) {
@@ -74,22 +143,37 @@ export async function installBinary(pkg, options = {}) {
   if (brandedEnvValue(env, 'BINARY')) return brandedEnvValue(env, 'BINARY');
   if (!brandedEnvValue(env, 'BINARY_URL')) {
     const bundled = bundledBinaryPath(options.platform, options.arch);
-    try { await stat(bundled); return bundled; } catch {}
+    try {
+      await stat(bundled);
+      const target0 = binaryTarget(options.platform, options.arch);
+      if (await verifyAgainstPackagedChecksums(bundled, target0) !== false) return bundled;
+      throw new Error(`bundled VSP binary ${target0.asset} failed checksum verification`);
+    } catch (error) {
+      if (String(error?.message || '').includes('checksum verification')) throw error;
+    }
   }
   const target = binaryTarget(options.platform, options.arch);
   const base = releaseBaseUrl(pkg, pkg.version);
   const assetUrl = brandedEnvValue(env, 'BINARY_URL') || `${base}/${target.asset}`;
-  const checksumUrl = `${base}/checksums.txt`;
   const response = await fetch(assetUrl);
   if (!response.ok) throw new Error(`VSP binary download failed (${response.status}); set SAP_AI_DEV_TOOLKIT_BINARY or SAP_AI_DEV_TOOLKIT_BINARY_URL`);
   const bytes = Buffer.from(await response.arrayBuffer());
-  const checksumResponse = await fetch(checksumUrl);
-  if (!checksumResponse.ok) throw new Error(`VSP checksum download failed (${checksumResponse.status}); set SAP_AI_DEV_TOOLKIT_BINARY or SAP_AI_DEV_TOOLKIT_BINARY_URL`);
-  const checksumText = await checksumResponse.text();
-  const expected = checksumText.split(/\r?\n/).map(line => line.trim().split(/\s+/)).find(parts => parts.length >= 2 && (parts[1] === target.asset || parts[1].endsWith(`/${target.asset}`)))?.[0];
-  if (!expected) throw new Error(`checksums.txt has no entry for ${target.asset}; set SAP_AI_DEV_TOOLKIT_BINARY or SAP_AI_DEV_TOOLKIT_BINARY_URL`);
   const actual = createHash('sha256').update(bytes).digest('hex');
-  if (actual.toLowerCase() !== expected.toLowerCase()) throw new Error(`VSP checksum mismatch for ${target.asset}`);
+  // Prefer the packaged checksum manifest (immutable per published version)
+  // as the anchor; only when it has no entry fall back to the release's own
+  // checksums.txt so pre-release builds keep working.
+  let expected = (await packagedChecksums()).get(target.asset);
+  let expectedSource = 'packaged checksums.txt';
+  if (!expected) {
+    const checksumUrl = `${base}/checksums.txt`;
+    const checksumResponse = await fetch(checksumUrl);
+    if (!checksumResponse.ok) throw new Error(`VSP checksum download failed (${checksumResponse.status}); set SAP_AI_DEV_TOOLKIT_BINARY or SAP_AI_DEV_TOOLKIT_BINARY_URL`);
+    const checksumText = await checksumResponse.text();
+    expected = checksumText.split(/\r?\n/).map(line => line.trim().split(/\s+/)).find(parts => parts.length >= 2 && (parts[1] === target.asset || parts[1].endsWith(`/${target.asset}`)))?.[0]?.toLowerCase();
+    expectedSource = 'release checksums.txt';
+    if (!expected) throw new Error(`checksums.txt has no entry for ${target.asset}; set SAP_AI_DEV_TOOLKIT_BINARY or SAP_AI_DEV_TOOLKIT_BINARY_URL`);
+  }
+  if (actual !== expected) throw new Error(`VSP checksum mismatch for ${target.asset} (verified against ${expectedSource})`);
   const dir = cacheDirectory(env);
   await mkdir(dir, { recursive: true, mode: 0o700 });
   await chmod(dir, 0o700);

package/src/cf-destination.mjs

@@ -114,6 +114,51 @@ export async function deleteManagedCloudFoundryServiceKeys({ env = process.env,
   return { warnings };
 }
 
+async function listToolkitServiceKeys({ env = process.env, spaceGuid, execFileImpl = nodeExecFile } = {}) {
+  const options = { env, execFileImpl };
+  const keys = [];
+  let path = `/v3/service_credential_instances?space_guids=${encodeURIComponent(spaceGuid)}&type=key&per_page=500`;
+  const visited = new Set();
+  while (path && !visited.has(path)) {
+    visited.add(path);
+    const page = await cfJson(path, options);
+    if (!Array.isArray(page?.resources)) return keys;
+    for (const resource of page.resources) {
+      const name = text(resource?.name);
+      const instanceGuid = resource?.relationships?.service_instance?.data?.guid;
+      if (!name.startsWith(KEY_PREFIX) || !instanceGuid) continue;
+      keys.push({ keyName: name, instanceGuid: String(instanceGuid) });
+    }
+    path = page?.metadata?.pagination?.next?.href ? apiPath(page.metadata.pagination.next.href) : '';
+  }
+  return keys;
+}
+
+// Reconcile toolkit-created service keys against the references recorded in
+// the MCP config. A Destination-instance service key exposes client
+// credentials for every destination in the instance, so a key orphaned by an
+// interrupted setup must not linger unnoticed.
+export async function findOrphanedCloudFoundryServiceKeys({ env = process.env, spaceGuid, managedKeys = [], execFileImpl = nodeExecFile } = {}) {
+  const listed = await listToolkitServiceKeys({ env, spaceGuid, execFileImpl });
+  const referenced = new Set((managedKeys || [])
+    .filter(ref => ref?.spaceGuid === spaceGuid && ref?.instanceGuid && ref?.keyName)
+    .map(ref => `${ref.instanceGuid}\0${ref.keyName}`));
+  const orphans = [];
+  const instanceNames = new Map();
+  for (const key of listed) {
+    if (referenced.has(`${key.instanceGuid}\0${key.keyName}`)) continue;
+    if (!instanceNames.has(key.instanceGuid)) {
+      try {
+        instanceNames.set(key.instanceGuid, text((await cfJson(`/v3/service_instances/${encodeURIComponent(key.instanceGuid)}`, { env, execFileImpl })).name));
+      } catch {
+        instanceNames.set(key.instanceGuid, '');
+      }
+    }
+    orphans.push({ kind: 'toolkit-created', spaceGuid, instanceGuid: key.instanceGuid, instanceName: instanceNames.get(key.instanceGuid) || key.instanceGuid, keyName: key.keyName });
+  }
+  return orphans;
+}
+
 async function cfJson(path, options) {
   const value = await runCf(['curl', path], options);
   try {
@@ -493,10 +538,19 @@ function probeResult(status) {
   return { status: 'unavailable', available: false, httpStatus: status };
 }
 
+function isLoopbackHostname(hostname) {
+  const host = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+  return host === '127.0.0.1' || host === 'localhost' || host === '::1';
+}
+
 async function probeRecord(record, env, { forcedProxy, fetchImpl = undiciFetch } = {}) {
   const target = new URL('/sap/bc/adt/discovery', record.url);
   const headers = { accept: 'application/xml,text/xml,*/*' };
-  if (record.authentication === 'BasicAuthentication') {
+  // Never send SAP Basic credentials over cleartext HTTP to a remote host:
+  // an http:// destination URL is allowed for reachability probing, but the
+  // probe runs unauthenticated then (401/403 still counts as reachable).
+  const plaintextRemote = target.protocol === 'http:' && !isLoopbackHostname(target.hostname);
+  if (record.authentication === 'BasicAuthentication' && !plaintextRemote) {
     headers.authorization = `Basic ${Buffer.from(`${record.user}:${record.password}`).toString('base64')}`;
   }
   let dispatcher;

package/src/credentials-store.mjs

@@ -10,8 +10,6 @@ import { brandedEnvValue } from './branding.mjs';
 const CREDENTIALS_FILENAME = 'sap-ai-dev-toolkit-credentials.json';
 const CREDENTIAL_MODES = new Set(['direct', 'bas-tunnel', 'cf-connectivity']);
 
-const SECRET_PATTERN = /(authorization|cookie|password|secret|token|bearer|credential)/i;
-
 async function exists(path) {
   try {
     await stat(path);
@@ -22,10 +20,6 @@ async function exists(path) {
   }
 }
 
-export function redactCredentialValue(value) {
-  return SECRET_PATTERN.test(String(value)) ? '[redacted]' : value;
-}
-
 export async function resolveCredentialsPath(env = process.env, mcpConfigPath) {
   const configured = brandedEnvValue(env, 'CREDENTIALS_FILE');
   if (configured) return configured;
@@ -117,7 +111,3 @@ export async function removeDestinationCredentials(path, names) {
   if (removed.length) await writeCredentials(path, destinations);
   return { path, removed };
 }
-
-export function listCredentialDestinations(credentials) {
-  return Object.entries(credentials?.destinations || {}).map(([name, entry]) => ({ name, host: entry.host, user: entry.user, updatedAt: entry.updatedAt }));
-}

package/src/engineering-tools.mjs

@@ -1,12 +1,14 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { ProxyAgent, fetch as undiciFetch } from 'undici';
 import { sanitizeChildEnv } from './bas-discovery.mjs';
+import { redactText } from './redact.mjs';
 
 const CHANGESET_WRITE_TOOLS = new Set(['WriteSource']);
 const TRANSPORT_CHECK_TOOLS = new Set(['GetTransport', 'GetTransportInfo', 'ListDependencies', 'GetInactiveObjects', 'RunUnitTests', 'RunATCCheck']);
 const MAX_CHANGE_BYTES = 128 * 1024;
 const MAX_CHANGESET_SIZE = 12;
 const MAX_REMOTE_BODY_BYTES = 2 * 1024 * 1024;
+const MAX_SUITE_CASES = 30;
 
 function object(value) {
   return value !== null && typeof value === 'object' && !Array.isArray(value);
@@ -21,9 +23,7 @@ function toolJson(value) {
 }
 
 function safeDiagnostic(value) {
-  return String(value?.message || value || 'unknown error')
-    .replace(/(authorization|proxy-authorization)\s*[:=]\s*(?:bearer\s+|basic\s+)?[^\s,;]+/gi, '$1=[redacted]')
-    .replace(/(cookie|password|secret|token)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]')
+  return redactText(value?.message || value || 'unknown error')
     .replace(/\s+/g, ' ')
     .slice(0, 300);
 }
@@ -339,27 +339,43 @@ function responseForDemo(path) {
   return { status: 200, contentType: 'application/json', body: JSON.stringify({ value: [{ ID: '10000001', Description: 'Sample order' }] }) };
 }
 
+function isLoopbackHost(hostname) {
+  const host = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+  return host === '127.0.0.1' || host === 'localhost' || host === '::1';
+}
+
+// OData reads follow the same egress rules as the relay: loopback targets
+// (the local BAS relay the child talks to) must go direct, NO_PROXY
+// exemptions are honored, and everything else uses the configured proxy.
+function proxyUrlFor(target, env) {
+  if (isLoopbackHost(target.hostname)) return '';
+  const host = target.hostname.toLowerCase();
+  const noProxy = String(env.NO_PROXY || env.no_proxy || '').split(',').map(value => value.trim().toLowerCase()).filter(Boolean);
+  if (noProxy.some(entry => entry === '*' || host === entry || host.endsWith(entry.startsWith('.') ? entry : `.${entry}`))) return '';
+  return String(env.HTTP_PROXY || env.http_proxy || env.HTTPS_PROXY || env.https_proxy || '');
+}
+
 async function fetchOData(entry, path, accept, env) {
   if (entry.destination.demo) return responseForDemo(path);
   const childEnv = { ...sanitizeChildEnv(env), ...(entry.destination.childEnv || {}) };
-  const proxyUrl = childEnv.HTTP_PROXY || childEnv.http_proxy;
-  if (!proxyUrl) throw new Error('No HTTP proxy is configured for the destination');
   const target = new URL(path, entry.destination.url);
   const base = new URL(entry.destination.url);
   if (target.origin !== base.origin || target.username || target.password || target.hash) throw new Error('OData request escaped the connected destination');
-  const dispatcher = new ProxyAgent(proxyUrl);
+  const proxyUrl = proxyUrlFor(target, childEnv);
+  if (!proxyUrl && /\.dest$/i.test(target.hostname)) throw new Error('No HTTP proxy is configured for the .dest destination');
+  const dispatcher = proxyUrl ? new ProxyAgent(proxyUrl) : undefined;
   try {
     const response = await undiciFetch(target, {
       method: 'GET',
       headers: { accept },
-      dispatcher,
+      ...(dispatcher ? { dispatcher } : {}),
       signal: AbortSignal.timeout(10_000),
       redirect: 'manual'
     });
     const body = await readBody(response);
     return { status: response.status, contentType: response.headers.get('content-type') || '', body };
   } finally {
-    await dispatcher.close();
+    await dispatcher?.close();
   }
 }
 
@@ -576,17 +592,23 @@ export function createEngineeringTools(entry, upstreamTools, { env = process.env
     if (response.status < 200 || response.status >= 300) throw new Error(`OData metadata request returned HTTP ${response.status}`);
     const entitySets = parseEntitySets(response.body);
     if (!entitySets.length) throw new Error('OData metadata did not contain entity sets');
+    // Cap generation so the emitted suite is always accepted by
+    // RunRAPRegressionSuite's own 30-case limit; report what was omitted.
+    const included = entitySets.slice(0, MAX_SUITE_CASES - 1);
     return toolJson({
       suite: {
         name: `${entry.destination.name} RAP smoke suite`,
         service_root: serviceRoot,
         cases: [
           { name: 'OData metadata', path: '$metadata', expected_status: 200, expected_content_type: 'xml' },
-          ...entitySets.map(name => ({ name: `Read ${name}`, path: `${name}?$top=1`, expected_status: 200, expected_content_type: 'json' }))
+          ...included.map(name => ({ name: `Read ${name}`, path: `${name}?$top=1`, expected_status: 200, expected_content_type: 'json' }))
         ]
       },
       entity_set_count: entitySets.length,
-      destination: entry.destination.name
+      destination: entry.destination.name,
+      ...(entitySets.length > included.length
+        ? { note: `${entitySets.length - included.length} entity sets were omitted to keep the suite within the ${MAX_SUITE_CASES}-case limit; generate targeted suites for them separately.` }
+        : {})
     });
   });
 

package/src/hana-tools.mjs

@@ -7,7 +7,11 @@ const MAX_COLUMNS = 40;
 const MAX_FILTERS = 20;
 const MAX_SELECTED_COLUMN_WIDTH = 8192;
 const UNBOUNDED_COLUMN_TYPES = new Set(['BLOB', 'CLOB', 'NCLOB', 'BINARY', 'VARBINARY', 'ST_GEOMETRY', 'ST_POINT']);
-const SENSITIVE_COLUMN_NAME = /(?:PASS(?:WORD|WD)|SECRET|(?:ACCESS|REFRESH|AUTH)?_?TOKEN|API_?KEY|PRIVATE_?KEY|CREDENTIAL)/i;
+// Denylist of credential-like column names. This is a heuristic — the real
+// control is the dedicated read-only HANA identity — but it keeps obvious
+// secret material (password hashes, salts, signatures, certificates, JWTs,
+// session ids) out of tool results even under that identity.
+const SENSITIVE_COLUMN_NAME = /(?:PASS(?:WORD|WD)?|PWD|PASSPHRASE|SECRET|CREDENTIAL|(?:ACCESS|REFRESH|AUTH|SESSION)?_?TOKEN|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|SIGNATURE|SALT|CERT(?:IFICATE)?|JWT|BEARER)/i;
 const SAFE_INSPECTION_ERRORS = new Set([
   'HANA result is too large to return safely; request fewer rows or columns.',
   'The requested object was not found in the bound HDI schema.',
@@ -181,7 +185,10 @@ async function readRows(database, schema, args) {
   const where = conditions.length ? ` WHERE ${conditions.join(' AND ')}` : '';
   const sql = `SELECT ${selected} FROM ${quoteHanaIdentifier(schema)}.${quoteHanaIdentifier(args.objectName)}${where}${order} LIMIT ${args.limit}`;
   const values = args.filters.map(filter => filter.value);
-  const rows = rowsOf(await database.query(sql, values));
+  // Defense in depth: the SQL LIMIT and the zod cap already bound the read,
+  // but the returned rows are sliced again so no future query-shape change
+  // can smuggle more than HANA_MAX_ROWS into a tool result.
+  const rows = rowsOf(await database.query(sql, values)).slice(0, HANA_MAX_ROWS);
   return {
     schema,
     ...target,

package/src/launcher.mjs

@@ -5,12 +5,13 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { discoverDestinations, remediation, slugifyDestination, statusRows } from './bas-discovery.mjs';
 import { findBinary } from './binary.mjs';
-import { MCPProxy, TOOL_NAME_PREFIX } from './mcp-proxy.mjs';
+import { MCPProxy } from './mcp-proxy.mjs';
 import { installMcpConfig, repairManagedMcpConfig } from './mcp-config.mjs';
 import { runSetup } from './setup.mjs';
 import { resolveConfiguredCloudFoundryDestination } from './cf-destination.mjs';
 import { withBrandedEnvironment } from './branding.mjs';
 import { enrichWithStoredCredentials } from './credential-overrides.mjs';
+import { redactText } from './redact.mjs';
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
 const runtimeEnv = withBrandedEnvironment(process.env);
@@ -47,10 +48,6 @@ function doctorRow(name, stage, status, detail) {
   return { name, stage, status, ...(detail ? { detail } : {}) };
 }
 
-function redactText(value) {
-  return String(value).replace(/(authorization|cookie|password|secret|token)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]');
-}
-
 async function runDoctor(destinations) {
   const checks = [];
   if (!destinations.length) {
@@ -111,11 +108,15 @@ async function runDoctor(destinations) {
       const listed = await proxy.handle({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} });
       if (listed?.error) throw new Error(listed.error.message || 'MCP tools/list failed');
       const tools = listed.result?.tools || [];
-      const toolPrefix = `${TOOL_NAME_PREFIX}${slugifyDestination(destination.name)}_`;
+      // Doctor inspects one destination per proxy, so tool names are
+      // unprefixed (get_source, run_query); match the slug-prefixed form too
+      // in case this ever runs against a multi-destination server.
+      const toolPrefix = `${slugifyDestination(destination.name)}_`;
       const localSegments = new Set(['lint_abap', 'get_application_log', 'prepare_abap_change_set', 'apply_abap_change_set', 'check_transport_readiness', 'plan_abap_cloud_migration', 'generate_rap_regression_suite', 'run_rap_regression_suite']);
-      const upstreamCount = tools.filter(tool => tool.name.startsWith(toolPrefix) && !localSegments.has(tool.name.slice(toolPrefix.length))).length;
+      const isUpstreamTool = tool => (tool.name.startsWith(toolPrefix) ? tool.name.slice(toolPrefix.length) : tool.name);
+      const upstreamCount = tools.filter(tool => !localSegments.has(isUpstreamTool(tool))).length;
       checks.push(doctorRow(destination.name, 'MCP tools/list', upstreamCount ? 'passed' : 'failed', `${upstreamCount} VSP tools and ${tools.length} total MCP tools returned; chat-picker binding is host-managed`));
-      const systemInfo = tools.find(tool => tool.name === `${toolPrefix}get_system_info`);
+      const systemInfo = tools.find(tool => tool.name === 'get_system_info' || tool.name === `${toolPrefix}get_system_info`);
       if (!systemInfo) {
         checks.push(doctorRow(destination.name, 'SAP system check', 'skipped', 'GetSystemInfo is not exposed by this VSP mode.'));
       } else {
@@ -167,7 +168,8 @@ async function runOfflineDemo() {
     childArgs: () => [demoPath],
     destinations: [{ name: 'demo', url: 'http://demo.dest', client: '001', demo: true }],
     env: { ...runtimeEnv, SAP_AI_DEV_TOOLKIT_DESTINATION: 'demo' },
-    log: message => console.error(message)
+    log: message => console.error(message),
+    version: pkg.version
   });
   console.error('[sap-ai-dev-toolkit] offline demo active; all SAP changes are simulated in memory');
   const shutdown = signal => { void proxy.close().finally(() => process.exit(signal === 'SIGINT' ? 130 : 143)); };
@@ -181,8 +183,7 @@ function probeDiagnostic(destination) {
   const details = [];
   if (probe.httpStatus) details.push(`HTTP ${probe.httpStatus}`);
   if (probe.error) {
-    const error = String(probe.error)
-      .replace(/(authorization|cookie|password|secret|token)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]')
+    const error = redactText(probe.error)
       .replace(/\s+/g, ' ')
       .slice(0, 400);
     details.push(error);
@@ -262,7 +263,7 @@ async function main() {
     let proxy;
     try {
       const binary = await binaryOrError();
-      proxy = new MCPProxy({ binary, destinations: [destination], env: runtimeEnv, log: logLine });
+      proxy = new MCPProxy({ binary, destinations: [destination], env: runtimeEnv, log: logLine, version: pkg.version });
       const shutdown = signal => { void proxy.close().finally(() => process.exit(signal === 'SIGINT' ? 130 : 143)); };
       process.once('SIGINT', () => shutdown('SIGINT'));
       process.once('SIGTERM', () => shutdown('SIGTERM'));
@@ -301,7 +302,7 @@ async function main() {
     else if (destination.credentials?.host) logLine(`[sap-ai-dev] ${destination.name}: direct connect enabled through stored credentials`);
   }
   logLine(`[sap-ai-dev] starting MCP proxy for ${destinations.map(destination => `${destination.name} (client=${destination.client})`).join(', ')}`);
-  const proxy = new MCPProxy({ binary, destinations, env: process.env, log: logLine });
+  const proxy = new MCPProxy({ binary, destinations, env: process.env, log: logLine, version: pkg.version });
   const shutdown = signal => { void proxy.close().finally(() => process.exit(signal === 'SIGINT' ? 130 : 143)); };
   process.once('SIGINT', () => shutdown('SIGINT'));
   process.once('SIGTERM', () => shutdown('SIGTERM'));

package/src/mcp-config.mjs

@@ -3,11 +3,27 @@ import { constants } from 'node:fs';
 import { access, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, delimiter, dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { brandedEnvValue } from './branding.mjs';
 import { slugifyDestination } from './bas-discovery.mjs';
 
 const LEGACY_MCP_SERVER_PREFIXES = ['sapAiDev_', 'basVspMcp_'];
 const COMPANION_SERVER_KIND = 'sap-development-companion';
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+// The self-package companion (HANA inspector) must launch the exact version
+// the user installed; an unpinned `npx sap-ai-dev-toolkit` would re-resolve
+// executable code from the registry at every MCP host start.
+let selfPackageVersion;
+async function runningPackageVersion() {
+  if (selfPackageVersion !== undefined) return selfPackageVersion;
+  try {
+    selfPackageVersion = String(JSON.parse(await readFile(join(packageRoot, 'package.json'), 'utf8')).version || '');
+  } catch {
+    selfPackageVersion = '';
+  }
+  return selfPackageVersion;
+}
 
 export const SAP_DEVELOPMENT_MCP_SERVERS = Object.freeze([
   Object.freeze({
@@ -294,9 +310,11 @@ export async function installMcpConfig(destinationsOrOptions, options = {}) {
   const env = options.env || process.env;
   const path = options.path || await resolveMcpConfigPath(env);
   const config = await readConfig(path);
+  const selfVersion = await runningPackageVersion();
+  const companionVersions = selfVersion ? { 'sap-ai-dev-toolkit': selfVersion, 'hana-cloud-inspector': selfVersion } : {};
   const generated = {
     ...buildMcpEntries(destinations, env),
-    ...buildSapDevelopmentMcpEntries(options.sapDevelopmentServers || [])
+    ...buildSapDevelopmentMcpEntries(options.sapDevelopmentServers || [], { packageVersions: companionVersions })
   };
   const launcherCommand = options.command || (destinations.length ? await resolveMcpServerCommand(env) : null);
   if (launcherCommand) {