sap-ai-dev-toolkit 0.5.5 → 0.5.7

package/src/mcp-proxy.mjs

@@ -5,6 +5,7 @@ import { ABAP_LINT_TOOL, runABAPLint } from './abaplint.mjs';
 import { createEngineeringTools } from './engineering-tools.mjs';
 import { brandedEnvValue } from './branding.mjs';
 import { createBasDestinationRelay } from './bas-destination-relay.mjs';
+import { diagnosticText, redactText } from './redact.mjs';
 
 const JSONRPC = '2.0';
 const FORWARDED_METHODS = new Set(['ping', 'resources/list', 'resources/read', 'resources/templates/list', 'prompts/list', 'completion/complete', 'logging/setLevel']);
@@ -37,6 +38,51 @@ const APPLICATION_LOG_SCHEMA = {
 };
 const APPLICATION_LOG_DESCRIPTION = 'Read SAP application log (SLG1) entries. Results are newest first and limited to 100 by default; set messages=true to include log message details.';
 
+// Read-only mode (SAP_AI_DEV_TOOLKIT_READ_ONLY=true) removes every tool that
+// changes SAP state from the public surface and starts VSP with
+// --transport-read-only, so an exploration destination cannot be written to
+// through this proxy even if a chat prompt asks for it.
+const READ_ONLY_HIDDEN_VSP_TOOLS = new Set([
+  'Activate',
+  'ActivateMultiple',
+  'CreateTransport',
+  'EditSource',
+  'SetBreakpoint',
+  'WriteSource'
+]);
+
+// Self-healing restarts retry the interrupted tools/call once. Retrying a
+// state-changing tool after a crash can apply the same write twice (the child
+// may have completed the side effect before dying), so these are never retried;
+// the original error is surfaced instead.
+const NON_RETRIABLE_VSP_TOOLS = new Set([
+  'Activate',
+  'ActivateMultiple',
+  'CreateTransport',
+  'EditSource',
+  'WriteSource'
+]);
+
+const MAX_CHILD_BUFFER_BYTES = 16 * 1024 * 1024;
+const MAX_PENDING_NOTIFICATIONS = 200;
+const DEFAULT_REQUEST_TIMEOUT_MS = 10 * 60 * 1000;
+const MAX_RESTARTS_PER_WINDOW = 5;
+const RESTART_WINDOW_MS = 5 * 60 * 1000;
+
+function requestTimeoutMs(env) {
+  const raw = brandedEnvValue(env, 'REQUEST_TIMEOUT_MS');
+  if (raw === undefined || raw === '') return DEFAULT_REQUEST_TIMEOUT_MS;
+  const parsed = Number(raw);
+  // 0 or a negative value disables the timeout; invalid values fall back.
+  if (!Number.isFinite(parsed)) return DEFAULT_REQUEST_TIMEOUT_MS;
+  return parsed > 0 ? Math.floor(parsed) : 0;
+}
+
+export function readOnlyMode(env = process.env) {
+  const raw = brandedEnvValue(env, 'READ_ONLY');
+  return raw !== undefined && ['1', 'true', 'yes'].includes(String(raw).trim().toLowerCase());
+}
+
 // Keep the default public VSP surface small enough for developer-lifecycle use.
 // Hidden upstream tools can still be used by local workflow tools when needed.
 export const PUBLIC_VSP_TOOLS = new Set([
@@ -93,8 +139,11 @@ export const PUBLIC_VSP_TOOLS = new Set([
   'WriteSource'
 ]);
 
-function exposeVspTool(tool) {
-  return PUBLIC_VSP_TOOLS.has(tool?.name);
+function exposeVspTool(tool, readOnly = false) {
+  if (!PUBLIC_VSP_TOOLS.has(tool?.name)) return false;
+  // Read-only destinations never expose the write/activate/transport-create
+  // surface, even when VSP registers it.
+  return !(readOnly && READ_ONLY_HIDDEN_VSP_TOOLS.has(tool.name));
 }
 
 // Public tool names are lowercase snake_case. BAS/VS Code chat tool references
@@ -108,10 +157,7 @@ export function snakeCaseName(value) {
 }
 
 // Every generated tool is prefixed with the destination it targets:
-// sap_system_<destination-slug>_<tool>, for example
-// sap_system_actions4d_get_table_contents.
-export const TOOL_NAME_PREFIX = 'sap_system_';
-
+// <destination-slug>_<tool>, for example demo-abap_get_table_contents.
 function publicToolSegment(name) {
   return snakeCaseName(name) || String(name).toLowerCase();
 }
@@ -127,8 +173,6 @@ function applicationLogArguments(arguments_ = {}) {
 
 function rpcResult(id, result) { return { jsonrpc: JSONRPC, id, result }; }
 function rpcError(id, code, message, data) { return { jsonrpc: JSONRPC, id, error: { code, message, ...(data === undefined ? {} : { data }) } }; }
-function redactText(text) { return String(text).replace(/(authorization|cookie|password|secret|token)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]'); }
-function diagnosticText(text) { return redactText(text || 'unknown error').replace(/\s+/g, ' ').slice(0, 500); }
 
 const closedRoutes = new WeakMap();
 
@@ -171,7 +215,8 @@ export function childArguments(destination, env = process.env) {
   const mode = brandedEnvValue(env, 'MODE') || 'expert';
   const args = ['--url', destination.url, '--client', destination.client || '001', '--mode', mode];
   if (destination.source !== 'cloud-foundry' || destination.authentication === 'PrincipalPropagation') args.push('--proxy-auth');
-  args.push('--enable-transports');
+  if (readOnlyMode(env)) args.push('--transport-read-only');
+  else args.push('--enable-transports');
   return args;
 }
 
@@ -184,6 +229,7 @@ class Child {
     this.buffer = '';
     this.exited = false;
     this.closing = false;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? 0;
     this.process = (options.spawn || nodeSpawn)(binary, options.args || childArguments(destination, options.env), {
       env: childEnvironment(destination, options.env),
       stdio: ['pipe', 'pipe', 'pipe']
@@ -194,6 +240,13 @@ class Child {
     this.process.stderr.on('data', chunk => {
       if (options.log) options.log(`[${destination.name}] ${redactText(chunk).trimEnd()}`);
     });
+    // A write racing child death surfaces as an EPIPE 'error' event on stdin.
+    // Without a listener that is an uncaught exception that kills the whole
+    // MCP server — exactly the crash window self-healing is meant to cover.
+    this.process.stdin.on('error', error => {
+      if (!this.closing && this.options.log) this.options.log(`[${destination.name}] VSP child stdin error: ${diagnosticText(error.message)}`);
+      this.fail(new Error(`child stdin failed: ${error.message}`));
+    });
     this.process.on('error', error => {
       if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] VSP child process error: ${diagnosticText(error.message)}`);
       this.fail(error);
@@ -210,12 +263,21 @@ class Child {
 
   onData(chunk) {
     this.buffer += chunk;
+    if (this.buffer.length > MAX_CHILD_BUFFER_BYTES) {
+      // A child streaming non-JSON garbage would grow this buffer unbounded.
+      this.fail(new Error('child stdout exceeded the buffered line limit'));
+      return;
+    }
     let newline;
     while ((newline = this.buffer.indexOf('\n')) >= 0) {
       const line = this.buffer.slice(0, newline).trim();
       this.buffer = this.buffer.slice(newline + 1);
       if (!line) continue;
-      try { this.onMessage(JSON.parse(line)); } catch (error) { this.fail(new Error(`invalid child JSON-RPC response: ${error.message}`)); }
+      // One garbled line (interleaved stderr, partial write) must not reject
+      // every in-flight request: skip it and let the per-request timeout or
+      // child exit handle a genuinely desynchronized stream.
+      try { this.onMessage(JSON.parse(line)); }
+      catch (error) { this.options.log?.(`[${this.destination.name}] dropped a non-JSON child line: ${diagnosticText(error.message)}`); }
     }
   }
 
@@ -250,9 +312,22 @@ class Child {
     if (this.exited || !this.process.stdin.writable) return Promise.reject(new Error(`destination ${this.destination.name} child is not running`));
     const id = this.nextId++;
     return new Promise((resolve, reject) => {
-      this.pending.set(id, { resolve, reject });
+      // A hung child (network stall, backend deadlock) must not hang the call
+      // forever. The timeout only fails this request; the child is left alone
+      // because killing it would also kill unrelated in-flight requests.
+      let timeout;
+      const cancel = () => clearTimeout(timeout);
+      this.pending.set(id, {
+        resolve: value => { cancel(); resolve(value); },
+        reject: error => { cancel(); reject(error); }
+      });
+      if (this.requestTimeoutMs > 0) {
+        timeout = setTimeout(() => {
+          if (this.pending.delete(id)) reject(new Error(`destination ${this.destination.name} did not answer ${method} within ${this.requestTimeoutMs}ms`));
+        }, this.requestTimeoutMs);
+      }
       try { this.process.stdin.write(`${JSON.stringify({ jsonrpc: JSONRPC, id, method, ...(params === undefined ? {} : { params })})}\n`); }
-      catch (error) { this.pending.delete(id); reject(error); }
+      catch (error) { cancel(); this.pending.delete(id); reject(error); }
     });
   }
 
@@ -310,7 +385,7 @@ class Child {
 }
 
 export class MCPProxy {
-  constructor({ binary, destinations, env = process.env, spawn = nodeSpawn, childArgs, log = message => console.error(message), output = line => process.stdout.write(`${line}\n`) }) {
+  constructor({ binary, destinations, env = process.env, spawn = nodeSpawn, childArgs, log = message => console.error(message), output = line => process.stdout.write(`${line}\n`), version = '0.0.0' }) {
     this.binary = binary;
     this.destinations = destinations;
     this.env = env;
@@ -318,6 +393,9 @@ export class MCPProxy {
     this.childArgs = childArgs;
     this.log = log;
     this.output = output;
+    this.version = version;
+    this.readOnly = readOnlyMode(env);
+    this.requestTimeoutMs = requestTimeoutMs(env);
     this.children = [];
     this.started = false;
     this.namespace = new Map();
@@ -338,13 +416,32 @@ export class MCPProxy {
   // notifications/message log event, in the host's MCP server output channel
   // (VS Code/BAS and Claude Code both render these). Events raised before the
   // client initializes are buffered so the channel still shows the full
-  // startup picture once it opens.
+  // startup picture once it opens. Everything passes through redactText so no
+  // lane can leak a credential that reached a diagnostic string.
   eventSink(message, level = 'info', logger = 'sap-ai-dev-toolkit') {
-    this.log(message);
+    const text = redactText(message);
+    this.log(text);
     if (!this.mcpLogEnabled(level)) return;
-    const notification = { jsonrpc: JSONRPC, method: 'notifications/message', params: { level, logger, data: message } };
+    const notification = { jsonrpc: JSONRPC, method: 'notifications/message', params: { level, logger, data: text } };
     if (this.clientInitialized) this.output(JSON.stringify(notification));
-    else this.pendingNotifications.push(notification);
+    else if (this.pendingNotifications.length < MAX_PENDING_NOTIFICATIONS) this.pendingNotifications.push(notification);
+  }
+
+  // Shared spawn options for initial start and self-healing restarts, so the
+  // replacement child behaves exactly like the one it replaces.
+  childSpawnOptions(destination) {
+    return {
+      env: this.env,
+      spawn: this.spawn,
+      args: this.childArgs?.(destination),
+      requestTimeoutMs: this.requestTimeoutMs,
+      log: message => this.eventSink(message),
+      onNotification: notification => {
+        if (notification.method === 'notifications/tools/list_changed') this.toolsCache = null;
+        if (this.clientInitialized) this.output(JSON.stringify(notification));
+        else if (this.pendingNotifications.length < MAX_PENDING_NOTIFICATIONS) this.pendingNotifications.push(notification);
+      }
+    };
   }
 
   start() {
@@ -370,8 +467,11 @@ export class MCPProxy {
                 stats: relay.stats
               },
               async close() {
-                await originalClose?.();
-                await relay.close();
+                try {
+                  await originalClose?.();
+                } finally {
+                  await relay.close();
+                }
               }
             };
             this.eventSink(`[${originalDestination.name}] BAS destination relay enabled (${relayUrl})`);
@@ -379,17 +479,7 @@ export class MCPProxy {
           this.eventSink(`[${destination.name}] starting VSP child (client=${destination.client || '001'})`);
           return {
             destination,
-            child: new Child(this.binary, destination, {
-              env: this.env,
-              spawn: this.spawn,
-              args: this.childArgs?.(destination),
-              log: message => this.eventSink(message),
-              onNotification: notification => {
-                if (notification.method === 'notifications/tools/list_changed') this.toolsCache = null;
-                if (this.clientInitialized) this.output(JSON.stringify(notification));
-                else this.pendingNotifications.push(notification);
-              }
-            })
+            child: new Child(this.binary, destination, this.childSpawnOptions(destination))
           };
         } catch (error) {
           this.eventSink(`[${destination.name}] failed to start child: ${diagnosticText(error.message)}`, 'error');
@@ -417,30 +507,38 @@ export class MCPProxy {
   // Self-healing mode 3: transparently restart a crashed VSP child so an
   // MCP tools/call does not permanently fail after a single crash. The
   // restarted child re-initializes and re-registers tools before the call
-  // is retried once.
+  // is retried once. Concurrent triggers share one restart (no orphaned
+  // children), and a bounded budget within a rolling window stops a
+  // crash-looping child from respawning forever.
   async restartChild(entry) {
     if (this.shuttingDown) throw new Error('MCP proxy is shutting down');
-    const name = entry.destination.name;
-    this.eventSink(`[${name}] VSP child crashed; self-healing restart in progress`, 'warning');
-    await entry.child.close().catch(() => {});
-    const child = new Child(this.binary, entry.destination, {
-      env: this.env,
-      spawn: this.spawn,
-      args: this.childArgs?.(entry.destination),
-      log: message => this.eventSink(message),
-      onNotification: notification => {
-        if (notification.method === 'notifications/tools/list_changed') this.toolsCache = null;
-        if (this.clientInitialized) this.output(JSON.stringify(notification));
-        else this.pendingNotifications.push(notification);
+    entry.restartState ||= { inFlight: null, timestamps: [] };
+    const state = entry.restartState;
+    if (state.inFlight) return state.inFlight;
+    const now = Date.now();
+    state.timestamps = state.timestamps.filter(at => now - at < RESTART_WINDOW_MS);
+    if (state.timestamps.length >= MAX_RESTARTS_PER_WINDOW) {
+      throw new Error(`VSP child restart budget exhausted (${MAX_RESTARTS_PER_WINDOW} in ${RESTART_WINDOW_MS / 1000}s); surfacing the failure instead of respawning`);
+    }
+    state.inFlight = (async () => {
+      const name = entry.destination.name;
+      this.eventSink(`[${name}] VSP child crashed; self-healing restart in progress`, 'warning');
+      try {
+        await entry.child.close().catch(() => {});
+        const child = new Child(this.binary, entry.destination, this.childSpawnOptions(entry.destination));
+        entry.child = child;
+        entry.server = await child.initialize(this.lastInitializeParams || {});
+        this.toolsCache = null;
+        await child.listToolsCached().catch(() => {});
+        state.timestamps.push(Date.now());
+        this.eventSink(`[${name}] VSP child self-healing restart complete`);
+        this.emitToolsListChanged();
+        return entry;
+      } finally {
+        state.inFlight = null;
       }
-    });
-    entry.child = child;
-    entry.server = await child.initialize(this.lastInitializeParams || {});
-    this.toolsCache = null;
-    await child.listToolsCached().catch(() => {});
-    this.eventSink(`[${name}] VSP child self-healing restart complete`);
-    this.emitToolsListChanged();
-    return entry;
+    })();
+    return state.inFlight;
   }
 
   emitToolsListChanged() {
@@ -494,11 +592,14 @@ export class MCPProxy {
     if (this.mergedToolsPromise) return this.mergedToolsPromise;
     if (this.toolsCacheValid()) return Promise.resolve([...this.toolsCache.tools]);
     const childrenAtBuild = this.children.map(entry => entry.child);
-    this.mergedToolsPromise = this.buildMergedTools()
+    // A build whose child listing failed is incomplete; caching it would pin
+    // the destination's missing tools until a restart or list_changed.
+    const buildState = { complete: true };
+    this.mergedToolsPromise = this.buildMergedTools(buildState)
       .then(tools => {
         // Cache only when the child set is unchanged; a restart that landed
         // mid-build invalidates the result and the next list rebuilds.
-        if (!this.shuttingDown && this.children.length === childrenAtBuild.length
+        if (!this.shuttingDown && buildState.complete && this.children.length === childrenAtBuild.length
           && this.children.every((entry, index) => entry.child === childrenAtBuild[index])) {
           this.toolsCache = { children: childrenAtBuild, tools };
         }
@@ -508,10 +609,17 @@ export class MCPProxy {
     return this.mergedToolsPromise;
   }
 
-  async buildMergedTools() {
+  async buildMergedTools(buildState = { complete: true }) {
     const namespace = new Map();
     const usedSlugs = new Map();
     const merged = [];
+    // Generated MCP entries pin exactly one destination per server, so tool
+    // names are unprefixed (run_query, get_source): the server name already
+    // identifies the target and a slug prefix would be redundant in chat
+    // references. Only when one server fronts several destinations (manual
+    // multi-destination startup) does each name carry its destination slug
+    // so every tool stays unambiguous.
+    const prefixed = this.children.length > 1;
     const publish = (name, mapping, definition) => {
       // A duplicate public name must not shadow the first registration: the
       // namespace map would keep the first handler while advertising both.
@@ -524,40 +632,54 @@ export class MCPProxy {
     };
     for (const entry of this.children) {
       const slug = slugifyDestination(entry.destination.name, usedSlugs);
-      const publicName = name => `${TOOL_NAME_PREFIX}${slug}_${publicToolSegment(name)}`;
+      const publicName = prefixed ? (name => `${slug}_${publicToolSegment(name)}`) : (name => publicToolSegment(name));
       const lintName = publicName(ABAP_LINT_TOOL.name);
       publish(lintName, { handler: runABAPLint }, { ...ABAP_LINT_TOOL, name: lintName });
+      let upstreamTools;
       try {
-        const upstreamTools = await entry.child.listToolsCached();
-        for (const tool of upstreamTools) {
-          if (tool.name === 'SAP') {
-            const applicationLogName = publicName('GetApplicationLog');
-            publish(applicationLogName, {
-              entry,
-              upstream: 'SAP',
-              publicName: 'GetApplicationLog',
-              transformArguments: applicationLogArguments
-            }, {
-              name: applicationLogName,
-              description: `${APPLICATION_LOG_DESCRIPTION} [destination: ${entry.destination.name}]`,
-              inputSchema: APPLICATION_LOG_SCHEMA
-            });
-          }
-
-          if (!exposeVspTool(tool)) continue;
-          const name = publicName(tool.name);
-          publish(name, { entry, upstream: tool.name }, { ...tool, name, description: `${tool.description || tool.name} [destination: ${entry.destination.name}]` });
-        }
-        for (const localTool of createEngineeringTools(entry, upstreamTools, { env: this.env, log: this.log })) {
-          const name = publicName(localTool.definition.name);
-          publish(name, { handler: localTool.handler }, {
-            ...localTool.definition,
-            name,
-            description: `${localTool.definition.description} [destination: ${entry.destination.name}]`
-          });
-        }
+        upstreamTools = await entry.child.listToolsCached();
+        entry.lastUpstreamTools = upstreamTools;
       } catch (error) {
+        buildState.complete = false;
         this.eventSink(`[${entry.destination.name}] tools/list failed: ${redactText(error.message)}`, 'error');
+        // A crashed child must not silently remove its tools from the
+        // surface: fall back to the last successful listing so the names stay
+        // callable and the tools/call self-heal path can restart the child.
+        upstreamTools = entry.lastUpstreamTools;
+      }
+      if (!upstreamTools) continue;
+      for (const tool of upstreamTools) {
+        if (tool.name === 'SAP') {
+          const applicationLogName = publicName('GetApplicationLog');
+          publish(applicationLogName, {
+            entry,
+            upstream: 'SAP',
+            publicName: 'GetApplicationLog',
+            transformArguments: applicationLogArguments
+          }, {
+            name: applicationLogName,
+            description: `${APPLICATION_LOG_DESCRIPTION} [destination: ${entry.destination.name}]`,
+            inputSchema: APPLICATION_LOG_SCHEMA
+          });
+        }
+
+        if (!exposeVspTool(tool, this.readOnly)) continue;
+        const name = publicName(tool.name);
+        publish(name, { entry, upstream: tool.name }, { ...tool, name, description: `${tool.description || tool.name} [destination: ${entry.destination.name}]` });
+      }
+      // Local workflow tools gate on the upstream surface they can use; in
+      // read-only mode the hidden write tools must not enable change-set
+      // staging either.
+      const effectiveUpstream = this.readOnly
+        ? upstreamTools.filter(tool => !READ_ONLY_HIDDEN_VSP_TOOLS.has(tool.name))
+        : upstreamTools;
+      for (const localTool of createEngineeringTools(entry, effectiveUpstream, { env: this.env, log: this.log })) {
+        const name = publicName(localTool.definition.name);
+        publish(name, { handler: localTool.handler }, {
+          ...localTool.definition,
+          name,
+          description: `${localTool.definition.description} [destination: ${entry.destination.name}]`
+        });
       }
     }
     if (!merged.length && this.children.length) throw new Error('No destination child provided tools');
@@ -578,7 +700,7 @@ export class MCPProxy {
       if (message.method === 'initialize') {
         await this.initializeChildren(message.params || {});
         this.eventSink('[MCP] initialize complete; server ready', 'info');
-        return rpcResult(message.id, { protocolVersion: message.params?.protocolVersion || '2024-11-05', capabilities: { tools: { listChanged: true } }, serverInfo: { name: slugifyDestination(brandedEnvValue(this.env, 'DESTINATION') || this.children[0].destination.name), version: '0.1.0' } });
+        return rpcResult(message.id, { protocolVersion: message.params?.protocolVersion || '2024-11-05', capabilities: { tools: { listChanged: true } }, serverInfo: { name: slugifyDestination(brandedEnvValue(this.env, 'DESTINATION') || this.children[0].destination.name), version: this.version } });
       }
       if (!this.initialized) return rpcError(message.id, -32002, 'MCP proxy is not initialized');
       if (message.method === 'logging/setLevel' && MCP_LOG_LEVELS.includes(message.params?.level)) {
@@ -592,6 +714,10 @@ export class MCPProxy {
       }
       if (message.method === 'tools/call') {
         const name = message.params?.name;
+        // Concurrent dispatch means a tools/call can race the first
+        // tools/list that builds the tool namespace; ensure the surface
+        // exists before resolving the name.
+        if (!this.namespace.size) await this.mergedTools().catch(() => {});
         const mapped = this.namespace.get(name);
         if (!mapped) return rpcError(message.id, -32602, `Unknown namespaced tool: ${name}`);
         if (mapped.handler) return rpcResult(message.id, await mapped.handler(message.params?.arguments));
@@ -615,17 +741,31 @@ export class MCPProxy {
           this.eventSink(`[${mapped.entry.destination.name}] tools/call ${toolName} failed after ${Date.now() - startedAt}ms: ${diagnosticText(error.rpcError?.message || error.message)}`, 'error');
           // Self-healing: a dead child (crash, OOM, transient pipe break) is
           // restarted and the call retried once before surfacing the error.
+          // State-changing tools are never retried: the child may have
+          // completed the write before dying, and a blind re-send would
+          // apply it twice.
           const childBroken = mapped.entry.child.exited || !mapped.entry.child.process.stdin.writable;
-          if (childBroken && !this.shuttingDown) {
+          const retriable = !NON_RETRIABLE_VSP_TOOLS.has(mapped.upstream);
+          if (!retriable) {
+            this.eventSink(`[${mapped.entry.destination.name}] tools/call ${toolName} is state-changing; not retried after a child crash (possible duplicate write)`, 'warning');
+          }
+          let restartFailure;
+          if (childBroken && retriable && !this.shuttingDown) {
             try {
               await this.restartChild(mapped.entry);
               this.eventSink(`[${mapped.entry.destination.name}] tools/call ${toolName} retried after self-healing restart`);
               const retried = await mapped.entry.child.request('tools/call', upstreamParams);
               return retried.error ? { ...retried, id: message.id } : rpcResult(message.id, retried.result);
             } catch (restartError) {
+              restartFailure = restartError;
               this.eventSink(`[${mapped.entry.destination.name}] tools/call ${toolName} self-healing restart failed: ${diagnosticText(restartError.message)}`, 'error');
             }
           }
+          if (restartFailure) {
+            // The restart refusal (budget exhausted, shutdown) is the
+            // actionable cause; keep the original failure as context.
+            return rpcError(message.id, -32001, `Destination ${mapped.entry.destination.name} failed: ${error.message}; self-healing restart did not run: ${restartFailure.message}`);
+          }
           return error.rpcError ? rpcError(message.id, error.rpcError.code || -32001, error.rpcError.message || error.message, error.rpcError.data) : rpcError(message.id, -32001, `Destination ${mapped.entry.destination.name} failed: ${error.message}`);
         }
       }
@@ -645,33 +785,74 @@ export class MCPProxy {
     this.output = output;
     this.start();
     let buffer = '';
-    const onData = async chunk => {
+    // Requests are dispatched concurrently so one slow tools/call (an ATC
+    // run, a big query) cannot block ping, tools/list, or notifications and
+    // make the host declare the server unresponsive. JSON-RPC ids make
+    // response order irrelevant to the client; only the initialize handshake
+    // must finish first, so every request awaits the gate captured at parse
+    // time. In-flight requests are awaited on stream end so their responses
+    // are still written before shutdown.
+    let initGate = Promise.resolve();
+    const inFlight = new Set();
+    const dispatch = async message => {
+      try {
+        const response = await this.handle(message);
+        if (!response) return;
+        output(JSON.stringify(response));
+        if (message.method === 'initialize') {
+          this.clientInitialized = true;
+          for (const notification of this.pendingNotifications) output(JSON.stringify(notification));
+          this.pendingNotifications.length = 0;
+        }
+      } catch (error) {
+        // One failed dispatch must never poison the stream: log and keep
+        // serving whatever the client sends next.
+        this.eventSink(`[MCP] failed to answer client message: ${diagnosticText(error.message)}`, 'error');
+      }
+    };
+    const track = promise => {
+      inFlight.add(promise);
+      promise.finally(() => inFlight.delete(promise)).catch(() => {});
+    };
+    const onData = chunk => {
       buffer += chunk;
       let newline;
       while ((newline = buffer.indexOf('\n')) >= 0) {
         const line = buffer.slice(0, newline).trim();
         buffer = buffer.slice(newline + 1);
         if (!line) continue;
-        try {
-          const message = JSON.parse(line);
-          const response = await this.handle(message);
-          if (response) {
-            output(JSON.stringify(response));
-            if (message.method === 'initialize') {
-              this.clientInitialized = true;
-              for (const notification of this.pendingNotifications) output(JSON.stringify(notification));
-              this.pendingNotifications.length = 0;
-            }
-          }
-        } catch (error) { this.eventSink(`[MCP] invalid client message dropped: ${redactText(error.message)}`, 'error'); }
+        let message;
+        try { message = JSON.parse(line); }
+        catch (error) {
+          this.eventSink(`[MCP] invalid client message dropped: ${redactText(error.message)}`, 'error');
+          continue;
+        }
+        if (message?.method === 'initialize' && message.id !== undefined) {
+          // Serialize the handshake itself so a second initialize cannot
+          // race the first into initializeChildren.
+          const run = initGate.then(() => dispatch(message));
+          initGate = run;
+          track(run);
+        } else if (message?.id !== undefined) {
+          track(initGate.then(() => dispatch(message)));
+        } else {
+          track(dispatch(message));
+        }
       }
     };
     input.setEncoding('utf8');
-    let queue = Promise.resolve();
-    input.on('data', chunk => { queue = queue.then(() => onData(chunk)); });
-    await once(input, 'end');
-    await queue;
-    await this.close();
+    input.on('error', error => {
+      this.eventSink(`[MCP] client input stream failed: ${diagnosticText(error.message)}`, 'error');
+      void this.close();
+    });
+    input.on('data', onData);
+    try {
+      await once(input, 'end');
+      await Promise.allSettled([...inFlight]);
+    } finally {
+      input.off('data', onData);
+      await this.close();
+    }
   }
 
   async close() {

package/src/redact.mjs

@@ -0,0 +1,28 @@
+// Shared credential redaction for every diagnostic lane (stderr, MCP log
+// notifications, tool errors, relay responses). One implementation so a fix
+// applies everywhere; the old per-file copies each missed a different case.
+//
+// Covered patterns:
+// - authorization: Basic <base64> / Bearer <token> / proxy-authorization
+// - cookie: a=b; c=d (the whole pair list, not just the first pair)
+// - password=... / secret=... / token=... / x-csrf-token: ... style keys
+// - URLs with embedded userinfo, https://user:pass@host
+// Bare credential blobs without a recognizable key cannot be detected
+// generically and are out of scope.
+const URL_USERINFO = /([a-z][a-z0-9+.-]*:\/\/)([^\s/@:?=&]+):([^\s/@]+)@/gi;
+const NAMED_VALUE = /((?:proxy-)?authorization|cookie|passwd|password|secret|token)\s*[:=]\s*(?:bearer\s+|basic\s+)?[^\s,;"']+/gi;
+// Header-shaped values may carry lists (cookie pairs); after the first pass
+// redacts the leading pair, this pass drops the remainder of the line.
+const HEADER_TAIL = /^((?:proxy-)?authorization|cookie)\s*[:=].*$/gim;
+
+export function redactText(value) {
+  return String(value ?? '')
+    .replace(URL_USERINFO, '$1[redacted]@')
+    .replace(NAMED_VALUE, '$1=[redacted]')
+    .replace(HEADER_TAIL, '$1=[redacted]');
+}
+
+// Redact, collapse whitespace, and clamp to a diagnostic-friendly length.
+export function diagnosticText(value, limit = 500) {
+  return redactText(value?.message || value || 'unknown error').replace(/\s+/g, ' ').trim().slice(0, limit);
+}

package/src/setup.mjs

@@ -2,7 +2,7 @@ import { createInterface } from 'node:readline/promises';
 import { stdin, stdout } from 'node:process';
 import { checkboxPrompt, colorText, formatStatus, textPrompt } from './terminal-ui.mjs';
 import { discoverDestinations, remediation } from './bas-discovery.mjs';
-import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys } from './cf-destination.mjs';
+import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys, findOrphanedCloudFoundryServiceKeys } from './cf-destination.mjs';
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
 import { readCredentials, removeDestinationCredentials, resolveCredentialsPath, storeDestinationCredentials } from './credentials-store.mjs';
 import { canPromptForCredentials, credentialKeyForDestination, credentialModeForDestination } from './credential-overrides.mjs';
@@ -224,6 +224,35 @@ export async function runSetup({
   if (!target.available) {
     warnings.push(target.reason);
   } else {
+    // Sweep for service keys this toolkit created but no config references
+    // (an interrupted earlier setup leaves them behind; a Destination key
+    // exposes credentials for every destination in its instance).
+    try {
+      const orphans = await findOrphanedCloudFoundryServiceKeys({ env, spaceGuid: target.spaceGuid, managedKeys });
+      if (orphans.length) {
+        print(output, '');
+        print(output, formatStatus(`Found ${orphans.length} unreferenced sap-ai-dev-toolkit service key${orphans.length === 1 ? '' : 's'} in this CF space:`, 'warning', output, 'Cloud Foundry'));
+        for (const orphan of orphans.slice(0, 5)) print(output, `  • ${orphan.keyName} on ${orphan.instanceName}`);
+        const readline = createInterface({ input, output });
+        let removeOrphans = false;
+        try {
+          const answer = await readline.question('Delete these unreferenced service keys? (y + Enter = delete; Enter = keep) ');
+          removeOrphans = /^y(?:es)?$/i.test(answer.trim());
+        } finally {
+          readline.close();
+        }
+        if (removeOrphans) {
+          const result = await deleteManagedCloudFoundryServiceKeys({ env, keys: orphans });
+          warnings.push(...(result.warnings || []));
+          const deleted = orphans.length - (result.warnings || []).length;
+          print(output, formatStatus(`Removed ${deleted} unreferenced service key${deleted === 1 ? '' : 's'}.`, 'success', output, 'Cloud Foundry'));
+        } else {
+          warnings.push(`${orphans.length} unreferenced sap-ai-dev-toolkit service key${orphans.length === 1 ? '' : 's'} were kept; review them with "cf service-keys" and delete manually if unwanted.`);
+        }
+      }
+    } catch {
+      // The sweep is best-effort; a failed lookup must not block setup.
+    }
     let shouldImport = false;
     try {
       shouldImport = await confirmCfImport({ input, output });