sap-ai-dev-toolkit 0.5.6 → 0.6.0

package/README.md

@@ -68,7 +68,7 @@ Then connect a destination in SAP Business Application Studio:
 
 Use the attached destination-prefixed tools directly in chat. Do not launch `sap-ai-dev` or handcraft MCP JSON-RPC in a terminal to discover or call them.
 
-**Prerequisite:** Node.js 20 or newer. If Go is not already available, the installer can provision the pinned supported Go release automatically.
+**Prerequisite:** Node.js 20 or newer. The pinned VSP runtime ships with the package; no Go toolchain is installed or required.
 
 ## 🤖 Available agents and skills
 
@@ -78,7 +78,7 @@ Use the attached destination-prefixed tools directly in chat. Do not launch `sap
 | --- | --- | --- |
 | 🧭 | **SAP Solution Architect** | System investigation, SAP standard/API recommendations, Clean Core and side-by-side design, and SDLC orchestration through implementation handoffs and validation gates |
 | 🧑‍💻 | **ABAP Developer** | General ABAP, CDS, and RAP implementation, validation, and transport-preparation tasks |
-| 🐞 | **ABAP Runtime Debugger** | Runtime incidents, dumps, logs, traces, debugger sessions, call graphs, and performance symptoms |
+| 🐞 | **ABAP Runtime Debugger** | Runtime incidents, application logs, debugger sessions, and performance symptoms; call relationships are derived from source inspection |
 | 🚀 | **RAP Service Developer** | RAP business objects, behavior implementations, projections, service definitions, service bindings, and OData validation |
 | 🗃️ | **HANA Cloud/HDI Specialist** | Read-only HANA Cloud container inspection, CAP/HDI artifact generation, local validation, and user-run deployment handoffs |
 
@@ -168,7 +168,7 @@ The package ships with five custom agents plus fourteen task-focused Copilot Age
 | 🧱 | `clean-core-extensibility` | Clean Core, released extensibility, and side-by-side extension design with risk classification |
 | 🔁 | `sap-sdlc-orchestration` | Requirement-to-release lifecycle planning, delegated implementation, quality gates, validation, and handover |
 | 🐞 | `abap-debugging` | Dumps, logs, traces, and runtime failure diagnosis |
-| 🔬 | `abap-runtime-analysis` | Incident triage, traces, debugger state, call graphs, and performance analysis |
+| 🔬 | `abap-runtime-analysis` | Incident triage, debugger state, and performance analysis; call relationships come from source inspection |
 | 🚀 | `rap-service-delivery` | RAP service activation, publication, OData validation, and end-to-end runtime checks |
 | 🚚 | `sap-transport-release` | Dependency checks and transport preparation; release itself is intentionally unavailable here |
 | 🔎 | `hana-cloud-inspection` | Verify the selected HANA Cloud binding and inspect bounded HDI catalog/data results |
@@ -237,6 +237,7 @@ Once the destination server is enabled in Copilot Chat, ask for outcomes instead
 | --- | --- |
 | 🎯 **Explicit target** | SAP changes only proceed when the destination and required target details are known. |
 | 🚦 **Explicit state change** | Activation, service publication, and transport creation happen only when requested and authorized. |
+| 👁️ **Optional read-only mode** | `SAP_AI_DEV_TOOLKIT_READ_ONLY=true` removes every write/activate/transport-create tool from the surface and starts VSP with `--transport-read-only`. Recommended for exploration destinations. |
 | 🧪 **Verification first** | The agent uses available lint, syntax, unit-test, ATC, and diagnostics workflows and reports what actually ran. |
 | 🔒 **SAP authorization remains authoritative** | The add-on does not bypass backend SAP permissions. |
 | 🚚 **Curated VSP tool surface** | The proxy exposes a cherry-picked developer-lifecycle set from VSP plus local workflow tools, keeping one destination below 60 tools; SAP authorizations and VSP safety checks still apply. |
@@ -270,14 +271,14 @@ The guided setup can also offer companion MCP entries with `sap-ai-dev --setup -
 | CAP tools | `@cap-js/mcp-server` | CAP CDS/service model inspection and CAP app development |
 | Browser validation | `@playwright/mcp` | Fiori/UI smoke tests, screenshots, and browser runtime validation |
 
-The installer handles two setup tasks automatically:
+The installer handles VSP provisioning automatically:
 
-- Looks for Go in `GO_BINARY`, `PATH`, or the package-local Go installation. If none is available, it downloads and installs the pinned supported Go release without prompting.
-- Uses the package's checksum-verified patched VSP binary for the current platform. A remote download is the fallback only when the package has no bundled asset.
+- Uses the package's bundled patched VSP binary for the current platform, verified against the npm-published `dist/checksums.txt`. A checksum-anchored remote download is the fallback only when the package has no bundled asset.
+- No Go toolchain is downloaded or required at install time; Go is only used by the repository's own `build:vsp` development script.
 
 With `H2O_URL` set, an interactive install opens a checkbox picker with no destinations selected by default. Use **Space** to choose destinations and **Enter** to confirm. Press **a** to toggle all destinations (select all if any are unchecked; otherwise clear the selection). Confirming with none selected removes this add-on's managed MCP entries. When the `cf` CLI 8.18 or newer is authenticated to a targeted space, setup first offers an optional import from that space's Destination service; type **y** then **Enter** to include it, or press **Enter** to skip. Accepted CF and BAS destinations appear together in the picker. npm may run its install hook without an interactive terminal, even when the shell is interactive; in that case, selection is skipped without changing MCP config.
 
-Some current npm versions also require install hooks to be approved. If npm reports that `sap-ai-dev-toolkit`'s `postinstall` was blocked, allow it during a fresh install with `npm install --global --allow-scripts=sap-ai-dev-toolkit sap-ai-dev-toolkit`, or run `sap-ai-dev-toolkit --setup` from an interactive BAS terminal after installation.
+Some current npm versions also require install hooks to be approved. If npm reports that `sap-ai-dev-toolkit`'s `postinstall` was blocked, allow it during a fresh install with `npm install --global --allow-scripts=sap-ai-dev-toolkit sap-ai-dev-toolkit`, or run `sap-ai-dev --setup` from an interactive BAS terminal after installation.
 
 The setup report uses icons and terminal colors; set `NO_COLOR=1` to disable ANSI colors. The table is a weather report, not a bouncer: green **PASS** means the ADT probe responded, red **FAIL** means it failed, and yellow **SKIPPED** means it was skipped. Probe failures do not block MCP registration or startup for destinations you select.
 
@@ -300,7 +301,7 @@ This lists discovered systems in the same checkbox picker, with nothing selected
 For a non-interactive installation or a platform without a published VSP asset, provide a trusted binary override:
 
 ```sh
-BAS_VSP_BINARY=/path/to/vsp npm install --global sap-ai-dev-toolkit
+SAP_AI_DEV_TOOLKIT_BINARY=/path/to/vsp npm install --global sap-ai-dev-toolkit
 ```
 
 At the end of a global install, the color-coded summary shows the MCP config path, each generated entry name, destination/client/authentication, launch command, and environment key names (not values). The installer does not open an editor automatically; in BAS/VS Code:
@@ -339,7 +340,7 @@ The package includes five user-invocable custom agents (**SAP Solution Architect
 | 🧱 | `clean-core-extensibility` | Design Clean Core compliant in-app, developer, API/event, and side-by-side extension patterns. |
 | 🔁 | `sap-sdlc-orchestration` | Orchestrate discovery, design, implementation handoffs, quality gates, transport readiness, and handover. |
 | 🐞 | `abap-debugging` | Diagnose dumps, application logs, traces, and runtime failures. |
-| 🔬 | `abap-runtime-analysis` | Analyze incidents, traces, debugger state, call graphs, and performance symptoms. |
+| 🔬 | `abap-runtime-analysis` | Analyze incidents, debugger state, and performance symptoms; derive call relationships from source inspection. |
 | 🚀 | `rap-service-delivery` | Validate RAP service bindings, activation, publication, and end-to-end OData behavior. |
 | 🚚 | `sap-transport-release` | Check dependencies and prepare changes for transport; release is not available here. |
 | 🔎 | `hana-cloud-inspection` | Verify the attached HANA target and inspect bounded HDI metadata and rows. |
@@ -348,7 +349,7 @@ The package includes five user-invocable custom agents (**SAP Solution Architect
 
 ### 📥 Install for your BAS user
 
-After destination setup, the installer prints a 🤖 notice that it is waiting for confirmation, then offers to install all bundled agents and skills under `$HOME/.copilot`. Press **Enter** to install; type **n** then **Enter** to skip. Declining leaves those files unchanged.
+After destination setup, the installer prints a 🤖 notice that it is waiting for confirmation, then offers to install all bundled agents and skills under `$HOME/.copilot`. Type **y** then **Enter** to install; pressing **Enter** alone skips (the default). Declining leaves those files unchanged.
 
 These user-level customizations are available across workspaces opened by the same BAS user in the same dev space. Copilot must be available in BAS and may need a window reload to discover new files. A non-interactive install skips the optional prompt; `npm install --ignore-scripts` skips the postinstall wizard entirely.
 
@@ -399,11 +400,11 @@ The sample values sketch an on-premise ABAP backend routed through SAP Cloud Con
 | `WebIDEUsage` | `dev_abap,odata_abap` | Include `dev_abap` for ABAP development; add other usages required by your BAS scenario. |
 | `CloudConnectorLocationId` | `DEMO-LOCATION` | Optional; set only when the Cloud Connector uses a location ID. |
 
-For on-premise systems, configure Cloud Connector access to the backend host and port first. BAS Destination and Connectivity service credentials remain in their respective services; optional SAP backend overrides are stored in the owner-only credentials file beside `mcp.json`, never in `mcp.json`. The BAS OnPremise override is saved only when its tunnel route returns a CSRF token and session cookie.
+For on-premise systems, configure Cloud Connector access to the backend host and port first. The add-on uses the authentication already configured in BAS or the Cloud Foundry Destination service; manage SAP credentials there.
 
 Think of `H2O_URL` as BAS's front door: it must point to the endpoint serving `/api/listDestinations`, not to the SAP backend.
 
-The `/api/listDestinations` response is a JSON array of destination records, like the provided `dests.sample.json`. A representative record:
+The `/api/listDestinations` response is a JSON array of destination records. A representative record:
 
 ```json
 {
@@ -447,7 +448,7 @@ One selected system, one isolated stdio MCP entry. Here's the shape:
 }
 ```
 
-The MCP protocol `serverInfo.name` matches `BAS_VSP_DESTINATION`, so each wizard-generated destination has its own identity instead of the shared `sap-ai-dev-toolkit` name.
+The MCP protocol `serverInfo.name` is the lowercased destination slug (from `SAP_AI_DEV_TOOLKIT_DESTINATION`, legacy `BAS_VSP_DESTINATION` accepted), so each wizard-generated destination has its own identity instead of the shared `sap-ai-dev-toolkit` name.
 
 Credentials, cookies, SAP usernames, passwords, and raw BAS destination payloads are not written to the MCP configuration.
 
@@ -489,7 +490,7 @@ Without `H2O_URL`, the command passes arguments directly to the installed VSP bi
 
 `sap-ai-dev` is an MCP stdio server and destination router, not a terminal command for individual SAP operations. No shell incantations needed: your MCP client discovers the tools, picks one for the chat request, and sends the call over stdio.
 
-Each generated MCP server entry is named with the lowercased destination slug: `DEMO_ABAP` becomes `demo-abap`. Tool names are `<destination-slug>_<tool>` with a lowercase snake_case tool segment (`demo-abap_get_source`, `demo-abap_run_query`, `demo-abap_lint_abap`), so every tool states which SAP system it targets. Lowercase names are deliberate: BAS and VS Code derive chat tool references from the server and tool names and only bind lowercase identifiers, so mixed-case names show up in the tools picker but never bind to the chat session. Use the exact names shown by your MCP client; punctuation can change during slugification.
+Each generated MCP server entry is named with the lowercased destination slug: `DEMO_ABAP` becomes `demo-abap`. Because every generated entry is scoped to exactly one destination, tool names carry no redundant prefix — they are plain lowercase snake_case (`get_source`, `run_query`, `lint_abap`); the server name already states which SAP system it targets. Only when one server fronts several destinations (manual multi-destination startup) does each name gain its destination slug (`demo-abap_run_query`) to stay unambiguous. Lowercase names are deliberate: BAS and VS Code derive chat tool references from the server and tool names and only bind lowercase identifiers, so mixed-case names show up in the tools picker but never bind to the chat session. Use the exact names shown by your MCP client; punctuation can change during slugification.
 
 Upgrading from an earlier release that wrote mixed-case entry names (for example `ActionS4D` or `cf:<guid>:<guid>:<name>`)? Re-run `sap-ai-dev --setup` to replace legacy entries — this is the only migration path for Cloud Foundry entries — or run `sap-ai-dev --doctor` to rename BAS entries in place. Then reload the BAS window and start a new chat; an existing chat keeps its stale tool binding. If setup reports that the lowercase name already exists and is not managed by this package, rename or remove that user-owned server entry first.
 
@@ -505,7 +506,7 @@ The menu includes the tools registered by the active VSP mode, the `GetApplicati
 
 ### 🧹 Lint submitted ABAP source locally
 
-The per-destination tool name is `<destination-slug>_lint_abap`, for example `demo-abap_lint_abap` (the local workflow name `LintABAP` is exposed in snake_case). It accepts caller-supplied abapGit-serialized source files; config is optional and, when present, is the full abaplint configuration rather than a merge with defaults.
+The tool is named `lint_abap` (the local workflow name `LintABAP` exposed in snake_case; on a multi-destination server it is `<destination-slug>_lint_abap`). It accepts caller-supplied abapGit-serialized source files; config is optional and, when present, is the full abaplint configuration rather than a merge with defaults.
 
 ```json
 {
@@ -545,7 +546,7 @@ For an ABAP Cloud assessment, get object URIs from `SearchObject` and pass them
 
 `tools/list` confirms what this MCP server exposes; it does not prove that VS Code attached the server to the active chat. Start the selected destination in **MCP: List Servers**, enable it in the Chat tools picker, and reload/reselect the agent if the host binding is stale. This add-on cannot inspect or repair another MCP server's registration or a host-wide tool budget.
 
-`sap-ai-dev-toolkit --demo` starts an isolated server with sample ABAP objects, test and ATC results, a sample transport, and synthetic OData metadata and rows. Source edits and transport creation stay in process memory and disappear on exit. The demo does not discover or contact BAS or SAP destinations.
+`sap-ai-dev --demo` starts an isolated server with sample ABAP objects, test and ATC results, a sample transport, and synthetic OData metadata and rows. Source edits and transport creation stay in process memory and disappear on exit. The demo does not discover or contact BAS or SAP destinations.
 
 ### 🔎 Find and understand ABAP objects
 
@@ -605,6 +606,7 @@ The write and activation tools change SAP state. Confirm the target, package, an
 | `GetSystemInfo` | Read system ID, SAP release, kernel, and database details. |
 | `GetInstalledComponents` | List installed software components and versions. |
 | `GetFeatures` | Probe optional system capabilities, including abapGit, RAP/OData, AMDP debugging, UI5/BSP, and CTS transports. |
+| `GetConnectionInfo` | Show the connected user, client, URL, mode, and feature-probe summary for the current destination session. |
 | `PrettyPrint` | Format ABAP source text without saving it to SAP. |
 
 ### 🚚 Inspect and create transports
@@ -642,7 +644,7 @@ The proxy intentionally does not expose the full child VSP process. Object delet
 3. Ask for the operation in plain language. The MCP client sends `tools/call`; no need to type a tool such as `GetSource` into a terminal.
 4. Check the response in chat. For source edits, ask for a syntax check and tests before activation when that matches your workflow.
 
-For a quick table read—say, company codes from `T001`—select the destination's `RunQuery` tool (for `DEMO_ABAP`, `demo-abap_run_query`) and pass:
+For a quick table read—say, company codes from `T001`—select the destination's `RunQuery` tool (exposed as `run_query`; `demo-abap_run_query` only on a multi-destination server) and pass:
 
 ```json
 {
@@ -659,7 +661,7 @@ The same request can be expressed to an MCP client as:
   "id": 2,
   "method": "tools/call",
   "params": {
-    "name": "demo-abap_run_query",
+    "name": "run_query",
     "arguments": {
       "sql_query": "SELECT BUKRS, BUTXT, WAERS, LAND1 FROM T001",
       "max_rows": 100
@@ -707,7 +709,7 @@ The response contains a `tools` array. A `RunQuery` entry resembles this excerpt
 
 ```json
 {
-  "name": "demo-abap_run_query",
+  "name": "run_query",
   "description": "Execute an ABAP SQL query [destination: DEMO_ABAP]",
   "inputSchema": {
     "type": "object",
@@ -732,15 +734,19 @@ The response contains a `tools` array. A `RunQuery` entry resembles this excerpt
 | `SAP_AI_DEV_TOOLKIT_MODE` | VSP child mode (`expert` by default; `focused` omits `ActivateMultiple`, `GetUserTransports`, and `GetTransportInfo`). The proxy exposes its curated tool subset and local workflow tools, including `LintABAP`. |
 | `SAP_ALLOW_TRANSPORTABLE_EDITS` | Generated MCP entries set this to `true` to permit source edits in transportable packages; VSP safety checks and SAP authorizations still apply. |
 | `SAP_AI_DEV_TOOLKIT_DISABLE_BAS_RELAY=true` | Disable the built-in BAS destination relay. By default the add-on self-heals `.dest` destinations through a local relay that keeps all access destination-based while handling ADT CSRF fetch/retry behavior before VSP calls SAP. |
-| `SAP_AI_DEV_TOOLKIT_HTTP_PROXY` | Egress proxy for relay and discovery traffic. Takes precedence over `HTTP_PROXY`/`http_proxy`; unset means the default BAS proxy for `.dest` hosts, empty means direct except for OnPremise credential overrides, which require a BAS proxy tunnel. |
+| `SAP_AI_DEV_TOOLKIT_HTTP_PROXY` | Egress proxy for relay and discovery traffic. Takes precedence over `HTTP_PROXY`/`http_proxy`; unset means the default BAS proxy for `.dest` hosts, empty means direct. |
 | `SAP_AI_DEV_TOOLKIT_MAX_CSRF_RETRIES` | Bounded retries after explicit CSRF-session rejection per unsafe request (default 3, maximum 10). Invalid values use the default. |
+| `SAP_AI_DEV_TOOLKIT_READ_ONLY=true` | Read-only mode: hides `WriteSource`, `EditSource`, `Activate`, `ActivateMultiple`, `CreateTransport`, `SetBreakpoint`, and the change-set workflow tools, and starts VSP with `--transport-read-only`. |
+| `SAP_AI_DEV_TOOLKIT_REQUEST_TIMEOUT_MS` | Per-request timeout for calls forwarded to a VSP child (default 600000 = 10 minutes; `0` disables). A stalled request fails with a timeout error; the child is left running. |
 | `SAP_AI_DEV_MCP_CONFIG` | Explicit MCP configuration path; highest precedence. |
 | `SAP_AI_DEV_TOOLKIT_MCP_CONFIG` | Branded compatibility alias for the MCP configuration path. |
 | `BAS_VSP_MCP_CONFIG` | Backward-compatible alias for the MCP configuration path. |
-| `BAS_VSP_BINARY` | Trusted prebuilt VSP executable; skips Go and binary provisioning. |
-| `BAS_VSP_BINARY_URL` | Alternate VSP binary download URL. |
-| `BAS_VSP_CACHE_DIR` | Binary cache directory. |
-| `GO_BINARY` | Explicit Go executable used for provisioning when automatic Go installation is unavailable. |
+| `SAP_AI_DEV_TOOLKIT_BINARY` | Trusted prebuilt VSP executable; skips binary provisioning. Legacy `BAS_VSP_BINARY` still works. |
+| `SAP_AI_DEV_TOOLKIT_BINARY_URL` | Alternate VSP binary download URL (checksum-verified). Legacy `BAS_VSP_BINARY_URL` still works. |
+| `SAP_AI_DEV_TOOLKIT_RELEASE_BASE_URL` | Override the base URL that VSP release binaries are downloaded from. |
+| `SAP_AI_DEV_TOOLKIT_CACHE_DIR` | Binary cache directory. Legacy `BAS_VSP_CACHE_DIR` still works. |
+| `BAS_CF_SPACE_GUID`, `BAS_CF_DESTINATION_INSTANCE_GUID`, `BAS_CF_DESTINATION_INSTANCE`, `BAS_CF_DESTINATION_KEY`, `BAS_CF_DESTINATION_NAME`, `BAS_CF_CONNECTIVITY_INSTANCE_GUID`, `BAS_CF_CONNECTIVITY_INSTANCE`, `BAS_CF_CONNECTIVITY_KEY` | Written into generated Cloud Foundry destination entries; they reference service instances and key **names** (never credentials). |
+| `GO_BINARY` | Explicit Go executable for the repository-only `build:vsp` script; not used during installation. |
 | `SAP_AI_DEV_TOOLKIT_SKIP_PROBE=true` | Skip destination probes; useful for controlled diagnostics or fixtures. |
 | `HTTP_PROXY` / `HTTPS_PROXY` | BAS proxy settings used for destination-list requests, destination probing, and child processes. |
 | `NO_PROXY` | Proxy bypass list for BAS destination-list requests; `.dest` hosts remain routed through the BAS proxy. |
@@ -753,8 +759,7 @@ The relay between the VSP child and each BAS destination recovers from the failu
 2. **Session refresh** — when SAP explicitly rejects a CSRF token, the cached session is dropped, a fresh token+cookie pair is fetched, and the request is retried within the configured bound. Generic authorization 401/403 responses are returned without being mislabeled or retried as CSRF failures.
 3. **Proxy tunnel fallback** — when the BAS proxy refuses absolute-form requests (502/504 or transport errors), the relay switches to a CONNECT tunnel through the same proxy and keeps going.
 4. **Child crash recovery** — a crashed VSP child is restarted transparently, re-initialized, tools re-registered, and the interrupted `tools/call` retried once before any error reaches the client.
-5. **Direct connect for Internet destinations** — the BAS `.dest` proxy strips SAP `Set-Cookie` headers, which makes CSRF token/session binding impossible for ADT writes (`403 CSRF token validation failed`). When you select an Internet destination with BasicAuthentication, setup asks whether to override its credentials. A Yes prompts for SAP user/password and stores them in `sap-ai-dev-toolkit-credentials.json` **next to** `mcp.json` (never inside it, permissions `0600`). The relay connects straight to the backend host so cookies survive and ADT writes can use the paired CSRF session.
-6. **Cloud Connector credential overrides** — setup also offers per-destination overrides for BasicAuthentication OnPremise destinations. BAS OnPremise credentials travel through an HTTP CONNECT tunnel to the BAS `.dest` endpoint, retaining its Cloud Connector mapping; setup saves the override only after a read-only probe returns both a CSRF token and a session cookie. If that route check fails, the override is not saved. Cloud Foundry OnPremise overrides replace only the SAP backend user/password; Connectivity service-key authentication and its proxy route remain unchanged. PrincipalPropagation is never overridden. Rerun `sap-ai-dev --setup` to change credentials or answer No to disable a stored override. Deselecting a destination (or selecting none) removes stale overrides.
+5. **Configured destination authentication** — the add-on always uses the URL, authentication mode, and credentials already configured for the selected destination. Setup does not prompt for or store SAP usernames/passwords, and the relay does not connect directly to a backend host as a credential fallback. Correct the credentials in BAS or the Cloud Foundry Destination service if SAP rejects them.
 Existing installs that still set the previous `BAS_VSP_*` environment variables remain supported. The setup wizard writes new MCP entries with the `SAP_AI_DEV_TOOLKIT_*` names.
 
 #### Server logging

package/inventory.md

@@ -6,8 +6,8 @@ This inventory reflects the current SAP AI Dev Toolkit proxy behavior in `src/mc
 
 | Status | Count | Notes |
 | --- | ---: | --- |
-| VSP tools | Up to 51 | Curated from the child VSP tool list and exposed with a destination prefix in lowercase snake_case, for example `<destination>_get_source`. |
-| Local lint tool | 1 per destination | `LintABAP` analyzes caller-supplied ABAP source in memory; it is exposed publicly as `<destination>_lint_abap`. |
+| VSP tools | Up to 51 | Curated from the child VSP tool list and exposed in lowercase snake_case, unprefixed (`get_source`) on single-destination servers; a destination slug prefix (`demo-abap_get_source`) appears only when one server fronts multiple destinations. |
+| Local lint tool | 1 per destination | `LintABAP` analyzes caller-supplied ABAP source in memory; it is exposed publicly as `lint_abap`. |
 | Workflow tools | Up to 6 per destination | Review/apply change sets, transport evidence, Clean Core release assessment, and read-only RAP regression suites. Some are exposed only when their upstream VSP tools are registered. |
 | Convenience mapping | Dynamic | `GetApplicationLog` maps to VSP `SAP(action="analyze", type="application_log")` when the SAP router is registered. |
 | Intentionally filtered VSP tools | Dynamic | Destructive, broad-router, trace, and unsupported VSP operations are hidden from direct calls. |
@@ -161,8 +161,10 @@ These logical names are exposed through MCP in lowercase snake_case (`lint_abap`
 
 ## Notes
 
-- Runtime tool names are `<destination-slug>_<tool>`, for example `demo-abap_run_query`; `tools/call` accepts the exact name returned by `tools/list`.
+- Runtime tool names are unprefixed lowercase snake_case (`run_query`) on the normal single-destination server; a `<destination-slug>_` prefix appears only on multi-destination servers. `tools/call` accepts the exact name returned by `tools/list`.
 - The proxy starts VSP with `--enable-transports`; generated MCP entries set `SAP_ALLOW_TRANSPORTABLE_EDITS=true`.
+- `SAP_AI_DEV_TOOLKIT_READ_ONLY=true` switches a server to read-only: the write/activate/transport-create/breakpoint tools above are removed from the surface, change-set workflows are not registered, and VSP starts with `--transport-read-only` instead.
+- `SAP_AI_DEV_TOOLKIT_REQUEST_TIMEOUT_MS` (default 600000) bounds each forwarded call; stalled requests fail without killing the child.
 - Transport release/deletion and the general-purpose `SAP` router are intentionally hidden from direct proxy calls. `GetApplicationLog` is the bounded convenience mapping for the SAP application-log route.
 
 ## Separate optional HANA Cloud inspector

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.5.6",
+  "version": "0.6.0",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/src/bas-destination-relay.mjs

@@ -133,14 +133,7 @@ async function readRequestBody(req) {
 export function createBasDestinationRelay(destination, { env = process.env, fetchImpl = undiciFetch, log = () => {} } = {}) {
   if (!destination?.url) throw new Error('Destination relay requires a BAS destination URL');
   const base = new URL(destination.url);
-  const credentials = destination.credentials;
-  const tunnelMode = credentials?.mode === 'bas-tunnel';
-  const directHost = tunnelMode ? '' : credentials?.host;
-  // Internet overrides retain the direct-backend path. OnPremise overrides
-  // must keep the BAS .dest route (and its Cloud Connector mapping), so they
-  // use HTTP CONNECT through the BAS proxy instead of credentials.host.
-  const directBase = directHost ? new URL(String(directHost)) : null;
-  const cookieBase = directBase || (destination.backendUrl
+  const cookieBase = destination.backendUrl
     ? new URL(String(destination.backendUrl))
     : (() => {
         const target = new URL(base);
@@ -149,9 +142,8 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
         // omits the backend URL so Secure session cookies are not discarded.
         if (target.protocol === 'http:' && /\.dest$/i.test(target.hostname)) target.protocol = 'https:';
         return target;
-      })());
-  if (directBase) log(`[${destination.name}] BAS relay direct connect active (${directBase.origin}); BAS proxy cookie stripping bypassed`);
-  if (tunnelMode) log(`[${destination.name}] BAS relay using a BAS proxy tunnel for the OnPremise destination`);
+      })();
+  // BAS destinations must keep their configured .dest route and authentication.
   // Proxy resolution: an explicitly configured proxy wins (an explicit empty
   // value means "go direct"). Without configuration, BAS virtual .dest hosts
   // imply the default BAS proxy; any other host (tests, direct URLs) is
@@ -159,16 +151,15 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
   // foreign proxy.
   const brandedProxy = brandedEnvValue(env, 'HTTP_PROXY');
   const explicitProxy = brandedProxy !== undefined ? brandedProxy : (env.HTTP_PROXY ?? env.http_proxy);
-  const proxyUrl = directBase ? '' : (explicitProxy !== undefined ? String(explicitProxy) : (/\.dest$/i.test(base.hostname) ? DEFAULT_PROXY : ''));
-  if (tunnelMode && !proxyUrl) throw new Error('OnPremise credential overrides require the BAS destination proxy to preserve the Cloud Connector route');
+  const proxyUrl = explicitProxy !== undefined ? String(explicitProxy) : (/\.dest$/i.test(base.hostname) ? DEFAULT_PROXY : '');
   const dispatcher = proxyUrl ? new ProxyAgent({ uri: proxyUrl, proxyTunnel: false }) : undefined;
   // Self-healing mode 2: if the BAS proxy refuses absolute-form proxied
   // requests (its own 502/504), retry through a CONNECT tunnel so the relay
   // keeps working through the same egress.
   const tunnelDispatcher = proxyUrl ? new ProxyAgent({ uri: proxyUrl, proxyTunnel: true }) : undefined;
-  let tunneled = tunnelMode;
+  let tunneled = false;
   // Observable self-healing counters, surfaced by --doctor and tests.
-  const stats = { requests: 0, csrfFetches: 0, csrfRetries: 0, csrfSessionFailures: 0, tunnelFallbacks: 0, direct: Boolean(directBase), proxyTunnel: tunnelMode };
+  const stats = { requests: 0, csrfFetches: 0, csrfRetries: 0, csrfSessionFailures: 0, tunnelFallbacks: 0, direct: false, proxyTunnel: false };
   const maxFailures = maxTokenFailures(env, log, destination.name);
   // The shared jar captures SAP cookies from safe reads as well as CSRF fetches.
   // Each cached token gets its own snapshot so later responses cannot silently
@@ -210,16 +201,16 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
   async function fetchTokenFresh(requestHeaders) {
     const key = CSRF_FETCH_PATH;
     stats.csrfFetches += 1;
-    const target = resolveTarget(new URL(CSRF_FETCH_PATH, base));
+    const target = new URL(CSRF_FETCH_PATH, base);
     const cookieTarget = resolveCookieTarget(target);
     const jar = copyCookieJar(sharedCookieJar);
     await seedRequestCookies(jar, requestHeaders.cookie, cookieTarget);
     const outgoingCookie = await cookieHeader(jar, cookieTarget);
-    const response = await sendWithFallback(target, 'GET', authHeaders(fetchHeaders(requestHeaders, {
+    const response = await sendWithFallback(target, 'GET', fetchHeaders(requestHeaders, {
       'x-csrf-token': 'Fetch',
       accept: requestHeaders.accept || 'application/xml,*/*',
       ...(outgoingCookie ? { cookie: outgoingCookie } : {})
-    })));
+    }));
     await response.arrayBuffer().catch(() => undefined);
     const token = response.headers.get('x-csrf-token');
     await recordCookies(jar, response.headers, cookieTarget, log, destination.name);
@@ -265,36 +256,17 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
     };
   }
 
-  // Rewrite an incoming .dest target onto the direct backend host when
-  // credentials are configured, keeping path and query intact.
-  function resolveTarget(target) {
-    if (!directBase) return target;
-    return new URL(`${target.pathname}${target.search}`, directBase);
-  }
-
-  function authHeaders(extra = {}) {
-    if (!credentials?.user || !credentials?.password) return extra;
-    const basic = Buffer.from(`${credentials.user}:${credentials.password}`).toString('base64');
-    // The stored credential override wins over any inbound authorization
-    // header: the override exists precisely to pair Basic auth with the
-    // relay's CSRF session, and silently forwarding a caller-supplied header
-    // would disable that pairing without any diagnostic.
-    const headers = { ...extra };
-    delete headers.authorization;
-    delete headers.Authorization;
-    return { ...headers, authorization: `Basic ${basic}` };
-  }
 
   async function forward(method, requestUrl, requestHeaders, body, session) {
-    const target = resolveTarget(requestUrl);
+    const target = requestUrl;
     const cookieTarget = resolveCookieTarget(target);
     const cookieJar = session?.jar || sharedCookieJar;
     if (!session) await seedRequestCookies(cookieJar, requestHeaders.cookie, cookieTarget);
     const sessionCookie = await cookieHeader(cookieJar, cookieTarget);
-    const headers = authHeaders(headersFrom(requestHeaders, {
+    const headers = headersFrom(requestHeaders, {
       ...(session?.token ? { 'x-csrf-token': session.token } : {}),
       ...(sessionCookie ? { cookie: sessionCookie } : {})
-    }));
+    });
     const response = await sendWithFallback(target, method, headers, body);
     const responseBody = Buffer.from(await response.arrayBuffer());
     if (session) await recordCookies(session.jar, response.headers, cookieTarget, log, destination.name);
@@ -332,7 +304,7 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
       return forwardWithRetry(method, requestUrl, requestHeaders, body, failures + 1);
     }
     if (unsafe && rejected && tokenOnly) {
-      log(`[${destination.name}] BAS relay CSRF token rejected without a session cookie for ${requestUrl.pathname}; not retried (route delivers no cookies; a credential override enables a paired session)`);
+      log(`[${destination.name}] BAS relay CSRF token rejected without a session cookie for ${requestUrl.pathname}; not retried (the configured destination route delivered no cookies)`);
     } else if (unsafe && rejected && failures >= maxFailures) {
       log(`[${destination.name}] BAS relay stopped after ${maxFailures} CSRF session retries for ${requestUrl.pathname}`);
     }

package/src/launcher.mjs

@@ -10,7 +10,6 @@ import { installMcpConfig, repairManagedMcpConfig } from './mcp-config.mjs';
 import { runSetup } from './setup.mjs';
 import { resolveConfiguredCloudFoundryDestination } from './cf-destination.mjs';
 import { withBrandedEnvironment } from './branding.mjs';
-import { enrichWithStoredCredentials } from './credential-overrides.mjs';
 import { redactText } from './redact.mjs';
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
@@ -100,19 +99,18 @@ async function runDoctor(destinations) {
       } else {
         checks.push(doctorRow(destination.name, 'BAS destination relay', 'skipped', 'Not applicable for this destination.'));
       }
-      if (relayedDestination?.credentials?.mode === 'bas-tunnel') {
-        checks.push(doctorRow(destination.name, 'OnPremise credential override', 'passed', 'Basic auth is routed through a BAS proxy tunnel; Cloud Connector routing is retained'));
-      } else if (relayedDestination?.credentials?.host) {
-        checks.push(doctorRow(destination.name, 'Direct connect', 'passed', `active (${new URL(relayedDestination.credentials.host).origin}); ADT writes use stored credentials`));
-      }
       const listed = await proxy.handle({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} });
       if (listed?.error) throw new Error(listed.error.message || 'MCP tools/list failed');
       const tools = listed.result?.tools || [];
+      // Doctor inspects one destination per proxy, so tool names are
+      // unprefixed (get_source, run_query); match the slug-prefixed form too
+      // in case this ever runs against a multi-destination server.
       const toolPrefix = `${slugifyDestination(destination.name)}_`;
       const localSegments = new Set(['lint_abap', 'get_application_log', 'prepare_abap_change_set', 'apply_abap_change_set', 'check_transport_readiness', 'plan_abap_cloud_migration', 'generate_rap_regression_suite', 'run_rap_regression_suite']);
-      const upstreamCount = tools.filter(tool => tool.name.startsWith(toolPrefix) && !localSegments.has(tool.name.slice(toolPrefix.length))).length;
+      const isUpstreamTool = tool => (tool.name.startsWith(toolPrefix) ? tool.name.slice(toolPrefix.length) : tool.name);
+      const upstreamCount = tools.filter(tool => !localSegments.has(isUpstreamTool(tool))).length;
       checks.push(doctorRow(destination.name, 'MCP tools/list', upstreamCount ? 'passed' : 'failed', `${upstreamCount} VSP tools and ${tools.length} total MCP tools returned; chat-picker binding is host-managed`));
-      const systemInfo = tools.find(tool => tool.name === `${toolPrefix}get_system_info`);
+      const systemInfo = tools.find(tool => tool.name === 'get_system_info' || tool.name === `${toolPrefix}get_system_info`);
       if (!systemInfo) {
         checks.push(doctorRow(destination.name, 'SAP system check', 'skipped', 'GetSystemInfo is not exposed by this VSP mode.'));
       } else {
@@ -133,7 +131,7 @@ async function runDoctor(destinations) {
             : `HTTP ${session?.httpStatus || 0}; token=${session?.tokenReceived ? 'received' : 'missing'}; cookies=${session?.cookieCount || 0}; usableSession=${sessionReady}; csrfFetches=${stats.csrfFetches || 0}; csrfRetries=${stats.csrfRetries || 0}; sessionFailures=${stats.csrfSessionFailures || 0}; tunnelFallbacks=${stats.tunnelFallbacks || 0}`;
           checks.push(doctorRow(destination.name, 'BAS relay CSRF preflight', status, detail));
           if (!sessionReady) {
-            const remediation = 'GetSystemInfo was not called because the relay could not establish a paired CSRF token/session. For OnPremise BasicAuth, run sap-ai-dev --setup and use a validated BAS proxy tunnel credential override.';
+            const remediation = 'GetSystemInfo was not called because the relay could not establish a paired CSRF token/session. Confirm the configured destination authentication and BAS proxy route.';
             checks.push(doctorRow(destination.name, 'SAP system check', 'skipped', preflightError ? `${remediation} Relay error: ${preflightError}` : remediation));
           }
         }
@@ -218,8 +216,8 @@ async function main() {
     let report;
     try {
       const destinations = runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry'
-        ? await enrichWithStoredCredentials([await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })], runtimeEnv)
-        : await enrichWithStoredCredentials(await discoverForCommand(), runtimeEnv);
+        ? [await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })]
+        : await discoverForCommand();
       report = await runDoctor(destinations);
     } catch (error) {
       report = { ok: false, destinations: 0, checks: [doctorRow('-', 'destination discovery', 'failed', redactText(error.message || error).slice(0, 300))] };
@@ -255,7 +253,7 @@ async function main() {
   }
 
   if (runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry') {
-    const destination = (await enrichWithStoredCredentials([await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })], runtimeEnv))[0];
+    const destination = await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv });
     let proxy;
     try {
       const binary = await binaryOrError();
@@ -285,7 +283,7 @@ async function main() {
 
   const discovered = await discoverDestinations({ env: runtimeEnv });
   for (const destination of discovered) logLine(probeDiagnostic(destination));
-  const destinations = await enrichWithStoredCredentials(discovered, runtimeEnv);
+  const destinations = discovered;
   if (!destinations.length) {
     logLine('[sap-ai-dev] destination discovery returned no named BAS destinations');
     throw new Error(remediation);
@@ -293,10 +291,6 @@ async function main() {
   const binary = await binaryOrError();
   logLine(`[sap-ai-dev] sap-ai-dev-toolkit v${pkg.version} (node ${process.version}, pid ${process.pid})`);
   logLine(`[sap-ai-dev] VSP binary: ${binary}`);
-  for (const destination of destinations) {
-    if (destination.credentials?.mode === 'bas-tunnel') logLine(`[sap-ai-dev] ${destination.name}: Basic credentials enabled through the BAS proxy tunnel`);
-    else if (destination.credentials?.host) logLine(`[sap-ai-dev] ${destination.name}: direct connect enabled through stored credentials`);
-  }
   logLine(`[sap-ai-dev] starting MCP proxy for ${destinations.map(destination => `${destination.name} (client=${destination.client})`).join(', ')}`);
   const proxy = new MCPProxy({ binary, destinations, env: process.env, log: logLine, version: pkg.version });
   const shutdown = signal => { void proxy.close().finally(() => process.exit(signal === 'SIGINT' ? 130 : 143)); };

package/src/mcp-proxy.mjs

@@ -613,6 +613,13 @@ export class MCPProxy {
     const namespace = new Map();
     const usedSlugs = new Map();
     const merged = [];
+    // Generated MCP entries pin exactly one destination per server, so tool
+    // names are unprefixed (run_query, get_source): the server name already
+    // identifies the target and a slug prefix would be redundant in chat
+    // references. Only when one server fronts several destinations (manual
+    // multi-destination startup) does each name carry its destination slug
+    // so every tool stays unambiguous.
+    const prefixed = this.children.length > 1;
     const publish = (name, mapping, definition) => {
       // A duplicate public name must not shadow the first registration: the
       // namespace map would keep the first handler while advertising both.
@@ -625,41 +632,54 @@ export class MCPProxy {
     };
     for (const entry of this.children) {
       const slug = slugifyDestination(entry.destination.name, usedSlugs);
-      const publicName = name => `${slug}_${publicToolSegment(name)}`;
+      const publicName = prefixed ? (name => `${slug}_${publicToolSegment(name)}`) : (name => publicToolSegment(name));
       const lintName = publicName(ABAP_LINT_TOOL.name);
       publish(lintName, { handler: runABAPLint }, { ...ABAP_LINT_TOOL, name: lintName });
+      let upstreamTools;
       try {
-        const upstreamTools = await entry.child.listToolsCached();
-        for (const tool of upstreamTools) {
-          if (tool.name === 'SAP') {
-            const applicationLogName = publicName('GetApplicationLog');
-            publish(applicationLogName, {
-              entry,
-              upstream: 'SAP',
-              publicName: 'GetApplicationLog',
-              transformArguments: applicationLogArguments
-            }, {
-              name: applicationLogName,
-              description: `${APPLICATION_LOG_DESCRIPTION} [destination: ${entry.destination.name}]`,
-              inputSchema: APPLICATION_LOG_SCHEMA
-            });
-          }
-
-          if (!exposeVspTool(tool, this.readOnly)) continue;
-          const name = publicName(tool.name);
-          publish(name, { entry, upstream: tool.name }, { ...tool, name, description: `${tool.description || tool.name} [destination: ${entry.destination.name}]` });
-        }
-        for (const localTool of createEngineeringTools(entry, upstreamTools, { env: this.env, log: this.log })) {
-          const name = publicName(localTool.definition.name);
-          publish(name, { handler: localTool.handler }, {
-            ...localTool.definition,
-            name,
-            description: `${localTool.definition.description} [destination: ${entry.destination.name}]`
-          });
-        }
+        upstreamTools = await entry.child.listToolsCached();
+        entry.lastUpstreamTools = upstreamTools;
       } catch (error) {
         buildState.complete = false;
         this.eventSink(`[${entry.destination.name}] tools/list failed: ${redactText(error.message)}`, 'error');
+        // A crashed child must not silently remove its tools from the
+        // surface: fall back to the last successful listing so the names stay
+        // callable and the tools/call self-heal path can restart the child.
+        upstreamTools = entry.lastUpstreamTools;
+      }
+      if (!upstreamTools) continue;
+      for (const tool of upstreamTools) {
+        if (tool.name === 'SAP') {
+          const applicationLogName = publicName('GetApplicationLog');
+          publish(applicationLogName, {
+            entry,
+            upstream: 'SAP',
+            publicName: 'GetApplicationLog',
+            transformArguments: applicationLogArguments
+          }, {
+            name: applicationLogName,
+            description: `${APPLICATION_LOG_DESCRIPTION} [destination: ${entry.destination.name}]`,
+            inputSchema: APPLICATION_LOG_SCHEMA
+          });
+        }
+
+        if (!exposeVspTool(tool, this.readOnly)) continue;
+        const name = publicName(tool.name);
+        publish(name, { entry, upstream: tool.name }, { ...tool, name, description: `${tool.description || tool.name} [destination: ${entry.destination.name}]` });
+      }
+      // Local workflow tools gate on the upstream surface they can use; in
+      // read-only mode the hidden write tools must not enable change-set
+      // staging either.
+      const effectiveUpstream = this.readOnly
+        ? upstreamTools.filter(tool => !READ_ONLY_HIDDEN_VSP_TOOLS.has(tool.name))
+        : upstreamTools;
+      for (const localTool of createEngineeringTools(entry, effectiveUpstream, { env: this.env, log: this.log })) {
+        const name = publicName(localTool.definition.name);
+        publish(name, { handler: localTool.handler }, {
+          ...localTool.definition,
+          name,
+          description: `${localTool.definition.description} [destination: ${entry.destination.name}]`
+        });
       }
     }
     if (!merged.length && this.children.length) throw new Error('No destination child provided tools');
@@ -729,6 +749,7 @@ export class MCPProxy {
           if (!retriable) {
             this.eventSink(`[${mapped.entry.destination.name}] tools/call ${toolName} is state-changing; not retried after a child crash (possible duplicate write)`, 'warning');
           }
+          let restartFailure;
           if (childBroken && retriable && !this.shuttingDown) {
             try {
               await this.restartChild(mapped.entry);
@@ -736,9 +757,15 @@ export class MCPProxy {
               const retried = await mapped.entry.child.request('tools/call', upstreamParams);
               return retried.error ? { ...retried, id: message.id } : rpcResult(message.id, retried.result);
             } catch (restartError) {
+              restartFailure = restartError;
               this.eventSink(`[${mapped.entry.destination.name}] tools/call ${toolName} self-healing restart failed: ${diagnosticText(restartError.message)}`, 'error');
             }
           }
+          if (restartFailure) {
+            // The restart refusal (budget exhausted, shutdown) is the
+            // actionable cause; keep the original failure as context.
+            return rpcError(message.id, -32001, `Destination ${mapped.entry.destination.name} failed: ${error.message}; self-healing restart did not run: ${restartFailure.message}`);
+          }
           return error.rpcError ? rpcError(message.id, error.rpcError.code || -32001, error.rpcError.message || error.message, error.rpcError.data) : rpcError(message.id, -32001, `Destination ${mapped.entry.destination.name} failed: ${error.message}`);
         }
       }