sap-ai-dev-toolkit 0.5.6 → 0.6.0

package/src/setup.mjs

@@ -1,12 +1,9 @@
 import { createInterface } from 'node:readline/promises';
 import { stdin, stdout } from 'node:process';
-import { checkboxPrompt, colorText, formatStatus, textPrompt } from './terminal-ui.mjs';
+import { checkboxPrompt, colorText, formatStatus } from './terminal-ui.mjs';
 import { discoverDestinations, remediation } from './bas-discovery.mjs';
 import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys, findOrphanedCloudFoundryServiceKeys } from './cf-destination.mjs';
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
-import { readCredentials, removeDestinationCredentials, resolveCredentialsPath, storeDestinationCredentials } from './credentials-store.mjs';
-import { canPromptForCredentials, credentialKeyForDestination, credentialModeForDestination } from './credential-overrides.mjs';
-import { createBasDestinationRelay } from './bas-destination-relay.mjs';
 
 const SETUP_COMMAND = 'sap-ai-dev --setup';
 
@@ -26,89 +23,6 @@ async function confirmCloudFoundryImport({ input = stdin, output = stdout } = {}
   }
 }
 
-async function probeBasOnPremCredentialRoute({ destination, user, password, env }) {
-  const relay = createBasDestinationRelay({
-    ...destination,
-    credentials: { user, password, mode: 'bas-tunnel' }
-  }, { env, log: () => {} });
-  try {
-    await relay.ready;
-    return await relay.probeCsrfSession();
-  } finally {
-    await relay.close();
-  }
-}
-
-async function promptForDestinationCredentials({ destinations, credentialsPath, existing = {}, input = stdin, output = stdout, env = process.env, verifyOnPremCredentialRoute = probeBasOnPremCredentialRoute } = {}) {
-  const eligible = destinations.filter(canPromptForCredentials);
-  const retained = new Set();
-  if (!eligible.length) return retained;
-
-  print(output, '');
-  print(output, formatStatus('Credential overrides are optional and apply only to selected BasicAuthentication destinations.', 'step', output, 'Credentials'));
-  print(output, `  Overrides are stored beside your MCP config in ${credentialsPath} with owner-only permissions (never inside mcp.json).`);
-  print(output, '  For OnPremise destinations, BAS/Cloud Foundry proxy credentials remain separate from the SAP backend credentials.');
-  print(output, '');
-
-  for (const destination of eligible) {
-    const key = credentialKeyForDestination(destination);
-    if (!key) continue;
-    const mode = credentialModeForDestination(destination);
-    const known = existing[key];
-    const routeLabel = `${destination.source === 'cloud-foundry' ? 'Cloud Foundry' : 'BAS'} ${destination.proxyType} — ${destination.name}`;
-    const answer = await textPrompt({
-      message: colorText(`🔐 ${routeLabel} — override SAP credentials? (y/n)`, 'cyan', output),
-      required: true,
-      validate: value => /^(?:y|yes|n|no)$/i.test(value.trim()) || 'Enter y or n.'
-    }, { input, output });
-    if (/^n/i.test(answer.trim())) {
-      await removeDestinationCredentials(credentialsPath, [key]);
-      print(output, formatStatus(`Credential override disabled for ${destination.name}.`, 'info', output, 'Credentials'));
-      continue;
-    }
-
-    if (known?.user && known?.password) {
-      print(output, formatStatus(`Credentials for ${destination.name} are already stored. Press Enter at both prompts to keep them.`, 'info', output, 'Credentials'));
-    }
-    const userAnswer = await textPrompt({
-      message: colorText(`👤 ${routeLabel} — SAP user`, 'cyan', output),
-      required: false,
-      placeholder: known ? 'Enter keeps the stored user' : 'SAP user name'
-    }, { input, output });
-    const user = userAnswer.trim() || known?.user || '';
-    const passwordAnswer = await textPrompt({
-      message: colorText(`🔒 ${routeLabel} — SAP password${known ? ' (Enter keeps stored password)' : ''}`, 'cyan', output),
-      secret: true,
-      required: false
-    }, { input, output });
-    const password = passwordAnswer || known?.password || '';
-    if (!user || !password) {
-      await removeDestinationCredentials(credentialsPath, [key]);
-      print(output, formatStatus(`No complete credentials for ${destination.name}; no override was stored.`, 'warning', output, 'Credentials'));
-      continue;
-    }
-
-    if (mode === 'bas-tunnel') {
-      let route;
-      try {
-        route = await verifyOnPremCredentialRoute({ destination, user, password, env });
-      } catch {
-        route = null;
-      }
-      if (!(route?.httpStatus >= 200 && route.httpStatus < 300) || !route.tokenReceived || !(route.cookieCount > 0)) {
-        await removeDestinationCredentials(credentialsPath, [key]);
-        print(output, formatStatus(`No override stored for ${destination.name}: the BAS/Cloud Connector route did not return both a CSRF token and session cookie.`, 'warning', output, 'Credentials'));
-        continue;
-      }
-    }
-
-    const host = mode === 'direct' ? (destination.backendUrl || known?.host || '') : '';
-    await storeDestinationCredentials(credentialsPath, key, { host, user, password, mode });
-    retained.add(key);
-    print(output, formatStatus(`Stored credential override for ${destination.name}.`, 'success', output, 'Credentials'));
-  }
-  return retained;
-}
 
 function safeProbe(probe) {
   const result = {};
@@ -187,7 +101,6 @@ export async function runSetup({
   discoverCf = discoverCloudFoundryDestinations,
   confirmCfImport = confirmCloudFoundryImport,
   install = installMcpConfig,
-  verifyOnPremCredentialRoute = probeBasOnPremCredentialRoute,
   includeSapDevelopmentToolsPrompt = false
 } = {}) {
   if (!env.H2O_URL) {
@@ -209,7 +122,6 @@ export async function runSetup({
   }
   const destinations = basDestinations.map(safeBasDestination);
   const warnings = [];
-  const credentialWarnings = [];
   let createdKeys = [];
   let configPath;
   let managedKeys = [];
@@ -352,25 +264,6 @@ export async function runSetup({
     }, { input, output });
   }
 
-  // Ask for an explicit credential override choice for each selected supported destination.
-  const credentialsPath = await resolveCredentialsPath(env, configPath);
-  try {
-    const existingMap = (await readCredentials(credentialsPath).catch(() => ({ destinations: {} }))).destinations || {};
-    const retained = await promptForDestinationCredentials({
-      destinations: selected,
-      credentialsPath,
-      existing: existingMap,
-      input,
-      output,
-      env,
-      verifyOnPremCredentialRoute
-    });
-    const stale = Object.keys(existingMap).filter(name => !retained.has(name));
-    if (stale.length) await removeDestinationCredentials(credentialsPath, stale);
-  } catch (error) {
-    if (/Prompt interrupted/.test(error.message)) throw error;
-    credentialWarnings.push(`Credential overrides could not be stored: ${error.message}`);
-  }
   try {
     const result = await install(selected, { env, sapDevelopmentServers });
     const location = result?.path ? ` in ${result.path}` : '';
@@ -391,9 +284,8 @@ export async function runSetup({
       }
     }
     await reportWarnings(warnings);
-    await reportWarnings(credentialWarnings);
     await reportWarnings(cleanupWarnings);
-    return { selected, ...(result || {}), warnings: [...warnings, ...credentialWarnings, ...cleanupWarnings] };
+    return { selected, ...(result || {}), warnings: [...warnings, ...cleanupWarnings] };
   } catch (error) {
     const cleanupWarnings = [];
     if (createdKeys.length) {

package/src/terminal-ui.mjs

@@ -139,7 +139,9 @@ export async function checkboxPrompt({ message, choices, required = false, short
     for (let index = top; index < end; index += 1) {
       const choice = choices[index];
       const pointer = index === cursor ? '❯' : ' ';
-      const marker = selected.has(index) ? '◉' : '◯';
+      const marker = selected.has(index)
+        ? colorText('✓', 'green', output)
+        : colorText('✗', 'red', output);
       const disabled = choice.disabled ? ` — ${choice.disabled}` : '';
       const label = `${pointer}${marker} ${choice.name}${disabled}`;
       lines.push(truncateToColumns(label, columns));

package/tools.md

@@ -2,7 +2,7 @@
 
 The proxy no longer advertises every VSP tool. To keep the developer-lifecycle MCP surface manageable, each generated one-destination server exposes a cherry-picked set of VSP tools plus local workflow tools (currently 59 tools when all curated VSP capabilities are registered).
 
-The names below are the logical tool names. Publicly, every tool is exposed as `<destination-slug>_<tool>` in lowercase (for example `GetTableContents` on destination `DEMO_ABAP` is `demo-abap_get_table_contents`): BAS/VS Code chat tool references bind only lowercase identifiers, so mixed-case names never reach the model.
+The names below are the logical tool names. Publicly they are exposed in lowercase snake_case without a prefix (`get_table_contents`, `run_query`) because each generated MCP server is scoped to one destination; only when a single server fronts multiple destinations does each name gain its destination slug (`demo-abap_get_table_contents`) to stay unambiguous. BAS/VS Code chat tool references bind only lowercase identifiers, so mixed-case names never reach the model.
 
 Hidden upstream VSP tools are not directly callable through the proxy. Local workflow tools may still call hidden or non-advertised upstream operations internally when they are required for a bounded workflow.
 
@@ -75,7 +75,15 @@ The proxy adds local multi-step tools to each destination when their required VS
 - `PlanABAPCloudMigration` — batch SAP API release-state checks and prioritize recognized unreleased results.
 - `GenerateRAPRegressionSuite` and `RunRAPRegressionSuite` — create and run reusable OData GET-only checks under the selected service root.
 
-`sap-ai-dev-toolkit --doctor` checks destination probing, VSP startup, the `get_system_info` probe, and MCP tool listing. `sap-ai-dev-toolkit --demo` runs the sample tools and OData fixtures without contacting SAP; demo writes and transport creation remain in memory until that process exits.
+`sap-ai-dev --doctor` checks destination probing, VSP startup, the `get_system_info` probe, and MCP tool listing. `sap-ai-dev --demo` runs the sample tools and OData fixtures without contacting SAP; demo writes and transport creation remain in memory until that process exits.
+
+### Read-only mode
+
+Set `SAP_AI_DEV_TOOLKIT_READ_ONLY=true` (or legacy `BAS_VSP_READ_ONLY`) on a destination server to run it strictly read-only: `WriteSource`, `EditSource`, `Activate`, `ActivateMultiple`, `CreateTransport`, `SetBreakpoint`, and the change-set workflow tools are removed from the surface, and the VSP child starts with `--transport-read-only` so transport writes are rejected upstream as well. Inspection, queries, linting, and checks remain available.
+
+### Request timeouts
+
+Calls forwarded to a VSP child time out after `SAP_AI_DEV_TOOLKIT_REQUEST_TIMEOUT_MS` (default 600000 ms; `0` disables). A stalled request fails with a timeout error; the child keeps running so unrelated in-flight requests are unaffected.
 
 ## Separate optional HANA Cloud inspector
 

package/src/credential-overrides.mjs

@@ -1,75 +0,0 @@
-import { readCredentials, resolveCredentialsPath } from './credentials-store.mjs';
-
-const CLOUD_FOUNDRY_KEY_PREFIX = 'cloud-foundry:';
-
-function isBasicAuthentication(value) {
-  return /^basic(?:authentication)?$/i.test(String(value || '').replace(/\s+/g, ''));
-}
-
-export function credentialKeyForDestination(destination = {}) {
-  if (destination.source === 'cloud-foundry') {
-    const serverName = String(destination.serverName || '').trim();
-    return serverName ? `${CLOUD_FOUNDRY_KEY_PREFIX}${serverName}` : '';
-  }
-  return String(destination.name || '').trim();
-}
-
-export function credentialModeForDestination(destination = {}) {
-  if (!isBasicAuthentication(destination.authentication)) return null;
-  const proxyType = String(destination.proxyType || '').trim().toLowerCase();
-  if (destination.source === 'cloud-foundry') {
-    return proxyType === 'onpremise' ? 'cf-connectivity' : null;
-  }
-  if (proxyType === 'internet') return 'direct';
-  if (proxyType === 'onpremise') return 'bas-tunnel';
-  return null;
-}
-
-export function canPromptForCredentials(destination = {}) {
-  const mode = credentialModeForDestination(destination);
-  return Boolean(mode && (mode !== 'direct' || destination.backendUrl));
-}
-
-export async function enrichWithStoredCredentials(destinations, env = process.env, log = message => console.error(message)) {
-  const needingCredentials = destinations.filter(destination => {
-    const mode = credentialModeForDestination(destination);
-    if (!mode || !canPromptForCredentials(destination)) return false;
-    if (mode === 'cf-connectivity') return Boolean(destination.serverName);
-    return Boolean(destination.url && String(destination.url).includes('.dest'));
-  });
-  if (!needingCredentials.length) return destinations;
-  let stored;
-  try {
-    const path = await resolveCredentialsPath(env);
-    stored = await readCredentials(path);
-  } catch (error) {
-    log(`[sap-ai-dev] stored credentials could not be read: ${String(error.message).slice(0, 200)}`);
-    return destinations;
-  }
-  return destinations.map(destination => {
-    const mode = credentialModeForDestination(destination);
-    const key = credentialKeyForDestination(destination);
-    const entry = key ? stored.destinations?.[key] : undefined;
-    if (!mode || !entry?.user || !entry?.password) return destination;
-    if (mode === 'cf-connectivity') {
-      if (entry.mode !== mode || destination.source !== 'cloud-foundry') return destination;
-      return {
-        ...destination,
-        childEnv: {
-          ...(destination.childEnv || {}),
-          SAP_USER: entry.user,
-          SAP_PASSWORD: entry.password,
-          SAP_VERBOSE: 'false'
-        }
-      };
-    }
-    if (mode === 'bas-tunnel') {
-      if (entry.mode !== mode) return destination;
-      return { ...destination, credentials: { user: entry.user, password: entry.password, mode } };
-    }
-    if (!destination.backendUrl || !destination.url || !String(destination.url).includes('.dest')) return destination;
-    if (entry.mode && entry.mode !== 'direct') return destination;
-    const host = entry.host || destination.backendUrl;
-    return { ...destination, credentials: { host, user: entry.user, password: entry.password, mode: 'direct' } };
-  });
-}

package/src/credentials-store.mjs

@@ -1,113 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { chmod, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
-import { homedir } from 'node:os';
-import { basename, dirname, join } from 'node:path';
-import { brandedEnvValue } from './branding.mjs';
-
-// Optional SAP backend credential overrides live next to the MCP config
-// (never inside it), with 0600 permissions and no tokens or cookies. Entries
-// are keyed by a stable destination identity and may include a route mode.
-const CREDENTIALS_FILENAME = 'sap-ai-dev-toolkit-credentials.json';
-const CREDENTIAL_MODES = new Set(['direct', 'bas-tunnel', 'cf-connectivity']);
-
-async function exists(path) {
-  try {
-    await stat(path);
-    return true;
-  } catch (error) {
-    if (error?.code === 'ENOENT') return false;
-    throw error;
-  }
-}
-
-export async function resolveCredentialsPath(env = process.env, mcpConfigPath) {
-  const configured = brandedEnvValue(env, 'CREDENTIALS_FILE');
-  if (configured) return configured;
-  if (mcpConfigPath) return join(dirname(mcpConfigPath), CREDENTIALS_FILENAME);
-  const home = env.HOME || homedir();
-  const candidates = [
-    join(home, '.vscode', 'data', 'User'),
-    join(home, '.vscode-server', 'data', 'User'),
-    join(home, '.code-server', 'data', 'User')
-  ];
-  for (const candidate of candidates) if (await exists(candidate)) return join(candidate, CREDENTIALS_FILENAME);
-  return join(candidates[0], CREDENTIALS_FILENAME);
-}
-
-function sanitizeEntry(entry) {
-  const result = {};
-  if (typeof entry?.host === 'string' && entry.host) result.host = entry.host;
-  if (typeof entry?.user === 'string' && entry.user) result.user = entry.user;
-  if (typeof entry?.password === 'string' && entry.password) result.password = entry.password;
-  if (CREDENTIAL_MODES.has(entry?.mode)) result.mode = entry.mode;
-  if (typeof entry?.updatedAt === 'string') result.updatedAt = entry.updatedAt;
-  return result;
-}
-
-export async function readCredentials(path) {
-  let raw;
-  try {
-    raw = await readFile(path, 'utf8');
-  } catch (error) {
-    if (error?.code === 'ENOENT') return {};
-    throw new Error(`Credentials file ${path} could not be read: ${error.message}`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (error) {
-    throw new Error(`Credentials file ${path} contains invalid JSON: ${error.message}`);
-  }
-  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-    throw new Error(`Credentials file ${path} must contain a top-level JSON object`);
-  }
-  const destinations = {};
-  for (const [name, entry] of Object.entries(parsed.destinations || {})) {
-    const clean = sanitizeEntry(entry);
-    if (clean.user && clean.password) destinations[name] = clean;
-  }
-  return { destinations };
-}
-
-async function writeCredentials(path, destinations) {
-  const directory = dirname(path);
-  await mkdir(directory, { recursive: true });
-  const temporary = join(directory, `.${basename(path)}.${process.pid}.${randomUUID()}.tmp`);
-  try {
-    await writeFile(temporary, `${JSON.stringify({ version: 1, destinations }, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-    await rename(temporary, path);
-    await chmod(path, 0o600).catch(() => {});
-  } catch (error) {
-    await rm(temporary, { force: true }).catch(() => {});
-    throw new Error(`Credentials file ${path} could not be written: ${error.message}`);
-  }
-}
-
-export async function storeDestinationCredentials(path, name, { host, user, password, mode }) {
-  if (mode != null && !CREDENTIAL_MODES.has(mode)) throw new Error('Credential override route mode is unsupported');
-  const current = await readCredentials(path).catch(error => { throw error; });
-  const destinations = { ...current.destinations };
-  destinations[String(name)] = {
-    host: String(host || ''),
-    user: String(user || ''),
-    password: String(password || ''),
-    ...(mode ? { mode } : {}),
-    updatedAt: new Date().toISOString()
-  };
-  await writeCredentials(path, destinations);
-  return { path, name };
-}
-
-export async function removeDestinationCredentials(path, names) {
-  const current = await readCredentials(path);
-  const destinations = { ...current.destinations };
-  const removed = [];
-  for (const name of names) {
-    if (Object.hasOwn(destinations, String(name))) {
-      delete destinations[String(name)];
-      removed.push(String(name));
-    }
-  }
-  if (removed.length) await writeCredentials(path, destinations);
-  return { path, removed };
-}