sap-ai-dev-toolkit 0.5.7 → 0.6.0

package/README.md

@@ -400,7 +400,7 @@ The sample values sketch an on-premise ABAP backend routed through SAP Cloud Con
 | `WebIDEUsage` | `dev_abap,odata_abap` | Include `dev_abap` for ABAP development; add other usages required by your BAS scenario. |
 | `CloudConnectorLocationId` | `DEMO-LOCATION` | Optional; set only when the Cloud Connector uses a location ID. |
 
-For on-premise systems, configure Cloud Connector access to the backend host and port first. BAS Destination and Connectivity service credentials remain in their respective services; optional SAP backend overrides are stored in the owner-only credentials file beside `mcp.json`, never in `mcp.json`. The BAS OnPremise override is saved only when its tunnel route returns a CSRF token and session cookie.
+For on-premise systems, configure Cloud Connector access to the backend host and port first. The add-on uses the authentication already configured in BAS or the Cloud Foundry Destination service; manage SAP credentials there.
 
 Think of `H2O_URL` as BAS's front door: it must point to the endpoint serving `/api/listDestinations`, not to the SAP backend.
 
@@ -734,14 +734,13 @@ The response contains a `tools` array. A `RunQuery` entry resembles this excerpt
 | `SAP_AI_DEV_TOOLKIT_MODE` | VSP child mode (`expert` by default; `focused` omits `ActivateMultiple`, `GetUserTransports`, and `GetTransportInfo`). The proxy exposes its curated tool subset and local workflow tools, including `LintABAP`. |
 | `SAP_ALLOW_TRANSPORTABLE_EDITS` | Generated MCP entries set this to `true` to permit source edits in transportable packages; VSP safety checks and SAP authorizations still apply. |
 | `SAP_AI_DEV_TOOLKIT_DISABLE_BAS_RELAY=true` | Disable the built-in BAS destination relay. By default the add-on self-heals `.dest` destinations through a local relay that keeps all access destination-based while handling ADT CSRF fetch/retry behavior before VSP calls SAP. |
-| `SAP_AI_DEV_TOOLKIT_HTTP_PROXY` | Egress proxy for relay and discovery traffic. Takes precedence over `HTTP_PROXY`/`http_proxy`; unset means the default BAS proxy for `.dest` hosts, empty means direct except for OnPremise credential overrides, which require a BAS proxy tunnel. |
+| `SAP_AI_DEV_TOOLKIT_HTTP_PROXY` | Egress proxy for relay and discovery traffic. Takes precedence over `HTTP_PROXY`/`http_proxy`; unset means the default BAS proxy for `.dest` hosts, empty means direct. |
 | `SAP_AI_DEV_TOOLKIT_MAX_CSRF_RETRIES` | Bounded retries after explicit CSRF-session rejection per unsafe request (default 3, maximum 10). Invalid values use the default. |
 | `SAP_AI_DEV_TOOLKIT_READ_ONLY=true` | Read-only mode: hides `WriteSource`, `EditSource`, `Activate`, `ActivateMultiple`, `CreateTransport`, `SetBreakpoint`, and the change-set workflow tools, and starts VSP with `--transport-read-only`. |
 | `SAP_AI_DEV_TOOLKIT_REQUEST_TIMEOUT_MS` | Per-request timeout for calls forwarded to a VSP child (default 600000 = 10 minutes; `0` disables). A stalled request fails with a timeout error; the child is left running. |
 | `SAP_AI_DEV_MCP_CONFIG` | Explicit MCP configuration path; highest precedence. |
 | `SAP_AI_DEV_TOOLKIT_MCP_CONFIG` | Branded compatibility alias for the MCP configuration path. |
 | `BAS_VSP_MCP_CONFIG` | Backward-compatible alias for the MCP configuration path. |
-| `SAP_AI_DEV_TOOLKIT_CREDENTIALS_FILE` | Explicit path for the optional SAP backend credential-override file (default: beside `mcp.json`). |
 | `SAP_AI_DEV_TOOLKIT_BINARY` | Trusted prebuilt VSP executable; skips binary provisioning. Legacy `BAS_VSP_BINARY` still works. |
 | `SAP_AI_DEV_TOOLKIT_BINARY_URL` | Alternate VSP binary download URL (checksum-verified). Legacy `BAS_VSP_BINARY_URL` still works. |
 | `SAP_AI_DEV_TOOLKIT_RELEASE_BASE_URL` | Override the base URL that VSP release binaries are downloaded from. |
@@ -760,8 +759,7 @@ The relay between the VSP child and each BAS destination recovers from the failu
 2. **Session refresh** — when SAP explicitly rejects a CSRF token, the cached session is dropped, a fresh token+cookie pair is fetched, and the request is retried within the configured bound. Generic authorization 401/403 responses are returned without being mislabeled or retried as CSRF failures.
 3. **Proxy tunnel fallback** — when the BAS proxy refuses absolute-form requests (502/504 or transport errors), the relay switches to a CONNECT tunnel through the same proxy and keeps going.
 4. **Child crash recovery** — a crashed VSP child is restarted transparently, re-initialized, tools re-registered, and the interrupted `tools/call` retried once before any error reaches the client.
-5. **Direct connect for Internet destinations** — the BAS `.dest` proxy strips SAP `Set-Cookie` headers, which makes CSRF token/session binding impossible for ADT writes (`403 CSRF token validation failed`). When you select an Internet destination with BasicAuthentication, setup asks whether to override its credentials. A Yes prompts for SAP user/password and stores them in `sap-ai-dev-toolkit-credentials.json` **next to** `mcp.json` (never inside it, permissions `0600`). The relay connects straight to the backend host so cookies survive and ADT writes can use the paired CSRF session.
-6. **Cloud Connector credential overrides** — setup also offers per-destination overrides for BasicAuthentication OnPremise destinations. BAS OnPremise credentials travel through an HTTP CONNECT tunnel to the BAS `.dest` endpoint, retaining its Cloud Connector mapping; setup saves the override only after a read-only probe returns both a CSRF token and a session cookie. If that route check fails, the override is not saved. Cloud Foundry OnPremise overrides replace only the SAP backend user/password; Connectivity service-key authentication and its proxy route remain unchanged. PrincipalPropagation is never overridden. Rerun `sap-ai-dev --setup` to change credentials or answer No to disable a stored override. Deselecting a destination (or selecting none) removes stale overrides.
+5. **Configured destination authentication** — the add-on always uses the URL, authentication mode, and credentials already configured for the selected destination. Setup does not prompt for or store SAP usernames/passwords, and the relay does not connect directly to a backend host as a credential fallback. Correct the credentials in BAS or the Cloud Foundry Destination service if SAP rejects them.
 Existing installs that still set the previous `BAS_VSP_*` environment variables remain supported. The setup wizard writes new MCP entries with the `SAP_AI_DEV_TOOLKIT_*` names.
 
 #### Server logging

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.5.7",
+  "version": "0.6.0",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/src/bas-destination-relay.mjs

@@ -133,14 +133,7 @@ async function readRequestBody(req) {
 export function createBasDestinationRelay(destination, { env = process.env, fetchImpl = undiciFetch, log = () => {} } = {}) {
   if (!destination?.url) throw new Error('Destination relay requires a BAS destination URL');
   const base = new URL(destination.url);
-  const credentials = destination.credentials;
-  const tunnelMode = credentials?.mode === 'bas-tunnel';
-  const directHost = tunnelMode ? '' : credentials?.host;
-  // Internet overrides retain the direct-backend path. OnPremise overrides
-  // must keep the BAS .dest route (and its Cloud Connector mapping), so they
-  // use HTTP CONNECT through the BAS proxy instead of credentials.host.
-  const directBase = directHost ? new URL(String(directHost)) : null;
-  const cookieBase = directBase || (destination.backendUrl
+  const cookieBase = destination.backendUrl
     ? new URL(String(destination.backendUrl))
     : (() => {
         const target = new URL(base);
@@ -149,9 +142,8 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
         // omits the backend URL so Secure session cookies are not discarded.
         if (target.protocol === 'http:' && /\.dest$/i.test(target.hostname)) target.protocol = 'https:';
         return target;
-      })());
-  if (directBase) log(`[${destination.name}] BAS relay direct connect active (${directBase.origin}); BAS proxy cookie stripping bypassed`);
-  if (tunnelMode) log(`[${destination.name}] BAS relay using a BAS proxy tunnel for the OnPremise destination`);
+      })();
+  // BAS destinations must keep their configured .dest route and authentication.
   // Proxy resolution: an explicitly configured proxy wins (an explicit empty
   // value means "go direct"). Without configuration, BAS virtual .dest hosts
   // imply the default BAS proxy; any other host (tests, direct URLs) is
@@ -159,16 +151,15 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
   // foreign proxy.
   const brandedProxy = brandedEnvValue(env, 'HTTP_PROXY');
   const explicitProxy = brandedProxy !== undefined ? brandedProxy : (env.HTTP_PROXY ?? env.http_proxy);
-  const proxyUrl = directBase ? '' : (explicitProxy !== undefined ? String(explicitProxy) : (/\.dest$/i.test(base.hostname) ? DEFAULT_PROXY : ''));
-  if (tunnelMode && !proxyUrl) throw new Error('OnPremise credential overrides require the BAS destination proxy to preserve the Cloud Connector route');
+  const proxyUrl = explicitProxy !== undefined ? String(explicitProxy) : (/\.dest$/i.test(base.hostname) ? DEFAULT_PROXY : '');
   const dispatcher = proxyUrl ? new ProxyAgent({ uri: proxyUrl, proxyTunnel: false }) : undefined;
   // Self-healing mode 2: if the BAS proxy refuses absolute-form proxied
   // requests (its own 502/504), retry through a CONNECT tunnel so the relay
   // keeps working through the same egress.
   const tunnelDispatcher = proxyUrl ? new ProxyAgent({ uri: proxyUrl, proxyTunnel: true }) : undefined;
-  let tunneled = tunnelMode;
+  let tunneled = false;
   // Observable self-healing counters, surfaced by --doctor and tests.
-  const stats = { requests: 0, csrfFetches: 0, csrfRetries: 0, csrfSessionFailures: 0, tunnelFallbacks: 0, direct: Boolean(directBase), proxyTunnel: tunnelMode };
+  const stats = { requests: 0, csrfFetches: 0, csrfRetries: 0, csrfSessionFailures: 0, tunnelFallbacks: 0, direct: false, proxyTunnel: false };
   const maxFailures = maxTokenFailures(env, log, destination.name);
   // The shared jar captures SAP cookies from safe reads as well as CSRF fetches.
   // Each cached token gets its own snapshot so later responses cannot silently
@@ -210,16 +201,16 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
   async function fetchTokenFresh(requestHeaders) {
     const key = CSRF_FETCH_PATH;
     stats.csrfFetches += 1;
-    const target = resolveTarget(new URL(CSRF_FETCH_PATH, base));
+    const target = new URL(CSRF_FETCH_PATH, base);
     const cookieTarget = resolveCookieTarget(target);
     const jar = copyCookieJar(sharedCookieJar);
     await seedRequestCookies(jar, requestHeaders.cookie, cookieTarget);
     const outgoingCookie = await cookieHeader(jar, cookieTarget);
-    const response = await sendWithFallback(target, 'GET', authHeaders(fetchHeaders(requestHeaders, {
+    const response = await sendWithFallback(target, 'GET', fetchHeaders(requestHeaders, {
       'x-csrf-token': 'Fetch',
       accept: requestHeaders.accept || 'application/xml,*/*',
       ...(outgoingCookie ? { cookie: outgoingCookie } : {})
-    })));
+    }));
     await response.arrayBuffer().catch(() => undefined);
     const token = response.headers.get('x-csrf-token');
     await recordCookies(jar, response.headers, cookieTarget, log, destination.name);
@@ -265,36 +256,17 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
     };
   }
 
-  // Rewrite an incoming .dest target onto the direct backend host when
-  // credentials are configured, keeping path and query intact.
-  function resolveTarget(target) {
-    if (!directBase) return target;
-    return new URL(`${target.pathname}${target.search}`, directBase);
-  }
-
-  function authHeaders(extra = {}) {
-    if (!credentials?.user || !credentials?.password) return extra;
-    const basic = Buffer.from(`${credentials.user}:${credentials.password}`).toString('base64');
-    // The stored credential override wins over any inbound authorization
-    // header: the override exists precisely to pair Basic auth with the
-    // relay's CSRF session, and silently forwarding a caller-supplied header
-    // would disable that pairing without any diagnostic.
-    const headers = { ...extra };
-    delete headers.authorization;
-    delete headers.Authorization;
-    return { ...headers, authorization: `Basic ${basic}` };
-  }
 
   async function forward(method, requestUrl, requestHeaders, body, session) {
-    const target = resolveTarget(requestUrl);
+    const target = requestUrl;
     const cookieTarget = resolveCookieTarget(target);
     const cookieJar = session?.jar || sharedCookieJar;
     if (!session) await seedRequestCookies(cookieJar, requestHeaders.cookie, cookieTarget);
     const sessionCookie = await cookieHeader(cookieJar, cookieTarget);
-    const headers = authHeaders(headersFrom(requestHeaders, {
+    const headers = headersFrom(requestHeaders, {
       ...(session?.token ? { 'x-csrf-token': session.token } : {}),
       ...(sessionCookie ? { cookie: sessionCookie } : {})
-    }));
+    });
     const response = await sendWithFallback(target, method, headers, body);
     const responseBody = Buffer.from(await response.arrayBuffer());
     if (session) await recordCookies(session.jar, response.headers, cookieTarget, log, destination.name);
@@ -332,7 +304,7 @@ export function createBasDestinationRelay(destination, { env = process.env, fetc
       return forwardWithRetry(method, requestUrl, requestHeaders, body, failures + 1);
     }
     if (unsafe && rejected && tokenOnly) {
-      log(`[${destination.name}] BAS relay CSRF token rejected without a session cookie for ${requestUrl.pathname}; not retried (route delivers no cookies; a credential override enables a paired session)`);
+      log(`[${destination.name}] BAS relay CSRF token rejected without a session cookie for ${requestUrl.pathname}; not retried (the configured destination route delivered no cookies)`);
     } else if (unsafe && rejected && failures >= maxFailures) {
       log(`[${destination.name}] BAS relay stopped after ${maxFailures} CSRF session retries for ${requestUrl.pathname}`);
     }

package/src/launcher.mjs

@@ -10,7 +10,6 @@ import { installMcpConfig, repairManagedMcpConfig } from './mcp-config.mjs';
 import { runSetup } from './setup.mjs';
 import { resolveConfiguredCloudFoundryDestination } from './cf-destination.mjs';
 import { withBrandedEnvironment } from './branding.mjs';
-import { enrichWithStoredCredentials } from './credential-overrides.mjs';
 import { redactText } from './redact.mjs';
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
@@ -100,11 +99,6 @@ async function runDoctor(destinations) {
       } else {
         checks.push(doctorRow(destination.name, 'BAS destination relay', 'skipped', 'Not applicable for this destination.'));
       }
-      if (relayedDestination?.credentials?.mode === 'bas-tunnel') {
-        checks.push(doctorRow(destination.name, 'OnPremise credential override', 'passed', 'Basic auth is routed through a BAS proxy tunnel; Cloud Connector routing is retained'));
-      } else if (relayedDestination?.credentials?.host) {
-        checks.push(doctorRow(destination.name, 'Direct connect', 'passed', `active (${new URL(relayedDestination.credentials.host).origin}); ADT writes use stored credentials`));
-      }
       const listed = await proxy.handle({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} });
       if (listed?.error) throw new Error(listed.error.message || 'MCP tools/list failed');
       const tools = listed.result?.tools || [];
@@ -137,7 +131,7 @@ async function runDoctor(destinations) {
             : `HTTP ${session?.httpStatus || 0}; token=${session?.tokenReceived ? 'received' : 'missing'}; cookies=${session?.cookieCount || 0}; usableSession=${sessionReady}; csrfFetches=${stats.csrfFetches || 0}; csrfRetries=${stats.csrfRetries || 0}; sessionFailures=${stats.csrfSessionFailures || 0}; tunnelFallbacks=${stats.tunnelFallbacks || 0}`;
           checks.push(doctorRow(destination.name, 'BAS relay CSRF preflight', status, detail));
           if (!sessionReady) {
-            const remediation = 'GetSystemInfo was not called because the relay could not establish a paired CSRF token/session. For OnPremise BasicAuth, run sap-ai-dev --setup and use a validated BAS proxy tunnel credential override.';
+            const remediation = 'GetSystemInfo was not called because the relay could not establish a paired CSRF token/session. Confirm the configured destination authentication and BAS proxy route.';
             checks.push(doctorRow(destination.name, 'SAP system check', 'skipped', preflightError ? `${remediation} Relay error: ${preflightError}` : remediation));
           }
         }
@@ -222,8 +216,8 @@ async function main() {
     let report;
     try {
       const destinations = runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry'
-        ? await enrichWithStoredCredentials([await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })], runtimeEnv)
-        : await enrichWithStoredCredentials(await discoverForCommand(), runtimeEnv);
+        ? [await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })]
+        : await discoverForCommand();
       report = await runDoctor(destinations);
     } catch (error) {
       report = { ok: false, destinations: 0, checks: [doctorRow('-', 'destination discovery', 'failed', redactText(error.message || error).slice(0, 300))] };
@@ -259,7 +253,7 @@ async function main() {
   }
 
   if (runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry') {
-    const destination = (await enrichWithStoredCredentials([await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })], runtimeEnv))[0];
+    const destination = await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv });
     let proxy;
     try {
       const binary = await binaryOrError();
@@ -289,7 +283,7 @@ async function main() {
 
   const discovered = await discoverDestinations({ env: runtimeEnv });
   for (const destination of discovered) logLine(probeDiagnostic(destination));
-  const destinations = await enrichWithStoredCredentials(discovered, runtimeEnv);
+  const destinations = discovered;
   if (!destinations.length) {
     logLine('[sap-ai-dev] destination discovery returned no named BAS destinations');
     throw new Error(remediation);
@@ -297,10 +291,6 @@ async function main() {
   const binary = await binaryOrError();
   logLine(`[sap-ai-dev] sap-ai-dev-toolkit v${pkg.version} (node ${process.version}, pid ${process.pid})`);
   logLine(`[sap-ai-dev] VSP binary: ${binary}`);
-  for (const destination of destinations) {
-    if (destination.credentials?.mode === 'bas-tunnel') logLine(`[sap-ai-dev] ${destination.name}: Basic credentials enabled through the BAS proxy tunnel`);
-    else if (destination.credentials?.host) logLine(`[sap-ai-dev] ${destination.name}: direct connect enabled through stored credentials`);
-  }
   logLine(`[sap-ai-dev] starting MCP proxy for ${destinations.map(destination => `${destination.name} (client=${destination.client})`).join(', ')}`);
   const proxy = new MCPProxy({ binary, destinations, env: process.env, log: logLine, version: pkg.version });
   const shutdown = signal => { void proxy.close().finally(() => process.exit(signal === 'SIGINT' ? 130 : 143)); };

package/src/setup.mjs

@@ -1,12 +1,9 @@
 import { createInterface } from 'node:readline/promises';
 import { stdin, stdout } from 'node:process';
-import { checkboxPrompt, colorText, formatStatus, textPrompt } from './terminal-ui.mjs';
+import { checkboxPrompt, colorText, formatStatus } from './terminal-ui.mjs';
 import { discoverDestinations, remediation } from './bas-discovery.mjs';
 import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys, findOrphanedCloudFoundryServiceKeys } from './cf-destination.mjs';
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
-import { readCredentials, removeDestinationCredentials, resolveCredentialsPath, storeDestinationCredentials } from './credentials-store.mjs';
-import { canPromptForCredentials, credentialKeyForDestination, credentialModeForDestination } from './credential-overrides.mjs';
-import { createBasDestinationRelay } from './bas-destination-relay.mjs';
 
 const SETUP_COMMAND = 'sap-ai-dev --setup';
 
@@ -26,89 +23,6 @@ async function confirmCloudFoundryImport({ input = stdin, output = stdout } = {}
   }
 }
 
-async function probeBasOnPremCredentialRoute({ destination, user, password, env }) {
-  const relay = createBasDestinationRelay({
-    ...destination,
-    credentials: { user, password, mode: 'bas-tunnel' }
-  }, { env, log: () => {} });
-  try {
-    await relay.ready;
-    return await relay.probeCsrfSession();
-  } finally {
-    await relay.close();
-  }
-}
-
-async function promptForDestinationCredentials({ destinations, credentialsPath, existing = {}, input = stdin, output = stdout, env = process.env, verifyOnPremCredentialRoute = probeBasOnPremCredentialRoute } = {}) {
-  const eligible = destinations.filter(canPromptForCredentials);
-  const retained = new Set();
-  if (!eligible.length) return retained;
-
-  print(output, '');
-  print(output, formatStatus('Credential overrides are optional and apply only to selected BasicAuthentication destinations.', 'step', output, 'Credentials'));
-  print(output, `  Overrides are stored beside your MCP config in ${credentialsPath} with owner-only permissions (never inside mcp.json).`);
-  print(output, '  For OnPremise destinations, BAS/Cloud Foundry proxy credentials remain separate from the SAP backend credentials.');
-  print(output, '');
-
-  for (const destination of eligible) {
-    const key = credentialKeyForDestination(destination);
-    if (!key) continue;
-    const mode = credentialModeForDestination(destination);
-    const known = existing[key];
-    const routeLabel = `${destination.source === 'cloud-foundry' ? 'Cloud Foundry' : 'BAS'} ${destination.proxyType} — ${destination.name}`;
-    const answer = await textPrompt({
-      message: colorText(`🔐 ${routeLabel} — override SAP credentials? (y/n)`, 'cyan', output),
-      required: true,
-      validate: value => /^(?:y|yes|n|no)$/i.test(value.trim()) || 'Enter y or n.'
-    }, { input, output });
-    if (/^n/i.test(answer.trim())) {
-      await removeDestinationCredentials(credentialsPath, [key]);
-      print(output, formatStatus(`Credential override disabled for ${destination.name}.`, 'info', output, 'Credentials'));
-      continue;
-    }
-
-    if (known?.user && known?.password) {
-      print(output, formatStatus(`Credentials for ${destination.name} are already stored. Press Enter at both prompts to keep them.`, 'info', output, 'Credentials'));
-    }
-    const userAnswer = await textPrompt({
-      message: colorText(`👤 ${routeLabel} — SAP user`, 'cyan', output),
-      required: false,
-      placeholder: known ? 'Enter keeps the stored user' : 'SAP user name'
-    }, { input, output });
-    const user = userAnswer.trim() || known?.user || '';
-    const passwordAnswer = await textPrompt({
-      message: colorText(`🔒 ${routeLabel} — SAP password${known ? ' (Enter keeps stored password)' : ''}`, 'cyan', output),
-      secret: true,
-      required: false
-    }, { input, output });
-    const password = passwordAnswer || known?.password || '';
-    if (!user || !password) {
-      await removeDestinationCredentials(credentialsPath, [key]);
-      print(output, formatStatus(`No complete credentials for ${destination.name}; no override was stored.`, 'warning', output, 'Credentials'));
-      continue;
-    }
-
-    if (mode === 'bas-tunnel') {
-      let route;
-      try {
-        route = await verifyOnPremCredentialRoute({ destination, user, password, env });
-      } catch {
-        route = null;
-      }
-      if (!(route?.httpStatus >= 200 && route.httpStatus < 300) || !route.tokenReceived || !(route.cookieCount > 0)) {
-        await removeDestinationCredentials(credentialsPath, [key]);
-        print(output, formatStatus(`No override stored for ${destination.name}: the BAS/Cloud Connector route did not return both a CSRF token and session cookie.`, 'warning', output, 'Credentials'));
-        continue;
-      }
-    }
-
-    const host = mode === 'direct' ? (destination.backendUrl || known?.host || '') : '';
-    await storeDestinationCredentials(credentialsPath, key, { host, user, password, mode });
-    retained.add(key);
-    print(output, formatStatus(`Stored credential override for ${destination.name}.`, 'success', output, 'Credentials'));
-  }
-  return retained;
-}
 
 function safeProbe(probe) {
   const result = {};
@@ -187,7 +101,6 @@ export async function runSetup({
   discoverCf = discoverCloudFoundryDestinations,
   confirmCfImport = confirmCloudFoundryImport,
   install = installMcpConfig,
-  verifyOnPremCredentialRoute = probeBasOnPremCredentialRoute,
   includeSapDevelopmentToolsPrompt = false
 } = {}) {
   if (!env.H2O_URL) {
@@ -209,7 +122,6 @@ export async function runSetup({
   }
   const destinations = basDestinations.map(safeBasDestination);
   const warnings = [];
-  const credentialWarnings = [];
   let createdKeys = [];
   let configPath;
   let managedKeys = [];
@@ -352,25 +264,6 @@ export async function runSetup({
     }, { input, output });
   }
 
-  // Ask for an explicit credential override choice for each selected supported destination.
-  const credentialsPath = await resolveCredentialsPath(env, configPath);
-  try {
-    const existingMap = (await readCredentials(credentialsPath).catch(() => ({ destinations: {} }))).destinations || {};
-    const retained = await promptForDestinationCredentials({
-      destinations: selected,
-      credentialsPath,
-      existing: existingMap,
-      input,
-      output,
-      env,
-      verifyOnPremCredentialRoute
-    });
-    const stale = Object.keys(existingMap).filter(name => !retained.has(name));
-    if (stale.length) await removeDestinationCredentials(credentialsPath, stale);
-  } catch (error) {
-    if (/Prompt interrupted/.test(error.message)) throw error;
-    credentialWarnings.push(`Credential overrides could not be stored: ${error.message}`);
-  }
   try {
     const result = await install(selected, { env, sapDevelopmentServers });
     const location = result?.path ? ` in ${result.path}` : '';
@@ -391,9 +284,8 @@ export async function runSetup({
       }
     }
     await reportWarnings(warnings);
-    await reportWarnings(credentialWarnings);
     await reportWarnings(cleanupWarnings);
-    return { selected, ...(result || {}), warnings: [...warnings, ...credentialWarnings, ...cleanupWarnings] };
+    return { selected, ...(result || {}), warnings: [...warnings, ...cleanupWarnings] };
   } catch (error) {
     const cleanupWarnings = [];
     if (createdKeys.length) {

package/src/terminal-ui.mjs

@@ -139,7 +139,9 @@ export async function checkboxPrompt({ message, choices, required = false, short
     for (let index = top; index < end; index += 1) {
       const choice = choices[index];
       const pointer = index === cursor ? '❯' : ' ';
-      const marker = selected.has(index) ? '◉' : '◯';
+      const marker = selected.has(index)
+        ? colorText('✓', 'green', output)
+        : colorText('✗', 'red', output);
       const disabled = choice.disabled ? ` — ${choice.disabled}` : '';
       const label = `${pointer}${marker} ${choice.name}${disabled}`;
       lines.push(truncateToColumns(label, columns));

package/src/credential-overrides.mjs

@@ -1,75 +0,0 @@
-import { readCredentials, resolveCredentialsPath } from './credentials-store.mjs';
-
-const CLOUD_FOUNDRY_KEY_PREFIX = 'cloud-foundry:';
-
-function isBasicAuthentication(value) {
-  return /^basic(?:authentication)?$/i.test(String(value || '').replace(/\s+/g, ''));
-}
-
-export function credentialKeyForDestination(destination = {}) {
-  if (destination.source === 'cloud-foundry') {
-    const serverName = String(destination.serverName || '').trim();
-    return serverName ? `${CLOUD_FOUNDRY_KEY_PREFIX}${serverName}` : '';
-  }
-  return String(destination.name || '').trim();
-}
-
-export function credentialModeForDestination(destination = {}) {
-  if (!isBasicAuthentication(destination.authentication)) return null;
-  const proxyType = String(destination.proxyType || '').trim().toLowerCase();
-  if (destination.source === 'cloud-foundry') {
-    return proxyType === 'onpremise' ? 'cf-connectivity' : null;
-  }
-  if (proxyType === 'internet') return 'direct';
-  if (proxyType === 'onpremise') return 'bas-tunnel';
-  return null;
-}
-
-export function canPromptForCredentials(destination = {}) {
-  const mode = credentialModeForDestination(destination);
-  return Boolean(mode && (mode !== 'direct' || destination.backendUrl));
-}
-
-export async function enrichWithStoredCredentials(destinations, env = process.env, log = message => console.error(message)) {
-  const needingCredentials = destinations.filter(destination => {
-    const mode = credentialModeForDestination(destination);
-    if (!mode || !canPromptForCredentials(destination)) return false;
-    if (mode === 'cf-connectivity') return Boolean(destination.serverName);
-    return Boolean(destination.url && String(destination.url).includes('.dest'));
-  });
-  if (!needingCredentials.length) return destinations;
-  let stored;
-  try {
-    const path = await resolveCredentialsPath(env);
-    stored = await readCredentials(path);
-  } catch (error) {
-    log(`[sap-ai-dev] stored credentials could not be read: ${String(error.message).slice(0, 200)}`);
-    return destinations;
-  }
-  return destinations.map(destination => {
-    const mode = credentialModeForDestination(destination);
-    const key = credentialKeyForDestination(destination);
-    const entry = key ? stored.destinations?.[key] : undefined;
-    if (!mode || !entry?.user || !entry?.password) return destination;
-    if (mode === 'cf-connectivity') {
-      if (entry.mode !== mode || destination.source !== 'cloud-foundry') return destination;
-      return {
-        ...destination,
-        childEnv: {
-          ...(destination.childEnv || {}),
-          SAP_USER: entry.user,
-          SAP_PASSWORD: entry.password,
-          SAP_VERBOSE: 'false'
-        }
-      };
-    }
-    if (mode === 'bas-tunnel') {
-      if (entry.mode !== mode) return destination;
-      return { ...destination, credentials: { user: entry.user, password: entry.password, mode } };
-    }
-    if (!destination.backendUrl || !destination.url || !String(destination.url).includes('.dest')) return destination;
-    if (entry.mode && entry.mode !== 'direct') return destination;
-    const host = entry.host || destination.backendUrl;
-    return { ...destination, credentials: { host, user: entry.user, password: entry.password, mode: 'direct' } };
-  });
-}

package/src/credentials-store.mjs

@@ -1,113 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { chmod, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
-import { homedir } from 'node:os';
-import { basename, dirname, join } from 'node:path';
-import { brandedEnvValue } from './branding.mjs';
-
-// Optional SAP backend credential overrides live next to the MCP config
-// (never inside it), with 0600 permissions and no tokens or cookies. Entries
-// are keyed by a stable destination identity and may include a route mode.
-const CREDENTIALS_FILENAME = 'sap-ai-dev-toolkit-credentials.json';
-const CREDENTIAL_MODES = new Set(['direct', 'bas-tunnel', 'cf-connectivity']);
-
-async function exists(path) {
-  try {
-    await stat(path);
-    return true;
-  } catch (error) {
-    if (error?.code === 'ENOENT') return false;
-    throw error;
-  }
-}
-
-export async function resolveCredentialsPath(env = process.env, mcpConfigPath) {
-  const configured = brandedEnvValue(env, 'CREDENTIALS_FILE');
-  if (configured) return configured;
-  if (mcpConfigPath) return join(dirname(mcpConfigPath), CREDENTIALS_FILENAME);
-  const home = env.HOME || homedir();
-  const candidates = [
-    join(home, '.vscode', 'data', 'User'),
-    join(home, '.vscode-server', 'data', 'User'),
-    join(home, '.code-server', 'data', 'User')
-  ];
-  for (const candidate of candidates) if (await exists(candidate)) return join(candidate, CREDENTIALS_FILENAME);
-  return join(candidates[0], CREDENTIALS_FILENAME);
-}
-
-function sanitizeEntry(entry) {
-  const result = {};
-  if (typeof entry?.host === 'string' && entry.host) result.host = entry.host;
-  if (typeof entry?.user === 'string' && entry.user) result.user = entry.user;
-  if (typeof entry?.password === 'string' && entry.password) result.password = entry.password;
-  if (CREDENTIAL_MODES.has(entry?.mode)) result.mode = entry.mode;
-  if (typeof entry?.updatedAt === 'string') result.updatedAt = entry.updatedAt;
-  return result;
-}
-
-export async function readCredentials(path) {
-  let raw;
-  try {
-    raw = await readFile(path, 'utf8');
-  } catch (error) {
-    if (error?.code === 'ENOENT') return {};
-    throw new Error(`Credentials file ${path} could not be read: ${error.message}`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (error) {
-    throw new Error(`Credentials file ${path} contains invalid JSON: ${error.message}`);
-  }
-  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-    throw new Error(`Credentials file ${path} must contain a top-level JSON object`);
-  }
-  const destinations = {};
-  for (const [name, entry] of Object.entries(parsed.destinations || {})) {
-    const clean = sanitizeEntry(entry);
-    if (clean.user && clean.password) destinations[name] = clean;
-  }
-  return { destinations };
-}
-
-async function writeCredentials(path, destinations) {
-  const directory = dirname(path);
-  await mkdir(directory, { recursive: true });
-  const temporary = join(directory, `.${basename(path)}.${process.pid}.${randomUUID()}.tmp`);
-  try {
-    await writeFile(temporary, `${JSON.stringify({ version: 1, destinations }, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-    await rename(temporary, path);
-    await chmod(path, 0o600).catch(() => {});
-  } catch (error) {
-    await rm(temporary, { force: true }).catch(() => {});
-    throw new Error(`Credentials file ${path} could not be written: ${error.message}`);
-  }
-}
-
-export async function storeDestinationCredentials(path, name, { host, user, password, mode }) {
-  if (mode != null && !CREDENTIAL_MODES.has(mode)) throw new Error('Credential override route mode is unsupported');
-  const current = await readCredentials(path).catch(error => { throw error; });
-  const destinations = { ...current.destinations };
-  destinations[String(name)] = {
-    host: String(host || ''),
-    user: String(user || ''),
-    password: String(password || ''),
-    ...(mode ? { mode } : {}),
-    updatedAt: new Date().toISOString()
-  };
-  await writeCredentials(path, destinations);
-  return { path, name };
-}
-
-export async function removeDestinationCredentials(path, names) {
-  const current = await readCredentials(path);
-  const destinations = { ...current.destinations };
-  const removed = [];
-  for (const name of names) {
-    if (Object.hasOwn(destinations, String(name))) {
-      delete destinations[String(name)];
-      removed.push(String(name));
-    }
-  }
-  if (removed.length) await writeCredentials(path, destinations);
-  return { path, removed };
-}