sap-ai-dev-toolkit 0.6.0 → 0.6.1

package/README.md

@@ -84,7 +84,7 @@ Use the attached destination-prefixed tools directly in chat. Do not launch `sap
 
 **Included skills:** `abap-development` · `abap-testing-quality` · `cds-development` · `rap-development` · `abap-debugging` · `abap-runtime-analysis` · `rap-service-delivery` · `sap-standard-api-analysis` · `clean-core-extensibility` · `sap-sdlc-orchestration` · `sap-transport-release` · `hana-cloud-inspection` · `hana-cloud-native-development` · `hana-cloud-validation`
 
-If the agents are not listed, install the optional agents and skills under `$HOME/.copilot` when prompted during an interactive global install, then reload BAS if needed. Repository-scoped installation instructions appear below.
+Agents and skills install into `$HOME/.copilot` by default during global installation; press Enter to accept or type `n` to skip. In non-interactive installs they are installed automatically. Repository-scoped installation instructions appear below.
 
 ## ✨ Your SAP development cockpit, inside Copilot Chat
 
@@ -237,10 +237,9 @@ Once the destination server is enabled in Copilot Chat, ask for outcomes instead
 | --- | --- |
 | 🎯 **Explicit target** | SAP changes only proceed when the destination and required target details are known. |
 | 🚦 **Explicit state change** | Activation, service publication, and transport creation happen only when requested and authorized. |
-| 👁️ **Optional read-only mode** | `SAP_AI_DEV_TOOLKIT_READ_ONLY=true` removes every write/activate/transport-create tool from the surface and starts VSP with `--transport-read-only`. Recommended for exploration destinations. |
 | 🧪 **Verification first** | The agent uses available lint, syntax, unit-test, ATC, and diagnostics workflows and reports what actually ran. |
 | 🔒 **SAP authorization remains authoritative** | The add-on does not bypass backend SAP permissions. |
-| 🚚 **Curated VSP tool surface** | The proxy exposes a cherry-picked developer-lifecycle set from VSP plus local workflow tools, keeping one destination below 60 tools; SAP authorizations and VSP safety checks still apply. |
+| 🚚 **Curated VSP tool surface** | The proxy exposes the same curated developer-lifecycle set for every destination, plus local workflow tools; SAP authorizations and VSP safety checks still apply. |
 | 🧱 **Per-destination isolation** | Generated MCP entries are scoped to a single `SAP_AI_DEV_TOOLKIT_DESTINATION`. |
 | 🔑 **No credentials in `mcp.json`** | Authentication material stays in BAS destination configuration rather than MCP config. |
 
@@ -278,6 +277,9 @@ The installer handles VSP provisioning automatically:
 
 With `H2O_URL` set, an interactive install opens a checkbox picker with no destinations selected by default. Use **Space** to choose destinations and **Enter** to confirm. Press **a** to toggle all destinations (select all if any are unchecked; otherwise clear the selection). Confirming with none selected removes this add-on's managed MCP entries. When the `cf` CLI 8.18 or newer is authenticated to a targeted space, setup first offers an optional import from that space's Destination service; type **y** then **Enter** to include it, or press **Enter** to skip. Accepted CF and BAS destinations appear together in the picker. npm may run its install hook without an interactive terminal, even when the shell is interactive; in that case, selection is skipped without changing MCP config.
 
+
+The same postinstall installs bundled Copilot agents and skills under `$HOME/.copilot` by default. Press Enter at `[Y/n]` to install or update them; type `n` to leave them unchanged. With no interactive terminal, installation proceeds automatically.
+
 Some current npm versions also require install hooks to be approved. If npm reports that `sap-ai-dev-toolkit`'s `postinstall` was blocked, allow it during a fresh install with `npm install --global --allow-scripts=sap-ai-dev-toolkit sap-ai-dev-toolkit`, or run `sap-ai-dev --setup` from an interactive BAS terminal after installation.
 
 The setup report uses icons and terminal colors; set `NO_COLOR=1` to disable ANSI colors. The table is a weather report, not a bouncer: green **PASS** means the ADT probe responded, red **FAIL** means it failed, and yellow **SKIPPED** means it was skipped. Probe failures do not block MCP registration or startup for destinations you select.
@@ -617,8 +619,11 @@ The write and activation tools change SAP state. Confirm the target, package, an
 | `GetUserTransports` | Read and group a user's transport requests and tasks; supports organizer filters and source selection. |
 | `GetTransport` | Read a transport request's details, objects, and tasks. |
 | `GetTransportInfo` | Find eligible transports and lock status for an ABAP object or package. |
+| `LockObject` | Lock an ABAP repository object in SAP. |
+| `UnlockObject` | Unlock an ABAP repository object in SAP. |
 | `CreateTransport` | Create a transport request. |
 | `CheckTransportReadiness` | Collect a whitelisted bundle of transport, dependency, inactive-object, ABAP Unit, and ATC evidence. |
+`LockObject` and `UnlockObject` are state-changing VSP tools; the proxy does not retry them after a child crash to avoid duplicate side effects.
 
 Transport release and deletion are not exposed by the curated proxy surface; release or delete transports outside this add-on after review.
 
@@ -736,7 +741,6 @@ The response contains a `tools` array. A `RunQuery` entry resembles this excerpt
 | `SAP_AI_DEV_TOOLKIT_DISABLE_BAS_RELAY=true` | Disable the built-in BAS destination relay. By default the add-on self-heals `.dest` destinations through a local relay that keeps all access destination-based while handling ADT CSRF fetch/retry behavior before VSP calls SAP. |
 | `SAP_AI_DEV_TOOLKIT_HTTP_PROXY` | Egress proxy for relay and discovery traffic. Takes precedence over `HTTP_PROXY`/`http_proxy`; unset means the default BAS proxy for `.dest` hosts, empty means direct. |
 | `SAP_AI_DEV_TOOLKIT_MAX_CSRF_RETRIES` | Bounded retries after explicit CSRF-session rejection per unsafe request (default 3, maximum 10). Invalid values use the default. |
-| `SAP_AI_DEV_TOOLKIT_READ_ONLY=true` | Read-only mode: hides `WriteSource`, `EditSource`, `Activate`, `ActivateMultiple`, `CreateTransport`, `SetBreakpoint`, and the change-set workflow tools, and starts VSP with `--transport-read-only`. |
 | `SAP_AI_DEV_TOOLKIT_REQUEST_TIMEOUT_MS` | Per-request timeout for calls forwarded to a VSP child (default 600000 = 10 minutes; `0` disables). A stalled request fails with a timeout error; the child is left running. |
 | `SAP_AI_DEV_MCP_CONFIG` | Explicit MCP configuration path; highest precedence. |
 | `SAP_AI_DEV_TOOLKIT_MCP_CONFIG` | Branded compatibility alias for the MCP configuration path. |

package/inventory.md

@@ -163,7 +163,7 @@ These logical names are exposed through MCP in lowercase snake_case (`lint_abap`
 
 - Runtime tool names are unprefixed lowercase snake_case (`run_query`) on the normal single-destination server; a `<destination-slug>_` prefix appears only on multi-destination servers. `tools/call` accepts the exact name returned by `tools/list`.
 - The proxy starts VSP with `--enable-transports`; generated MCP entries set `SAP_ALLOW_TRANSPORTABLE_EDITS=true`.
-- `SAP_AI_DEV_TOOLKIT_READ_ONLY=true` switches a server to read-only: the write/activate/transport-create/breakpoint tools above are removed from the surface, change-set workflows are not registered, and VSP starts with `--transport-read-only` instead.
+- The curated VSP tool surface and enabled transport mode are the same for every destination; SAP authorization remains authoritative.
 - `SAP_AI_DEV_TOOLKIT_REQUEST_TIMEOUT_MS` (default 600000) bounds each forwarded call; stalled requests fail without killing the child.
 - Transport release/deletion and the general-purpose `SAP` router are intentionally hidden from direct proxy calls. `GetApplicationLog` is the bounded convenience mapping for the SAP application-log route.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/scripts/install-local.mjs

@@ -14,7 +14,7 @@ function usage() {
     '',
     '  (default)  Packs the workspace and installs the tarball globally, then',
     '             runs the normal postinstall wizard (binary provisioning,',
-    '             BAS destination setup, optional Copilot assets).',
+    '             BAS destination setup, and default Copilot asset installation).',
     '  --link     Installs with npm link instead of a tarball; edits to src/',
     '             and scripts/ take effect immediately without reinstalling.',
     '  --verify   Verifies the global sap-ai-dev command resolves to this',

package/scripts/postinstall.mjs

@@ -68,19 +68,29 @@ async function runInstallSetup() {
 }
 
 async function runCopilotAssetInstall() {
+  const copilotRoot = join(process.env.HOME || homedir(), '.copilot');
+  const installAssets = async () => {
+    const assets = await installUserCopilotAssets({ root });
+    const installed = assets.installed + assets.updated;
+    await announce(`Installed ${installed} Copilot files in ${assets.root}; ${assets.unchanged} already current.`, 'success');
+    if (assets.conflicts.length > 0) {
+      const paths = assets.conflicts.map(path => join(assets.root, path)).join(', ');
+      await announce(`Existing Copilot customizations were preserved; review these paths: ${paths}`, 'warning');
+    }
+  };
   await withInstallTerminal(async terminal => {
     if (!terminal) {
-      await announce('Optional Copilot installation skipped because no interactive terminal is available.', 'warning');
+      await announce('Installing bundled agents and skills by default because no interactive terminal is available.', 'progress');
+      await installAssets();
       return;
     }
-    const copilotRoot = join(process.env.HOME || homedir(), '.copilot');
     await announce([
-      'Optional Copilot setup is waiting for your choice.',
+      'Bundled Copilot agents and skills are installed by default.',
       '',
-      'Type y then press Enter to install the bundled agents and all skills in the path shown below; press Enter alone to skip.',
+      'Type n then press Enter to skip installing or updating the bundled files.',
       '',
-      `${colorText('✅ Type y then Enter', 'green', true)} to install the bundled agents and all skills.`,
-      `${colorText('⏭️  Press Enter', 'yellow', true)} to skip this optional step (default).`,
+      `${colorText('✅ Press Enter', 'green', true)} to install or update the bundled agents and all skills.`,
+      `${colorText('⏭️  Type n then Enter', 'yellow', true)} to skip this step.`,
       '',
       `${colorText('📁 Target folder:', 'cyan', true)}`,
       `   ${copilotRoot}`,
@@ -89,23 +99,15 @@ async function runCopilotAssetInstall() {
     const prompt = createInterface({ input: terminal.input, output: terminal.output });
     let answer;
     try {
-      answer = await prompt.question(`${colorText('🤖 Install the bundled agents and all skills?', 'magenta', terminal.output)} ${colorText('[y/N]', 'yellow', terminal.output)} `);
+      answer = await prompt.question(`${colorText('🤖 Install the bundled agents and all skills?', 'magenta', terminal.output)} ${colorText('[Y/n]', 'yellow', terminal.output)} `);
     } finally {
       prompt.close();
     }
-    // Default is skip: writing instruction files into ~/.copilot affects
-    // every Copilot session on the machine, so it needs an explicit yes.
-    if (!/^y(?:es)?$/i.test(answer.trim())) {
+    if (/^n(?:o)?$/i.test(answer.trim())) {
       await announce('Copilot agent and skills were skipped. Your files were not changed.', 'info');
       return;
     }
-    const assets = await installUserCopilotAssets({ root });
-    const installed = assets.installed + assets.updated;
-    await announce(`Installed ${installed} Copilot files in ${assets.root}; ${assets.unchanged} already current.`, 'success');
-    if (assets.conflicts.length > 0) {
-      const paths = assets.conflicts.map(path => join(assets.root, path)).join(', ');
-      await announce(`Existing Copilot customizations were preserved; review these paths: ${paths}`, 'warning');
-    }
+    await installAssets();
   });
 }
 

package/src/mcp-proxy.mjs

@@ -38,18 +38,6 @@ const APPLICATION_LOG_SCHEMA = {
 };
 const APPLICATION_LOG_DESCRIPTION = 'Read SAP application log (SLG1) entries. Results are newest first and limited to 100 by default; set messages=true to include log message details.';
 
-// Read-only mode (SAP_AI_DEV_TOOLKIT_READ_ONLY=true) removes every tool that
-// changes SAP state from the public surface and starts VSP with
-// --transport-read-only, so an exploration destination cannot be written to
-// through this proxy even if a chat prompt asks for it.
-const READ_ONLY_HIDDEN_VSP_TOOLS = new Set([
-  'Activate',
-  'ActivateMultiple',
-  'CreateTransport',
-  'EditSource',
-  'SetBreakpoint',
-  'WriteSource'
-]);
 
 // Self-healing restarts retry the interrupted tools/call once. Retrying a
 // state-changing tool after a crash can apply the same write twice (the child
@@ -60,6 +48,8 @@ const NON_RETRIABLE_VSP_TOOLS = new Set([
   'ActivateMultiple',
   'CreateTransport',
   'EditSource',
+  'LockObject',
+  'UnlockObject',
   'WriteSource'
 ]);
 
@@ -78,10 +68,6 @@ function requestTimeoutMs(env) {
   return parsed > 0 ? Math.floor(parsed) : 0;
 }
 
-export function readOnlyMode(env = process.env) {
-  const raw = brandedEnvValue(env, 'READ_ONLY');
-  return raw !== undefined && ['1', 'true', 'yes'].includes(String(raw).trim().toLowerCase());
-}
 
 // Keep the default public VSP surface small enough for developer-lifecycle use.
 // Hidden upstream tools can still be used by local workflow tools when needed.
@@ -129,6 +115,7 @@ export const PUBLIC_VSP_TOOLS = new Set([
   'GrepPackages',
   'ListDependencies',
   'ListTransports',
+  'LockObject',
   'PrettyPrint',
   'RunATCCheck',
   'RunQuery',
@@ -136,15 +123,10 @@ export const PUBLIC_VSP_TOOLS = new Set([
   'SearchObject',
   'SetBreakpoint',
   'SyntaxCheck',
+  'UnlockObject',
   'WriteSource'
 ]);
 
-function exposeVspTool(tool, readOnly = false) {
-  if (!PUBLIC_VSP_TOOLS.has(tool?.name)) return false;
-  // Read-only destinations never expose the write/activate/transport-create
-  // surface, even when VSP registers it.
-  return !(readOnly && READ_ONLY_HIDDEN_VSP_TOOLS.has(tool.name));
-}
 
 // Public tool names are lowercase snake_case. BAS/VS Code chat tool references
 // are lowercase-only, so mixed-case names never bind in the tools picker even
@@ -210,13 +192,12 @@ function childEnvironment(destination, env) {
 
 
 export function childArguments(destination, env = process.env) {
-  // The proxy allowlist keeps transport mutations to CreateTransport.
-  // Transportable source edits are controlled by SAP_ALLOW_TRANSPORTABLE_EDITS.
+  // The proxy allowlist controls transport operations; source edits are
+  // controlled by SAP_ALLOW_TRANSPORTABLE_EDITS and SAP authorizations.
   const mode = brandedEnvValue(env, 'MODE') || 'expert';
   const args = ['--url', destination.url, '--client', destination.client || '001', '--mode', mode];
   if (destination.source !== 'cloud-foundry' || destination.authentication === 'PrincipalPropagation') args.push('--proxy-auth');
-  if (readOnlyMode(env)) args.push('--transport-read-only');
-  else args.push('--enable-transports');
+  args.push('--enable-transports');
   return args;
 }
 
@@ -394,7 +375,6 @@ export class MCPProxy {
     this.log = log;
     this.output = output;
     this.version = version;
-    this.readOnly = readOnlyMode(env);
     this.requestTimeoutMs = requestTimeoutMs(env);
     this.children = [];
     this.started = false;
@@ -663,17 +643,11 @@ export class MCPProxy {
           });
         }
 
-        if (!exposeVspTool(tool, this.readOnly)) continue;
+        if (!PUBLIC_VSP_TOOLS.has(tool?.name)) continue;
         const name = publicName(tool.name);
         publish(name, { entry, upstream: tool.name }, { ...tool, name, description: `${tool.description || tool.name} [destination: ${entry.destination.name}]` });
       }
-      // Local workflow tools gate on the upstream surface they can use; in
-      // read-only mode the hidden write tools must not enable change-set
-      // staging either.
-      const effectiveUpstream = this.readOnly
-        ? upstreamTools.filter(tool => !READ_ONLY_HIDDEN_VSP_TOOLS.has(tool.name))
-        : upstreamTools;
-      for (const localTool of createEngineeringTools(entry, effectiveUpstream, { env: this.env, log: this.log })) {
+      for (const localTool of createEngineeringTools(entry, upstreamTools, { env: this.env, log: this.log })) {
         const name = publicName(localTool.definition.name);
         publish(name, { handler: localTool.handler }, {
           ...localTool.definition,

package/tools.md

@@ -77,9 +77,6 @@ The proxy adds local multi-step tools to each destination when their required VS
 
 `sap-ai-dev --doctor` checks destination probing, VSP startup, the `get_system_info` probe, and MCP tool listing. `sap-ai-dev --demo` runs the sample tools and OData fixtures without contacting SAP; demo writes and transport creation remain in memory until that process exits.
 
-### Read-only mode
-
-Set `SAP_AI_DEV_TOOLKIT_READ_ONLY=true` (or legacy `BAS_VSP_READ_ONLY`) on a destination server to run it strictly read-only: `WriteSource`, `EditSource`, `Activate`, `ActivateMultiple`, `CreateTransport`, `SetBreakpoint`, and the change-set workflow tools are removed from the surface, and the VSP child starts with `--transport-read-only` so transport writes are rejected upstream as well. Inspection, queries, linting, and checks remain available.
 
 ### Request timeouts