sap-ai-dev-toolkit 0.6.5 → 0.6.6

package/README.md

@@ -544,7 +544,7 @@ For a transport report, include exactly one `GetTransport` check whose `transpor
 
 For an ABAP Cloud assessment, get object URIs from `SearchObject` and pass them to `PlanABAPCloudMigration`. It reports release evidence; it does not guess replacement APIs. Save the JSON from `GenerateRAPRegressionSuite` and pass it to `RunRAPRegressionSuite` after relevant service changes.
 
-`sap-ai-dev --doctor` probes each discovered destination, checks that each managed MCP entry still matches its selected BAS destination, starts VSP, lists MCP tools, and preflights the runtime relay's CSRF session (token fetched from the GET-capable ADT discovery endpoint, the same token POST-only services such as data preview rely on) before calling `GetSystemInfo`. It repairs only tagged toolkit-owned BAS entries that can be verified against complete destination discovery; it does not add destinations, remove stale or third-party entries, or overwrite malformed configuration. `--doctor --json` reports redacted session diagnostics (HTTP status, cookie count, retry/fallback counters; never token or cookie values) and exits unsuccessfully when a required check fails.
+`sap-ai-dev --doctor` probes each discovered destination, checks that each managed MCP entry still matches its selected BAS destination, starts VSP, lists MCP tools, and calls `GetSystemInfo` directly when that tool is exposed. It repairs only tagged toolkit-owned BAS entries that can be verified against complete destination discovery; it does not add destinations, remove stale or third-party entries, or overwrite malformed configuration. `--doctor --json` reports redacted diagnostics and exits unsuccessfully when a required check fails.
 
 `tools/list` confirms what this MCP server exposes; it does not prove that VS Code attached the server to the active chat. Start the selected destination in **MCP: List Servers**, enable it in the Chat tools picker, and reload/reselect the agent if the host binding is stale. This add-on cannot inspect or repair another MCP server's registration or a host-wide tool budget.
 
@@ -738,9 +738,7 @@ The response contains a `tools` array. A `RunQuery` entry resembles this excerpt
 | `SAP_AI_DEV_TOOLKIT_DESTINATION` | Comma-separated destination allowlist for normal runtime discovery. Setup clears this temporarily so it can display all eligible systems. |
 | `SAP_AI_DEV_TOOLKIT_MODE` | VSP child mode (`expert` by default; `focused` omits `ActivateMultiple`, `GetUserTransports`, and `GetTransportInfo`). The proxy exposes its curated tool subset and local workflow tools, including `LintABAP`. |
 | `SAP_ALLOW_TRANSPORTABLE_EDITS` | Generated MCP entries set this to `true` to permit source edits in transportable packages; VSP safety checks and SAP authorizations still apply. |
-| `SAP_AI_DEV_TOOLKIT_DISABLE_BAS_RELAY=true` | Disable the built-in BAS destination relay. By default the add-on self-heals `.dest` destinations through a local relay that keeps all access destination-based while handling ADT CSRF fetch/retry behavior before VSP calls SAP. |
-| `SAP_AI_DEV_TOOLKIT_HTTP_PROXY` | Egress proxy for relay and discovery traffic. Takes precedence over `HTTP_PROXY`/`http_proxy`; unset means the default BAS proxy for `.dest` hosts, empty means direct. |
-| `SAP_AI_DEV_TOOLKIT_MAX_CSRF_RETRIES` | Bounded retries after explicit CSRF-session rejection per unsafe request (default 3, maximum 10). Invalid values use the default. |
+| `SAP_AI_DEV_TOOLKIT_HTTP_PROXY` | Egress proxy for BAS discovery and probe traffic. Takes precedence over `HTTP_PROXY`/`http_proxy`; unset means the default BAS proxy for `.dest` hosts, empty means direct. |
 | `SAP_AI_DEV_TOOLKIT_REQUEST_TIMEOUT_MS` | Per-request timeout for calls forwarded to a VSP child (default 600000 = 10 minutes; `0` disables). A stalled request fails with a timeout error; the child is left running. |
 | `SAP_AI_DEV_MCP_CONFIG` | Explicit MCP configuration path; highest precedence. |
 | `SAP_AI_DEV_TOOLKIT_MCP_CONFIG` | Branded compatibility alias for the MCP configuration path. |
@@ -757,18 +755,13 @@ The response contains a `tools` array. A `RunQuery` entry resembles this excerpt
 
 #### Self-healing modes
 
-The relay between the VSP child and each BAS destination recovers from the failure modes that break ADT writes over `.dest` proxies:
-
-1. **CSRF session pairing** — a scoped cookie jar retains session cookies received during safe reads and token fetches, applies updates and expirations, and replays the matching token/cookie pair on POST/PUT/PATCH/DELETE. Tokens are session-scoped and always fetched from the GET-capable `/sap/bc/adt/discovery` endpoint, so unsafe requests to POST-only services (ADT data preview) are covered too. If no token can be obtained at all, the relay fails closed and does not send the unsafe request. A token that arrives without session cookies is still used — BAS proxy routes strip `Set-Cookie`, yet the backend accepts the token on the proxy-established Basic-auth session — and a CSRF rejection on such a cookie-less route is surfaced without pointless retries.
-2. **Session refresh** — when SAP explicitly rejects a CSRF token, the cached session is dropped, a fresh token+cookie pair is fetched, and the request is retried within the configured bound. Generic authorization 401/403 responses are returned without being mislabeled or retried as CSRF failures.
-3. **Proxy tunnel fallback** — when the BAS proxy refuses absolute-form requests (502/504 or transport errors), the relay switches to a CONNECT tunnel through the same proxy and keeps going.
-4. **Child crash recovery** — a crashed VSP child is restarted transparently, re-initialized, tools re-registered, and the interrupted `tools/call` retried once before any error reaches the client.
-5. **Configured destination authentication** — BAS destination children use the selected BAS destination as their only SAP identity. The toolkit clears VSP local authentication environment values so a project `.env` cannot override or conflict with destination authentication. Setup does not prompt for or store SAP usernames/passwords, and the relay does not connect directly to a backend host as a credential fallback. Cloud Foundry destinations use only credentials returned by their configured Destination service record.
+VSP children connect to each configured destination URL directly. BAS destination authentication remains selected through VSP's `--proxy-auth` path; Cloud Foundry on-premise destinations continue through the separate Connectivity proxy.
+Child crash recovery restarts a failed VSP child, re-initializes it, re-registers tools, and retries the interrupted `tools/call` once before surfacing an error. State-changing tools are not retried.
 Existing installs that still set the previous `BAS_VSP_*` environment variables remain supported. The setup wizard writes new MCP entries with the `SAP_AI_DEV_TOOLKIT_*` names.
 
 #### Server logging
 
-Every observable event — startup banner (version, PID, VSP binary), destination discovery, relay activation, VSP session initialization, each JSON-RPC request with its id, every tool call with duration and outcome, self-healing restarts, and errors — is logged twice: to **stderr** with ISO timestamps (visible when the server runs in a terminal or in hosts that surface stderr), and to the host's **MCP server output channel** as standard `notifications/message` log notifications (VS Code/BAS and Claude Code render these under the server's output). Log notifications start at `info`; send `logging/setLevel` with `debug` (or higher) from the client to adjust what reaches the channel — stderr always receives everything. Credentials, cookies, and tokens are redacted in both streams.
+Every observable event — startup banner (version, PID, VSP binary), destination discovery, VSP session initialization, each JSON-RPC request with its id, every tool call with duration and outcome, self-healing restarts, and errors — is logged twice: to **stderr** with ISO timestamps (visible when the server runs in a terminal or in hosts that surface stderr), and to the host's **MCP server output channel** as standard `notifications/message` log notifications (VS Code/BAS and Claude Code render these under the server's output). Log notifications start at `info`; send `logging/setLevel` with `debug` (or higher) from the client to adjust what reaches the channel — stderr always receives everything. Credentials, cookies, and tokens are redacted.
 
 <a id="troubleshooting"></a>
 
@@ -785,6 +778,8 @@ Next, check that the backend answers at `/sap/bc/adt`.
 
 Runtime diagnostics take the stderr lane. In the MCP server's Output view, check per-destination ADT probe status, VSP child stderr, and failed tool-call details; stdout is reserved for MCP protocol messages.
 
+If `GetSystemInfo` or `RunQuery` reports a CSRF-token fetch failure, VSP tries `/sap/bc/adt/core/discovery` first and falls back to `/sap/bc/adt/discovery` when the core endpoint returns HTTP 404 or 5xx without a token. If both endpoints fail, the error includes their HTTP statuses; check BAS destination routing and the SAP ADT service. `GetInstalledComponents` is a separate GET request and a failure there is not evidence of a CSRF problem.
+
 If automatic Go or VSP provisioning fails, check network access and the package's supported platform. You can install Go manually or set `GO_BINARY` as an explicit fallback. A trusted prebuilt VSP can be supplied with `SAP_AI_DEV_TOOLKIT_BINARY`.
 
 ## 🧑‍💻 Development

package/dist/checksums.txt

@@ -1,5 +1,5 @@
-78c0f6b7adf151a4c83ee3a757752aa409225fc75af64dfe728aed68dc5cf598  vsp-linux-x64
-4ceaf3ef3519431aa5ebe7d7c14569cf7c7035956dbfc9342c8fa9b6343a5380  vsp-linux-arm64
-f8d075f1ef955f8bb4be5b1d9ec3ffc86e84349b8a141265cf39e74c9fd83246  vsp-darwin-x64
-25e19e0d7317fe5adcb3c670b5fcf1da1caafa3c1bf8a6783c4ff00b312b5194  vsp-darwin-arm64
-c67c921ae884abeacaa39782c5524f58ec58bdbccc0d7097ee8a2499c04331ac  vsp-win32-x64.exe
+8ab555658815db7de670b956dafe0f12d6a249e4f1e1cbbb058deb658a89a37d  vsp-linux-x64
+7011b716e295ce2cecc40b9a56e57d9a1ec24c2b9d6aa25ab46e5cde0ec23998  vsp-linux-arm64
+5c240a6b53e15ebaae817612aed1c5b95624a99adfc38e6abb9afa377de30d1a  vsp-darwin-x64
+28032c4d331253808ec9318e6db570420c6c9308935964de665e34374465d89f  vsp-darwin-arm64
+5bb45857489bbe5d57587d9abda0b768d3a1b352d89a2a6bf13b23af8d2fd45e  vsp-win32-x64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.6.5",
+  "version": "0.6.6",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",
@@ -12,7 +12,6 @@
     "@modelcontextprotocol/sdk": "1.30.1",
     "@sap/hana-client": "2.30.27",
     "terminal-kit": "^3.1.4",
-    "tough-cookie": "^5.1.2",
     "undici": "^6.21.3",
     "zod": "4.6.5"
   },

package/patches/vsp-bas-proxy-auth.patch

@@ -308,3 +308,128 @@ diff --git a/internal/mcp/tools_register.go b/internal/mcp/tools_register.go
 +				}),
  			),
  		), s.handleActivateMultiple)
+ 	}
+diff --git a/pkg/adt/http.go b/pkg/adt/http.go
+--- a/pkg/adt/http.go
++++ b/pkg/adt/http.go
+@@ -499,6 +499,7 @@ func (t *Transport) fetchCSRFTokenFor(ctx context.Context, stateful bool) error
+ // allowReauth exists to break a cycle: re-authenticating ends with a token
+ // fetch of its own, and that fetch must not start another re-authentication.
+ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bool, stateful bool) error {
++	var alternateFailure string
+ 	token, status, redirected, err := t.probeCSRFToken(ctx, http.MethodHead, stateful)
+ 	if err != nil {
+ 		return err
+@@ -513,6 +514,29 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+ 		if err != nil {
+ 			return err
+ 		}
++		// Some ADT installations return 500 from /core/discovery even though
++		// the standard /discovery endpoint can issue a token. Keep the
++		// existing fast path, but do not make every POST depend on the
++		// failing endpoint.
++		if !isCSRFToken(token) && (getStatus >= 500 || getStatus == http.StatusNotFound) {
++			coreStatus := getStatus
++			token, status, redirected, err = t.probeCSRFTokenAt(ctx, http.MethodHead, stateful, "/sap/bc/adt/discovery")
++			if err != nil {
++				return err
++			}
++			if !isCSRFToken(token) {
++				if status == http.StatusUnauthorized && !t.canReauth() {
++					return fmt.Errorf("authentication failed (401): check username/password")
++				}
++				token, getStatus, getRedirected, err = t.probeCSRFTokenAt(ctx, http.MethodGet, stateful, "/sap/bc/adt/discovery")
++				if err != nil {
++					return err
++				}
++				if !isCSRFToken(token) {
++					alternateFailure = fmt.Sprintf("no CSRF token from /sap/bc/adt/core/discovery (GET %d) or /sap/bc/adt/discovery (HEAD %d, GET %d)", coreStatus, status, getStatus)
++				}
++			}
++		}
+ 		if !isCSRFToken(token) {
+ 			// An expired SSO session rarely announces itself as a 401. ICF sends
+ 			// the request on to the identity provider, the redirect chain is
+@@ -537,6 +561,9 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+ 				}
+ 				return t.fetchCSRFTokenWithReauth(ctx, false, stateful)
+ 			}
++			if alternateFailure != "" {
++				return errors.New(alternateFailure)
++			}
+ 			switch getStatus {
+ 			case http.StatusUnauthorized:
+ 				return fmt.Errorf("authentication failed (401): check username/password")
+@@ -556,7 +583,11 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+ // returns the token (empty when the server did not supply one), the status, and
+ // whether the answer came from somewhere other than the SAP host.
+ func (t *Transport) probeCSRFToken(ctx context.Context, method string, stateful bool) (token string, status int, redirected bool, err error) {
+-	reqURL, err := t.buildURL("/sap/bc/adt/core/discovery", nil)
++	return t.probeCSRFTokenAt(ctx, method, stateful, "/sap/bc/adt/core/discovery")
++}
++
++func (t *Transport) probeCSRFTokenAt(ctx context.Context, method string, stateful bool, path string) (token string, status int, redirected bool, err error) {
++	reqURL, err := t.buildURL(path, nil)
+ 	if err != nil {
+ 		return "", 0, false, fmt.Errorf("building URL: %w", err)
+ 	}
+diff --git a/pkg/adt/http_csrf_discovery_test.go b/pkg/adt/http_csrf_discovery_test.go
+new file mode 100644
+--- /dev/null
++++ b/pkg/adt/http_csrf_discovery_test.go
+@@ -0,0 +1,55 @@
++package adt
++
++import (
++	"context"
++	"net/http"
++	"net/http/httptest"
++	"strings"
++	"testing"
++)
++
++func TestCSRFAlternateDiscoveryOnCoreFailure(t *testing.T) {
++	var requests []string
++	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++		requests = append(requests, r.Method+" "+r.URL.Path)
++		switch r.URL.Path {
++		case "/sap/bc/adt/core/discovery":
++			w.WriteHeader(http.StatusInternalServerError)
++		case "/sap/bc/adt/discovery":
++			w.Header().Set("X-CSRF-Token", "valid-token")
++		case "/sap/bc/adt/datapreview/freestyle":
++			if r.Header.Get("X-CSRF-Token") != "valid-token" {
++				t.Errorf("POST missing fetched token")
++				w.WriteHeader(http.StatusForbidden)
++			}
++		default:
++			t.Errorf("unexpected request %s", r.URL.Path)
++		}
++	}))
++	defer srv.Close()
++	tr := newCSRFTestTransport(t, srv)
++	_, err := tr.Request(context.Background(), "/sap/bc/adt/datapreview/freestyle", &RequestOptions{Method: http.MethodPost, Body: []byte("SELECT * FROM T000")})
++	if err != nil {
++		t.Fatalf("read-only POST failed: %v", err)
++	}
++	want := []string{"HEAD /sap/bc/adt/core/discovery", "GET /sap/bc/adt/core/discovery", "HEAD /sap/bc/adt/discovery", "POST /sap/bc/adt/datapreview/freestyle"}
++	if strings.Join(requests, "|") != strings.Join(want, "|") {
++		t.Errorf("requests = %v, want %v", requests, want)
++	}
++}
++
++func TestCSRFAlternateDiscoveryFailureIncludesStatuses(t *testing.T) {
++	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++		if r.URL.Path == "/sap/bc/adt/core/discovery" {
++			w.WriteHeader(http.StatusInternalServerError)
++		} else {
++			w.WriteHeader(http.StatusForbidden)
++		}
++	}))
++	defer srv.Close()
++	tr := newCSRFTestTransport(t, srv)
++	err := tr.fetchCSRFToken(context.Background())
++	if err == nil || !strings.Contains(err.Error(), "500") || !strings.Contains(err.Error(), "403") {
++		t.Fatalf("expected both endpoint failures, got %v", err)
++	}
++}

package/src/launcher.mjs

@@ -89,16 +89,6 @@ async function runDoctor(destinations) {
       const initialized = await proxy.handle({ jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2024-11-05' } });
       if (initialized?.error) throw new Error(initialized.error.message || 'MCP initialization failed');
       checks.push(doctorRow(destination.name, 'VSP MCP startup', 'passed', 'initialized'));
-      const relayedDestination = proxy.children[0]?.destination;
-      if (relayedDestination?.relay) {
-        checks.push(doctorRow(destination.name, 'BAS destination relay', 'passed', `enabled (${relayedDestination.url}); runtime session preflight pending`));
-      } else if (destination.source === 'cloud-foundry') {
-        checks.push(doctorRow(destination.name, 'BAS destination relay', 'skipped', 'Cloud Foundry destinations connect through the connectivity proxy directly.'));
-      } else if (String(runtimeEnv.SAP_AI_DEV_TOOLKIT_DISABLE_BAS_RELAY || '').toLowerCase() === 'true') {
-        checks.push(doctorRow(destination.name, 'BAS destination relay', 'skipped', 'Disabled through SAP_AI_DEV_TOOLKIT_DISABLE_BAS_RELAY.'));
-      } else {
-        checks.push(doctorRow(destination.name, 'BAS destination relay', 'skipped', 'Not applicable for this destination.'));
-      }
       const listed = await proxy.handle({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} });
       if (listed?.error) throw new Error(listed.error.message || 'MCP tools/list failed');
       const tools = listed.result?.tools || [];
@@ -114,32 +104,9 @@ async function runDoctor(destinations) {
       if (!systemInfo) {
         checks.push(doctorRow(destination.name, 'SAP system check', 'skipped', 'GetSystemInfo is not exposed by this VSP mode.'));
       } else {
-        let sessionReady = true;
-        if (relayedDestination?.relay?.probeCsrfSession) {
-          let session;
-          let preflightError;
-          try {
-            session = await relayedDestination.relay.probeCsrfSession();
-          } catch (error) {
-            preflightError = redactText(error.message || error).slice(0, 250);
-          }
-          sessionReady = session?.sessionUsable === true;
-          const status = sessionReady ? 'passed' : 'failed';
-          const stats = relayedDestination.relay.stats || {};
-          const detail = preflightError
-            ? `preflight request failed: ${preflightError}`
-            : `HTTP ${session?.httpStatus || 0}; token=${session?.tokenReceived ? 'received' : 'missing'}; cookies=${session?.cookieCount || 0}; usableSession=${sessionReady}; csrfFetches=${stats.csrfFetches || 0}; csrfRetries=${stats.csrfRetries || 0}; sessionFailures=${stats.csrfSessionFailures || 0}; tunnelFallbacks=${stats.tunnelFallbacks || 0}`;
-          checks.push(doctorRow(destination.name, 'BAS relay CSRF preflight', status, detail));
-          if (!sessionReady) {
-            const remediation = 'GetSystemInfo was not called because the relay could not establish a paired CSRF token/session. Confirm the configured destination authentication and BAS proxy route.';
-            checks.push(doctorRow(destination.name, 'SAP system check', 'skipped', preflightError ? `${remediation} Relay error: ${preflightError}` : remediation));
-          }
-        }
-        if (sessionReady) {
-          const inspected = await proxy.handle({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: systemInfo.name, arguments: {} } });
-          const failed = inspected?.error || inspected?.result?.isError;
-          checks.push(doctorRow(destination.name, 'SAP system check', failed ? 'failed' : 'passed', failed ? redactText(inspected?.error?.message || inspected?.result?.content?.[0]?.text || 'GetSystemInfo failed') : 'GetSystemInfo returned successfully'));
-        }
+        const inspected = await proxy.handle({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: systemInfo.name, arguments: {} } });
+        const failed = inspected?.error || inspected?.result?.isError;
+        checks.push(doctorRow(destination.name, 'SAP system check', failed ? 'failed' : 'passed', failed ? redactText(inspected?.error?.message || inspected?.result?.content?.[0]?.text || 'GetSystemInfo failed') : 'GetSystemInfo returned successfully'));
       }
     } catch (error) {
       const detail = redactText(error.message || error).slice(0, 300);

package/src/mcp-proxy.mjs

@@ -4,7 +4,6 @@ import { sanitizeChildEnv, slugifyDestination } from './bas-discovery.mjs';
 import { ABAP_LINT_TOOL, runABAPLint } from './abaplint.mjs';
 import { createEngineeringTools } from './engineering-tools.mjs';
 import { brandedEnvValue } from './branding.mjs';
-import { createBasDestinationRelay } from './bas-destination-relay.mjs';
 import { diagnosticText, redactText } from './redact.mjs';
 
 const JSONRPC = '2.0';
@@ -167,12 +166,6 @@ function closeDestinationRoute(destination) {
   return closedRoutes.get(destination);
 }
 
-function useBasDestinationRelay(destination, env = process.env) {
-  if (String(brandedEnvValue(env, 'DISABLE_BAS_RELAY') || '').toLowerCase() === 'true') return false;
-  if (destination.source === 'cloud-foundry') return false;
-  if (!destination.authentication) return false;
-  return Boolean(destination.url && String(destination.url).includes('.dest'));
-}
 
 function useProxyAuthentication(destination) {
   return destination.source !== 'cloud-foundry' || destination.authentication === 'PrincipalPropagation';
@@ -190,17 +183,6 @@ function childEnvironment(destination, env) {
       'SAP_SAML_AUTH', 'SAP_SAML_USER', 'SAP_SAML_PASSWORD', 'SAP_CREDENTIAL_CMD'
     ]) childEnv[key] = '';
   }
-  // The VSP child must reach the local BAS relay directly, never through the
-  // BAS .dest proxy. Without a loopback exception every child request would
-  // be double-proxied and the relay's session pairing could never apply.
-  if (destination.relay) {
-    const loopback = '127.0.0.1,localhost';
-    for (const key of ['NO_PROXY', 'no_proxy']) {
-      const entries = String(childEnv[key] || '').split(',').map(value => value.trim()).filter(Boolean);
-      for (const host of loopback.split(',')) if (!entries.some(entry => entry.toLowerCase() === host)) entries.push(host);
-      childEnv[key] = entries.join(',');
-    }
-  }
   return childEnv;
 }
 
@@ -245,14 +227,12 @@ class Child {
     this.process.on('error', error => {
       if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] VSP child process error: ${diagnosticText(error.message)}`);
       this.fail(error);
-      // Relay routes survive child crashes so self-healing restarts can reuse
-      // them; they are closed by the proxy shutdown path instead.
-      if (!destination.relay) void closeDestinationRoute(destination);
+      void closeDestinationRoute(destination);
     });
     this.process.on('exit', (code, signal) => {
       if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] VSP child exited (${code ?? signal})`);
       this.fail(new Error(`child exited (${code ?? signal})`));
-      if (!destination.relay) void closeDestinationRoute(destination);
+      void closeDestinationRoute(destination);
     });
   }
 
@@ -442,34 +422,10 @@ export class MCPProxy {
     if (this.started) return this;
     this.started = true;
     this.starting = (async () => {
-      // Destinations start concurrently (relay bind + child spawn); children
-      // are assembled in destination order, which keeps serverInfo's
-      // children[0] fallback and merged slug numbering deterministic.
-      const started = await Promise.all(this.destinations.map(originalDestination => (async () => {
-        let destination = originalDestination;
-        let relay;
+      // Destinations start concurrently and are assembled in destination order,
+      // keeping serverInfo's children[0] fallback and merged slug numbering deterministic.
+      const started = await Promise.all(this.destinations.map(destination => (async () => {
         try {
-          if (useBasDestinationRelay(originalDestination, this.env)) {
-            relay = createBasDestinationRelay(originalDestination, { env: this.env, log: message => this.eventSink(message) });
-            const originalClose = originalDestination.close;
-            const relayUrl = await relay.ready;
-            destination = {
-              ...originalDestination,
-              url: relayUrl,
-              relay: {
-                probeCsrfSession: relay.probeCsrfSession,
-                stats: relay.stats
-              },
-              async close() {
-                try {
-                  await originalClose?.();
-                } finally {
-                  await relay.close();
-                }
-              }
-            };
-            this.eventSink(`[${originalDestination.name}] BAS destination relay enabled (${relayUrl})`);
-          }
           this.eventSink(`[${destination.name}] starting VSP child (client=${destination.client || '001'})`);
           return {
             destination,
@@ -477,8 +433,6 @@ export class MCPProxy {
           };
         } catch (error) {
           this.eventSink(`[${destination.name}] failed to start child: ${diagnosticText(error.message)}`, 'error');
-          // A relay whose ready promise rejected still owns dispatchers.
-          if (relay && destination === originalDestination) await relay.close().catch(() => {});
           void closeDestinationRoute(destination);
           return null;
         }

package/src/bas-destination-relay.mjs

@@ -1,377 +0,0 @@
-import http from 'node:http';
-import { fetch as undiciFetch, ProxyAgent } from 'undici';
-import { CookieJar } from 'tough-cookie';
-import { brandedEnvValue } from './branding.mjs';
-import { redactText } from './redact.mjs';
-
-const DEFAULT_PROXY = 'http://127.0.0.1:8887';
-const MAX_BODY_BYTES = 64 * 1024 * 1024;
-const HOP_BY_HOP = new Set([
-  'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
-  'proxy-connection', 'te', 'trailer', 'transfer-encoding', 'upgrade', 'host'
-]);
-const UNSAFE = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
-// SAP ties CSRF tokens to the session that fetched them. The BAS .dest proxy
-// authenticates each hop, so the relay pairs every token with the exact
-// Set-Cookie state SAP returned alongside it and replays both on the unsafe
-// request. Without this pairing SAP sees a token from a foreign session and
-// answers "CSRF token validation failed" with HTTP 403.
-// Tokens are session-scoped, not path-scoped, but SAP only issues them from
-// GET-capable endpoints. POST-only services (ADT data preview among them)
-// answer a same-path token fetch with 4xx, so the relay always fetches from
-// the GET-friendly discovery endpoint and accepts that session's token for
-// unsafe requests to any path.
-const CSRF_FETCH_PATH = '/sap/bc/adt/discovery';
-const TOKEN_TTL_MS = 15 * 60 * 1000;
-const DEFAULT_MAX_TOKEN_FAILURES = 3;
-const MAX_CONFIGURED_TOKEN_FAILURES = 10;
-const MAX_TUNNEL_FALLBACKS = 2;
-// Carrying a POST's content-length on the token-fetch GET would make the
-// proxy wait for a body that never arrives, so the relay drops body headers.
-const BODY_HEADERS = new Set(['content-length', 'content-type']);
-// The forwarded request's content-length must describe the body undici is
-// about to send. Forwarding the inbound value alongside a re-buffered body
-// makes undici reject the request (UND_ERR_INVALID_ARG), so it is always
-// recomputed from the actual payload.
-const LENGTH_HEADERS = new Set(['content-length', 'transfer-encoding']);
-// undici transparently decompresses gzip/deflate/br responses but keeps the
-// content-encoding header, so forwarding the client's accept-encoding would
-// hand VSP a "gzip" body that is actually plain bytes. Dropping the header
-// lets undici request identity encoding and keeps bodies consistent.
-const ENCODING_HEADERS = new Set(['accept-encoding', 'content-encoding']);
-
-function headersFrom(requestHeaders, extra = {}) {
-  const headers = {};
-  for (const [name, value] of Object.entries(requestHeaders || {})) {
-    const lower = name.toLowerCase();
-    if (HOP_BY_HOP.has(lower) || LENGTH_HEADERS.has(lower) || ENCODING_HEADERS.has(lower)) continue;
-    if (value !== undefined) headers[name] = Array.isArray(value) ? value.join(', ') : String(value);
-  }
-  return { ...headers, ...extra };
-}
-
-function fetchHeaders(requestHeaders, extra = {}) {
-  const headers = {};
-  for (const [name, value] of Object.entries(requestHeaders || {})) {
-    const lower = name.toLowerCase();
-    if (HOP_BY_HOP.has(lower) || BODY_HEADERS.has(lower) || ENCODING_HEADERS.has(lower)) continue;
-    if (value !== undefined) headers[name] = Array.isArray(value) ? value.join(', ') : String(value);
-  }
-  return { ...headers, ...extra };
-}
-
-function tunnelFailure(status) {
-  // 502/504 from the proxy itself means the absolute-form .dest request is
-  // being refused; worth retrying through a CONNECT tunnel.
-  return status === 502 || status === 504;
-}
-
-function csrfFailure(status, headers, body) {
-  return status === 403 && (
-    String(headers.get?.('x-csrf-token') || '').toLowerCase() === 'required' ||
-    String(body || '').toLowerCase().includes('csrf token validation failed')
-  );
-}
-
-function maxTokenFailures(env, log, destinationName) {
-  const configured = brandedEnvValue(env, 'MAX_CSRF_RETRIES');
-  if (configured === undefined || configured === '') return DEFAULT_MAX_TOKEN_FAILURES;
-  const parsed = Number(configured);
-  if (!Number.isSafeInteger(parsed) || parsed < 0) {
-    log(`[${destinationName}] invalid CSRF retry setting; using the default of ${DEFAULT_MAX_TOKEN_FAILURES}`);
-    return DEFAULT_MAX_TOKEN_FAILURES;
-  }
-  return Math.min(parsed, MAX_CONFIGURED_TOKEN_FAILURES);
-}
-
-function copyCookieJar(jar) {
-  return CookieJar.deserializeSync(jar.serializeSync());
-}
-
-async function cookieHeader(jar, target) {
-  return await jar.getCookieString(target.href) || undefined;
-}
-
-async function seedRequestCookies(jar, requestCookie, target) {
-  for (const pair of String(requestCookie || '').split(';')) {
-    const separator = pair.indexOf('=');
-    if (separator <= 0) continue;
-    const name = pair.slice(0, separator).trim();
-    const value = pair.slice(separator + 1).trim();
-    if (!name) continue;
-    try {
-      await jar.setCookie(`${name}=${value}; Path=/`, target.href, { ignoreError: true });
-    } catch {
-      // Invalid caller-provided cookie fragments are ignored; SAP response
-      // cookies remain authoritative for the destination session.
-    }
-  }
-}
-
-async function recordCookies(jar, headers, target, log, destinationName) {
-  const values = headers.getSetCookie?.() || (headers.get('set-cookie') ? [headers.get('set-cookie')] : []);
-  for (const value of values) {
-    try {
-      await jar.setCookie(String(value), target.href, { ignoreError: true });
-    } catch {
-      log(`[${destinationName}] BAS relay ignored an invalid Set-Cookie header`);
-    }
-  }
-}
-
-async function readRequestBody(req) {
-  const chunks = [];
-  let size = 0;
-  for await (const chunk of req) {
-    size += chunk.length;
-    if (size > MAX_BODY_BYTES) throw new Error('request body is too large for BAS destination relay');
-    chunks.push(chunk);
-  }
-  return Buffer.concat(chunks);
-}
-
-export function createBasDestinationRelay(destination, { env = process.env, fetchImpl = undiciFetch, log = () => {} } = {}) {
-  if (!destination?.url) throw new Error('Destination relay requires a BAS destination URL');
-  const base = new URL(destination.url);
-  const cookieBase = destination.backendUrl
-    ? new URL(String(destination.backendUrl))
-    : (() => {
-        const target = new URL(base);
-        // BAS .dest URLs are local HTTP routing aliases for SAP backends that
-        // are commonly HTTPS. Use a secure cookie context when BAS metadata
-        // omits the backend URL so Secure session cookies are not discarded.
-        if (target.protocol === 'http:' && /\.dest$/i.test(target.hostname)) target.protocol = 'https:';
-        return target;
-      })();
-  // BAS destinations must keep their configured .dest route and authentication.
-  // Proxy resolution: an explicitly configured proxy wins (an explicit empty
-  // value means "go direct"). Without configuration, BAS virtual .dest hosts
-  // imply the default BAS proxy; any other host (tests, direct URLs) is
-  // reached directly so the relay never routes loopback traffic through a
-  // foreign proxy.
-  const brandedProxy = brandedEnvValue(env, 'HTTP_PROXY');
-  const explicitProxy = brandedProxy !== undefined ? brandedProxy : (env.HTTP_PROXY ?? env.http_proxy);
-  const proxyUrl = explicitProxy !== undefined ? String(explicitProxy) : (/\.dest$/i.test(base.hostname) ? DEFAULT_PROXY : '');
-  const dispatcher = proxyUrl ? new ProxyAgent({ uri: proxyUrl, proxyTunnel: false }) : undefined;
-  // Self-healing mode 2: if the BAS proxy refuses absolute-form proxied
-  // requests (its own 502/504), retry through a CONNECT tunnel so the relay
-  // keeps working through the same egress.
-  const tunnelDispatcher = proxyUrl ? new ProxyAgent({ uri: proxyUrl, proxyTunnel: true }) : undefined;
-  let tunneled = false;
-  // Observable self-healing counters, surfaced by --doctor and tests.
-  const stats = { requests: 0, csrfFetches: 0, csrfRetries: 0, csrfSessionFailures: 0, tunnelFallbacks: 0, direct: false, proxyTunnel: false };
-  const maxFailures = maxTokenFailures(env, log, destination.name);
-  // The shared jar captures SAP cookies from safe reads as well as CSRF fetches.
-  // Each cached token gets its own snapshot so later responses cannot silently
-  // pair an old token with a different session.
-  const sharedCookieJar = new CookieJar();
-  const tokenCache = new Map();
-  const tokenFetches = new Map();
-
-  function resolveCookieTarget(target) {
-    return new URL(`${target.pathname}${target.search}`, cookieBase);
-  }
-
-  async function send(target, method, headers, body) {
-    const useTunnel = tunneled && tunnelDispatcher;
-    return fetchImpl(target, {
-      method,
-      headers,
-      body: body?.length ? body : undefined,
-      ...(useTunnel ? { dispatcher: tunnelDispatcher } : dispatcher ? { dispatcher } : {})
-    });
-  }
-
-  // Try absolute-form first; on transport errors or proxy-level failures,
-  // flip to tunneled mode once and retry (sticky for later requests).
-  async function sendWithFallback(target, method, headers, body) {
-    if (tunneled) return send(target, method, headers, body);
-    try {
-      const response = await send(target, method, headers, body);
-      if (!tunnelFailure(response.status)) return response;
-      log(`[${destination.name}] BAS relay proxy returned HTTP ${response.status} for ${target.pathname}; switching to proxy tunnel`);
-    } catch (error) {
-      log(`[${destination.name}] BAS relay absolute-form request failed for ${target.pathname} (${error.message}); switching to proxy tunnel`);
-    }
-    tunneled = true;
-    stats.tunnelFallbacks += 1;
-    return send(target, method, headers, body);
-  }
-
-  async function fetchTokenFresh(requestHeaders) {
-    const key = CSRF_FETCH_PATH;
-    stats.csrfFetches += 1;
-    const target = new URL(CSRF_FETCH_PATH, base);
-    const cookieTarget = resolveCookieTarget(target);
-    const jar = copyCookieJar(sharedCookieJar);
-    await seedRequestCookies(jar, requestHeaders.cookie, cookieTarget);
-    const outgoingCookie = await cookieHeader(jar, cookieTarget);
-    const response = await sendWithFallback(target, 'GET', fetchHeaders(requestHeaders, {
-      'x-csrf-token': 'Fetch',
-      accept: requestHeaders.accept || 'application/xml,*/*',
-      ...(outgoingCookie ? { cookie: outgoingCookie } : {})
-    }));
-    await response.arrayBuffer().catch(() => undefined);
-    const token = response.headers.get('x-csrf-token');
-    await recordCookies(jar, response.headers, cookieTarget, log, destination.name);
-    await recordCookies(sharedCookieJar, response.headers, cookieTarget, log, destination.name);
-    const cookies = await jar.getCookies(cookieTarget.href);
-    const session = {
-      token: response.ok && token && token.toLowerCase() !== 'required' ? token : null,
-      jar,
-      fetchedAt: Date.now(),
-      httpStatus: response.status,
-      cookieCount: cookies.length
-    };
-    if (session.token) tokenCache.set(key, session);
-    return session;
-  }
-
-  async function fetchToken(requestHeaders = {}) {
-    const key = CSRF_FETCH_PATH;
-    const cached = tokenCache.get(key);
-    if (cached && Date.now() - cached.fetchedAt < TOKEN_TTL_MS) return cached;
-    const pending = tokenFetches.get(key);
-    if (pending) return pending;
-    const fetching = fetchTokenFresh(requestHeaders);
-    tokenFetches.set(key, fetching);
-    try {
-      return await fetching;
-    } finally {
-      if (tokenFetches.get(key) === fetching) tokenFetches.delete(key);
-    }
-  }
-
-  async function probeCsrfSession() {
-    const session = await fetchToken({ accept: 'application/xml,text/xml,*/*' });
-    return {
-      httpStatus: session?.httpStatus || 0,
-      tokenReceived: Boolean(session?.token),
-      cookieCount: session?.cookieCount || 0,
-      // A token alone makes unsafe requests viable: BAS proxy routes deliver
-      // tokens but strip cookies, and the backend accepts the token on the
-      // proxy-established Basic-auth session. cookieCount stays reported for
-      // diagnosis; setup's override validation requires cookies separately.
-      sessionUsable: Boolean(session?.token)
-    };
-  }
-
-
-  async function forward(method, requestUrl, requestHeaders, body, session) {
-    const target = requestUrl;
-    const cookieTarget = resolveCookieTarget(target);
-    const cookieJar = session?.jar || sharedCookieJar;
-    if (!session) await seedRequestCookies(cookieJar, requestHeaders.cookie, cookieTarget);
-    const sessionCookie = await cookieHeader(cookieJar, cookieTarget);
-    const headers = headersFrom(requestHeaders, {
-      ...(session?.token ? { 'x-csrf-token': session.token } : {}),
-      ...(sessionCookie ? { cookie: sessionCookie } : {})
-    });
-    const response = await sendWithFallback(target, method, headers, body);
-    const responseBody = Buffer.from(await response.arrayBuffer());
-    if (session) await recordCookies(session.jar, response.headers, cookieTarget, log, destination.name);
-    await recordCookies(sharedCookieJar, response.headers, cookieTarget, log, destination.name);
-    return { response, body: responseBody };
-  }
-
-  // Self-healing mode 1: when SAP rejects a token (expired, rotated, or
-  // invalidated server-side), drop the cached session and retry with a
-  // freshly fetched token paired with its own cookies. Bounded retries keep
-  // a failing destination from looping forever.
-  async function forwardWithRetry(method, requestUrl, requestHeaders, body, failures = 0) {
-    const unsafe = UNSAFE.has(method);
-    const session = unsafe ? await fetchToken(requestHeaders) : null;
-    if (unsafe && !session?.token) {
-      stats.csrfSessionFailures += 1;
-      const message = `BAS destination relay could not obtain a CSRF token for ${requestUrl.pathname}; no unsafe request was sent`;
-      log(`[${destination.name}] ${message}`);
-      const status = session?.httpStatus >= 400 ? session.httpStatus : 503;
-      const response = new Response(message, { status, headers: { 'content-type': 'text/plain; charset=utf-8' } });
-      return { response, body: Buffer.from(message) };
-    }
-    // A token without cookies is still sent: BAS proxy routes deliver tokens
-    // but strip Set-Cookie, and the backend accepts the token on the Basic-
-    // auth session the proxy establishes per hop. A retry cannot help there
-    // (a fresh token still arrives cookie-less), so a CSRF rejection on a
-    // cookie-less session is surfaced instead of retried.
-    const tokenOnly = unsafe && !session.cookieCount;
-    const { response, body: responseBody } = await forward(method, requestUrl, requestHeaders, body, session);
-    const rejected = csrfFailure(response.status, response.headers, responseBody);
-    if (unsafe && rejected && !tokenOnly && failures < maxFailures) {
-      log(`[${destination.name}] BAS relay CSRF session rejected for ${requestUrl.pathname}; re-establishing token and session (attempt ${failures + 1}/${maxFailures})`);
-      stats.csrfRetries += 1;
-      tokenCache.delete(CSRF_FETCH_PATH);
-      return forwardWithRetry(method, requestUrl, requestHeaders, body, failures + 1);
-    }
-    if (unsafe && rejected && tokenOnly) {
-      log(`[${destination.name}] BAS relay CSRF token rejected without a session cookie for ${requestUrl.pathname}; not retried (the configured destination route delivered no cookies)`);
-    } else if (unsafe && rejected && failures >= maxFailures) {
-      log(`[${destination.name}] BAS relay stopped after ${maxFailures} CSRF session retries for ${requestUrl.pathname}`);
-    }
-    return { response, body: responseBody };
-  }
-
-  const server = http.createServer((req, res) => {
-    void (async () => {
-      const method = String(req.method || 'GET').toUpperCase();
-      const requestUrl = new URL(req.url || '/', base);
-      stats.requests += 1;
-      const body = UNSAFE.has(method) ? await readRequestBody(req) : Buffer.alloc(0);
-      const { response, body: responseBody } = await forwardWithRetry(method, requestUrl, req.headers, body);
-      const responseHeaders = {};
-      // SAP sessions commonly set several cookies at once; a plain object
-      // assignment would collapse them to the last value. undici exposes the
-      // full list via getSetCookie, and Node's http server serializes an
-      // array as repeated headers.
-      const setCookies = response.headers.getSetCookie?.() || [];
-      if (setCookies.length) responseHeaders['set-cookie'] = setCookies;
-      for (const [name, value] of response.headers) {
-        const lower = name.toLowerCase();
-        // undici decompresses response bodies; the stale content-encoding and
-        // content-length would misdescribe the plain bytes handed to VSP.
-        if (lower === 'set-cookie' || HOP_BY_HOP.has(lower) || lower === 'content-encoding' || lower === 'content-length') continue;
-        responseHeaders[name] = value;
-      }
-      responseHeaders['x-sap-ai-dev-toolkit-relay'] = 'bas-destination';
-      res.writeHead(response.status, response.statusText, responseHeaders);
-      res.end(responseBody);
-    })().catch(error => {
-      if (!res.headersSent) res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8', 'connection': 'close' });
-      // Proxy and transport errors can embed the full proxy URL including
-      // userinfo; redact before the body reaches the child (and the tool result).
-      res.end(`BAS destination relay failed: ${redactText(error.message)}\n`);
-    });
-  });
-
-  // Keep an error listener for the server's whole lifetime: after listen()
-  // succeeds, a later 'error' event (port collision cleanup, socket reset)
-  // with no listener would be an uncaught exception that kills the process.
-  server.on('error', error => {
-    log(`[${destination.name}] BAS relay server error: ${redactText(error.message)}`);
-  });
-  // Bind eagerly and report the real port through `ready`. Callers must
-  // await `ready` before handing the URL to a VSP child; binding failures
-  // surface as a rejected promise instead of a silently wrong guessed port.
-  const listening = new Promise((resolve, reject) => {
-    server.once('error', reject);
-    server.listen(0, '127.0.0.1', () => {
-      server.removeListener('error', reject);
-      resolve(server.address().port);
-    });
-  });
-  const ready = listening.then(port => `http://127.0.0.1:${port}`).catch(error => {
-    log(`[${destination.name}] BAS relay failed to start: ${error.message}`);
-    throw error;
-  });
-  return {
-    ready,
-    stats,
-    probeCsrfSession,
-    close: async () => {
-      await dispatcher?.close?.();
-      await tunnelDispatcher?.close?.();
-      server.closeAllConnections?.();
-      await new Promise(resolve => server.close(() => resolve()));
-    }
-  };
-}