sap-ai-dev-toolkit 0.7.5 → 0.7.9

package/README.md

@@ -15,7 +15,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/badge/SAP-Business%20Application%20Studio-0A6ED1?style=flat-square&logo=sap&logoColor=white" alt="SAP Business Application Studio">
-  <img src="https://img.shields.io/badge/AI%20agents-Copilot%20%7C%20Claude%20%7C%20Codex%20%7C%20Cursor%20%7C%20Gemini%20%7C%20opencode-000000?style=flat-square" alt="Works with GitHub Copilot, Claude Code, OpenAI Codex, Cursor, Gemini CLI, and opencode">
+  <img src="https://img.shields.io/badge/AI%20agents-Copilot%20%7C%20Claude%20%7C%20Codex%20%7C%20Cursor%20%7C%20Gemini%20%7C%20opencode%20%7C%20Pi-000000?style=flat-square" alt="Works with GitHub Copilot, Claude Code, OpenAI Codex, Cursor, Gemini CLI, opencode, and Pi Coding Agent">
   <img src="https://img.shields.io/badge/MCP-enabled-7B61FF?style=flat-square" alt="MCP enabled">
   <img src="https://img.shields.io/badge/SAP%20ADT-connected-0A6ED1?style=flat-square&logo=sap&logoColor=white" alt="SAP ADT connected">
   <img src="https://img.shields.io/badge/ABAP-CDS%20%7C%20RAP-EA4AAA?style=flat-square" alt="ABAP CDS RAP">
@@ -52,13 +52,13 @@ To also add optional full-stack SAP companion MCP servers for Fiori, UI5, CAP, a
 sap-ai-dev --setup --tools
 ```
 
-Then connect a destination in SAP Business Application Studio:
+Then connect a destination in SAP Business Application Studio, or run the same setup locally to discover SAP GUI systems and create VS Code MCP entries:
 
 1. Open the Command Palette.
 2. Run **MCP: List Servers**.
-3. Start the server named after your selected BAS destination (the lowercase slug, for example `demo-abap` for destination `DEMO_ABAP`).
-4. In your AI assistant's chat, choose the best-fit bundled agent from the agent picker (GitHub Copilot, Claude Code, and opencode install the agents): **SAP Solution Architect**, **ABAP Developer**, **ABAP Runtime Debugger**, **RAP Service Developer**, or **HANA Cloud/HDI Specialist**.
-5. In the Chat tools picker, enable the server for that BAS destination.
+3. Start the server named after your selected destination (the lowercase slug, for example `demo-abap` for destination `DEMO_ABAP`).
+4. In your AI assistant's chat, choose the best-fit bundled agent from the agent picker (GitHub Copilot, Claude Code, and opencode install the agents) or invoke the matching Pi prompt template (`/sap-solution-architect`, `/abap-developer`, `/abap-runtime-debugger`, `/rap-service-developer`, or `/hana-cloud-hdi-specialist`): **SAP Solution Architect**, **ABAP Developer**, **ABAP Runtime Debugger**, **RAP Service Developer**, or **HANA Cloud/HDI Specialist**.
+5. In the Chat tools picker, enable the server for that destination.
 6. Ask the agent to inspect, build, test, or verify something in your SAP landscape.
 
 Use the attached destination-prefixed tools directly in chat. Do not launch `sap-ai-dev` or handcraft MCP JSON-RPC in a terminal to discover or call them.
@@ -67,7 +67,7 @@ Use the attached destination-prefixed tools directly in chat. Do not launch `sap
 
 ## 🤖 Available agents and skills
 
-**Agents:** Five user-invocable custom agents are included. Select the best fit from the agent picker in your harness's chat (GitHub Copilot, Claude Code, or opencode), as shown in Quick start.
+**Agents:** Five user-invocable custom agents are included. Select the best fit from the agent picker in your harness's chat (GitHub Copilot, Claude Code, or opencode), or use the matching Pi prompt command, as shown in Quick start.
 
 | | Agent | Best for |
 | --- | --- | --- |
@@ -79,7 +79,7 @@ Use the attached destination-prefixed tools directly in chat. Do not launch `sap
 
 **Included skills:** `abap-development` · `abap-testing-quality` · `cds-development` · `rap-development` · `abap-debugging` · `abap-runtime-analysis` · `rap-service-delivery` · `sap-standard-api-analysis` · `clean-core-extensibility` · `sap-sdlc-orchestration` · `sap-transport-release` · `hana-cloud-inspection` · `hana-cloud-native-development` · `hana-cloud-validation`
 
-Agents and skills install for the harnesses you pick during global installation: a multi-select offers GitHub Copilot and Claude Code pre-checked, plus OpenAI Codex, Cursor, Gemini CLI, and opencode. In non-interactive installs they are installed for GitHub Copilot only. Repository-scoped installation instructions appear below.
+Agents and skills install for the harnesses you pick during global installation: a multi-select offers GitHub Copilot and Claude Code pre-checked, plus OpenAI Codex, Cursor, Gemini CLI, opencode, and Pi Coding Agent. In non-interactive installs they are installed for GitHub Copilot only. Repository-scoped installation instructions appear below.
 
 ## ✨ Your SAP development cockpit, inside your AI assistant
 
@@ -236,13 +236,13 @@ Once the destination server is enabled in your chat's tools picker, ask for outc
 | 🔒 **SAP authorization remains authoritative** | The add-on does not bypass backend SAP permissions. |
 | 🚚 **Curated VSP tool surface** | The proxy exposes the same curated developer-lifecycle set for every destination, plus local workflow tools; SAP authorizations and VSP safety checks still apply. |
 | 🧱 **Per-destination isolation** | Generated MCP entries are scoped to a single `SAP_AI_DEV_TOOLKIT_DESTINATION`. |
-| 🔑 **No credentials in `mcp.json`** | Authentication material stays in BAS destination configuration rather than MCP config. |
+| 🔑 **Credential-aware setup** | BAS authentication material stays in Destination configuration. Local SAP GUI setup writes VS Code input prompts for SAP user/password instead of raw credentials. |
 
 <a id="install"></a>
 
 ## 📦 Installation
 
-Install globally from a BAS dev space:
+Install globally from SAP Business Application Studio or from a local workstation with SAP GUI installed:
 
 ```sh
 npm install --global sap-ai-dev-toolkit
@@ -270,18 +270,20 @@ The installer handles VSP provisioning automatically:
 - Uses the package's bundled patched VSP binary for the current platform, verified against the npm-published `dist/checksums.txt`. A checksum-anchored remote download is the fallback only when the package has no bundled asset.
 - No Go toolchain is downloaded or required at install time; Go is only used by the repository's own `build:vsp` development script.
 
-With `H2O_URL` set, an interactive install opens a checkbox picker with no destinations selected by default. Use **Space** to choose destinations and **Enter** to confirm. Press **a** to toggle all destinations (select all if any are unchecked; otherwise clear the selection). Confirming with none selected removes this add-on's managed MCP entries. When the `cf` CLI 8.18 or newer is authenticated to a targeted space, setup first offers an optional import from that space's Destination service; type **y** then **Enter** to include it, or press **Enter** to skip. Accepted CF and BAS destinations appear together in the picker. npm may run its install hook without an interactive terminal, even when the shell is interactive; in that case, selection is skipped without changing MCP config.
+Setup detects where it is running. With `H2O_URL` set, it treats the environment as SAP Business Application Studio and opens a checkbox picker for BAS destinations, with no destinations selected by default. Use **Space** to choose destinations and **Enter** to confirm. Press **a** to toggle all destinations (select all if any are unchecked; otherwise clear the selection). Confirming with none selected removes this add-on's managed MCP entries. When the `cf` CLI 8.18 or newer is authenticated to a targeted space, setup first offers an optional import from that space's Destination service; type **y** then **Enter** to include it, or press **Enter** to skip. Accepted CF and BAS destinations appear together in the picker.
 
+Without `H2O_URL`, interactive setup looks for local SAP GUI system configuration on macOS and Windows (for example SAP GUI landscape XML and `saplogon.ini`). SAP GUI landscape files describe SAP GUI/DIAG connectivity, not the ADT HTTP(S) endpoint, so setup asks you to confirm the ADT URL for each selected system. The generated MCP entry uses VS Code input prompts for the SAP user and password at server start; raw SAP credentials are not stored in `mcp.json`. On Windows, setup can instead write an experimental `SAP_AUTH_MODE=windows-sso` entry without username/password prompts; this requires the ADT endpoint to support HTTP Negotiate/SPNEGO. Runtime uses the bundled Windows Negotiate helper by default, or a trusted custom helper configured with `SAP_AI_DEV_TOOLKIT_NEGOTIATE_HELPER`. npm may run its install hook without an interactive terminal, even when the shell is interactive; in that case, destination selection is skipped without changing MCP config.
 
-The same postinstall offers the bundled agents and skills for several AI coding harnesses in a checkbox picker. **GitHub Copilot** and **Claude Code** start pre-checked, so pressing **Enter** alone installs both; **Space** selects or deselects a harness, **a** toggles all six, and confirming with none selected skips the step without changing files. With no interactive terminal, the assets are installed for GitHub Copilot only; set `SAP_AI_DEV_TOOLKIT_HARNESSES` to a comma-separated list of harness ids (`github-copilot`, `claude-code`, `codex`, `cursor`, `gemini-cli`, `opencode`) to choose non-interactively.
+
+The same postinstall offers the bundled agents and skills for several AI coding harnesses in a checkbox picker. **GitHub Copilot** and **Claude Code** start pre-checked, so pressing **Enter** alone installs both; **Space** selects or deselects a harness, **a** toggles all seven, and confirming with none selected skips the step without changing files. When destination MCP setup succeeds, the generated managed MCP servers are also mirrored into selected harnesses that have a stable user-level JSON MCP configuration (Claude Code, Cursor, Gemini CLI, and Pi Coding Agent). GitHub Copilot continues to use the BAS/VS Code MCP configuration written during destination setup. With no interactive terminal, the assets are installed for GitHub Copilot only; set `SAP_AI_DEV_TOOLKIT_HARNESSES` to a comma-separated list of harness ids (`github-copilot`, `claude-code`, `codex`, `cursor`, `gemini-cli`, `opencode`, `pi-coding-agent`) to choose non-interactively.
 
 Some current npm versions also require install hooks to be approved. If npm reports that `sap-ai-dev-toolkit`'s `postinstall` was blocked, allow it during a fresh install with `npm install --global --allow-scripts=sap-ai-dev-toolkit sap-ai-dev-toolkit`, or run `sap-ai-dev --setup` from an interactive BAS terminal after installation.
 
 The setup report uses icons and terminal colors; set `NO_COLOR=1` to disable ANSI colors. The table is a weather report, not a bouncer: green **PASS** means the ADT probe responded, red **FAIL** means it failed, and yellow **SKIPPED** means it was skipped. Probe failures do not block MCP registration or startup for destinations you select.
 
-Run `sap-ai-dev --setup` later to change the destination selection or remove generated destination entries. Run `sap-ai-dev --setup --tools` to also choose optional companion tools. Use `--npx` to make generated BAS/VSP destination entries start the pinned package through npm instead of relying on a global `sap-ai-dev` command; companion tools already use `npx` with their own npm packages.
+Run `sap-ai-dev --setup` later to change the destination selection or remove generated destination entries. Run `sap-ai-dev --setup --tools` to also choose optional companion tools. Use `--npx` to make generated destination entries start the pinned package through npm instead of relying on a global `sap-ai-dev` command; companion tools already use `npx` with their own npm packages.
 
-If a setup step is skipped or fails, rerun it from an interactive BAS terminal:
+If a setup step is skipped or fails, rerun it from an interactive terminal:
 
 ```sh
 sap-ai-dev --setup
@@ -293,7 +295,7 @@ To configure without a global install, run the guided setup directly through npm
 npx --yes --ignore-scripts --package=sap-ai-dev-toolkit sap-ai-dev --setup --npx
 ```
 
-This lists discovered systems in the same checkbox picker, with nothing selected by default. Use **Space** to choose destinations, **Enter** to confirm, and **a** to toggle all (select all if any are unchecked; otherwise clear the selection). It writes MCP entries that launch the selected servers through npx. The entries pin the package version used during setup, and `--ignore-scripts` avoids running the install-time wizard a second time. After setup, in BAS run **MCP: List Servers**, select each chosen destination, and choose **Start Server**.
+This lists discovered systems in the same checkbox picker, with nothing selected by default. Use **Space** to choose destinations, **Enter** to confirm, and **a** to toggle all (select all if any are unchecked; otherwise clear the selection). It writes MCP entries that launch the selected servers through npx. The entries pin the package version used during setup, and `--ignore-scripts` avoids running the install-time wizard a second time. After setup, in BAS or VS Code run **MCP: List Servers**, select each chosen destination, and choose **Start Server**.
 
 For a non-interactive installation or a platform without a published VSP asset, provide a trusted binary override:
 
@@ -348,16 +350,19 @@ The package includes five user-invocable custom agents (**SAP Solution Architect
 
 After destination setup, the installer prints a 🤖 notice and a checkbox picker asking which AI coding harnesses should receive the bundled agents and skills. **Space** selects or deselects, **a** toggles all, **Enter** confirms. **GitHub Copilot** and **Claude Code** are pre-checked, so pressing **Enter** without changes installs both; confirming with none selected skips the step and leaves your files unchanged.
 
-| Harness | Skills land in | Agents land in |
-| --- | --- | --- |
-| GitHub Copilot | `$HOME/.copilot/skills/` | `$HOME/.copilot/agents/*.agent.md` |
-| Claude Code | `$HOME/.claude/skills/` | `$HOME/.claude/agents/<id>.md` (frontmatter reduced to `name` and `description`) |
-| OpenAI Codex | `$HOME/.agents/skills/` | — |
-| Cursor | `$HOME/.cursor/skills/` | — |
-| Gemini CLI | `$HOME/.gemini/skills/` | — |
-| opencode | `$XDG_CONFIG_HOME/opencode/skills/` (default `$HOME/.config/opencode/skills/`) | `$XDG_CONFIG_HOME/opencode/agents/<id>.md` (as subagents) |
+| Harness | Skills land in | Agents land in | MCP auto-wiring |
+| --- | --- | --- | --- |
+| GitHub Copilot | `$HOME/.copilot/skills/` | `$HOME/.copilot/agents/*.agent.md` | Uses the BAS/VS Code `mcp.json` written by destination setup |
+| Claude Code | `$HOME/.claude/skills/` | `$HOME/.claude/agents/<id>.md` (frontmatter reduced to `name` and `description`) | `$HOME/.claude.json` |
+| OpenAI Codex | `$HOME/.agents/skills/` | — | Not changed automatically |
+| Cursor | `$HOME/.cursor/skills/` | — | `$HOME/.cursor/mcp.json` |
+| Gemini CLI | `$HOME/.gemini/skills/` | — | `$HOME/.gemini/settings.json` |
+| opencode | `$XDG_CONFIG_HOME/opencode/skills/` (default `$HOME/.config/opencode/skills/`) | `$XDG_CONFIG_HOME/opencode/agents/<id>.md` (as subagents) | Not changed automatically |
+| Pi Coding Agent | `$PI_CODING_AGENT_DIR/skills/` (default `$HOME/.pi/agent/skills/`) | `$PI_CODING_AGENT_DIR/prompts/<id>.md` (as `/` prompt commands) | `$PI_CODING_AGENT_DIR/mcp.json` (default `$HOME/.pi/agent/mcp.json`) |
+
+All 14 skills use the portable `SKILL.md` format and are installed verbatim. The 5 agents use Copilot's `.agent.md` format, so they are installed as native custom agents for harnesses with a custom-agent mechanism (GitHub Copilot, Claude Code, opencode), with frontmatter adapted where needed. Pi receives equivalent prompt templates (`/abap-developer`, `/sap-solution-architect`, and so on) because Pi exposes reusable personas through prompts rather than a separate custom-agent file type. Selecting several harnesses duplicates the small markdown payloads on disk.
 
-All 14 skills use the portable `SKILL.md` format and are installed verbatim. The 5 agents use Copilot's `.agent.md` format, so they are only installed for harnesses with a custom-agent mechanism (GitHub Copilot, Claude Code, opencode), with frontmatter adapted where needed. Selecting several harnesses duplicates the small markdown payloads on disk.
+MCP auto-wiring preserves unrelated servers in each harness config and replaces only entries previously managed by `sap-ai-dev-toolkit`. Generated entries carry `SAP_AI_DEV_TOOLKIT_MANAGED=true` in their server environment so future reinstalls can reconcile them without touching user-owned MCP servers.
 
 These user-level customizations are available across workspaces opened by the same BAS user in the same dev space. The harness must be available in BAS and may need a window reload to discover new files. A non-interactive install skips the picker and installs for GitHub Copilot only; override with `SAP_AI_DEV_TOOLKIT_HARNESSES` (comma-separated harness ids). `npm install --ignore-scripts` skips the postinstall wizard entirely.
 
@@ -744,6 +749,8 @@ The response contains a `tools` array. A `RunQuery` entry resembles this excerpt
 | `SAP_AI_DEV_TOOLKIT_DESTINATION` | Comma-separated destination allowlist for normal runtime discovery. Setup clears this temporarily so it can display all eligible systems. |
 | `SAP_AI_DEV_TOOLKIT_MODE` | VSP child mode (`expert` by default; `focused` omits `ActivateMultiple`, `GetUserTransports`, and `GetTransportInfo`). The proxy exposes its curated tool subset and local workflow tools, including `LintABAP`. |
 | `SAP_ALLOW_TRANSPORTABLE_EDITS` | Generated MCP entries set this to `true` to permit source edits in transportable packages; VSP safety checks and SAP authorizations still apply. |
+| `SAP_AUTH_MODE=windows-sso` | Local SAP GUI entry mode for experimental Windows Integrated Authentication. Runtime starts a loopback ADT proxy and does not pass SAP username/password credentials to VSP. |
+| `SAP_AI_DEV_TOOLKIT_NEGOTIATE_HELPER` / `SAP_AI_DEV_TOOLKIT_SSPI_HELPER` | Optional trusted Windows helper executable used by the local Windows SSO proxy to convert an HTTP `WWW-Authenticate: Negotiate` challenge into a Kerberos/SPNEGO token. NTLM fallback is rejected because it is connection-oriented and unsafe for this proxy shape. When unset on Windows, the bundled PowerShell SSPI helper is used. A custom helper receives one JSON line on stdin (`url`, `challenge`, `mechanism`) and prints the base64 token on stdout. |
 | `SAP_AI_DEV_TOOLKIT_HTTP_PROXY` | Egress proxy for BAS discovery and probe traffic. Takes precedence over `HTTP_PROXY`/`http_proxy`; unset means the default BAS proxy for `.dest` hosts, empty means direct. |
 | `SAP_AI_DEV_TOOLKIT_REQUEST_TIMEOUT_MS` | Per-request timeout for calls forwarded to a VSP child (default 600000 = 10 minutes; `0` disables). A stalled request fails with a timeout error; the child is left running. |
 | `SAP_AI_DEV_MCP_CONFIG` | Explicit MCP configuration path; highest precedence. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.7.5",
+  "version": "0.7.9",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/scripts/postinstall.mjs

@@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url';
 import { installBinary } from '../src/binary.mjs';
 import { runSetup } from '../src/setup.mjs';
 import { installUserAssetsForHarnesses } from '../src/install-user-assets.mjs';
+import { installMcpServersForHarnesses } from '../src/harness-mcp-config.mjs';
 import { DEFAULT_HARNESS_IDS, HARNESSES, HARNESS_ENV_VAR, NON_INTERACTIVE_HARNESS_IDS, envHarnessSelection, harnessRoot } from '../src/harnesses.mjs';
 import { ReadStream as TTYReadStream, WriteStream as TTYWriteStream } from 'node:tty';
 import { homedir } from 'node:os';
@@ -87,7 +88,9 @@ async function installSelectedHarnessAssets(ids) {
   }
   for (const assets of results) {
     const installed = assets.installed + assets.updated;
-    await announce(`${assets.label}: ${installed} file${installed === 1 ? '' : 's'} installed or updated in ${assets.root}; ${assets.unchanged} already current.`, 'success');
+    const removed = assets.removed || 0;
+    const cleanup = removed > 0 ? `; ${removed} duplicate or legacy file${removed === 1 ? '' : 's'} removed` : '';
+    await announce(`${assets.label}: ${installed} file${installed === 1 ? '' : 's'} installed or updated in ${assets.root}; ${assets.unchanged} already current${cleanup}.`, 'success');
     if (assets.conflicts.length > 0) {
       const paths = assets.conflicts.map(path => join(assets.root, path)).join(', ');
       await announce(`${assets.label}: existing customizations were preserved; review these paths: ${paths}`, 'warning');
@@ -102,13 +105,13 @@ async function installSelectedHarnessAssets(ids) {
 async function runHarnessAssetInstall() {
   const home = process.env.HOME || homedir();
   const override = await resolveHarnessOverride();
-  await withInstallTerminal(async terminal => {
+  return withInstallTerminal(async terminal => {
     let selected = override;
     if (!terminal) {
       if (!selected) selected = NON_INTERACTIVE_HARNESS_IDS;
       await announce(`Installing bundled agents and skills for ${harnessSelectionLabels(selected)} by default because no interactive terminal is available.`, 'progress');
       await installSelectedHarnessAssets(selected);
-      return;
+      return selected;
     }
     if (!selected) selected = DEFAULT_HARNESS_IDS;
     await announce([
@@ -135,18 +138,40 @@ async function runHarnessAssetInstall() {
     } catch (error) {
       if (error.message === 'Prompt interrupted') {
         await announce('Bundled agents and skills were skipped because the prompt was interrupted. Your files were not changed.', 'info');
-        return;
+        return [];
       }
       throw error;
     }
     if (answer.length === 0) {
       await announce('Bundled agents and skills were skipped. Your files were not changed.', 'info');
-      return;
+      return [];
     }
     await installSelectedHarnessAssets(answer);
+    return answer;
   });
 }
 
+async function wireHarnessMcpServers(ids, servers) {
+  const entries = servers && Object.keys(servers).length ? servers : null;
+  if (!entries || !ids?.length) return;
+  const hasLocalSapGui = Object.values(entries).some(entry => entry?.env?.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'sap-gui-local');
+  if (hasLocalSapGui) {
+    await announce('Local SAP GUI MCP entries use VS Code input prompts for SAP login, so automatic wiring into non-VS Code harness MCP files was skipped. Configure those harnesses manually if they support secure runtime prompts.', 'info');
+    return;
+  }
+  const { results, failures } = await installMcpServersForHarnesses(ids, entries, { env: runtimeEnv });
+  for (const result of results) {
+    if (!result.supported) {
+      await announce(`${result.label}: MCP auto-wiring skipped. ${result.skipped}`, 'info');
+      continue;
+    }
+    await announce(`${result.label}: wired ${result.servers} MCP server${result.servers === 1 ? '' : 's'} in ${result.path}.`, 'success');
+  }
+  for (const failure of failures) {
+    await announce(`${failure.label}: MCP auto-wiring failed: ${failure.error.message}`, 'error');
+  }
+}
+
 
 function probeCell(destination) {
   const probe = destination.probe || {};
@@ -172,7 +197,7 @@ export function destinationTable(destinations, registeredNames) {
     const registered = registeredNames.has(generatedServerName(destination.serverName || destination.name));
     const source = destination.source === 'cloud-foundry'
       ? `CF ${destination.cf?.destinationInstanceName || 'unknown instance'}`
-      : 'BAS';
+      : (destination.source === 'sap-gui-local' ? 'SAP GUI' : 'BAS');
     return [
       { text: destination.name, output: destination.name },
       { text: source, output: source },
@@ -224,9 +249,10 @@ async function announceSetup(result) {
   const registeredNames = new Set(servers.map(([name]) => name));
   const entryDetails = servers.flatMap(([name, entry]) => {
     const destination = destinationsByServer.get(name);
-    const source = brandedEnvValue(entry.env, 'DESTINATION_SOURCE') === 'cloud-foundry' || destination?.source === 'cloud-foundry'
+    const configuredSource = brandedEnvValue(entry.env, 'DESTINATION_SOURCE') || destination?.source;
+    const source = configuredSource === 'cloud-foundry'
       ? 'Cloud Foundry'
-      : 'BAS';
+      : (configuredSource === 'sap-gui-local' ? 'Local SAP GUI' : 'BAS');
     const destinationName = brandedEnvValue(entry.env, 'DESTINATION') || destination?.name || 'unknown';
     const client = destination?.client || '001';
     const authentication = destination?.authentication || 'unknown';
@@ -291,11 +317,17 @@ async function main() {
     await announce('Rerun sap-ai-dev --setup.', 'info');
   }
 
+  let harnessIds = [];
   try {
-    await runHarnessAssetInstall();
+    harnessIds = await runHarnessAssetInstall();
   } catch (error) {
     await announce(`Bundled agent and skill installation failed: ${error.message}`, 'error');
   }
+  try {
+    if (setupCompleted) await wireHarnessMcpServers(harnessIds, setupResult?.servers);
+  } catch (error) {
+    await announce(`Harness MCP auto-wiring failed: ${error.message}`, 'error');
+  }
   if (setupCompleted) await announceSetup(setupResult);
 }
 if (process.argv[1] && realpathSync(fileURLToPath(import.meta.url)) === realpathSync(resolve(process.argv[1]))) {

package/scripts/windows-negotiate-helper.ps1

@@ -0,0 +1,182 @@
+# Windows Integrated Authentication helper for sap-ai-dev-toolkit.
+# Reads one JSON object from stdin with: url, challenge, mechanism.
+# Writes only the base64 Negotiate token to stdout.
+# Errors are written to stderr and exit non-zero.
+
+$ErrorActionPreference = 'Stop'
+
+$sspiSource = @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+
+public static class SapAiDevSspiNegotiate
+{
+    const int SECPKG_CRED_OUTBOUND = 2;
+    const int SECBUFFER_VERSION = 0;
+    const int SECBUFFER_TOKEN = 2;
+    const int SECURITY_NATIVE_DREP = 0x10;
+    const int SEC_E_OK = 0;
+    const int SEC_I_CONTINUE_NEEDED = 0x00090312;
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct SecHandle
+    {
+        public IntPtr dwLower;
+        public IntPtr dwUpper;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct SecBuffer
+    {
+        public int cbBuffer;
+        public int BufferType;
+        public IntPtr pvBuffer;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct SecBufferDesc
+    {
+        public int ulVersion;
+        public int cBuffers;
+        public IntPtr pBuffers;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct SECURITY_INTEGER
+    {
+        public uint LowPart;
+        public int HighPart;
+    }
+
+    [DllImport("secur32.dll", CharSet = CharSet.Unicode, SetLastError = false)]
+    static extern int AcquireCredentialsHandle(
+        string pszPrincipal,
+        string pszPackage,
+        int fCredentialUse,
+        IntPtr pvLogonID,
+        IntPtr pAuthData,
+        IntPtr pGetKeyFn,
+        IntPtr pvGetKeyArgument,
+        out SecHandle phCredential,
+        out SECURITY_INTEGER ptsExpiry);
+
+    [DllImport("secur32.dll", CharSet = CharSet.Unicode, SetLastError = false)]
+    static extern int InitializeSecurityContext(
+        ref SecHandle phCredential,
+        IntPtr phContext,
+        string pszTargetName,
+        int fContextReq,
+        int Reserved1,
+        int TargetDataRep,
+        IntPtr pInput,
+        int Reserved2,
+        out SecHandle phNewContext,
+        IntPtr pOutput,
+        out int pfContextAttr,
+        out SECURITY_INTEGER ptsExpiry);
+
+    [DllImport("secur32.dll", SetLastError = false)]
+    static extern int FreeCredentialsHandle(ref SecHandle phCredential);
+
+    [DllImport("secur32.dll", SetLastError = false)]
+    static extern int DeleteSecurityContext(ref SecHandle phContext);
+
+    static void Check(int status, string operation)
+    {
+        if (status == SEC_E_OK || status == SEC_I_CONTINUE_NEEDED) return;
+        throw new Win32Exception(status, operation + " failed with SSPI status 0x" + status.ToString("X8"));
+    }
+
+    static IntPtr BufferDesc(byte[] token, out IntPtr tokenMemory, out IntPtr bufferMemory)
+    {
+        tokenMemory = IntPtr.Zero;
+        SecBuffer buffer = new SecBuffer();
+        buffer.BufferType = SECBUFFER_TOKEN;
+        if (token != null && token.Length > 0)
+        {
+            tokenMemory = Marshal.AllocHGlobal(token.Length);
+            Marshal.Copy(token, 0, tokenMemory, token.Length);
+            buffer.cbBuffer = token.Length;
+            buffer.pvBuffer = tokenMemory;
+        }
+        bufferMemory = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(SecBuffer)));
+        Marshal.StructureToPtr(buffer, bufferMemory, false);
+        SecBufferDesc desc = new SecBufferDesc();
+        desc.ulVersion = SECBUFFER_VERSION;
+        desc.cBuffers = 1;
+        desc.pBuffers = bufferMemory;
+        IntPtr descMemory = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(SecBufferDesc)));
+        Marshal.StructureToPtr(desc, descMemory, false);
+        return descMemory;
+    }
+
+    static void FreeDesc(IntPtr descMemory, IntPtr tokenMemory, IntPtr bufferMemory)
+    {
+        if (descMemory != IntPtr.Zero) Marshal.FreeHGlobal(descMemory);
+        if (bufferMemory != IntPtr.Zero) Marshal.FreeHGlobal(bufferMemory);
+        if (tokenMemory != IntPtr.Zero) Marshal.FreeHGlobal(tokenMemory);
+    }
+
+    public static string CreateToken(string targetName, string incomingBase64)
+    {
+        SecHandle credential;
+        SECURITY_INTEGER expiry;
+        int status = AcquireCredentialsHandle(null, "Negotiate", SECPKG_CRED_OUTBOUND, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, out credential, out expiry);
+        Check(status, "AcquireCredentialsHandle");
+
+        SecHandle context = new SecHandle();
+        IntPtr inputDesc = IntPtr.Zero, inputToken = IntPtr.Zero, inputBuffer = IntPtr.Zero;
+        IntPtr outputDesc = IntPtr.Zero, outputToken = IntPtr.Zero, outputBuffer = IntPtr.Zero;
+        try
+        {
+            byte[] incoming = null;
+            if (!String.IsNullOrWhiteSpace(incomingBase64)) incoming = Convert.FromBase64String(incomingBase64);
+            if (incoming != null && incoming.Length > 0) inputDesc = BufferDesc(incoming, out inputToken, out inputBuffer);
+
+            outputDesc = BufferDesc(new byte[12288], out outputToken, out outputBuffer);
+            int attrs;
+            status = InitializeSecurityContext(ref credential, IntPtr.Zero, targetName, 0, 0, SECURITY_NATIVE_DREP, inputDesc, 0, out context, outputDesc, out attrs, out expiry);
+            Check(status, "InitializeSecurityContext");
+
+            SecBuffer outBuffer = (SecBuffer) Marshal.PtrToStructure(outputBuffer, typeof(SecBuffer));
+            if (outBuffer.cbBuffer <= 0 || outBuffer.pvBuffer == IntPtr.Zero) throw new Exception("SSPI returned an empty Negotiate token.");
+            byte[] bytes = new byte[outBuffer.cbBuffer];
+            Marshal.Copy(outBuffer.pvBuffer, bytes, 0, bytes.Length);
+            return Convert.ToBase64String(bytes);
+        }
+        finally
+        {
+            FreeDesc(inputDesc, inputToken, inputBuffer);
+            FreeDesc(outputDesc, outputToken, outputBuffer);
+            DeleteSecurityContext(ref context);
+            FreeCredentialsHandle(ref credential);
+        }
+    }
+}
+'@
+
+try {
+  $raw = [Console]::In.ReadToEnd()
+  if ([string]::IsNullOrWhiteSpace($raw)) { throw 'Missing helper request on stdin.' }
+  $request = $raw | ConvertFrom-Json
+  if (-not $request.url) { throw 'Missing target URL.' }
+
+  $uri = [Uri] [string] $request.url
+  if ($uri.Scheme -ne 'http' -and $uri.Scheme -ne 'https') { throw 'Target URL must use HTTP or HTTPS.' }
+  if ($uri.UserInfo) { throw 'Target URL must not contain user information.' }
+
+  Add-Type -TypeDefinition $sspiSource -Language CSharp
+
+  $incoming = $null
+  $challenge = [string] $request.challenge
+  if ($challenge -match '(?i)Negotiate\s+([^,\s]+)') { $incoming = $Matches[1] }
+  $targetName = 'HTTP/' + $uri.DnsSafeHost
+  $token = [SapAiDevSspiNegotiate]::CreateToken($targetName, $incoming)
+  if ([string]::IsNullOrWhiteSpace($token)) { throw 'Negotiate token generation returned an empty token.' }
+  [Console]::Out.WriteLine($token.Trim())
+  exit 0
+} catch {
+  [Console]::Error.WriteLine($_.Exception.Message)
+  exit 1
+}

package/src/harness-mcp-config.mjs

@@ -0,0 +1,122 @@
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { basename, dirname, join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { harnessById, harnessRoot } from './harnesses.mjs';
+
+const MANAGED_ENV = 'SAP_AI_DEV_TOOLKIT_MANAGED';
+
+function mcpServersPath(harness, { home = process.env.HOME || homedir(), env = process.env } = {}) {
+  switch (harness.id) {
+    case 'claude-code':
+      return join(home, '.claude.json');
+    case 'cursor':
+      return join(harnessRoot(harness, { home, env }), 'mcp.json');
+    case 'gemini-cli':
+      return join(harnessRoot(harness, { home, env }), 'settings.json');
+    case 'pi-coding-agent':
+      return join(harnessRoot(harness, { home, env }), 'mcp.json');
+    default:
+      return null;
+  }
+}
+
+async function readJsonConfig(path) {
+  let raw;
+  try {
+    raw = await readFile(path, 'utf8');
+  } catch (error) {
+    if (error.code === 'ENOENT') return {};
+    throw error;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error('top-level value is not an object');
+    return parsed;
+  } catch (error) {
+    throw new Error(`${path} contains invalid JSON: ${error.message}`);
+  }
+}
+
+async function writeJsonConfig(path, config) {
+  await mkdir(dirname(path), { recursive: true, mode: 0o755 });
+  const temporary = join(dirname(path), `.${basename(path)}.${process.pid}.${randomUUID()}.tmp`);
+  try {
+    await writeFile(temporary, `${JSON.stringify(config, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await rename(temporary, path);
+  } catch (error) {
+    await rm(temporary, { force: true }).catch(() => {});
+    throw error;
+  }
+}
+
+function isManagedServer(entry) {
+  if (!entry || typeof entry !== 'object') return false;
+  const env = entry.env;
+  return env && typeof env === 'object' && (
+    env[MANAGED_ENV] === 'true'
+    || typeof env.SAP_AI_DEV_TOOLKIT_DESTINATION === 'string'
+    || env.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry'
+  );
+}
+
+function toMcpServersEntry(entry) {
+  const converted = {};
+  if (entry?.type === 'stdio') converted.type = 'stdio';
+  if (typeof entry?.command === 'string') converted.command = entry.command;
+  if (Array.isArray(entry?.args)) converted.args = [...entry.args];
+  converted.env = entry?.env && typeof entry.env === 'object' && !Array.isArray(entry.env)
+    ? { ...entry.env, [MANAGED_ENV]: 'true' }
+    : { [MANAGED_ENV]: 'true' };
+  if (typeof entry?.cwd === 'string') converted.cwd = entry.cwd;
+  if (typeof entry?.description === 'string') converted.description = entry.description;
+  if (typeof entry?.displayName === 'string' && !converted.description) converted.description = entry.displayName;
+  return converted;
+}
+
+export function harnessMcpConfigPath(id, options = {}) {
+  return mcpServersPath(harnessById(id), options);
+}
+
+export async function installMcpServersForHarness({ harness, servers, home, env = process.env } = {}) {
+  const path = mcpServersPath(harness, { home, env });
+  if (!path) {
+    const skipped = harness.id === 'github-copilot'
+      ? 'GitHub Copilot uses the BAS/VS Code MCP configuration already written during destination setup.'
+      : 'No stable user-level MCP JSON config is known for this harness.';
+    return { harness: harness.id, label: harness.label, supported: false, skipped };
+  }
+  const config = await readJsonConfig(path);
+  const existing = config.mcpServers;
+  if (existing !== undefined && (!existing || typeof existing !== 'object' || Array.isArray(existing))) {
+    throw new Error(`${path} has a non-object mcpServers value`);
+  }
+  const mcpServers = { ...(existing || {}) };
+  for (const [name, entry] of Object.entries(mcpServers)) {
+    if (isManagedServer(entry)) delete mcpServers[name];
+  }
+  for (const [name, entry] of Object.entries(servers || {})) {
+    if (Object.hasOwn(mcpServers, name)) {
+      throw new Error(`MCP server "${name}" already exists and is not managed by sap-ai-dev-toolkit`);
+    }
+    mcpServers[name] = toMcpServersEntry(entry);
+  }
+  config.mcpServers = mcpServers;
+  await writeJsonConfig(path, config);
+  return { harness: harness.id, label: harness.label, supported: true, path, servers: Object.keys(servers || {}).length };
+}
+
+export async function installMcpServersForHarnesses(ids, servers, { home, env = process.env } = {}) {
+  const results = [];
+  const failures = [];
+  for (const id of ids) {
+    let harness;
+    try {
+      harness = harnessById(id);
+      results.push(await installMcpServersForHarness({ harness, servers, home, env }));
+    } catch (error) {
+      failures.push({ id, label: harness?.label || id, error });
+    }
+  }
+  return { results, failures };
+}

package/src/harnesses.mjs

@@ -31,6 +31,11 @@ export function agentMarkdownName(fileName) {
   return String(fileName).replace(/\.agent\.md$/, '.md');
 }
 
+export function piCodingAgentRoot({ home = process.env.HOME || homedir(), env = process.env } = {}) {
+  const override = typeof env?.PI_CODING_AGENT_DIR === 'string' ? env.PI_CODING_AGENT_DIR.trim() : '';
+  return override || join(home, '.pi', 'agent');
+}
+
 export function claudeCodeAgentDocument(source) {
   const frontmatter = splitFrontmatter(source);
   if (!frontmatter) throw new Error('unsupported agent frontmatter');
@@ -51,13 +56,35 @@ export function opencodeAgentDocument(source) {
   return renderDocument([{ key: 'description', value: description }, { key: 'mode', value: 'subagent' }], frontmatter.body);
 }
 
+export function piCodingAgentPromptDocument(source) {
+  const frontmatter = splitFrontmatter(source);
+  if (!frontmatter) throw new Error('unsupported agent frontmatter');
+  const name = requiredField(frontmatter.fields, 'name');
+  const description = requiredField(frontmatter.fields, 'description');
+  if (!name || !description) throw new Error('unsupported agent frontmatter');
+  const body = frontmatter.body
+    .replaceAll('from the Chat tools picker', 'from Pi\'s MCP tool context')
+    .replaceAll('the Chat tools picker', 'Pi\'s MCP tool context')
+    .replaceAll('current workspace and SAP MCP server', 'current workspace and configured SAP MCP server');
+  return renderDocument([
+    { key: 'description', value: `Use the ${name} SAP agent persona. ${description}` },
+    { key: 'argument-hint', value: '"[request]"' }
+  ], `Act as **${name}** for the following request. Follow these agent instructions and use relevant installed SAP skills when helpful.
+
+${body.trim()}
+
+User request: $ARGUMENTS
+`);
+}
+
 export const HARNESSES = [
   { id: 'github-copilot', label: 'GitHub Copilot', directory: '.copilot', supportsAgents: true, legacyManifest: true },
   { id: 'claude-code', label: 'Claude Code', directory: '.claude', supportsAgents: true, agentFileName: agentMarkdownName, agentDocument: claudeCodeAgentDocument },
   { id: 'codex', label: 'OpenAI Codex', directory: '.agents', supportsAgents: false },
   { id: 'cursor', label: 'Cursor', directory: '.cursor', supportsAgents: false },
   { id: 'gemini-cli', label: 'Gemini CLI', directory: '.gemini', supportsAgents: false },
-  { id: 'opencode', label: 'opencode', directory: 'opencode', configHome: true, supportsAgents: true, agentFileName: agentMarkdownName, agentDocument: opencodeAgentDocument }
+  { id: 'opencode', label: 'opencode', directory: 'opencode', configHome: true, supportsAgents: true, agentFileName: agentMarkdownName, agentDocument: opencodeAgentDocument },
+  { id: 'pi-coding-agent', label: 'Pi Coding Agent', directory: '.pi/agent', supportsAgents: true, agentTargetPrefix: 'prompts', agentFileName: agentMarkdownName, agentDocument: piCodingAgentPromptDocument, root: piCodingAgentRoot }
 ];
 
 export function harnessById(id) {
@@ -69,6 +96,7 @@ export function harnessById(id) {
 }
 
 export function harnessRoot(harness, { home = process.env.HOME || homedir(), env = process.env } = {}) {
+  if (harness.root) return harness.root({ home, env });
   if (harness.configHome) {
     const override = typeof env?.XDG_CONFIG_HOME === 'string' ? env.XDG_CONFIG_HOME.trim() : '';
     return join(override || join(home, '.config'), harness.directory);