sap-ai-dev-toolkit 0.7.5 → 0.7.9

package/src/setup.mjs

@@ -1,7 +1,9 @@
 import { createInterface } from 'node:readline/promises';
 import { stdin, stdout } from 'node:process';
-import { checkboxPrompt, colorText, formatStatus } from './terminal-ui.mjs';
+import { platform } from 'node:os';
+import { checkboxPrompt, colorText, formatStatus, textPrompt } from './terminal-ui.mjs';
 import { discoverDestinations, remediation } from './bas-discovery.mjs';
+import { defaultAdtUrl, discoverSapGuiSystems } from './local-sap-gui.mjs';
 import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys, findOrphanedCloudFoundryServiceKeys } from './cf-destination.mjs';
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
 
@@ -11,6 +13,24 @@ function print(output, message) {
   output.write(`${message}\n`);
 }
 
+function windowsSsoSetupAvailable(env = process.env) {
+  return platform() === 'win32' || env.SAP_AI_DEV_TOOLKIT_ENABLE_WINDOWS_SSO_SETUP === 'true';
+}
+
+async function chooseLocalAuthMode(destination, { input = stdin, output = stdout, env = process.env } = {}) {
+  if (!windowsSsoSetupAvailable(env)) return 'basic';
+  const answer = await textPrompt({
+    message: `Authentication for ${destination.name} (password/sso)`,
+    placeholder: 'password',
+    required: false,
+    validate: value => {
+      const candidate = String(value || 'password').trim().toLowerCase();
+      return ['password', 'basic', 'sso', 'windows-sso'].includes(candidate) || 'Enter password or sso.';
+    }
+  }, { input, output });
+  const normalized = String(answer || 'password').trim().toLowerCase();
+  return ['sso', 'windows-sso'].includes(normalized) ? 'windows-sso' : 'basic';
+}
 
 async function confirmCloudFoundryImport({ input = stdin, output = stdout } = {}) {
   const readline = createInterface({ input, output });
@@ -46,6 +66,24 @@ function safeBasDestination(destination) {
   };
 }
 
+function safeLocalSapGuiDestination(destination) {
+  return {
+    source: 'sap-gui-local',
+    name: destination.name,
+    serverName: destination.serverName || destination.name,
+    url: destination.url,
+    host: destination.host,
+    systemId: destination.systemId,
+    instance: destination.instance,
+    client: destination.client || '001',
+    authentication: destination.authentication || 'Basic',
+    authMode: destination.authMode,
+    proxyType: 'Internet',
+    probe: safeProbe(destination.probe),
+    childEnv: destination.childEnv || {}
+  };
+}
+
 function safeCloudFoundryDestination(destination) {
   const cf = destination.cf || {};
   return {
@@ -99,28 +137,41 @@ export async function runSetup({
   output = stdout,
   discover = discoverDestinations,
   discoverCf = discoverCloudFoundryDestinations,
+  discoverLocalSapGui = discoverSapGuiSystems,
   confirmCfImport = confirmCloudFoundryImport,
   install = installMcpConfig,
   includeSapDevelopmentToolsPrompt = false
 } = {}) {
-  if (!env.H2O_URL) {
-    print(output, formatStatus(`Setup skipped: H2O_URL is not set. Run ${SETUP_COMMAND} in a BAS dev space.`, 'info', output, 'SAP AI Dev Toolkit'));
+  const isBas = Boolean(env.H2O_URL);
+  if (!isBas && (!input.isTTY || !output.isTTY)) {
+    print(output, formatStatus('BAS destination setup was skipped because H2O_URL is not set.', 'info', output, 'SAP AI Dev Toolkit'));
     return { skipped: true, reason: 'non-bas' };
   }
   if (!input.isTTY || !output.isTTY) {
-    print(output, formatStatus(`Interactive setup needs a terminal. Rerun ${SETUP_COMMAND} from a BAS terminal.`, 'warning', output, 'SAP AI Dev Toolkit'));
+    print(output, formatStatus(`Interactive setup needs a terminal. Rerun ${SETUP_COMMAND} from a terminal.`, 'warning', output, 'SAP AI Dev Toolkit'));
     return { skipped: true, reason: 'non-tty' };
   }
   print(output, '');
-  print(output, formatStatus('Contacting BAS to discover destinations; this may take a moment.', 'progress', output, 'Setup'));
+  print(output, formatStatus(isBas ? 'Contacting BAS to discover destinations; this may take a moment.' : 'Looking for local SAP GUI system configuration.', 'progress', output, 'Setup'));
 
-  let basDestinations;
-  try {
-    basDestinations = await discover({ env: { ...env, SAP_AI_DEV_TOOLKIT_DESTINATION: '' } });
-  } catch (error) {
-    throw new Error(`BAS discovery failed: ${error.message}`);
+  let destinations = [];
+  if (isBas) {
+    let basDestinations;
+    try {
+      basDestinations = await discover({ env: { ...env, SAP_AI_DEV_TOOLKIT_DESTINATION: '' } });
+    } catch (error) {
+      throw new Error(`BAS discovery failed: ${error.message}`);
+    }
+    destinations = basDestinations.map(safeBasDestination);
+  } else {
+    let localSystems;
+    try {
+      localSystems = await discoverLocalSapGui({ env });
+    } catch (error) {
+      throw new Error(`SAP GUI discovery failed: ${error.message}`);
+    }
+    destinations = localSystems.map(safeLocalSapGuiDestination);
   }
-  const destinations = basDestinations.map(safeBasDestination);
   const warnings = [];
   let createdKeys = [];
   let configPath;
@@ -132,9 +183,9 @@ export async function runSetup({
     warnings.push('Existing MCP config could not be read before setup; existing CF service keys will not be reused.');
   }
 
-  const target = await getCloudFoundryTarget({ env });
+  const target = isBas ? await getCloudFoundryTarget({ env }) : { available: false, reason: 'Cloud Foundry import is only available in BAS setup.' };
   if (!target.available) {
-    warnings.push(target.reason);
+    if (isBas) warnings.push(target.reason);
   } else {
     // Sweep for service keys this toolkit created but no config references
     // (an interrupted earlier setup leaves them behind; a Destination key
@@ -205,8 +256,8 @@ export async function runSetup({
   };
   const selectable = destinations.filter(destination => !destination.disabledReason);
   if (!selectable.length) {
-    print(output, formatStatus('No selectable BAS or Cloud Foundry destinations were found.', 'warning', output, 'Setup'));
-    print(output, remediation);
+    print(output, formatStatus(isBas ? 'No selectable BAS or Cloud Foundry destinations were found.' : 'No SAP GUI systems were found on this computer.', 'warning', output, 'Setup'));
+    print(output, isBas ? remediation : 'Install SAP GUI and create SAP Logon entries, or set SAP_AI_DEV_MCP_CONFIG and add systems manually. ADT still needs an HTTP(S) URL; SAP GUI files contain DIAG routing only.');
     await reportWarnings(warnings);
     const cleanupWarnings = await cleanupNewKeysWithoutConfigChange();
     await reportWarnings(cleanupWarnings);
@@ -222,9 +273,9 @@ export async function runSetup({
     const probe = destination.probe?.status || 'unknown';
     const source = destination.source === 'cloud-foundry'
       ? `CF ${destination.cf.destinationInstanceName}`
-      : 'BAS';
+      : (destination.source === 'sap-gui-local' ? `SAP GUI ${destination.systemId || destination.host || ''}`.trim() : 'BAS');
     const disabled = destination.disabledReason;
-    const state = disabled ? 'disabled' : (destination.probe?.available === false ? `fail:${probe}` : `ok:${probe}`);
+    const state = disabled ? 'disabled' : (probe === 'needs-adt-url' ? probe : (destination.probe?.available === false ? `fail:${probe}` : `ok:${probe}`));
     return {
       value: destination,
       name: `${destination.name} (${source}, client ${destination.client}, ${state})`,
@@ -245,6 +296,52 @@ export async function runSetup({
     shortcuts: { all: 'a' }
   }, { input, output });
 
+  if (!isBas && selected.length) {
+    print(output, '');
+    print(output, formatStatus('SAP GUI landscapes do not contain ADT HTTP(S) endpoints. Confirm the ADT URL and authentication for each selected system.', 'step', output, 'Local SAP GUI'));
+    if (windowsSsoSetupAvailable(env)) print(output, '  Windows SSO is experimental and only applies to ADT systems configured for HTTP Integrated Authentication. Username/password remains the default.');
+    for (const destination of selected) {
+      const fallback = defaultAdtUrl(destination);
+      const url = await textPrompt({
+        message: `ADT URL for ${destination.name}`,
+        placeholder: fallback || 'https://host:44300',
+        validate: value => {
+          const candidate = value || fallback;
+          if (!candidate) return 'Enter an ADT base URL, for example https://host:44300.';
+          try {
+            const parsed = new URL(candidate);
+            if (!['http:', 'https:'].includes(parsed.protocol)) return 'Use an http:// or https:// URL.';
+            if (parsed.username || parsed.password) return 'Do not embed credentials in the ADT URL; use the login prompts.';
+            if (parsed.search || parsed.hash) return 'Enter an ADT base URL without a query or fragment.';
+            return true;
+          }
+          catch { return 'Enter a valid URL.'; }
+        },
+        required: false
+      }, { input, output });
+      destination.url = url || fallback;
+      const authMode = await chooseLocalAuthMode(destination, { input, output, env });
+      destination.authentication = authMode === 'windows-sso' ? 'WindowsSSO' : 'Basic';
+      destination.authMode = authMode;
+      if (authMode === 'windows-sso') {
+        destination.childEnv = { SAP_AUTH_MODE: 'windows-sso' };
+        destination.inputs = [];
+      } else {
+        const userInputId = `sap-ai-dev-${destination.serverName || destination.name}-user`.toLowerCase().replace(/[^a-z0-9_-]+/g, '-');
+        const passwordInputId = `sap-ai-dev-${destination.serverName || destination.name}-password`.toLowerCase().replace(/[^a-z0-9_-]+/g, '-');
+        destination.childEnv = {
+          SAP_AUTH_MODE: 'basic',
+          SAP_USER: `\${input:${userInputId}}`,
+          SAP_PASSWORD: `\${input:${passwordInputId}}`
+        };
+        destination.inputs = [
+          { id: userInputId, type: 'promptString', description: `SAP user for ${destination.name}` },
+          { id: passwordInputId, type: 'promptString', description: `SAP password for ${destination.name}`, password: true }
+        ];
+      }
+    }
+  }
+
   let sapDevelopmentServers = [];
   if (includeSapDevelopmentToolsPrompt) {
     print(output, '');
@@ -269,18 +366,20 @@ export async function runSetup({
     const location = result?.path ? ` in ${result.path}` : '';
     print(output, '');
     const configuredCount = selected.length + sapDevelopmentServers.length;
-    print(output, formatStatus(`Configured ${configuredCount} MCP server${configuredCount === 1 ? '' : 's'}${location}.`, 'success', output, 'BAS setup'));
+    print(output, formatStatus(`Configured ${configuredCount} MCP server${configuredCount === 1 ? '' : 's'}${location}.`, 'success', output, isBas ? 'BAS setup' : 'Local setup'));
     printConnectionInstructions(output, result);
     let cleanupWarnings = [];
     const finalPath = result?.path || configPath;
-    if (!finalPath) {
-      cleanupWarnings.push('CF service-key cleanup skipped because the final MCP config path is unavailable.');
-    } else {
-      try {
-        const finalConfig = await readMcpConfig(finalPath);
-        cleanupWarnings = await cleanupKeys([...managedKeys, ...createdKeys], finalConfig);
-      } catch {
-        cleanupWarnings.push('CF service-key cleanup skipped because the final MCP config could not be read.');
+    if (isBas) {
+      if (!finalPath) {
+        cleanupWarnings.push('CF service-key cleanup skipped because the final MCP config path is unavailable.');
+      } else {
+        try {
+          const finalConfig = await readMcpConfig(finalPath);
+          cleanupWarnings = await cleanupKeys([...managedKeys, ...createdKeys], finalConfig);
+        } catch {
+          cleanupWarnings.push('CF service-key cleanup skipped because the final MCP config could not be read.');
+        }
       }
     }
     await reportWarnings(warnings);

package/src/windows-sso-adt-proxy.mjs

@@ -0,0 +1,224 @@
+import http from 'node:http';
+import { once } from 'node:events';
+import { execFile as nodeExecFile } from 'node:child_process';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const MAX_HELPER_OUTPUT = 1024 * 1024;
+const HOP_BY_HOP = new Set(['connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization', 'te', 'trailer', 'transfer-encoding', 'upgrade']);
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
+
+function safeError(message) { return new Error(message); }
+
+function validateTarget(value) {
+  let url;
+  try { url = new URL(value); }
+  catch { throw safeError('Windows SSO target ADT URL is invalid'); }
+  if (!['http:', 'https:'].includes(url.protocol) || !url.hostname || url.username || url.password) {
+    throw safeError('Windows SSO target ADT URL must be an HTTP(S) URL without embedded user information');
+  }
+  url.hash = '';
+  return url;
+}
+
+function hasNegotiateChallenge(headers) {
+  const value = headers.get?.('www-authenticate') || '';
+  return /(?:^|,)\s*Negotiate\b/i.test(value);
+}
+
+function headerObject(headers) {
+  const result = {};
+  for (const [name, value] of Object.entries(headers || {})) {
+    const lower = name.toLowerCase();
+    if (HOP_BY_HOP.has(lower) || lower === 'host') continue;
+    if (lower === 'authorization') continue;
+    if (value == null) continue;
+    result[name] = Array.isArray(value) ? value.join(', ') : String(value);
+  }
+  return result;
+}
+
+function copyResponseHeaders(response, { proxyOrigin, targetOrigin } = {}) {
+  const headers = {};
+  for (const [name, value] of response.headers) {
+    const lower = name.toLowerCase();
+    if (HOP_BY_HOP.has(lower) || ['content-encoding', 'content-length', 'set-cookie'].includes(lower)) continue;
+    // fetch exposes decompressed bytes, so upstream framing is no longer valid.
+    if (lower === 'location' && proxyOrigin && targetOrigin) {
+      try {
+        const location = new URL(value, targetOrigin);
+        if (location.origin === targetOrigin) {
+          headers[name] = `${proxyOrigin}${location.pathname}${location.search}${location.hash}`;
+          continue;
+        }
+      } catch {
+        // Keep unparsable Location values unchanged; the client/backend can decide.
+      }
+    }
+    headers[name] = value;
+  }
+  const cookies = setCookies(response.headers);
+  if (cookies.length) headers['set-cookie'] = cookies;
+  return headers;
+}
+
+function setCookies(headers) {
+  if (typeof headers?.getSetCookie === 'function') return headers.getSetCookie();
+  const value = headers?.get?.('set-cookie');
+  return value ? [value] : [];
+}
+
+function mergeCookieHeader(existing, cookies) {
+  const pairs = new Map();
+  for (const part of String(existing || '').split(';')) {
+    const trimmed = part.trim();
+    const index = trimmed.indexOf('=');
+    if (index > 0) pairs.set(trimmed.slice(0, index), trimmed.slice(index + 1));
+  }
+  for (const cookie of cookies || []) {
+    const first = String(cookie || '').split(';', 1)[0]?.trim();
+    const index = first.indexOf('=');
+    if (index > 0) pairs.set(first.slice(0, index), first.slice(index + 1));
+  }
+  return [...pairs].map(([name, value]) => `${name}=${value}`).join('; ');
+}
+
+async function readRequestBody(req, limit = 50 * 1024 * 1024) {
+  if (['GET', 'HEAD'].includes(req.method || 'GET')) return undefined;
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    size += chunk.length;
+    if (size > limit) throw safeError('Windows SSO proxy request body is too large');
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+function helperCommand(env) {
+  const command = env.SAP_AI_DEV_TOOLKIT_NEGOTIATE_HELPER || env.SAP_AI_DEV_TOOLKIT_SSPI_HELPER;
+  if (command) return { command, args: [] };
+  if (process.platform !== 'win32') return null;
+  return {
+    command: env.SystemRoot ? join(env.SystemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe') : 'powershell.exe',
+    args: ['-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', join(root, 'scripts', 'windows-negotiate-helper.ps1')]
+  };
+}
+
+function tokenLooksLikeNtlm(token) {
+  try {
+    return Buffer.from(token, 'base64').subarray(0, 8).toString('ascii') === 'NTLMSSP\0';
+  } catch {
+    return false;
+  }
+}
+
+function execHelper(helper, payload, execFileImpl = nodeExecFile, env = process.env) {
+  return new Promise((resolve, reject) => {
+    const child = execFileImpl(helper.command, helper.args, {
+      windowsHide: true,
+      timeout: 30_000,
+      maxBuffer: MAX_HELPER_OUTPUT,
+      env: { ...process.env, ...env }
+    }, (error, stdout) => {
+      // execFile errors can contain helper stdout/stderr, including tokens.
+      if (error) return reject(safeError('Windows SSO helper failed; verify the helper and Windows Kerberos configuration.'));
+      const token = String(stdout || '').trim();
+      if (!/^[A-Za-z0-9+/=_-]+$/.test(token)) return reject(safeError('Windows SSO helper returned an invalid Negotiate token'));
+      if (tokenLooksLikeNtlm(token)) return reject(safeError('Windows SSO helper returned an NTLM token. ADT SSO requires Kerberos/SPNEGO; verify the backend SPN and Kerberos configuration, or rerun sap-ai-dev --setup and choose username/password.'));
+      resolve(token);
+    });
+    child.stdin?.end(`${JSON.stringify(payload)}\n`);
+  });
+}
+
+async function acquireNegotiateToken({ targetUrl, challenge, env, execFileImpl }) {
+  const helper = helperCommand(env);
+  if (!helper) {
+    throw safeError('Windows SSO requires an SSPI/Negotiate helper. Set SAP_AI_DEV_TOOLKIT_NEGOTIATE_HELPER to a trusted helper executable, or rerun sap-ai-dev --setup and choose username/password.');
+  }
+  return execHelper(helper, { url: targetUrl, challenge, mechanism: 'Negotiate' }, execFileImpl, env);
+}
+
+async function forward(req, targetUrl, headers, body, fetchImpl) {
+  return fetchImpl(targetUrl, {
+    method: req.method,
+    headers,
+    body,
+    duplex: body ? 'half' : undefined,
+    redirect: 'manual'
+  });
+}
+
+function writeFetchResponse(res, response, base, proxyOrigin) {
+  res.writeHead(response.status, response.statusText, copyResponseHeaders(response, { proxyOrigin, targetOrigin: base.origin }));
+  if (!response.body) return res.end();
+  response.body.pipeTo(new WritableStream({
+    write(chunk) { res.write(chunk); },
+    close() { res.end(); },
+    abort() { res.destroy(); }
+  })).catch(() => res.destroy());
+}
+
+export async function createWindowsSsoAdtProxy({ destinationUrl, env = process.env, fetchImpl = globalThis.fetch, execFileImpl = nodeExecFile } = {}) {
+  if (process.platform !== 'win32' && env.SAP_AI_DEV_TOOLKIT_ALLOW_SSO_PROXY_ON_NON_WINDOWS !== 'true') {
+    throw safeError('Windows SSO for local ADT destinations is only supported on Windows');
+  }
+  if (typeof fetchImpl !== 'function') throw safeError('HTTP fetch implementation is unavailable');
+  const base = validateTarget(destinationUrl);
+  const sockets = new Set();
+  let closed = false;
+  let proxyOrigin = '';
+
+  const server = http.createServer(async (req, res) => {
+    if (closed) return res.destroy();
+    let target;
+    try {
+      target = new URL(req.url || '/', base);
+      if (target.origin !== base.origin) throw safeError('Cross-origin Windows SSO proxy request rejected');
+      const headers = headerObject(req.headers);
+      const body = await readRequestBody(req);
+      let response = await forward(req, target, headers, body, fetchImpl);
+      if (response.status === 401 && hasNegotiateChallenge(response.headers)) {
+        const challenge = response.headers.get('www-authenticate') || '';
+        const cancel = response.body?.cancel?.();
+        await cancel?.catch?.(() => {});
+        const token = await acquireNegotiateToken({ targetUrl: target.href, challenge, env, execFileImpl });
+        const retryHeaders = { ...headers, Authorization: `Negotiate ${token}` };
+        const cookies = mergeCookieHeader(headers.cookie || headers.Cookie, setCookies(response.headers));
+        delete retryHeaders.cookie;
+        delete retryHeaders.Cookie;
+        if (cookies) retryHeaders.Cookie = cookies;
+        response = await forward(req, target, retryHeaders, body, fetchImpl);
+      }
+      writeFetchResponse(res, response, base, proxyOrigin);
+    } catch (error) {
+      if (!res.headersSent) {
+        res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8', connection: 'close' });
+        res.end(`${error.message || 'Windows SSO proxy request failed'}\n`);
+      } else {
+        res.destroy();
+      }
+    }
+  });
+
+  server.on('connection', socket => {
+    sockets.add(socket);
+    socket.on('close', () => sockets.delete(socket));
+  });
+
+  server.listen(0, '127.0.0.1');
+  await once(server, 'listening');
+  const address = server.address();
+  proxyOrigin = `http://127.0.0.1:${address.port}`;
+  return {
+    url: proxyOrigin,
+    close: async () => {
+      if (closed) return;
+      closed = true;
+      for (const socket of sockets) socket.destroy();
+      server.close();
+      await once(server, 'close').catch(() => {});
+    }
+  };
+}