sap-ai-dev-toolkit 0.7.8 → 0.7.9

package/README.md

@@ -52,13 +52,13 @@ To also add optional full-stack SAP companion MCP servers for Fiori, UI5, CAP, a
 sap-ai-dev --setup --tools
 ```
 
-Then connect a destination in SAP Business Application Studio:
+Then connect a destination in SAP Business Application Studio, or run the same setup locally to discover SAP GUI systems and create VS Code MCP entries:
 
 1. Open the Command Palette.
 2. Run **MCP: List Servers**.
-3. Start the server named after your selected BAS destination (the lowercase slug, for example `demo-abap` for destination `DEMO_ABAP`).
+3. Start the server named after your selected destination (the lowercase slug, for example `demo-abap` for destination `DEMO_ABAP`).
 4. In your AI assistant's chat, choose the best-fit bundled agent from the agent picker (GitHub Copilot, Claude Code, and opencode install the agents) or invoke the matching Pi prompt template (`/sap-solution-architect`, `/abap-developer`, `/abap-runtime-debugger`, `/rap-service-developer`, or `/hana-cloud-hdi-specialist`): **SAP Solution Architect**, **ABAP Developer**, **ABAP Runtime Debugger**, **RAP Service Developer**, or **HANA Cloud/HDI Specialist**.
-5. In the Chat tools picker, enable the server for that BAS destination.
+5. In the Chat tools picker, enable the server for that destination.
 6. Ask the agent to inspect, build, test, or verify something in your SAP landscape.
 
 Use the attached destination-prefixed tools directly in chat. Do not launch `sap-ai-dev` or handcraft MCP JSON-RPC in a terminal to discover or call them.
@@ -236,13 +236,13 @@ Once the destination server is enabled in your chat's tools picker, ask for outc
 | 🔒 **SAP authorization remains authoritative** | The add-on does not bypass backend SAP permissions. |
 | 🚚 **Curated VSP tool surface** | The proxy exposes the same curated developer-lifecycle set for every destination, plus local workflow tools; SAP authorizations and VSP safety checks still apply. |
 | 🧱 **Per-destination isolation** | Generated MCP entries are scoped to a single `SAP_AI_DEV_TOOLKIT_DESTINATION`. |
-| 🔑 **No credentials in `mcp.json`** | Authentication material stays in BAS destination configuration rather than MCP config. |
+| 🔑 **Credential-aware setup** | BAS authentication material stays in Destination configuration. Local SAP GUI setup writes VS Code input prompts for SAP user/password instead of raw credentials. |
 
 <a id="install"></a>
 
 ## 📦 Installation
 
-Install globally from a BAS dev space:
+Install globally from SAP Business Application Studio or from a local workstation with SAP GUI installed:
 
 ```sh
 npm install --global sap-ai-dev-toolkit
@@ -270,7 +270,9 @@ The installer handles VSP provisioning automatically:
 - Uses the package's bundled patched VSP binary for the current platform, verified against the npm-published `dist/checksums.txt`. A checksum-anchored remote download is the fallback only when the package has no bundled asset.
 - No Go toolchain is downloaded or required at install time; Go is only used by the repository's own `build:vsp` development script.
 
-With `H2O_URL` set, an interactive install opens a checkbox picker with no destinations selected by default. Use **Space** to choose destinations and **Enter** to confirm. Press **a** to toggle all destinations (select all if any are unchecked; otherwise clear the selection). Confirming with none selected removes this add-on's managed MCP entries. When the `cf` CLI 8.18 or newer is authenticated to a targeted space, setup first offers an optional import from that space's Destination service; type **y** then **Enter** to include it, or press **Enter** to skip. Accepted CF and BAS destinations appear together in the picker. npm may run its install hook without an interactive terminal, even when the shell is interactive; in that case, selection is skipped without changing MCP config.
+Setup detects where it is running. With `H2O_URL` set, it treats the environment as SAP Business Application Studio and opens a checkbox picker for BAS destinations, with no destinations selected by default. Use **Space** to choose destinations and **Enter** to confirm. Press **a** to toggle all destinations (select all if any are unchecked; otherwise clear the selection). Confirming with none selected removes this add-on's managed MCP entries. When the `cf` CLI 8.18 or newer is authenticated to a targeted space, setup first offers an optional import from that space's Destination service; type **y** then **Enter** to include it, or press **Enter** to skip. Accepted CF and BAS destinations appear together in the picker.
+
+Without `H2O_URL`, interactive setup looks for local SAP GUI system configuration on macOS and Windows (for example SAP GUI landscape XML and `saplogon.ini`). SAP GUI landscape files describe SAP GUI/DIAG connectivity, not the ADT HTTP(S) endpoint, so setup asks you to confirm the ADT URL for each selected system. The generated MCP entry uses VS Code input prompts for the SAP user and password at server start; raw SAP credentials are not stored in `mcp.json`. On Windows, setup can instead write an experimental `SAP_AUTH_MODE=windows-sso` entry without username/password prompts; this requires the ADT endpoint to support HTTP Negotiate/SPNEGO. Runtime uses the bundled Windows Negotiate helper by default, or a trusted custom helper configured with `SAP_AI_DEV_TOOLKIT_NEGOTIATE_HELPER`. npm may run its install hook without an interactive terminal, even when the shell is interactive; in that case, destination selection is skipped without changing MCP config.
 
 
 The same postinstall offers the bundled agents and skills for several AI coding harnesses in a checkbox picker. **GitHub Copilot** and **Claude Code** start pre-checked, so pressing **Enter** alone installs both; **Space** selects or deselects a harness, **a** toggles all seven, and confirming with none selected skips the step without changing files. When destination MCP setup succeeds, the generated managed MCP servers are also mirrored into selected harnesses that have a stable user-level JSON MCP configuration (Claude Code, Cursor, Gemini CLI, and Pi Coding Agent). GitHub Copilot continues to use the BAS/VS Code MCP configuration written during destination setup. With no interactive terminal, the assets are installed for GitHub Copilot only; set `SAP_AI_DEV_TOOLKIT_HARNESSES` to a comma-separated list of harness ids (`github-copilot`, `claude-code`, `codex`, `cursor`, `gemini-cli`, `opencode`, `pi-coding-agent`) to choose non-interactively.
@@ -279,9 +281,9 @@ Some current npm versions also require install hooks to be approved. If npm repo
 
 The setup report uses icons and terminal colors; set `NO_COLOR=1` to disable ANSI colors. The table is a weather report, not a bouncer: green **PASS** means the ADT probe responded, red **FAIL** means it failed, and yellow **SKIPPED** means it was skipped. Probe failures do not block MCP registration or startup for destinations you select.
 
-Run `sap-ai-dev --setup` later to change the destination selection or remove generated destination entries. Run `sap-ai-dev --setup --tools` to also choose optional companion tools. Use `--npx` to make generated BAS/VSP destination entries start the pinned package through npm instead of relying on a global `sap-ai-dev` command; companion tools already use `npx` with their own npm packages.
+Run `sap-ai-dev --setup` later to change the destination selection or remove generated destination entries. Run `sap-ai-dev --setup --tools` to also choose optional companion tools. Use `--npx` to make generated destination entries start the pinned package through npm instead of relying on a global `sap-ai-dev` command; companion tools already use `npx` with their own npm packages.
 
-If a setup step is skipped or fails, rerun it from an interactive BAS terminal:
+If a setup step is skipped or fails, rerun it from an interactive terminal:
 
 ```sh
 sap-ai-dev --setup
@@ -293,7 +295,7 @@ To configure without a global install, run the guided setup directly through npm
 npx --yes --ignore-scripts --package=sap-ai-dev-toolkit sap-ai-dev --setup --npx
 ```
 
-This lists discovered systems in the same checkbox picker, with nothing selected by default. Use **Space** to choose destinations, **Enter** to confirm, and **a** to toggle all (select all if any are unchecked; otherwise clear the selection). It writes MCP entries that launch the selected servers through npx. The entries pin the package version used during setup, and `--ignore-scripts` avoids running the install-time wizard a second time. After setup, in BAS run **MCP: List Servers**, select each chosen destination, and choose **Start Server**.
+This lists discovered systems in the same checkbox picker, with nothing selected by default. Use **Space** to choose destinations, **Enter** to confirm, and **a** to toggle all (select all if any are unchecked; otherwise clear the selection). It writes MCP entries that launch the selected servers through npx. The entries pin the package version used during setup, and `--ignore-scripts` avoids running the install-time wizard a second time. After setup, in BAS or VS Code run **MCP: List Servers**, select each chosen destination, and choose **Start Server**.
 
 For a non-interactive installation or a platform without a published VSP asset, provide a trusted binary override:
 
@@ -747,6 +749,8 @@ The response contains a `tools` array. A `RunQuery` entry resembles this excerpt
 | `SAP_AI_DEV_TOOLKIT_DESTINATION` | Comma-separated destination allowlist for normal runtime discovery. Setup clears this temporarily so it can display all eligible systems. |
 | `SAP_AI_DEV_TOOLKIT_MODE` | VSP child mode (`expert` by default; `focused` omits `ActivateMultiple`, `GetUserTransports`, and `GetTransportInfo`). The proxy exposes its curated tool subset and local workflow tools, including `LintABAP`. |
 | `SAP_ALLOW_TRANSPORTABLE_EDITS` | Generated MCP entries set this to `true` to permit source edits in transportable packages; VSP safety checks and SAP authorizations still apply. |
+| `SAP_AUTH_MODE=windows-sso` | Local SAP GUI entry mode for experimental Windows Integrated Authentication. Runtime starts a loopback ADT proxy and does not pass SAP username/password credentials to VSP. |
+| `SAP_AI_DEV_TOOLKIT_NEGOTIATE_HELPER` / `SAP_AI_DEV_TOOLKIT_SSPI_HELPER` | Optional trusted Windows helper executable used by the local Windows SSO proxy to convert an HTTP `WWW-Authenticate: Negotiate` challenge into a Kerberos/SPNEGO token. NTLM fallback is rejected because it is connection-oriented and unsafe for this proxy shape. When unset on Windows, the bundled PowerShell SSPI helper is used. A custom helper receives one JSON line on stdin (`url`, `challenge`, `mechanism`) and prints the base64 token on stdout. |
 | `SAP_AI_DEV_TOOLKIT_HTTP_PROXY` | Egress proxy for BAS discovery and probe traffic. Takes precedence over `HTTP_PROXY`/`http_proxy`; unset means the default BAS proxy for `.dest` hosts, empty means direct. |
 | `SAP_AI_DEV_TOOLKIT_REQUEST_TIMEOUT_MS` | Per-request timeout for calls forwarded to a VSP child (default 600000 = 10 minutes; `0` disables). A stalled request fails with a timeout error; the child is left running. |
 | `SAP_AI_DEV_MCP_CONFIG` | Explicit MCP configuration path; highest precedence. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.7.8",
+  "version": "0.7.9",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/scripts/postinstall.mjs

@@ -88,7 +88,9 @@ async function installSelectedHarnessAssets(ids) {
   }
   for (const assets of results) {
     const installed = assets.installed + assets.updated;
-    await announce(`${assets.label}: ${installed} file${installed === 1 ? '' : 's'} installed or updated in ${assets.root}; ${assets.unchanged} already current.`, 'success');
+    const removed = assets.removed || 0;
+    const cleanup = removed > 0 ? `; ${removed} duplicate or legacy file${removed === 1 ? '' : 's'} removed` : '';
+    await announce(`${assets.label}: ${installed} file${installed === 1 ? '' : 's'} installed or updated in ${assets.root}; ${assets.unchanged} already current${cleanup}.`, 'success');
     if (assets.conflicts.length > 0) {
       const paths = assets.conflicts.map(path => join(assets.root, path)).join(', ');
       await announce(`${assets.label}: existing customizations were preserved; review these paths: ${paths}`, 'warning');
@@ -152,6 +154,11 @@ async function runHarnessAssetInstall() {
 async function wireHarnessMcpServers(ids, servers) {
   const entries = servers && Object.keys(servers).length ? servers : null;
   if (!entries || !ids?.length) return;
+  const hasLocalSapGui = Object.values(entries).some(entry => entry?.env?.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'sap-gui-local');
+  if (hasLocalSapGui) {
+    await announce('Local SAP GUI MCP entries use VS Code input prompts for SAP login, so automatic wiring into non-VS Code harness MCP files was skipped. Configure those harnesses manually if they support secure runtime prompts.', 'info');
+    return;
+  }
   const { results, failures } = await installMcpServersForHarnesses(ids, entries, { env: runtimeEnv });
   for (const result of results) {
     if (!result.supported) {
@@ -190,7 +197,7 @@ export function destinationTable(destinations, registeredNames) {
     const registered = registeredNames.has(generatedServerName(destination.serverName || destination.name));
     const source = destination.source === 'cloud-foundry'
       ? `CF ${destination.cf?.destinationInstanceName || 'unknown instance'}`
-      : 'BAS';
+      : (destination.source === 'sap-gui-local' ? 'SAP GUI' : 'BAS');
     return [
       { text: destination.name, output: destination.name },
       { text: source, output: source },
@@ -242,9 +249,10 @@ async function announceSetup(result) {
   const registeredNames = new Set(servers.map(([name]) => name));
   const entryDetails = servers.flatMap(([name, entry]) => {
     const destination = destinationsByServer.get(name);
-    const source = brandedEnvValue(entry.env, 'DESTINATION_SOURCE') === 'cloud-foundry' || destination?.source === 'cloud-foundry'
+    const configuredSource = brandedEnvValue(entry.env, 'DESTINATION_SOURCE') || destination?.source;
+    const source = configuredSource === 'cloud-foundry'
       ? 'Cloud Foundry'
-      : 'BAS';
+      : (configuredSource === 'sap-gui-local' ? 'Local SAP GUI' : 'BAS');
     const destinationName = brandedEnvValue(entry.env, 'DESTINATION') || destination?.name || 'unknown';
     const client = destination?.client || '001';
     const authentication = destination?.authentication || 'unknown';

package/scripts/windows-negotiate-helper.ps1

@@ -0,0 +1,182 @@
+# Windows Integrated Authentication helper for sap-ai-dev-toolkit.
+# Reads one JSON object from stdin with: url, challenge, mechanism.
+# Writes only the base64 Negotiate token to stdout.
+# Errors are written to stderr and exit non-zero.
+
+$ErrorActionPreference = 'Stop'
+
+$sspiSource = @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+
+public static class SapAiDevSspiNegotiate
+{
+    const int SECPKG_CRED_OUTBOUND = 2;
+    const int SECBUFFER_VERSION = 0;
+    const int SECBUFFER_TOKEN = 2;
+    const int SECURITY_NATIVE_DREP = 0x10;
+    const int SEC_E_OK = 0;
+    const int SEC_I_CONTINUE_NEEDED = 0x00090312;
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct SecHandle
+    {
+        public IntPtr dwLower;
+        public IntPtr dwUpper;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct SecBuffer
+    {
+        public int cbBuffer;
+        public int BufferType;
+        public IntPtr pvBuffer;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct SecBufferDesc
+    {
+        public int ulVersion;
+        public int cBuffers;
+        public IntPtr pBuffers;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct SECURITY_INTEGER
+    {
+        public uint LowPart;
+        public int HighPart;
+    }
+
+    [DllImport("secur32.dll", CharSet = CharSet.Unicode, SetLastError = false)]
+    static extern int AcquireCredentialsHandle(
+        string pszPrincipal,
+        string pszPackage,
+        int fCredentialUse,
+        IntPtr pvLogonID,
+        IntPtr pAuthData,
+        IntPtr pGetKeyFn,
+        IntPtr pvGetKeyArgument,
+        out SecHandle phCredential,
+        out SECURITY_INTEGER ptsExpiry);
+
+    [DllImport("secur32.dll", CharSet = CharSet.Unicode, SetLastError = false)]
+    static extern int InitializeSecurityContext(
+        ref SecHandle phCredential,
+        IntPtr phContext,
+        string pszTargetName,
+        int fContextReq,
+        int Reserved1,
+        int TargetDataRep,
+        IntPtr pInput,
+        int Reserved2,
+        out SecHandle phNewContext,
+        IntPtr pOutput,
+        out int pfContextAttr,
+        out SECURITY_INTEGER ptsExpiry);
+
+    [DllImport("secur32.dll", SetLastError = false)]
+    static extern int FreeCredentialsHandle(ref SecHandle phCredential);
+
+    [DllImport("secur32.dll", SetLastError = false)]
+    static extern int DeleteSecurityContext(ref SecHandle phContext);
+
+    static void Check(int status, string operation)
+    {
+        if (status == SEC_E_OK || status == SEC_I_CONTINUE_NEEDED) return;
+        throw new Win32Exception(status, operation + " failed with SSPI status 0x" + status.ToString("X8"));
+    }
+
+    static IntPtr BufferDesc(byte[] token, out IntPtr tokenMemory, out IntPtr bufferMemory)
+    {
+        tokenMemory = IntPtr.Zero;
+        SecBuffer buffer = new SecBuffer();
+        buffer.BufferType = SECBUFFER_TOKEN;
+        if (token != null && token.Length > 0)
+        {
+            tokenMemory = Marshal.AllocHGlobal(token.Length);
+            Marshal.Copy(token, 0, tokenMemory, token.Length);
+            buffer.cbBuffer = token.Length;
+            buffer.pvBuffer = tokenMemory;
+        }
+        bufferMemory = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(SecBuffer)));
+        Marshal.StructureToPtr(buffer, bufferMemory, false);
+        SecBufferDesc desc = new SecBufferDesc();
+        desc.ulVersion = SECBUFFER_VERSION;
+        desc.cBuffers = 1;
+        desc.pBuffers = bufferMemory;
+        IntPtr descMemory = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(SecBufferDesc)));
+        Marshal.StructureToPtr(desc, descMemory, false);
+        return descMemory;
+    }
+
+    static void FreeDesc(IntPtr descMemory, IntPtr tokenMemory, IntPtr bufferMemory)
+    {
+        if (descMemory != IntPtr.Zero) Marshal.FreeHGlobal(descMemory);
+        if (bufferMemory != IntPtr.Zero) Marshal.FreeHGlobal(bufferMemory);
+        if (tokenMemory != IntPtr.Zero) Marshal.FreeHGlobal(tokenMemory);
+    }
+
+    public static string CreateToken(string targetName, string incomingBase64)
+    {
+        SecHandle credential;
+        SECURITY_INTEGER expiry;
+        int status = AcquireCredentialsHandle(null, "Negotiate", SECPKG_CRED_OUTBOUND, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, out credential, out expiry);
+        Check(status, "AcquireCredentialsHandle");
+
+        SecHandle context = new SecHandle();
+        IntPtr inputDesc = IntPtr.Zero, inputToken = IntPtr.Zero, inputBuffer = IntPtr.Zero;
+        IntPtr outputDesc = IntPtr.Zero, outputToken = IntPtr.Zero, outputBuffer = IntPtr.Zero;
+        try
+        {
+            byte[] incoming = null;
+            if (!String.IsNullOrWhiteSpace(incomingBase64)) incoming = Convert.FromBase64String(incomingBase64);
+            if (incoming != null && incoming.Length > 0) inputDesc = BufferDesc(incoming, out inputToken, out inputBuffer);
+
+            outputDesc = BufferDesc(new byte[12288], out outputToken, out outputBuffer);
+            int attrs;
+            status = InitializeSecurityContext(ref credential, IntPtr.Zero, targetName, 0, 0, SECURITY_NATIVE_DREP, inputDesc, 0, out context, outputDesc, out attrs, out expiry);
+            Check(status, "InitializeSecurityContext");
+
+            SecBuffer outBuffer = (SecBuffer) Marshal.PtrToStructure(outputBuffer, typeof(SecBuffer));
+            if (outBuffer.cbBuffer <= 0 || outBuffer.pvBuffer == IntPtr.Zero) throw new Exception("SSPI returned an empty Negotiate token.");
+            byte[] bytes = new byte[outBuffer.cbBuffer];
+            Marshal.Copy(outBuffer.pvBuffer, bytes, 0, bytes.Length);
+            return Convert.ToBase64String(bytes);
+        }
+        finally
+        {
+            FreeDesc(inputDesc, inputToken, inputBuffer);
+            FreeDesc(outputDesc, outputToken, outputBuffer);
+            DeleteSecurityContext(ref context);
+            FreeCredentialsHandle(ref credential);
+        }
+    }
+}
+'@
+
+try {
+  $raw = [Console]::In.ReadToEnd()
+  if ([string]::IsNullOrWhiteSpace($raw)) { throw 'Missing helper request on stdin.' }
+  $request = $raw | ConvertFrom-Json
+  if (-not $request.url) { throw 'Missing target URL.' }
+
+  $uri = [Uri] [string] $request.url
+  if ($uri.Scheme -ne 'http' -and $uri.Scheme -ne 'https') { throw 'Target URL must use HTTP or HTTPS.' }
+  if ($uri.UserInfo) { throw 'Target URL must not contain user information.' }
+
+  Add-Type -TypeDefinition $sspiSource -Language CSharp
+
+  $incoming = $null
+  $challenge = [string] $request.challenge
+  if ($challenge -match '(?i)Negotiate\s+([^,\s]+)') { $incoming = $Matches[1] }
+  $targetName = 'HTTP/' + $uri.DnsSafeHost
+  $token = [SapAiDevSspiNegotiate]::CreateToken($targetName, $incoming)
+  if ([string]::IsNullOrWhiteSpace($token)) { throw 'Negotiate token generation returned an empty token.' }
+  [Console]::Out.WriteLine($token.Trim())
+  exit 0
+} catch {
+  [Console]::Error.WriteLine($_.Exception.Message)
+  exit 1
+}

package/src/install-user-assets.mjs

@@ -69,17 +69,43 @@ async function planDestinations(harness, files) {
   for (const file of files) {
     const raw = await readFile(file.source);
     if (!file.target.startsWith(`agents${sep}`)) {
-      destinations.push({ target: file.target, content: raw });
+      destinations.push({ target: file.target, content: raw, aliases: [] });
       continue;
     }
     if (!harness.supportsAgents) continue;
-    const fileName = harness.agentFileName ? harness.agentFileName(basename(file.target)) : basename(file.target);
+    const sourceName = basename(file.target);
+    const fileName = harness.agentFileName ? harness.agentFileName(sourceName) : sourceName;
+    const prefix = harness.agentTargetPrefix || 'agents';
+    const target = join(prefix, fileName);
+    const aliasCandidates = [
+      file.target,
+      join(prefix, sourceName),
+      join('agents', fileName)
+    ];
+    const aliases = [...new Set(aliasCandidates.filter(alias => alias !== target))];
     const content = harness.agentDocument ? Buffer.from(harness.agentDocument(raw.toString('utf8')), 'utf8') : raw;
-    destinations.push({ target: join(harness.agentTargetPrefix || 'agents', fileName), content });
+    destinations.push({ target, content, aliases });
   }
   return destinations;
 }
 
+async function reconcileRemovableFile({ targetRoot, target, contentHash, previousFiles }) {
+  const path = join(targetRoot, target);
+  let existing;
+  try {
+    existing = await readFile(path);
+  } catch (error) {
+    if (error.code === 'ENOENT') return 'missing';
+    throw error;
+  }
+  const existingHash = digest(existing);
+  if (previousFiles[target] === existingHash || existingHash === contentHash) {
+    await rm(path, { force: true });
+    return 'removed';
+  }
+  return 'conflict';
+}
+
 export async function installUserAssets({ harness, home = process.env.HOME || homedir(), root = packageRoot, env = process.env } = {}) {
   const destinations = await planDestinations(harness, await collectSourceFiles(root));
   const targetRoot = harnessRoot(harness, { home, env });
@@ -89,15 +115,22 @@ export async function installUserAssets({ harness, home = process.env.HOME || ho
   const legacyFiles = harness.legacyManifest ? await readManagedFiles(legacyManifestPath) : {};
   const currentFiles = await readManagedFiles(manifestPath);
   const previousFiles = { ...legacyFiles, ...currentFiles };
-  const managedFiles = { ...previousFiles };
+  const managedFiles = {};
+  const activeTargets = new Set(destinations.flatMap(file => [file.target, ...file.aliases]));
   const conflicts = [];
   let installed = 0;
   let updated = 0;
   let unchanged = 0;
+  let removed = 0;
 
   for (const file of destinations) {
     const destination = join(targetRoot, file.target);
     const contentHash = digest(file.content);
+    for (const alias of file.aliases) {
+      const status = await reconcileRemovableFile({ targetRoot, target: alias, contentHash, previousFiles });
+      if (status === 'removed') removed += 1;
+      if (status === 'conflict') conflicts.push(alias);
+    }
     await mkdir(dirname(destination), { recursive: true, mode: 0o755 });
 
     let existing;
@@ -129,9 +162,16 @@ export async function installUserAssets({ harness, home = process.env.HOME || ho
     }
   }
 
+  for (const target of Object.keys(previousFiles)) {
+    if (activeTargets.has(target) || managedFiles[target]) continue;
+    const status = await reconcileRemovableFile({ targetRoot, target, contentHash: '', previousFiles });
+    if (status === 'removed') removed += 1;
+    if (status === 'conflict') conflicts.push(target);
+  }
+
   await replaceFile(manifestPath, `${JSON.stringify({ version: 1, files: managedFiles }, null, 2)}\n`);
   if (harness.legacyManifest) await rm(legacyManifestPath, { force: true });
-  return { harness: harness.id, label: harness.label, root: targetRoot, installed, updated, unchanged, conflicts };
+  return { harness: harness.id, label: harness.label, root: targetRoot, installed, updated, unchanged, removed, conflicts };
 }
 
 export async function installUserAssetsForHarnesses(ids, { home, root = packageRoot, env = process.env } = {}) {

package/src/launcher.mjs

@@ -4,11 +4,13 @@ import { readFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { discoverDestinations, remediation, slugifyDestination, statusRows } from './bas-discovery.mjs';
+import { discoverSapGuiSystems } from './local-sap-gui.mjs';
 import { findBinary } from './binary.mjs';
 import { MCPProxy } from './mcp-proxy.mjs';
 import { installMcpConfig, repairManagedMcpConfig } from './mcp-config.mjs';
 import { runSetup } from './setup.mjs';
 import { resolveConfiguredCloudFoundryDestination } from './cf-destination.mjs';
+import { createWindowsSsoAdtProxy } from './windows-sso-adt-proxy.mjs';
 import { withBrandedEnvironment } from './branding.mjs';
 import { redactText } from './redact.mjs';
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
@@ -25,7 +27,7 @@ function usage() {
   return [
     'Usage: sap-ai-dev [options]',
     '',
-    'With H2O_URL set and no command, starts the SAP AI Dev Toolkit stdio server for selected BAS destinations.',
+    'With H2O_URL set, starts the SAP AI Dev Toolkit stdio server for selected BAS destinations; with local SAP GUI setup, starts the selected local ADT system.',
     'Options:',
     '  --setup                  Configure generated BAS MCP servers',
     '  --tools                  Also offer full-stack SAP companion MCP servers (use with --setup)',
@@ -161,9 +163,46 @@ async function binaryOrError() {
 async function discoverForCommand() {
   const env = { ...runtimeEnv };
   if (env.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry') env.SAP_AI_DEV_TOOLKIT_DESTINATION = '';
+  if (!env.H2O_URL) {
+    const systems = await discoverSapGuiSystems({ env });
+    if (!systems.length) throw new Error('H2O_URL is required for BAS destination discovery');
+    return systems;
+  }
   return discoverDestinations({ env });
 }
 
+async function configuredLocalSapGuiDestination(env) {
+  const name = env.SAP_AI_DEV_TOOLKIT_DESTINATION || env.SAP_SYSTEM_ID || 'local-sap';
+  if (!env.SAP_URL) throw new Error('SAP_URL is required for local SAP GUI MCP entries. Rerun sap-ai-dev --setup and enter the ADT URL.');
+  const authMode = String(env.SAP_AUTH_MODE || '').toLowerCase();
+  if (authMode === 'windows-sso') {
+    const route = await createWindowsSsoAdtProxy({ destinationUrl: env.SAP_URL, env });
+    return {
+      source: 'sap-gui-local',
+      name,
+      url: route.url,
+      backendUrl: env.SAP_URL,
+      client: env.SAP_CLIENT || '001',
+      authentication: 'WindowsSSO',
+      childEnv: {},
+      close: route.close,
+      probe: { status: 'configured', available: true }
+    };
+  }
+  return {
+    source: 'sap-gui-local',
+    name,
+    url: env.SAP_URL,
+    client: env.SAP_CLIENT || '001',
+    authentication: 'Basic',
+    childEnv: {
+      SAP_USER: env.SAP_USER || env.SAP_USERNAME || '',
+      SAP_PASSWORD: env.SAP_PASSWORD || env.SAP_PASS || ''
+    },
+    probe: { status: 'configured', available: true }
+  };
+}
+
 async function main() {
   const setup = hasFlag('--setup');
   const check = hasFlag('--check');
@@ -184,7 +223,9 @@ async function main() {
     try {
       const destinations = runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry'
         ? [await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })]
-        : await discoverForCommand();
+        : (runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'sap-gui-local'
+          ? [await configuredLocalSapGuiDestination(runtimeEnv)]
+          : await discoverForCommand());
       report = await runDoctor(destinations);
     } catch (error) {
       report = { ok: false, destinations: 0, checks: [doctorRow('-', 'destination discovery', 'failed', redactText(error.message || error).slice(0, 300))] };
@@ -219,8 +260,10 @@ async function main() {
     return;
   }
 
-  if (runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry') {
-    const destination = await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv });
+  if (['cloud-foundry', 'sap-gui-local'].includes(runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE)) {
+    const destination = runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry'
+      ? await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })
+      : await configuredLocalSapGuiDestination(runtimeEnv);
     let proxy;
     try {
       const binary = await binaryOrError();

package/src/local-sap-gui.mjs

@@ -0,0 +1,217 @@
+import { platform, homedir } from 'node:os';
+import { join } from 'node:path';
+import { readdir, readFile, stat } from 'node:fs/promises';
+
+function text(value) { return value == null ? '' : String(value).trim(); }
+function decodeXml(value) {
+  return text(value)
+    .replace(/"/g, '"')
+    .replace(/'/g, "'")
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&amp;/g, '&');
+}
+
+async function exists(path) {
+  try { await stat(path); return true; }
+  catch (error) { if (error?.code === 'ENOENT') return false; throw error; }
+}
+
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
+}
+
+export function sapGuiLandscapeCandidates(env = process.env) {
+  const home = env.HOME || env.USERPROFILE || homedir();
+  const appData = env.APPDATA || (env.USERPROFILE ? join(env.USERPROFILE, 'AppData', 'Roaming') : '');
+  const candidates = [];
+  if (platform() === 'win32' || appData) {
+    candidates.push(
+      join(appData || '', 'SAP', 'Common', 'SAPUILandscape.xml'),
+      join(appData || '', 'SAP', 'Common', 'SAPUILandscapeGlobal.xml'),
+      join(appData || '', 'SAP', 'Common', 'saplogon.ini')
+    );
+  }
+  candidates.push(
+    join(home, 'Library', 'Preferences', 'SAP', 'SAPGUILandscape.xml'),
+    join(home, 'Library', 'Preferences', 'SAP', 'SAPUILandscape.xml'),
+    join(home, 'Library', 'Preferences', 'SAP', 'connections'),
+    join(home, '.SAPGUI', 'SAPGUILandscape.xml')
+  );
+  return unique(candidates);
+}
+
+function attributes(fragment) {
+  const result = {};
+  for (const match of fragment.matchAll(/([A-Za-z_:][\w:.-]*)\s*=\s*"([^"]*)"|([A-Za-z_:][\w:.-]*)\s*=\s*'([^']*)'/g)) {
+    result[String(match[1] || match[3]).toLowerCase()] = decodeXml(match[2] ?? match[4]);
+  }
+  return result;
+}
+
+function ssoHintFrom(record) {
+  const ssoKeys = ['sncname', 'sncpartnername', 'sncmode', 'snc_mode', 'sncqop', 'snc_qop', 'use_sso', 'sso'];
+  if (ssoKeys.some(key => {
+    const value = text(record[key]);
+    return value && !['0', 'false', 'no', 'off'].includes(value.toLowerCase());
+  })) return true;
+  const values = [record.authentication, record.auth].map(text).filter(Boolean);
+  return values.some(value => /snc|sso|kerberos|spnego|secure\s*login/i.test(value) || ['1', 'true', 'yes'].includes(value.toLowerCase()));
+}
+
+function instanceFrom(value) {
+  const candidates = [value?.instance, value?.instancenumber, value?.instanceNumber, value?.sysnr, value?.systemnumber];
+  for (const candidate of candidates) {
+    const match = text(candidate).match(/^\d{2}$/);
+    if (match) return match[0];
+  }
+  return '';
+}
+
+function normalizeRecord(record, sourcePath) {
+  const type = text(record.type || record.kind).toLowerCase();
+  if (type && !['sapgui', 'r/3', 'sap'].some(token => type.includes(token))) return null;
+  const name = text(record.name || record.description || record.desc || record.systemid || record.sid || record.uuid);
+  const address = text(record.server || record.host || record.applicationserver || record.messageserver || record.mshost);
+  // SAP GUI ports are DIAG dispatcher ports, not HTTP ports.
+  const endpoint = address.match(/^(\[[^\]]+\]|[^:/]+):(\d+)$/);
+  const host = endpoint ? endpoint[1] : address;
+  const systemId = text(record.systemid || record.sid || record.r3name).toUpperCase();
+  if (!name || !host) return null;
+  const port = endpoint ? Number(endpoint[2]) : 0;
+  const instance = instanceFrom(record) || (port >= 3200 && port <= 3299 ? String(port - 3200).padStart(2, '0') : '');
+  const client = text(record.client || record.sapclient) || '001';
+  return {
+    source: 'sap-gui-local',
+    name,
+    serverName: name,
+    host,
+    systemId,
+    instance,
+    client,
+    authentication: ssoHintFrom(record) ? 'Basic/SSO hint' : 'Basic',
+    authMode: 'basic',
+    ssoHint: ssoHintFrom(record),
+    proxyType: 'Internet',
+    landscapePath: sourcePath,
+    probe: { status: 'needs-adt-url' }
+  };
+}
+
+function parseLandscapeXml(content, sourcePath) {
+  const records = [];
+  // Comments must not turn deleted entries into selectable systems.
+  content = content.replace(/<!--[\s\S]*?-->/g, '');
+  const messageServers = new Map();
+  for (const match of content.matchAll(/<Messageserver\b([^>]*)>/gi)) {
+    const record = attributes(match[1]);
+    if (record.uuid) messageServers.set(record.uuid, record);
+  }
+  for (const match of content.matchAll(/<Service\b([^>]*)\/?>(?:\s*<\/Service>)?/gi)) {
+    const record = attributes(match[1]);
+    if (record.msid) {
+      const messageServer = messageServers.get(record.msid);
+      // For load-balanced entries `server` is a logon group, not a host.
+      if (!messageServer?.host) continue;
+      record.server = messageServer.host;
+    }
+    const normalized = normalizeRecord(record, sourcePath);
+    if (normalized) records.push(normalized);
+  }
+  // SAP GUI for Java files may use generic Item/Connection elements.
+  for (const match of content.matchAll(/<(?:Item|Connection)\b([^>]*)\/?>(?:\s*<\/(?:Item|Connection)>)?/gi)) {
+    const normalized = normalizeRecord(attributes(match[1]), sourcePath);
+    if (normalized) records.push(normalized);
+  }
+  return records;
+}
+
+function parseSapLogonIni(content, sourcePath) {
+  const sections = new Map();
+  let section = '';
+  for (const line of content.split(/\r?\n/)) {
+    const header = line.match(/^\s*\[(.+)]\s*$/);
+    if (header) { section = header[1].toLowerCase(); if (!sections.has(section)) sections.set(section, {}); continue; }
+    const entry = line.match(/^\s*([^=]+?)\s*=\s*(.*?)\s*$/);
+    if (entry && section) sections.get(section)[entry[1].toLowerCase()] = entry[2];
+  }
+  const descriptions = sections.get('description') || sections.get('descriptions') || {};
+  const servers = sections.get('server') || sections.get('servers') || {};
+  const systems = sections.get('system') || sections.get('systems') || {};
+  const databases = sections.get('database') || sections.get('databases') || {};
+  const clients = sections.get('client') || sections.get('clients') || {};
+  const instances = sections.get('systemnumber') || {};
+  const sncNames = sections.get('sncname') || {};
+  const sncModes = sections.get('snc') || sections.get('sncmode') || {};
+  const keys = unique([...Object.keys(descriptions), ...Object.keys(servers)]);
+  return keys.map(key => normalizeRecord({
+    name: descriptions[key] || systems[key] || key,
+    server: servers[key],
+    systemid: databases[key] || systems[key],
+    client: clients[key],
+    systemnumber: instances[key],
+    sncname: sncNames[key],
+    sncmode: sncModes[key]
+  }, sourcePath)).filter(Boolean);
+}
+
+async function readGuiFile(path) {
+  const bytes = await readFile(path);
+  if (bytes[0] === 0xff && bytes[1] === 0xfe) return bytes.subarray(2).toString('utf16le');
+  if (bytes[0] === 0xfe && bytes[1] === 0xff) return bytes.subarray(2).swap16().toString('utf16le');
+  return bytes.toString('utf8').replace(/^\uFEFF/, '');
+}
+
+async function parseConnectionsFile(path) {
+  const content = await readGuiFile(path);
+  if (content.includes('<')) return parseLandscapeXml(content, path);
+  return content.split(/\r?\n/).map((line, index) => {
+    const parts = line.split(/[;,\t]/).map(text).filter(Boolean);
+    if (parts.length < 2) return null;
+    return normalizeRecord({ name: parts[0] || `SAP GUI ${index + 1}`, server: parts.find(part => /[A-Za-z]/.test(part) && part.includes('.')) || parts[1], systemid: parts.find(part => /^[A-Za-z0-9]{3}$/.test(part)) }, path);
+  }).filter(Boolean);
+}
+
+export async function discoverSapGuiSystems({ env = process.env, paths = sapGuiLandscapeCandidates(env) } = {}) {
+  const systems = [];
+  for (const path of unique(paths)) {
+    if (!path) continue;
+    try {
+      if (!await exists(path)) continue;
+      const info = await stat(path);
+      if (info.isDirectory()) {
+        for (const name of await readdir(path)) {
+          const child = join(path, name);
+          try {
+            if ((await stat(child)).isFile()) systems.push(...await parseConnectionsFile(child));
+          } catch {
+            // One unreadable child must not hide the rest of the directory.
+          }
+        }
+      } else if (/saplogon\.ini$/i.test(path)) {
+        systems.push(...parseSapLogonIni(await readGuiFile(path), path));
+      } else {
+        systems.push(...await parseConnectionsFile(path));
+      }
+    } catch {
+      // Ignore unreadable or unfamiliar SAP GUI files; discovery is best-effort.
+    }
+  }
+  const seen = new Set();
+  return systems.filter(system => {
+    const key = `${system.name}\0${system.host}\0${system.systemId}\0${system.instance}\0${system.client}`.toLowerCase();
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  }).sort((a, b) => a.name.localeCompare(b.name));
+}
+
+export function defaultAdtUrl(system) {
+  const host = text(system.host);
+  const instance = text(system.instance);
+  if (!host) return '';
+  // Router strings and other DIAG routes cannot be used as HTTP hosts.
+  if (/[\s/@?#]/.test(host)) return '';
+  const authority = host.includes(':') && !host.startsWith('[') ? `[${host}]` : host;
+  return /^\d{2}$/.test(instance) ? `https://${authority}:443${instance}` : `https://${authority}`;
+}

package/src/mcp-config.mjs

@@ -1,7 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
 import { access, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
-import { homedir } from 'node:os';
+import { homedir, platform } from 'node:os';
 import { basename, delimiter, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { brandedEnvValue } from './branding.mjs';
@@ -103,11 +103,22 @@ export async function resolveMcpConfigPath(env = process.env) {
     .find(value => typeof value === 'string' && value.length > 0);
   if (configuredPath) return configuredPath;
   const home = env.HOME || homedir();
-  const candidates = [
+  const appData = env.APPDATA || (env.USERPROFILE ? join(env.USERPROFILE, 'AppData', 'Roaming') : '');
+  const localVsCodeCandidates = [
+    ...(appData ? [join(appData, 'Code', 'User', 'mcp.json'), join(appData, 'Code - Insiders', 'User', 'mcp.json')] : []),
+    ...(platform() === 'darwin' ? [
+      join(home, 'Library', 'Application Support', 'Code', 'User', 'mcp.json'),
+      join(home, 'Library', 'Application Support', 'Code - Insiders', 'User', 'mcp.json')
+    ] : []),
+    join(home, '.config', 'Code', 'User', 'mcp.json'),
+    join(home, '.config', 'Code - Insiders', 'User', 'mcp.json')
+  ];
+  const basCandidates = [
     join(home, '.vscode', 'data', 'User', 'mcp.json'),
     join(home, '.vscode-server', 'data', 'User', 'mcp.json'),
     join(home, '.code-server', 'data', 'User', 'mcp.json')
   ];
+  const candidates = env.H2O_URL ? [...basCandidates, ...localVsCodeCandidates] : [...localVsCodeCandidates, ...basCandidates];
   for (const candidate of candidates) if (await exists(candidate)) return candidate;
   return candidates[0];
 }
@@ -141,15 +152,17 @@ export function buildSapDevelopmentMcpEntries(serverIds = SAP_DEVELOPMENT_MCP_SE
 
 export function buildMcpEntries(destinations, env = process.env) {
   const h2oUrl = env.H2O_URL;
-  if (!h2oUrl) throw new Error('H2O_URL is required to write SAP AI Dev Toolkit configuration');
+  const hasNonLocal = destinations.some(destination => destination?.source !== 'sap-gui-local');
+  if (destinations.length && hasNonLocal && !h2oUrl) throw new Error('H2O_URL is required to write SAP AI Dev Toolkit configuration');
   const entries = Object.create(null);
   const selected = [...destinations].sort((a, b) => String(a.serverName || a.name).localeCompare(String(b.serverName || b.name)));
   for (const destination of selected) {
     const isCf = destination.source === 'cloud-foundry';
+    const isLocalSapGui = destination.source === 'sap-gui-local';
     const name = generatedServerName(isCf ? destination.serverName : destination.name);
     if (Object.hasOwn(entries, name)) throw new Error(`Duplicate MCP destination server name: ${name} (two destination names normalize to the same lowercase server name)`);
     const entryEnv = {
-      H2O_URL: String(h2oUrl),
+      ...(h2oUrl ? { H2O_URL: String(h2oUrl) } : {}),
       SAP_ALLOW_TRANSPORTABLE_EDITS: 'true'
     };
     if (isCf) {
@@ -171,6 +184,16 @@ export function buildMcpEntries(destinations, env = process.env) {
           BAS_CF_CONNECTIVITY_KEY: String(cf.connectivityKeyName)
         });
       }
+    } else if (isLocalSapGui) {
+      if (!destination.url) throw new Error(`Local SAP GUI destination "${destination.name}" is missing an ADT URL`);
+      Object.assign(entryEnv, {
+        SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE: 'sap-gui-local',
+        SAP_AI_DEV_TOOLKIT_DESTINATION: String(destination.name),
+        SAP_URL: String(destination.url),
+        SAP_CLIENT: String(destination.client || '001'),
+        ...(destination.systemId ? { SAP_SYSTEM_ID: String(destination.systemId) } : {}),
+        ...(destination.childEnv || {})
+      });
     } else {
       entryEnv.SAP_AI_DEV_TOOLKIT_DESTINATION = String(destination.name);
     }
@@ -316,6 +339,12 @@ export async function installMcpConfig(destinationsOrOptions, options = {}) {
     ...buildMcpEntries(destinations, env),
     ...buildSapDevelopmentMcpEntries(options.sapDevelopmentServers || [], { packageVersions: companionVersions })
   };
+  const generatedInputs = new Map();
+  for (const destination of destinations) {
+    for (const input of Array.isArray(destination?.inputs) ? destination.inputs : []) {
+      if (input?.id) generatedInputs.set(input.id, input);
+    }
+  }
   const launcherCommand = options.command || (destinations.length ? await resolveMcpServerCommand(env) : null);
   if (launcherCommand) {
     for (const entry of Object.values(generated)) {
@@ -325,12 +354,19 @@ export async function installMcpConfig(destinationsOrOptions, options = {}) {
     }
   }
   const servers = Object.create(null);
+  const managedInputIds = new Set();
   for (const [name, entry] of Object.entries(config.servers)) {
     const managed = isPackageLauncher(entry)
       && typeof destinationValue(entry?.env) === 'string'
       && (destinationSource(entry.env) === 'cloud-foundry'
         ? typeof entry.env.BAS_CF_DESTINATION_KEY === 'string'
-        : destinationSource(entry.env) === undefined);
+        : (destinationSource(entry.env) === undefined || destinationSource(entry.env) === 'sap-gui-local'));
+    if (managed && destinationSource(entry.env) === 'sap-gui-local') {
+      for (const value of Object.values(entry.env || {})) {
+        const match = typeof value === 'string' ? value.match(/^\$\{input:([^}]+)}$/) : null;
+        if (match) managedInputIds.add(match[1]);
+      }
+    }
     if (!LEGACY_MCP_SERVER_PREFIXES.some(prefix => name.startsWith(prefix)) && !managed && !isCompanionServer(entry)) servers[name] = entry;
   }
   for (const name of Object.keys(generated)) {
@@ -339,6 +375,10 @@ export async function installMcpConfig(destinationsOrOptions, options = {}) {
     }
   }
   config.servers = { ...servers, ...generated };
+  if (generatedInputs.size || managedInputIds.size) {
+    const existingInputs = Array.isArray(config.inputs) ? config.inputs.filter(input => !generatedInputs.has(input?.id) && !managedInputIds.has(input?.id)) : [];
+    config.inputs = [...existingInputs, ...generatedInputs.values()];
+  }
   await writeConfig(path, config);
   return { path, servers: generated };
 }

package/src/mcp-proxy.mjs

@@ -168,6 +168,7 @@ function closeDestinationRoute(destination) {
 
 
 function useProxyAuthentication(destination) {
+  if (destination.source === 'sap-gui-local') return destination.authentication === 'WindowsSSO';
   return destination.source !== 'cloud-foundry' || destination.authentication === 'PrincipalPropagation';
 }
 

package/src/setup.mjs

@@ -1,7 +1,9 @@
 import { createInterface } from 'node:readline/promises';
 import { stdin, stdout } from 'node:process';
-import { checkboxPrompt, colorText, formatStatus } from './terminal-ui.mjs';
+import { platform } from 'node:os';
+import { checkboxPrompt, colorText, formatStatus, textPrompt } from './terminal-ui.mjs';
 import { discoverDestinations, remediation } from './bas-discovery.mjs';
+import { defaultAdtUrl, discoverSapGuiSystems } from './local-sap-gui.mjs';
 import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys, findOrphanedCloudFoundryServiceKeys } from './cf-destination.mjs';
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
 
@@ -11,6 +13,24 @@ function print(output, message) {
   output.write(`${message}\n`);
 }
 
+function windowsSsoSetupAvailable(env = process.env) {
+  return platform() === 'win32' || env.SAP_AI_DEV_TOOLKIT_ENABLE_WINDOWS_SSO_SETUP === 'true';
+}
+
+async function chooseLocalAuthMode(destination, { input = stdin, output = stdout, env = process.env } = {}) {
+  if (!windowsSsoSetupAvailable(env)) return 'basic';
+  const answer = await textPrompt({
+    message: `Authentication for ${destination.name} (password/sso)`,
+    placeholder: 'password',
+    required: false,
+    validate: value => {
+      const candidate = String(value || 'password').trim().toLowerCase();
+      return ['password', 'basic', 'sso', 'windows-sso'].includes(candidate) || 'Enter password or sso.';
+    }
+  }, { input, output });
+  const normalized = String(answer || 'password').trim().toLowerCase();
+  return ['sso', 'windows-sso'].includes(normalized) ? 'windows-sso' : 'basic';
+}
 
 async function confirmCloudFoundryImport({ input = stdin, output = stdout } = {}) {
   const readline = createInterface({ input, output });
@@ -46,6 +66,24 @@ function safeBasDestination(destination) {
   };
 }
 
+function safeLocalSapGuiDestination(destination) {
+  return {
+    source: 'sap-gui-local',
+    name: destination.name,
+    serverName: destination.serverName || destination.name,
+    url: destination.url,
+    host: destination.host,
+    systemId: destination.systemId,
+    instance: destination.instance,
+    client: destination.client || '001',
+    authentication: destination.authentication || 'Basic',
+    authMode: destination.authMode,
+    proxyType: 'Internet',
+    probe: safeProbe(destination.probe),
+    childEnv: destination.childEnv || {}
+  };
+}
+
 function safeCloudFoundryDestination(destination) {
   const cf = destination.cf || {};
   return {
@@ -99,28 +137,41 @@ export async function runSetup({
   output = stdout,
   discover = discoverDestinations,
   discoverCf = discoverCloudFoundryDestinations,
+  discoverLocalSapGui = discoverSapGuiSystems,
   confirmCfImport = confirmCloudFoundryImport,
   install = installMcpConfig,
   includeSapDevelopmentToolsPrompt = false
 } = {}) {
-  if (!env.H2O_URL) {
-    print(output, formatStatus(`Setup skipped: H2O_URL is not set. Run ${SETUP_COMMAND} in a BAS dev space.`, 'info', output, 'SAP AI Dev Toolkit'));
+  const isBas = Boolean(env.H2O_URL);
+  if (!isBas && (!input.isTTY || !output.isTTY)) {
+    print(output, formatStatus('BAS destination setup was skipped because H2O_URL is not set.', 'info', output, 'SAP AI Dev Toolkit'));
     return { skipped: true, reason: 'non-bas' };
   }
   if (!input.isTTY || !output.isTTY) {
-    print(output, formatStatus(`Interactive setup needs a terminal. Rerun ${SETUP_COMMAND} from a BAS terminal.`, 'warning', output, 'SAP AI Dev Toolkit'));
+    print(output, formatStatus(`Interactive setup needs a terminal. Rerun ${SETUP_COMMAND} from a terminal.`, 'warning', output, 'SAP AI Dev Toolkit'));
     return { skipped: true, reason: 'non-tty' };
   }
   print(output, '');
-  print(output, formatStatus('Contacting BAS to discover destinations; this may take a moment.', 'progress', output, 'Setup'));
+  print(output, formatStatus(isBas ? 'Contacting BAS to discover destinations; this may take a moment.' : 'Looking for local SAP GUI system configuration.', 'progress', output, 'Setup'));
 
-  let basDestinations;
-  try {
-    basDestinations = await discover({ env: { ...env, SAP_AI_DEV_TOOLKIT_DESTINATION: '' } });
-  } catch (error) {
-    throw new Error(`BAS discovery failed: ${error.message}`);
+  let destinations = [];
+  if (isBas) {
+    let basDestinations;
+    try {
+      basDestinations = await discover({ env: { ...env, SAP_AI_DEV_TOOLKIT_DESTINATION: '' } });
+    } catch (error) {
+      throw new Error(`BAS discovery failed: ${error.message}`);
+    }
+    destinations = basDestinations.map(safeBasDestination);
+  } else {
+    let localSystems;
+    try {
+      localSystems = await discoverLocalSapGui({ env });
+    } catch (error) {
+      throw new Error(`SAP GUI discovery failed: ${error.message}`);
+    }
+    destinations = localSystems.map(safeLocalSapGuiDestination);
   }
-  const destinations = basDestinations.map(safeBasDestination);
   const warnings = [];
   let createdKeys = [];
   let configPath;
@@ -132,9 +183,9 @@ export async function runSetup({
     warnings.push('Existing MCP config could not be read before setup; existing CF service keys will not be reused.');
   }
 
-  const target = await getCloudFoundryTarget({ env });
+  const target = isBas ? await getCloudFoundryTarget({ env }) : { available: false, reason: 'Cloud Foundry import is only available in BAS setup.' };
   if (!target.available) {
-    warnings.push(target.reason);
+    if (isBas) warnings.push(target.reason);
   } else {
     // Sweep for service keys this toolkit created but no config references
     // (an interrupted earlier setup leaves them behind; a Destination key
@@ -205,8 +256,8 @@ export async function runSetup({
   };
   const selectable = destinations.filter(destination => !destination.disabledReason);
   if (!selectable.length) {
-    print(output, formatStatus('No selectable BAS or Cloud Foundry destinations were found.', 'warning', output, 'Setup'));
-    print(output, remediation);
+    print(output, formatStatus(isBas ? 'No selectable BAS or Cloud Foundry destinations were found.' : 'No SAP GUI systems were found on this computer.', 'warning', output, 'Setup'));
+    print(output, isBas ? remediation : 'Install SAP GUI and create SAP Logon entries, or set SAP_AI_DEV_MCP_CONFIG and add systems manually. ADT still needs an HTTP(S) URL; SAP GUI files contain DIAG routing only.');
     await reportWarnings(warnings);
     const cleanupWarnings = await cleanupNewKeysWithoutConfigChange();
     await reportWarnings(cleanupWarnings);
@@ -222,9 +273,9 @@ export async function runSetup({
     const probe = destination.probe?.status || 'unknown';
     const source = destination.source === 'cloud-foundry'
       ? `CF ${destination.cf.destinationInstanceName}`
-      : 'BAS';
+      : (destination.source === 'sap-gui-local' ? `SAP GUI ${destination.systemId || destination.host || ''}`.trim() : 'BAS');
     const disabled = destination.disabledReason;
-    const state = disabled ? 'disabled' : (destination.probe?.available === false ? `fail:${probe}` : `ok:${probe}`);
+    const state = disabled ? 'disabled' : (probe === 'needs-adt-url' ? probe : (destination.probe?.available === false ? `fail:${probe}` : `ok:${probe}`));
     return {
       value: destination,
       name: `${destination.name} (${source}, client ${destination.client}, ${state})`,
@@ -245,6 +296,52 @@ export async function runSetup({
     shortcuts: { all: 'a' }
   }, { input, output });
 
+  if (!isBas && selected.length) {
+    print(output, '');
+    print(output, formatStatus('SAP GUI landscapes do not contain ADT HTTP(S) endpoints. Confirm the ADT URL and authentication for each selected system.', 'step', output, 'Local SAP GUI'));
+    if (windowsSsoSetupAvailable(env)) print(output, '  Windows SSO is experimental and only applies to ADT systems configured for HTTP Integrated Authentication. Username/password remains the default.');
+    for (const destination of selected) {
+      const fallback = defaultAdtUrl(destination);
+      const url = await textPrompt({
+        message: `ADT URL for ${destination.name}`,
+        placeholder: fallback || 'https://host:44300',
+        validate: value => {
+          const candidate = value || fallback;
+          if (!candidate) return 'Enter an ADT base URL, for example https://host:44300.';
+          try {
+            const parsed = new URL(candidate);
+            if (!['http:', 'https:'].includes(parsed.protocol)) return 'Use an http:// or https:// URL.';
+            if (parsed.username || parsed.password) return 'Do not embed credentials in the ADT URL; use the login prompts.';
+            if (parsed.search || parsed.hash) return 'Enter an ADT base URL without a query or fragment.';
+            return true;
+          }
+          catch { return 'Enter a valid URL.'; }
+        },
+        required: false
+      }, { input, output });
+      destination.url = url || fallback;
+      const authMode = await chooseLocalAuthMode(destination, { input, output, env });
+      destination.authentication = authMode === 'windows-sso' ? 'WindowsSSO' : 'Basic';
+      destination.authMode = authMode;
+      if (authMode === 'windows-sso') {
+        destination.childEnv = { SAP_AUTH_MODE: 'windows-sso' };
+        destination.inputs = [];
+      } else {
+        const userInputId = `sap-ai-dev-${destination.serverName || destination.name}-user`.toLowerCase().replace(/[^a-z0-9_-]+/g, '-');
+        const passwordInputId = `sap-ai-dev-${destination.serverName || destination.name}-password`.toLowerCase().replace(/[^a-z0-9_-]+/g, '-');
+        destination.childEnv = {
+          SAP_AUTH_MODE: 'basic',
+          SAP_USER: `\${input:${userInputId}}`,
+          SAP_PASSWORD: `\${input:${passwordInputId}}`
+        };
+        destination.inputs = [
+          { id: userInputId, type: 'promptString', description: `SAP user for ${destination.name}` },
+          { id: passwordInputId, type: 'promptString', description: `SAP password for ${destination.name}`, password: true }
+        ];
+      }
+    }
+  }
+
   let sapDevelopmentServers = [];
   if (includeSapDevelopmentToolsPrompt) {
     print(output, '');
@@ -269,18 +366,20 @@ export async function runSetup({
     const location = result?.path ? ` in ${result.path}` : '';
     print(output, '');
     const configuredCount = selected.length + sapDevelopmentServers.length;
-    print(output, formatStatus(`Configured ${configuredCount} MCP server${configuredCount === 1 ? '' : 's'}${location}.`, 'success', output, 'BAS setup'));
+    print(output, formatStatus(`Configured ${configuredCount} MCP server${configuredCount === 1 ? '' : 's'}${location}.`, 'success', output, isBas ? 'BAS setup' : 'Local setup'));
     printConnectionInstructions(output, result);
     let cleanupWarnings = [];
     const finalPath = result?.path || configPath;
-    if (!finalPath) {
-      cleanupWarnings.push('CF service-key cleanup skipped because the final MCP config path is unavailable.');
-    } else {
-      try {
-        const finalConfig = await readMcpConfig(finalPath);
-        cleanupWarnings = await cleanupKeys([...managedKeys, ...createdKeys], finalConfig);
-      } catch {
-        cleanupWarnings.push('CF service-key cleanup skipped because the final MCP config could not be read.');
+    if (isBas) {
+      if (!finalPath) {
+        cleanupWarnings.push('CF service-key cleanup skipped because the final MCP config path is unavailable.');
+      } else {
+        try {
+          const finalConfig = await readMcpConfig(finalPath);
+          cleanupWarnings = await cleanupKeys([...managedKeys, ...createdKeys], finalConfig);
+        } catch {
+          cleanupWarnings.push('CF service-key cleanup skipped because the final MCP config could not be read.');
+        }
       }
     }
     await reportWarnings(warnings);

package/src/windows-sso-adt-proxy.mjs

@@ -0,0 +1,224 @@
+import http from 'node:http';
+import { once } from 'node:events';
+import { execFile as nodeExecFile } from 'node:child_process';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const MAX_HELPER_OUTPUT = 1024 * 1024;
+const HOP_BY_HOP = new Set(['connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization', 'te', 'trailer', 'transfer-encoding', 'upgrade']);
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
+
+function safeError(message) { return new Error(message); }
+
+function validateTarget(value) {
+  let url;
+  try { url = new URL(value); }
+  catch { throw safeError('Windows SSO target ADT URL is invalid'); }
+  if (!['http:', 'https:'].includes(url.protocol) || !url.hostname || url.username || url.password) {
+    throw safeError('Windows SSO target ADT URL must be an HTTP(S) URL without embedded user information');
+  }
+  url.hash = '';
+  return url;
+}
+
+function hasNegotiateChallenge(headers) {
+  const value = headers.get?.('www-authenticate') || '';
+  return /(?:^|,)\s*Negotiate\b/i.test(value);
+}
+
+function headerObject(headers) {
+  const result = {};
+  for (const [name, value] of Object.entries(headers || {})) {
+    const lower = name.toLowerCase();
+    if (HOP_BY_HOP.has(lower) || lower === 'host') continue;
+    if (lower === 'authorization') continue;
+    if (value == null) continue;
+    result[name] = Array.isArray(value) ? value.join(', ') : String(value);
+  }
+  return result;
+}
+
+function copyResponseHeaders(response, { proxyOrigin, targetOrigin } = {}) {
+  const headers = {};
+  for (const [name, value] of response.headers) {
+    const lower = name.toLowerCase();
+    if (HOP_BY_HOP.has(lower) || ['content-encoding', 'content-length', 'set-cookie'].includes(lower)) continue;
+    // fetch exposes decompressed bytes, so upstream framing is no longer valid.
+    if (lower === 'location' && proxyOrigin && targetOrigin) {
+      try {
+        const location = new URL(value, targetOrigin);
+        if (location.origin === targetOrigin) {
+          headers[name] = `${proxyOrigin}${location.pathname}${location.search}${location.hash}`;
+          continue;
+        }
+      } catch {
+        // Keep unparsable Location values unchanged; the client/backend can decide.
+      }
+    }
+    headers[name] = value;
+  }
+  const cookies = setCookies(response.headers);
+  if (cookies.length) headers['set-cookie'] = cookies;
+  return headers;
+}
+
+function setCookies(headers) {
+  if (typeof headers?.getSetCookie === 'function') return headers.getSetCookie();
+  const value = headers?.get?.('set-cookie');
+  return value ? [value] : [];
+}
+
+function mergeCookieHeader(existing, cookies) {
+  const pairs = new Map();
+  for (const part of String(existing || '').split(';')) {
+    const trimmed = part.trim();
+    const index = trimmed.indexOf('=');
+    if (index > 0) pairs.set(trimmed.slice(0, index), trimmed.slice(index + 1));
+  }
+  for (const cookie of cookies || []) {
+    const first = String(cookie || '').split(';', 1)[0]?.trim();
+    const index = first.indexOf('=');
+    if (index > 0) pairs.set(first.slice(0, index), first.slice(index + 1));
+  }
+  return [...pairs].map(([name, value]) => `${name}=${value}`).join('; ');
+}
+
+async function readRequestBody(req, limit = 50 * 1024 * 1024) {
+  if (['GET', 'HEAD'].includes(req.method || 'GET')) return undefined;
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    size += chunk.length;
+    if (size > limit) throw safeError('Windows SSO proxy request body is too large');
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+function helperCommand(env) {
+  const command = env.SAP_AI_DEV_TOOLKIT_NEGOTIATE_HELPER || env.SAP_AI_DEV_TOOLKIT_SSPI_HELPER;
+  if (command) return { command, args: [] };
+  if (process.platform !== 'win32') return null;
+  return {
+    command: env.SystemRoot ? join(env.SystemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe') : 'powershell.exe',
+    args: ['-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', join(root, 'scripts', 'windows-negotiate-helper.ps1')]
+  };
+}
+
+function tokenLooksLikeNtlm(token) {
+  try {
+    return Buffer.from(token, 'base64').subarray(0, 8).toString('ascii') === 'NTLMSSP\0';
+  } catch {
+    return false;
+  }
+}
+
+function execHelper(helper, payload, execFileImpl = nodeExecFile, env = process.env) {
+  return new Promise((resolve, reject) => {
+    const child = execFileImpl(helper.command, helper.args, {
+      windowsHide: true,
+      timeout: 30_000,
+      maxBuffer: MAX_HELPER_OUTPUT,
+      env: { ...process.env, ...env }
+    }, (error, stdout) => {
+      // execFile errors can contain helper stdout/stderr, including tokens.
+      if (error) return reject(safeError('Windows SSO helper failed; verify the helper and Windows Kerberos configuration.'));
+      const token = String(stdout || '').trim();
+      if (!/^[A-Za-z0-9+/=_-]+$/.test(token)) return reject(safeError('Windows SSO helper returned an invalid Negotiate token'));
+      if (tokenLooksLikeNtlm(token)) return reject(safeError('Windows SSO helper returned an NTLM token. ADT SSO requires Kerberos/SPNEGO; verify the backend SPN and Kerberos configuration, or rerun sap-ai-dev --setup and choose username/password.'));
+      resolve(token);
+    });
+    child.stdin?.end(`${JSON.stringify(payload)}\n`);
+  });
+}
+
+async function acquireNegotiateToken({ targetUrl, challenge, env, execFileImpl }) {
+  const helper = helperCommand(env);
+  if (!helper) {
+    throw safeError('Windows SSO requires an SSPI/Negotiate helper. Set SAP_AI_DEV_TOOLKIT_NEGOTIATE_HELPER to a trusted helper executable, or rerun sap-ai-dev --setup and choose username/password.');
+  }
+  return execHelper(helper, { url: targetUrl, challenge, mechanism: 'Negotiate' }, execFileImpl, env);
+}
+
+async function forward(req, targetUrl, headers, body, fetchImpl) {
+  return fetchImpl(targetUrl, {
+    method: req.method,
+    headers,
+    body,
+    duplex: body ? 'half' : undefined,
+    redirect: 'manual'
+  });
+}
+
+function writeFetchResponse(res, response, base, proxyOrigin) {
+  res.writeHead(response.status, response.statusText, copyResponseHeaders(response, { proxyOrigin, targetOrigin: base.origin }));
+  if (!response.body) return res.end();
+  response.body.pipeTo(new WritableStream({
+    write(chunk) { res.write(chunk); },
+    close() { res.end(); },
+    abort() { res.destroy(); }
+  })).catch(() => res.destroy());
+}
+
+export async function createWindowsSsoAdtProxy({ destinationUrl, env = process.env, fetchImpl = globalThis.fetch, execFileImpl = nodeExecFile } = {}) {
+  if (process.platform !== 'win32' && env.SAP_AI_DEV_TOOLKIT_ALLOW_SSO_PROXY_ON_NON_WINDOWS !== 'true') {
+    throw safeError('Windows SSO for local ADT destinations is only supported on Windows');
+  }
+  if (typeof fetchImpl !== 'function') throw safeError('HTTP fetch implementation is unavailable');
+  const base = validateTarget(destinationUrl);
+  const sockets = new Set();
+  let closed = false;
+  let proxyOrigin = '';
+
+  const server = http.createServer(async (req, res) => {
+    if (closed) return res.destroy();
+    let target;
+    try {
+      target = new URL(req.url || '/', base);
+      if (target.origin !== base.origin) throw safeError('Cross-origin Windows SSO proxy request rejected');
+      const headers = headerObject(req.headers);
+      const body = await readRequestBody(req);
+      let response = await forward(req, target, headers, body, fetchImpl);
+      if (response.status === 401 && hasNegotiateChallenge(response.headers)) {
+        const challenge = response.headers.get('www-authenticate') || '';
+        const cancel = response.body?.cancel?.();
+        await cancel?.catch?.(() => {});
+        const token = await acquireNegotiateToken({ targetUrl: target.href, challenge, env, execFileImpl });
+        const retryHeaders = { ...headers, Authorization: `Negotiate ${token}` };
+        const cookies = mergeCookieHeader(headers.cookie || headers.Cookie, setCookies(response.headers));
+        delete retryHeaders.cookie;
+        delete retryHeaders.Cookie;
+        if (cookies) retryHeaders.Cookie = cookies;
+        response = await forward(req, target, retryHeaders, body, fetchImpl);
+      }
+      writeFetchResponse(res, response, base, proxyOrigin);
+    } catch (error) {
+      if (!res.headersSent) {
+        res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8', connection: 'close' });
+        res.end(`${error.message || 'Windows SSO proxy request failed'}\n`);
+      } else {
+        res.destroy();
+      }
+    }
+  });
+
+  server.on('connection', socket => {
+    sockets.add(socket);
+    socket.on('close', () => sockets.delete(socket));
+  });
+
+  server.listen(0, '127.0.0.1');
+  await once(server, 'listening');
+  const address = server.address();
+  proxyOrigin = `http://127.0.0.1:${address.port}`;
+  return {
+    url: proxyOrigin,
+    close: async () => {
+      if (closed) return;
+      closed = true;
+      for (const socket of sockets) socket.destroy();
+      server.close();
+      await once(server, 'close').catch(() => {});
+    }
+  };
+}