sap-ai-dev-toolkit 0.7.8 → 0.8.0

package/README.md

@@ -52,13 +52,13 @@ To also add optional full-stack SAP companion MCP servers for Fiori, UI5, CAP, a
 sap-ai-dev --setup --tools
 ```
 
-Then connect a destination in SAP Business Application Studio:
+Then connect a destination in SAP Business Application Studio, or run the same setup locally to discover SAP GUI systems and create VS Code MCP entries:
 
 1. Open the Command Palette.
 2. Run **MCP: List Servers**.
-3. Start the server named after your selected BAS destination (the lowercase slug, for example `demo-abap` for destination `DEMO_ABAP`).
+3. Start the server named after your selected destination (the lowercase slug, for example `demo-abap` for destination `DEMO_ABAP`).
 4. In your AI assistant's chat, choose the best-fit bundled agent from the agent picker (GitHub Copilot, Claude Code, and opencode install the agents) or invoke the matching Pi prompt template (`/sap-solution-architect`, `/abap-developer`, `/abap-runtime-debugger`, `/rap-service-developer`, or `/hana-cloud-hdi-specialist`): **SAP Solution Architect**, **ABAP Developer**, **ABAP Runtime Debugger**, **RAP Service Developer**, or **HANA Cloud/HDI Specialist**.
-5. In the Chat tools picker, enable the server for that BAS destination.
+5. In the Chat tools picker, enable the server for that destination.
 6. Ask the agent to inspect, build, test, or verify something in your SAP landscape.
 
 Use the attached destination-prefixed tools directly in chat. Do not launch `sap-ai-dev` or handcraft MCP JSON-RPC in a terminal to discover or call them.
@@ -236,13 +236,13 @@ Once the destination server is enabled in your chat's tools picker, ask for outc
 | 🔒 **SAP authorization remains authoritative** | The add-on does not bypass backend SAP permissions. |
 | 🚚 **Curated VSP tool surface** | The proxy exposes the same curated developer-lifecycle set for every destination, plus local workflow tools; SAP authorizations and VSP safety checks still apply. |
 | 🧱 **Per-destination isolation** | Generated MCP entries are scoped to a single `SAP_AI_DEV_TOOLKIT_DESTINATION`. |
-| 🔑 **No credentials in `mcp.json`** | Authentication material stays in BAS destination configuration rather than MCP config. |
+| 🔑 **Credential-aware setup** | BAS authentication material stays in Destination configuration. Local SAP GUI setup writes VS Code input prompts for SAP user/password instead of raw credentials. |
 
 <a id="install"></a>
 
 ## 📦 Installation
 
-Install globally from a BAS dev space:
+Install globally from SAP Business Application Studio or from a local workstation with SAP GUI installed:
 
 ```sh
 npm install --global sap-ai-dev-toolkit
@@ -270,7 +270,9 @@ The installer handles VSP provisioning automatically:
 - Uses the package's bundled patched VSP binary for the current platform, verified against the npm-published `dist/checksums.txt`. A checksum-anchored remote download is the fallback only when the package has no bundled asset.
 - No Go toolchain is downloaded or required at install time; Go is only used by the repository's own `build:vsp` development script.
 
-With `H2O_URL` set, an interactive install opens a checkbox picker with no destinations selected by default. Use **Space** to choose destinations and **Enter** to confirm. Press **a** to toggle all destinations (select all if any are unchecked; otherwise clear the selection). Confirming with none selected removes this add-on's managed MCP entries. When the `cf` CLI 8.18 or newer is authenticated to a targeted space, setup first offers an optional import from that space's Destination service; type **y** then **Enter** to include it, or press **Enter** to skip. Accepted CF and BAS destinations appear together in the picker. npm may run its install hook without an interactive terminal, even when the shell is interactive; in that case, selection is skipped without changing MCP config.
+Setup detects where it is running. With `H2O_URL` set, it treats the environment as SAP Business Application Studio and opens a checkbox picker for BAS destinations, with no destinations selected by default. Use **Space** to choose destinations and **Enter** to confirm. Press **a** to toggle all destinations (select all if any are unchecked; otherwise clear the selection). Confirming with none selected removes this add-on's managed MCP entries. When the `cf` CLI 8.18 or newer is authenticated to a targeted space, setup first offers an optional import from that space's Destination service; type **y** then **Enter** to include it, or press **Enter** to skip. Accepted CF and BAS destinations appear together in the picker.
+
+Without `H2O_URL`, interactive setup looks for local SAP GUI system configuration on macOS and Windows (for example SAP GUI landscape XML and `saplogon.ini`). SAP GUI landscape files describe SAP GUI/DIAG connectivity, not the ADT HTTP(S) endpoint, so setup asks you to confirm the ADT URL for each selected system. The generated MCP entry uses VS Code input prompts for the SAP user and password at server start; raw SAP credentials are not stored in `mcp.json`. On Windows, setup can instead write an experimental `SAP_AUTH_MODE=windows-sso` entry without username/password prompts; this requires the ADT endpoint to support HTTP Negotiate/SPNEGO. Runtime uses the bundled Windows Negotiate helper by default, or a trusted custom helper configured with `SAP_AI_DEV_TOOLKIT_NEGOTIATE_HELPER`. npm may run its install hook without an interactive terminal, even when the shell is interactive; in that case, destination selection is skipped without changing MCP config.
 
 
 The same postinstall offers the bundled agents and skills for several AI coding harnesses in a checkbox picker. **GitHub Copilot** and **Claude Code** start pre-checked, so pressing **Enter** alone installs both; **Space** selects or deselects a harness, **a** toggles all seven, and confirming with none selected skips the step without changing files. When destination MCP setup succeeds, the generated managed MCP servers are also mirrored into selected harnesses that have a stable user-level JSON MCP configuration (Claude Code, Cursor, Gemini CLI, and Pi Coding Agent). GitHub Copilot continues to use the BAS/VS Code MCP configuration written during destination setup. With no interactive terminal, the assets are installed for GitHub Copilot only; set `SAP_AI_DEV_TOOLKIT_HARNESSES` to a comma-separated list of harness ids (`github-copilot`, `claude-code`, `codex`, `cursor`, `gemini-cli`, `opencode`, `pi-coding-agent`) to choose non-interactively.
@@ -279,9 +281,9 @@ Some current npm versions also require install hooks to be approved. If npm repo
 
 The setup report uses icons and terminal colors; set `NO_COLOR=1` to disable ANSI colors. The table is a weather report, not a bouncer: green **PASS** means the ADT probe responded, red **FAIL** means it failed, and yellow **SKIPPED** means it was skipped. Probe failures do not block MCP registration or startup for destinations you select.
 
-Run `sap-ai-dev --setup` later to change the destination selection or remove generated destination entries. Run `sap-ai-dev --setup --tools` to also choose optional companion tools. Use `--npx` to make generated BAS/VSP destination entries start the pinned package through npm instead of relying on a global `sap-ai-dev` command; companion tools already use `npx` with their own npm packages.
+Run `sap-ai-dev --setup` later to change the destination selection or remove generated destination entries. Run `sap-ai-dev --setup --tools` to also choose optional companion tools. Use `--npx` to make generated destination entries start the pinned package through npm instead of relying on a global `sap-ai-dev` command; companion tools already use `npx` with their own npm packages.
 
-If a setup step is skipped or fails, rerun it from an interactive BAS terminal:
+If a setup step is skipped or fails, rerun it from an interactive terminal:
 
 ```sh
 sap-ai-dev --setup
@@ -293,7 +295,7 @@ To configure without a global install, run the guided setup directly through npm
 npx --yes --ignore-scripts --package=sap-ai-dev-toolkit sap-ai-dev --setup --npx
 ```
 
-This lists discovered systems in the same checkbox picker, with nothing selected by default. Use **Space** to choose destinations, **Enter** to confirm, and **a** to toggle all (select all if any are unchecked; otherwise clear the selection). It writes MCP entries that launch the selected servers through npx. The entries pin the package version used during setup, and `--ignore-scripts` avoids running the install-time wizard a second time. After setup, in BAS run **MCP: List Servers**, select each chosen destination, and choose **Start Server**.
+This lists discovered systems in the same checkbox picker, with nothing selected by default. Use **Space** to choose destinations, **Enter** to confirm, and **a** to toggle all (select all if any are unchecked; otherwise clear the selection). It writes MCP entries that launch the selected servers through npx. The entries pin the package version used during setup, and `--ignore-scripts` avoids running the install-time wizard a second time. After setup, in BAS or VS Code run **MCP: List Servers**, select each chosen destination, and choose **Start Server**.
 
 For a non-interactive installation or a platform without a published VSP asset, provide a trusted binary override:
 
@@ -747,6 +749,11 @@ The response contains a `tools` array. A `RunQuery` entry resembles this excerpt
 | `SAP_AI_DEV_TOOLKIT_DESTINATION` | Comma-separated destination allowlist for normal runtime discovery. Setup clears this temporarily so it can display all eligible systems. |
 | `SAP_AI_DEV_TOOLKIT_MODE` | VSP child mode (`expert` by default; `focused` omits `ActivateMultiple`, `GetUserTransports`, and `GetTransportInfo`). The proxy exposes its curated tool subset and local workflow tools, including `LintABAP`. |
 | `SAP_ALLOW_TRANSPORTABLE_EDITS` | Generated MCP entries set this to `true` to permit source edits in transportable packages; VSP safety checks and SAP authorizations still apply. |
+| `SAP_AUTH_MODE=windows-sso` | Local SAP GUI entry mode for experimental Windows Integrated Authentication. Runtime starts a loopback ADT proxy and does not pass SAP username/password credentials to VSP. |
+| `SAP_TLS_SERVER_NAMES` / `SAP_AI_DEV_TOOLKIT_TLS_SERVER_NAMES` | Comma-separated local SAP GUI TLS self-healing names, normally auto-discovered during setup from the SAP HTTPS certificate when `SAP_URL` uses an IP address. Runtime tries them one by one while keeping certificate validation enabled. |
+| `SAP_TLS_SERVER_NAME` / `SAP_AI_DEV_TOOLKIT_TLS_SERVER_NAME` | Single-name compatibility form of the local SAP GUI TLS self-healing override. Prefer the auto-discovered plural variable written by setup. |
+| `SAP_TLS_CA_FILE` / `SAP_AI_DEV_TOOLKIT_TLS_CA_FILE` | Optional PEM CA bundle for the local TLS self-healing proxy when the SAP HTTPS certificate chains to a private CA that is not in the OS/Node trust store. Certificate verification remains enabled. |
+| `SAP_AI_DEV_TOOLKIT_NEGOTIATE_HELPER` / `SAP_AI_DEV_TOOLKIT_SSPI_HELPER` | Optional trusted Windows helper executable used by the local Windows SSO proxy to convert an HTTP `WWW-Authenticate: Negotiate` challenge into a Kerberos/SPNEGO token. NTLM fallback is rejected because it is connection-oriented and unsafe for this proxy shape. When unset on Windows, the bundled PowerShell SSPI helper is used. A custom helper receives one JSON line on stdin (`url`, `challenge`, `mechanism`) and prints the base64 token on stdout. |
 | `SAP_AI_DEV_TOOLKIT_HTTP_PROXY` | Egress proxy for BAS discovery and probe traffic. Takes precedence over `HTTP_PROXY`/`http_proxy`; unset means the default BAS proxy for `.dest` hosts, empty means direct. |
 | `SAP_AI_DEV_TOOLKIT_REQUEST_TIMEOUT_MS` | Per-request timeout for calls forwarded to a VSP child (default 600000 = 10 minutes; `0` disables). A stalled request fails with a timeout error; the child is left running. |
 | `SAP_AI_DEV_MCP_CONFIG` | Explicit MCP configuration path; highest precedence. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.7.8",
+  "version": "0.8.0",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/scripts/postinstall.mjs

@@ -88,7 +88,9 @@ async function installSelectedHarnessAssets(ids) {
   }
   for (const assets of results) {
     const installed = assets.installed + assets.updated;
-    await announce(`${assets.label}: ${installed} file${installed === 1 ? '' : 's'} installed or updated in ${assets.root}; ${assets.unchanged} already current.`, 'success');
+    const removed = assets.removed || 0;
+    const cleanup = removed > 0 ? `; ${removed} duplicate or legacy file${removed === 1 ? '' : 's'} removed` : '';
+    await announce(`${assets.label}: ${installed} file${installed === 1 ? '' : 's'} installed or updated in ${assets.root}; ${assets.unchanged} already current${cleanup}.`, 'success');
     if (assets.conflicts.length > 0) {
       const paths = assets.conflicts.map(path => join(assets.root, path)).join(', ');
       await announce(`${assets.label}: existing customizations were preserved; review these paths: ${paths}`, 'warning');
@@ -152,6 +154,11 @@ async function runHarnessAssetInstall() {
 async function wireHarnessMcpServers(ids, servers) {
   const entries = servers && Object.keys(servers).length ? servers : null;
   if (!entries || !ids?.length) return;
+  const hasLocalSapGui = Object.values(entries).some(entry => entry?.env?.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'sap-gui-local');
+  if (hasLocalSapGui) {
+    await announce('Local SAP GUI MCP entries use VS Code input prompts for SAP login, so automatic wiring into non-VS Code harness MCP files was skipped. Configure those harnesses manually if they support secure runtime prompts.', 'info');
+    return;
+  }
   const { results, failures } = await installMcpServersForHarnesses(ids, entries, { env: runtimeEnv });
   for (const result of results) {
     if (!result.supported) {
@@ -190,7 +197,7 @@ export function destinationTable(destinations, registeredNames) {
     const registered = registeredNames.has(generatedServerName(destination.serverName || destination.name));
     const source = destination.source === 'cloud-foundry'
       ? `CF ${destination.cf?.destinationInstanceName || 'unknown instance'}`
-      : 'BAS';
+      : (destination.source === 'sap-gui-local' ? 'SAP GUI' : 'BAS');
     return [
       { text: destination.name, output: destination.name },
       { text: source, output: source },
@@ -242,9 +249,10 @@ async function announceSetup(result) {
   const registeredNames = new Set(servers.map(([name]) => name));
   const entryDetails = servers.flatMap(([name, entry]) => {
     const destination = destinationsByServer.get(name);
-    const source = brandedEnvValue(entry.env, 'DESTINATION_SOURCE') === 'cloud-foundry' || destination?.source === 'cloud-foundry'
+    const configuredSource = brandedEnvValue(entry.env, 'DESTINATION_SOURCE') || destination?.source;
+    const source = configuredSource === 'cloud-foundry'
       ? 'Cloud Foundry'
-      : 'BAS';
+      : (configuredSource === 'sap-gui-local' ? 'Local SAP GUI' : 'BAS');
     const destinationName = brandedEnvValue(entry.env, 'DESTINATION') || destination?.name || 'unknown';
     const client = destination?.client || '001';
     const authentication = destination?.authentication || 'unknown';

package/scripts/windows-negotiate-helper.ps1

@@ -0,0 +1,182 @@
+# Windows Integrated Authentication helper for sap-ai-dev-toolkit.
+# Reads one JSON object from stdin with: url, challenge, mechanism.
+# Writes only the base64 Negotiate token to stdout.
+# Errors are written to stderr and exit non-zero.
+
+$ErrorActionPreference = 'Stop'
+
+$sspiSource = @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+
+public static class SapAiDevSspiNegotiate
+{
+    const int SECPKG_CRED_OUTBOUND = 2;
+    const int SECBUFFER_VERSION = 0;
+    const int SECBUFFER_TOKEN = 2;
+    const int SECURITY_NATIVE_DREP = 0x10;
+    const int SEC_E_OK = 0;
+    const int SEC_I_CONTINUE_NEEDED = 0x00090312;
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct SecHandle
+    {
+        public IntPtr dwLower;
+        public IntPtr dwUpper;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct SecBuffer
+    {
+        public int cbBuffer;
+        public int BufferType;
+        public IntPtr pvBuffer;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct SecBufferDesc
+    {
+        public int ulVersion;
+        public int cBuffers;
+        public IntPtr pBuffers;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct SECURITY_INTEGER
+    {
+        public uint LowPart;
+        public int HighPart;
+    }
+
+    [DllImport("secur32.dll", CharSet = CharSet.Unicode, SetLastError = false)]
+    static extern int AcquireCredentialsHandle(
+        string pszPrincipal,
+        string pszPackage,
+        int fCredentialUse,
+        IntPtr pvLogonID,
+        IntPtr pAuthData,
+        IntPtr pGetKeyFn,
+        IntPtr pvGetKeyArgument,
+        out SecHandle phCredential,
+        out SECURITY_INTEGER ptsExpiry);
+
+    [DllImport("secur32.dll", CharSet = CharSet.Unicode, SetLastError = false)]
+    static extern int InitializeSecurityContext(
+        ref SecHandle phCredential,
+        IntPtr phContext,
+        string pszTargetName,
+        int fContextReq,
+        int Reserved1,
+        int TargetDataRep,
+        IntPtr pInput,
+        int Reserved2,
+        out SecHandle phNewContext,
+        IntPtr pOutput,
+        out int pfContextAttr,
+        out SECURITY_INTEGER ptsExpiry);
+
+    [DllImport("secur32.dll", SetLastError = false)]
+    static extern int FreeCredentialsHandle(ref SecHandle phCredential);
+
+    [DllImport("secur32.dll", SetLastError = false)]
+    static extern int DeleteSecurityContext(ref SecHandle phContext);
+
+    static void Check(int status, string operation)
+    {
+        if (status == SEC_E_OK || status == SEC_I_CONTINUE_NEEDED) return;
+        throw new Win32Exception(status, operation + " failed with SSPI status 0x" + status.ToString("X8"));
+    }
+
+    static IntPtr BufferDesc(byte[] token, out IntPtr tokenMemory, out IntPtr bufferMemory)
+    {
+        tokenMemory = IntPtr.Zero;
+        SecBuffer buffer = new SecBuffer();
+        buffer.BufferType = SECBUFFER_TOKEN;
+        if (token != null && token.Length > 0)
+        {
+            tokenMemory = Marshal.AllocHGlobal(token.Length);
+            Marshal.Copy(token, 0, tokenMemory, token.Length);
+            buffer.cbBuffer = token.Length;
+            buffer.pvBuffer = tokenMemory;
+        }
+        bufferMemory = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(SecBuffer)));
+        Marshal.StructureToPtr(buffer, bufferMemory, false);
+        SecBufferDesc desc = new SecBufferDesc();
+        desc.ulVersion = SECBUFFER_VERSION;
+        desc.cBuffers = 1;
+        desc.pBuffers = bufferMemory;
+        IntPtr descMemory = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(SecBufferDesc)));
+        Marshal.StructureToPtr(desc, descMemory, false);
+        return descMemory;
+    }
+
+    static void FreeDesc(IntPtr descMemory, IntPtr tokenMemory, IntPtr bufferMemory)
+    {
+        if (descMemory != IntPtr.Zero) Marshal.FreeHGlobal(descMemory);
+        if (bufferMemory != IntPtr.Zero) Marshal.FreeHGlobal(bufferMemory);
+        if (tokenMemory != IntPtr.Zero) Marshal.FreeHGlobal(tokenMemory);
+    }
+
+    public static string CreateToken(string targetName, string incomingBase64)
+    {
+        SecHandle credential;
+        SECURITY_INTEGER expiry;
+        int status = AcquireCredentialsHandle(null, "Negotiate", SECPKG_CRED_OUTBOUND, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, out credential, out expiry);
+        Check(status, "AcquireCredentialsHandle");
+
+        SecHandle context = new SecHandle();
+        IntPtr inputDesc = IntPtr.Zero, inputToken = IntPtr.Zero, inputBuffer = IntPtr.Zero;
+        IntPtr outputDesc = IntPtr.Zero, outputToken = IntPtr.Zero, outputBuffer = IntPtr.Zero;
+        try
+        {
+            byte[] incoming = null;
+            if (!String.IsNullOrWhiteSpace(incomingBase64)) incoming = Convert.FromBase64String(incomingBase64);
+            if (incoming != null && incoming.Length > 0) inputDesc = BufferDesc(incoming, out inputToken, out inputBuffer);
+
+            outputDesc = BufferDesc(new byte[12288], out outputToken, out outputBuffer);
+            int attrs;
+            status = InitializeSecurityContext(ref credential, IntPtr.Zero, targetName, 0, 0, SECURITY_NATIVE_DREP, inputDesc, 0, out context, outputDesc, out attrs, out expiry);
+            Check(status, "InitializeSecurityContext");
+
+            SecBuffer outBuffer = (SecBuffer) Marshal.PtrToStructure(outputBuffer, typeof(SecBuffer));
+            if (outBuffer.cbBuffer <= 0 || outBuffer.pvBuffer == IntPtr.Zero) throw new Exception("SSPI returned an empty Negotiate token.");
+            byte[] bytes = new byte[outBuffer.cbBuffer];
+            Marshal.Copy(outBuffer.pvBuffer, bytes, 0, bytes.Length);
+            return Convert.ToBase64String(bytes);
+        }
+        finally
+        {
+            FreeDesc(inputDesc, inputToken, inputBuffer);
+            FreeDesc(outputDesc, outputToken, outputBuffer);
+            DeleteSecurityContext(ref context);
+            FreeCredentialsHandle(ref credential);
+        }
+    }
+}
+'@
+
+try {
+  $raw = [Console]::In.ReadToEnd()
+  if ([string]::IsNullOrWhiteSpace($raw)) { throw 'Missing helper request on stdin.' }
+  $request = $raw | ConvertFrom-Json
+  if (-not $request.url) { throw 'Missing target URL.' }
+
+  $uri = [Uri] [string] $request.url
+  if ($uri.Scheme -ne 'http' -and $uri.Scheme -ne 'https') { throw 'Target URL must use HTTP or HTTPS.' }
+  if ($uri.UserInfo) { throw 'Target URL must not contain user information.' }
+
+  Add-Type -TypeDefinition $sspiSource -Language CSharp
+
+  $incoming = $null
+  $challenge = [string] $request.challenge
+  if ($challenge -match '(?i)Negotiate\s+([^,\s]+)') { $incoming = $Matches[1] }
+  $targetName = 'HTTP/' + $uri.DnsSafeHost
+  $token = [SapAiDevSspiNegotiate]::CreateToken($targetName, $incoming)
+  if ([string]::IsNullOrWhiteSpace($token)) { throw 'Negotiate token generation returned an empty token.' }
+  [Console]::Out.WriteLine($token.Trim())
+  exit 0
+} catch {
+  [Console]::Error.WriteLine($_.Exception.Message)
+  exit 1
+}

package/src/install-user-assets.mjs

@@ -69,17 +69,43 @@ async function planDestinations(harness, files) {
   for (const file of files) {
     const raw = await readFile(file.source);
     if (!file.target.startsWith(`agents${sep}`)) {
-      destinations.push({ target: file.target, content: raw });
+      destinations.push({ target: file.target, content: raw, aliases: [] });
       continue;
     }
     if (!harness.supportsAgents) continue;
-    const fileName = harness.agentFileName ? harness.agentFileName(basename(file.target)) : basename(file.target);
+    const sourceName = basename(file.target);
+    const fileName = harness.agentFileName ? harness.agentFileName(sourceName) : sourceName;
+    const prefix = harness.agentTargetPrefix || 'agents';
+    const target = join(prefix, fileName);
+    const aliasCandidates = [
+      file.target,
+      join(prefix, sourceName),
+      join('agents', fileName)
+    ];
+    const aliases = [...new Set(aliasCandidates.filter(alias => alias !== target))];
     const content = harness.agentDocument ? Buffer.from(harness.agentDocument(raw.toString('utf8')), 'utf8') : raw;
-    destinations.push({ target: join(harness.agentTargetPrefix || 'agents', fileName), content });
+    destinations.push({ target, content, aliases });
   }
   return destinations;
 }
 
+async function reconcileRemovableFile({ targetRoot, target, contentHash, previousFiles }) {
+  const path = join(targetRoot, target);
+  let existing;
+  try {
+    existing = await readFile(path);
+  } catch (error) {
+    if (error.code === 'ENOENT') return 'missing';
+    throw error;
+  }
+  const existingHash = digest(existing);
+  if (previousFiles[target] === existingHash || existingHash === contentHash) {
+    await rm(path, { force: true });
+    return 'removed';
+  }
+  return 'conflict';
+}
+
 export async function installUserAssets({ harness, home = process.env.HOME || homedir(), root = packageRoot, env = process.env } = {}) {
   const destinations = await planDestinations(harness, await collectSourceFiles(root));
   const targetRoot = harnessRoot(harness, { home, env });
@@ -89,15 +115,22 @@ export async function installUserAssets({ harness, home = process.env.HOME || ho
   const legacyFiles = harness.legacyManifest ? await readManagedFiles(legacyManifestPath) : {};
   const currentFiles = await readManagedFiles(manifestPath);
   const previousFiles = { ...legacyFiles, ...currentFiles };
-  const managedFiles = { ...previousFiles };
+  const managedFiles = {};
+  const activeTargets = new Set(destinations.flatMap(file => [file.target, ...file.aliases]));
   const conflicts = [];
   let installed = 0;
   let updated = 0;
   let unchanged = 0;
+  let removed = 0;
 
   for (const file of destinations) {
     const destination = join(targetRoot, file.target);
     const contentHash = digest(file.content);
+    for (const alias of file.aliases) {
+      const status = await reconcileRemovableFile({ targetRoot, target: alias, contentHash, previousFiles });
+      if (status === 'removed') removed += 1;
+      if (status === 'conflict') conflicts.push(alias);
+    }
     await mkdir(dirname(destination), { recursive: true, mode: 0o755 });
 
     let existing;
@@ -129,9 +162,16 @@ export async function installUserAssets({ harness, home = process.env.HOME || ho
     }
   }
 
+  for (const target of Object.keys(previousFiles)) {
+    if (activeTargets.has(target) || managedFiles[target]) continue;
+    const status = await reconcileRemovableFile({ targetRoot, target, contentHash: '', previousFiles });
+    if (status === 'removed') removed += 1;
+    if (status === 'conflict') conflicts.push(target);
+  }
+
   await replaceFile(manifestPath, `${JSON.stringify({ version: 1, files: managedFiles }, null, 2)}\n`);
   if (harness.legacyManifest) await rm(legacyManifestPath, { force: true });
-  return { harness: harness.id, label: harness.label, root: targetRoot, installed, updated, unchanged, conflicts };
+  return { harness: harness.id, label: harness.label, root: targetRoot, installed, updated, unchanged, removed, conflicts };
 }
 
 export async function installUserAssetsForHarnesses(ids, { home, root = packageRoot, env = process.env } = {}) {

package/src/launcher.mjs

@@ -4,11 +4,14 @@ import { readFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { discoverDestinations, remediation, slugifyDestination, statusRows } from './bas-discovery.mjs';
+import { discoverSapGuiSystems } from './local-sap-gui.mjs';
 import { findBinary } from './binary.mjs';
 import { MCPProxy } from './mcp-proxy.mjs';
 import { installMcpConfig, repairManagedMcpConfig } from './mcp-config.mjs';
 import { runSetup } from './setup.mjs';
 import { resolveConfiguredCloudFoundryDestination } from './cf-destination.mjs';
+import { createWindowsSsoAdtProxy } from './windows-sso-adt-proxy.mjs';
+import { createTlsServerNameAdtProxy } from './tls-adt-proxy.mjs';
 import { withBrandedEnvironment } from './branding.mjs';
 import { redactText } from './redact.mjs';
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
@@ -25,7 +28,7 @@ function usage() {
   return [
     'Usage: sap-ai-dev [options]',
     '',
-    'With H2O_URL set and no command, starts the SAP AI Dev Toolkit stdio server for selected BAS destinations.',
+    'With H2O_URL set, starts the SAP AI Dev Toolkit stdio server for selected BAS destinations; with local SAP GUI setup, starts the selected local ADT system.',
     'Options:',
     '  --setup                  Configure generated BAS MCP servers',
     '  --tools                  Also offer full-stack SAP companion MCP servers (use with --setup)',
@@ -161,9 +164,58 @@ async function binaryOrError() {
 async function discoverForCommand() {
   const env = { ...runtimeEnv };
   if (env.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry') env.SAP_AI_DEV_TOOLKIT_DESTINATION = '';
+  if (!env.H2O_URL) {
+    const systems = await discoverSapGuiSystems({ env });
+    if (!systems.length) throw new Error('H2O_URL is required for BAS destination discovery');
+    return systems;
+  }
   return discoverDestinations({ env });
 }
 
+async function configuredLocalSapGuiDestination(env) {
+  const name = env.SAP_AI_DEV_TOOLKIT_DESTINATION || env.SAP_SYSTEM_ID || 'local-sap';
+  if (!env.SAP_URL) throw new Error('SAP_URL is required for local SAP GUI MCP entries. Rerun sap-ai-dev --setup and enter the ADT URL.');
+  const authMode = String(env.SAP_AUTH_MODE || '').toLowerCase();
+  const tlsServerName = String(env.SAP_TLS_SERVER_NAME || env.SAP_AI_DEV_TOOLKIT_TLS_SERVER_NAME || '').trim();
+  const tlsServerNames = String(env.SAP_TLS_SERVER_NAMES || env.SAP_AI_DEV_TOOLKIT_TLS_SERVER_NAMES || tlsServerName).split(',').map(value => value.trim()).filter(Boolean);
+  const tlsCaFile = String(env.SAP_TLS_CA_FILE || env.SAP_AI_DEV_TOOLKIT_TLS_CA_FILE || '').trim();
+  const tlsRoute = tlsServerNames.length
+    ? await createTlsServerNameAdtProxy({ destinationUrl: env.SAP_URL, tlsServerNames, caFile: tlsCaFile || undefined })
+    : null;
+  const adtUrl = tlsRoute?.url || env.SAP_URL;
+  const closeRoute = async route => {
+    await Promise.all([route?.close?.(), tlsRoute?.close?.()].filter(Boolean).map(close => Promise.resolve().then(close).catch(() => {})));
+  };
+  if (authMode === 'windows-sso') {
+    const route = await createWindowsSsoAdtProxy({ destinationUrl: adtUrl, env });
+    return {
+      source: 'sap-gui-local',
+      name,
+      url: route.url,
+      backendUrl: env.SAP_URL,
+      client: env.SAP_CLIENT || '001',
+      authentication: 'WindowsSSO',
+      childEnv: {},
+      close: () => closeRoute(route),
+      probe: { status: tlsRoute ? 'configured-tls-server-name' : 'configured', available: true }
+    };
+  }
+  return {
+    source: 'sap-gui-local',
+    name,
+    url: adtUrl,
+    backendUrl: tlsRoute ? env.SAP_URL : undefined,
+    client: env.SAP_CLIENT || '001',
+    authentication: 'Basic',
+    childEnv: {
+      SAP_USER: env.SAP_USER || env.SAP_USERNAME || '',
+      SAP_PASSWORD: env.SAP_PASSWORD || env.SAP_PASS || ''
+    },
+    close: tlsRoute?.close,
+    probe: { status: tlsRoute ? 'configured-tls-server-name' : 'configured', available: true }
+  };
+}
+
 async function main() {
   const setup = hasFlag('--setup');
   const check = hasFlag('--check');
@@ -184,7 +236,9 @@ async function main() {
     try {
       const destinations = runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry'
         ? [await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })]
-        : await discoverForCommand();
+        : (runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'sap-gui-local'
+          ? [await configuredLocalSapGuiDestination(runtimeEnv)]
+          : await discoverForCommand());
       report = await runDoctor(destinations);
     } catch (error) {
       report = { ok: false, destinations: 0, checks: [doctorRow('-', 'destination discovery', 'failed', redactText(error.message || error).slice(0, 300))] };
@@ -219,8 +273,10 @@ async function main() {
     return;
   }
 
-  if (runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry') {
-    const destination = await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv });
+  if (['cloud-foundry', 'sap-gui-local'].includes(runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE)) {
+    const destination = runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry'
+      ? await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })
+      : await configuredLocalSapGuiDestination(runtimeEnv);
     let proxy;
     try {
       const binary = await binaryOrError();