sap-ai-dev-toolkit 0.7.8 → 0.8.0

package/src/local-sap-gui.mjs

@@ -0,0 +1,217 @@
+import { platform, homedir } from 'node:os';
+import { join } from 'node:path';
+import { readdir, readFile, stat } from 'node:fs/promises';
+
+function text(value) { return value == null ? '' : String(value).trim(); }
+function decodeXml(value) {
+  return text(value)
+    .replace(/"/g, '"')
+    .replace(/'/g, "'")
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&amp;/g, '&');
+}
+
+async function exists(path) {
+  try { await stat(path); return true; }
+  catch (error) { if (error?.code === 'ENOENT') return false; throw error; }
+}
+
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
+}
+
+export function sapGuiLandscapeCandidates(env = process.env) {
+  const home = env.HOME || env.USERPROFILE || homedir();
+  const appData = env.APPDATA || (env.USERPROFILE ? join(env.USERPROFILE, 'AppData', 'Roaming') : '');
+  const candidates = [];
+  if (platform() === 'win32' || appData) {
+    candidates.push(
+      join(appData || '', 'SAP', 'Common', 'SAPUILandscape.xml'),
+      join(appData || '', 'SAP', 'Common', 'SAPUILandscapeGlobal.xml'),
+      join(appData || '', 'SAP', 'Common', 'saplogon.ini')
+    );
+  }
+  candidates.push(
+    join(home, 'Library', 'Preferences', 'SAP', 'SAPGUILandscape.xml'),
+    join(home, 'Library', 'Preferences', 'SAP', 'SAPUILandscape.xml'),
+    join(home, 'Library', 'Preferences', 'SAP', 'connections'),
+    join(home, '.SAPGUI', 'SAPGUILandscape.xml')
+  );
+  return unique(candidates);
+}
+
+function attributes(fragment) {
+  const result = {};
+  for (const match of fragment.matchAll(/([A-Za-z_:][\w:.-]*)\s*=\s*"([^"]*)"|([A-Za-z_:][\w:.-]*)\s*=\s*'([^']*)'/g)) {
+    result[String(match[1] || match[3]).toLowerCase()] = decodeXml(match[2] ?? match[4]);
+  }
+  return result;
+}
+
+function ssoHintFrom(record) {
+  const ssoKeys = ['sncname', 'sncpartnername', 'sncmode', 'snc_mode', 'sncqop', 'snc_qop', 'use_sso', 'sso'];
+  if (ssoKeys.some(key => {
+    const value = text(record[key]);
+    return value && !['0', 'false', 'no', 'off'].includes(value.toLowerCase());
+  })) return true;
+  const values = [record.authentication, record.auth].map(text).filter(Boolean);
+  return values.some(value => /snc|sso|kerberos|spnego|secure\s*login/i.test(value) || ['1', 'true', 'yes'].includes(value.toLowerCase()));
+}
+
+function instanceFrom(value) {
+  const candidates = [value?.instance, value?.instancenumber, value?.instanceNumber, value?.sysnr, value?.systemnumber];
+  for (const candidate of candidates) {
+    const match = text(candidate).match(/^\d{2}$/);
+    if (match) return match[0];
+  }
+  return '';
+}
+
+function normalizeRecord(record, sourcePath) {
+  const type = text(record.type || record.kind).toLowerCase();
+  if (type && !['sapgui', 'r/3', 'sap'].some(token => type.includes(token))) return null;
+  const name = text(record.name || record.description || record.desc || record.systemid || record.sid || record.uuid);
+  const address = text(record.server || record.host || record.applicationserver || record.messageserver || record.mshost);
+  // SAP GUI ports are DIAG dispatcher ports, not HTTP ports.
+  const endpoint = address.match(/^(\[[^\]]+\]|[^:/]+):(\d+)$/);
+  const host = endpoint ? endpoint[1] : address;
+  const systemId = text(record.systemid || record.sid || record.r3name).toUpperCase();
+  if (!name || !host) return null;
+  const port = endpoint ? Number(endpoint[2]) : 0;
+  const instance = instanceFrom(record) || (port >= 3200 && port <= 3299 ? String(port - 3200).padStart(2, '0') : '');
+  const client = text(record.client || record.sapclient) || '001';
+  return {
+    source: 'sap-gui-local',
+    name,
+    serverName: name,
+    host,
+    systemId,
+    instance,
+    client,
+    authentication: ssoHintFrom(record) ? 'Basic/SSO hint' : 'Basic',
+    authMode: 'basic',
+    ssoHint: ssoHintFrom(record),
+    proxyType: 'Internet',
+    landscapePath: sourcePath,
+    probe: { status: 'needs-adt-url' }
+  };
+}
+
+function parseLandscapeXml(content, sourcePath) {
+  const records = [];
+  // Comments must not turn deleted entries into selectable systems.
+  content = content.replace(/<!--[\s\S]*?-->/g, '');
+  const messageServers = new Map();
+  for (const match of content.matchAll(/<Messageserver\b([^>]*)>/gi)) {
+    const record = attributes(match[1]);
+    if (record.uuid) messageServers.set(record.uuid, record);
+  }
+  for (const match of content.matchAll(/<Service\b([^>]*)\/?>(?:\s*<\/Service>)?/gi)) {
+    const record = attributes(match[1]);
+    if (record.msid) {
+      const messageServer = messageServers.get(record.msid);
+      // For load-balanced entries `server` is a logon group, not a host.
+      if (!messageServer?.host) continue;
+      record.server = messageServer.host;
+    }
+    const normalized = normalizeRecord(record, sourcePath);
+    if (normalized) records.push(normalized);
+  }
+  // SAP GUI for Java files may use generic Item/Connection elements.
+  for (const match of content.matchAll(/<(?:Item|Connection)\b([^>]*)\/?>(?:\s*<\/(?:Item|Connection)>)?/gi)) {
+    const normalized = normalizeRecord(attributes(match[1]), sourcePath);
+    if (normalized) records.push(normalized);
+  }
+  return records;
+}
+
+function parseSapLogonIni(content, sourcePath) {
+  const sections = new Map();
+  let section = '';
+  for (const line of content.split(/\r?\n/)) {
+    const header = line.match(/^\s*\[(.+)]\s*$/);
+    if (header) { section = header[1].toLowerCase(); if (!sections.has(section)) sections.set(section, {}); continue; }
+    const entry = line.match(/^\s*([^=]+?)\s*=\s*(.*?)\s*$/);
+    if (entry && section) sections.get(section)[entry[1].toLowerCase()] = entry[2];
+  }
+  const descriptions = sections.get('description') || sections.get('descriptions') || {};
+  const servers = sections.get('server') || sections.get('servers') || {};
+  const systems = sections.get('system') || sections.get('systems') || {};
+  const databases = sections.get('database') || sections.get('databases') || {};
+  const clients = sections.get('client') || sections.get('clients') || {};
+  const instances = sections.get('systemnumber') || {};
+  const sncNames = sections.get('sncname') || {};
+  const sncModes = sections.get('snc') || sections.get('sncmode') || {};
+  const keys = unique([...Object.keys(descriptions), ...Object.keys(servers)]);
+  return keys.map(key => normalizeRecord({
+    name: descriptions[key] || systems[key] || key,
+    server: servers[key],
+    systemid: databases[key] || systems[key],
+    client: clients[key],
+    systemnumber: instances[key],
+    sncname: sncNames[key],
+    sncmode: sncModes[key]
+  }, sourcePath)).filter(Boolean);
+}
+
+async function readGuiFile(path) {
+  const bytes = await readFile(path);
+  if (bytes[0] === 0xff && bytes[1] === 0xfe) return bytes.subarray(2).toString('utf16le');
+  if (bytes[0] === 0xfe && bytes[1] === 0xff) return bytes.subarray(2).swap16().toString('utf16le');
+  return bytes.toString('utf8').replace(/^\uFEFF/, '');
+}
+
+async function parseConnectionsFile(path) {
+  const content = await readGuiFile(path);
+  if (content.includes('<')) return parseLandscapeXml(content, path);
+  return content.split(/\r?\n/).map((line, index) => {
+    const parts = line.split(/[;,\t]/).map(text).filter(Boolean);
+    if (parts.length < 2) return null;
+    return normalizeRecord({ name: parts[0] || `SAP GUI ${index + 1}`, server: parts.find(part => /[A-Za-z]/.test(part) && part.includes('.')) || parts[1], systemid: parts.find(part => /^[A-Za-z0-9]{3}$/.test(part)) }, path);
+  }).filter(Boolean);
+}
+
+export async function discoverSapGuiSystems({ env = process.env, paths = sapGuiLandscapeCandidates(env) } = {}) {
+  const systems = [];
+  for (const path of unique(paths)) {
+    if (!path) continue;
+    try {
+      if (!await exists(path)) continue;
+      const info = await stat(path);
+      if (info.isDirectory()) {
+        for (const name of await readdir(path)) {
+          const child = join(path, name);
+          try {
+            if ((await stat(child)).isFile()) systems.push(...await parseConnectionsFile(child));
+          } catch {
+            // One unreadable child must not hide the rest of the directory.
+          }
+        }
+      } else if (/saplogon\.ini$/i.test(path)) {
+        systems.push(...parseSapLogonIni(await readGuiFile(path), path));
+      } else {
+        systems.push(...await parseConnectionsFile(path));
+      }
+    } catch {
+      // Ignore unreadable or unfamiliar SAP GUI files; discovery is best-effort.
+    }
+  }
+  const seen = new Set();
+  return systems.filter(system => {
+    const key = `${system.name}\0${system.host}\0${system.systemId}\0${system.instance}\0${system.client}`.toLowerCase();
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  }).sort((a, b) => a.name.localeCompare(b.name));
+}
+
+export function defaultAdtUrl(system) {
+  const host = text(system.host);
+  const instance = text(system.instance);
+  if (!host) return '';
+  // Router strings and other DIAG routes cannot be used as HTTP hosts.
+  if (/[\s/@?#]/.test(host)) return '';
+  const authority = host.includes(':') && !host.startsWith('[') ? `[${host}]` : host;
+  return /^\d{2}$/.test(instance) ? `https://${authority}:443${instance}` : `https://${authority}`;
+}

package/src/mcp-config.mjs

@@ -1,7 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
 import { access, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
-import { homedir } from 'node:os';
+import { homedir, platform } from 'node:os';
 import { basename, delimiter, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { brandedEnvValue } from './branding.mjs';
@@ -103,11 +103,22 @@ export async function resolveMcpConfigPath(env = process.env) {
     .find(value => typeof value === 'string' && value.length > 0);
   if (configuredPath) return configuredPath;
   const home = env.HOME || homedir();
-  const candidates = [
+  const appData = env.APPDATA || (env.USERPROFILE ? join(env.USERPROFILE, 'AppData', 'Roaming') : '');
+  const localVsCodeCandidates = [
+    ...(appData ? [join(appData, 'Code', 'User', 'mcp.json'), join(appData, 'Code - Insiders', 'User', 'mcp.json')] : []),
+    ...(platform() === 'darwin' ? [
+      join(home, 'Library', 'Application Support', 'Code', 'User', 'mcp.json'),
+      join(home, 'Library', 'Application Support', 'Code - Insiders', 'User', 'mcp.json')
+    ] : []),
+    join(home, '.config', 'Code', 'User', 'mcp.json'),
+    join(home, '.config', 'Code - Insiders', 'User', 'mcp.json')
+  ];
+  const basCandidates = [
     join(home, '.vscode', 'data', 'User', 'mcp.json'),
     join(home, '.vscode-server', 'data', 'User', 'mcp.json'),
     join(home, '.code-server', 'data', 'User', 'mcp.json')
   ];
+  const candidates = env.H2O_URL ? [...basCandidates, ...localVsCodeCandidates] : [...localVsCodeCandidates, ...basCandidates];
   for (const candidate of candidates) if (await exists(candidate)) return candidate;
   return candidates[0];
 }
@@ -141,15 +152,17 @@ export function buildSapDevelopmentMcpEntries(serverIds = SAP_DEVELOPMENT_MCP_SE
 
 export function buildMcpEntries(destinations, env = process.env) {
   const h2oUrl = env.H2O_URL;
-  if (!h2oUrl) throw new Error('H2O_URL is required to write SAP AI Dev Toolkit configuration');
+  const hasNonLocal = destinations.some(destination => destination?.source !== 'sap-gui-local');
+  if (destinations.length && hasNonLocal && !h2oUrl) throw new Error('H2O_URL is required to write SAP AI Dev Toolkit configuration');
   const entries = Object.create(null);
   const selected = [...destinations].sort((a, b) => String(a.serverName || a.name).localeCompare(String(b.serverName || b.name)));
   for (const destination of selected) {
     const isCf = destination.source === 'cloud-foundry';
+    const isLocalSapGui = destination.source === 'sap-gui-local';
     const name = generatedServerName(isCf ? destination.serverName : destination.name);
     if (Object.hasOwn(entries, name)) throw new Error(`Duplicate MCP destination server name: ${name} (two destination names normalize to the same lowercase server name)`);
     const entryEnv = {
-      H2O_URL: String(h2oUrl),
+      ...(h2oUrl ? { H2O_URL: String(h2oUrl) } : {}),
       SAP_ALLOW_TRANSPORTABLE_EDITS: 'true'
     };
     if (isCf) {
@@ -171,6 +184,18 @@ export function buildMcpEntries(destinations, env = process.env) {
           BAS_CF_CONNECTIVITY_KEY: String(cf.connectivityKeyName)
         });
       }
+    } else if (isLocalSapGui) {
+      if (!destination.url) throw new Error(`Local SAP GUI destination "${destination.name}" is missing an ADT URL`);
+      Object.assign(entryEnv, {
+        SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE: 'sap-gui-local',
+        SAP_AI_DEV_TOOLKIT_DESTINATION: String(destination.name),
+        SAP_URL: String(destination.url),
+        SAP_CLIENT: String(destination.client || '001'),
+        ...(destination.systemId ? { SAP_SYSTEM_ID: String(destination.systemId) } : {}),
+        ...(Array.isArray(destination.tlsServerNames) && destination.tlsServerNames.length ? { SAP_TLS_SERVER_NAMES: destination.tlsServerNames.join(',') } : {}),
+        ...(!Array.isArray(destination.tlsServerNames) && destination.tlsServerName ? { SAP_TLS_SERVER_NAME: String(destination.tlsServerName) } : {}),
+        ...(destination.childEnv || {})
+      });
     } else {
       entryEnv.SAP_AI_DEV_TOOLKIT_DESTINATION = String(destination.name);
     }
@@ -316,6 +341,12 @@ export async function installMcpConfig(destinationsOrOptions, options = {}) {
     ...buildMcpEntries(destinations, env),
     ...buildSapDevelopmentMcpEntries(options.sapDevelopmentServers || [], { packageVersions: companionVersions })
   };
+  const generatedInputs = new Map();
+  for (const destination of destinations) {
+    for (const input of Array.isArray(destination?.inputs) ? destination.inputs : []) {
+      if (input?.id) generatedInputs.set(input.id, input);
+    }
+  }
   const launcherCommand = options.command || (destinations.length ? await resolveMcpServerCommand(env) : null);
   if (launcherCommand) {
     for (const entry of Object.values(generated)) {
@@ -325,12 +356,19 @@ export async function installMcpConfig(destinationsOrOptions, options = {}) {
     }
   }
   const servers = Object.create(null);
+  const managedInputIds = new Set();
   for (const [name, entry] of Object.entries(config.servers)) {
     const managed = isPackageLauncher(entry)
       && typeof destinationValue(entry?.env) === 'string'
       && (destinationSource(entry.env) === 'cloud-foundry'
         ? typeof entry.env.BAS_CF_DESTINATION_KEY === 'string'
-        : destinationSource(entry.env) === undefined);
+        : (destinationSource(entry.env) === undefined || destinationSource(entry.env) === 'sap-gui-local'));
+    if (managed && destinationSource(entry.env) === 'sap-gui-local') {
+      for (const value of Object.values(entry.env || {})) {
+        const match = typeof value === 'string' ? value.match(/^\$\{input:([^}]+)}$/) : null;
+        if (match) managedInputIds.add(match[1]);
+      }
+    }
     if (!LEGACY_MCP_SERVER_PREFIXES.some(prefix => name.startsWith(prefix)) && !managed && !isCompanionServer(entry)) servers[name] = entry;
   }
   for (const name of Object.keys(generated)) {
@@ -339,6 +377,10 @@ export async function installMcpConfig(destinationsOrOptions, options = {}) {
     }
   }
   config.servers = { ...servers, ...generated };
+  if (generatedInputs.size || managedInputIds.size) {
+    const existingInputs = Array.isArray(config.inputs) ? config.inputs.filter(input => !generatedInputs.has(input?.id) && !managedInputIds.has(input?.id)) : [];
+    config.inputs = [...existingInputs, ...generatedInputs.values()];
+  }
   await writeConfig(path, config);
   return { path, servers: generated };
 }

package/src/mcp-proxy.mjs

@@ -168,6 +168,7 @@ function closeDestinationRoute(destination) {
 
 
 function useProxyAuthentication(destination) {
+  if (destination.source === 'sap-gui-local') return destination.authentication === 'WindowsSSO';
   return destination.source !== 'cloud-foundry' || destination.authentication === 'PrincipalPropagation';
 }
 

package/src/setup.mjs

@@ -1,9 +1,13 @@
 import { createInterface } from 'node:readline/promises';
 import { stdin, stdout } from 'node:process';
-import { checkboxPrompt, colorText, formatStatus } from './terminal-ui.mjs';
+import { platform } from 'node:os';
+import { isIP } from 'node:net';
+import { checkboxPrompt, colorText, formatStatus, textPrompt } from './terminal-ui.mjs';
 import { discoverDestinations, remediation } from './bas-discovery.mjs';
+import { defaultAdtUrl, discoverSapGuiSystems } from './local-sap-gui.mjs';
 import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys, findOrphanedCloudFoundryServiceKeys } from './cf-destination.mjs';
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
+import { discoverCertificateDnsNames } from './tls-adt-proxy.mjs';
 
 const SETUP_COMMAND = 'sap-ai-dev --setup';
 
@@ -11,6 +15,24 @@ function print(output, message) {
   output.write(`${message}\n`);
 }
 
+function windowsSsoSetupAvailable(env = process.env) {
+  return platform() === 'win32' || env.SAP_AI_DEV_TOOLKIT_ENABLE_WINDOWS_SSO_SETUP === 'true';
+}
+
+async function chooseLocalAuthMode(destination, { input = stdin, output = stdout, env = process.env } = {}) {
+  if (!windowsSsoSetupAvailable(env)) return 'basic';
+  const answer = await textPrompt({
+    message: `Authentication for ${destination.name} (password/sso)`,
+    placeholder: 'password',
+    required: false,
+    validate: value => {
+      const candidate = String(value || 'password').trim().toLowerCase();
+      return ['password', 'basic', 'sso', 'windows-sso'].includes(candidate) || 'Enter password or sso.';
+    }
+  }, { input, output });
+  const normalized = String(answer || 'password').trim().toLowerCase();
+  return ['sso', 'windows-sso'].includes(normalized) ? 'windows-sso' : 'basic';
+}
 
 async function confirmCloudFoundryImport({ input = stdin, output = stdout } = {}) {
   const readline = createInterface({ input, output });
@@ -46,6 +68,26 @@ function safeBasDestination(destination) {
   };
 }
 
+function safeLocalSapGuiDestination(destination) {
+  return {
+    source: 'sap-gui-local',
+    name: destination.name,
+    serverName: destination.serverName || destination.name,
+    url: destination.url,
+    host: destination.host,
+    systemId: destination.systemId,
+    instance: destination.instance,
+    client: destination.client || '001',
+    authentication: destination.authentication || 'Basic',
+    authMode: destination.authMode,
+    proxyType: 'Internet',
+    tlsServerName: destination.tlsServerName,
+    tlsServerNames: destination.tlsServerNames,
+    probe: safeProbe(destination.probe),
+    childEnv: destination.childEnv || {}
+  };
+}
+
 function safeCloudFoundryDestination(destination) {
   const cf = destination.cf || {};
   return {
@@ -99,28 +141,41 @@ export async function runSetup({
   output = stdout,
   discover = discoverDestinations,
   discoverCf = discoverCloudFoundryDestinations,
+  discoverLocalSapGui = discoverSapGuiSystems,
   confirmCfImport = confirmCloudFoundryImport,
   install = installMcpConfig,
   includeSapDevelopmentToolsPrompt = false
 } = {}) {
-  if (!env.H2O_URL) {
-    print(output, formatStatus(`Setup skipped: H2O_URL is not set. Run ${SETUP_COMMAND} in a BAS dev space.`, 'info', output, 'SAP AI Dev Toolkit'));
+  const isBas = Boolean(env.H2O_URL);
+  if (!isBas && (!input.isTTY || !output.isTTY)) {
+    print(output, formatStatus('BAS destination setup was skipped because H2O_URL is not set.', 'info', output, 'SAP AI Dev Toolkit'));
     return { skipped: true, reason: 'non-bas' };
   }
   if (!input.isTTY || !output.isTTY) {
-    print(output, formatStatus(`Interactive setup needs a terminal. Rerun ${SETUP_COMMAND} from a BAS terminal.`, 'warning', output, 'SAP AI Dev Toolkit'));
+    print(output, formatStatus(`Interactive setup needs a terminal. Rerun ${SETUP_COMMAND} from a terminal.`, 'warning', output, 'SAP AI Dev Toolkit'));
     return { skipped: true, reason: 'non-tty' };
   }
   print(output, '');
-  print(output, formatStatus('Contacting BAS to discover destinations; this may take a moment.', 'progress', output, 'Setup'));
+  print(output, formatStatus(isBas ? 'Contacting BAS to discover destinations; this may take a moment.' : 'Looking for local SAP GUI system configuration.', 'progress', output, 'Setup'));
 
-  let basDestinations;
-  try {
-    basDestinations = await discover({ env: { ...env, SAP_AI_DEV_TOOLKIT_DESTINATION: '' } });
-  } catch (error) {
-    throw new Error(`BAS discovery failed: ${error.message}`);
+  let destinations = [];
+  if (isBas) {
+    let basDestinations;
+    try {
+      basDestinations = await discover({ env: { ...env, SAP_AI_DEV_TOOLKIT_DESTINATION: '' } });
+    } catch (error) {
+      throw new Error(`BAS discovery failed: ${error.message}`);
+    }
+    destinations = basDestinations.map(safeBasDestination);
+  } else {
+    let localSystems;
+    try {
+      localSystems = await discoverLocalSapGui({ env });
+    } catch (error) {
+      throw new Error(`SAP GUI discovery failed: ${error.message}`);
+    }
+    destinations = localSystems.map(safeLocalSapGuiDestination);
   }
-  const destinations = basDestinations.map(safeBasDestination);
   const warnings = [];
   let createdKeys = [];
   let configPath;
@@ -132,9 +187,9 @@ export async function runSetup({
     warnings.push('Existing MCP config could not be read before setup; existing CF service keys will not be reused.');
   }
 
-  const target = await getCloudFoundryTarget({ env });
+  const target = isBas ? await getCloudFoundryTarget({ env }) : { available: false, reason: 'Cloud Foundry import is only available in BAS setup.' };
   if (!target.available) {
-    warnings.push(target.reason);
+    if (isBas) warnings.push(target.reason);
   } else {
     // Sweep for service keys this toolkit created but no config references
     // (an interrupted earlier setup leaves them behind; a Destination key
@@ -205,8 +260,8 @@ export async function runSetup({
   };
   const selectable = destinations.filter(destination => !destination.disabledReason);
   if (!selectable.length) {
-    print(output, formatStatus('No selectable BAS or Cloud Foundry destinations were found.', 'warning', output, 'Setup'));
-    print(output, remediation);
+    print(output, formatStatus(isBas ? 'No selectable BAS or Cloud Foundry destinations were found.' : 'No SAP GUI systems were found on this computer.', 'warning', output, 'Setup'));
+    print(output, isBas ? remediation : 'Install SAP GUI and create SAP Logon entries, or set SAP_AI_DEV_MCP_CONFIG and add systems manually. ADT still needs an HTTP(S) URL; SAP GUI files contain DIAG routing only.');
     await reportWarnings(warnings);
     const cleanupWarnings = await cleanupNewKeysWithoutConfigChange();
     await reportWarnings(cleanupWarnings);
@@ -222,9 +277,9 @@ export async function runSetup({
     const probe = destination.probe?.status || 'unknown';
     const source = destination.source === 'cloud-foundry'
       ? `CF ${destination.cf.destinationInstanceName}`
-      : 'BAS';
+      : (destination.source === 'sap-gui-local' ? `SAP GUI ${destination.systemId || destination.host || ''}`.trim() : 'BAS');
     const disabled = destination.disabledReason;
-    const state = disabled ? 'disabled' : (destination.probe?.available === false ? `fail:${probe}` : `ok:${probe}`);
+    const state = disabled ? 'disabled' : (probe === 'needs-adt-url' ? probe : (destination.probe?.available === false ? `fail:${probe}` : `ok:${probe}`));
     return {
       value: destination,
       name: `${destination.name} (${source}, client ${destination.client}, ${state})`,
@@ -245,6 +300,74 @@ export async function runSetup({
     shortcuts: { all: 'a' }
   }, { input, output });
 
+  if (!isBas && selected.length) {
+    print(output, '');
+    print(output, formatStatus('SAP GUI landscapes do not contain ADT HTTP(S) endpoints. Confirm the ADT URL and authentication for each selected system.', 'step', output, 'Local SAP GUI'));
+    if (windowsSsoSetupAvailable(env)) print(output, '  Windows SSO is experimental and only applies to ADT systems configured for HTTP Integrated Authentication. Username/password remains the default.');
+    for (const destination of selected) {
+      const fallback = defaultAdtUrl(destination);
+      const url = await textPrompt({
+        message: `ADT URL for ${destination.name}`,
+        placeholder: fallback || 'https://host:44300',
+        validate: value => {
+          const candidate = value || fallback;
+          if (!candidate) return 'Enter an ADT base URL, for example https://host:44300.';
+          try {
+            const parsed = new URL(candidate);
+            if (!['http:', 'https:'].includes(parsed.protocol)) return 'Use an http:// or https:// URL.';
+            if (parsed.username || parsed.password) return 'Do not embed credentials in the ADT URL; use the login prompts.';
+            if (parsed.search || parsed.hash) return 'Enter an ADT base URL without a query or fragment.';
+            return true;
+          }
+          catch { return 'Enter a valid URL.'; }
+        },
+        required: false
+      }, { input, output });
+      destination.url = url || fallback;
+      const parsedAdtUrl = new URL(destination.url);
+      if (parsedAdtUrl.protocol === 'https:' && isIP(parsedAdtUrl.hostname)) {
+        print(output, formatStatus('The ADT URL uses an IP address. Setup will inspect the SAP HTTPS certificate and can enable TLS self-healing automatically; certificate validation remains enabled.', 'warning', output, 'TLS self-heal'));
+        let discoveredNames = [];
+        try { discoveredNames = await discoverCertificateDnsNames(destination.url); }
+        catch { discoveredNames = []; }
+        if (discoveredNames.length) {
+          const preview = discoveredNames.slice(0, 5).join(', ');
+          const answer = await textPrompt({
+            message: `Use discovered certificate DNS name${discoveredNames.length === 1 ? '' : 's'} for ${destination.name}: ${preview}${discoveredNames.length > 5 ? ', ...' : ''}? (y/Enter=yes, n=no)`,
+            placeholder: 'y',
+            required: false,
+            validate: value => /^(?:|y|yes|n|no)$/i.test(String(value || '').trim()) || 'Enter y or n.'
+          }, { input, output });
+          if (!/^n(?:o)?$/i.test(String(answer || '').trim())) {
+            destination.tlsServerNames = discoveredNames;
+            destination.tlsServerName = discoveredNames[0];
+          }
+        } else {
+          print(output, formatStatus('No DNS subjectAltName entries could be read from the SAP HTTPS certificate. TLS self-healing was not configured automatically.', 'warning', output, 'TLS self-heal'));
+        }
+      }
+      const authMode = await chooseLocalAuthMode(destination, { input, output, env });
+      destination.authentication = authMode === 'windows-sso' ? 'WindowsSSO' : 'Basic';
+      destination.authMode = authMode;
+      if (authMode === 'windows-sso') {
+        destination.childEnv = { SAP_AUTH_MODE: 'windows-sso' };
+        destination.inputs = [];
+      } else {
+        const userInputId = `sap-ai-dev-${destination.serverName || destination.name}-user`.toLowerCase().replace(/[^a-z0-9_-]+/g, '-');
+        const passwordInputId = `sap-ai-dev-${destination.serverName || destination.name}-password`.toLowerCase().replace(/[^a-z0-9_-]+/g, '-');
+        destination.childEnv = {
+          SAP_AUTH_MODE: 'basic',
+          SAP_USER: `\${input:${userInputId}}`,
+          SAP_PASSWORD: `\${input:${passwordInputId}}`
+        };
+        destination.inputs = [
+          { id: userInputId, type: 'promptString', description: `SAP user for ${destination.name}` },
+          { id: passwordInputId, type: 'promptString', description: `SAP password for ${destination.name}`, password: true }
+        ];
+      }
+    }
+  }
+
   let sapDevelopmentServers = [];
   if (includeSapDevelopmentToolsPrompt) {
     print(output, '');
@@ -269,18 +392,20 @@ export async function runSetup({
     const location = result?.path ? ` in ${result.path}` : '';
     print(output, '');
     const configuredCount = selected.length + sapDevelopmentServers.length;
-    print(output, formatStatus(`Configured ${configuredCount} MCP server${configuredCount === 1 ? '' : 's'}${location}.`, 'success', output, 'BAS setup'));
+    print(output, formatStatus(`Configured ${configuredCount} MCP server${configuredCount === 1 ? '' : 's'}${location}.`, 'success', output, isBas ? 'BAS setup' : 'Local setup'));
     printConnectionInstructions(output, result);
     let cleanupWarnings = [];
     const finalPath = result?.path || configPath;
-    if (!finalPath) {
-      cleanupWarnings.push('CF service-key cleanup skipped because the final MCP config path is unavailable.');
-    } else {
-      try {
-        const finalConfig = await readMcpConfig(finalPath);
-        cleanupWarnings = await cleanupKeys([...managedKeys, ...createdKeys], finalConfig);
-      } catch {
-        cleanupWarnings.push('CF service-key cleanup skipped because the final MCP config could not be read.');
+    if (isBas) {
+      if (!finalPath) {
+        cleanupWarnings.push('CF service-key cleanup skipped because the final MCP config path is unavailable.');
+      } else {
+        try {
+          const finalConfig = await readMcpConfig(finalPath);
+          cleanupWarnings = await cleanupKeys([...managedKeys, ...createdKeys], finalConfig);
+        } catch {
+          cleanupWarnings.push('CF service-key cleanup skipped because the final MCP config could not be read.');
+        }
       }
     }
     await reportWarnings(warnings);