sap-ai-dev-toolkit 0.7.9 → 0.8.0

package/README.md

@@ -750,6 +750,9 @@ The response contains a `tools` array. A `RunQuery` entry resembles this excerpt
 | `SAP_AI_DEV_TOOLKIT_MODE` | VSP child mode (`expert` by default; `focused` omits `ActivateMultiple`, `GetUserTransports`, and `GetTransportInfo`). The proxy exposes its curated tool subset and local workflow tools, including `LintABAP`. |
 | `SAP_ALLOW_TRANSPORTABLE_EDITS` | Generated MCP entries set this to `true` to permit source edits in transportable packages; VSP safety checks and SAP authorizations still apply. |
 | `SAP_AUTH_MODE=windows-sso` | Local SAP GUI entry mode for experimental Windows Integrated Authentication. Runtime starts a loopback ADT proxy and does not pass SAP username/password credentials to VSP. |
+| `SAP_TLS_SERVER_NAMES` / `SAP_AI_DEV_TOOLKIT_TLS_SERVER_NAMES` | Comma-separated local SAP GUI TLS self-healing names, normally auto-discovered during setup from the SAP HTTPS certificate when `SAP_URL` uses an IP address. Runtime tries them one by one while keeping certificate validation enabled. |
+| `SAP_TLS_SERVER_NAME` / `SAP_AI_DEV_TOOLKIT_TLS_SERVER_NAME` | Single-name compatibility form of the local SAP GUI TLS self-healing override. Prefer the auto-discovered plural variable written by setup. |
+| `SAP_TLS_CA_FILE` / `SAP_AI_DEV_TOOLKIT_TLS_CA_FILE` | Optional PEM CA bundle for the local TLS self-healing proxy when the SAP HTTPS certificate chains to a private CA that is not in the OS/Node trust store. Certificate verification remains enabled. |
 | `SAP_AI_DEV_TOOLKIT_NEGOTIATE_HELPER` / `SAP_AI_DEV_TOOLKIT_SSPI_HELPER` | Optional trusted Windows helper executable used by the local Windows SSO proxy to convert an HTTP `WWW-Authenticate: Negotiate` challenge into a Kerberos/SPNEGO token. NTLM fallback is rejected because it is connection-oriented and unsafe for this proxy shape. When unset on Windows, the bundled PowerShell SSPI helper is used. A custom helper receives one JSON line on stdin (`url`, `challenge`, `mechanism`) and prints the base64 token on stdout. |
 | `SAP_AI_DEV_TOOLKIT_HTTP_PROXY` | Egress proxy for BAS discovery and probe traffic. Takes precedence over `HTTP_PROXY`/`http_proxy`; unset means the default BAS proxy for `.dest` hosts, empty means direct. |
 | `SAP_AI_DEV_TOOLKIT_REQUEST_TIMEOUT_MS` | Per-request timeout for calls forwarded to a VSP child (default 600000 = 10 minutes; `0` disables). A stalled request fails with a timeout error; the child is left running. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.7.9",
+  "version": "0.8.0",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/src/launcher.mjs

@@ -11,6 +11,7 @@ import { installMcpConfig, repairManagedMcpConfig } from './mcp-config.mjs';
 import { runSetup } from './setup.mjs';
 import { resolveConfiguredCloudFoundryDestination } from './cf-destination.mjs';
 import { createWindowsSsoAdtProxy } from './windows-sso-adt-proxy.mjs';
+import { createTlsServerNameAdtProxy } from './tls-adt-proxy.mjs';
 import { withBrandedEnvironment } from './branding.mjs';
 import { redactText } from './redact.mjs';
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
@@ -175,8 +176,18 @@ async function configuredLocalSapGuiDestination(env) {
   const name = env.SAP_AI_DEV_TOOLKIT_DESTINATION || env.SAP_SYSTEM_ID || 'local-sap';
   if (!env.SAP_URL) throw new Error('SAP_URL is required for local SAP GUI MCP entries. Rerun sap-ai-dev --setup and enter the ADT URL.');
   const authMode = String(env.SAP_AUTH_MODE || '').toLowerCase();
+  const tlsServerName = String(env.SAP_TLS_SERVER_NAME || env.SAP_AI_DEV_TOOLKIT_TLS_SERVER_NAME || '').trim();
+  const tlsServerNames = String(env.SAP_TLS_SERVER_NAMES || env.SAP_AI_DEV_TOOLKIT_TLS_SERVER_NAMES || tlsServerName).split(',').map(value => value.trim()).filter(Boolean);
+  const tlsCaFile = String(env.SAP_TLS_CA_FILE || env.SAP_AI_DEV_TOOLKIT_TLS_CA_FILE || '').trim();
+  const tlsRoute = tlsServerNames.length
+    ? await createTlsServerNameAdtProxy({ destinationUrl: env.SAP_URL, tlsServerNames, caFile: tlsCaFile || undefined })
+    : null;
+  const adtUrl = tlsRoute?.url || env.SAP_URL;
+  const closeRoute = async route => {
+    await Promise.all([route?.close?.(), tlsRoute?.close?.()].filter(Boolean).map(close => Promise.resolve().then(close).catch(() => {})));
+  };
   if (authMode === 'windows-sso') {
-    const route = await createWindowsSsoAdtProxy({ destinationUrl: env.SAP_URL, env });
+    const route = await createWindowsSsoAdtProxy({ destinationUrl: adtUrl, env });
     return {
       source: 'sap-gui-local',
       name,
@@ -185,21 +196,23 @@ async function configuredLocalSapGuiDestination(env) {
       client: env.SAP_CLIENT || '001',
       authentication: 'WindowsSSO',
       childEnv: {},
-      close: route.close,
-      probe: { status: 'configured', available: true }
+      close: () => closeRoute(route),
+      probe: { status: tlsRoute ? 'configured-tls-server-name' : 'configured', available: true }
     };
   }
   return {
     source: 'sap-gui-local',
     name,
-    url: env.SAP_URL,
+    url: adtUrl,
+    backendUrl: tlsRoute ? env.SAP_URL : undefined,
     client: env.SAP_CLIENT || '001',
     authentication: 'Basic',
     childEnv: {
       SAP_USER: env.SAP_USER || env.SAP_USERNAME || '',
       SAP_PASSWORD: env.SAP_PASSWORD || env.SAP_PASS || ''
     },
-    probe: { status: 'configured', available: true }
+    close: tlsRoute?.close,
+    probe: { status: tlsRoute ? 'configured-tls-server-name' : 'configured', available: true }
   };
 }
 

package/src/mcp-config.mjs

@@ -192,6 +192,8 @@ export function buildMcpEntries(destinations, env = process.env) {
         SAP_URL: String(destination.url),
         SAP_CLIENT: String(destination.client || '001'),
         ...(destination.systemId ? { SAP_SYSTEM_ID: String(destination.systemId) } : {}),
+        ...(Array.isArray(destination.tlsServerNames) && destination.tlsServerNames.length ? { SAP_TLS_SERVER_NAMES: destination.tlsServerNames.join(',') } : {}),
+        ...(!Array.isArray(destination.tlsServerNames) && destination.tlsServerName ? { SAP_TLS_SERVER_NAME: String(destination.tlsServerName) } : {}),
         ...(destination.childEnv || {})
       });
     } else {

package/src/setup.mjs

@@ -1,11 +1,13 @@
 import { createInterface } from 'node:readline/promises';
 import { stdin, stdout } from 'node:process';
 import { platform } from 'node:os';
+import { isIP } from 'node:net';
 import { checkboxPrompt, colorText, formatStatus, textPrompt } from './terminal-ui.mjs';
 import { discoverDestinations, remediation } from './bas-discovery.mjs';
 import { defaultAdtUrl, discoverSapGuiSystems } from './local-sap-gui.mjs';
 import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys, findOrphanedCloudFoundryServiceKeys } from './cf-destination.mjs';
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
+import { discoverCertificateDnsNames } from './tls-adt-proxy.mjs';
 
 const SETUP_COMMAND = 'sap-ai-dev --setup';
 
@@ -79,6 +81,8 @@ function safeLocalSapGuiDestination(destination) {
     authentication: destination.authentication || 'Basic',
     authMode: destination.authMode,
     proxyType: 'Internet',
+    tlsServerName: destination.tlsServerName,
+    tlsServerNames: destination.tlsServerNames,
     probe: safeProbe(destination.probe),
     childEnv: destination.childEnv || {}
   };
@@ -320,6 +324,28 @@ export async function runSetup({
         required: false
       }, { input, output });
       destination.url = url || fallback;
+      const parsedAdtUrl = new URL(destination.url);
+      if (parsedAdtUrl.protocol === 'https:' && isIP(parsedAdtUrl.hostname)) {
+        print(output, formatStatus('The ADT URL uses an IP address. Setup will inspect the SAP HTTPS certificate and can enable TLS self-healing automatically; certificate validation remains enabled.', 'warning', output, 'TLS self-heal'));
+        let discoveredNames = [];
+        try { discoveredNames = await discoverCertificateDnsNames(destination.url); }
+        catch { discoveredNames = []; }
+        if (discoveredNames.length) {
+          const preview = discoveredNames.slice(0, 5).join(', ');
+          const answer = await textPrompt({
+            message: `Use discovered certificate DNS name${discoveredNames.length === 1 ? '' : 's'} for ${destination.name}: ${preview}${discoveredNames.length > 5 ? ', ...' : ''}? (y/Enter=yes, n=no)`,
+            placeholder: 'y',
+            required: false,
+            validate: value => /^(?:|y|yes|n|no)$/i.test(String(value || '').trim()) || 'Enter y or n.'
+          }, { input, output });
+          if (!/^n(?:o)?$/i.test(String(answer || '').trim())) {
+            destination.tlsServerNames = discoveredNames;
+            destination.tlsServerName = discoveredNames[0];
+          }
+        } else {
+          print(output, formatStatus('No DNS subjectAltName entries could be read from the SAP HTTPS certificate. TLS self-healing was not configured automatically.', 'warning', output, 'TLS self-heal'));
+        }
+      }
       const authMode = await chooseLocalAuthMode(destination, { input, output, env });
       destination.authentication = authMode === 'windows-sso' ? 'WindowsSSO' : 'Basic';
       destination.authMode = authMode;

package/src/tls-adt-proxy.mjs

@@ -0,0 +1,122 @@
+import http from 'node:http';
+import https from 'node:https';
+import tls from 'node:tls';
+import { once } from 'node:events';
+import { readFile } from 'node:fs/promises';
+import { isIP } from 'node:net';
+
+const HOP_BY_HOP = new Set([
+  'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
+  'te', 'trailer', 'transfer-encoding', 'upgrade'
+]);
+
+function filteredHeaders(headers) {
+  const result = { ...headers };
+  for (const name of Object.keys(result)) {
+    if (HOP_BY_HOP.has(name.toLowerCase())) delete result[name];
+  }
+  return result;
+}
+
+function requestHeaders(headers, backend) {
+  return { ...filteredHeaders(headers), host: backend.host };
+}
+
+function parseSubjectAltName(value) {
+  return String(value || '')
+    .split(/,\s*/)
+    .map(item => item.match(/^DNS:(.+)$/i)?.[1]?.trim())
+    .filter(Boolean);
+}
+
+export async function discoverCertificateDnsNames(destinationUrl) {
+  const backend = new URL(destinationUrl);
+  if (backend.protocol !== 'https:') return [];
+  const socket = tls.connect({
+    host: backend.hostname,
+    port: Number(backend.port || 443),
+    ...(isIP(backend.hostname) ? {} : { servername: backend.hostname }),
+    rejectUnauthorized: false
+  });
+  try {
+    await once(socket, 'secureConnect');
+    const certificate = socket.getPeerCertificate();
+    return [...new Set(parseSubjectAltName(certificate?.subjectaltname))];
+  } finally {
+    socket.destroy();
+  }
+}
+
+function responseHeaders(headers, backend, clientReq) {
+  const result = filteredHeaders(headers);
+  const location = result.location;
+  if (typeof location === 'string') {
+    try {
+      const parsed = new URL(location, backend);
+      if (parsed.origin === backend.origin) {
+        result.location = `http://${clientReq.headers.host}${parsed.pathname}${parsed.search}${parsed.hash}`;
+      }
+    } catch {}
+  }
+  return result;
+}
+
+/**
+ * Starts a loopback HTTP reverse proxy for ADT HTTPS endpoints whose network
+ * address and certificate identity differ. The proxy dials the configured
+ * backend URL but verifies TLS with tlsServerName; CA validation stays enabled.
+ */
+export async function createTlsServerNameAdtProxy({ destinationUrl, tlsServerName, tlsServerNames, caFile } = {}) {
+  const backend = new URL(destinationUrl);
+  if (backend.protocol !== 'https:') throw new Error('TLS server-name override requires an https:// SAP URL.');
+  const serverNames = [...new Set([...(Array.isArray(tlsServerNames) ? tlsServerNames : []), ...String(tlsServerName || '').split(',')].map(value => String(value || '').trim()).filter(Boolean))];
+  if (!serverNames.length) throw new Error('TLS server-name override requires a DNS name.');
+
+  const ca = caFile ? await readFile(caFile) : undefined;
+  const server = http.createServer((clientReq, clientRes) => {
+    let target;
+    try {
+      target = new URL(clientReq.url || '/', backend);
+      if (target.origin !== backend.origin) throw new Error('cross-origin request rejected');
+    } catch (error) {
+      clientRes.writeHead(400, { 'content-type': 'text/plain; charset=utf-8' });
+      clientRes.end(`ADT TLS proxy rejected request: ${error.message}`);
+      return;
+    }
+    const chunks = [];
+    clientReq.on('data', chunk => chunks.push(chunk));
+    clientReq.on('end', () => {
+      const body = Buffer.concat(chunks);
+      const tryServerName = index => {
+        const request = https.request({
+          protocol: 'https:',
+          hostname: backend.hostname,
+          port: backend.port || 443,
+          method: clientReq.method,
+          path: `${target.pathname}${target.search}`,
+          headers: requestHeaders(clientReq.headers, backend),
+          servername: serverNames[index],
+          rejectUnauthorized: true,
+          ...(ca ? { ca } : {})
+        }, backendRes => {
+          clientRes.writeHead(backendRes.statusCode || 502, backendRes.statusMessage, responseHeaders(backendRes.headers, backend, clientReq));
+          backendRes.pipe(clientRes);
+        });
+        request.on('error', error => {
+          if (index + 1 < serverNames.length && /certificate|hostname|altname|x509/i.test(error.message)) return tryServerName(index + 1);
+          if (!clientRes.headersSent) clientRes.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' });
+          clientRes.end(`ADT TLS proxy failed: ${error.message}`);
+        });
+        request.end(body);
+      };
+      tryServerName(0);
+    });
+  });
+  server.listen(0, '127.0.0.1');
+  await once(server, 'listening');
+  const { port } = server.address();
+  return {
+    url: `http://127.0.0.1:${port}`,
+    close: () => new Promise(resolve => server.close(() => resolve()))
+  };
+}