sap-ai-dev-toolkit 0.8.5 → 0.9.1

package/README.md

@@ -857,6 +857,8 @@ NPM_PUBLISH_TOKEN=npm_...
 - To publish a patch bump, run `npm run publish:npm -- --patch`; it updates `package.json` and `package-lock.json` before publishing. If publishing fails after the bump, retry without `--patch`.
 - npm's `prepublishOnly` hook builds the pinned VSP binaries for all platforms (including the Go toolchain if missing) and refuses to ship a tarball whose `dist/checksums.txt` does not list all five assets; it guards `npm run publish:npm` and a plain `npm publish` alike. Pass `--skip-build` to republish an already-built `dist/` without rebuilding.
 - Preview the package without publishing, changing its version, or building with `npm run publish:npm -- --dry-run`.
+- GitHub Actions runs the test suite on pushes to `main` and pull requests. A push to `main` that changes the `package.json` version runs the same checks, builds the VSP binaries, and publishes that version to npm.
+- The publish workflow uses the `NPM_PUBLISH_TOKEN` GitHub repository secret. Verify it with `gh secret list`; the token value is never stored in the repository.
 
 The token is not printed or stored in the repository.
 

package/dist/checksums.txt

@@ -1,5 +1,5 @@
-8ab555658815db7de670b956dafe0f12d6a249e4f1e1cbbb058deb658a89a37d  vsp-linux-x64
-7011b716e295ce2cecc40b9a56e57d9a1ec24c2b9d6aa25ab46e5cde0ec23998  vsp-linux-arm64
-5c240a6b53e15ebaae817612aed1c5b95624a99adfc38e6abb9afa377de30d1a  vsp-darwin-x64
-28032c4d331253808ec9318e6db570420c6c9308935964de665e34374465d89f  vsp-darwin-arm64
-5bb45857489bbe5d57587d9abda0b768d3a1b352d89a2a6bf13b23af8d2fd45e  vsp-win32-x64.exe
+a5b602573f54ce3d03d161aaaeb78559fd73bd51f2ae9a3b7549cee1ddc3fbf6  vsp-linux-x64
+2e336e2999c3654e5eb1e3a8bb42616eb5d5e422ab7ae74ffbff4634be45189d  vsp-linux-arm64
+afc7fd0f2e40ae5ebfcd3ddb8ac3cb7e7501b2b66d76ac96e3b6054b09366bb5  vsp-darwin-x64
+2d28a870c4a006900eec245384b4bbc2e84651e0ba911cca6107c132ace73575  vsp-darwin-arm64
+7d0189aa7ff936a145b0e3f15bffce8de5aebc252465a720edc3a9b122bd2a28  vsp-win32-x64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.8.5",
+  "version": "0.9.1",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",
@@ -22,8 +22,8 @@
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs",
     "install:local": "node scripts/install-local.mjs",
-    "test": "node --test test/*.test.mjs",
-    "test:live:s4h": "SAP_AI_DEV_LIVE_S4H=1 node --test test/live-s4h.test.mjs",
+    "test": "node --test --test-force-exit test/*.test.mjs",
+    "test:live:s4h": "node scripts/run-live-s4h.mjs",
     "test:visibility": "node --test test/setup.test.mjs test/terminal-ui.test.mjs",
     "test:mutation": "node scripts/mutation-terminal-ui.mjs",
     "publish:npm": "node scripts/publish-npm.mjs",
@@ -55,5 +55,8 @@
   ],
   "publishConfig": {
     "access": "public"
+  },
+  "devDependencies": {
+    "@lydell/node-pty": "^1.2.0-beta.15"
   }
 }

package/patches/vsp-bas-proxy-auth.patch

@@ -1,21 +1,45 @@
 diff --git a/cmd/vsp/main.go b/cmd/vsp/main.go
+index 5007935..b2bc6be 100755
 --- a/cmd/vsp/main.go
 +++ b/cmd/vsp/main.go
-@@ -102,1 +102,2 @@
+@@ -100,6 +100,7 @@ func init() {
+ 	rootCmd.Flags().StringVar(&cfg.BaseURL, "service", "", "SAP system URL (alias for --url)")
+ 
  	// Authentication flags
 +	rootCmd.Flags().BoolVar(&cfg.ProxyAuth, "proxy-auth", false, "Use BAS destination proxy authentication; do not send local credentials")
-@@ -172,1 +172,2 @@
+ 	rootCmd.Flags().StringVarP(&cfg.Username, "user", "u", "", "SAP username")
+ 	rootCmd.Flags().StringVarP(&cfg.Password, "password", "p", "", "SAP password")
+ 	rootCmd.Flags().StringVar(&cfg.Password, "pass", "", "SAP password (alias for --password)")
+@@ -170,6 +171,7 @@ func init() {
+ 	rootCmd.PersistentFlags().BoolVarP(&cfg.Verbose, "verbose", "v", false, "Enable verbose output to stderr")
+ 
  	// Bind flags to viper for environment variable support
 +	viper.BindPFlag("proxy-auth", rootCmd.Flags().Lookup("proxy-auth"))
-@@ -235,1 +235,4 @@
+ 	viper.BindPFlag("url", rootCmd.Flags().Lookup("url"))
+ 	viper.BindPFlag("user", rootCmd.Flags().Lookup("user"))
+ 	viper.BindPFlag("password", rootCmd.Flags().Lookup("password"))
+@@ -233,6 +235,9 @@ func runServer(cmd *cobra.Command, args []string) error {
+ 	}
+ 
  	// Browser-based SSO authentication (must run before processCookieAuth)
 +	if err := validateProxyAuth(cmd); err != nil {
 +		return err
 +	}
-@@ -348,1 +348,2 @@
+ 	if err := processBrowserAuth(cmd); err != nil {
+ 		return err
+ 	}
+@@ -346,6 +351,7 @@ func runServer(cmd *cobra.Command, args []string) error {
+ }
+ 
  func resolveConfig(cmd *cobra.Command) {
 +	cfg.ProxyAuth = cfg.ProxyAuth || viper.GetBool("PROXY_AUTH")
-@@ -533,1 +533,19 @@
+ 	// Check if cookie auth is explicitly requested via CLI flags OR env vars
+ 	// If so, we should NOT load user/password from env/.env to avoid conflicts
+ 	// Cookie auth takes precedence over basic auth since it's more explicit
+@@ -530,6 +536,24 @@ func validateConfig() error {
+ 	return nil
+ }
+ 
 +func validateProxyAuth(cmd *cobra.Command) error {
 +	if !cfg.ProxyAuth {
 +		return nil
@@ -35,146 +59,68 @@ diff --git a/cmd/vsp/main.go b/cmd/vsp/main.go
 +	return nil
 +}
  func processBrowserAuth(cmd *cobra.Command) error {
-@@ -601,1 +601,4 @@
+ 	browserAuth, _ := cmd.Flags().GetBool("browser-auth")
+ 	if !browserAuth && !viper.GetBool("BROWSER_AUTH") {
+@@ -599,6 +623,9 @@ func ssoRequested(cmd *cobra.Command) bool {
+ // days will outlive any session it starts with, and the point of the exercise
+ // is that nobody has to notice when it does.
  func processSSOAuth(cmd *cobra.Command) error {
 +	if cfg.ProxyAuth {
 +		return nil
 +	}
-@@ -659,1 +659,4 @@
+ 	if !ssoRequested(cmd) {
+ 		return nil
+ 	}
+@@ -657,6 +684,9 @@ func processSSOAuth(cmd *cobra.Command) error {
+ }
+ 
  func processSAMLAuth(cmd *cobra.Command) error {
 +	if cfg.ProxyAuth {
 +		return nil
 +	}
-@@ -754,1 +754,4 @@
+ 	samlAuth, _ := cmd.Flags().GetBool("saml-auth")
+ 	if !samlAuth && !viper.GetBool("SAML_AUTH") {
+ 		return nil
+@@ -752,6 +782,9 @@ func processSAMLAuth(cmd *cobra.Command) error {
+ }
+ 
  func processCookieAuth(cmd *cobra.Command) error {
 +	if cfg.ProxyAuth {
 +		return nil
 +	}
+ 	cookieFile, _ := cmd.Flags().GetString("cookie-file")
+ 	cookieString, _ := cmd.Flags().GetString("cookie-string")
+ 
 diff --git a/internal/mcp/server.go b/internal/mcp/server.go
+index 9337857..11fc940 100644
 --- a/internal/mcp/server.go
 +++ b/internal/mcp/server.go
-@@ -71,2 +71,5 @@
+@@ -69,6 +69,9 @@ type Config struct {
+ 	InsecureSkipVerify bool
+ 
  	// Cookie authentication (alternative to basic auth)
 +	// ProxyAuth delegates identity to a BAS destination proxy. Local credentials are rejected.
 +	ProxyAuth bool
 +
  	Cookies map[string]string
-@@ -154,1 +154,4 @@
+ 
+ 	// Build names the binary, as "v2.52.0 (commit abc1234, built ...)".
+@@ -151,6 +154,9 @@ func NewServer(cfg *Config) *Server {
+ 	if cfg.InsecureSkipVerify {
+ 		opts = append(opts, adt.WithInsecureSkipVerify())
+ 	}
 +	if cfg.ProxyAuth {
 +		opts = append(opts, adt.WithProxyContextIDGuard())
 +	}
  	if len(cfg.Cookies) > 0 {
-diff --git a/pkg/adt/client.go b/pkg/adt/client.go
---- a/pkg/adt/client.go
-+++ b/pkg/adt/client.go
-@@ -1586 +1586 @@
--		Accept: "application/xml",
-+		Accept: "application/atom+xml;type=feed",
-@@ -1592,27 +1592,27 @@
--	type componentXML struct {
--		Name        string `xml:"name,attr"`
--		Release     string `xml:"release,attr"`
--		SupportPack string `xml:"supportPack,attr"`
--		Description string `xml:"description,attr"`
--	}
--	type componentsXML struct {
--		XMLName    xml.Name       `xml:"components"`
--		Components []componentXML `xml:"component"`
--	}
--
--	var comps componentsXML
--	if err := xml.Unmarshal(resp.Body, &comps); err != nil {
--		return nil, fmt.Errorf("parsing components: %w", err)
--	}
--
--	result := make([]InstalledComponent, len(comps.Components))
--	for i, c := range comps.Components {
--		result[i] = InstalledComponent{
--			Name:        c.Name,
--			Release:     c.Release,
--			SupportPack: c.SupportPack,
--			Description: c.Description,
--		}
--	}
--
--	return result, nil
-+	type componentEntry struct {
-+		ID    string `xml:"id"`
-+		Title string `xml:"title"`
-+	}
-+	type componentsFeed struct {
-+		Entries []componentEntry `xml:"entry"`
-+	}
-+	var feed componentsFeed
-+	if err := xml.Unmarshal(resp.Body, &feed); err != nil {
-+		return nil, fmt.Errorf("parsing components: %w", err)
-+	}
-+
-+	result := make([]InstalledComponent, 0, len(feed.Entries))
-+	for i, entry := range feed.Entries {
-+		fields := strings.SplitN(entry.Title, ";", 4)
-+		name := strings.TrimSpace(entry.ID)
-+		if name == "" || len(fields) != 4 {
-+			return nil, fmt.Errorf("parsing components: malformed feed entry %d", i+1)
-+		}
-+		result = append(result, InstalledComponent{
-+			Name:        name,
-+			Release:     strings.TrimSpace(fields[0]),
-+			SupportPack: strings.TrimSpace(fields[2]),
-+			Description: strings.TrimSpace(fields[3]),
-+		})
-+	}
-+	return result, nil
-diff --git a/pkg/adt/client_components_test.go b/pkg/adt/client_components_test.go
-new file mode 100644
---- /dev/null
-+++ b/pkg/adt/client_components_test.go
-@@ -0,0 +1,40 @@
-+package adt
-+
-+import (
-+	"context"
-+	"io"
-+	"net/http"
-+	"net/http/httptest"
-+	"testing"
-+)
-+
-+func TestGetInstalledComponentsUsesADTFeed(t *testing.T) {
-+	const accept = "application/atom+xml;type=feed"
-+	const response = `<atom:feed xmlns:atom="http://www.w3.org/2005/Atom"><atom:entry><atom:id>SAP_BASIS</atom:id><atom:title>758;SAPK-75802INSAPBASIS;0002;SAP Basis &gt; 2022; patch</atom:title></atom:entry></atom:feed>`
-+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-+		if r.URL.Path != "/sap/bc/adt/system/components" {
-+			t.Errorf("unexpected request path: %s", r.URL.Path)
-+			w.WriteHeader(http.StatusNotFound)
-+			return
-+		}
-+		if got := r.Header.Get("Accept"); got != accept {
-+			t.Errorf("Accept = %q, want %q", got, accept)
-+			w.WriteHeader(http.StatusNotAcceptable)
-+			return
-+		}
-+		w.Header().Set("Content-Type", accept)
-+		_, _ = io.WriteString(w, response)
-+	}))
-+	defer server.Close()
-+
-+	components, err := NewClient(server.URL, "user", "pass").GetInstalledComponents(context.Background())
-+	if err != nil {
-+		t.Fatalf("GetInstalledComponents returned an error: %v", err)
-+	}
-+	if len(components) != 1 {
-+		t.Fatalf("got %d components, want 1", len(components))
-+	}
-+	if got := components[0]; got.Name != "SAP_BASIS" || got.Release != "758" || got.SupportPack != "0002" || got.Description != "SAP Basis > 2022; patch" {
-+		t.Errorf("got component %#v", got)
-+	}
-+}
+ 		opts = append(opts, adt.WithCookies(cfg.Cookies))
+ 	}
 diff --git a/internal/mcp/server_test.go b/internal/mcp/server_test.go
+index 7740e56..b4c2faf 100755
 --- a/internal/mcp/server_test.go
 +++ b/internal/mcp/server_test.go
 @@ -159,3 +159,112 @@ func TestDebuggerGetVariablesSchemaIncludesItems(t *testing.T) {
- 		t.Fatalf("expected variableIDs.items.type to be 'string', got %v", items["type"])
+ 		t.Fatalf("expected variable_ids.items.type to be 'string', got %v", items["type"])
  	}
  }
 +
@@ -287,6 +233,7 @@ diff --git a/internal/mcp/server_test.go b/internal/mcp/server_test.go
 +	}
 +}
 diff --git a/internal/mcp/tools_register.go b/internal/mcp/tools_register.go
+index dd433d6..5553b7f 100644
 --- a/internal/mcp/tools_register.go
 +++ b/internal/mcp/tools_register.go
 @@ -837,6 +837,19 @@ func (s *Server) registerDevTools(shouldRegister func(string) bool) {
@@ -309,7 +256,117 @@ diff --git a/internal/mcp/tools_register.go b/internal/mcp/tools_register.go
  			),
  		), s.handleActivateMultiple)
  	}
+diff --git a/pkg/adt/client.go b/pkg/adt/client.go
+index 979e908..c7e9501 100755
+--- a/pkg/adt/client.go
++++ b/pkg/adt/client.go
+@@ -1583,38 +1583,38 @@ type InstalledComponent struct {
+ func (c *Client) GetInstalledComponents(ctx context.Context) ([]InstalledComponent, error) {
+ 	resp, err := c.transport.Request(ctx, "/sap/bc/adt/system/components", &RequestOptions{
+ 		Method: http.MethodGet,
+-		Accept: "application/xml",
++		Accept: "application/atom+xml;type=feed",
+ 	})
+ 	if err != nil {
+ 		return nil, fmt.Errorf("getting installed components: %w", err)
+ 	}
+ 
+-	type componentXML struct {
+-		Name        string `xml:"name,attr"`
+-		Release     string `xml:"release,attr"`
+-		SupportPack string `xml:"supportPack,attr"`
+-		Description string `xml:"description,attr"`
++	type componentEntry struct {
++		ID    string `xml:"id"`
++		Title string `xml:"title"`
+ 	}
+-	type componentsXML struct {
+-		XMLName    xml.Name       `xml:"components"`
+-		Components []componentXML `xml:"component"`
++	type componentsFeed struct {
++		Entries []componentEntry `xml:"entry"`
+ 	}
+-
+-	var comps componentsXML
+-	if err := xml.Unmarshal(resp.Body, &comps); err != nil {
++	var feed componentsFeed
++	if err := xml.Unmarshal(resp.Body, &feed); err != nil {
+ 		return nil, fmt.Errorf("parsing components: %w", err)
+ 	}
+ 
+-	result := make([]InstalledComponent, len(comps.Components))
+-	for i, c := range comps.Components {
+-		result[i] = InstalledComponent{
+-			Name:        c.Name,
+-			Release:     c.Release,
+-			SupportPack: c.SupportPack,
+-			Description: c.Description,
++	result := make([]InstalledComponent, 0, len(feed.Entries))
++	for i, entry := range feed.Entries {
++		fields := strings.SplitN(entry.Title, ";", 4)
++		name := strings.TrimSpace(entry.ID)
++		if name == "" || len(fields) != 4 {
++			return nil, fmt.Errorf("parsing components: malformed feed entry %d", i+1)
+ 		}
++		result = append(result, InstalledComponent{
++			Name:        name,
++			Release:     strings.TrimSpace(fields[0]),
++			SupportPack: strings.TrimSpace(fields[2]),
++			Description: strings.TrimSpace(fields[3]),
++		})
+ 	}
+-
+ 	return result, nil
+ }
+ 
+diff --git a/pkg/adt/client_components_test.go b/pkg/adt/client_components_test.go
+new file mode 100644
+index 0000000..1ed3c2b
+--- /dev/null
++++ b/pkg/adt/client_components_test.go
+@@ -0,0 +1,40 @@
++package adt
++
++import (
++	"context"
++	"io"
++	"net/http"
++	"net/http/httptest"
++	"testing"
++)
++
++func TestGetInstalledComponentsUsesADTFeed(t *testing.T) {
++	const accept = "application/atom+xml;type=feed"
++	const response = `<atom:feed xmlns:atom="http://www.w3.org/2005/Atom"><atom:entry><atom:id>SAP_BASIS</atom:id><atom:title>758;SAPK-75802INSAPBASIS;0002;SAP Basis &gt; 2022; patch</atom:title></atom:entry></atom:feed>`
++	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++		if r.URL.Path != "/sap/bc/adt/system/components" {
++			t.Errorf("unexpected request path: %s", r.URL.Path)
++			w.WriteHeader(http.StatusNotFound)
++			return
++		}
++		if got := r.Header.Get("Accept"); got != accept {
++			t.Errorf("Accept = %q, want %q", got, accept)
++			w.WriteHeader(http.StatusNotAcceptable)
++			return
++		}
++		w.Header().Set("Content-Type", accept)
++		_, _ = io.WriteString(w, response)
++	}))
++	defer server.Close()
++
++	components, err := NewClient(server.URL, "user", "pass").GetInstalledComponents(context.Background())
++	if err != nil {
++		t.Fatalf("GetInstalledComponents returned an error: %v", err)
++	}
++	if len(components) != 1 {
++		t.Fatalf("got %d components, want 1", len(components))
++	}
++	if got := components[0]; got.Name != "SAP_BASIS" || got.Release != "758" || got.SupportPack != "0002" || got.Description != "SAP Basis > 2022; patch" {
++		t.Errorf("got component %#v", got)
++	}
++}
 diff --git a/pkg/adt/http.go b/pkg/adt/http.go
+index 0b4d9f1..3473536 100755
 --- a/pkg/adt/http.go
 +++ b/pkg/adt/http.go
 @@ -499,6 +499,7 @@ func (t *Transport) fetchCSRFTokenFor(ctx context.Context, stateful bool) error
@@ -375,9 +432,10 @@ diff --git a/pkg/adt/http.go b/pkg/adt/http.go
  	}
 diff --git a/pkg/adt/http_csrf_discovery_test.go b/pkg/adt/http_csrf_discovery_test.go
 new file mode 100644
+index 0000000..80741da
 --- /dev/null
 +++ b/pkg/adt/http_csrf_discovery_test.go
-@@ -0,0 +1,55 @@
+@@ -0,0 +1,56 @@
 +package adt
 +
 +import (
@@ -433,3 +491,4 @@ new file mode 100644
 +		t.Fatalf("expected both endpoint failures, got %v", err)
 +	}
 +}
++

package/scripts/ensure-go.mjs

@@ -10,7 +10,8 @@ const exec = promisify(execFile);
 export const GO_VERSION = brandedEnvValue(process.env, 'GO_VERSION') || 'go1.27.1';
 const GO_RELEASES = {
   'linux:x64': { archive: `${GO_VERSION}.linux-amd64.tar.gz`, sha256: '63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445' },
-  'linux:arm64': { archive: `${GO_VERSION}.linux-arm64.tar.gz`, sha256: '3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec' }
+  'linux:arm64': { archive: `${GO_VERSION}.linux-arm64.tar.gz`, sha256: '3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec' },
+  'win32:x64': { archive: `${GO_VERSION}.windows-amd64.zip`, sha256: 'a3911b5e0e1b1053f25ed0675f4c1c6aad1e2bfcf253df2b9be4caabd2edd95d' }
 };
 
 function localGoPath() {
@@ -28,7 +29,7 @@ function candidateGo() {
 
 export async function installGo() {
   const release = GO_RELEASES[`${process.platform}:${process.arch}`];
-  if (!release) throw new Error(`Go is missing and automatic installation is supported only for Linux x64/arm64. Install ${GO_VERSION} manually and ensure go is on PATH.`);
+  if (!release) throw new Error(`Go is missing and automatic installation is supported only for Linux x64/arm64 and Windows x64. Install ${GO_VERSION} manually and ensure go is on PATH.`);
   const response = await fetch(`https://go.dev/dl/${release.archive}`);
   if (!response.ok) throw new Error(`Go download failed with HTTP ${response.status}; install ${GO_VERSION} manually and ensure go is on PATH.`);
   const bytes = Buffer.from(await response.arrayBuffer());
@@ -39,13 +40,20 @@ export async function installGo() {
   await mkdir(root, { recursive: true, mode: 0o755 });
   const archive = join(tmpdir(), `${release.archive}.${process.pid}`);
   await writeFile(archive, bytes, { mode: 0o600 });
-  await exec('tar', ['-xzf', archive, '-C', root, '--strip-components=1'], { stdio: 'inherit' });
+  // bsdtar on Windows extracts zip archives the same way as gzip tarballs.
+  // Prefer the OS-supplied C:\Windows\System32\tar.exe: a GNU tar earlier on
+  // PATH (e.g. Git for Windows) misreads the drive-letter -C path as a
+  // remote host unless --force-local is passed.
+  const tarCommand = process.platform === 'win32' ? join(process.env.SystemRoot || 'C:\\WINDOWS', 'System32', 'tar.exe') : 'tar';
+  await exec(tarCommand, ['-xzf', archive, '-C', root, '--strip-components=1'], { stdio: 'inherit' });
   await rm(archive, { force: true });
-  const goPath = join(root, 'bin', 'go');
+  const goPath = join(root, 'bin', process.platform === 'win32' ? 'go.exe' : 'go');
   await chmod(goPath, 0o755);
-  const userBin = join(homedir(), '.local', 'bin');
-  await mkdir(userBin, { recursive: true, mode: 0o755 });
-  try { await symlink(goPath, join(userBin, process.platform === 'win32' ? 'go.exe' : 'go')); } catch {}
+  if (process.platform !== 'win32') {
+    const userBin = join(homedir(), '.local', 'bin');
+    await mkdir(userBin, { recursive: true, mode: 0o755 });
+    try { await symlink(goPath, join(userBin, 'go')); } catch {}
+  }
   return goPath;
 }
 

package/scripts/install-local.mjs

@@ -61,7 +61,11 @@ async function resolveGlobalBinaryPath() {
 async function verify() {
   const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
   const prefix = await resolveGlobalBinaryPath();
-  const expected = resolvePath(prefix, 'lib', 'node_modules', pkg.name);
+  // npm's global layout differs per platform: Unix nests modules under
+  // <prefix>/lib/node_modules, Windows puts them directly under <prefix>.
+  const expected = process.platform === 'win32'
+    ? resolvePath(prefix, 'node_modules', pkg.name)
+    : resolvePath(prefix, 'lib', 'node_modules', pkg.name);
   const serverCommand = process.platform === 'win32'
     ? join(prefix, 'sap-ai-dev.cmd')
     : join(prefix, 'bin', 'sap-ai-dev');

package/scripts/postinstall.mjs

@@ -20,9 +20,16 @@ const runtimeEnv = withBrandedEnvironment(process.env);
 
 async function announce(message, tone = 'info') {
   const content = message.replace(/^sap-ai-dev-toolkit:\s*/, '');
+  // Windows cannot open CONOUT$ as a writable console stream from a
+  // piped npm script (libuv normalizes the device name, and the resulting
+  // handle drops writes), so output goes through stderr unconditionally.
+  if (process.platform === 'win32') {
+    console.error(formatStatus(content, tone, process.stderr));
+    return;
+  }
   let terminal;
   try {
-    terminal = await open(process.platform === 'win32' ? 'CONOUT$' : '/dev/tty', 'w');
+    terminal = await open('/dev/tty', 'w');
     await terminal.write(`${formatStatus(content, tone, true)}\n`);
   } catch {
     console.error(formatStatus(content, tone, process.stderr));
@@ -32,12 +39,17 @@ async function announce(message, tone = 'info') {
 }
 
 function openControllingTerminal() {
-  const inputPath = process.platform === 'win32' ? 'CONIN$' : '/dev/tty';
-  const outputPath = process.platform === 'win32' ? 'CONOUT$' : '/dev/tty';
-  const inputFd = openSync(inputPath, 'r');
+  if (process.platform === 'win32') {
+    // fs cannot open CONIN$/CONOUT$ (libuv path normalization rejects the
+    // device names), so there is no controlling-terminal recovery on
+    // Windows: npm-script installs run non-interactively and the printed
+    // guidance points at `sap-ai-dev --setup` in a real terminal.
+    throw new Error('controlling terminal recovery is unavailable on Windows');
+  }
+  const inputFd = openSync('/dev/tty', 'r');
   let outputFd;
   try {
-    outputFd = openSync(outputPath, 'w');
+    outputFd = openSync('/dev/tty', 'w');
     return { input: new TTYReadStream(inputFd), output: new TTYWriteStream(outputFd) };
   } catch (error) {
     closeSync(inputFd);

package/scripts/run-live-s4h.mjs

@@ -0,0 +1,10 @@
+// Cross-platform runner for the live S4H suite: Windows cmd cannot parse the
+// Unix `VAR=1 command` prefix used in npm scripts, so the flag is set here
+// and the test runner is spawned directly.
+import { spawnSync } from 'node:child_process';
+
+const result = spawnSync(process.execPath, ['--test', '--test-force-exit', 'test/live-s4h.test.mjs'], {
+  stdio: 'inherit',
+  env: { ...process.env, SAP_AI_DEV_LIVE_S4H: '1' }
+});
+process.exitCode = result.status ?? 1;

package/src/harnesses.mjs

@@ -5,7 +5,9 @@ export const HARNESS_ENV_VAR = 'SAP_AI_DEV_TOOLKIT_HARNESSES';
 export const DEFAULT_HARNESS_IDS = ['github-copilot', 'claude-code'];
 export const NON_INTERACTIVE_HARNESS_IDS = ['github-copilot'];
 
-const FRONTMATTER_PATTERN = /^---\n([\s\S]*?)\n---\n/;
+// \r? keeps frontmatter parsing working on Windows checkouts where git's
+// autocrlf converted the bundled agents and skills to CRLF line endings.
+const FRONTMATTER_PATTERN = /^---\r?\n([\s\S]*?)\r?\n---\r?\n/;
 
 function splitFrontmatter(source) {
   const match = FRONTMATTER_PATTERN.exec(String(source));

package/src/launcher.mjs

@@ -105,7 +105,10 @@ async function runDoctor(destinations) {
       const upstreamCount = tools.filter(tool => !localSegments.has(isUpstreamTool(tool))).length;
       checks.push(doctorRow(destination.name, 'MCP tools/list', upstreamCount ? 'passed' : 'failed', `${upstreamCount} VSP tools and ${tools.length} total MCP tools returned; chat-picker binding is host-managed`));
       const systemInfo = tools.find(tool => tool.name === 'get_system_info' || tool.name === `${toolPrefix}get_system_info`);
-      if (!systemInfo) {
+      const needsAdtUrl = destination.probe?.status === 'needs-adt-url';
+      if (needsAdtUrl) {
+        checks.push(doctorRow(destination.name, 'SAP system check', 'skipped', 'No ADT URL is configured for this SAP GUI system; run sap-ai-dev --setup to add one.'));
+      } else if (!systemInfo) {
         checks.push(doctorRow(destination.name, 'SAP system check', 'skipped', 'GetSystemInfo is not exposed by this VSP mode.'));
       } else {
         const inspected = await proxy.handle({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: systemInfo.name, arguments: {} } });
@@ -316,10 +319,18 @@ async function main() {
       return;
     }
     const binary = await binaryOrError();
-    const child = spawn(binary, process.argv.slice(2), { env: runtimeEnv, stdio: 'inherit' });
+    // Windows cannot exec a .js/.mjs file directly; route JavaScript entries
+    // (test fixtures) through the current Node binary like MCPProxy does.
+    const spawnTarget = /\.(?:mjs|cjs|js)$/i.test(binary)
+      ? { command: process.execPath, prefixArgs: [binary] }
+      : { command: binary, prefixArgs: [] };
+    const child = spawn(spawnTarget.command, [...spawnTarget.prefixArgs, ...process.argv.slice(2)], { env: runtimeEnv, stdio: 'inherit' });
     process.once('SIGINT', () => child.kill('SIGINT'));
     process.once('SIGTERM', () => child.kill('SIGTERM'));
-    const [code, signal] = await new Promise(resolve => child.once('exit', (exitCode, exitSignal) => resolve([exitCode, exitSignal])));
+    const [code, signal] = await new Promise((resolve, reject) => {
+      child.once('error', reject);
+      child.once('exit', (exitCode, exitSignal) => resolve([exitCode, exitSignal]));
+    });
     if (signal) process.kill(process.pid, signal);
     process.exitCode = code ?? 1;
     return;

package/src/local-sap-gui.mjs

@@ -300,6 +300,10 @@ function registryPathCandidates(value) {
 
 async function windowsRegistrySapGuiCandidates(env = process.env) {
   if (platform() !== 'win32') return [];
+  // Escape hatch for locked-down machines and for tests that must not see
+  // the real registry's landscape paths.
+  const disabled = String(env.SAP_AI_DEV_TOOLKIT_DISABLE_SAP_GUI_REGISTRY || '').toLowerCase() === 'true';
+  if (disabled) return [];
   const candidates = [];
   for (const root of SAP_GUI_REGISTRY_ROOTS) {
     try {

package/src/mcp-proxy.mjs

@@ -198,6 +198,14 @@ export function childArguments(destination, env = process.env) {
   return args;
 }
 
+// Windows cannot exec a .js/.mjs file directly (no shebang support), so test
+// fixtures written in JavaScript are launched through the current Node binary.
+// The production VSP binary is a native executable and is unaffected.
+function spawnCommand(binary) {
+  if (/\.(?:mjs|cjs|js)$/i.test(binary)) return [process.execPath, binary];
+  return [binary];
+}
+
 class Child {
   constructor(binary, destination, options) {
     this.destination = destination;
@@ -208,7 +216,8 @@ class Child {
     this.exited = false;
     this.closing = false;
     this.requestTimeoutMs = options.requestTimeoutMs ?? 0;
-    this.process = (options.spawn || nodeSpawn)(binary, options.args || childArguments(destination, options.env), {
+    const [command, ...commandPrefixArgs] = spawnCommand(binary);
+    this.process = (options.spawn || nodeSpawn)(command, [...commandPrefixArgs, ...(options.args || childArguments(destination, options.env))], {
       env: childEnvironment(destination, options.env),
       stdio: ['pipe', 'pipe', 'pipe']
     });
@@ -346,8 +355,22 @@ class Child {
     if (this.exited) return;
     this.closing = true;
     this.notify('notifications/cancelled', { reason: 'proxy shutdown' });
-    this.process.kill('SIGTERM');
+    // Give well-behaved MCP children a graceful exit first: stdin EOF lets
+    // them finish and log their own shutdown. Windows cannot trap SIGTERM
+    // (Node maps it to TerminateProcess), so EOF is the only graceful path —
+    // wait briefly for it before escalating.
+    this.process.stdin?.end();
     let timeout;
+    try {
+      await Promise.race([
+        once(this.process, 'exit').catch(() => {}),
+        new Promise(resolve => { timeout = setTimeout(resolve, 750); })
+      ]);
+    } finally {
+      clearTimeout(timeout);
+    }
+    if (this.exited) return;
+    this.process.kill('SIGTERM');
     try {
       await Promise.race([
         once(this.process, 'exit').catch(() => {}),

package/src/windows-sso-adt-proxy.mjs

@@ -21,37 +21,9 @@ function validateTarget(value) {
   return url;
 }
 
-function authChallengeValues(headers) {
-  const value = headers?.get?.('www-authenticate');
-  if (!value) return [];
-  const parts = [];
-  let start = 0;
-  let quoted = false;
-  let escaped = false;
-  for (let index = 0; index < value.length; index += 1) {
-    const char = value[index];
-    if (escaped) {
-      escaped = false;
-    } else if (char === '\\' && quoted) {
-      escaped = true;
-    } else if (char === '"') {
-      quoted = !quoted;
-    } else if (char === ',' && !quoted) {
-      parts.push(value.slice(start, index).trim());
-      start = index + 1;
-    }
-  }
-  parts.push(value.slice(start).trim());
-  return parts.filter(Boolean);
-}
-
-function hasAuthChallenge(headers, scheme) {
-  const pattern = new RegExp(`^${scheme}(?:\\s|$)`, 'i');
-  return authChallengeValues(headers).some(part => pattern.test(part));
-}
-
 function hasNegotiateChallenge(headers) {
-  return hasAuthChallenge(headers, 'Negotiate');
+  const value = headers.get?.('www-authenticate') || '';
+  return /(?:^|,)\s*Negotiate\b/i.test(value);
 }
 
 function headerObject(headers) {
@@ -170,8 +142,8 @@ async function acquireNegotiateToken({ targetUrl, challenge, env, execFileImpl }
 }
 
 function basicFallbackCredentials(env) {
-  const mode = String(env.SAP_AUTH_FALLBACK_MODE || env.SAP_AI_DEV_TOOLKIT_AUTH_FALLBACK_MODE || '').trim().toLowerCase();
-  const enabled = mode === 'basic' || String(env.SAP_AI_DEV_TOOLKIT_SSO_BASIC_FALLBACK || '').toLowerCase() === 'true';
+  const mode = String(env.SAP_AUTH_FALLBACK_MODE || env.SAP_AI_DEV_TOOLKIT_AUTH_FALLBACK_MODE || '').toLowerCase();
+  const enabled = mode === 'basic' || env.SAP_AI_DEV_TOOLKIT_SSO_BASIC_FALLBACK === 'true';
   const user = String(env.SAP_USER || env.SAP_USERNAME || '').trim();
   const password = String(env.SAP_PASSWORD || env.SAP_PASS || '');
   if (!enabled || !user || !password) return null;
@@ -179,7 +151,8 @@ function basicFallbackCredentials(env) {
 }
 
 function hasBasicChallenge(headers) {
-  return hasAuthChallenge(headers, 'Basic');
+  const value = headers.get?.('www-authenticate') || '';
+  return /(?:^|,)\s*Basic\b/i.test(value);
 }
 
 async function retryWithBasicFallback({ req, target, headers, body, fetchImpl, env }) {
@@ -243,9 +216,7 @@ export async function createWindowsSsoAdtProxy({ destinationUrl, env = process.e
           if (cookies) retryHeaders.Cookie = cookies;
           response = await forward(req, target, retryHeaders, body, fetchImpl);
         } catch (error) {
-          response = hasBasicChallenge(response.headers)
-            ? await retryWithBasicFallback({ req, target, headers: { ...headers, ...(cookies ? { Cookie: cookies } : {}) }, body, fetchImpl, env })
-            : null;
+          response = await retryWithBasicFallback({ req, target, headers: { ...headers, ...(cookies ? { Cookie: cookies } : {}) }, body, fetchImpl, env });
           if (!response) throw error;
         }
       } else if (response.status === 401 && hasBasicChallenge(response.headers) && basicFallbackCredentials(env)) {