sap-ai-dev-toolkit 0.9.5 → 0.9.6

package/README.md

@@ -297,7 +297,7 @@ The guided setup can also offer companion MCP entries with `sap-ai-dev --setup -
 
 The installer handles VSP provisioning automatically:
 
-- Uses the package's bundled patched VSP binary for the current platform, verified against the npm-published `dist/checksums.txt`. A checksum-anchored remote download is the fallback only when the package has no bundled asset.
+- Uses the package's bundled patched VSP binary for the current platform, verified against the npm-published `dist/checksums.txt`. When the bundled asset is missing (an interrupted install, an antivirus quarantine, or a git checkout without `dist/`), a checksum-anchored download from the matching GitHub release is the fallback; MCP server startup runs it too, because npx entries skip install scripts.
 - No Go toolchain is downloaded or required at install time; Go is only used by the repository's own `build:vsp` development script.
 
 Setup detects where it is running. With `H2O_URL` set, it treats the environment as SAP Business Application Studio and opens a checkbox picker for BAS destinations, with no destinations selected by default. Use **Space** to choose destinations and **Enter** to confirm. Press **a** to toggle all destinations (select all if any are unchecked; otherwise clear the selection). Confirming with none selected removes this add-on's managed MCP entries. When the `cf` CLI 8.18 or newer is authenticated to a targeted space, setup first offers an optional import from that space's Destination service; type **y** then **Enter** to include it, or press **Enter** to skip. Accepted CF and BAS destinations appear together in the picker.
@@ -880,7 +880,7 @@ NPM_PUBLISH_TOKEN=npm_...
 - To publish a patch bump, run `npm run publish:npm -- --patch`; it updates `package.json` and `package-lock.json` before publishing. If publishing fails after the bump, retry without `--patch`.
 - npm's `prepublishOnly` hook builds the pinned VSP binaries for all platforms (including the Go toolchain if missing) and refuses to ship a tarball whose `dist/checksums.txt` does not list all five assets; it guards `npm run publish:npm` and a plain `npm publish` alike. Pass `--skip-build` to republish an already-built `dist/` without rebuilding.
 - Preview the package without publishing, changing its version, or building with `npm run publish:npm -- --dry-run`.
-- GitHub Actions runs the test suite on pushes to `main` and pull requests. A push to `main` that changes the `package.json` version runs the same checks, builds the VSP binaries, publishes that version to npm, and creates a `v<version>` GitHub release with generated notes.
+- GitHub Actions runs the test suite on pushes to `main` and pull requests. A push to `main` that changes the `package.json` version runs the same checks, builds the VSP binaries, publishes that version to npm, and creates a `v<version>` GitHub release with generated notes and the VSP binaries plus `checksums.txt` attached for the download fallback.
 - The publish workflow uses the `NPM_PUBLISH_TOKEN` GitHub repository secret. Verify it with `gh secret list`; the token value is never stored in the repository.
 
 The token is not printed or stored in the repository.

package/dist/checksums.txt

@@ -1,5 +1,5 @@
-85333f1ac7cbc25bc10a938cea5712b43d1c7b241911f19c6794f897dbcb589c  vsp-linux-x64
-68cd2b79e7cda145135f9f516b6ba76f33839bc9226bbf58ea015ff2442b4b2d  vsp-linux-arm64
-62fd8cd8eba8d61e36813c098938a2479af68047fd2fa1c85782edb4d4b5261b  vsp-darwin-x64
-71eb9e64e292e3ac83a2ab6a630367cfb0d79fe465d62ad1cfb05ef8c6c2b6e7  vsp-darwin-arm64
-952a6d5a90265fb6a6b3494d01a5d143fd7c471f7ce560bed200c399522b180f  vsp-win32-x64.exe
+a5b602573f54ce3d03d161aaaeb78559fd73bd51f2ae9a3b7549cee1ddc3fbf6  vsp-linux-x64
+2e336e2999c3654e5eb1e3a8bb42616eb5d5e422ab7ae74ffbff4634be45189d  vsp-linux-arm64
+afc7fd0f2e40ae5ebfcd3ddb8ac3cb7e7501b2b66d76ac96e3b6054b09366bb5  vsp-darwin-x64
+2d28a870c4a006900eec245384b4bbc2e84651e0ba911cca6107c132ace73575  vsp-darwin-arm64
+7d0189aa7ff936a145b0e3f15bffce8de5aebc252465a720edc3a9b122bd2a28  vsp-win32-x64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/src/binary.mjs

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 import { chmod, mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises';
-import { homedir, tmpdir } from 'node:os';
+import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { brandedEnvValue } from './branding.mjs';
@@ -114,12 +114,14 @@ export async function findBinary(pkg, options = {}) {
       await stat(bundled);
       const verified = await verifyAgainstPackagedChecksums(bundled, target);
       if (verified === false) {
-        log(`bundled VSP binary ${target.asset} failed checksum verification; ignoring it`);
+        log(`bundled VSP binary ${bundled} failed checksum verification; ignoring it`);
       } else {
         if (verified === null) log(`bundled VSP binary ${target.asset} has no packaged checksum entry; using it unverified`);
         return bundled;
       }
-    } catch {}
+    } catch (error) {
+      log(`bundled VSP binary not found at ${bundled} (${error.code || error.message})`);
+    }
   }
   const path = cachedBinaryPath(pkg, options.platform, options.arch, env);
   try {
@@ -158,6 +160,11 @@ export async function installBinary(pkg, options = {}) {
       if (String(error?.message || '').includes('checksum verification')) throw error;
     }
   }
+  return downloadBinary(pkg, options);
+}
+
+export async function downloadBinary(pkg, options = {}) {
+  const env = options.env || process.env;
   const target = binaryTarget(options.platform, options.arch);
   const base = releaseBaseUrl(pkg, pkg.version);
   const assetUrl = brandedEnvValue(env, 'BINARY_URL') || `${base}/${target.asset}`;
@@ -184,7 +191,8 @@ export async function installBinary(pkg, options = {}) {
   await mkdir(dir, { recursive: true, mode: 0o700 });
   await chmod(dir, 0o700);
   const destination = cachedBinaryPath(pkg, options.platform, options.arch, env);
-  const temporary = join(tmpdir(), `sap-ai-dev-toolkit-vsp-${process.pid}-${Date.now()}`);
+  // Same directory as the destination: rename fails with EXDEV across filesystems (tmpfs /tmp).
+  const temporary = `${destination}.${process.pid}-${Date.now()}.tmp`;
   await writeFile(temporary, bytes, { mode: 0o700 });
   await chmod(temporary, 0o700);
   await rename(temporary, destination);

package/src/launcher.mjs

@@ -5,7 +5,7 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { discoverDestinations, remediation, slugifyDestination, statusRows } from './bas-discovery.mjs';
 import { discoverSapGuiSystems } from './local-sap-gui.mjs';
-import { findBinary } from './binary.mjs';
+import { binaryTarget, downloadBinary, findBinary } from './binary.mjs';
 import { MCPProxy } from './mcp-proxy.mjs';
 import { installMcpConfig, npxMcpLauncher, repairManagedMcpConfig } from './mcp-config.mjs';
 import { runSetup } from './setup.mjs';
@@ -163,10 +163,27 @@ function probeDiagnostic(destination) {
   return `[sap-ai-dev] ${destination.name}: probe=${probe.status || 'unknown'}${details.length ? ` (${details.join('; ')})` : ''}`;
 }
 
+// npx MCP entries run with --ignore-scripts, so postinstall's verified
+// download fallback never ran; a missing or corrupt bundled binary heals here.
 async function binaryOrError() {
-  const path = await findBinary(pkg, { env: runtimeEnv });
-  if (path) return path;
-  throw new Error('VSP binary is not installed. Reinstall with scripts enabled, set SAP_AI_DEV_TOOLKIT_BINARY to a trusted patched binary, or run npm run build:vsp.');
+  const notes = [];
+  const found = await findBinary(pkg, { env: runtimeEnv, log: note => notes.push(note) });
+  if (found) return found;
+  logLine(`[sap-ai-dev] ${notes.join('; ') || 'no VSP binary found'}; downloading a checksum-verified copy`);
+  try {
+    const downloaded = await downloadBinary(pkg, { env: runtimeEnv });
+    logLine(`[sap-ai-dev] VSP binary installed at ${downloaded}`);
+    return downloaded;
+  } catch (error) {
+    notes.push(`download fallback failed: ${error.message}${error.cause?.code ? ` (${error.cause.code})` : ''}`);
+  }
+  const npxDirectory = root.match(/^(.*[\\/]_npx[\\/][^\\/]+)[\\/]node_modules[\\/]/)?.[1];
+  throw new Error([
+    `VSP binary ${binaryTarget().asset} is unavailable for ${pkg.name}@${pkg.version}: ${notes.join('; ')}.`,
+    npxDirectory
+      ? `The npm package ships this binary, so an interrupted install or an antivirus quarantine usually removed it: delete ${npxDirectory} and restart the MCP server so npx reinstalls the package, or set SAP_AI_DEV_TOOLKIT_BINARY to a trusted patched VSP binary.`
+      : `Reinstall ${pkg.name} (a git checkout needs npm run build:vsp), check whether antivirus quarantined the binary, or set SAP_AI_DEV_TOOLKIT_BINARY to a trusted patched VSP binary.`
+  ].join(' '));
 }
 
 async function discoverForCommand() {