sap-ai-dev-toolkit 0.9.5 → 0.9.7

package/README.md

@@ -297,10 +297,10 @@ The guided setup can also offer companion MCP entries with `sap-ai-dev --setup -
 
 The installer handles VSP provisioning automatically:
 
-- Uses the package's bundled patched VSP binary for the current platform, verified against the npm-published `dist/checksums.txt`. A checksum-anchored remote download is the fallback only when the package has no bundled asset.
+- Uses the package's bundled patched VSP binary for the current platform, verified against the npm-published `dist/checksums.txt`. When the bundled asset is missing (an interrupted install, an antivirus quarantine, or a git checkout without `dist/`), a checksum-anchored download from the matching GitHub release is the fallback; MCP server startup runs it too, because npx entries skip install scripts.
 - No Go toolchain is downloaded or required at install time; Go is only used by the repository's own `build:vsp` development script.
 
-Setup detects where it is running. With `H2O_URL` set, it treats the environment as SAP Business Application Studio and opens a checkbox picker for BAS destinations, with no destinations selected by default. Use **Space** to choose destinations and **Enter** to confirm. Press **a** to toggle all destinations (select all if any are unchecked; otherwise clear the selection). Confirming with none selected removes this add-on's managed MCP entries. When the `cf` CLI 8.18 or newer is authenticated to a targeted space, setup first offers an optional import from that space's Destination service; type **y** then **Enter** to include it, or press **Enter** to skip. Accepted CF and BAS destinations appear together in the picker.
+Setup detects where it is running. With `H2O_URL` set, it treats the environment as SAP Business Application Studio and opens a checkbox picker for BAS destinations, with no destinations selected by default: every row starts with an empty box `[ ]`. Use **Space** to tick a destination (`[✓]`) and **Enter** to confirm; the line under the list always names the next key to press. Press **a** to toggle all destinations (select all if any are unchecked; otherwise clear the selection). Pressing **Enter** with nothing selected asks for a second **Enter**, because confirming with none selected removes this add-on's managed MCP entries. When the `cf` CLI 8.18 or newer is authenticated to a targeted space, setup first offers an optional import from that space's Destination service; type **y** then **Enter** to include it, or press **Enter** to skip. Accepted CF and BAS destinations appear together in the picker.
 
 Without `H2O_URL`, interactive setup looks for local SAP GUI system configuration on macOS and Windows (for example SAP GUI landscape XML and `saplogon.ini`). SAP GUI landscape files describe SAP GUI/DIAG connectivity, not the ADT HTTP(S) endpoint or a complete ABAP client catalog, so setup asks for the SAP client or comma-separated clients to configure for each selected system (for example `100,200`), proposes an ADT URL from the SAP GUI host and instance when it can, and asks you to confirm or edit that value. Multiple entered clients create separate isolated MCP entries, one per system/client pair. Local SAP GUI MCP server keys use the SAP system ID and client (for example `t4d-100`) instead of the longer SAP GUI description, while `SAP_AI_DEV_TOOLKIT_DESTINATION` still preserves the display name. When the ADT URL uses an IP address, setup automatically inspects the SAP HTTPS certificate, extracts DNS subjectAltName entries, and offers to enable secure TLS self-healing with a simple yes/no confirmation; you do not need to type certificate names. The generated MCP entry uses VS Code input prompts for the SAP user and password at server start; raw SAP credentials are not stored in `mcp.json`. On Windows, setup offers Windows / smart card SSO (the default) instead, which writes `SAP_AUTH_MODE=sso` without username/password prompts. At server start, VSP opens Microsoft Edge on the ADT URL; Edge completes the login the same way it does in your browser (smart card certificate and PIN, Kerberos, or company SAML/Entra login), and the session is cached and refreshed automatically. SSO entries need an ADT URL with a host name, not an IP address. npm may run its install hook without an interactive terminal, even when the shell is interactive; in that case, destination selection is skipped without changing MCP config, and you should run `sap-ai-dev --setup` afterwards.
 
@@ -447,7 +447,7 @@ Review skipped or conflicting files and merge changes manually. `LintABAP` analy
 If the `cf` CLI is version 8.18 or newer and authenticated to a targeted space, setup offers an opt-in import from that space's SAP Destination service. It does not create service keys unless you accept. The imported records are limited to the current space and are merged with BAS destinations for selection. OnPremise destinations require choosing a Connectivity service instance; runtime traffic uses that service's proxy, and PrincipalPropagation uses the current CF user's token. Internet destinations use the configured HTTP(S) proxy environment. Setup stores only service-instance/key references in `mcp.json`, not the service-key credentials. At runtime the generated entry verifies the active CF space and resolves those references. Setup removes an add-on-created key only when no remaining CF entry references it and the CLI is targeted to the key's recorded space; keys are left untouched when the space cannot be verified.
 Cloud Foundry HTTP destination probes use forward-form HTTP requests, not CONNECT tunnels; SAP Connectivity requires HTTP from the application to its proxy. OnPremise requests are canceled when the client disconnects or the runtime route closes.
 
-Interactive npm install and `sap-ai-dev --setup` both use a checkbox picker with no destinations selected by default. Use **Space** to choose destinations, **Enter** to confirm, **a** to toggle all (select all if any are unchecked; otherwise clear the selection), and **m** to configure an undiscovered system manually in the manual entry wizard; configured systems join the picker pre-selected. Confirming with none checked removes this package's generated MCP entries. Non-interactive installs skip destination or local SAP GUI system selection without changing MCP config. Run the interactive setup command above; generated entries fall back to the pinned npx launcher automatically when the package is not installed globally.
+Interactive npm install and `sap-ai-dev --setup` both use a checkbox picker with no destinations selected by default. Use **Space** to choose destinations, **Enter** to confirm, **a** to toggle all (select all if any are unchecked; otherwise clear the selection), and **m** to configure an undiscovered system manually in the manual entry wizard; configured systems join the picker pre-selected. Confirming with none checked takes a second **Enter** and removes this package's generated MCP entries. Non-interactive installs skip destination or local SAP GUI system selection without changing MCP config. Run the interactive setup command above; generated entries fall back to the pinned npx launcher automatically when the package is not installed globally.
 
 When nothing is detected — no BAS destinations, no Cloud Foundry imports, or no local SAP GUI entries — setup offers the **manual entry wizard** instead of stopping. The same wizard is available at any point in the destination picker via the **m** shortcut. It asks for a system name, the ADT HTTP(S) base URL (for example `https://myhost.example:44300`), one or more 3-digit SAP clients, and (on Windows) the login mode. You can add several systems in one run; each becomes the same isolated per-system/client MCP server the discovery flows generate, including credential input prompts and TLS self-healing for IP-based HTTPS URLs. Declining the wizard when nothing was detected exits setup without changes; aborting it inside the picker (Ctrl+C) returns to the selection unchanged.
 
@@ -880,7 +880,7 @@ NPM_PUBLISH_TOKEN=npm_...
 - To publish a patch bump, run `npm run publish:npm -- --patch`; it updates `package.json` and `package-lock.json` before publishing. If publishing fails after the bump, retry without `--patch`.
 - npm's `prepublishOnly` hook builds the pinned VSP binaries for all platforms (including the Go toolchain if missing) and refuses to ship a tarball whose `dist/checksums.txt` does not list all five assets; it guards `npm run publish:npm` and a plain `npm publish` alike. Pass `--skip-build` to republish an already-built `dist/` without rebuilding.
 - Preview the package without publishing, changing its version, or building with `npm run publish:npm -- --dry-run`.
-- GitHub Actions runs the test suite on pushes to `main` and pull requests. A push to `main` that changes the `package.json` version runs the same checks, builds the VSP binaries, publishes that version to npm, and creates a `v<version>` GitHub release with generated notes.
+- GitHub Actions runs the test suite on pushes to `main` and pull requests. A push to `main` that changes the `package.json` version runs the same checks, builds the VSP binaries, publishes that version to npm, and creates a `v<version>` GitHub release with generated notes and the VSP binaries plus `checksums.txt` attached for the download fallback.
 - The publish workflow uses the `NPM_PUBLISH_TOKEN` GitHub repository secret. Verify it with `gh secret list`; the token value is never stored in the repository.
 
 The token is not printed or stored in the repository.

package/dist/checksums.txt

@@ -1,5 +1,5 @@
-85333f1ac7cbc25bc10a938cea5712b43d1c7b241911f19c6794f897dbcb589c  vsp-linux-x64
-68cd2b79e7cda145135f9f516b6ba76f33839bc9226bbf58ea015ff2442b4b2d  vsp-linux-arm64
-62fd8cd8eba8d61e36813c098938a2479af68047fd2fa1c85782edb4d4b5261b  vsp-darwin-x64
-71eb9e64e292e3ac83a2ab6a630367cfb0d79fe465d62ad1cfb05ef8c6c2b6e7  vsp-darwin-arm64
-952a6d5a90265fb6a6b3494d01a5d143fd7c471f7ce560bed200c399522b180f  vsp-win32-x64.exe
+a5b602573f54ce3d03d161aaaeb78559fd73bd51f2ae9a3b7549cee1ddc3fbf6  vsp-linux-x64
+2e336e2999c3654e5eb1e3a8bb42616eb5d5e422ab7ae74ffbff4634be45189d  vsp-linux-arm64
+afc7fd0f2e40ae5ebfcd3ddb8ac3cb7e7501b2b66d76ac96e3b6054b09366bb5  vsp-darwin-x64
+2d28a870c4a006900eec245384b4bbc2e84651e0ba911cca6107c132ace73575  vsp-darwin-arm64
+7d0189aa7ff936a145b0e3f15bffce8de5aebc252465a720edc3a9b122bd2a28  vsp-win32-x64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.9.5",
+  "version": "0.9.7",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/src/binary.mjs

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 import { chmod, mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises';
-import { homedir, tmpdir } from 'node:os';
+import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { brandedEnvValue } from './branding.mjs';
@@ -114,12 +114,14 @@ export async function findBinary(pkg, options = {}) {
       await stat(bundled);
       const verified = await verifyAgainstPackagedChecksums(bundled, target);
       if (verified === false) {
-        log(`bundled VSP binary ${target.asset} failed checksum verification; ignoring it`);
+        log(`bundled VSP binary ${bundled} failed checksum verification; ignoring it`);
       } else {
         if (verified === null) log(`bundled VSP binary ${target.asset} has no packaged checksum entry; using it unverified`);
         return bundled;
       }
-    } catch {}
+    } catch (error) {
+      log(`bundled VSP binary not found at ${bundled} (${error.code || error.message})`);
+    }
   }
   const path = cachedBinaryPath(pkg, options.platform, options.arch, env);
   try {
@@ -158,6 +160,11 @@ export async function installBinary(pkg, options = {}) {
       if (String(error?.message || '').includes('checksum verification')) throw error;
     }
   }
+  return downloadBinary(pkg, options);
+}
+
+export async function downloadBinary(pkg, options = {}) {
+  const env = options.env || process.env;
   const target = binaryTarget(options.platform, options.arch);
   const base = releaseBaseUrl(pkg, pkg.version);
   const assetUrl = brandedEnvValue(env, 'BINARY_URL') || `${base}/${target.asset}`;
@@ -184,7 +191,8 @@ export async function installBinary(pkg, options = {}) {
   await mkdir(dir, { recursive: true, mode: 0o700 });
   await chmod(dir, 0o700);
   const destination = cachedBinaryPath(pkg, options.platform, options.arch, env);
-  const temporary = join(tmpdir(), `sap-ai-dev-toolkit-vsp-${process.pid}-${Date.now()}`);
+  // Same directory as the destination: rename fails with EXDEV across filesystems (tmpfs /tmp).
+  const temporary = `${destination}.${process.pid}-${Date.now()}.tmp`;
   await writeFile(temporary, bytes, { mode: 0o700 });
   await chmod(temporary, 0o700);
   await rename(temporary, destination);

package/src/launcher.mjs

@@ -4,8 +4,8 @@ import { readFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { discoverDestinations, remediation, slugifyDestination, statusRows } from './bas-discovery.mjs';
-import { discoverSapGuiSystems } from './local-sap-gui.mjs';
-import { findBinary } from './binary.mjs';
+import { detectAdtUrl, discoverSapGuiSystems, hasExplicitPort } from './local-sap-gui.mjs';
+import { binaryTarget, downloadBinary, findBinary } from './binary.mjs';
 import { MCPProxy } from './mcp-proxy.mjs';
 import { installMcpConfig, npxMcpLauncher, repairManagedMcpConfig } from './mcp-config.mjs';
 import { runSetup } from './setup.mjs';
@@ -163,10 +163,31 @@ function probeDiagnostic(destination) {
   return `[sap-ai-dev] ${destination.name}: probe=${probe.status || 'unknown'}${details.length ? ` (${details.join('; ')})` : ''}`;
 }
 
+// npx MCP entries run with --ignore-scripts, so postinstall's verified
+// download fallback never ran; a missing or corrupt bundled binary heals here.
 async function binaryOrError() {
-  const path = await findBinary(pkg, { env: runtimeEnv });
-  if (path) return path;
-  throw new Error('VSP binary is not installed. Reinstall with scripts enabled, set SAP_AI_DEV_TOOLKIT_BINARY to a trusted patched binary, or run npm run build:vsp.');
+  const notes = [];
+  const found = await findBinary(pkg, { env: runtimeEnv, log: note => notes.push(note) });
+  if (found) return found;
+  logLine(`[sap-ai-dev] ${notes.join('; ') || 'no VSP binary found'}; downloading a checksum-verified copy`);
+  try {
+    const downloaded = await downloadBinary(pkg, { env: runtimeEnv });
+    logLine(`[sap-ai-dev] VSP binary installed at ${downloaded}`);
+    return downloaded;
+  } catch (error) {
+    notes.push(`download fallback failed: ${error.message}${error.cause?.code ? ` (${error.cause.code})` : ''}`);
+  }
+  const npxDirectory = root.match(/^(.*[\\/]_npx[\\/][^\\/]+)[\\/]node_modules[\\/]/)?.[1];
+  throw new Error([
+    `VSP binary ${binaryTarget().asset} is unavailable for ${pkg.name}@${pkg.version}: ${notes.join('; ')}.`,
+    npxDirectory
+      ? `The npm package ships this binary, so an interrupted install or an antivirus quarantine usually removed it: delete ${npxDirectory} and restart the MCP server so npx reinstalls the package, or set SAP_AI_DEV_TOOLKIT_BINARY to a trusted patched VSP binary.`
+      : `Reinstall ${pkg.name} (a git checkout needs npm run build:vsp), check whether antivirus quarantined the binary, or set SAP_AI_DEV_TOOLKIT_BINARY to a trusted patched VSP binary.`
+  ].join(' '));
+}
+
+async function detectLocalAdtUrl(target) {
+  return detectAdtUrl(await binaryOrError(), { ...target, env: runtimeEnv });
 }
 
 async function discoverForCommand() {
@@ -188,10 +209,19 @@ async function configuredLocalSapGuiDestination(env) {
   // Older entries used windows-sso, browser-saml or saml-password; all of them now mean browser SSO.
   if (!['', 'basic'].includes(String(env.SAP_AUTH_MODE || '').toLowerCase())) {
     const cacheKey = `${systemId || new URL(env.SAP_URL).hostname}-${client}`.toLowerCase().replace(/[^a-z0-9.-]+/g, '-');
+    let url = env.SAP_URL;
+    // SAP GUI landscapes carry no HTTP port, and the SSO browser cannot sign in on a guessed one.
+    if (!hasExplicitPort(url)) {
+      const detected = await detectLocalAdtUrl({ url, client }).catch(() => '');
+      logLine(detected
+        ? `[sap-ai-dev] ${name}: SAP_URL has no port; ADT answers at ${detected}`
+        : `[sap-ai-dev] ${name}: SAP_URL has no port and no ADT port answered on ${new URL(url).hostname}; add the port to SAP_URL or rerun sap-ai-dev --setup`);
+      url = detected || url;
+    }
     return {
       source: 'sap-gui-local',
       name,
-      url: env.SAP_URL,
+      url,
       client,
       systemId,
       authentication: 'SSO',
@@ -263,7 +293,8 @@ async function main() {
   }
   if (setup) {
     const setupOptions = {
-      includeSapDevelopmentToolsPrompt: hasFlag('--tools') || hasFlag('--companion-tools')
+      includeSapDevelopmentToolsPrompt: hasFlag('--tools') || hasFlag('--companion-tools'),
+      detectAdtUrl: detectLocalAdtUrl
     };
     if (hasFlag('--npx')) {
       // Windows has no npx.exe, so generated entries there launch through
@@ -318,7 +349,7 @@ async function main() {
   if (!runtimeEnv.H2O_URL) {
     if (args().length === 0 && process.stdin.isTTY && process.stdout.isTTY) {
       console.error('sap-ai-dev: no BAS environment detected; starting local interactive setup. Use --help for other commands.');
-      await runSetup();
+      await runSetup({ detectAdtUrl: detectLocalAdtUrl });
       return;
     }
     const binary = await binaryOrError();

package/src/local-sap-gui.mjs

@@ -401,3 +401,27 @@ export function defaultAdtUrl(system) {
   const authority = host.includes(':') && !host.startsWith('[') ? `[${host}]` : host;
   return /^\d{2}$/.test(instance) ? `https://${authority}:443${instance}` : `https://${authority}`;
 }
+
+// new URL() drops a default port, so `https://host:443` must be read from the text.
+export function hasExplicitPort(url) {
+  return /^[a-z][a-z0-9+.-]*:\/\/[^/?#]*:\d+(?:[/?#]|$)/i.test(String(url || '').trim());
+}
+
+// A portless URL means 443, which on-premise ICMs rarely serve; VSP's `detect`
+// probes the conventional ADT ports and reports which one answers.
+export async function detectAdtUrl(binary, { url, client, env = process.env, timeoutMs = 60_000 } = {}) {
+  let configured;
+  try { configured = new URL(url); } catch { return ''; }
+  const args = ['detect', configured.hostname.replace(/^\[(.*)\]$/, '$1'), '--json', ...(client ? ['--client', String(client)] : [])];
+  const [command, ...prefixArgs] = /\.(?:mjs|cjs|js)$/i.test(binary)
+    ? [process.execPath, binary]
+    : (/\.(?:cmd|bat)$/i.test(binary) && platform() === 'win32' ? ['cmd', '/c', binary] : [binary]);
+  try {
+    const { stdout } = await execFileAsync(command, [...prefixArgs, ...args], { env, windowsHide: true, timeout: timeoutMs, maxBuffer: 1024 * 1024 });
+    const adt = (JSON.parse(stdout)?.findings || []).filter(finding => finding?.kind === 'adt' && /^https?:\/\//i.test(String(finding.url || '')));
+    // The SSO session cookie is the whole credential; never trade https for http.
+    return (adt.find(finding => finding.secure) || (configured.protocol === 'http:' ? adt[0] : undefined))?.url || '';
+  } catch {
+    return '';
+  }
+}

package/src/mcp-config.mjs

@@ -106,6 +106,8 @@ export async function resolveMcpServerCommand(env = process.env) {
     : ['sap-ai-dev'];
   const searchPath = String(env.PATH || env.Path || '').split(delimiter).filter(Boolean);
   for (const directory of searchPath) {
+    // npx prepends its disposable cache bin dir; entries pointing there go stale or vanish with the cache.
+    if (/[\\/]_npx[\\/][^\\/]+[\\/]node_modules[\\/]\.bin[\\/]?$/.test(directory)) continue;
     for (const executableName of executableNames) {
       const candidate = resolve(directory, executableName);
       try {

package/src/setup.mjs

@@ -4,7 +4,7 @@ import { platform } from 'node:os';
 import { isIP } from 'node:net';
 import { checkboxPrompt, colorText, formatStatus, selectPrompt, startProgress, textPrompt } from './terminal-ui.mjs';
 import { discoverDestinations, remediation } from './bas-discovery.mjs';
-import { defaultAdtUrl, discoverSapGuiSystems } from './local-sap-gui.mjs';
+import { defaultAdtUrl, discoverSapGuiSystems, hasExplicitPort } from './local-sap-gui.mjs';
 import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys, findOrphanedCloudFoundryServiceKeys } from './cf-destination.mjs';
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
 import { discoverCertificateDnsNames } from './tls-adt-proxy.mjs';
@@ -124,6 +124,23 @@ function localAuthenticationLabel(authMode) {
   return authMode === 'sso' ? 'SSO' : 'Basic';
 }
 
+// The SSO browser signs in on the ADT URL itself, and SAP GUI landscapes never
+// carry the HTTP port, so a portless URL would send it to 443.
+async function detectSsoAdtPort(destination, label, client, { output = stdout, env = process.env, detectAdtUrl } = {}) {
+  if (!detectAdtUrl || hasExplicitPort(destination.url)) return;
+  const stopProgress = startProgress(`Detecting the ADT port for ${label}`, { output, env, label: 'SSO' });
+  let detected = '';
+  try { detected = await detectAdtUrl({ url: destination.url, client }); }
+  catch { detected = ''; }
+  finally { stopProgress(); }
+  if (detected) {
+    destination.url = detected;
+    print(output, formatStatus(`ADT answers at ${detected}; SSO signs in there.`, 'success', output, 'SSO'));
+    return;
+  }
+  print(output, formatStatus(`No ADT port answered for ${label}; SSO keeps ${destination.url}. If the browser cannot reach it, rerun setup and enter the ADT URL with its port, for example ${new URL(destination.url).origin}:44300.`, 'warning', output, 'SSO'));
+}
+
 async function confirmPrompt(message, { input = stdin, output = stdout } = {}) {
   const answer = await textPrompt({
     message,
@@ -181,7 +198,7 @@ async function maybeConfigureTlsSelfHeal(destination, promptLabel, { input = std
 // collects the minimal ADT configuration directly from the user and produces
 // the same local destination shape as the SAP GUI flow, so installation,
 // credential inputs, and TLS handling stay identical.
-async function runManualEntryWizard({ env = process.env, input = stdin, output = stdout } = {}) {
+async function runManualEntryWizard({ env = process.env, input = stdin, output = stdout, detectAdtUrl } = {}) {
   print(output, '');
   print(output, colorText('✍️  Manual system entry — skip discovery, add your SAP system directly', 'magenta', output));
   print(output, colorText('   The ADT URL is the base URL that Eclipse ADT or VS Code ADT tools use, for example https://myhost.example:44300.', 'cyan', output));
@@ -229,6 +246,7 @@ async function runManualEntryWizard({ env = process.env, input = stdin, output =
     await maybeConfigureTlsSelfHeal(destination, name, { input, output });
     const clients = await promptSapClients(destination, { input, output });
     const authMode = await chooseLocalAuthMode(destination, { input, output, env });
+    if (authMode === 'sso') await detectSsoAdtPort(destination, name, clients[0], { output, env, detectAdtUrl });
     destination.authentication = localAuthenticationLabel(authMode);
     destination.authMode = authMode;
     for (const client of clients) {
@@ -346,7 +364,7 @@ function printConnectionInstructions(output, result) {
 
 // Checkbox selection over the discovered destinations plus, outside BAS, the
 // per-system confirmation prompts (clients, ADT URL, TLS self-heal, login).
-async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin, output = stdout, env = process.env } = {}) {
+async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin, output = stdout, env = process.env, detectAdtUrl } = {}) {
   const orderedDestinations = [...destinations].sort((left, right) => {
     const leftRank = left.disabledReason ? 2 : (left.probe?.available === false ? 1 : 0);
     const rightRank = right.disabledReason ? 2 : (right.probe?.available === false ? 1 : 0);
@@ -371,9 +389,8 @@ async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin
   print(output, '');
   print(output, colorText('  Space = select/deselect · a = toggle all · m = add a system manually · Enter = confirm.', 'cyan', output));
   print(output, colorText('  💡 No system listed, or need an extra one? Press m to skip discovery and add any SAP system manually.', 'magenta', output));
-  print(output, '  Nothing selected removes this add-on’s MCP entries.');
   print(output, '');
-  const addManually = async () => (await runManualEntryWizard({ env, input, output })).map(destination => ({
+  const addManually = async () => (await runManualEntryWizard({ env, input, output, detectAdtUrl })).map(destination => ({
     value: destination,
     name: `${destination.name} (manual, client ${destination.client})`
   }));
@@ -382,7 +399,8 @@ async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin
     choices,
     required: false,
     shortcuts: { all: 'a' },
-    actions: { m: addManually }
+    actions: { m: addManually },
+    confirmEmpty: 'Press Enter again to continue with none (removes this add-on’s MCP entries).'
   }, { input, output });
 
   if (!isBas && selected.length) {
@@ -417,6 +435,7 @@ async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin
       destination.url = url || fallback;
       await maybeConfigureTlsSelfHeal(destination, promptLabel, { input, output });
       const authMode = await chooseLocalAuthMode({ ...destination, name: promptLabel }, { input, output, env });
+      if (authMode === 'sso') await detectSsoAdtPort(destination, promptLabel, clients[0], { output, env, detectAdtUrl });
       destination.authentication = localAuthenticationLabel(authMode);
       destination.authMode = authMode;
       for (const client of clients) {
@@ -437,7 +456,8 @@ export async function runSetup({
   discoverLocalSapGui = discoverSapGuiSystems,
   confirmCfImport = confirmCloudFoundryImport,
   install = installMcpConfig,
-  includeSapDevelopmentToolsPrompt = false
+  includeSapDevelopmentToolsPrompt = false,
+  detectAdtUrl
 } = {}) {
   const isBas = Boolean(env.H2O_URL);
   if (!isBas && (!input.isTTY || !output.isTTY)) {
@@ -584,10 +604,10 @@ export async function runSetup({
       ]
     }, { input, output });
     if (choice !== 'manual') return await exitWithoutDestinations();
-    selected = await runManualEntryWizard({ env, input, output });
+    selected = await runManualEntryWizard({ env, input, output, detectAdtUrl });
     if (!selected.length) return await exitWithoutDestinations();
   } else {
-    selected = await chooseDiscoveredDestinations(destinations, { isBas, input, output, env });
+    selected = await chooseDiscoveredDestinations(destinations, { isBas, input, output, env, detectAdtUrl });
   }
 
   let sapDevelopmentServers = [];

package/src/terminal-ui.mjs

@@ -213,7 +213,7 @@ export async function selectPrompt({ message, choices, defaultValue } = {}, { in
   });
 }
 
-export async function checkboxPrompt({ message, choices: initialChoices, required = false, shortcuts = { all: 'a' }, actions = {}, validate } = {}, { input = process.stdin, output = process.stdout } = {}) {
+export async function checkboxPrompt({ message, choices: initialChoices, required = false, shortcuts = { all: 'a' }, actions = {}, validate, confirmEmpty = '' } = {}, { input = process.stdin, output = process.stdout } = {}) {
   if (!Array.isArray(initialChoices) || !initialChoices.length) return [];
   // Action shortcuts (for example 'm' → manual entry wizard) may append new
   // choices while the picker is open, so the list itself stays mutable.
@@ -225,6 +225,8 @@ export async function checkboxPrompt({ message, choices: initialChoices, require
   let renderedLines = 0;
   let done = false;
   let previousRawMode;
+  // With confirmEmpty set, Enter on an empty selection shows it and waits for a second Enter.
+  let awaitingEmptyConfirm = false;
 
   const write = text => output.write(text);
   const clearRendered = () => {
@@ -237,6 +239,12 @@ export async function checkboxPrompt({ message, choices: initialChoices, require
     if (cursor >= top + pageSize) top = cursor - pageSize + 1;
     top = clamp(top, 0, Math.max(0, choices.length - pageSize));
   };
+  const footer = error => {
+    if (error) return [[error, 'red']];
+    if (awaitingEmptyConfirm) return [['Nothing is selected yet. Press Space to select the highlighted item (❯).', 'yellow'], [confirmEmpty, 'yellow']];
+    if (!selected.size) return [['Press Space to select the highlighted item (❯), then Enter to confirm.', 'cyan']];
+    return [[`${selected.size} selected. Press Enter to confirm, or Space to change.`, 'green']];
+  };
   const render = (error = '') => {
     const columns = Number.isFinite(output?.columns) ? output.columns : 80;
     const pageSize = checkboxPageSize(output, choices.length);
@@ -247,17 +255,15 @@ export async function checkboxPrompt({ message, choices: initialChoices, require
     for (let index = top; index < end; index += 1) {
       const choice = choices[index];
       const pointer = index === cursor ? '❯' : ' ';
-      const marker = selected.has(index)
-        ? colorText('✓', 'green', output)
-        : colorText('✗', 'red', output);
+      // A red ✗ for "not selected yet" was read as an error, so unselected rows show an empty box.
+      const box = choice.disabled ? '[-]' : (selected.has(index) ? colorText('[✓]', 'green', output) : '[ ]');
       const disabled = choice.disabled ? ` — ${choice.disabled}` : '';
-      const label = `${pointer}${marker} ${choice.name}${disabled}`;
-      lines.push(truncateToColumns(label, columns));
+      lines.push(truncateToColumns(`${pointer} ${box} ${choice.name}${disabled}`, columns));
     }
     if (choices.length > pageSize) {
       lines.push(truncateToColumns(colorText(`  Showing ${top + 1}-${end} of ${choices.length}; use ↑/↓ to scroll.`, 'cyan', output), columns));
     }
-    if (error) lines.push(truncateToColumns(colorText(`  ${error}`, 'red', output), columns));
+    for (const [text, color] of footer(error)) lines.push(truncateToColumns(colorText(`  ${text}`, color, output), columns));
     clearRendered();
     write(`${lines.join('\n')}\n`);
     renderedLines = physicalRows(lines, columns);
@@ -332,6 +338,7 @@ export async function checkboxPrompt({ message, choices: initialChoices, require
         selected.clear();
         if (!allSelected) for (const choice of enabledChoices(choices)) selected.add(choices.indexOf(choice));
       } else if (actionShortcutFor(_chunk, key)) {
+        awaitingEmptyConfirm = false;
         void runAction(actionShortcutFor(_chunk, key));
         return;
       } else if (key.name === 'return' || key.name === 'enter') {
@@ -339,10 +346,15 @@ export async function checkboxPrompt({ message, choices: initialChoices, require
         const validation = typeof validate === 'function' ? validate(values) : true;
         if (validation !== true) return render(String(validation));
         if (required && !values.length) return render('Select at least one item.');
+        if (confirmEmpty && !values.length && !awaitingEmptyConfirm) {
+          awaitingEmptyConfirm = true;
+          return render();
+        }
         return finish(values);
       } else {
         return;
       }
+      awaitingEmptyConfirm = false;
       render();
     };