sap-ai-dev-toolkit 0.9.9 → 0.9.92

package/README.md

@@ -302,7 +302,7 @@ The installer handles VSP provisioning automatically:
 
 Setup detects where it is running. With `H2O_URL` set, it treats the environment as SAP Business Application Studio and opens a checkbox picker for BAS destinations, with no destinations selected by default: every row starts with an empty box `[ ]`. Use **Space** to tick a destination (`[✓]`) and **Enter** to confirm; the line under the list always names the next key to press. Press **a** to toggle all destinations (select all if any are unchecked; otherwise clear the selection). Pressing **Enter** with nothing selected asks for a second **Enter**, because confirming with none selected removes this add-on's managed MCP entries. When the `cf` CLI 8.18 or newer is authenticated to a targeted space, setup first offers an optional import from that space's Destination service; type **y** then **Enter** to include it, or press **Enter** to skip. Accepted CF and BAS destinations appear together in the picker.
 
-Without `H2O_URL`, interactive setup looks for local SAP GUI system configuration on macOS and Windows (for example SAP GUI landscape XML and `saplogon.ini`). SAP GUI landscape files describe SAP GUI/DIAG connectivity, not the ADT HTTP(S) endpoint or a complete ABAP client catalog, so setup asks for the SAP client or comma-separated clients to configure for each selected system (for example `100,200`), proposes an ADT URL from the SAP GUI host and instance when it can, and asks you to confirm or edit that value. Multiple entered clients create separate isolated MCP entries, one per system/client pair. Local SAP GUI MCP server keys use the SAP system ID and client (for example `t4d-100`) instead of the longer SAP GUI description, while `SAP_AI_DEV_TOOLKIT_DESTINATION` still preserves the display name. When the ADT URL uses an IP address, setup automatically inspects the SAP HTTPS certificate, extracts DNS subjectAltName entries, and offers to enable secure TLS self-healing with a simple yes/no confirmation; you do not need to type certificate names. The generated MCP entry uses VS Code input prompts for the SAP user and password at server start; raw SAP credentials are not stored in `mcp.json`. On Windows, setup offers Windows / smart card SSO (the default) instead, which writes `SAP_AUTH_MODE=sso` without username/password prompts. At server start, VSP opens Microsoft Edge on the ADT URL; Edge completes the login the same way it does in your browser (smart card certificate and PIN, Kerberos, or company SAML/Entra login), and the session is cached and refreshed automatically. SSO entries need an ADT URL with a host name, not an IP address. npm may run its install hook without an interactive terminal, even when the shell is interactive; in that case, destination selection is skipped without changing MCP config, and you should run `sap-ai-dev --setup` afterwards.
+Without `H2O_URL`, interactive setup looks for local SAP GUI system configuration on macOS and Windows (for example SAP GUI landscape XML and `saplogon.ini`). SAP GUI landscape files describe SAP GUI/DIAG connectivity, not the ADT HTTP(S) endpoint or a complete ABAP client catalog, so setup asks for the SAP client or comma-separated clients to configure for each selected system (for example `100,200`), proposes an ADT URL from the SAP GUI host and instance when it can, and asks you to confirm or edit that value. Multiple entered clients create separate isolated MCP entries, one per system/client pair. Local SAP GUI MCP server keys use the SAP system ID and client (for example `t4d-100`) instead of the longer SAP GUI description, while `SAP_AI_DEV_TOOLKIT_DESTINATION` still preserves the display name. When the ADT URL uses an IP address, setup automatically inspects the SAP HTTPS certificate, extracts DNS subjectAltName entries, and offers to enable secure TLS self-healing with a simple yes/no confirmation; you do not need to type certificate names. The generated MCP entry uses VS Code input prompts for the SAP user and password at server start; raw SAP credentials are not stored in `mcp.json`. On Windows, setup offers Windows / smart card SSO (the default) instead, which writes `SAP_AUTH_MODE=sso` without username/password prompts. At server start, VSP opens a Microsoft Edge window on the ADT URL whenever no session is cached yet; Edge completes the login the same way it does in your browser (smart card certificate and PIN, Kerberos, or company SAML/Entra login). Keep the MCP server running until the sign-in finishes; the session is then cached and refreshed automatically. SSO entries need an ADT URL with a host name, not an IP address. npm may run its install hook without an interactive terminal, even when the shell is interactive; in that case, destination selection is skipped without changing MCP config, and you should run `sap-ai-dev --setup` afterwards.
 
 ### 🖥️ Local machine SAP GUI support
 
@@ -314,7 +314,7 @@ Supported discovery and runtime behavior:
 - **Client selection:** SAP GUI entries may contain one default client but cannot reliably list every ABAP client available through ADT. Setup asks for one or more 3-digit clients per selected system; enter comma-separated values such as `100,200` to create separate MCP servers for each client.
 - **ADT endpoint derivation:** SAP GUI entries usually contain DIAG/router information, not the HTTP(S) ADT endpoint. Setup derives the common ADT port from the SAP instance when possible, for example instance `00` → `https://host:44300`, and asks for confirmation only when configuring the selected entry.
 - **Credential handling:** username/password local entries use VS Code MCP input prompts (`${input:...}`) at server start. Plain SAP credentials are not written to `mcp.json`.
-- **Login methods:** local entries use either username/password or Windows / smart card SSO. SSO sets `SAP_SSO=true` for the VSP runtime, which drives Microsoft Edge for the login and re-opens an Edge window only when the cached session can no longer be refreshed silently.
+- **Login methods:** local entries use either username/password or Windows / smart card SSO. SSO sets `SAP_SSO=true` for the VSP runtime, which drives Microsoft Edge for the login: the first sign-in opens an Edge window immediately, and an expired session is refreshed without a window for up to 15 seconds before Edge opens again. While a sign-in is pending, the MCP server output repeats a reminder every 15 seconds.
 - **IP-address HTTPS self-healing:** if the confirmed ADT URL is `https://<ip>:<port>` and the certificate is issued to DNS names, setup reads the certificate DNS SANs automatically and stores them as `SAP_TLS_SERVER_NAMES`. At runtime a loopback proxy dials the IP address but verifies TLS against those discovered DNS names, trying them one by one. Certificate verification stays enabled; there is no `--insecure` mode.
 - **Private CAs:** if the SAP HTTPS certificate chains to an internal CA that is not trusted by the local Node runtime, set `SAP_TLS_CA_FILE` or `SAP_AI_DEV_TOOLKIT_TLS_CA_FILE` to a PEM CA bundle. This adds trust roots for the self-healing proxy without disabling certificate validation.
 - **Redirect and request safety:** local loopback proxies reject cross-origin forward-form requests and rewrite same-origin SAP redirects back through the loopback listener, so VSP stays on the safe route.
@@ -809,6 +809,8 @@ The response contains a `tools` array. A `RunQuery` entry resembles this excerpt
 | `SAP_AI_DEV_TOOLKIT_MODE` | VSP child mode (`expert` by default; `focused` omits `ActivateMultiple`, `GetUserTransports`, and `GetTransportInfo`). The proxy exposes its curated tool subset and local workflow tools, including `LintABAP`. |
 | `SAP_ALLOW_TRANSPORTABLE_EDITS` | Generated MCP entries set this to `true` to permit source edits in transportable packages; VSP safety checks and SAP authorizations still apply. |
 | `SAP_AUTH_MODE=sso` | Local SAP GUI entry mode for Windows / smart card SSO. Runtime starts VSP with `SAP_SSO=true`, which signs in through Microsoft Edge and caches the session per system and client. Older `windows-sso`, `browser-saml`, and `saml-password` entries are treated as `sso`. |
+| `SAP_SSO_FIRST_LOGIN` | Local SSO entries default to `window`: with no cached session, VSP opens the Edge sign-in window at once. Set `silent` to try a hidden browser first. |
+| `SAP_SSO_SILENT_TIMEOUT` | How long a hidden SSO refresh may run before the Edge window opens, as a Go duration. Local SSO entries default to `15s`; VSP's own default is `45s`. |
 | `SAP_TLS_SERVER_NAMES` / `SAP_AI_DEV_TOOLKIT_TLS_SERVER_NAMES` | Comma-separated local SAP GUI TLS self-healing names, normally auto-discovered during setup from the SAP HTTPS certificate when `SAP_URL` uses an IP address. Runtime tries them one by one while keeping certificate validation enabled. |
 | `SAP_TLS_SERVER_NAME` / `SAP_AI_DEV_TOOLKIT_TLS_SERVER_NAME` | Single-name compatibility form of the local SAP GUI TLS self-healing override. Prefer the auto-discovered plural variable written by setup. |
 | `SAP_TLS_CA_FILE` / `SAP_AI_DEV_TOOLKIT_TLS_CA_FILE` | Optional PEM CA bundle for the local TLS self-healing proxy when the SAP HTTPS certificate chains to a private CA that is not in the OS/Node trust store. Certificate verification remains enabled. |

package/dist/checksums.txt

@@ -1,5 +1,5 @@
-a5b602573f54ce3d03d161aaaeb78559fd73bd51f2ae9a3b7549cee1ddc3fbf6  vsp-linux-x64
-2e336e2999c3654e5eb1e3a8bb42616eb5d5e422ab7ae74ffbff4634be45189d  vsp-linux-arm64
-afc7fd0f2e40ae5ebfcd3ddb8ac3cb7e7501b2b66d76ac96e3b6054b09366bb5  vsp-darwin-x64
-2d28a870c4a006900eec245384b4bbc2e84651e0ba911cca6107c132ace73575  vsp-darwin-arm64
-7d0189aa7ff936a145b0e3f15bffce8de5aebc252465a720edc3a9b122bd2a28  vsp-win32-x64.exe
+40bba6b57e0656249b3de91f70504b49e56c4a72cd418de47d5b3c4ff5b78466  vsp-linux-x64
+86b1ecdf0f6af6778750b44caef6cc1e7f4ab9efc1cfe202f26766b85c48cbf4  vsp-linux-arm64
+9ee2823cea8fc456f2fcd249abe8ffbd72e7ca52a3731ee228efbabe7099b455  vsp-darwin-x64
+9148037eb23f6e80f03bb0080d3a12e5c73f25f8d2d9c262273b870ed0716782  vsp-darwin-arm64
+5494267d5c47bed9155507cf5b156932933ce0f6aaf7999c6c60afe1ecc6367f  vsp-win32-x64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.9.9",
+  "version": "0.9.92",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/patches/vsp-bas-proxy-auth.patch

@@ -1,5 +1,5 @@
 diff --git a/cmd/vsp/main.go b/cmd/vsp/main.go
-index 5007935..b2bc6be 100755
+index 5007935..715c0e9 100755
 --- a/cmd/vsp/main.go
 +++ b/cmd/vsp/main.go
 @@ -100,6 +100,7 @@ func init() {
@@ -10,7 +10,16 @@ index 5007935..b2bc6be 100755
  	rootCmd.Flags().StringVarP(&cfg.Username, "user", "u", "", "SAP username")
  	rootCmd.Flags().StringVarP(&cfg.Password, "password", "p", "", "SAP password")
  	rootCmd.Flags().StringVar(&cfg.Password, "pass", "", "SAP password (alias for --password)")
-@@ -170,6 +171,7 @@ func init() {
+@@ -126,6 +127,8 @@ func init() {
+ 	rootCmd.Flags().String("sso-profile", "", "Browser profile directory for SSO (a Windows path when running under WSL)")
+ 	rootCmd.Flags().String("sso-helper", "", "Path to the Windows SSO capture helper (vsp-sso.exe), used under WSL")
+ 	rootCmd.Flags().String("sso-on-expiry", "window", "When a silent SSO refresh needs a human: 'window' opens a browser, 'error' reports what to run")
++	rootCmd.Flags().String("sso-first-login", "", "With no cached SSO session: 'window' signs in through a visible browser window at once (default: try silently first)")
++	rootCmd.Flags().String("sso-silent-timeout", "", "Budget for a silent SSO capture, as a Go duration (default 45s)")
+ 	rootCmd.Flags().Bool("saml-auth", false, "Authenticate via programmatic SAML SSO (no browser, no MFA)")
+ 	rootCmd.Flags().String("saml-user", "", "SAML/IAS username (email)")
+ 	rootCmd.Flags().String("saml-password", "", "SAML/IAS password")
+@@ -170,6 +173,7 @@ func init() {
  	rootCmd.PersistentFlags().BoolVarP(&cfg.Verbose, "verbose", "v", false, "Enable verbose output to stderr")
  
  	// Bind flags to viper for environment variable support
@@ -18,7 +27,16 @@ index 5007935..b2bc6be 100755
  	viper.BindPFlag("url", rootCmd.Flags().Lookup("url"))
  	viper.BindPFlag("user", rootCmd.Flags().Lookup("user"))
  	viper.BindPFlag("password", rootCmd.Flags().Lookup("password"))
-@@ -233,6 +235,9 @@ func runServer(cmd *cobra.Command, args []string) error {
+@@ -186,6 +190,8 @@ func init() {
+ 	viper.BindPFlag("sso-profile", rootCmd.Flags().Lookup("sso-profile"))
+ 	viper.BindPFlag("sso-helper", rootCmd.Flags().Lookup("sso-helper"))
+ 	viper.BindPFlag("sso-on-expiry", rootCmd.Flags().Lookup("sso-on-expiry"))
++	viper.BindPFlag("sso-first-login", rootCmd.Flags().Lookup("sso-first-login"))
++	viper.BindPFlag("sso-silent-timeout", rootCmd.Flags().Lookup("sso-silent-timeout"))
+ 	viper.BindPFlag("saml-auth", rootCmd.Flags().Lookup("saml-auth"))
+ 	viper.BindPFlag("saml-user", rootCmd.Flags().Lookup("saml-user"))
+ 	viper.BindPFlag("saml-password", rootCmd.Flags().Lookup("saml-password"))
+@@ -233,6 +239,9 @@ func runServer(cmd *cobra.Command, args []string) error {
  	}
  
  	// Browser-based SSO authentication (must run before processCookieAuth)
@@ -28,7 +46,7 @@ index 5007935..b2bc6be 100755
  	if err := processBrowserAuth(cmd); err != nil {
  		return err
  	}
-@@ -346,6 +351,7 @@ func runServer(cmd *cobra.Command, args []string) error {
+@@ -346,6 +355,7 @@ func runServer(cmd *cobra.Command, args []string) error {
  }
  
  func resolveConfig(cmd *cobra.Command) {
@@ -36,7 +54,7 @@ index 5007935..b2bc6be 100755
  	// Check if cookie auth is explicitly requested via CLI flags OR env vars
  	// If so, we should NOT load user/password from env/.env to avoid conflicts
  	// Cookie auth takes precedence over basic auth since it's more explicit
-@@ -530,6 +536,24 @@ func validateConfig() error {
+@@ -530,6 +540,24 @@ func validateConfig() error {
  	return nil
  }
  
@@ -61,7 +79,7 @@ index 5007935..b2bc6be 100755
  func processBrowserAuth(cmd *cobra.Command) error {
  	browserAuth, _ := cmd.Flags().GetBool("browser-auth")
  	if !browserAuth && !viper.GetBool("BROWSER_AUTH") {
-@@ -599,6 +623,9 @@ func ssoRequested(cmd *cobra.Command) bool {
+@@ -599,6 +627,9 @@ func ssoRequested(cmd *cobra.Command) bool {
  // days will outlive any session it starts with, and the point of the exercise
  // is that nobody has to notice when it does.
  func processSSOAuth(cmd *cobra.Command) error {
@@ -71,7 +89,45 @@ index 5007935..b2bc6be 100755
  	if !ssoRequested(cmd) {
  		return nil
  	}
-@@ -657,6 +684,9 @@ func processSSOAuth(cmd *cobra.Command) error {
+@@ -626,22 +657,27 @@ func processSSOAuth(cmd *cobra.Command) error {
+ 	}
+ 
+ 	onExpiry := stringOpt("sso-on-expiry", "SSO_ON_EXPIRY")
++	silentTimeout, err := parseOptionalDuration(stringOpt("sso-silent-timeout", "SSO_SILENT_TIMEOUT"), "--sso-silent-timeout")
++	if err != nil {
++		return err
++	}
+ 	provider, err := adt.NewSSOProvider(adt.SSOConfig{
+-		System:      stringOpt("sso-system", "SSO_SYSTEM"),
+-		BaseURL:     cfg.BaseURL,
+-		Client:      cfg.Client,
+-		TriggerURL:  stringOpt("sso-trigger-url", "SSO_TRIGGER_URL"),
+-		Profile:     stringOpt("sso-profile", "SSO_PROFILE"),
+-		HelperPath:  stringOpt("sso-helper", "SSO_HELPER"),
+-		Interactive: !strings.EqualFold(onExpiry, "error"),
+-		Insecure:    cfg.InsecureSkipVerify,
+-		Verbose:     cfg.Verbose,
++		System:        stringOpt("sso-system", "SSO_SYSTEM"),
++		BaseURL:       cfg.BaseURL,
++		Client:        cfg.Client,
++		TriggerURL:    stringOpt("sso-trigger-url", "SSO_TRIGGER_URL"),
++		Profile:       stringOpt("sso-profile", "SSO_PROFILE"),
++		HelperPath:    stringOpt("sso-helper", "SSO_HELPER"),
++		Interactive:   !strings.EqualFold(onExpiry, "error"),
++		SilentTimeout: silentTimeout,
++		Insecure:      cfg.InsecureSkipVerify,
++		Verbose:       cfg.Verbose,
+ 	})
+ 	if err != nil {
+ 		return err
+ 	}
+ 
+-	cookies, err := provider.Cookies(cmd.Context())
++	cookies, err := provider.Start(cmd.Context(), strings.EqualFold(stringOpt("sso-first-login", "SSO_FIRST_LOGIN"), "window"))
+ 	if err != nil {
+ 		return fmt.Errorf("browser SSO: %w", err)
+ 	}
+@@ -657,6 +693,9 @@ func processSSOAuth(cmd *cobra.Command) error {
  }
  
  func processSAMLAuth(cmd *cobra.Command) error {
@@ -81,7 +137,7 @@ index 5007935..b2bc6be 100755
  	samlAuth, _ := cmd.Flags().GetBool("saml-auth")
  	if !samlAuth && !viper.GetBool("SAML_AUTH") {
  		return nil
-@@ -752,6 +782,9 @@ func processSAMLAuth(cmd *cobra.Command) error {
+@@ -752,6 +791,9 @@ func processSAMLAuth(cmd *cobra.Command) error {
  }
  
  func processCookieAuth(cmd *cobra.Command) error {
@@ -492,3 +548,146 @@ index 0000000..80741da
 +	}
 +}
 +
+diff --git a/pkg/adt/sso.go b/pkg/adt/sso.go
+index d67c4e8..4e9dc45 100644
+--- a/pkg/adt/sso.go
++++ b/pkg/adt/sso.go
+@@ -155,7 +155,7 @@ func CaptureSSOCookies(ctx context.Context, opts SSOOptions) (map[string]string,
+ 	// below is the real verdict.
+ 	if err := chromedp.Run(timeoutCtx, chromedp.Navigate(opts.TriggerURL)); err != nil {
+ 		if timeoutCtx.Err() != nil {
+-			return nil, fmt.Errorf("SSO capture timed out after %s", timeout)
++			return nil, navigationTimeout(opts.Headless, timeout)
+ 		}
+ 		if opts.Verbose {
+ 			fmt.Fprintf(os.Stderr, "[SSO] navigation reported %v (normal during SSO)\n", err)
+@@ -174,6 +174,17 @@ func CaptureSSOCookies(ctx context.Context, opts SSOOptions) (map[string]string,
+ 	return cookies, nil
+ }
+ 
++// navigationTimeout explains a first page that never finished loading. In a
++// silent browser that page is waiting on a person — a smart-card certificate
++// picker or a login prompt headless mode cannot show — so a visible window is
++// the next step, not a failed start.
++func navigationTimeout(headless bool, timeout time.Duration) error {
++	if headless {
++		return fmt.Errorf("%w: the silent sign-in page did not finish loading within %s", ErrSSOInteractiveRequired, timeout)
++	}
++	return fmt.Errorf("SSO capture timed out after %s", timeout)
++}
++
+ // DefaultSSOProfileDir returns a per-host browser profile directory under the
+ // user's cache location. Keeping one profile per host means a silent refresh
+ // for one system is never disturbed by a login to another.
+diff --git a/pkg/adt/sso_first_login_test.go b/pkg/adt/sso_first_login_test.go
+new file mode 100644
+index 0000000..f8efda4
+--- /dev/null
++++ b/pkg/adt/sso_first_login_test.go
+@@ -0,0 +1,52 @@
++package adt
++
++import (
++	"context"
++	"os"
++	"testing"
++)
++
++func TestStartWithWindowFirstReusesACachedSession(t *testing.T) {
++	t.Setenv("HOME", t.TempDir())
++	p, err := NewSSOProvider(SSOConfig{System: "devsys", BaseURL: "https://sap.example"})
++	if err != nil {
++		t.Fatal(err)
++	}
++	if err := SaveSSOSession(p.CachePath(), "sap.example", map[string]string{"SAP_SESSIONID_X": "live"}); err != nil {
++		t.Fatal(err)
++	}
++	// A browser launch here would fail the test on a build machine.
++	got, err := p.Start(context.Background(), true)
++	if err != nil {
++		t.Fatalf("Start: %v", err)
++	}
++	if got["SAP_SESSIONID_X"] != "live" {
++		t.Errorf("cookies = %v, want the cached session", got)
++	}
++}
++
++func TestHasSessionDecidesWhetherTheFirstSignInNeedsAWindow(t *testing.T) {
++	t.Setenv("HOME", t.TempDir())
++	p, err := NewSSOProvider(SSOConfig{System: "devsys", BaseURL: "https://sap.example"})
++	if err != nil {
++		t.Fatal(err)
++	}
++	if p.hasSession() {
++		t.Fatal("an empty cache must send the first sign-in to a window")
++	}
++	if err := SaveSSOSession(p.CachePath(), "sap.example", map[string]string{"SAP_SESSIONID_X": "live"}); err != nil {
++		t.Fatal(err)
++	}
++	if !p.hasSession() {
++		t.Fatal("a cached session must be reused, not replaced by a window")
++	}
++	if err := os.Remove(p.CachePath()); err != nil {
++		t.Fatal(err)
++	}
++	if err := os.Mkdir(p.CachePath(), 0700); err != nil {
++		t.Fatal(err)
++	}
++	if !p.hasSession() {
++		t.Fatal("an unreadable cache must reach Cookies, which reports the read error")
++	}
++}
+diff --git a/pkg/adt/sso_navigation_test.go b/pkg/adt/sso_navigation_test.go
+new file mode 100644
+index 0000000..c851021
+--- /dev/null
++++ b/pkg/adt/sso_navigation_test.go
+@@ -0,0 +1,16 @@
++package adt
++
++import (
++	"errors"
++	"testing"
++	"time"
++)
++
++func TestSilentNavigationTimeoutAsksForAPerson(t *testing.T) {
++	if err := navigationTimeout(true, time.Second); !errors.Is(err, ErrSSOInteractiveRequired) {
++		t.Fatalf("silent timeout = %v, want ErrSSOInteractiveRequired so a visible window opens", err)
++	}
++	if err := navigationTimeout(false, time.Second); errors.Is(err, ErrSSOInteractiveRequired) {
++		t.Fatalf("headed timeout = %v, must not ask for yet another window", err)
++	}
++}
+diff --git a/pkg/adt/sso_provider.go b/pkg/adt/sso_provider.go
+index 8e5bed4..6977a33 100644
+--- a/pkg/adt/sso_provider.go
++++ b/pkg/adt/sso_provider.go
+@@ -180,6 +180,27 @@ func (p *SSOProvider) Login(ctx context.Context) (map[string]string, error) {
+ 	return p.acquire(ctx, true)
+ }
+ 
++// Start returns the session a server begins with; windowFirst skips the silent attempt when nothing is cached.
++func (p *SSOProvider) Start(ctx context.Context, windowFirst bool) (map[string]string, error) {
++	if windowFirst && !p.hasSession() {
++		fmt.Fprintf(os.Stderr, "[SSO] no cached session — opening a browser window to sign in\n")
++		return p.Login(ctx)
++	}
++	return p.Cookies(ctx)
++}
++
++// hasSession counts an unreadable cache as present so Cookies can report why.
++func (p *SSOProvider) hasSession() bool {
++	p.mu.Lock()
++	held := len(p.current) > 0
++	p.mu.Unlock()
++	if held {
++		return true
++	}
++	sess, err := LoadSSOSession(p.cachePath)
++	return err != nil || sess != nil
++}
++
+ // Clear removes the cached session, so the next call captures a fresh one.
+ func (p *SSOProvider) Clear() error {
+ 	p.mu.Lock()

package/src/launcher.mjs

@@ -222,7 +222,14 @@ async function rememberAdtUrl(configured, found) {
 // swept only when the configuration never named one.
 async function resolveLocalAdtUrl(name, configured, client) {
   const log = message => logLine(`[sap-ai-dev] ${name}: ${message}`);
-  const detect = target => detectLocalAdtUrl({ client, ...target }).catch(error => ({ url: '', reason: error.message, failed: true }));
+  const detect = async target => {
+    const started = Date.now();
+    // MCP output channels cannot animate, so a long scan reports that it is still running.
+    const heartbeat = setInterval(() => log(`port scan still running on ${new URL(target.url).hostname} (${Math.round((Date.now() - started) / 1000)} s)`), 20_000);
+    try { return await detectLocalAdtUrl({ client, ...target }); }
+    catch (error) { return { url: '', reason: error.message, failed: true }; }
+    finally { clearInterval(heartbeat); }
+  };
   const explicit = hasExplicitPort(configured);
   let verdict = { url: '', reason: '' };
   if (explicit) {
@@ -302,7 +309,8 @@ async function configuredLocalSapGuiDestination(env) {
       systemId,
       authentication: 'SSO',
       // SAP_SAML_AUTH survives sanitizeChildEnv and would make VSP demand SAML credentials.
-      childEnv: { SAP_SSO: 'true', SAP_SSO_SYSTEM: cacheKey, SAP_SAML_AUTH: '', ...direct },
+      // A first sign-in has no session a hidden browser could renew, so its window opens at once.
+      childEnv: { SAP_SSO: 'true', SAP_SSO_SYSTEM: cacheKey, SAP_SAML_AUTH: '', SAP_SSO_FIRST_LOGIN: env.SAP_SSO_FIRST_LOGIN || 'window', SAP_SSO_SILENT_TIMEOUT: env.SAP_SSO_SILENT_TIMEOUT || '15s', ...direct },
       probe
     };
   }
@@ -401,12 +409,14 @@ async function main() {
   }
 
   if (['cloud-foundry', 'sap-gui-local'].includes(runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE)) {
+    logLine(`[sap-ai-dev] sap-ai-dev-toolkit v${pkg.version} (node ${process.version}, pid ${process.pid})`);
     const destination = runtimeEnv.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'cloud-foundry'
       ? await resolveConfiguredCloudFoundryDestination({ env: runtimeEnv })
       : await configuredLocalSapGuiDestination(runtimeEnv);
     let proxy;
     try {
       const binary = await binaryOrError();
+      logLine(`[sap-ai-dev] VSP binary: ${binary}`);
       proxy = new MCPProxy({ binary, destinations: [destination], env: runtimeEnv, log: logLine, version: pkg.version });
       const shutdown = signal => { void proxy.close().finally(() => process.exit(signal === 'SIGINT' ? 130 : 143)); };
       process.once('SIGINT', () => shutdown('SIGINT'));

package/src/local-sap-gui.mjs

@@ -461,8 +461,10 @@ export function adtVerdict(result, protocol = 'https:') {
 }
 
 // A portless URL means 443, which on-premise ICMs rarely serve; VSP's `detect`
-// probes the conventional ADT ports and reports which one answers.
-export async function detectAdtUrl(binary, { url, client, instance, env = process.env, exhaustive = false, ports = [], timeoutMs = 180_000 } = {}) {
+// probes the conventional ADT ports and reports which one answers. A host that
+// accepts every port makes each probe wait out its HTTP timeouts, so the full
+// sweep gets minutes.
+export async function detectAdtUrl(binary, { url, client, instance, env = process.env, exhaustive = false, ports = [], timeoutMs = exhaustive ? 600_000 : 120_000 } = {}) {
   let configured;
   try { configured = new URL(url); } catch { return { url: '', reason: `${url} is not a valid URL` }; }
   const host = configured.hostname.replace(/^\[(.*)\]$/, '$1');

package/src/mcp-proxy.mjs

@@ -387,7 +387,7 @@ class Child {
 }
 
 export class MCPProxy {
-  constructor({ binary, destinations, env = process.env, spawn = nodeSpawn, childArgs, log = message => console.error(message), output = line => process.stdout.write(`${line}\n`), version = '0.0.0' }) {
+  constructor({ binary, destinations, env = process.env, spawn = nodeSpawn, childArgs, log = message => console.error(message), output = line => process.stdout.write(`${line}\n`), version = '0.0.0', ssoHeartbeatMs = 15_000 }) {
     this.binary = binary;
     this.destinations = destinations;
     this.env = env;
@@ -396,6 +396,7 @@ export class MCPProxy {
     this.log = log;
     this.output = output;
     this.version = version;
+    this.ssoHeartbeatMs = ssoHeartbeatMs;
     this.requestTimeoutMs = requestTimeoutMs(env);
     this.children = [];
     this.started = false;
@@ -532,8 +533,12 @@ export class MCPProxy {
     const initialized = await Promise.all(this.children.map(async entry => {
       const startedAt = Date.now();
       this.eventSink(`[${entry.destination.name}] initializing VSP MCP session`);
+      // VSP answers initialize only after its browser sign-in, which waits on a person.
+      const signIn = entry.destination.authentication === 'SSO'
+        ? setInterval(() => this.eventSink(`[${entry.destination.name}] still waiting for the SSO sign-in (${Math.round((Date.now() - startedAt) / 1000)} s): finish it in the browser window (it may be behind other windows); restarting the server cancels it`), this.ssoHeartbeatMs)
+        : undefined;
       try {
-        entry.server = await entry.child.initialize(params);
+        entry.server = await entry.child.initialize(params).finally(() => clearInterval(signIn));
         this.eventSink(`[${entry.destination.name}] VSP MCP session initialized (${Date.now() - startedAt}ms)`);
         return entry;
       } catch (error) {

package/src/setup.mjs

@@ -141,30 +141,42 @@ export function adtCandidate(answer, baseUrl) {
 // Cheapest evidence first: named ports get one probe, then the host's usual
 // ports, then the message server's application servers, then every port.
 async function findAdtUrl(destination, label, client, { candidates = [], scan = true, output = stdout, env = process.env, detectAdtUrl } = {}) {
-  const detect = async (message, target) => {
-    print(output, formatStatus(message, 'progress', output, 'ADT'));
-    const stopProgress = startProgress(message, { output, env, label: 'ADT' });
+  const detect = async (line, activity, target) => {
+    print(output, formatStatus(line, 'progress', output, 'ADT'));
+    const started = Date.now();
+    const progress = startProgress(activity, { output, env, label: 'ADT' });
+    // A short, ticking spinner: a long line would truncate the animation away and look frozen.
+    const ticker = setInterval(() => progress.update(`${activity} (${Math.round((Date.now() - started) / 1000)} s)`), 1000);
     try { return await detectAdtUrl({ client, ...target }); }
     catch (error) { return { url: '', reason: error.message }; }
-    finally { stopProgress(); }
+    finally {
+      clearInterval(ticker);
+      progress();
+    }
   };
   let verdict = { url: '', reason: `no port was checked for ${label}` };
   for (const candidate of [...new Set([destination.url, ...candidates].filter(url => url && hasExplicitPort(url)))]) {
-    verdict = await detect(`Checking ADT at ${candidate}`, { url: candidate, ports: [adtPort(candidate)] });
+    verdict = await detect(`Checking ADT at ${candidate}`, `Checking ${candidate}`, { url: candidate, ports: [adtPort(candidate)] });
     if (verdict.url || verdict.unresolved) return verdict;
   }
   if (!scan) return verdict;
   const host = new URL(destination.url).hostname;
-  verdict = await detect(`Port scan in progress on ${host} to find the ADT port for ${label}`, { url: destination.url, ...(destination.instance ? { instance: destination.instance } : {}) });
+  verdict = await detect(`Port scan in progress on ${host} to find the ADT port for ${label}`, `Scanning the usual ADT ports on ${host}`, { url: destination.url, ...(destination.instance ? { instance: destination.instance } : {}) });
   if (verdict.url || verdict.unresolved) return verdict;
   if (destination.messageServer) {
-    print(output, formatStatus(`Asking the message server ${destination.messageServer.host}:${destination.messageServer.httpPort} for the application servers of ${label}`, 'progress', output, 'ADT'));
-    for (const server of (await messageServerAppServers({ ...destination.messageServer, systemId: destination.systemId })).slice(0, 3)) {
-      const found = await detect(`Port scan in progress on application server ${server.host} (instance ${server.instance})`, { url: `${new URL(destination.url).protocol}//${server.host}`, instance: server.instance });
+    const { host: messageHost, httpPort } = destination.messageServer;
+    print(output, formatStatus(`Asking the message server ${messageHost}:${httpPort} for the application servers of ${label}`, 'progress', output, 'ADT'));
+    const servers = (await messageServerAppServers({ ...destination.messageServer, systemId: destination.systemId })).slice(0, 3);
+    print(output, formatStatus(servers.length
+      ? `The message server lists ${servers.map(server => `${server.host} (instance ${server.instance})`).join(', ')}.`
+      : `The message server at ${messageHost}:${httpPort} listed no application servers.`, 'info', output, 'ADT'));
+    for (const server of servers) {
+      const found = await detect(`Port scan in progress on application server ${server.host} (instance ${server.instance})`, `Scanning ${server.host}`, { url: `${new URL(destination.url).protocol}//${server.host}`, instance: server.instance });
       if (found.url) return found;
     }
   }
-  return detect(`No ADT port on the usual ports for ${label} (${verdict.reason}); port scan in progress on every conventional SAP port of ${host} (this can take a minute)`, { url: destination.url, exhaustive: true });
+  print(output, formatStatus(`No ADT port on the usual ports for ${label}: ${verdict.reason}.`, 'info', output, 'ADT'));
+  return detect(`Scanning the remaining conventional SAP ports on ${host} (about 300 ports; this can take a few minutes)`, `Scanning the remaining SAP ports on ${host}`, { url: destination.url, exhaustive: true });
 }
 
 // An SSO sign-in can only start where ADT answers, so for SSO setup does not