sap-ai-dev-toolkit 0.9.94 → 0.9.9903

package/src/mcp-proxy.mjs

@@ -45,10 +45,13 @@ const APPLICATION_LOG_DESCRIPTION = 'Read SAP application log (SLG1) entries. Re
 const NON_RETRIABLE_VSP_TOOLS = new Set([
   'Activate',
   'ActivateMultiple',
+  'CreateObject',
   'CreateTransport',
   'EditSource',
   'LockObject',
+  'PublishServiceBinding',
   'UnlockObject',
+  'UnpublishServiceBinding',
   'WriteSource'
 ]);
 
@@ -68,12 +71,13 @@ function requestTimeoutMs(env) {
 }
 
 
-// Keep the default public VSP surface small enough for developer-lifecycle use.
+// Keep the default public tool surface small enough for developer-lifecycle use.
 // Hidden upstream tools can still be used by local workflow tools when needed.
 export const PUBLIC_VSP_TOOLS = new Set([
   'Activate',
   'ActivateMultiple',
   'CompareSource',
+  'CreateObject',
   'CreateTransport',
   'DebuggerAttach',
   'DebuggerDetach',
@@ -116,13 +120,19 @@ export const PUBLIC_VSP_TOOLS = new Set([
   'ListTransports',
   'LockObject',
   'PrettyPrint',
+  'PublishServiceBinding',
   'RunATCCheck',
   'RunQuery',
   'RunUnitTests',
   'SearchObject',
   'SetBreakpoint',
   'SyntaxCheck',
+  // UI5 write tools stay hidden: the ADT filestore is read-only.
+  'UI5GetApp',
+  'UI5GetFileContent',
+  'UI5ListApps',
   'UnlockObject',
+  'UnpublishServiceBinding',
   'WriteSource'
 ]);
 
@@ -175,7 +185,7 @@ function useProxyAuthentication(destination) {
 function childEnvironment(destination, env) {
   const childEnv = { ...sanitizeChildEnv(env), ...(destination.childEnv || {}) };
   if (useProxyAuthentication(destination)) {
-    // VSP loads SAP_* values from local .env files. Set every supported local
+    // The runtime loads SAP_* values from local .env files. Set every supported local
     // auth variable explicitly empty so dotenv cannot supply a fallback
     // identity or session instead of the selected BAS destination identity.
     for (const key of [
@@ -200,7 +210,7 @@ export function childArguments(destination, env = process.env) {
 
 // Windows cannot exec a .js/.mjs file directly (no shebang support), so test
 // fixtures written in JavaScript are launched through the current Node binary.
-// The production VSP binary is a native executable and is unaffected; a
+// The production runtime executable is native and unaffected; a
 // Windows .cmd/.bat override needs cmd /c because Node refuses to spawn
 // batch files directly (EINVAL since the CVE-2024-27980 hardening).
 function spawnCommand(binary) {
@@ -237,16 +247,16 @@ class Child {
     // Without a listener that is an uncaught exception that kills the whole
     // MCP server — exactly the crash window self-healing is meant to cover.
     this.process.stdin.on('error', error => {
-      if (!this.closing && this.options.log) this.options.log(`[${destination.name}] VSP child stdin error: ${diagnosticText(error.message)}`);
+      if (!this.closing && this.options.log) this.options.log(`[${destination.name}] runtime process stdin error: ${diagnosticText(error.message)}`);
       this.fail(new Error(`child stdin failed: ${error.message}`));
     });
     this.process.on('error', error => {
-      if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] VSP child process error: ${diagnosticText(error.message)}`);
+      if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] runtime process error: ${diagnosticText(error.message)}`);
       this.fail(error);
       void closeDestinationRoute(destination);
     });
     this.process.on('exit', (code, signal) => {
-      if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] VSP child exited (${code ?? signal})`);
+      if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] runtime process exited (${code ?? signal})`);
       this.fail(new Error(`child exited (${code ?? signal})`));
       void closeDestinationRoute(destination);
     });
@@ -327,7 +337,7 @@ class Child {
     try { this.process.stdin.write(`${JSON.stringify({ jsonrpc: JSONRPC, method, ...(params === undefined ? {} : { params })})}\n`); } catch {}
   }
 
-  // VSP's own "Error:" line explains an exit, and stderr can still be draining when 'exit' fires.
+  // The runtime's own "Error:" line explains an exit, and stderr can still be draining when 'exit' fires.
   async stopReason(waitMs = 1000) {
     let timer;
     await Promise.race([this.stderrClosed, new Promise(resolve => { timer = setTimeout(resolve, waitMs); })]);
@@ -352,7 +362,7 @@ class Child {
     return tools;
   }
 
-  // The VSP tool surface is fixed for the process lifetime (--mode is a
+  // The runtime tool surface is fixed for the process lifetime (--mode is a
   // launch argument), so listings are memoized per child. The memo is
   // cleared on failure, on child exit, and on upstream list_changed.
   listToolsCached() {
@@ -465,7 +475,7 @@ export class MCPProxy {
       // keeping serverInfo's children[0] fallback and merged slug numbering deterministic.
       const started = await Promise.all(this.destinations.map(destination => (async () => {
         try {
-          this.eventSink(`[${destination.name}] starting VSP child (client=${destination.client || '001'})`);
+          this.eventSink(`[${destination.name}] starting runtime process (client=${destination.client || '001'})`);
           return {
             destination,
             child: new Child(this.binary, destination, this.childSpawnOptions(destination))
@@ -491,7 +501,7 @@ export class MCPProxy {
     return this;
   }
 
-  // Self-healing mode 3: transparently restart a crashed VSP child so an
+  // Self-healing mode 3: transparently restart a crashed child so an
   // MCP tools/call does not permanently fail after a single crash. The
   // restarted child re-initializes and re-registers tools before the call
   // is retried once. Concurrent triggers share one restart (no orphaned
@@ -505,11 +515,11 @@ export class MCPProxy {
     const now = Date.now();
     state.timestamps = state.timestamps.filter(at => now - at < RESTART_WINDOW_MS);
     if (state.timestamps.length >= MAX_RESTARTS_PER_WINDOW) {
-      throw new Error(`VSP child restart budget exhausted (${MAX_RESTARTS_PER_WINDOW} in ${RESTART_WINDOW_MS / 1000}s); surfacing the failure instead of respawning`);
+      throw new Error(`Runtime process restart budget exhausted (${MAX_RESTARTS_PER_WINDOW} in ${RESTART_WINDOW_MS / 1000}s); surfacing the failure instead of respawning`);
     }
     state.inFlight = (async () => {
       const name = entry.destination.name;
-      this.eventSink(`[${name}] VSP child crashed; self-healing restart in progress`, 'warning');
+      this.eventSink(`[${name}] runtime process crashed; self-healing restart in progress`, 'warning');
       try {
         await entry.child.close().catch(() => {});
         const child = new Child(this.binary, entry.destination, this.childSpawnOptions(entry.destination));
@@ -518,7 +528,7 @@ export class MCPProxy {
         this.toolsCache = null;
         await child.listToolsCached().catch(() => {});
         state.timestamps.push(Date.now());
-        this.eventSink(`[${name}] VSP child self-healing restart complete`);
+        this.eventSink(`[${name}] runtime process self-healing restart complete`);
         this.emitToolsListChanged();
         return entry;
       } finally {
@@ -544,16 +554,16 @@ export class MCPProxy {
     const initialized = await Promise.all(this.children.map(async entry => {
       const { destination } = entry;
       const startedAt = Date.now();
-      this.eventSink(`[${destination.name}] initializing VSP MCP session`);
+      this.eventSink(`[${destination.name}] initializing runtime MCP session`);
       for (let attempt = 1; ; attempt += 1) {
         const attemptStartedAt = Date.now();
-        // VSP answers initialize only after its browser sign-in, which waits on a person.
+        // The runtime answers initialize only after browser sign-in, which waits on a person.
         const signIn = destination.authentication === 'SSO'
           ? setInterval(() => this.eventSink(`[${destination.name}] still waiting for the SSO sign-in (${Math.round((Date.now() - attemptStartedAt) / 1000)} s): finish it in the browser window (it may be behind other windows); restarting the server cancels it`), this.ssoHeartbeatMs)
           : undefined;
         try {
           entry.server = await entry.child.initialize(params).finally(() => clearInterval(signIn));
-          this.eventSink(`[${destination.name}] VSP MCP session initialized (${Date.now() - startedAt}ms)`);
+          this.eventSink(`[${destination.name}] runtime MCP session initialized (${Date.now() - startedAt}ms)`);
           return entry;
         } catch (error) {
           const reason = await entry.child.stopReason();

package/src/setup.mjs

@@ -705,6 +705,7 @@ export async function runSetup({
     return { skipped: true, reason: 'no-destinations', warnings: [...warnings, ...cleanupWarnings] };
   };
   let selected;
+  let additiveSetup = false;
   if (!selectable.length) {
     // Nothing was detected — no BAS/CF destinations, or no SAP GUI entries.
     // Offer the manual MCP entry wizard before giving up.
@@ -721,9 +722,11 @@ export async function runSetup({
     }, { input, output });
     if (choice !== 'manual') return await exitWithoutDestinations();
     selected = await runManualEntryWizard({ env, input, output, detectAdtUrl });
+    additiveSetup = true;
     if (!selected.length) return await exitWithoutDestinations();
   } else {
     selected = await chooseDiscoveredDestinations(destinations, { isBas, input, output, env, detectAdtUrl, previousAdtUrls });
+    additiveSetup = selected.length > 0;
   }
 
   let sapDevelopmentServers = [];
@@ -746,7 +749,7 @@ export async function runSetup({
   }
 
   try {
-    const result = await install(selected, { env, sapDevelopmentServers });
+    const result = await install(selected, { env, sapDevelopmentServers, additive: additiveSetup });
     const location = result?.path ? ` in ${result.path}` : '';
     print(output, '');
     const configuredCount = selected.length + sapDevelopmentServers.length;

package/src/sso-browsers.mjs

@@ -59,7 +59,7 @@ async function fileExists(path) {
   }
 }
 
-// Every Chromium-based browser VSP can drive, best first; SAP_BROWSER_EXEC pins one ahead of the rest.
+// Every Chromium-based browser the runtime can drive, best first; SAP_BROWSER_EXEC pins one ahead of the rest.
 export async function findSsoBrowsers({ env = process.env, platform = process.platform, exists = fileExists, appPaths = registeredAppPaths } = {}) {
   const candidates = [];
   const pinned = envValue(env, 'SAP_BROWSER_EXEC');

package/src/terminal-ui.mjs

@@ -274,17 +274,19 @@ export async function checkboxPrompt({ message, choices: initialChoices, require
   const render = (error = '') => {
     const columns = Number.isFinite(output?.columns) ? output.columns : 80;
     const indexes = visibleIndexes();
+    const fixedLines = 1 + (searchable ? 1 : 0) + (Object.hasOwn(actions, 'm') ? 1 : 0) + footer().length;
     const pageSize = searchable
-      ? Math.max(1, checkboxPageSize(output, indexes.length + 1) - 1)
+      ? Math.max(1, Math.min(indexes.length, (Number.isFinite(output?.rows) ? output.rows : 24) - fixedLines - 7))
       : checkboxPageSize(output, indexes.length);
     const cursorPosition = indexes.indexOf(cursor);
     ensureVisible(pageSize, indexes.length, cursorPosition);
     const lines = [];
     lines.push(truncateToColumns(`${message} (Space: select, ${shortcuts?.all || 'a'}: toggle all, Enter: confirm)`, columns));
     if (searchable) {
-      const hint = searchQuery ? 'Backspace edits; Esc clears' : 'type prefix; / before a or m';
+      const hint = searchQuery ? 'Backspace edits; Esc clears' : 'type prefix to search';
       lines.push(truncateToColumns(`Search: ${searchQuery || 'type prefix'} (${hint})`, columns));
     }
+    if (Object.hasOwn(actions, 'm')) lines.push(truncateToColumns('m: add system manually', columns));
     const end = Math.min(indexes.length, top + pageSize);
     for (let index = top; index < end; index += 1) {
       const choiceIndex = indexes[index];
@@ -505,7 +507,7 @@ export async function textPrompt({ message, secret = false, required = true, pla
 }
 
 // Animated progress line for long-running steps (destination discovery,
-// ADT probes, VSP binary provisioning). TTY outputs get spinner frames on an
+// ADT probes, runtime provisioning). TTY outputs get spinner frames on an
 // unref'd timer that starts after a short delay, so steps that finish quickly
 // never flash anything. Non-TTY outputs (pipes, MCP hosts, --json callers,
 // CI) stay completely silent so machine consumers never see progress noise.

package/tools.md

@@ -1,16 +1,17 @@
-# Curated VSP tools exposed through the BAS proxy
+# Curated SAP tools exposed through the BAS proxy
 
-The proxy no longer advertises every VSP tool. To keep the developer-lifecycle MCP surface manageable, each generated one-destination server exposes a cherry-picked set of VSP tools plus local workflow tools (currently 61 tools when all curated VSP capabilities are registered).
+The proxy no longer advertises every tool provided by the SAP runtime. To keep the developer-lifecycle MCP surface manageable, each generated one-destination server exposes a curated set of upstream tools plus local workflow tools (currently 67 tools when all upstream capabilities are registered).
 
 The names below are the logical tool names. Publicly they are exposed in lowercase snake_case without a prefix (`get_table_contents`, `run_query`) because each generated MCP server is scoped to one destination; only when a single server fronts multiple destinations does each name gain its destination slug (`demo-abap_get_table_contents`) to stay unambiguous. BAS/VS Code chat tool references bind only lowercase identifiers, so mixed-case names never reach the model.
 
-Hidden upstream VSP tools are not directly callable through the proxy. Local workflow tools may still call hidden or non-advertised upstream operations internally when they are required for a bounded workflow.
+Hidden upstream tools are not directly callable through the proxy. Local workflow tools may still call hidden or non-advertised operations internally when they are required for a bounded workflow.
 
-## Public VSP tools
+## Public upstream tools
 
 - `Activate`
 - `ActivateMultiple`
 - `CompareSource`
+- `CreateObject`
 - `CreateTransport`
 - `DebuggerAttach`
 - `DebuggerDetach`
@@ -53,22 +54,27 @@ Hidden upstream VSP tools are not directly callable through the proxy. Local wor
 - `ListTransports`
 - `LockObject`
 - `PrettyPrint`
+- `PublishServiceBinding`
 - `RunATCCheck`
 - `RunQuery`
 - `RunUnitTests`
 - `SearchObject`
 - `SetBreakpoint`
 - `SyntaxCheck`
+- `UI5GetApp`
+- `UI5GetFileContent`
+- `UI5ListApps`
 - `UnlockObject`
+- `UnpublishServiceBinding`
 - `WriteSource`
 
 ## Hidden from direct proxy calls
 
-Broad/destructive surfaces such as object deletion, SQL trace, arbitrary SAP router calls, transport release/delete, RFC execution, debugger listen/delete-breakpoint helpers, and one-off generator/update helpers are intentionally not advertised by the BAS proxy.
+Broad/destructive surfaces such as object deletion, SQL trace, arbitrary SAP router calls, transport release/delete, RFC execution, debugger listen/delete-breakpoint helpers, and one-off generator/update helpers are intentionally not advertised by the BAS proxy. UI5 repository writes are hidden too: the ADT filestore only reads UI5 apps, so deploy them with SAP Fiori tools instead.
 
 ## Destination-scoped workflow tools
 
-The proxy adds local multi-step tools to each destination when their required VSP capabilities are available. Like the VSP tools above, they are exposed publicly in lowercase snake_case (`lint_abap`, `get_application_log`, `prepare_abap_change_set`, and so on):
+The proxy adds local multi-step tools to each destination when their required upstream capabilities are available. Like the upstream tools above, they are exposed publicly in lowercase snake_case (`lint_abap`, `get_application_log`, `prepare_abap_change_set`, and so on):
 
 - `LintABAP` — local in-memory ABAP linting.
 - `GetApplicationLog` — bounded convenience mapping to the upstream SAP application-log route when available.
@@ -77,16 +83,16 @@ The proxy adds local multi-step tools to each destination when their required VS
 - `PlanABAPCloudMigration` — batch SAP API release-state checks and prioritize recognized unreleased results.
 - `GenerateRAPRegressionSuite` and `RunRAPRegressionSuite` — create and run reusable OData GET-only checks under the selected service root.
 
-`sap-ai-dev --doctor` checks destination probing, VSP startup, the `get_system_info` probe, and MCP tool listing. `sap-ai-dev --demo` runs the sample tools and OData fixtures without contacting SAP; demo writes and transport creation remain in memory until that process exits.
+`sap-ai-dev --doctor` checks destination probing, runtime startup, the `get_system_info` probe, and MCP tool listing. `sap-ai-dev --demo` runs the sample tools and OData fixtures without contacting SAP; demo writes and transport creation remain in memory until that process exits.
 
 
 ### Request timeouts
 
-Calls forwarded to a VSP child time out after `SAP_AI_DEV_TOOLKIT_REQUEST_TIMEOUT_MS` (default 600000 ms; `0` disables). A stalled request fails with a timeout error; the child keeps running so unrelated in-flight requests are unaffected.
+Calls forwarded to the runtime process time out after `SAP_AI_DEV_TOOLKIT_REQUEST_TIMEOUT_MS` (default 600000 ms; `0` disables). A stalled request fails with a timeout error; the process keeps running so unrelated in-flight requests are unaffected.
 
 ## Separate optional HANA Cloud inspector
 
-The optional `hana-cloud-inspector` companion starts `sap-ai-hana` as a separate stdio MCP server. It does not use the VSP proxy, BAS destination prefix, or ABAP SQL `RunQuery`. When selected and configured with a dedicated read-only identity, it exposes:
+The optional `hana-cloud-inspector` companion starts `sap-ai-hana` as a separate stdio MCP server. It does not use the BAS proxy, destination prefix, or ABAP SQL `RunQuery`. When selected and configured with a dedicated read-only identity, it exposes:
 
 - `hana_connection_info` — verify the configured endpoint, service/binding, current user, schema, and TLS state without returning credentials.
 - `hana_list_objects` — list tables/views in the bound HDI schema, with a 200-object maximum.