sap-ai-dev-toolkit 0.9.97 → 0.9.9903

package/src/launcher.mjs

@@ -81,15 +81,15 @@ async function runDoctor(destinations) {
     checks.push(doctorRow('-', 'MCP config repair', 'failed', redactText(error.message || error).slice(0, 300)));
   }
   for (const destination of destinations) {
-    stopProgress.update(`Checking ${destination.name}: ADT probe, VSP startup, tools/list`);
+    stopProgress.update(`Checking ${destination.name}: ADT probe, runtime startup, tools/list`);
     const probe = destination.probe;
     const probeStatus = !probe || probe.status === 'skipped' ? 'skipped' : (probe.available === true ? 'passed' : 'failed');
     checks.push(doctorRow(destination.name, 'ADT probe', probeStatus, probe?.status || 'No BAS ADT probe was supplied; GetSystemInfo will check the route.'));
-    checks.push(doctorRow(destination.name, 'VSP binary', binary ? 'passed' : 'failed', binary ? 'installed' : binaryError));
+    checks.push(doctorRow(destination.name, 'Runtime executable', binary ? 'passed' : 'failed', binary ? 'installed' : binaryError));
     if (!binary) {
-      checks.push(doctorRow(destination.name, 'VSP MCP startup', 'skipped', 'The VSP binary is unavailable.'));
-      checks.push(doctorRow(destination.name, 'SAP system check', 'skipped', 'VSP MCP startup could not run.'));
-      checks.push(doctorRow(destination.name, 'MCP tools/list', 'skipped', 'VSP MCP startup could not run.'));
+      checks.push(doctorRow(destination.name, 'MCP startup', 'skipped', 'The runtime executable is unavailable.'));
+      checks.push(doctorRow(destination.name, 'SAP system check', 'skipped', 'MCP startup could not run.'));
+      checks.push(doctorRow(destination.name, 'MCP tools/list', 'skipped', 'MCP startup could not run.'));
       try { await destination.close?.(); } catch {}
       continue;
     }
@@ -98,7 +98,7 @@ async function runDoctor(destinations) {
       proxy.start();
       const initialized = await proxy.handle({ jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2024-11-05' } });
       if (initialized?.error) throw new Error(initialized.error.message || 'MCP initialization failed');
-      checks.push(doctorRow(destination.name, 'VSP MCP startup', 'passed', 'initialized'));
+      checks.push(doctorRow(destination.name, 'MCP startup', 'passed', 'initialized'));
       const listed = await proxy.handle({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} });
       if (listed?.error) throw new Error(listed.error.message || 'MCP tools/list failed');
       const tools = listed.result?.tools || [];
@@ -109,13 +109,13 @@ async function runDoctor(destinations) {
       const localSegments = new Set(['lint_abap', 'get_application_log', 'prepare_abap_change_set', 'apply_abap_change_set', 'check_transport_readiness', 'plan_abap_cloud_migration', 'generate_rap_regression_suite', 'run_rap_regression_suite']);
       const isUpstreamTool = tool => (tool.name.startsWith(toolPrefix) ? tool.name.slice(toolPrefix.length) : tool.name);
       const upstreamCount = tools.filter(tool => !localSegments.has(isUpstreamTool(tool))).length;
-      checks.push(doctorRow(destination.name, 'MCP tools/list', upstreamCount ? 'passed' : 'failed', `${upstreamCount} VSP tools and ${tools.length} total MCP tools returned; chat-picker binding is host-managed`));
+      checks.push(doctorRow(destination.name, 'MCP tools/list', upstreamCount ? 'passed' : 'failed', `${upstreamCount} upstream tools and ${tools.length} total MCP tools returned; chat-picker binding is host-managed`));
       const systemInfo = tools.find(tool => tool.name === 'get_system_info' || tool.name === `${toolPrefix}get_system_info`);
       const needsAdtUrl = destination.probe?.status === 'needs-adt-url';
       if (needsAdtUrl) {
         checks.push(doctorRow(destination.name, 'SAP system check', 'skipped', 'No ADT URL is configured for this SAP GUI system; run sap-ai-dev --setup to add one.'));
       } else if (!systemInfo) {
-        checks.push(doctorRow(destination.name, 'SAP system check', 'skipped', 'GetSystemInfo is not exposed by this VSP mode.'));
+        checks.push(doctorRow(destination.name, 'SAP system check', 'skipped', 'GetSystemInfo is not exposed by this runtime mode.'));
       } else {
         const inspected = await proxy.handle({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: systemInfo.name, arguments: {} } });
         const failed = inspected?.error || inspected?.result?.isError;
@@ -123,8 +123,8 @@ async function runDoctor(destinations) {
       }
     } catch (error) {
       const detail = redactText(error.message || error).slice(0, 300);
-      const initialized = checks.some(row => row.name === destination.name && row.stage === 'VSP MCP startup' && row.status === 'passed');
-      if (!initialized) checks.push(doctorRow(destination.name, 'VSP MCP startup', 'failed', detail));
+      const initialized = checks.some(row => row.name === destination.name && row.stage === 'MCP startup' && row.status === 'passed');
+      if (!initialized) checks.push(doctorRow(destination.name, 'MCP startup', 'failed', detail));
       else checks.push(doctorRow(destination.name, 'MCP tools/list', 'failed', detail));
       checks.push(doctorRow(destination.name, 'SAP system check', 'skipped', 'An earlier diagnostic step failed.'));
     } finally {
@@ -179,20 +179,20 @@ async function resolveBinary() {
   const notes = [];
   const found = await findBinary(pkg, { env: runtimeEnv, log: note => notes.push(note) });
   if (found) return found;
-  logLine(`[sap-ai-dev] ${notes.join('; ') || 'no VSP binary found'}; downloading a checksum-verified copy`);
+  logLine(`[sap-ai-dev] ${notes.join('; ') || 'no runtime executable found'}; downloading a checksum-verified copy`);
   try {
     const downloaded = await downloadBinary(pkg, { env: runtimeEnv });
-    logLine(`[sap-ai-dev] VSP binary installed at ${downloaded}`);
+    logLine(`[sap-ai-dev] runtime executable installed at ${downloaded}`);
     return downloaded;
   } catch (error) {
     notes.push(`download fallback failed: ${error.message}${error.cause?.code ? ` (${error.cause.code})` : ''}`);
   }
   const npxDirectory = root.match(/^(.*[\\/]_npx[\\/][^\\/]+)[\\/]node_modules[\\/]/)?.[1];
   throw new Error([
-    `VSP binary ${binaryTarget().asset} is unavailable for ${pkg.name}@${pkg.version}: ${notes.join('; ')}.`,
+    `Runtime executable ${binaryTarget().asset} is unavailable for ${pkg.name}@${pkg.version}: ${notes.join('; ')}.`,
     npxDirectory
-      ? `The npm package ships this binary, so an interrupted install or an antivirus quarantine usually removed it: delete ${npxDirectory} and restart the MCP server so npx reinstalls the package, or set SAP_AI_DEV_TOOLKIT_BINARY to a trusted patched VSP binary.`
-      : `Reinstall ${pkg.name} (a git checkout needs npm run build:vsp), check whether antivirus quarantined the binary, or set SAP_AI_DEV_TOOLKIT_BINARY to a trusted patched VSP binary.`
+      ? `The npm package ships this binary, so an interrupted install or an antivirus quarantine usually removed it: delete ${npxDirectory} and restart the MCP server so npx reinstalls the package, or set SAP_AI_DEV_TOOLKIT_BINARY to a trusted executable.`
+      : `Reinstall ${pkg.name} (a git checkout must build its bundled runtime executable first), check whether antivirus quarantined the executable, or set SAP_AI_DEV_TOOLKIT_BINARY to a trusted executable.`
   ].join(' '));
 }
 
@@ -322,7 +322,7 @@ async function configuredLocalSapGuiDestination(env) {
   const adt = (sso || !tlsServerNames.length) && !hasPathPrefix(configuredUrl)
     ? await resolveLocalAdtUrl(name, configuredUrl, client)
     : { url: configuredUrl };
-  // The scan reached ADT directly, so an env proxy the browser's PAC would bypass must not reroute VSP.
+  // The scan reached ADT directly, so an env proxy the browser's PAC would bypass must not reroute the runtime.
   const direct = adt.verified ? noProxyEnv(env, new URL(adt.url).hostname) : {};
   const probe = adt.verified === undefined
     ? { status: 'configured', available: true }
@@ -340,7 +340,7 @@ async function configuredLocalSapGuiDestination(env) {
       systemId,
       authentication: 'SSO',
       ssoBrowsers,
-      // SAP_SAML_AUTH survives sanitizeChildEnv and would make VSP demand SAML credentials.
+      // SAP_SAML_AUTH survives sanitizeChildEnv and would make the runtime demand SAML credentials.
       // A first sign-in has no session a hidden browser could renew, so its window opens at once.
       childEnv: { SAP_SSO: 'true', SAP_SSO_SYSTEM: cacheKey, SAP_SAML_AUTH: '', SAP_SSO_FIRST_LOGIN: env.SAP_SSO_FIRST_LOGIN || 'window', SAP_SSO_SILENT_TIMEOUT: env.SAP_SSO_SILENT_TIMEOUT || '15s', ...(ssoBrowsers.length ? { SAP_BROWSER_EXEC: ssoBrowsers[0].path } : {}), ...direct },
       probe
@@ -443,7 +443,7 @@ async function main() {
     let proxy;
     try {
       const binary = await binaryOrError();
-      logLine(`[sap-ai-dev] VSP binary: ${binary}`);
+      logLine(`[sap-ai-dev] runtime executable: ${binary}`);
       proxy = new MCPProxy({ binary, destinations: [destination], env: runtimeEnv, log: logLine, version: pkg.version });
       const shutdown = signal => { void proxy.close().finally(() => process.exit(signal === 'SIGINT' ? 130 : 143)); };
       process.once('SIGINT', () => shutdown('SIGINT'));
@@ -492,7 +492,7 @@ async function main() {
   }
   const binary = await binaryOrError();
   logLine(`[sap-ai-dev] sap-ai-dev-toolkit v${pkg.version} (node ${process.version}, pid ${process.pid})`);
-  logLine(`[sap-ai-dev] VSP binary: ${binary}`);
+  logLine(`[sap-ai-dev] runtime executable: ${binary}`);
   logLine(`[sap-ai-dev] starting MCP proxy for ${destinations.map(destination => `${destination.name} (client=${destination.client})`).join(', ')}`);
   const proxy = new MCPProxy({ binary, destinations, env: process.env, log: logLine, version: pkg.version });
   const shutdown = signal => { void proxy.close().finally(() => process.exit(signal === 'SIGINT' ? 130 : 143)); };

package/src/local-sap-gui.mjs

@@ -164,6 +164,8 @@ function normalizeRecord(record, sourcePath) {
     authentication: ssoHintFrom(record) ? 'Basic/SSO hint' : 'Basic',
     authMode: 'basic',
     ssoHint: ssoHintFrom(record),
+    ...(record.uuid ? { serviceId: text(record.uuid).toLowerCase() } : {}),
+    ...(record.msid ? { logonGroup: text(record.logongroup || record.server || record.group) } : {}),
     proxyType: 'Internet',
     landscapePath: sourcePath,
     probe: { status: 'needs-adt-url' }
@@ -175,30 +177,53 @@ function parseLandscapeXml(content, sourcePath) {
   // Comments must not turn deleted entries into selectable systems.
   content = content.replace(/<!--[\s\S]*?-->/g, '');
   const messageServers = new Map();
-  for (const match of content.matchAll(/<Messageserver\b([^>]*)>/gi)) {
+  for (const match of content.matchAll(/<Messageserver\b((?:[^>"']|"[^"]*"|'[^']*')*)>/gi)) {
     const record = attributes(match[1]);
-    if (record.uuid) messageServers.set(record.uuid, record);
+    if (record.uuid) messageServers.set(record.uuid.toLowerCase(), record);
   }
-  for (const match of content.matchAll(/<Service\b([^>]*)\/?>(?:\s*<\/Service>)?/gi)) {
+  const services = new Map();
+  for (const match of content.matchAll(/<Service\b((?:[^>"']|"[^"]*"|'[^']*')*)\/?>(?:\s*<\/Service>)?/gi)) {
     const record = attributes(match[1]);
-    if (record.msid) {
-      const messageServer = messageServers.get(record.msid);
-      // For load-balanced entries `server` is a logon group, not a host.
-      if (!messageServer?.host) continue;
-      record.server = messageServer.host;
-      record.msport = messageServer.port;
-    }
-    const normalized = normalizeRecord(record, sourcePath);
+    if (record.uuid) services.set(record.uuid.toLowerCase(), record);
+    const normalized = normalizeLandscapeService(record, messageServers, sourcePath);
     if (normalized) records.push(normalized);
   }
-  // SAP GUI for Java files may use generic Item/Connection elements.
-  for (const match of content.matchAll(/<(?:Item|Connection)\b([^>]*)\/?>(?:\s*<\/(?:Item|Connection)>)?/gi)) {
-    const normalized = normalizeRecord(attributes(match[1]), sourcePath);
+
+  // Workspace trees organize visibility, not service definitions. Items can
+  // point at shared services, so resolve those references across all groups.
+  const referencedServiceIds = new Set();
+  for (const match of content.matchAll(/<(?:Item|Reference)\b((?:[^>"']|"[^"]*"|'[^']*')*)\/?>(?:\s*<\/(?:Item|Reference)>)?/gi)) {
+    const item = attributes(match[1]);
+    const serviceId = text(item.serviceid || item.service_id || item.link || item.ref).replace(/^#/, '').toLowerCase();
+    const referenced = serviceId ? services.get(serviceId) : null;
+    if (serviceId && !referenced) continue;
+    const record = referenced ? { ...referenced, ...item } : item;
+    if (referenced) {
+      for (const key of ['server', 'host', 'applicationserver', 'messageserver', 'mshost', 'msid', 'systemid', 'sid', 'r3name', 'type', 'kind']) {
+        if (referenced[key] && !item[key]) record[key] = referenced[key];
+      }
+      // Emit an unaliased service only once even when multiple groups include it.
+      if (!(item.name || item.description || item.desc) && referencedServiceIds.has(serviceId)) continue;
+      referencedServiceIds.add(serviceId);
+    }
+    const normalized = normalizeLandscapeService(record, messageServers, sourcePath);
     if (normalized) records.push(normalized);
   }
   return records;
 }
 
+function normalizeLandscapeService(record, messageServers, sourcePath) {
+  if (record.msid) {
+    const messageServer = messageServers.get(record.msid.toLowerCase());
+    // For load-balanced entries `server` is a logon group, not a host.
+    if (!messageServer?.host) return null;
+    record.logongroup = record.logongroup || record.server || record.group;
+    record.server = messageServer.host;
+    record.msport = messageServer.port;
+  }
+  return normalizeRecord(record, sourcePath);
+}
+
 function parseSapLogonIni(content, sourcePath) {
   const sections = new Map();
   let section = '';
@@ -390,7 +415,7 @@ export async function discoverSapGuiSystems({ env = process.env, paths } = {}) {
   if (!systems.length && !paths) systems = await parseSapGuiCandidatePaths(await broadSelfHealingSapGuiCandidates(env));
   const seen = new Set();
   return systems.filter(system => {
-    const key = `${system.name}\0${system.host}\0${system.systemId}\0${system.instance}\0${system.client}`.toLowerCase();
+    const key = `${system.serviceId || ''}\0${system.logonGroup || ''}\0${system.name}\0${system.host}\0${system.systemId}\0${system.instance}\0${system.client}`.toLowerCase();
     if (seen.has(key)) return false;
     seen.add(key);
     return true;
@@ -412,7 +437,7 @@ export function hasExplicitPort(url) {
   return /^[a-z][a-z0-9+.-]*:\/\/[^/?#]*:\d+(?:[/?#]|$)/i.test(String(url || '').trim());
 }
 
-// VSP appends every ADT path to the base URL, so a pasted ADT path would double up.
+// The runtime appends every ADT path to the base URL, so a pasted ADT path would double up.
 export function adtBaseUrl(url) {
   return String(url || '').trim().replace(/[?#].*$/, '').replace(/\/sap\/bc\/adt(?:\/.*)?$/i, '').replace(/\/+$/, '');
 }
@@ -432,7 +457,7 @@ function adtRank(finding) {
   return (finding.secure ? 0 : 2) + (finding.status >= 300 && finding.status < 400 ? 1 : 0);
 }
 
-// Picks the ADT URL from VSP detect's JSON, or explains why there is none.
+// Picks the ADT URL from runtime detect JSON, or explains why there is none.
 export function adtVerdict(result, protocol = 'https:') {
   const findings = Array.isArray(result?.findings) ? result.findings.filter(Boolean) : [];
   const usable = findings
@@ -452,7 +477,7 @@ export function adtVerdict(result, protocol = 'https:') {
   if (inactive) return { url: '', reason: `SAP answers at ${inactive.url} but /sap/bc/adt is not active; ask basis to activate it in SICF` };
   const tls = findings.find(finding => finding.kind === 'tls-name-mismatch');
   if (tls && /certificate required|bad certificate/i.test(String(tls.detail))) {
-    return { url: '', reason: `port ${tls.port} demands a client certificate (smart card), which VSP cannot present` };
+    return { url: '', reason: `port ${tls.port} demands a client certificate (smart card), which the runtime cannot present` };
   }
   if (tls) return { url: '', reason: `port ${tls.port} presents a certificate ${tls.certHost ? `for ${tls.certHost}` : 'this machine does not trust'}${tls.detail ? ` (${tls.detail})` : ''}` };
   const open = findings.filter(finding => ['open', 'http'].includes(finding.kind)).map(finding => finding.port);
@@ -460,7 +485,7 @@ export function adtVerdict(result, protocol = 'https:') {
   return { url: '', reason: `no port answered on ${host}` };
 }
 
-// A portless URL means 443, which on-premise ICMs rarely serve; VSP's `detect`
+// A portless URL means 443, which on-premise ICMs rarely serve; runtime `detect`
 // probes the conventional ADT ports and reports which one answers. A host that
 // accepts every port makes each probe wait out its HTTP timeouts, so the full
 // sweep gets minutes.
@@ -484,10 +509,10 @@ export async function detectAdtUrl(binary, { url, client, instance, env = proces
   } catch (error) {
     const why = error.killed ? `timed out after ${Math.round(timeoutMs / 1000)} s` : (typeof error.code === 'string' ? error.code : `exit code ${error.code}`);
     const blocked = ['EACCES', 'EPERM', 'UNKNOWN'].includes(error.code) ? '; antivirus or application control may block it' : '';
-    return { url: '', reason: `VSP detect could not run (${why}) from ${binary}${blocked}` };
+    return { url: '', reason: `Runtime detect could not run (${why}) from ${binary}${blocked}` };
   }
   try { return adtVerdict(JSON.parse(stdout), configured.protocol); }
-  catch { return { url: '', reason: 'VSP detect returned unreadable output' }; }
+  catch { return { url: '', reason: 'Runtime detect returned unreadable output' }; }
 }
 
 // Application servers appear by their SM51 names, host_SID_NN.

package/src/mcp-config.mjs

@@ -166,8 +166,10 @@ function npxLaunchArgs(entry) {
   return null;
 }
 
-// The package version a PATH sap-ai-dev starts, found through npm's global
-// layouts (Unix bin symlink, Windows .cmd shim); null when the layout is unknown.
+// Resolves how generated destination entries launch the toolkit: the global
+// sap-ai-dev command when it is on PATH, otherwise the pinned package
+// through npx (routed through cmd /c on Windows) so entries written by a
+// pure `npx sap-ai-dev-toolkit --setup` run still start on every host.
 async function commandPackageVersion(command) {
   const target = await realpath(command).catch(() => command);
   for (const manifest of [join(dirname(dirname(target)), 'package.json'), join(dirname(command), 'node_modules', 'sap-ai-dev-toolkit', 'package.json')]) {
@@ -181,10 +183,6 @@ async function commandPackageVersion(command) {
   return null;
 }
 
-// Resolves how generated destination entries launch the toolkit: the global
-// sap-ai-dev command when it is on PATH and is this version, otherwise the
-// pinned package through npx (routed through cmd /c on Windows) so entries
-// written by a pure `npx sap-ai-dev-toolkit --setup` run still start on every host.
 async function resolveLauncherInstallCommand(env) {
   const resolved = await resolveMcpServerCommand(env);
   const selfVersion = await runningPackageVersion();
@@ -192,7 +190,6 @@ async function resolveLauncherInstallCommand(env) {
   if (resolved !== 'sap-ai-dev') {
     const installed = await commandPackageVersion(resolved);
     if (installed === null || !selfVersion || installed === selfVersion) return { command: resolved, args: null };
-    // A stale global install would keep starting the old launcher and VSP binary.
     warning = `${resolved} is sap-ai-dev-toolkit ${installed}, not ${selfVersion}; MCP entries start sap-ai-dev-toolkit@${selfVersion} through npx instead. Run "npm install -g sap-ai-dev-toolkit@${selfVersion}" to use the global command.`;
   }
   return { ...npxPackageLauncher(selfVersion), warning };
@@ -343,7 +340,7 @@ function isPackageLauncher(entry) {
     && hasPackage(npxArgs, legacyPackages);
   // Current launchers are treated as managed only when tagged by this add-on.
   // Some early bas-mcp-addon entries were not tagged with BAS_EXT, though, and
-  // leaving them behind keeps advertising the old full VSP surface (~159 tools).
+  // leaving them behind keeps advertising the old full child tool surface (~159 tools).
   return (entry?.BAS_EXT === 'true' && (currentCommand || currentNpxLauncher || legacyCommand || legacyNpxLauncher))
     || legacyCommand
     || legacyNpxLauncher;
@@ -591,6 +588,7 @@ export async function installMcpConfig(destinationsOrOptions, options = {}) {
     options = destinationsOrOptions || {};
   }
   const env = options.env || process.env;
+  const additive = options.additive === true;
   const path = options.path || await resolveMcpConfigPath(env);
   const installWarnings = [];
   // recoverInvalid: BOM/encoding damage, VS Code JSONC comments, torn writes
@@ -626,7 +624,9 @@ export async function installMcpConfig(destinationsOrOptions, options = {}) {
     }
   }
   const servers = Object.create(null);
+  const managedEntries = [];
   const managedInputIds = new Set();
+  const generatedNames = new Set(Object.keys(generated));
   for (const [name, entry] of Object.entries(config.servers)) {
     const managed = isPackageLauncher(entry)
       && typeof destinationValue(entry?.env) === 'string'
@@ -639,17 +639,38 @@ export async function installMcpConfig(destinationsOrOptions, options = {}) {
         if (match) managedInputIds.add(match[1]);
       }
     }
-    if (!LEGACY_MCP_SERVER_PREFIXES.some(prefix => name.startsWith(prefix)) && !managed && !isCompanionServer(entry)) servers[name] = entry;
+    const exactManagedUpdate = managed && generatedNames.has(name)
+      && destinationValue(entry.env) === generated[name]?.env?.SAP_AI_DEV_TOOLKIT_DESTINATION
+      && destinationSource(entry.env) === generated[name]?.env?.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE;
+    if (additive && (managed || isCompanionServer(entry)) && !exactManagedUpdate) managedEntries.push([name, entry]);
+    else if (!managed && !isCompanionServer(entry) && !LEGACY_MCP_SERVER_PREFIXES.some(prefix => name.startsWith(prefix))) servers[name] = entry;
   }
+  const retainedNames = new Set(managedEntries.map(([name]) => name));
   for (const name of Object.keys(generated)) {
-    if (Object.hasOwn(servers, name)) {
-      throw new Error(`MCP server "${name}" already exists and is not managed by sap-ai-dev-toolkit`);
+    if (Object.hasOwn(servers, name) || retainedNames.has(name)) {
+      const existing = Object.hasOwn(servers, name) ? servers[name] : config.servers[name];
+      const conflict = Object.hasOwn(servers, name)
+        ? 'already exists and is not managed by sap-ai-dev-toolkit'
+        : `conflicts with a different managed destination${isCompanionServer(existing) ? ' or companion server' : ''}`;
+      throw new Error(`MCP server "${name}" ${conflict}`);
     }
   }
-  config.servers = { ...servers, ...generated };
+  config.servers = { ...servers, ...Object.fromEntries(managedEntries), ...generated };
   if (generatedInputs.size || managedInputIds.size) {
-    const existingInputs = Array.isArray(config.inputs) ? config.inputs.filter(input => !generatedInputs.has(input?.id) && !managedInputIds.has(input?.id)) : [];
-    config.inputs = [...existingInputs, ...generatedInputs.values()];
+    const retainedInputIds = new Set();
+    if (additive) {
+      for (const [, entry] of managedEntries) {
+        for (const value of Object.values(entry.env || {})) {
+          const match = typeof value === 'string' ? value.match(/^\$\{input:([^}]+)}$/) : null;
+          if (match) retainedInputIds.add(match[1]);
+        }
+      }
+    }
+    const existingInputs = Array.isArray(config.inputs) ? config.inputs.filter(input =>
+      !managedInputIds.has(input?.id) || retainedInputIds.has(input?.id)) : [];
+    const inputsById = new Map(existingInputs.map(input => [input?.id, input]));
+    for (const [id, input] of generatedInputs) inputsById.set(id, input);
+    config.inputs = [...inputsById.values()];
   }
   await writeConfig(path, config);
   return { path, servers: generated, warnings: installWarnings };

package/src/mcp-proxy.mjs

@@ -45,10 +45,13 @@ const APPLICATION_LOG_DESCRIPTION = 'Read SAP application log (SLG1) entries. Re
 const NON_RETRIABLE_VSP_TOOLS = new Set([
   'Activate',
   'ActivateMultiple',
+  'CreateObject',
   'CreateTransport',
   'EditSource',
   'LockObject',
+  'PublishServiceBinding',
   'UnlockObject',
+  'UnpublishServiceBinding',
   'WriteSource'
 ]);
 
@@ -68,12 +71,13 @@ function requestTimeoutMs(env) {
 }
 
 
-// Keep the default public VSP surface small enough for developer-lifecycle use.
+// Keep the default public tool surface small enough for developer-lifecycle use.
 // Hidden upstream tools can still be used by local workflow tools when needed.
 export const PUBLIC_VSP_TOOLS = new Set([
   'Activate',
   'ActivateMultiple',
   'CompareSource',
+  'CreateObject',
   'CreateTransport',
   'DebuggerAttach',
   'DebuggerDetach',
@@ -116,13 +120,19 @@ export const PUBLIC_VSP_TOOLS = new Set([
   'ListTransports',
   'LockObject',
   'PrettyPrint',
+  'PublishServiceBinding',
   'RunATCCheck',
   'RunQuery',
   'RunUnitTests',
   'SearchObject',
   'SetBreakpoint',
   'SyntaxCheck',
+  // UI5 write tools stay hidden: the ADT filestore is read-only.
+  'UI5GetApp',
+  'UI5GetFileContent',
+  'UI5ListApps',
   'UnlockObject',
+  'UnpublishServiceBinding',
   'WriteSource'
 ]);
 
@@ -175,7 +185,7 @@ function useProxyAuthentication(destination) {
 function childEnvironment(destination, env) {
   const childEnv = { ...sanitizeChildEnv(env), ...(destination.childEnv || {}) };
   if (useProxyAuthentication(destination)) {
-    // VSP loads SAP_* values from local .env files. Set every supported local
+    // The runtime loads SAP_* values from local .env files. Set every supported local
     // auth variable explicitly empty so dotenv cannot supply a fallback
     // identity or session instead of the selected BAS destination identity.
     for (const key of [
@@ -200,7 +210,7 @@ export function childArguments(destination, env = process.env) {
 
 // Windows cannot exec a .js/.mjs file directly (no shebang support), so test
 // fixtures written in JavaScript are launched through the current Node binary.
-// The production VSP binary is a native executable and is unaffected; a
+// The production runtime executable is native and unaffected; a
 // Windows .cmd/.bat override needs cmd /c because Node refuses to spawn
 // batch files directly (EINVAL since the CVE-2024-27980 hardening).
 function spawnCommand(binary) {
@@ -237,16 +247,16 @@ class Child {
     // Without a listener that is an uncaught exception that kills the whole
     // MCP server — exactly the crash window self-healing is meant to cover.
     this.process.stdin.on('error', error => {
-      if (!this.closing && this.options.log) this.options.log(`[${destination.name}] VSP child stdin error: ${diagnosticText(error.message)}`);
+      if (!this.closing && this.options.log) this.options.log(`[${destination.name}] runtime process stdin error: ${diagnosticText(error.message)}`);
       this.fail(new Error(`child stdin failed: ${error.message}`));
     });
     this.process.on('error', error => {
-      if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] VSP child process error: ${diagnosticText(error.message)}`);
+      if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] runtime process error: ${diagnosticText(error.message)}`);
       this.fail(error);
       void closeDestinationRoute(destination);
     });
     this.process.on('exit', (code, signal) => {
-      if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] VSP child exited (${code ?? signal})`);
+      if (!this.closing && !this.pending.size && this.options.log) this.options.log(`[${destination.name}] runtime process exited (${code ?? signal})`);
       this.fail(new Error(`child exited (${code ?? signal})`));
       void closeDestinationRoute(destination);
     });
@@ -327,7 +337,7 @@ class Child {
     try { this.process.stdin.write(`${JSON.stringify({ jsonrpc: JSONRPC, method, ...(params === undefined ? {} : { params })})}\n`); } catch {}
   }
 
-  // VSP's own "Error:" line explains an exit, and stderr can still be draining when 'exit' fires.
+  // The runtime's own "Error:" line explains an exit, and stderr can still be draining when 'exit' fires.
   async stopReason(waitMs = 1000) {
     let timer;
     await Promise.race([this.stderrClosed, new Promise(resolve => { timer = setTimeout(resolve, waitMs); })]);
@@ -352,7 +362,7 @@ class Child {
     return tools;
   }
 
-  // The VSP tool surface is fixed for the process lifetime (--mode is a
+  // The runtime tool surface is fixed for the process lifetime (--mode is a
   // launch argument), so listings are memoized per child. The memo is
   // cleared on failure, on child exit, and on upstream list_changed.
   listToolsCached() {
@@ -465,7 +475,7 @@ export class MCPProxy {
       // keeping serverInfo's children[0] fallback and merged slug numbering deterministic.
       const started = await Promise.all(this.destinations.map(destination => (async () => {
         try {
-          this.eventSink(`[${destination.name}] starting VSP child (client=${destination.client || '001'})`);
+          this.eventSink(`[${destination.name}] starting runtime process (client=${destination.client || '001'})`);
           return {
             destination,
             child: new Child(this.binary, destination, this.childSpawnOptions(destination))
@@ -491,7 +501,7 @@ export class MCPProxy {
     return this;
   }
 
-  // Self-healing mode 3: transparently restart a crashed VSP child so an
+  // Self-healing mode 3: transparently restart a crashed child so an
   // MCP tools/call does not permanently fail after a single crash. The
   // restarted child re-initializes and re-registers tools before the call
   // is retried once. Concurrent triggers share one restart (no orphaned
@@ -505,11 +515,11 @@ export class MCPProxy {
     const now = Date.now();
     state.timestamps = state.timestamps.filter(at => now - at < RESTART_WINDOW_MS);
     if (state.timestamps.length >= MAX_RESTARTS_PER_WINDOW) {
-      throw new Error(`VSP child restart budget exhausted (${MAX_RESTARTS_PER_WINDOW} in ${RESTART_WINDOW_MS / 1000}s); surfacing the failure instead of respawning`);
+      throw new Error(`Runtime process restart budget exhausted (${MAX_RESTARTS_PER_WINDOW} in ${RESTART_WINDOW_MS / 1000}s); surfacing the failure instead of respawning`);
     }
     state.inFlight = (async () => {
       const name = entry.destination.name;
-      this.eventSink(`[${name}] VSP child crashed; self-healing restart in progress`, 'warning');
+      this.eventSink(`[${name}] runtime process crashed; self-healing restart in progress`, 'warning');
       try {
         await entry.child.close().catch(() => {});
         const child = new Child(this.binary, entry.destination, this.childSpawnOptions(entry.destination));
@@ -518,7 +528,7 @@ export class MCPProxy {
         this.toolsCache = null;
         await child.listToolsCached().catch(() => {});
         state.timestamps.push(Date.now());
-        this.eventSink(`[${name}] VSP child self-healing restart complete`);
+        this.eventSink(`[${name}] runtime process self-healing restart complete`);
         this.emitToolsListChanged();
         return entry;
       } finally {
@@ -544,16 +554,16 @@ export class MCPProxy {
     const initialized = await Promise.all(this.children.map(async entry => {
       const { destination } = entry;
       const startedAt = Date.now();
-      this.eventSink(`[${destination.name}] initializing VSP MCP session`);
+      this.eventSink(`[${destination.name}] initializing runtime MCP session`);
       for (let attempt = 1; ; attempt += 1) {
         const attemptStartedAt = Date.now();
-        // VSP answers initialize only after its browser sign-in, which waits on a person.
+        // The runtime answers initialize only after browser sign-in, which waits on a person.
         const signIn = destination.authentication === 'SSO'
           ? setInterval(() => this.eventSink(`[${destination.name}] still waiting for the SSO sign-in (${Math.round((Date.now() - attemptStartedAt) / 1000)} s): finish it in the browser window (it may be behind other windows); restarting the server cancels it`), this.ssoHeartbeatMs)
           : undefined;
         try {
           entry.server = await entry.child.initialize(params).finally(() => clearInterval(signIn));
-          this.eventSink(`[${destination.name}] VSP MCP session initialized (${Date.now() - startedAt}ms)`);
+          this.eventSink(`[${destination.name}] runtime MCP session initialized (${Date.now() - startedAt}ms)`);
           return entry;
         } catch (error) {
           const reason = await entry.child.stopReason();

package/src/setup.mjs

@@ -705,6 +705,7 @@ export async function runSetup({
     return { skipped: true, reason: 'no-destinations', warnings: [...warnings, ...cleanupWarnings] };
   };
   let selected;
+  let additiveSetup = false;
   if (!selectable.length) {
     // Nothing was detected — no BAS/CF destinations, or no SAP GUI entries.
     // Offer the manual MCP entry wizard before giving up.
@@ -721,9 +722,11 @@ export async function runSetup({
     }, { input, output });
     if (choice !== 'manual') return await exitWithoutDestinations();
     selected = await runManualEntryWizard({ env, input, output, detectAdtUrl });
+    additiveSetup = true;
     if (!selected.length) return await exitWithoutDestinations();
   } else {
     selected = await chooseDiscoveredDestinations(destinations, { isBas, input, output, env, detectAdtUrl, previousAdtUrls });
+    additiveSetup = selected.length > 0;
   }
 
   let sapDevelopmentServers = [];
@@ -746,7 +749,7 @@ export async function runSetup({
   }
 
   try {
-    const result = await install(selected, { env, sapDevelopmentServers });
+    const result = await install(selected, { env, sapDevelopmentServers, additive: additiveSetup });
     const location = result?.path ? ` in ${result.path}` : '';
     print(output, '');
     const configuredCount = selected.length + sapDevelopmentServers.length;

package/src/sso-browsers.mjs

@@ -59,7 +59,7 @@ async function fileExists(path) {
   }
 }
 
-// Every Chromium-based browser VSP can drive, best first; SAP_BROWSER_EXEC pins one ahead of the rest.
+// Every Chromium-based browser the runtime can drive, best first; SAP_BROWSER_EXEC pins one ahead of the rest.
 export async function findSsoBrowsers({ env = process.env, platform = process.platform, exists = fileExists, appPaths = registeredAppPaths } = {}) {
   const candidates = [];
   const pinned = envValue(env, 'SAP_BROWSER_EXEC');

package/src/terminal-ui.mjs

@@ -274,17 +274,19 @@ export async function checkboxPrompt({ message, choices: initialChoices, require
   const render = (error = '') => {
     const columns = Number.isFinite(output?.columns) ? output.columns : 80;
     const indexes = visibleIndexes();
+    const fixedLines = 1 + (searchable ? 1 : 0) + (Object.hasOwn(actions, 'm') ? 1 : 0) + footer().length;
     const pageSize = searchable
-      ? Math.max(1, checkboxPageSize(output, indexes.length + 1) - 1)
+      ? Math.max(1, Math.min(indexes.length, (Number.isFinite(output?.rows) ? output.rows : 24) - fixedLines - 7))
       : checkboxPageSize(output, indexes.length);
     const cursorPosition = indexes.indexOf(cursor);
     ensureVisible(pageSize, indexes.length, cursorPosition);
     const lines = [];
     lines.push(truncateToColumns(`${message} (Space: select, ${shortcuts?.all || 'a'}: toggle all, Enter: confirm)`, columns));
     if (searchable) {
-      const hint = searchQuery ? 'Backspace edits; Esc clears' : 'type prefix; / before a or m';
+      const hint = searchQuery ? 'Backspace edits; Esc clears' : 'type prefix to search';
       lines.push(truncateToColumns(`Search: ${searchQuery || 'type prefix'} (${hint})`, columns));
     }
+    if (Object.hasOwn(actions, 'm')) lines.push(truncateToColumns('m: add system manually', columns));
     const end = Math.min(indexes.length, top + pageSize);
     for (let index = top; index < end; index += 1) {
       const choiceIndex = indexes[index];
@@ -505,7 +507,7 @@ export async function textPrompt({ message, secret = false, required = true, pla
 }
 
 // Animated progress line for long-running steps (destination discovery,
-// ADT probes, VSP binary provisioning). TTY outputs get spinner frames on an
+// ADT probes, runtime provisioning). TTY outputs get spinner frames on an
 // unref'd timer that starts after a short delay, so steps that finish quickly
 // never flash anything. Non-TTY outputs (pipes, MCP hosts, --json callers,
 // CI) stay completely silent so machine consumers never see progress noise.