sap-ai-dev-toolkit 0.9.9904 → 0.9.9908

package/README.md

@@ -15,7 +15,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/badge/SAP-Business%20Application%20Studio-0A6ED1?style=flat-square&logo=sap&logoColor=white" alt="SAP Business Application Studio">
-  <img src="https://img.shields.io/badge/AI%20agents-Copilot%20%7C%20Claude%20%7C%20Codex%20%7C%20Cursor%20%7C%20Gemini%20%7C%20opencode%20%7C%20Pi-000000?style=flat-square" alt="Works with GitHub Copilot, Claude Code, OpenAI Codex, Cursor, Gemini CLI, opencode, and Pi Coding Agent">
+  <img src="https://img.shields.io/badge/AI%20agents-Copilot%20%7C%20Claude%20%7C%20Codex%20%7C%20Cursor%20%7C%20Gemini%20%7C%20opencode%20%7C%20Pi%20%7C%20OMP%20%7C%20Cline%20%7C%20Roo%20%7C%20Windsurf-000000?style=flat-square" alt="Works with GitHub Copilot, Claude Code, OpenAI Codex, Cursor, Gemini CLI, opencode, Pi Coding Agent, Oh My Pi, Cline, Roo Code, and Windsurf">
   <img src="https://img.shields.io/badge/MCP-enabled-7B61FF?style=flat-square" alt="MCP enabled">
   <img src="https://img.shields.io/badge/SAP%20ADT-connected-0A6ED1?style=flat-square&logo=sap&logoColor=white" alt="SAP ADT connected">
   <img src="https://img.shields.io/badge/ABAP-CDS%20%7C%20RAP-EA4AAA?style=flat-square" alt="ABAP CDS RAP">
@@ -41,12 +41,14 @@ SAP AI Dev Toolkit connects your AI coding assistant to the SAP development tool
 
 ## ⚡ Quick start
 
-The default installation is a single npx command — no global install, nothing left behind except the generated MCP configuration:
+Run the setup wizard without a global install:
 
 ```sh
 npx --yes --ignore-scripts sap-ai-dev-toolkit --setup
 ```
 
+Interactive setup configures the selected destinations, then asks which AI harnesses should receive the bundled agents and skills. This prompt is part of `--setup`, so it still appears when `--ignore-scripts` skips npm lifecycle scripts. Without an interactive terminal, assets install for GitHub Copilot by default.
+
 Prefer a persistent global install instead?
 
 ```sh
@@ -87,7 +89,7 @@ Use the attached destination-prefixed tools directly in chat. Do not launch `sap
 
 **Included skills:** `abap-development` · `abap-testing-quality` · `cds-development` · `rap-development` · `abap-debugging` · `abap-runtime-analysis` · `rap-service-delivery` · `sap-standard-api-analysis` · `clean-core-extensibility` · `sap-sdlc-orchestration` · `sap-transport-release` · `hana-cloud-inspection` · `hana-cloud-native-development` · `hana-cloud-validation`
 
-Agents and skills install for the harnesses you pick during global installation: a multi-select offers GitHub Copilot and Claude Code pre-checked, plus OpenAI Codex, Cursor, Gemini CLI, opencode, and Pi Coding Agent. In non-interactive installs they are installed for GitHub Copilot only; run `sap-ai-dev --setup` afterwards to configure destinations or local SAP GUI systems. Repository-scoped installation instructions appear below.
+Agents and skills install for the harnesses you pick during global installation: a multi-select offers GitHub Copilot and Claude Code pre-checked, plus OpenAI Codex, Cursor, Gemini CLI, opencode, Pi Coding Agent, Oh My Pi (OMP), Cline, Roo Code, and Windsurf / Devin Desktop. In non-interactive installs they are installed for GitHub Copilot only; run `sap-ai-dev --setup` afterwards to configure destinations or local SAP GUI systems. Repository-scoped installation instructions appear below.
 
 ## ✨ Your SAP development cockpit, inside your AI assistant
 
@@ -332,7 +334,7 @@ sap-ai-dev --setup
 5. Choose Windows / smart card SSO or username/password when the prompt is available.
 6. Start each generated MCP server from VS Code's **MCP: List Servers** command.
 
-The same postinstall offers the bundled agents and skills for several AI coding harnesses in a checkbox picker. **GitHub Copilot** and **Claude Code** start pre-checked, so pressing **Enter** alone installs both; **Space** selects or deselects a harness, **a** toggles all seven, and confirming with none selected skips the step without changing files. When MCP setup succeeds, the generated managed MCP servers are also mirrored into selected harnesses that have a stable user-level JSON MCP configuration (Claude Code, Cursor, Gemini CLI, and Pi Coding Agent). GitHub Copilot continues to use the VS Code/BAS MCP configuration written during setup. With no interactive terminal, the assets are installed for GitHub Copilot only; set `SAP_AI_DEV_TOOLKIT_HARNESSES` to a comma-separated list of harness ids (`github-copilot`, `claude-code`, `codex`, `cursor`, `gemini-cli`, `opencode`, `pi-coding-agent`) to choose non-interactively.
+The same postinstall offers the bundled agents and skills for several AI coding harnesses in a checkbox picker. **GitHub Copilot** and **Claude Code** start pre-checked, so pressing **Enter** alone installs both; **Space** selects or deselects a harness, **a** toggles all eleven, and confirming with none selected skips the step without changing files. When MCP setup succeeds, generated managed MCP servers are also mirrored into selected harnesses with documented user-level JSON configuration (Claude Code, Cursor, Gemini CLI, Pi Coding Agent, OMP, and Windsurf / Devin Desktop). GitHub Copilot continues to use the VS Code/BAS MCP configuration written during setup. With no interactive terminal, the assets are installed for GitHub Copilot only; set `SAP_AI_DEV_TOOLKIT_HARNESSES` to a comma-separated list of harness ids (`github-copilot`, `claude-code`, `codex`, `cursor`, `gemini-cli`, `opencode`, `pi-coding-agent`, `omp`, `cline`, `roo-code`, `windsurf`) to choose non-interactively.
 
 Some current npm versions also require install hooks to be approved. If npm reports that `sap-ai-dev-toolkit`'s `postinstall` was blocked, allow it during a fresh install with `npm install --global --allow-scripts=sap-ai-dev-toolkit sap-ai-dev-toolkit`, or run `sap-ai-dev --setup` from an interactive terminal after installation.
 
@@ -405,7 +407,7 @@ The package includes five user-invocable custom agents (**SAP Solution Architect
 
 ### 📥 Install agents and skills for your user
 
-During npm postinstall, after the destination or local SAP GUI setup step, the installer prints a 🤖 notice and a checkbox picker asking which AI coding harnesses should receive the bundled agents and skills. **Space** selects or deselects, **a** toggles all, **Enter** confirms. **GitHub Copilot** and **Claude Code** are pre-checked, so pressing **Enter** without changes installs both; confirming with none selected skips the step and leaves your files unchanged.
+During npm postinstall, or after interactive `sap-ai-dev --setup` in BAS or on a local PC, the installer prints a 🤖 notice and a checkbox picker asking which AI coding harnesses should receive the bundled agents and skills. **Space** selects or deselects, **a** toggles all, **Enter** confirms. **GitHub Copilot** and **Claude Code** are pre-checked, so pressing **Enter** without changes installs both; confirming with none selected skips the step and leaves your files unchanged.
 
 | Harness | Skills land in | Agents land in | MCP auto-wiring |
 | --- | --- | --- | --- |
@@ -416,12 +418,16 @@ During npm postinstall, after the destination or local SAP GUI setup step, the i
 | Gemini CLI | `$HOME/.gemini/skills/` | — | `$HOME/.gemini/settings.json` |
 | opencode | `$XDG_CONFIG_HOME/opencode/skills/` (default `$HOME/.config/opencode/skills/`) | `$XDG_CONFIG_HOME/opencode/agents/<id>.md` (as subagents) | Not changed automatically |
 | Pi Coding Agent | `$PI_CODING_AGENT_DIR/skills/` (default `$HOME/.pi/agent/skills/`) | `$PI_CODING_AGENT_DIR/prompts/<id>.md` (as `/` prompt commands) | `$PI_CODING_AGENT_DIR/mcp.json` (default `$HOME/.pi/agent/mcp.json`) |
+| Oh My Pi (OMP) | `$HOME/.omp/agent/skills/` (overridden by `PI_CONFIG_DIR` or `PI_CODING_AGENT_DIR`) | — | `$HOME/.omp/agent/mcp.json` (same overrides) |
+| Cline | `$HOME/.cline/skills/` | — | Not changed automatically |
+| Roo Code | `$HOME/.roo/skills/` | — | Not changed automatically |
+| Windsurf / Devin Desktop | `$XDG_CONFIG_HOME/devin/skills/` (default `$HOME/.config/devin/skills/`); Windows: `$HOME/.codeium/windsurf/skills/` | — | `$XDG_CONFIG_HOME/devin/mcp_config.json` (default `$HOME/.config/devin/mcp_config.json`); Windows: `%APPDATA%\devin\mcp_config.json` |
 
 All 14 skills use the portable `SKILL.md` format and are installed verbatim. The 5 agents use Copilot's `.agent.md` format, so they are installed as native custom agents for harnesses with a custom-agent mechanism (GitHub Copilot, Claude Code, opencode), with frontmatter adapted where needed. Pi receives equivalent prompt templates (`/abap-developer`, `/sap-solution-architect`, and so on) because Pi exposes reusable personas through prompts rather than a separate custom-agent file type. Selecting several harnesses duplicates the small markdown payloads on disk.
 
 MCP auto-wiring preserves unrelated servers in each harness config and replaces only entries previously managed by `sap-ai-dev-toolkit`. Generated entries carry `SAP_AI_DEV_TOOLKIT_MANAGED=true` in their server environment so future reinstalls can reconcile them without touching user-owned MCP servers.
 
-These user-level customizations are available across workspaces opened by the same OS user (or the same BAS user in a dev space). The harness may need a window reload to discover new files. A non-interactive install skips the picker and installs for GitHub Copilot only; override with `SAP_AI_DEV_TOOLKIT_HARNESSES` (comma-separated harness ids). `npm install --ignore-scripts` skips the postinstall wizard entirely.
+These user-level customizations are available across workspaces opened by the same OS user (or the same BAS user in a dev space). The harness may need a window reload to discover new files. A non-interactive postinstall or setup run installs for GitHub Copilot only; override with `SAP_AI_DEV_TOOLKIT_HARNESSES` (comma-separated harness ids). `npm install --ignore-scripts` skips postinstall, but running `sap-ai-dev --setup` still offers harness installation after destination setup.
 
 On reinstall or package upgrade, unchanged add-on-managed files are updated per harness. Existing customizations and files edited since the previous install are preserved; postinstall reports paths that need manual review instead of overwriting them.
 

package/dist/checksums.txt

@@ -1,5 +1,5 @@
-87b75dce6f9517696d1326526ae06bf1c216695283db7b2ee34f47335a861892  vsp-linux-x64
-c118ccd7043fc2eef9ad34d62ad78fb64c3ef3b4114d65b337b8d855b7b40f0d  vsp-linux-arm64
-c66c6b75b83d3d581f859fa0a21c5a6a6ca0c168019353e3cd34ac8ed4632e7e  vsp-darwin-x64
-6b7833dfd6de0b2d1f6dab921e6ba7dd795217c733552413b4382925590f4388  vsp-darwin-arm64
-8d1f0bf29a83d3b301c5bb9a34811c8c2a84d63285b93a7a393d0c942bf1d2f6  vsp-win32-x64.exe
+f10b759b5e320c6fec4c176ef9bce49f783d796eeb8a2476dd5898c94cb14afd  vsp-linux-x64
+a4c47e4c15538cc16b540d19f55771e4c1340389efeca815e1881eafd89e45c5  vsp-linux-arm64
+20a197921c88f539ea1a7f5236509dbaa9b9f906a6333e6fb1dce9f8b5eec85c  vsp-darwin-x64
+24a8810a17d31a434b92957ea41e6347b24e2a6a35e47b3b2fc13a16082a44c3  vsp-darwin-arm64
+b318fdf5194a7f15ebcf7ee912fb2493df21aba337540a2402f81786300fd0ea  vsp-win32-x64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.9.9904",
+  "version": "0.9.9908",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",
@@ -9,7 +9,7 @@
   },
   "dependencies": {
     "@abaplint/core": "2.119.0",
-    "@modelcontextprotocol/sdk": "1.30.1",
+    "@modelcontextprotocol/sdk": "1.32.1",
     "@sap/hana-client": "2.30.27",
     "terminal-kit": "^3.1.4",
     "undici": "^6.21.3",

package/patches/vsp-bas-proxy-auth.patch

@@ -620,10 +620,30 @@ index 0000000..5e880bd
 +	}
 +}
 diff --git a/pkg/adt/http.go b/pkg/adt/http.go
-index 0b4d9f1..3473536 100755
+index 0b4d9f1..f0b5b51 100755
 --- a/pkg/adt/http.go
 +++ b/pkg/adt/http.go
-@@ -499,6 +499,7 @@ func (t *Transport) fetchCSRFTokenFor(ctx context.Context, stateful bool) error
+@@ -313,7 +313,7 @@ func (t *Transport) request(ctx context.Context, path string, opts *RequestOptio
+ 	// The same expiry reaches a plain read as a successful-looking response that
+ 	// was in fact served by the identity provider. Nothing downstream would
+ 	// recognise the logon page it carries, so catch it here by origin.
+-	if resp.StatusCode < 400 && t.canReauth() && t.redirectedAwayFromSAP(resp) {
++	if t.canReauth() && ((resp.StatusCode < 400 && t.redirectedAwayFromSAP(resp)) || isSSOLoginResponse(resp, body)) {
+ 		t.setCSRFToken("")
+ 		t.setSessionID("")
+ 		if err := t.callReauthFunc(ctx); err != nil {
+@@ -448,6 +448,10 @@ func (t *Transport) retryRequest(ctx context.Context, path string, opts *Request
+ 	}
+ 	traceHTTPResponse(resp, body)
+ 
++	if t.canReauth() && (t.redirectedAwayFromSAP(resp) || isSSOLoginResponse(resp, body)) {
++		return nil, fmt.Errorf("SSO session is still unauthenticated after re-authentication on %s", path)
++	}
++
+ 	if resp.StatusCode >= 400 {
+ 		return nil, &APIError{
+ 			StatusCode: resp.StatusCode,
+@@ -499,6 +503,7 @@ func (t *Transport) fetchCSRFTokenFor(ctx context.Context, stateful bool) error
  // allowReauth exists to break a cycle: re-authenticating ends with a token
  // fetch of its own, and that fetch must not start another re-authentication.
  func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bool, stateful bool) error {
@@ -631,7 +651,7 @@ index 0b4d9f1..3473536 100755
  	token, status, redirected, err := t.probeCSRFToken(ctx, http.MethodHead, stateful)
  	if err != nil {
  		return err
-@@ -513,6 +514,29 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+@@ -513,6 +518,29 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
  		if err != nil {
  			return err
  		}
@@ -661,7 +681,16 @@ index 0b4d9f1..3473536 100755
  		if !isCSRFToken(token) {
  			// An expired SSO session rarely announces itself as a 401. ICF sends
  			// the request on to the identity provider, the redirect chain is
-@@ -537,6 +561,9 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+@@ -520,7 +548,7 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+ 			// 200 — with no CSRF token in it, because it is not ADT answering.
+ 			// A live ADT session always yields a token, so its absence here is
+ 			// the signal, and a hop to a foreign host is the confirmation.
+-			if allowReauth && t.canReauth() && getStatus != http.StatusForbidden {
++			if allowReauth && t.canReauth() && (getStatus != http.StatusForbidden || redirected || getRedirected) {
+ 				reason := fmt.Sprintf("no CSRF token (HEAD %d, GET %d)", status, getStatus)
+ 				if redirected || getRedirected {
+ 					reason = "the identity provider answered instead of SAP"
+@@ -537,6 +565,9 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
  				}
  				return t.fetchCSRFTokenWithReauth(ctx, false, stateful)
  			}
@@ -671,7 +700,7 @@ index 0b4d9f1..3473536 100755
  			switch getStatus {
  			case http.StatusUnauthorized:
  				return fmt.Errorf("authentication failed (401): check username/password")
-@@ -556,7 +583,11 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+@@ -556,7 +587,11 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
  // returns the token (empty when the server did not supply one), the status, and
  // whether the answer came from somewhere other than the SAP host.
  func (t *Transport) probeCSRFToken(ctx context.Context, method string, stateful bool) (token string, status int, redirected bool, err error) {
@@ -684,6 +713,42 @@ index 0b4d9f1..3473536 100755
  	if err != nil {
  		return "", 0, false, fmt.Errorf("building URL: %w", err)
  	}
+@@ -596,12 +631,34 @@ func (t *Transport) probeCSRFToken(ctx context.Context, method string, stateful
+ 		return "", 0, false, fmt.Errorf("executing request: %w", err)
+ 	}
+ 	defer resp.Body.Close()
++	body, err := io.ReadAll(io.LimitReader(resp.Body, 64*1024))
++	if err != nil {
++		return "", 0, false, fmt.Errorf("reading CSRF response: %w", err)
++	}
+ 	// Drain the body so the connection can be reused.
+ 	_, _ = io.Copy(io.Discard, resp.Body)
+ 	traceHTTPResponse(resp, nil)
+ 	t.adoptServerCookies(resp)
+ 
+-	return resp.Header.Get("X-CSRF-Token"), resp.StatusCode, t.redirectedAwayFromSAP(resp), nil
++	return resp.Header.Get("X-CSRF-Token"), resp.StatusCode, t.redirectedAwayFromSAP(resp) || isSSOLoginResponse(resp, body), nil
++}
++
++func isSSOLoginResponse(resp *http.Response, body []byte) bool {
++	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusForbidden {
++		return false
++	}
++	page := strings.ToLower(strings.TrimSpace(string(body)))
++	html := strings.Contains(strings.ToLower(resp.Header.Get("Content-Type")), "text/html") ||
++		strings.HasPrefix(page, "<!doctype html") || strings.HasPrefix(page, "<html")
++	if !html || !strings.Contains(page, "<form") {
++		return false
++	}
++	for _, marker := range []string{"samlrequest", "samlresponse", "sap-system-login", "sap-password", `type="password"`, `type='password'`} {
++		if strings.Contains(page, marker) {
++			return true
++		}
++	}
++	return false
+ }
+ 
+ // redirectedAwayFromSAP reports whether a response was ultimately served by
 diff --git a/pkg/adt/http_csrf_discovery_test.go b/pkg/adt/http_csrf_discovery_test.go
 new file mode 100644
 index 0000000..80741da
@@ -746,6 +811,98 @@ index 0000000..80741da
 +	}
 +}
 +
+diff --git a/pkg/adt/http_sso_same_host_test.go b/pkg/adt/http_sso_same_host_test.go
+new file mode 100644
+index 0000000..0c39b96
+--- /dev/null
++++ b/pkg/adt/http_sso_same_host_test.go
+@@ -0,0 +1,86 @@
++package adt
++
++import (
++	"context"
++	"io"
++	"net/http"
++	"net/http/httptest"
++	"strings"
++	"testing"
++)
++
++func TestSameHostLoginPageRefreshesSSO(t *testing.T) {
++	for _, method := range []string{http.MethodGet, http.MethodPost} {
++		for _, status := range []int{http.StatusOK, http.StatusUnauthorized, http.StatusForbidden} {
++			t.Run(method+"/"+http.StatusText(status), func(t *testing.T) {
++				refreshes := 0
++				server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++					cookie, err := r.Cookie("SAP_SESSIONID")
++					if err != nil || cookie.Value != "fresh" {
++						w.Header().Set("Content-Type", "text/html; charset=utf-8")
++						w.WriteHeader(status)
++						_, _ = io.WriteString(w, `<html><body><form action="/sap/saml2/sp/acs"><input name="SAMLRequest" value="fixture"></form></body></html>`)
++						return
++					}
++					w.Header().Set("X-CSRF-Token", "fresh-token")
++					w.Header().Set("Content-Type", "application/xml")
++					_, _ = io.WriteString(w, "<source>authenticated</source>")
++				}))
++				defer server.Close()
++				transport := NewTransportWithClient(&Config{
++					BaseURL: server.URL,
++					Cookies: map[string]string{"SAP_SESSIONID": "expired"},
++					ReauthFunc: func(context.Context) (map[string]string, error) {
++						refreshes++
++						return map[string]string{"SAP_SESSIONID": "fresh"}, nil
++					},
++				}, server.Client())
++				response, err := transport.Request(context.Background(), "/sap/bc/adt/source", &RequestOptions{Method: method})
++				if err != nil {
++					t.Fatalf("request failed: %v", err)
++				}
++				if refreshes != 1 || string(response.Body) != "<source>authenticated</source>" {
++					t.Fatalf("refreshes=%d body=%q, want one SSO refresh and authenticated source", refreshes, response.Body)
++				}
++			})
++		}
++	}
++}
++
++func TestOrdinaryForbiddenDoesNotRefreshSSO(t *testing.T) {
++	refreshes := 0
++	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++		w.WriteHeader(http.StatusForbidden)
++		_, _ = io.WriteString(w, "Missing development authorization")
++	}))
++	defer server.Close()
++	transport := NewTransportWithClient(&Config{BaseURL: server.URL, ReauthFunc: func(context.Context) (map[string]string, error) {
++		refreshes++
++		return nil, nil
++	}}, server.Client())
++	_, err := transport.Request(context.Background(), "/sap/bc/adt/source", &RequestOptions{Method: http.MethodGet})
++	if err == nil || refreshes != 0 {
++		t.Fatalf("err=%v refreshes=%d, want authorization error without SSO refresh", err, refreshes)
++	}
++}
++
++func TestSSOLoginPageAfterRefreshFailsWithoutLoop(t *testing.T) {
++	refreshes := 0
++	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++		if r.URL.Path == "/sap/bc/adt/source" {
++			w.Header().Set("Content-Type", "text/html")
++			_, _ = io.WriteString(w, `<html><form><input type="password"></form></html>`)
++			return
++		}
++		w.Header().Set("X-CSRF-Token", "fresh-token")
++	}))
++	defer server.Close()
++	transport := NewTransportWithClient(&Config{BaseURL: server.URL, ReauthFunc: func(context.Context) (map[string]string, error) {
++		refreshes++
++		return map[string]string{"SAP_SESSIONID": "fresh"}, nil
++	}}, server.Client())
++	_, err := transport.Request(context.Background(), "/sap/bc/adt/source", &RequestOptions{Method: http.MethodGet})
++	if err == nil || !strings.Contains(err.Error(), "still unauthenticated") || refreshes != 1 {
++		t.Fatalf("err=%v refreshes=%d, want explicit failure after one refresh", err, refreshes)
++	}
++}
 diff --git a/pkg/adt/servicebinding_publish_test.go b/pkg/adt/servicebinding_publish_test.go
 new file mode 100644
 index 0000000..93c19f9

package/scripts/postinstall.mjs

@@ -1,203 +1,25 @@
-import { open, readFile } from 'node:fs/promises';
-import { closeSync, openSync, realpathSync } from 'node:fs';
-import { spawnSync } from 'node:child_process';
+import { readFile } from 'node:fs/promises';
+import { realpathSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { installBinary } from '../src/binary.mjs';
 import { detectAdtUrl } from '../src/local-sap-gui.mjs';
 import { runSetup } from '../src/setup.mjs';
-import { installUserAssetsForHarnesses } from '../src/install-user-assets.mjs';
-import { installMcpServersForHarnesses } from '../src/harness-mcp-config.mjs';
-import { DEFAULT_HARNESS_IDS, HARNESSES, HARNESS_ENV_VAR, NON_INTERACTIVE_HARNESS_IDS, envHarnessSelection, harnessRoot } from '../src/harnesses.mjs';
-import { ReadStream as TTYReadStream, WriteStream as TTYWriteStream } from 'node:tty';
-import { homedir } from 'node:os';
-import { checkboxPrompt, colorText, formatStatus, startProgress } from '../src/terminal-ui.mjs';
+import { colorText, startProgress } from '../src/terminal-ui.mjs';
 import { brandedEnvValue, withBrandedEnvironment } from '../src/branding.mjs';
 import { generatedServerName } from '../src/mcp-config.mjs';
 import { redactText } from '../src/redact.mjs';
+import { announce, runHarnessSetup, withInstallTerminal } from '../src/harness-setup.mjs';
 
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
 const runtimeEnv = withBrandedEnvironment(process.env);
 
-async function announce(message, tone = 'info') {
-  const content = message.replace(/^sap-ai-dev-toolkit:\s*/, '');
-  // Windows cannot open CONOUT$ as a writable console stream from a
-  // piped npm script (libuv normalizes the device name, and the resulting
-  // handle drops writes), so output goes through stderr unconditionally.
-  if (process.platform === 'win32') {
-    console.error(formatStatus(content, tone, process.stderr));
-    return;
-  }
-  let terminal;
-  try {
-    terminal = await open('/dev/tty', 'w');
-    await terminal.write(`${formatStatus(content, tone, true)}\n`);
-  } catch {
-    console.error(formatStatus(content, tone, process.stderr));
-  } finally {
-    await terminal?.close().catch(() => {});
-  }
-}
-
-function openControllingTerminal() {
-  if (process.platform === 'win32') {
-    // npm can pipe lifecycle script streams even when the install was
-    // launched from an interactive Windows console. Verify console access,
-    // then attach Node TTY streams to its standard console devices.
-    const probe = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', '[Console]::OpenStandardInput(); [Console]::OpenStandardOutput()'], { stdio: 'ignore', windowsHide: true });
-    if (probe.error || probe.status !== 0) throw new Error('interactive console is unavailable');
-    const inputFd = openSync('CONIN$', 'r');
-    let outputFd;
-    try {
-      outputFd = openSync('CONOUT$', 'w');
-      return { input: new TTYReadStream(inputFd), output: new TTYWriteStream(outputFd) };
-    } catch (error) {
-      closeSync(inputFd);
-      if (outputFd !== undefined) closeSync(outputFd);
-      throw error;
-    }
-  }
-  const inputFd = openSync('/dev/tty', 'r');
-  let outputFd;
-  try {
-    outputFd = openSync('/dev/tty', 'w');
-    return { input: new TTYReadStream(inputFd), output: new TTYWriteStream(outputFd) };
-  } catch (error) {
-    closeSync(inputFd);
-    if (outputFd !== undefined) closeSync(outputFd);
-    throw error;
-  }
-}
-
-async function withInstallTerminal(action) {
-  if (process.stdin.isTTY && process.stdout.isTTY) {
-    return action({ input: process.stdin, output: process.stdout });
-  }
-  let terminal;
-  try {
-    terminal = openControllingTerminal();
-  } catch {
-    return action(null);
-  }
-  try {
-    return await action(terminal);
-  } finally {
-    terminal.input.destroy();
-    terminal.output.destroy();
-  }
-}
-
 async function runInstallSetup(binary) {
   const detect = binary ? target => detectAdtUrl(binary, { ...target, env: runtimeEnv }) : undefined;
   return withInstallTerminal(terminal => runSetup({ env: runtimeEnv, ...(terminal || {}), detectAdtUrl: detect }));
 }
 
-function harnessSelectionLabels(ids) {
-  return HARNESSES.filter(harness => ids.includes(harness.id)).map(harness => harness.label).join(', ');
-}
-
-async function resolveHarnessOverride() {
-  try {
-    return envHarnessSelection(runtimeEnv);
-  } catch (error) {
-    await announce(`${error.message} Ignoring ${HARNESS_ENV_VAR}.`, 'warning');
-    return null;
-  }
-}
-
-async function installSelectedHarnessAssets(ids) {
-  const { results, failures } = await installUserAssetsForHarnesses(ids, { root });
-  for (const failure of failures) {
-    await announce(`${failure.label}: bundled agent and skill installation failed: ${failure.error.message}`, 'error');
-  }
-  for (const assets of results) {
-    const installed = assets.installed + assets.updated;
-    const removed = assets.removed || 0;
-    const cleanup = removed > 0 ? `; ${removed} duplicate or legacy file${removed === 1 ? '' : 's'} removed` : '';
-    await announce(`${assets.label}: ${installed} file${installed === 1 ? '' : 's'} installed or updated in ${assets.root}; ${assets.unchanged} already current${cleanup}.`, 'success');
-    if (assets.conflicts.length > 0) {
-      const paths = assets.conflicts.map(path => join(assets.root, path)).join(', ');
-      await announce(`${assets.label}: existing customizations were preserved; review these paths: ${paths}`, 'warning');
-    }
-  }
-  const total = results.reduce((sum, assets) => sum + assets.installed + assets.updated, 0);
-  if (results.length > 0) {
-    await announce(`Installed ${total} files across ${results.length} harness${results.length === 1 ? '' : 'es'}.`, 'success');
-  }
-}
-
-async function runHarnessAssetInstall() {
-  const home = process.env.HOME || homedir();
-  const override = await resolveHarnessOverride();
-  return withInstallTerminal(async terminal => {
-    let selected = override;
-    if (!terminal) {
-      if (!selected) selected = NON_INTERACTIVE_HARNESS_IDS;
-      await announce(`Installing bundled agents and skills for ${harnessSelectionLabels(selected)} by default because no interactive terminal is available.`, 'progress');
-      await installSelectedHarnessAssets(selected);
-      return selected;
-    }
-    if (!selected) selected = DEFAULT_HARNESS_IDS;
-    await announce([
-      'The bundled agents and skills can be installed for several AI coding harnesses.',
-      '',
-      'Space = select or deselect · a = toggle all · Enter = confirm. Pressing Enter without changes installs the pre-checked harnesses; confirming with none selected skips this step.',
-      '',
-      `${colorText('📁 Target folders:', 'cyan', true)}`,
-      ...HARNESSES.map(harness => `   ${harnessRoot(harness, { home, env: runtimeEnv })} — ${harness.label} (${harness.supportsAgents ? 'skills + agents' : 'skills only'})`),
-      ''
-    ].join('\n'), 'copilot');
-    let answer;
-    try {
-      answer = await checkboxPrompt({
-        message: colorText('🤖 Install bundled agents and skills for', 'magenta', terminal.output),
-        choices: HARNESSES.map(harness => ({
-          value: harness.id,
-          name: `${harness.label} (${harness.supportsAgents ? 'skills + agents' : 'skills'})`,
-          checked: selected.includes(harness.id)
-        })),
-        required: false,
-        shortcuts: { all: 'a' }
-      }, { input: terminal.input, output: terminal.output });
-    } catch (error) {
-      if (error.message === 'Prompt interrupted') {
-        await announce('Bundled agents and skills were skipped because the prompt was interrupted. Your files were not changed.', 'info');
-        return [];
-      }
-      throw error;
-    }
-    if (answer.length === 0) {
-      await announce('Bundled agents and skills were skipped. Your files were not changed.', 'info');
-      return [];
-    }
-    await installSelectedHarnessAssets(answer);
-    return answer;
-  });
-}
-
-async function wireHarnessMcpServers(ids, servers) {
-  const entries = servers && Object.keys(servers).length ? servers : null;
-  if (!entries || !ids?.length) return;
-  const hasLocalSapGui = Object.values(entries).some(entry => entry?.env?.SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE === 'sap-gui-local');
-  if (hasLocalSapGui) {
-    await announce('Local SAP GUI MCP entries use VS Code input prompts for SAP login, so automatic wiring into non-VS Code harness MCP files was skipped. Configure those harnesses manually if they support secure runtime prompts.', 'info');
-    return;
-  }
-  const { results, failures } = await installMcpServersForHarnesses(ids, entries, { env: runtimeEnv });
-  for (const result of results) {
-    if (!result.supported) {
-      await announce(`${result.label}: MCP auto-wiring skipped. ${result.skipped}`, 'info');
-      continue;
-    }
-    await announce(`${result.label}: wired ${result.servers} MCP server${result.servers === 1 ? '' : 's'} in ${result.path}.`, 'success');
-  }
-  for (const failure of failures) {
-    await announce(`${failure.label}: MCP auto-wiring failed: ${failure.error.message}`, 'error');
-  }
-}
-
-
 function probeCell(destination) {
   const probe = destination.probe || {};
   if (probe.status === 'skipped') return { text: 'SKIPPED (probe disabled)', color: 'yellow' };
@@ -347,17 +169,7 @@ async function main() {
     await announce('Rerun sap-ai-dev --setup.', 'info');
   }
 
-  let harnessIds = [];
-  try {
-    harnessIds = await runHarnessAssetInstall();
-  } catch (error) {
-    await announce(`Bundled agent and skill installation failed: ${error.message}`, 'error');
-  }
-  try {
-    if (setupCompleted) await wireHarnessMcpServers(harnessIds, setupResult?.servers);
-  } catch (error) {
-    await announce(`Harness MCP auto-wiring failed: ${error.message}`, 'error');
-  }
+  await runHarnessSetup(setupResult?.servers, { env: runtimeEnv, root, wire: setupCompleted });
   if (setupCompleted) await announceSetup(setupResult);
 }
 if (process.argv[1] && realpathSync(fileURLToPath(import.meta.url)) === realpathSync(resolve(process.argv[1]))) {