sap-ai-dev-toolkit 0.9.9904 → 0.9.9908

package/src/setup.mjs

@@ -8,6 +8,7 @@ import { adtBaseUrl, adtPort, defaultAdtUrl, discoverSapGuiSystems, hasExplicitP
 import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys, findOrphanedCloudFoundryServiceKeys } from './cf-destination.mjs';
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
 import { discoverCertificateDnsNames } from './tls-adt-proxy.mjs';
+import { findRemoteControllableSsoBrowsers } from './sso-browsers.mjs';
 
 const SETUP_COMMAND = 'sap-ai-dev --setup';
 
@@ -66,6 +67,45 @@ async function chooseLocalAuthMode(destination, { input = stdin, output = stdout
   }, { input, output });
 }
 
+function createSsoBrowserSelector({ discoverSsoBrowsers, input, output, env }) {
+  let selectedPath;
+  let selectionComplete = false;
+  return async destination => {
+    if (selectionComplete) return selectedPath;
+    selectionComplete = true;
+    print(output, formatStatus('Checking installed browsers for remote DevTools access.', 'progress', output, 'SSO'));
+    let result;
+    try {
+      result = await discoverSsoBrowsers({ env });
+    } catch (error) {
+      const reason = String(error?.message || error).replace(/\s+/g, ' ').slice(0, 240);
+      print(output, formatStatus(`Browser control check failed (${reason}). Setup will keep automatic browser discovery.`, 'warning', output, 'SSO'));
+      return undefined;
+    }
+    const { browsers = [], unavailable = [] } = result || {};
+    if (!browsers.length) {
+      const details = unavailable.map(browser => `${browser.name}: ${browser.reason}`).join('; ').slice(0, 300);
+      print(output, formatStatus(`No remotely controllable SSO browser was found${details ? ` (${details})` : ''}. Setup will keep automatic browser discovery.`, 'warning', output, 'SSO'));
+      return undefined;
+    }
+    if (browsers.length === 1) {
+      selectedPath = browsers[0].path;
+      print(output, formatStatus(`Using ${browsers[0].name}; it responded to a remote DevTools command.`, 'success', output, 'SSO browser'));
+      return selectedPath;
+    }
+    selectedPath = await selectPrompt({
+      message: `Browser for SSO (${destination.name})`,
+      defaultValue: browsers[0].path,
+      choices: browsers.map((browser, index) => ({
+        name: `${browser.name} (${browser.path})`,
+        value: browser.path,
+        shortcut: String(index + 1)
+      }))
+    }, { input, output });
+    return selectedPath;
+  };
+}
+
 async function confirmCloudFoundryImport({ input = stdin, output = stdout } = {}) {
   const readline = createInterface({ input, output });
   try {
@@ -238,7 +278,7 @@ async function confirmPrompt(message, { input = stdin, output = stdout } = {}) {
   return !/^n(?:o)?$/i.test(String(answer || '').trim());
 }
 
-function buildLocalClientDestination(destination, client, authMode, { multipleClients = false, duplicateSystemName = false } = {}) {
+function buildLocalClientDestination(destination, client, authMode, { multipleClients = false, duplicateSystemName = false, browserPath } = {}) {
   const name = localClientDestinationName(destination, client, { multipleClients, duplicateSystemName });
   const localDestination = { ...destination, name, serverName: name, client };
   const userInputId = `sap-ai-dev-${localDestination.serverName || localDestination.name}-user`.toLowerCase().replace(/[^a-z0-9_-]+/g, '-');
@@ -248,7 +288,7 @@ function buildLocalClientDestination(destination, client, authMode, { multipleCl
     { id: passwordInputId, type: 'promptString', description: `SAP password for ${localDestination.name}`, password: true }
   ];
   if (authMode === 'sso') {
-    localDestination.childEnv = { SAP_AUTH_MODE: 'sso' };
+    localDestination.childEnv = { SAP_AUTH_MODE: 'sso', ...(browserPath ? { SAP_BROWSER_EXEC: browserPath } : {}) };
     localDestination.inputs = [];
   } else {
     localDestination.childEnv = {
@@ -285,7 +325,7 @@ async function maybeConfigureTlsSelfHeal(destination, promptLabel, { input = std
 // collects the minimal ADT configuration directly from the user and produces
 // the same local destination shape as the SAP GUI flow, so installation,
 // credential inputs, and TLS handling stay identical.
-async function runManualEntryWizard({ env = process.env, input = stdin, output = stdout, detectAdtUrl } = {}) {
+async function runManualEntryWizard({ env = process.env, input = stdin, output = stdout, detectAdtUrl, selectSsoBrowser } = {}) {
   print(output, '');
   print(output, colorText('✍️  Manual system entry — skip discovery, add your SAP system directly', 'magenta', output));
   print(output, colorText('   The ADT URL is the base URL that Eclipse ADT or VS Code ADT tools use, for example https://myhost.example:44300.', 'cyan', output));
@@ -338,10 +378,11 @@ async function runManualEntryWizard({ env = process.env, input = stdin, output =
     } else {
       if (authMode === 'sso') warnSsoIpHost(destination, name, output);
       else await maybeConfigureTlsSelfHeal(destination, name, { input, output });
+      const browserPath = authMode === 'sso' ? await selectSsoBrowser(destination) : undefined;
       destination.authentication = localAuthenticationLabel(authMode);
       destination.authMode = authMode;
       for (const client of clients) {
-        expanded.push(buildLocalClientDestination(destination, client, authMode, { multipleClients: clients.length > 1 }));
+        expanded.push(buildLocalClientDestination(destination, client, authMode, { multipleClients: clients.length > 1, browserPath }));
       }
       print(output, formatStatus(`Added ${name} (client${clients.length === 1 ? '' : 's'} ${clients.join(', ')}).`, 'success', output, 'Manual entry'));
     }
@@ -469,7 +510,7 @@ function printConnectionInstructions(output, result) {
 
 // Checkbox selection over the discovered destinations plus, outside BAS, the
 // per-system confirmation prompts (clients, ADT URL, TLS self-heal, login).
-async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin, output = stdout, env = process.env, detectAdtUrl, previousAdtUrls = new Map() } = {}) {
+async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin, output = stdout, env = process.env, detectAdtUrl, previousAdtUrls = new Map(), selectSsoBrowser } = {}) {
   const orderedDestinations = [...destinations].sort((left, right) => {
     const leftRank = left.disabledReason ? 2 : (left.probe?.available === false ? 1 : 0);
     const rightRank = right.disabledReason ? 2 : (right.probe?.available === false ? 1 : 0);
@@ -495,7 +536,7 @@ async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin
   print(output, colorText('  Space = select/deselect · a = toggle all · m = add a system manually · Enter = confirm.', 'cyan', output));
   print(output, colorText('  💡 No system listed, or need an extra one? Press m to skip discovery and add any SAP system manually.', 'magenta', output));
   print(output, '');
-  const addManually = async () => (await runManualEntryWizard({ env, input, output, detectAdtUrl })).map(destination => ({
+  const addManually = async () => (await runManualEntryWizard({ env, input, output, detectAdtUrl, selectSsoBrowser })).map(destination => ({
     value: destination,
     name: `${destination.name} (manual, client ${destination.client})`
   }));
@@ -549,10 +590,11 @@ async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin
       }
       if (authMode === 'sso') warnSsoIpHost(destination, promptLabel, output);
       else await maybeConfigureTlsSelfHeal(destination, promptLabel, { input, output });
+      const browserPath = authMode === 'sso' ? await selectSsoBrowser(destination) : undefined;
       destination.authentication = localAuthenticationLabel(authMode);
       destination.authMode = authMode;
       for (const client of clients) {
-        expanded.push(buildLocalClientDestination(destination, client, authMode, { multipleClients: clients.length > 1, duplicateSystemName }));
+        expanded.push(buildLocalClientDestination(destination, client, authMode, { multipleClients: clients.length > 1, duplicateSystemName, browserPath }));
       }
     }
     selected = expanded;
@@ -570,7 +612,8 @@ export async function runSetup({
   confirmCfImport = confirmCloudFoundryImport,
   install = installMcpConfig,
   includeSapDevelopmentToolsPrompt = false,
-  detectAdtUrl
+  detectAdtUrl,
+  discoverSsoBrowsers = findRemoteControllableSsoBrowsers
 } = {}) {
   const isBas = Boolean(env.H2O_URL);
   if (!isBas && (!input.isTTY || !output.isTTY)) {
@@ -581,6 +624,7 @@ export async function runSetup({
     print(output, formatStatus(`Interactive setup needs a terminal. Rerun ${SETUP_COMMAND} from a terminal.`, 'warning', output, 'SAP AI Dev Toolkit'));
     return { skipped: true, reason: 'non-tty' };
   }
+  const selectSsoBrowser = createSsoBrowserSelector({ discoverSsoBrowsers, input, output, env });
   print(output, '');
   print(output, colorText('💡 Tip: you can skip auto-discovery and add a system manually — press m in the destination picker, or take the wizard offer when nothing is found.', 'magenta', output));
   if (!isBas) print(output, formatStatus('Looking for local SAP GUI system configuration.', 'progress', output, 'Setup'));
@@ -721,11 +765,11 @@ export async function runSetup({
       ]
     }, { input, output });
     if (choice !== 'manual') return await exitWithoutDestinations();
-    selected = await runManualEntryWizard({ env, input, output, detectAdtUrl });
+    selected = await runManualEntryWizard({ env, input, output, detectAdtUrl, selectSsoBrowser });
     additiveSetup = true;
     if (!selected.length) return await exitWithoutDestinations();
   } else {
-    selected = await chooseDiscoveredDestinations(destinations, { isBas, input, output, env, detectAdtUrl, previousAdtUrls });
+    selected = await chooseDiscoveredDestinations(destinations, { isBas, input, output, env, detectAdtUrl, previousAdtUrls, selectSsoBrowser });
     additiveSetup = selected.length > 0;
   }
 

package/src/sso-browsers.mjs

@@ -1,8 +1,9 @@
-import { execFile } from 'node:child_process';
-import { access, constants } from 'node:fs/promises';
-import { homedir } from 'node:os';
-import { posix, win32 } from 'node:path';
+import { execFile, spawn } from 'node:child_process';
+import { access, constants, mkdtemp, rm } from 'node:fs/promises';
+import { homedir, tmpdir } from 'node:os';
+import { join, posix, win32 } from 'node:path';
 import { promisify } from 'node:util';
+import { WebSocket } from 'undici';
 
 const execFileAsync = promisify(execFile);
 
@@ -59,6 +60,155 @@ async function fileExists(path) {
   }
 }
 
+function remoteDebuggingEndpoint(output) {
+  return /DevTools listening on (ws:\/\/[^\s]+)/.exec(output)?.[1] || '';
+}
+
+function waitForRemoteDebuggingEndpoint(child, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    let output = '';
+    let settled = false;
+    const finish = (error, endpoint) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.stdout?.off('data', onData);
+      child.stderr?.off('data', onData);
+      child.off('error', onError);
+      child.off('close', onClose);
+      if (error) reject(error);
+      else resolve(endpoint);
+    };
+    const onData = chunk => {
+      output = `${output}${chunk}`.slice(-8192);
+      const endpoint = remoteDebuggingEndpoint(output);
+      if (endpoint) finish(null, endpoint);
+    };
+    const onError = error => finish(error);
+    const onClose = (code, signal) => finish(new Error(`browser exited before exposing DevTools (code ${code ?? 'unknown'}, signal ${signal || 'none'})`));
+    const timer = setTimeout(() => finish(new Error(`browser did not expose DevTools within ${timeoutMs}ms`)), timeoutMs);
+    child.stdout?.on('data', onData);
+    child.stderr?.on('data', onData);
+    child.once('error', onError);
+    child.once('close', onClose);
+  });
+}
+
+function controlBrowser(endpoint, timeoutMs) {
+  const url = new URL(endpoint);
+  if (url.protocol !== 'ws:' || !['localhost', '127.0.0.1', '::1', '[::1]'].includes(url.hostname)) {
+    throw new Error('browser exposed a non-local DevTools endpoint');
+  }
+
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const socket = new WebSocket(url.href);
+    const finish = error => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try { socket.close(); } catch {}
+      if (error) reject(error);
+      else resolve();
+    };
+    const timer = setTimeout(() => finish(new Error(`DevTools command timed out after ${timeoutMs}ms`)), timeoutMs);
+    socket.addEventListener('open', () => socket.send(JSON.stringify({ id: 1, method: 'Browser.getVersion' })));
+    socket.addEventListener('message', event => {
+      let response;
+      try { response = JSON.parse(event.data); }
+      catch { return finish(new Error('DevTools returned an invalid response')); }
+      if (response.id !== 1) return;
+      if (response.error) return finish(new Error(response.error.message || 'DevTools rejected Browser.getVersion'));
+      if (!response.result?.product) return finish(new Error('DevTools returned no browser version'));
+      finish();
+    });
+    socket.addEventListener('error', () => finish(new Error('could not connect to the browser DevTools endpoint')));
+    socket.addEventListener('close', () => {
+      if (!settled) finish(new Error('browser closed the DevTools connection'));
+    });
+  });
+}
+
+function waitForClose(child, timeoutMs) {
+  return new Promise(resolve => {
+    if (child.exitCode !== null || child.signalCode !== null) return resolve(true);
+    const timer = setTimeout(() => {
+      child.off('close', onClose);
+      resolve(false);
+    }, timeoutMs);
+    const onClose = () => {
+      clearTimeout(timer);
+      resolve(true);
+    };
+    child.once('close', onClose);
+  });
+}
+
+async function signalBrowserTree(child, platform, signal) {
+  if (platform === 'win32' && child.pid) {
+    try {
+      await execFileAsync('taskkill', [
+        '/pid', String(child.pid), '/t',
+        ...(signal === 'SIGKILL' ? ['/f'] : [])
+      ], { windowsHide: true, timeout: 1000 });
+      return;
+    } catch {}
+  }
+  try {
+    if (platform !== 'win32' && child.pid) process.kill(-child.pid, signal);
+    else child.kill(signal);
+  } catch {
+    try { child.kill(signal); } catch {}
+  }
+}
+
+async function stopBrowser(child, platform) {
+  if (!child || child.exitCode !== null || child.signalCode !== null) return;
+  await signalBrowserTree(child, platform, 'SIGTERM');
+  if (await waitForClose(child, 1000)) return;
+  await signalBrowserTree(child, platform, 'SIGKILL');
+  await waitForClose(child, 1000);
+}
+
+export async function probeSsoBrowser(browser, {
+  platform = process.platform,
+  timeoutMs = 5000,
+  spawnBrowser = spawn,
+  controlRemote = controlBrowser
+} = {}) {
+  let profile;
+  let child;
+  try {
+    profile = await mkdtemp(join(tmpdir(), 'sap-ai-dev-sso-probe-'));
+    child = spawnBrowser(browser.path, [
+      `--user-data-dir=${profile}`,
+      '--remote-debugging-port=0',
+      '--headless=new',
+      '--no-first-run',
+      '--no-default-browser-check',
+      'about:blank'
+    ], { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, detached: platform !== 'win32' });
+    const endpoint = await waitForRemoteDebuggingEndpoint(child, timeoutMs);
+    await controlRemote(endpoint, timeoutMs);
+    return { usable: true };
+  } catch (error) {
+    const reason = String(error?.message || error).replace(/\s+/g, ' ').slice(0, 240);
+    return { usable: false, reason };
+  } finally {
+    await stopBrowser(child, platform);
+    if (profile) await rm(profile, { recursive: true, force: true });
+  }
+}
+
+export async function findRemoteControllableSsoBrowsers({ probe = probeSsoBrowser, ...options } = {}) {
+  const candidates = await findSsoBrowsers(options);
+  const results = await Promise.all(candidates.map(async browser => ({ browser, ...await probe(browser) })));
+  return {
+    browsers: results.filter(result => result.usable).map(result => result.browser),
+    unavailable: results.filter(result => !result.usable).map(({ browser, reason }) => ({ ...browser, reason }))
+  };
+}
+
 // Every Chromium-based browser the runtime can drive, best first; SAP_BROWSER_EXEC pins one ahead of the rest.
 export async function findSsoBrowsers({ env = process.env, platform = process.platform, exists = fileExists, appPaths = registeredAppPaths } = {}) {
   const candidates = [];

package/tools.md

@@ -72,11 +72,12 @@ Hidden upstream tools are not directly callable through the proxy. Local workflo
 
 Broad/destructive surfaces such as object deletion, SQL trace, arbitrary SAP router calls, transport release/delete, RFC execution, debugger listen/delete-breakpoint helpers, and one-off generator/update helpers are intentionally not advertised by the BAS proxy. UI5 repository writes are hidden too: the ADT filestore only reads UI5 apps, so deploy them with SAP Fiori tools instead.
 
-## Destination-scoped workflow tools
+## Local and destination-scoped workflow tools
 
-The proxy adds local multi-step tools to each destination when their required upstream capabilities are available. Like the upstream tools above, they are exposed publicly in lowercase snake_case (`lint_abap`, `get_application_log`, `prepare_abap_change_set`, and so on):
+The proxy adds local tools to the MCP surface. Some are workspace-wide; others are added to each destination when their required upstream capabilities are available. Like the upstream tools above, they are exposed publicly in lowercase snake_case (`lint_abap`, `lint_abap_project`, `get_application_log`, and so on):
 
 - `LintABAP` — local in-memory ABAP linting.
+- `LintABAPProject` — scan serialized ABAP objects in the configured workspace root (SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT, defaulting to the MCP server working directory) using the project abaplint config and available local dependency folders. This is static analysis only; it does not contact SAP or activate objects.
 - `GetApplicationLog` — bounded convenience mapping to the upstream SAP application-log route when available.
 - `PrepareABAPChangeSet` and `ApplyABAPChangeSet` — review full-source diffs and recheck source before explicit writes.
 - `CheckTransportReadiness` — collect a whitelisted bundle of transport, dependency, inactive-object, ABAP Unit, and ATC results.