sap-ai-dev-toolkit 0.9.9906 → 0.9.9908

package/README.md

@@ -15,7 +15,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/badge/SAP-Business%20Application%20Studio-0A6ED1?style=flat-square&logo=sap&logoColor=white" alt="SAP Business Application Studio">
-  <img src="https://img.shields.io/badge/AI%20agents-Copilot%20%7C%20Claude%20%7C%20Codex%20%7C%20Cursor%20%7C%20Gemini%20%7C%20opencode%20%7C%20Pi-000000?style=flat-square" alt="Works with GitHub Copilot, Claude Code, OpenAI Codex, Cursor, Gemini CLI, opencode, and Pi Coding Agent">
+  <img src="https://img.shields.io/badge/AI%20agents-Copilot%20%7C%20Claude%20%7C%20Codex%20%7C%20Cursor%20%7C%20Gemini%20%7C%20opencode%20%7C%20Pi%20%7C%20OMP%20%7C%20Cline%20%7C%20Roo%20%7C%20Windsurf-000000?style=flat-square" alt="Works with GitHub Copilot, Claude Code, OpenAI Codex, Cursor, Gemini CLI, opencode, Pi Coding Agent, Oh My Pi, Cline, Roo Code, and Windsurf">
   <img src="https://img.shields.io/badge/MCP-enabled-7B61FF?style=flat-square" alt="MCP enabled">
   <img src="https://img.shields.io/badge/SAP%20ADT-connected-0A6ED1?style=flat-square&logo=sap&logoColor=white" alt="SAP ADT connected">
   <img src="https://img.shields.io/badge/ABAP-CDS%20%7C%20RAP-EA4AAA?style=flat-square" alt="ABAP CDS RAP">
@@ -89,7 +89,7 @@ Use the attached destination-prefixed tools directly in chat. Do not launch `sap
 
 **Included skills:** `abap-development` · `abap-testing-quality` · `cds-development` · `rap-development` · `abap-debugging` · `abap-runtime-analysis` · `rap-service-delivery` · `sap-standard-api-analysis` · `clean-core-extensibility` · `sap-sdlc-orchestration` · `sap-transport-release` · `hana-cloud-inspection` · `hana-cloud-native-development` · `hana-cloud-validation`
 
-Agents and skills install for the harnesses you pick during global installation: a multi-select offers GitHub Copilot and Claude Code pre-checked, plus OpenAI Codex, Cursor, Gemini CLI, opencode, and Pi Coding Agent. In non-interactive installs they are installed for GitHub Copilot only; run `sap-ai-dev --setup` afterwards to configure destinations or local SAP GUI systems. Repository-scoped installation instructions appear below.
+Agents and skills install for the harnesses you pick during global installation: a multi-select offers GitHub Copilot and Claude Code pre-checked, plus OpenAI Codex, Cursor, Gemini CLI, opencode, Pi Coding Agent, Oh My Pi (OMP), Cline, Roo Code, and Windsurf / Devin Desktop. In non-interactive installs they are installed for GitHub Copilot only; run `sap-ai-dev --setup` afterwards to configure destinations or local SAP GUI systems. Repository-scoped installation instructions appear below.
 
 ## ✨ Your SAP development cockpit, inside your AI assistant
 
@@ -334,7 +334,7 @@ sap-ai-dev --setup
 5. Choose Windows / smart card SSO or username/password when the prompt is available.
 6. Start each generated MCP server from VS Code's **MCP: List Servers** command.
 
-The same postinstall offers the bundled agents and skills for several AI coding harnesses in a checkbox picker. **GitHub Copilot** and **Claude Code** start pre-checked, so pressing **Enter** alone installs both; **Space** selects or deselects a harness, **a** toggles all seven, and confirming with none selected skips the step without changing files. When MCP setup succeeds, the generated managed MCP servers are also mirrored into selected harnesses that have a stable user-level JSON MCP configuration (Claude Code, Cursor, Gemini CLI, and Pi Coding Agent). GitHub Copilot continues to use the VS Code/BAS MCP configuration written during setup. With no interactive terminal, the assets are installed for GitHub Copilot only; set `SAP_AI_DEV_TOOLKIT_HARNESSES` to a comma-separated list of harness ids (`github-copilot`, `claude-code`, `codex`, `cursor`, `gemini-cli`, `opencode`, `pi-coding-agent`) to choose non-interactively.
+The same postinstall offers the bundled agents and skills for several AI coding harnesses in a checkbox picker. **GitHub Copilot** and **Claude Code** start pre-checked, so pressing **Enter** alone installs both; **Space** selects or deselects a harness, **a** toggles all eleven, and confirming with none selected skips the step without changing files. When MCP setup succeeds, generated managed MCP servers are also mirrored into selected harnesses with documented user-level JSON configuration (Claude Code, Cursor, Gemini CLI, Pi Coding Agent, OMP, and Windsurf / Devin Desktop). GitHub Copilot continues to use the VS Code/BAS MCP configuration written during setup. With no interactive terminal, the assets are installed for GitHub Copilot only; set `SAP_AI_DEV_TOOLKIT_HARNESSES` to a comma-separated list of harness ids (`github-copilot`, `claude-code`, `codex`, `cursor`, `gemini-cli`, `opencode`, `pi-coding-agent`, `omp`, `cline`, `roo-code`, `windsurf`) to choose non-interactively.
 
 Some current npm versions also require install hooks to be approved. If npm reports that `sap-ai-dev-toolkit`'s `postinstall` was blocked, allow it during a fresh install with `npm install --global --allow-scripts=sap-ai-dev-toolkit sap-ai-dev-toolkit`, or run `sap-ai-dev --setup` from an interactive terminal after installation.
 
@@ -418,6 +418,10 @@ During npm postinstall, or after interactive `sap-ai-dev --setup` in BAS or on a
 | Gemini CLI | `$HOME/.gemini/skills/` | — | `$HOME/.gemini/settings.json` |
 | opencode | `$XDG_CONFIG_HOME/opencode/skills/` (default `$HOME/.config/opencode/skills/`) | `$XDG_CONFIG_HOME/opencode/agents/<id>.md` (as subagents) | Not changed automatically |
 | Pi Coding Agent | `$PI_CODING_AGENT_DIR/skills/` (default `$HOME/.pi/agent/skills/`) | `$PI_CODING_AGENT_DIR/prompts/<id>.md` (as `/` prompt commands) | `$PI_CODING_AGENT_DIR/mcp.json` (default `$HOME/.pi/agent/mcp.json`) |
+| Oh My Pi (OMP) | `$HOME/.omp/agent/skills/` (overridden by `PI_CONFIG_DIR` or `PI_CODING_AGENT_DIR`) | — | `$HOME/.omp/agent/mcp.json` (same overrides) |
+| Cline | `$HOME/.cline/skills/` | — | Not changed automatically |
+| Roo Code | `$HOME/.roo/skills/` | — | Not changed automatically |
+| Windsurf / Devin Desktop | `$XDG_CONFIG_HOME/devin/skills/` (default `$HOME/.config/devin/skills/`); Windows: `$HOME/.codeium/windsurf/skills/` | — | `$XDG_CONFIG_HOME/devin/mcp_config.json` (default `$HOME/.config/devin/mcp_config.json`); Windows: `%APPDATA%\devin\mcp_config.json` |
 
 All 14 skills use the portable `SKILL.md` format and are installed verbatim. The 5 agents use Copilot's `.agent.md` format, so they are installed as native custom agents for harnesses with a custom-agent mechanism (GitHub Copilot, Claude Code, opencode), with frontmatter adapted where needed. Pi receives equivalent prompt templates (`/abap-developer`, `/sap-solution-architect`, and so on) because Pi exposes reusable personas through prompts rather than a separate custom-agent file type. Selecting several harnesses duplicates the small markdown payloads on disk.
 

package/dist/checksums.txt

@@ -1,5 +1,5 @@
-87b75dce6f9517696d1326526ae06bf1c216695283db7b2ee34f47335a861892  vsp-linux-x64
-c118ccd7043fc2eef9ad34d62ad78fb64c3ef3b4114d65b337b8d855b7b40f0d  vsp-linux-arm64
-c66c6b75b83d3d581f859fa0a21c5a6a6ca0c168019353e3cd34ac8ed4632e7e  vsp-darwin-x64
-6b7833dfd6de0b2d1f6dab921e6ba7dd795217c733552413b4382925590f4388  vsp-darwin-arm64
-8d1f0bf29a83d3b301c5bb9a34811c8c2a84d63285b93a7a393d0c942bf1d2f6  vsp-win32-x64.exe
+f10b759b5e320c6fec4c176ef9bce49f783d796eeb8a2476dd5898c94cb14afd  vsp-linux-x64
+a4c47e4c15538cc16b540d19f55771e4c1340389efeca815e1881eafd89e45c5  vsp-linux-arm64
+20a197921c88f539ea1a7f5236509dbaa9b9f906a6333e6fb1dce9f8b5eec85c  vsp-darwin-x64
+24a8810a17d31a434b92957ea41e6347b24e2a6a35e47b3b2fc13a16082a44c3  vsp-darwin-arm64
+b318fdf5194a7f15ebcf7ee912fb2493df21aba337540a2402f81786300fd0ea  vsp-win32-x64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.9.9906",
+  "version": "0.9.9908",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",
@@ -9,7 +9,7 @@
   },
   "dependencies": {
     "@abaplint/core": "2.119.0",
-    "@modelcontextprotocol/sdk": "1.30.1",
+    "@modelcontextprotocol/sdk": "1.32.1",
     "@sap/hana-client": "2.30.27",
     "terminal-kit": "^3.1.4",
     "undici": "^6.21.3",

package/patches/vsp-bas-proxy-auth.patch

@@ -620,10 +620,30 @@ index 0000000..5e880bd
 +	}
 +}
 diff --git a/pkg/adt/http.go b/pkg/adt/http.go
-index 0b4d9f1..3473536 100755
+index 0b4d9f1..f0b5b51 100755
 --- a/pkg/adt/http.go
 +++ b/pkg/adt/http.go
-@@ -499,6 +499,7 @@ func (t *Transport) fetchCSRFTokenFor(ctx context.Context, stateful bool) error
+@@ -313,7 +313,7 @@ func (t *Transport) request(ctx context.Context, path string, opts *RequestOptio
+ 	// The same expiry reaches a plain read as a successful-looking response that
+ 	// was in fact served by the identity provider. Nothing downstream would
+ 	// recognise the logon page it carries, so catch it here by origin.
+-	if resp.StatusCode < 400 && t.canReauth() && t.redirectedAwayFromSAP(resp) {
++	if t.canReauth() && ((resp.StatusCode < 400 && t.redirectedAwayFromSAP(resp)) || isSSOLoginResponse(resp, body)) {
+ 		t.setCSRFToken("")
+ 		t.setSessionID("")
+ 		if err := t.callReauthFunc(ctx); err != nil {
+@@ -448,6 +448,10 @@ func (t *Transport) retryRequest(ctx context.Context, path string, opts *Request
+ 	}
+ 	traceHTTPResponse(resp, body)
+ 
++	if t.canReauth() && (t.redirectedAwayFromSAP(resp) || isSSOLoginResponse(resp, body)) {
++		return nil, fmt.Errorf("SSO session is still unauthenticated after re-authentication on %s", path)
++	}
++
+ 	if resp.StatusCode >= 400 {
+ 		return nil, &APIError{
+ 			StatusCode: resp.StatusCode,
+@@ -499,6 +503,7 @@ func (t *Transport) fetchCSRFTokenFor(ctx context.Context, stateful bool) error
  // allowReauth exists to break a cycle: re-authenticating ends with a token
  // fetch of its own, and that fetch must not start another re-authentication.
  func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bool, stateful bool) error {
@@ -631,7 +651,7 @@ index 0b4d9f1..3473536 100755
  	token, status, redirected, err := t.probeCSRFToken(ctx, http.MethodHead, stateful)
  	if err != nil {
  		return err
-@@ -513,6 +514,29 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+@@ -513,6 +518,29 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
  		if err != nil {
  			return err
  		}
@@ -661,7 +681,16 @@ index 0b4d9f1..3473536 100755
  		if !isCSRFToken(token) {
  			// An expired SSO session rarely announces itself as a 401. ICF sends
  			// the request on to the identity provider, the redirect chain is
-@@ -537,6 +561,9 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+@@ -520,7 +548,7 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+ 			// 200 — with no CSRF token in it, because it is not ADT answering.
+ 			// A live ADT session always yields a token, so its absence here is
+ 			// the signal, and a hop to a foreign host is the confirmation.
+-			if allowReauth && t.canReauth() && getStatus != http.StatusForbidden {
++			if allowReauth && t.canReauth() && (getStatus != http.StatusForbidden || redirected || getRedirected) {
+ 				reason := fmt.Sprintf("no CSRF token (HEAD %d, GET %d)", status, getStatus)
+ 				if redirected || getRedirected {
+ 					reason = "the identity provider answered instead of SAP"
+@@ -537,6 +565,9 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
  				}
  				return t.fetchCSRFTokenWithReauth(ctx, false, stateful)
  			}
@@ -671,7 +700,7 @@ index 0b4d9f1..3473536 100755
  			switch getStatus {
  			case http.StatusUnauthorized:
  				return fmt.Errorf("authentication failed (401): check username/password")
-@@ -556,7 +583,11 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+@@ -556,7 +587,11 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
  // returns the token (empty when the server did not supply one), the status, and
  // whether the answer came from somewhere other than the SAP host.
  func (t *Transport) probeCSRFToken(ctx context.Context, method string, stateful bool) (token string, status int, redirected bool, err error) {
@@ -684,6 +713,42 @@ index 0b4d9f1..3473536 100755
  	if err != nil {
  		return "", 0, false, fmt.Errorf("building URL: %w", err)
  	}
+@@ -596,12 +631,34 @@ func (t *Transport) probeCSRFToken(ctx context.Context, method string, stateful
+ 		return "", 0, false, fmt.Errorf("executing request: %w", err)
+ 	}
+ 	defer resp.Body.Close()
++	body, err := io.ReadAll(io.LimitReader(resp.Body, 64*1024))
++	if err != nil {
++		return "", 0, false, fmt.Errorf("reading CSRF response: %w", err)
++	}
+ 	// Drain the body so the connection can be reused.
+ 	_, _ = io.Copy(io.Discard, resp.Body)
+ 	traceHTTPResponse(resp, nil)
+ 	t.adoptServerCookies(resp)
+ 
+-	return resp.Header.Get("X-CSRF-Token"), resp.StatusCode, t.redirectedAwayFromSAP(resp), nil
++	return resp.Header.Get("X-CSRF-Token"), resp.StatusCode, t.redirectedAwayFromSAP(resp) || isSSOLoginResponse(resp, body), nil
++}
++
++func isSSOLoginResponse(resp *http.Response, body []byte) bool {
++	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusForbidden {
++		return false
++	}
++	page := strings.ToLower(strings.TrimSpace(string(body)))
++	html := strings.Contains(strings.ToLower(resp.Header.Get("Content-Type")), "text/html") ||
++		strings.HasPrefix(page, "<!doctype html") || strings.HasPrefix(page, "<html")
++	if !html || !strings.Contains(page, "<form") {
++		return false
++	}
++	for _, marker := range []string{"samlrequest", "samlresponse", "sap-system-login", "sap-password", `type="password"`, `type='password'`} {
++		if strings.Contains(page, marker) {
++			return true
++		}
++	}
++	return false
+ }
+ 
+ // redirectedAwayFromSAP reports whether a response was ultimately served by
 diff --git a/pkg/adt/http_csrf_discovery_test.go b/pkg/adt/http_csrf_discovery_test.go
 new file mode 100644
 index 0000000..80741da
@@ -746,6 +811,98 @@ index 0000000..80741da
 +	}
 +}
 +
+diff --git a/pkg/adt/http_sso_same_host_test.go b/pkg/adt/http_sso_same_host_test.go
+new file mode 100644
+index 0000000..0c39b96
+--- /dev/null
++++ b/pkg/adt/http_sso_same_host_test.go
+@@ -0,0 +1,86 @@
++package adt
++
++import (
++	"context"
++	"io"
++	"net/http"
++	"net/http/httptest"
++	"strings"
++	"testing"
++)
++
++func TestSameHostLoginPageRefreshesSSO(t *testing.T) {
++	for _, method := range []string{http.MethodGet, http.MethodPost} {
++		for _, status := range []int{http.StatusOK, http.StatusUnauthorized, http.StatusForbidden} {
++			t.Run(method+"/"+http.StatusText(status), func(t *testing.T) {
++				refreshes := 0
++				server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++					cookie, err := r.Cookie("SAP_SESSIONID")
++					if err != nil || cookie.Value != "fresh" {
++						w.Header().Set("Content-Type", "text/html; charset=utf-8")
++						w.WriteHeader(status)
++						_, _ = io.WriteString(w, `<html><body><form action="/sap/saml2/sp/acs"><input name="SAMLRequest" value="fixture"></form></body></html>`)
++						return
++					}
++					w.Header().Set("X-CSRF-Token", "fresh-token")
++					w.Header().Set("Content-Type", "application/xml")
++					_, _ = io.WriteString(w, "<source>authenticated</source>")
++				}))
++				defer server.Close()
++				transport := NewTransportWithClient(&Config{
++					BaseURL: server.URL,
++					Cookies: map[string]string{"SAP_SESSIONID": "expired"},
++					ReauthFunc: func(context.Context) (map[string]string, error) {
++						refreshes++
++						return map[string]string{"SAP_SESSIONID": "fresh"}, nil
++					},
++				}, server.Client())
++				response, err := transport.Request(context.Background(), "/sap/bc/adt/source", &RequestOptions{Method: method})
++				if err != nil {
++					t.Fatalf("request failed: %v", err)
++				}
++				if refreshes != 1 || string(response.Body) != "<source>authenticated</source>" {
++					t.Fatalf("refreshes=%d body=%q, want one SSO refresh and authenticated source", refreshes, response.Body)
++				}
++			})
++		}
++	}
++}
++
++func TestOrdinaryForbiddenDoesNotRefreshSSO(t *testing.T) {
++	refreshes := 0
++	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++		w.WriteHeader(http.StatusForbidden)
++		_, _ = io.WriteString(w, "Missing development authorization")
++	}))
++	defer server.Close()
++	transport := NewTransportWithClient(&Config{BaseURL: server.URL, ReauthFunc: func(context.Context) (map[string]string, error) {
++		refreshes++
++		return nil, nil
++	}}, server.Client())
++	_, err := transport.Request(context.Background(), "/sap/bc/adt/source", &RequestOptions{Method: http.MethodGet})
++	if err == nil || refreshes != 0 {
++		t.Fatalf("err=%v refreshes=%d, want authorization error without SSO refresh", err, refreshes)
++	}
++}
++
++func TestSSOLoginPageAfterRefreshFailsWithoutLoop(t *testing.T) {
++	refreshes := 0
++	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++		if r.URL.Path == "/sap/bc/adt/source" {
++			w.Header().Set("Content-Type", "text/html")
++			_, _ = io.WriteString(w, `<html><form><input type="password"></form></html>`)
++			return
++		}
++		w.Header().Set("X-CSRF-Token", "fresh-token")
++	}))
++	defer server.Close()
++	transport := NewTransportWithClient(&Config{BaseURL: server.URL, ReauthFunc: func(context.Context) (map[string]string, error) {
++		refreshes++
++		return map[string]string{"SAP_SESSIONID": "fresh"}, nil
++	}}, server.Client())
++	_, err := transport.Request(context.Background(), "/sap/bc/adt/source", &RequestOptions{Method: http.MethodGet})
++	if err == nil || !strings.Contains(err.Error(), "still unauthenticated") || refreshes != 1 {
++		t.Fatalf("err=%v refreshes=%d, want explicit failure after one refresh", err, refreshes)
++	}
++}
 diff --git a/pkg/adt/servicebinding_publish_test.go b/pkg/adt/servicebinding_publish_test.go
 new file mode 100644
 index 0000000..93c19f9

package/src/abaplint.mjs

@@ -1,5 +1,13 @@
+import { lstat, readdir, readFile, realpath } from 'node:fs/promises';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
 import { Config, MemoryFile, Registry } from '@abaplint/core';
 
+const MAX_PROJECT_FILES = 20_000;
+const MAX_PROJECT_FILE_BYTES = 2 * 1024 * 1024;
+const MAX_PROJECT_SOURCE_BYTES = 32 * 1024 * 1024;
+const IGNORED_DIRECTORIES = new Set(['.git', '.hg', '.svn', '.build', '.next', '.cache', 'coverage', 'dist', 'node_modules']);
+const PROJECT_CONFIG_FILES = ['.abaplint.jsonc', 'abaplint.jsonc', '.abaplint.json', 'abaplint.json'];
+
 export const ABAP_LINT_TOOL = {
   name: 'LintABAP',
   description: 'Run abaplint on caller-supplied source files in memory; does not read workspace files or call SAP.',
@@ -26,6 +34,21 @@ export const ABAP_LINT_TOOL = {
   }
 };
 
+export const ABAP_LINT_PROJECT_TOOL = {
+  name: 'LintABAPProject',
+  description: 'Run read-only abaplint checks over serialized ABAP objects under the configured workspace root. Loads the project config and local dependency folders when present; does not call SAP, write files, or activate ABAP.',
+  inputSchema: {
+    type: 'object',
+    properties: {
+      directory: { type: 'string', description: 'Optional project subdirectory relative to the configured workspace root.' },
+      config: { type: 'object', description: 'Optional abaplint config object that overrides project config discovery.' }
+    },
+    required: [],
+    additionalProperties: false
+  },
+  annotations: { readOnlyHint: true }
+};
+
 function isObject(value) {
   return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
@@ -65,6 +88,170 @@ function errorResult(error) {
   };
 }
 
+function reportResult(report) {
+  return {
+    isError: false,
+    content: [{ type: 'text', text: JSON.stringify(report) }],
+    structuredContent: report
+  };
+}
+
+function lintReport(registry, filesChecked) {
+  const issues = registry.findIssues();
+  const counts = { Error: 0, Warning: 0, Info: 0 };
+  const reportIssues = issues.map(issue => {
+    counts[issue.getSeverity()] += 1;
+    const start = issue.getStart();
+    const end = issue.getEnd();
+    return {
+      filename: issue.getFilename(),
+      rule: issue.getKey(),
+      severity: issue.getSeverity(),
+      message: issue.getMessage(),
+      start: { line: start.getRow(), column: start.getCol() },
+      end: { line: end.getRow(), column: end.getCol() }
+    };
+  });
+  return {
+    status: reportIssues.length === 0 ? 'clean' : 'issues',
+    filesChecked,
+    issueCount: reportIssues.length,
+    errors: counts.Error,
+    warnings: counts.Warning,
+    infos: counts.Info,
+    issues: reportIssues
+  };
+}
+
+function pathIsWithin(parent, candidate) {
+  const path = relative(parent, candidate);
+  return path === '' || (path !== '..' && !path.startsWith(`..${sep}`) && !isAbsolute(path));
+}
+
+function validateProjectArguments(arguments_) {
+  if (!isObject(arguments_)) throw new Error('Arguments must be an object');
+  rejectUnknownFields(arguments_, new Set(['directory', 'config']), 'argument');
+  if (arguments_.directory !== undefined) {
+    if (typeof arguments_.directory !== 'string' || arguments_.directory.includes('\0') ||
+        isAbsolute(arguments_.directory) || /^[A-Za-z]:[\\/]/.test(arguments_.directory) ||
+        arguments_.directory.split(/[\\/]+/).includes('..')) {
+      throw new Error('directory must be a relative path inside the configured workspace root');
+    }
+  }
+  if (arguments_.config !== undefined && !isObject(arguments_.config)) {
+    throw new Error('config must be an object');
+  }
+}
+
+async function loadProjectConfig(directory, override) {
+  if (override !== undefined) return { config: new Config(JSON.stringify(override)), source: 'caller' };
+  for (const filename of PROJECT_CONFIG_FILES) {
+    const configPath = resolve(directory, filename);
+    let info;
+    try { info = await lstat(configPath); }
+    catch (error) {
+      if (error?.code === 'ENOENT') continue;
+      throw error;
+    }
+    if (info.isSymbolicLink() || !info.isFile()) throw new Error(`${filename} must be a regular file inside the workspace`);
+    try {
+      return { config: new Config(await readFile(configPath, 'utf8')), source: filename };
+    } catch (error) {
+      throw new Error(`Could not load ${filename}: ${error.message || error}`);
+    }
+  }
+  return { config: Config.getDefault(), source: 'default' };
+}
+
+function enableSyntaxRules(config) {
+  const projectConfig = config.get();
+  const rules = { ...(projectConfig.rules || {}) };
+  const disabled = [];
+  for (const rule of ['parser_error', 'check_syntax']) {
+    if (rules[rule] === false) disabled.push(rule);
+    else if (rules[rule] === undefined) rules[rule] = true;
+  }
+  return {
+    config: new Config(JSON.stringify({ ...projectConfig, rules })),
+    disabled
+  };
+}
+
+async function dependencyRoots(config, projectRoot) {
+  const declared = config.get()?.dependencies;
+  if (!Array.isArray(declared)) return { roots: [], missing: [], count: 0 };
+  const roots = [];
+  const missing = [];
+  for (const dependency of declared) {
+    const folder = dependency?.folder;
+    if (typeof folder !== 'string' || !folder.trim()) {
+      missing.push(String(folder || '(unspecified folder)'));
+      continue;
+    }
+    const relativeFolder = folder.replace(/^[\\/]+/, '');
+    if (/^[A-Za-z]:[\\/]/.test(relativeFolder) || relativeFolder.split(/[\\/]+/).includes('..')) {
+      throw new Error('Dependency folders must stay inside the configured project directory');
+    }
+    const candidate = resolve(projectRoot, relativeFolder || '.');
+    if (!pathIsWithin(projectRoot, candidate)) throw new Error('Dependency folders must stay inside the configured project directory');
+    let canonical;
+    try { canonical = await realpath(candidate); }
+    catch (error) {
+      if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') {
+        missing.push(folder);
+        continue;
+      }
+      throw error;
+    }
+    if (!pathIsWithin(projectRoot, canonical)) throw new Error('Dependency folders must stay inside the configured project directory');
+    const info = await lstat(canonical);
+    if (!info.isDirectory()) {
+      missing.push(folder);
+      continue;
+    }
+    roots.push(canonical);
+  }
+  return { roots, missing, count: declared.length };
+}
+
+async function collectProjectFiles(projectRoot, dependencies) {
+  const sourceFiles = [];
+  const dependencyFiles = [];
+  const pending = [projectRoot];
+  let totalBytes = 0;
+  while (pending.length) {
+    const directory = pending.pop();
+    const entries = await readdir(directory, { withFileTypes: true });
+    entries.sort((left, right) => left.name.localeCompare(right.name));
+    for (const entry of entries) {
+      const absolutePath = resolve(directory, entry.name);
+      if (entry.isDirectory()) {
+        const isDependencyPath = dependencies.some(root => pathIsWithin(absolutePath, root) || pathIsWithin(root, absolutePath));
+        if (!IGNORED_DIRECTORIES.has(entry.name) || isDependencyPath) pending.push(absolutePath);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const filename = relative(projectRoot, absolutePath).split(sep).join('/');
+      const basename = filename.split('/').at(-1);
+      const nameParts = basename.split('.');
+      if (nameParts.length < 3 || !nameParts[0] || !nameParts[1]) continue;
+      if (!new MemoryFile(filename, '').getObjectType()) continue;
+      const info = await lstat(absolutePath);
+      if (!info.isFile() || info.isSymbolicLink()) continue;
+      if (info.size > MAX_PROJECT_FILE_BYTES) throw new Error(`ABAP file exceeds ${MAX_PROJECT_FILE_BYTES} bytes: ${filename}`);
+      totalBytes += info.size;
+      if (totalBytes > MAX_PROJECT_SOURCE_BYTES) throw new Error(`Workspace ABAP sources exceed ${MAX_PROJECT_SOURCE_BYTES} bytes`);
+      const file = new MemoryFile(filename, await readFile(absolutePath, 'utf8'));
+      const isDependency = dependencies.some(root => pathIsWithin(root, absolutePath));
+      (isDependency ? dependencyFiles : sourceFiles).push(file);
+      if (sourceFiles.length + dependencyFiles.length > MAX_PROJECT_FILES) {
+        throw new Error(`Workspace contains more than ${MAX_PROJECT_FILES} ABAP files`);
+      }
+    }
+  }
+  return { sourceFiles, dependencyFiles };
+}
+
 export async function runABAPLint(arguments_) {
   try {
     validateArguments(arguments_);
@@ -74,31 +261,49 @@ export async function runABAPLint(arguments_) {
     const files = arguments_.files.map(({ filename, source }) => new MemoryFile(filename, source));
     const registry = new Registry(config).addFiles(files);
     await registry.parseAsync();
-    const issues = registry.findIssues();
-    const counts = { Error: 0, Warning: 0, Info: 0 };
-    const reportIssues = issues.map(issue => {
-      counts[issue.getSeverity()] += 1;
-      const start = issue.getStart();
-      const end = issue.getEnd();
-      return {
-        filename: issue.getFilename(),
-        rule: issue.getKey(),
-        severity: issue.getSeverity(),
-        message: issue.getMessage(),
-        start: { line: start.getRow(), column: start.getCol() },
-        end: { line: end.getRow(), column: end.getCol() }
-      };
+    return { isError: false, content: [{ type: 'text', text: JSON.stringify(lintReport(registry, files.length)) }] };
+  } catch (error) {
+    return errorResult(error);
+  }
+}
+
+export async function runABAPLintProject(arguments_, { workspaceRoot = process.cwd() } = {}) {
+  try {
+    validateProjectArguments(arguments_);
+    const root = await realpath(workspaceRoot);
+    const directory = resolve(root, arguments_.directory || '.');
+    if (!pathIsWithin(root, directory)) throw new Error('directory must stay inside the configured workspace root');
+    const projectRoot = await realpath(directory);
+    if (!pathIsWithin(root, projectRoot)) throw new Error('directory must stay inside the configured workspace root');
+    const projectInfo = await lstat(projectRoot);
+    if (!projectInfo.isDirectory()) throw new Error('directory must identify a workspace directory');
+
+    const { config: projectConfig, source: configSource } = await loadProjectConfig(projectRoot, arguments_.config);
+    const { config, disabled: disabledSyntaxRules } = enableSyntaxRules(projectConfig);
+    const dependencies = await dependencyRoots(config, projectRoot);
+    const { sourceFiles, dependencyFiles } = await collectProjectFiles(projectRoot, dependencies.roots);
+    const registry = new Registry(config);
+    registry.addDependencies(dependencyFiles);
+    registry.addFiles(sourceFiles);
+    await registry.parseAsync();
+
+    const report = lintReport(registry, sourceFiles.length);
+    if (report.filesChecked === 0) report.status = 'no-abap-files';
+    else if (report.status === 'clean' && (dependencies.missing.length || disabledSyntaxRules.length)) report.status = 'incomplete';
+    return reportResult({
+      ...report,
+      scope: 'workspace-static',
+      activation: 'not-performed',
+      workspaceDirectory: arguments_.directory || '.',
+      configSource,
+      targetRelease: config.getVersion(),
+      syntaxRules: { enabled: ['parser_error', 'check_syntax'].filter(rule => !disabledSyntaxRules.includes(rule)), disabled: disabledSyntaxRules },
+      dependencies: {
+        declared: dependencies.count,
+        filesLoaded: dependencyFiles.length,
+        missingFolders: dependencies.missing
+      }
     });
-    const report = {
-      status: reportIssues.length === 0 ? 'clean' : 'issues',
-      filesChecked: files.length,
-      issueCount: reportIssues.length,
-      errors: counts.Error,
-      warnings: counts.Warning,
-      infos: counts.Info,
-      issues: reportIssues
-    };
-    return { isError: false, content: [{ type: 'text', text: JSON.stringify(report) }] };
   } catch (error) {
     return errorResult(error);
   }

package/src/harness-mcp-config.mjs

@@ -7,7 +7,7 @@ import { decodeJsonFileBuffer } from './mcp-config.mjs';
 
 const MANAGED_ENV = 'SAP_AI_DEV_TOOLKIT_MANAGED';
 
-function mcpServersPath(harness, { home = process.env.HOME || homedir(), env = process.env } = {}) {
+function mcpServersPath(harness, { home = process.env.HOME || homedir(), env = process.env, platform = process.platform } = {}) {
   switch (harness.id) {
     case 'claude-code':
       return join(home, '.claude.json');
@@ -15,8 +15,16 @@ function mcpServersPath(harness, { home = process.env.HOME || homedir(), env = p
       return join(harnessRoot(harness, { home, env }), 'mcp.json');
     case 'gemini-cli':
       return join(harnessRoot(harness, { home, env }), 'settings.json');
+    case 'omp':
+      return join(harnessRoot(harness, { home, env }), 'mcp.json');
     case 'pi-coding-agent':
       return join(harnessRoot(harness, { home, env }), 'mcp.json');
+    case 'windsurf': {
+      const configRoot = platform === 'win32'
+        ? (typeof env?.APPDATA === 'string' && env.APPDATA.trim() ? env.APPDATA.trim() : join(home, 'AppData', 'Roaming'))
+        : (typeof env?.XDG_CONFIG_HOME === 'string' && env.XDG_CONFIG_HOME.trim() ? env.XDG_CONFIG_HOME.trim() : join(home, '.config'));
+      return join(configRoot, 'devin', 'mcp_config.json');
+    }
     default:
       return null;
   }

package/src/harnesses.mjs

@@ -1,5 +1,5 @@
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 
 export const HARNESS_ENV_VAR = 'SAP_AI_DEV_TOOLKIT_HARNESSES';
 export const DEFAULT_HARNESS_IDS = ['github-copilot', 'claude-code'];
@@ -38,6 +38,19 @@ export function piCodingAgentRoot({ home = process.env.HOME || homedir(), env =
   return override || join(home, '.pi', 'agent');
 }
 
+export function ompAgentRoot({ home = process.env.HOME || homedir(), env = process.env } = {}) {
+  const agentOverride = typeof env?.PI_CODING_AGENT_DIR === 'string' ? env.PI_CODING_AGENT_DIR.trim() : '';
+  if (agentOverride) return resolve(agentOverride);
+  const configDirectory = typeof env?.PI_CONFIG_DIR === 'string' ? env.PI_CONFIG_DIR.trim() : '';
+  return join(home, configDirectory || '.omp', 'agent');
+}
+
+export function windsurfSkillsRoot({ home = process.env.HOME || homedir(), env = process.env, platform = process.platform } = {}) {
+  if (platform === 'win32') return join(home, '.codeium', 'windsurf');
+  const override = typeof env?.XDG_CONFIG_HOME === 'string' ? env.XDG_CONFIG_HOME.trim() : '';
+  return join(override || join(home, '.config'), 'devin');
+}
+
 export function claudeCodeAgentDocument(source) {
   const frontmatter = splitFrontmatter(source);
   if (!frontmatter) throw new Error('unsupported agent frontmatter');
@@ -86,7 +99,11 @@ export const HARNESSES = [
   { id: 'cursor', label: 'Cursor', directory: '.cursor', supportsAgents: false },
   { id: 'gemini-cli', label: 'Gemini CLI', directory: '.gemini', supportsAgents: false },
   { id: 'opencode', label: 'opencode', directory: 'opencode', configHome: true, supportsAgents: true, agentFileName: agentMarkdownName, agentDocument: opencodeAgentDocument },
-  { id: 'pi-coding-agent', label: 'Pi Coding Agent', directory: '.pi/agent', supportsAgents: true, agentTargetPrefix: 'prompts', agentFileName: agentMarkdownName, agentDocument: piCodingAgentPromptDocument, root: piCodingAgentRoot }
+  { id: 'pi-coding-agent', label: 'Pi Coding Agent', directory: '.pi/agent', supportsAgents: true, agentTargetPrefix: 'prompts', agentFileName: agentMarkdownName, agentDocument: piCodingAgentPromptDocument, root: piCodingAgentRoot },
+  { id: 'omp', label: 'Oh My Pi (OMP)', directory: '.omp/agent', supportsAgents: false, root: ompAgentRoot },
+  { id: 'cline', label: 'Cline', directory: '.cline', supportsAgents: false },
+  { id: 'roo-code', label: 'Roo Code', directory: '.roo', supportsAgents: false },
+  { id: 'windsurf', label: 'Windsurf / Devin Desktop', directory: 'devin', supportsAgents: false, root: windsurfSkillsRoot }
 ];
 
 export function harnessById(id) {
@@ -97,8 +114,8 @@ export function harnessById(id) {
   return harness;
 }
 
-export function harnessRoot(harness, { home = process.env.HOME || homedir(), env = process.env } = {}) {
-  if (harness.root) return harness.root({ home, env });
+export function harnessRoot(harness, { home = process.env.HOME || homedir(), env = process.env, platform = process.platform } = {}) {
+  if (harness.root) return harness.root({ home, env, platform });
   if (harness.configHome) {
     const override = typeof env?.XDG_CONFIG_HOME === 'string' ? env.XDG_CONFIG_HOME.trim() : '';
     return join(override || join(home, '.config'), harness.directory);

package/src/launcher.mjs

@@ -107,7 +107,7 @@ async function runDoctor(destinations) {
       // unprefixed (get_source, run_query); match the slug-prefixed form too
       // in case this ever runs against a multi-destination server.
       const toolPrefix = `${slugifyDestination(destination.name)}_`;
-      const localSegments = new Set(['lint_abap', 'get_application_log', 'prepare_abap_change_set', 'apply_abap_change_set', 'check_transport_readiness', 'plan_abap_cloud_migration', 'generate_rap_regression_suite', 'run_rap_regression_suite']);
+      const localSegments = new Set(['lint_abap', 'lint_abap_project', 'get_application_log', 'prepare_abap_change_set', 'apply_abap_change_set', 'check_transport_readiness', 'plan_abap_cloud_migration', 'generate_rap_regression_suite', 'run_rap_regression_suite']);
       const isUpstreamTool = tool => (tool.name.startsWith(toolPrefix) ? tool.name.slice(toolPrefix.length) : tool.name);
       const upstreamCount = tools.filter(tool => !localSegments.has(isUpstreamTool(tool))).length;
       checks.push(doctorRow(destination.name, 'MCP tools/list', upstreamCount ? 'passed' : 'failed', `${upstreamCount} upstream tools and ${tools.length} total MCP tools returned; chat-picker binding is host-managed`));

package/src/mcp-proxy.mjs

@@ -1,7 +1,7 @@
 import { spawn as nodeSpawn } from 'node:child_process';
 import { once } from 'node:events';
 import { sanitizeChildEnv, slugifyDestination } from './bas-discovery.mjs';
-import { ABAP_LINT_TOOL, runABAPLint } from './abaplint.mjs';
+import { ABAP_LINT_PROJECT_TOOL, ABAP_LINT_TOOL, runABAPLint, runABAPLintProject } from './abaplint.mjs';
 import { createEngineeringTools } from './engineering-tools.mjs';
 import { brandedEnvValue } from './branding.mjs';
 import { diagnosticText, redactText } from './redact.mjs';
@@ -698,6 +698,12 @@ export class MCPProxy {
         });
       }
     }
+    const projectLintName = snakeCaseName(ABAP_LINT_PROJECT_TOOL.name);
+    publish(projectLintName, {
+      handler: arguments_ => runABAPLintProject(arguments_, {
+        workspaceRoot: brandedEnvValue(this.env, 'WORKSPACE_ROOT') || process.cwd()
+      })
+    }, { ...ABAP_LINT_PROJECT_TOOL, name: projectLintName });
     if (!merged.length && this.children.length) throw new Error('No destination child provided tools');
     // Swap atomically so a concurrent tools/call never sees a partial map.
     this.namespace = namespace;

package/src/setup.mjs

@@ -8,6 +8,7 @@ import { adtBaseUrl, adtPort, defaultAdtUrl, discoverSapGuiSystems, hasExplicitP
 import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys, findOrphanedCloudFoundryServiceKeys } from './cf-destination.mjs';
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
 import { discoverCertificateDnsNames } from './tls-adt-proxy.mjs';
+import { findRemoteControllableSsoBrowsers } from './sso-browsers.mjs';
 
 const SETUP_COMMAND = 'sap-ai-dev --setup';
 
@@ -66,6 +67,45 @@ async function chooseLocalAuthMode(destination, { input = stdin, output = stdout
   }, { input, output });
 }
 
+function createSsoBrowserSelector({ discoverSsoBrowsers, input, output, env }) {
+  let selectedPath;
+  let selectionComplete = false;
+  return async destination => {
+    if (selectionComplete) return selectedPath;
+    selectionComplete = true;
+    print(output, formatStatus('Checking installed browsers for remote DevTools access.', 'progress', output, 'SSO'));
+    let result;
+    try {
+      result = await discoverSsoBrowsers({ env });
+    } catch (error) {
+      const reason = String(error?.message || error).replace(/\s+/g, ' ').slice(0, 240);
+      print(output, formatStatus(`Browser control check failed (${reason}). Setup will keep automatic browser discovery.`, 'warning', output, 'SSO'));
+      return undefined;
+    }
+    const { browsers = [], unavailable = [] } = result || {};
+    if (!browsers.length) {
+      const details = unavailable.map(browser => `${browser.name}: ${browser.reason}`).join('; ').slice(0, 300);
+      print(output, formatStatus(`No remotely controllable SSO browser was found${details ? ` (${details})` : ''}. Setup will keep automatic browser discovery.`, 'warning', output, 'SSO'));
+      return undefined;
+    }
+    if (browsers.length === 1) {
+      selectedPath = browsers[0].path;
+      print(output, formatStatus(`Using ${browsers[0].name}; it responded to a remote DevTools command.`, 'success', output, 'SSO browser'));
+      return selectedPath;
+    }
+    selectedPath = await selectPrompt({
+      message: `Browser for SSO (${destination.name})`,
+      defaultValue: browsers[0].path,
+      choices: browsers.map((browser, index) => ({
+        name: `${browser.name} (${browser.path})`,
+        value: browser.path,
+        shortcut: String(index + 1)
+      }))
+    }, { input, output });
+    return selectedPath;
+  };
+}
+
 async function confirmCloudFoundryImport({ input = stdin, output = stdout } = {}) {
   const readline = createInterface({ input, output });
   try {
@@ -238,7 +278,7 @@ async function confirmPrompt(message, { input = stdin, output = stdout } = {}) {
   return !/^n(?:o)?$/i.test(String(answer || '').trim());
 }
 
-function buildLocalClientDestination(destination, client, authMode, { multipleClients = false, duplicateSystemName = false } = {}) {
+function buildLocalClientDestination(destination, client, authMode, { multipleClients = false, duplicateSystemName = false, browserPath } = {}) {
   const name = localClientDestinationName(destination, client, { multipleClients, duplicateSystemName });
   const localDestination = { ...destination, name, serverName: name, client };
   const userInputId = `sap-ai-dev-${localDestination.serverName || localDestination.name}-user`.toLowerCase().replace(/[^a-z0-9_-]+/g, '-');
@@ -248,7 +288,7 @@ function buildLocalClientDestination(destination, client, authMode, { multipleCl
     { id: passwordInputId, type: 'promptString', description: `SAP password for ${localDestination.name}`, password: true }
   ];
   if (authMode === 'sso') {
-    localDestination.childEnv = { SAP_AUTH_MODE: 'sso' };
+    localDestination.childEnv = { SAP_AUTH_MODE: 'sso', ...(browserPath ? { SAP_BROWSER_EXEC: browserPath } : {}) };
     localDestination.inputs = [];
   } else {
     localDestination.childEnv = {
@@ -285,7 +325,7 @@ async function maybeConfigureTlsSelfHeal(destination, promptLabel, { input = std
 // collects the minimal ADT configuration directly from the user and produces
 // the same local destination shape as the SAP GUI flow, so installation,
 // credential inputs, and TLS handling stay identical.
-async function runManualEntryWizard({ env = process.env, input = stdin, output = stdout, detectAdtUrl } = {}) {
+async function runManualEntryWizard({ env = process.env, input = stdin, output = stdout, detectAdtUrl, selectSsoBrowser } = {}) {
   print(output, '');
   print(output, colorText('✍️  Manual system entry — skip discovery, add your SAP system directly', 'magenta', output));
   print(output, colorText('   The ADT URL is the base URL that Eclipse ADT or VS Code ADT tools use, for example https://myhost.example:44300.', 'cyan', output));
@@ -338,10 +378,11 @@ async function runManualEntryWizard({ env = process.env, input = stdin, output =
     } else {
       if (authMode === 'sso') warnSsoIpHost(destination, name, output);
       else await maybeConfigureTlsSelfHeal(destination, name, { input, output });
+      const browserPath = authMode === 'sso' ? await selectSsoBrowser(destination) : undefined;
       destination.authentication = localAuthenticationLabel(authMode);
       destination.authMode = authMode;
       for (const client of clients) {
-        expanded.push(buildLocalClientDestination(destination, client, authMode, { multipleClients: clients.length > 1 }));
+        expanded.push(buildLocalClientDestination(destination, client, authMode, { multipleClients: clients.length > 1, browserPath }));
       }
       print(output, formatStatus(`Added ${name} (client${clients.length === 1 ? '' : 's'} ${clients.join(', ')}).`, 'success', output, 'Manual entry'));
     }
@@ -469,7 +510,7 @@ function printConnectionInstructions(output, result) {
 
 // Checkbox selection over the discovered destinations plus, outside BAS, the
 // per-system confirmation prompts (clients, ADT URL, TLS self-heal, login).
-async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin, output = stdout, env = process.env, detectAdtUrl, previousAdtUrls = new Map() } = {}) {
+async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin, output = stdout, env = process.env, detectAdtUrl, previousAdtUrls = new Map(), selectSsoBrowser } = {}) {
   const orderedDestinations = [...destinations].sort((left, right) => {
     const leftRank = left.disabledReason ? 2 : (left.probe?.available === false ? 1 : 0);
     const rightRank = right.disabledReason ? 2 : (right.probe?.available === false ? 1 : 0);
@@ -495,7 +536,7 @@ async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin
   print(output, colorText('  Space = select/deselect · a = toggle all · m = add a system manually · Enter = confirm.', 'cyan', output));
   print(output, colorText('  💡 No system listed, or need an extra one? Press m to skip discovery and add any SAP system manually.', 'magenta', output));
   print(output, '');
-  const addManually = async () => (await runManualEntryWizard({ env, input, output, detectAdtUrl })).map(destination => ({
+  const addManually = async () => (await runManualEntryWizard({ env, input, output, detectAdtUrl, selectSsoBrowser })).map(destination => ({
     value: destination,
     name: `${destination.name} (manual, client ${destination.client})`
   }));
@@ -549,10 +590,11 @@ async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin
       }
       if (authMode === 'sso') warnSsoIpHost(destination, promptLabel, output);
       else await maybeConfigureTlsSelfHeal(destination, promptLabel, { input, output });
+      const browserPath = authMode === 'sso' ? await selectSsoBrowser(destination) : undefined;
       destination.authentication = localAuthenticationLabel(authMode);
       destination.authMode = authMode;
       for (const client of clients) {
-        expanded.push(buildLocalClientDestination(destination, client, authMode, { multipleClients: clients.length > 1, duplicateSystemName }));
+        expanded.push(buildLocalClientDestination(destination, client, authMode, { multipleClients: clients.length > 1, duplicateSystemName, browserPath }));
       }
     }
     selected = expanded;
@@ -570,7 +612,8 @@ export async function runSetup({
   confirmCfImport = confirmCloudFoundryImport,
   install = installMcpConfig,
   includeSapDevelopmentToolsPrompt = false,
-  detectAdtUrl
+  detectAdtUrl,
+  discoverSsoBrowsers = findRemoteControllableSsoBrowsers
 } = {}) {
   const isBas = Boolean(env.H2O_URL);
   if (!isBas && (!input.isTTY || !output.isTTY)) {
@@ -581,6 +624,7 @@ export async function runSetup({
     print(output, formatStatus(`Interactive setup needs a terminal. Rerun ${SETUP_COMMAND} from a terminal.`, 'warning', output, 'SAP AI Dev Toolkit'));
     return { skipped: true, reason: 'non-tty' };
   }
+  const selectSsoBrowser = createSsoBrowserSelector({ discoverSsoBrowsers, input, output, env });
   print(output, '');
   print(output, colorText('💡 Tip: you can skip auto-discovery and add a system manually — press m in the destination picker, or take the wizard offer when nothing is found.', 'magenta', output));
   if (!isBas) print(output, formatStatus('Looking for local SAP GUI system configuration.', 'progress', output, 'Setup'));
@@ -721,11 +765,11 @@ export async function runSetup({
       ]
     }, { input, output });
     if (choice !== 'manual') return await exitWithoutDestinations();
-    selected = await runManualEntryWizard({ env, input, output, detectAdtUrl });
+    selected = await runManualEntryWizard({ env, input, output, detectAdtUrl, selectSsoBrowser });
     additiveSetup = true;
     if (!selected.length) return await exitWithoutDestinations();
   } else {
-    selected = await chooseDiscoveredDestinations(destinations, { isBas, input, output, env, detectAdtUrl, previousAdtUrls });
+    selected = await chooseDiscoveredDestinations(destinations, { isBas, input, output, env, detectAdtUrl, previousAdtUrls, selectSsoBrowser });
     additiveSetup = selected.length > 0;
   }
 

package/src/sso-browsers.mjs

@@ -1,8 +1,9 @@
-import { execFile } from 'node:child_process';
-import { access, constants } from 'node:fs/promises';
-import { homedir } from 'node:os';
-import { posix, win32 } from 'node:path';
+import { execFile, spawn } from 'node:child_process';
+import { access, constants, mkdtemp, rm } from 'node:fs/promises';
+import { homedir, tmpdir } from 'node:os';
+import { join, posix, win32 } from 'node:path';
 import { promisify } from 'node:util';
+import { WebSocket } from 'undici';
 
 const execFileAsync = promisify(execFile);
 
@@ -59,6 +60,155 @@ async function fileExists(path) {
   }
 }
 
+function remoteDebuggingEndpoint(output) {
+  return /DevTools listening on (ws:\/\/[^\s]+)/.exec(output)?.[1] || '';
+}
+
+function waitForRemoteDebuggingEndpoint(child, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    let output = '';
+    let settled = false;
+    const finish = (error, endpoint) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.stdout?.off('data', onData);
+      child.stderr?.off('data', onData);
+      child.off('error', onError);
+      child.off('close', onClose);
+      if (error) reject(error);
+      else resolve(endpoint);
+    };
+    const onData = chunk => {
+      output = `${output}${chunk}`.slice(-8192);
+      const endpoint = remoteDebuggingEndpoint(output);
+      if (endpoint) finish(null, endpoint);
+    };
+    const onError = error => finish(error);
+    const onClose = (code, signal) => finish(new Error(`browser exited before exposing DevTools (code ${code ?? 'unknown'}, signal ${signal || 'none'})`));
+    const timer = setTimeout(() => finish(new Error(`browser did not expose DevTools within ${timeoutMs}ms`)), timeoutMs);
+    child.stdout?.on('data', onData);
+    child.stderr?.on('data', onData);
+    child.once('error', onError);
+    child.once('close', onClose);
+  });
+}
+
+function controlBrowser(endpoint, timeoutMs) {
+  const url = new URL(endpoint);
+  if (url.protocol !== 'ws:' || !['localhost', '127.0.0.1', '::1', '[::1]'].includes(url.hostname)) {
+    throw new Error('browser exposed a non-local DevTools endpoint');
+  }
+
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const socket = new WebSocket(url.href);
+    const finish = error => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try { socket.close(); } catch {}
+      if (error) reject(error);
+      else resolve();
+    };
+    const timer = setTimeout(() => finish(new Error(`DevTools command timed out after ${timeoutMs}ms`)), timeoutMs);
+    socket.addEventListener('open', () => socket.send(JSON.stringify({ id: 1, method: 'Browser.getVersion' })));
+    socket.addEventListener('message', event => {
+      let response;
+      try { response = JSON.parse(event.data); }
+      catch { return finish(new Error('DevTools returned an invalid response')); }
+      if (response.id !== 1) return;
+      if (response.error) return finish(new Error(response.error.message || 'DevTools rejected Browser.getVersion'));
+      if (!response.result?.product) return finish(new Error('DevTools returned no browser version'));
+      finish();
+    });
+    socket.addEventListener('error', () => finish(new Error('could not connect to the browser DevTools endpoint')));
+    socket.addEventListener('close', () => {
+      if (!settled) finish(new Error('browser closed the DevTools connection'));
+    });
+  });
+}
+
+function waitForClose(child, timeoutMs) {
+  return new Promise(resolve => {
+    if (child.exitCode !== null || child.signalCode !== null) return resolve(true);
+    const timer = setTimeout(() => {
+      child.off('close', onClose);
+      resolve(false);
+    }, timeoutMs);
+    const onClose = () => {
+      clearTimeout(timer);
+      resolve(true);
+    };
+    child.once('close', onClose);
+  });
+}
+
+async function signalBrowserTree(child, platform, signal) {
+  if (platform === 'win32' && child.pid) {
+    try {
+      await execFileAsync('taskkill', [
+        '/pid', String(child.pid), '/t',
+        ...(signal === 'SIGKILL' ? ['/f'] : [])
+      ], { windowsHide: true, timeout: 1000 });
+      return;
+    } catch {}
+  }
+  try {
+    if (platform !== 'win32' && child.pid) process.kill(-child.pid, signal);
+    else child.kill(signal);
+  } catch {
+    try { child.kill(signal); } catch {}
+  }
+}
+
+async function stopBrowser(child, platform) {
+  if (!child || child.exitCode !== null || child.signalCode !== null) return;
+  await signalBrowserTree(child, platform, 'SIGTERM');
+  if (await waitForClose(child, 1000)) return;
+  await signalBrowserTree(child, platform, 'SIGKILL');
+  await waitForClose(child, 1000);
+}
+
+export async function probeSsoBrowser(browser, {
+  platform = process.platform,
+  timeoutMs = 5000,
+  spawnBrowser = spawn,
+  controlRemote = controlBrowser
+} = {}) {
+  let profile;
+  let child;
+  try {
+    profile = await mkdtemp(join(tmpdir(), 'sap-ai-dev-sso-probe-'));
+    child = spawnBrowser(browser.path, [
+      `--user-data-dir=${profile}`,
+      '--remote-debugging-port=0',
+      '--headless=new',
+      '--no-first-run',
+      '--no-default-browser-check',
+      'about:blank'
+    ], { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, detached: platform !== 'win32' });
+    const endpoint = await waitForRemoteDebuggingEndpoint(child, timeoutMs);
+    await controlRemote(endpoint, timeoutMs);
+    return { usable: true };
+  } catch (error) {
+    const reason = String(error?.message || error).replace(/\s+/g, ' ').slice(0, 240);
+    return { usable: false, reason };
+  } finally {
+    await stopBrowser(child, platform);
+    if (profile) await rm(profile, { recursive: true, force: true });
+  }
+}
+
+export async function findRemoteControllableSsoBrowsers({ probe = probeSsoBrowser, ...options } = {}) {
+  const candidates = await findSsoBrowsers(options);
+  const results = await Promise.all(candidates.map(async browser => ({ browser, ...await probe(browser) })));
+  return {
+    browsers: results.filter(result => result.usable).map(result => result.browser),
+    unavailable: results.filter(result => !result.usable).map(({ browser, reason }) => ({ ...browser, reason }))
+  };
+}
+
 // Every Chromium-based browser the runtime can drive, best first; SAP_BROWSER_EXEC pins one ahead of the rest.
 export async function findSsoBrowsers({ env = process.env, platform = process.platform, exists = fileExists, appPaths = registeredAppPaths } = {}) {
   const candidates = [];

package/tools.md

@@ -72,11 +72,12 @@ Hidden upstream tools are not directly callable through the proxy. Local workflo
 
 Broad/destructive surfaces such as object deletion, SQL trace, arbitrary SAP router calls, transport release/delete, RFC execution, debugger listen/delete-breakpoint helpers, and one-off generator/update helpers are intentionally not advertised by the BAS proxy. UI5 repository writes are hidden too: the ADT filestore only reads UI5 apps, so deploy them with SAP Fiori tools instead.
 
-## Destination-scoped workflow tools
+## Local and destination-scoped workflow tools
 
-The proxy adds local multi-step tools to each destination when their required upstream capabilities are available. Like the upstream tools above, they are exposed publicly in lowercase snake_case (`lint_abap`, `get_application_log`, `prepare_abap_change_set`, and so on):
+The proxy adds local tools to the MCP surface. Some are workspace-wide; others are added to each destination when their required upstream capabilities are available. Like the upstream tools above, they are exposed publicly in lowercase snake_case (`lint_abap`, `lint_abap_project`, `get_application_log`, and so on):
 
 - `LintABAP` — local in-memory ABAP linting.
+- `LintABAPProject` — scan serialized ABAP objects in the configured workspace root (SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT, defaulting to the MCP server working directory) using the project abaplint config and available local dependency folders. This is static analysis only; it does not contact SAP or activate objects.
 - `GetApplicationLog` — bounded convenience mapping to the upstream SAP application-log route when available.
 - `PrepareABAPChangeSet` and `ApplyABAPChangeSet` — review full-source diffs and recheck source before explicit writes.
 - `CheckTransportReadiness` — collect a whitelisted bundle of transport, dependency, inactive-object, ABAP Unit, and ATC results.