sap-ai-dev-toolkit 0.9.9906 → 0.9.9909

package/.github/agents/abap-developer.agent.md

@@ -5,6 +5,8 @@ target: vscode
 user-invocable: true
 ---
 
+**Workspace preflight.** Whenever this workflow edits or hands off serialized ABAP sources in a workspace, run `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Skip when no serialized project source exists.
+
 You are an ABAP development agent for SAP Business Application Studio (BAS). Follow this workflow in order. Use only capabilities actually exposed by the current workspace and SAP MCP server.
 
 **Direct MCP invocation is mandatory.** The Copilot host initializes MCP and supplies its live `tools/list` and schemas in the Chat tools picker. Invoke the attached destination tools directly. Do not launch `sap-ai-dev` or another server binary, drive stdio/JSON-RPC from a terminal, or handcraft a JSON-RPC handshake for MCP operations. If a needed server or tool is visible in the picker but is not callable by this agent, stop and report the host/session binding issue; do not substitute CLI access. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.

package/.github/agents/abap-runtime-debugger.agent.md

@@ -5,6 +5,8 @@ target: vscode
 user-invocable: true
 ---
 
+**Workspace preflight.** Whenever this workflow edits or hands off serialized ABAP sources in a workspace, run `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Skip when no serialized project source exists.
+
 You are a specialized ABAP runtime debugging and performance diagnosis agent for SAP Business Application Studio (BAS). Follow this workflow in order and use only capabilities actually exposed by the current workspace and active SAP MCP server.
 
 **Direct MCP invocation is mandatory.** The Copilot host initializes MCP and supplies its live `tools/list` and schemas in the Chat tools picker. Invoke the attached destination tools directly. Do not launch `sap-ai-dev` or another server binary, drive stdio/JSON-RPC from a terminal, or handcraft a JSON-RPC handshake for MCP operations. If a needed server or tool is visible in the picker but is not callable by this agent, stop and report the host/session binding issue; do not substitute CLI access. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.

package/.github/agents/rap-service-developer.agent.md

@@ -5,6 +5,8 @@ target: vscode
 user-invocable: true
 ---
 
+**Workspace preflight.** Whenever this workflow edits or hands off serialized ABAP/RAP/CDS sources in a workspace, run `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Skip when no serialized project source exists.
+
 You are a specialized SAP RAP service development agent for SAP Business Application Studio (BAS). Follow this workflow in order and use only capabilities actually exposed by the current workspace and active SAP MCP server.
 
 **Direct MCP invocation is mandatory.** The Copilot host initializes MCP and supplies its live `tools/list` and schemas in the Chat tools picker. Invoke the attached destination tools directly. Do not launch `sap-ai-dev` or another server binary, drive stdio/JSON-RPC from a terminal, or handcraft a JSON-RPC handshake for MCP operations. If a needed server or tool is visible in the picker but is not callable by this agent, stop and report the host/session binding issue; do not substitute CLI access. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.

package/.github/agents/sap-solution-architect.agent.md

@@ -5,6 +5,8 @@ target: vscode
 user-invocable: true
 ---
 
+**Workspace preflight.** Whenever this workflow edits or hands off serialized ABAP/RAP/CDS sources in a workspace, run `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Skip when no serialized project source exists.
+
 You are an SAP solution architecture and SDLC orchestration agent for SAP Business Application Studio (BAS). Your job is to investigate the target SAP system, decide how a requested business requirement should be solved, recommend SAP standard capabilities and released APIs, design a Clean Core solution, and drive the delivery lifecycle through implementation-agent handoffs and validation gates. Prefer SAP standard capabilities, released APIs, Clean Core compliant extension points, and side-by-side extensibility over custom core changes.
 
 Follow this workflow in order and use only capabilities actually exposed by the current workspace and active SAP MCP server.

package/.github/skills/abap-debugging/SKILL.md

@@ -5,6 +5,8 @@ description: Diagnose ABAP runtime failures using application logs, source/refer
 
 # ABAP debugging
 
+**Workspace preflight.** Whenever this workflow edits or hands off serialized ABAP sources in a workspace, run `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Skip when no serialized project source exists.
+
 ## Tool shortlist
 
 Query the active MCP server's live `tools/list` once; use the exact live tool name and schema for the target. Start with `GetApplicationLog`, source/object inspection (`SearchObject`, `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`, `ListDependencies`), and safe data inspection (`RunQuery`, `GetTableContents`). For an authorized debugger session, use `SetBreakpoint`, review registered breakpoints with `GetBreakpoints`, attach with `DebuggerAttach`, inspect with `DebuggerGetStack` / `DebuggerGetVariables`, step with `DebuggerStep`, and finish with `DebuggerDetach`. Avoid attaching to another user's session. Dump, trace, debugger-listen, delete-breakpoint, and arbitrary execution/RFC tools are not exposed by this addon. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.

package/.github/skills/abap-development/SKILL.md

@@ -5,6 +5,8 @@ description: Implement or change ABAP programs, classes, interfaces, function gr
 
 # ABAP development
 
+**Workspace preflight.** Whenever this workflow edits or hands off serialized ABAP sources in a workspace, run `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Skip when no serialized project source exists.
+
 ## Tool shortlist
 
 Query the active MCP server's live `tools/list` once; use task-relevant tools with their returned schemas. Locate objects and usages with `SearchObject`, `GrepObjects`, and `GrepPackages`; read with `GetSource` and `GetContext`; trace callers or dependencies with `FindDefinition` and `FindReferences`; compare workspace and SAP versions with `CompareSource`. Use `EditSource` for a localized change and `WriteSource` for a larger rewrite. Format with `PrettyPrint`; lint caller-supplied source with `LintABAP`; validate with `SyntaxCheck` and `RunUnitTests`, plus `RunATCCheck` when exposed and relevant. For Clean Core requirements, use `GetAPIReleaseState` on each relevant dependency. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.

package/.github/skills/abap-runtime-analysis/SKILL.md

@@ -5,6 +5,8 @@ description: Analyze ABAP runtime incidents, debugger state, and performance sym
 
 # ABAP runtime analysis
 
+**Workspace preflight.** Whenever this workflow edits or hands off serialized ABAP sources in a workspace, run `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Skip when no serialized project source exists.
+
 ## Tool shortlist
 
 Query the active MCP server's live `tools/list` once and use the exact live names and schemas. Prefer these curated addon tools when available: `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`, `GetInstalledComponents`, `GetContext`, `GetApplicationLog`, `DebuggerAttach`, `DebuggerGetStack`, `DebuggerGetVariables`, `DebuggerStep`, `DebuggerDetach`, `SetBreakpoint`, `GetBreakpoints`, `FindDefinition`, `FindReferences`, `CompareSource`, `ListDependencies`, `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetClass`, `GetClassInfo`, `GetClassComponents`, `GetClassInclude`, `GetFunction`, `GetFunctionGroup`, `GetProgram`, `GetInclude`, `GetInterface`, `GetPackage`, `GetTable`, `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, `RunQuery`, and `GetTableContents`. For authorized fixes, also use `EditSource`, `WriteSource`, `PrepareABAPChangeSet`, `ApplyABAPChangeSet`, `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, `PrettyPrint`, `Activate`, and `ActivateMultiple`. Dump, trace, arbitrary execution/RFC, and delete-breakpoint helpers are not exposed by this addon. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.

package/.github/skills/abap-testing-quality/SKILL.md

@@ -5,6 +5,8 @@ description: Design ABAP Unit behavior tests and validate ABAP changes with lint
 
 # ABAP testing and quality
 
+**Workspace preflight.** Whenever this workflow edits or hands off serialized ABAP sources in a workspace, run `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Skip when no serialized project source exists.
+
 ## Tool selection
 
 Query the active MCP server's live `tools/list` once, then use only task-relevant tools with their returned schemas: `LintABAP` for caller-supplied source, `SyntaxCheck` for SAP syntax validation, `RunUnitTests` for ABAP Unit, and `RunATCCheck` for ATC. Unavailable tools are not passes. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.

package/.github/skills/cds-development/SKILL.md

@@ -5,6 +5,8 @@ description: Implement, change, or analyze ABAP CDS data definitions and their d
 
 # CDS development
 
+**Workspace preflight.** Whenever this workflow edits or hands off serialized CDS/ABAP sources in a workspace, run `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available for ABAP sources. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Skip when no serialized project source exists.
+
 ## Tool shortlist
 
 Query the active MCP server's live `tools/list` once; use task-relevant tools with their returned schemas. Locate views and usages with `SearchObject` and `GrepObjects`; read DDLS with `GetSource`; compare workspace and SAP versions with `CompareSource`; use `GetCDSDependencies` for upstream dependencies, `GetCDSImpactAnalysis` for consumers, and `GetCDSElementInfo` for element metadata. Trace references with `FindReferences`; edit via `EditSource` / `WriteSource`. Validate with `SyntaxCheck`, `RunATCCheck`, activation via `Activate` / `ActivateMultiple`, and read-only runtime queries via `RunQuery` or `GetTableContents` when exposed. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.

package/.github/skills/clean-core-extensibility/SKILL.md

@@ -5,6 +5,8 @@ description: Design SAP extensions using Clean Core principles, released extensi
 
 # Clean Core extensibility
 
+**Workspace preflight.** Whenever the selected extension edits or hands off serialized ABAP/RAP sources in a workspace, run `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Skip when no serialized project source exists.
+
 ## Tool shortlist
 
 Query the active MCP server's live `tools/list` once; use task-relevant tools with their returned schemas. Inspect system capabilities with `GetSystemInfo`, `GetFeatures`, and `GetInstalledComponents`; inspect source and dependencies with `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`, `CompareSource`, `ListDependencies`, `GetCDSDependencies`, and `GetCDSImpactAnalysis`. Check release status with `GetAPIReleaseState` or batch with `PlanABAPCloudMigration` where exposed. Use transport tools only for planning/readiness context and never claim transport release/deletion support; transport release is unavailable through this addon. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.

package/.github/skills/rap-development/SKILL.md

@@ -5,6 +5,8 @@ description: Develop SAP RAP business objects, behavior, projections, and OData
 
 # RAP development
 
+**Workspace preflight.** Whenever this workflow edits or hands off serialized RAP/CDS/ABAP sources in a workspace, run `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Skip when no serialized project source exists.
+
 ## Tool shortlist
 
 Query the active MCP server's live `tools/list` once; use task-relevant tools with their returned schemas. Check support and the connected destination with `GetSystemInfo`, `GetFeatures`, and `GetConnectionInfo`; locate objects with `SearchObject` and `GrepObjects`; inspect sources and structure with `GetSource`, `GetContext`, `ListDependencies`, `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, `GetClassInfo`, `GetClassComponents`, `GetClassInclude`, `GetInterface`, `GetProgram`, and `GetInclude`. Edit with `EditSource` / `WriteSource` or reviewed `PrepareABAPChangeSet` / `ApplyABAPChangeSet`; validate with `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, `RunQuery`, `GetTableContents`, and `GenerateRAPRegressionSuite` / `RunRAPRegressionSuite` for GET-only OData smoke checks when exposed. Activate with `Activate` / `ActivateMultiple` only when requested. Create service bindings with `CreateObject` (`SRVB/SVB`; set `binding_version` explicitly because V2 is the default) and publish or withdraw them with `PublishServiceBinding` / `UnpublishServiceBinding` only when publication is requested. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.

package/.github/skills/rap-service-delivery/SKILL.md

@@ -5,6 +5,8 @@ description: Validate and deliver SAP RAP OData services, behavior implementatio
 
 # RAP service delivery
 
+**Workspace preflight.** Whenever this workflow edits or hands off serialized RAP/CDS/ABAP sources in a workspace, run `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Skip when no serialized project source exists.
+
 ## Tool shortlist
 
 Query the active MCP server's live `tools/list` once and use the exact live names and schemas. Prefer these curated addon tools when available: `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`, `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetContext`, `ListDependencies`, `GetCDSDependencies`, `GetCDSImpactAnalysis`, `GetCDSElementInfo`, `GetClass`, `GetClassInfo`, `GetClassComponents`, `GetClassInclude`, `GetInterface`, `EditSource`, `WriteSource`, `PrepareABAPChangeSet`, `ApplyABAPChangeSet`, `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, `PrettyPrint`, `RunQuery`, `GetTableContents`, `GenerateRAPRegressionSuite`, `RunRAPRegressionSuite`, `GetApplicationLog`, `GetInactiveObjects`, `Activate`, `ActivateMultiple`, `CreateObject` (service bindings), `PublishServiceBinding`, and `UnpublishServiceBinding`. Read UI5 apps already deployed to the ABAP repository with `UI5ListApps`, `UI5GetApp`, and `UI5GetFileContent`. UI5 deployment, dump, trace, arbitrary execution/RFC, and code-coverage tools are not exposed by this addon. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.

package/.github/skills/sap-sdlc-orchestration/SKILL.md

@@ -5,6 +5,8 @@ description: Orchestrate the SAP delivery lifecycle from requirement analysis th
 
 # SAP SDLC orchestration
 
+**Workspace preflight.** Whenever an implementation package edits or hands off serialized ABAP/RAP/CDS sources in a workspace, require `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Skip when no serialized project source exists.
+
 ## Tool shortlist
 
 Query the active MCP server's live `tools/list` once; use task-relevant tools with their returned schemas. Investigate system and repository context with `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`, `GetInstalledComponents`, `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`, `CompareSource`, and dependency tools (`ListDependencies`, `GetCDSDependencies`, `GetCDSImpactAnalysis`). Validate with `LintABAP`, `SyntaxCheck`, `RunUnitTests`, `RunATCCheck`, runtime queries (`RunQuery`, `GetTableContents`), `GetApplicationLog`, and `GenerateRAPRegressionSuite` / `RunRAPRegressionSuite` when exposed. Use transport tools for readiness planning only; never claim transport release/deletion support because transport release is unavailable through this addon. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.

package/.github/skills/sap-standard-api-analysis/SKILL.md

@@ -5,6 +5,8 @@ description: Assess requirements against SAP standard capabilities, released API
 
 # SAP standard and API analysis
 
+**Workspace preflight.** Whenever the recommendation includes editing or handing off serialized ABAP/RAP sources in a workspace, require `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Any actual activation still requires a successful `LintABAP` run immediately before activation on the latest source for the exact activation request. Never activate merely to run tests. Skip for analysis-only work or when no serialized project source exists.
+
 ## Tool shortlist
 
 Query the active MCP server's live `tools/list` once; use task-relevant tools with their returned schemas. Inspect target capabilities with `GetSystemInfo`, `GetFeatures`, `GetConnectionInfo`, and `GetInstalledComponents`. Search candidates with `SearchObject`, `GrepObjects`, `GrepPackages`, `GetSource`, `GetContext`, `FindDefinition`, `FindReferences`, `ListDependencies`, `GetCDSDependencies`, `GetCDSImpactAnalysis`, and `GetCDSElementInfo`. Verify released API status with `GetAPIReleaseState` or batch with `PlanABAPCloudMigration` when exposed. Use `RunQuery` or `GetTableContents` only for safe read-only evidence. Never claim transport release/deletion support; transport release is unavailable through this addon. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.

package/.github/skills/sap-transport-release/SKILL.md

@@ -5,6 +5,8 @@ description: Prepare ABAP changes for SAP transport and verify request contents,
 
 # SAP transport preparation
 
+**Workspace preflight.** When a transport request includes serialized ABAP sources in a workspace, run `LintABAPProject` (`lint_abap_project`) before sending changes to SAP; if unavailable, report the skipped preflight and use caller-supplied `LintABAP` if available. Confirm the configured root is the intended project (`SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT`, or the MCP process working directory by default; `directory` is relative to that root), `targetRelease` matches the SAP target, `dependencies.missingFolders` and `syntaxRules.disabled` are empty, and `status` is `clean`. `issues`, `incomplete`, `no-abap-files`, or a mismatched root/release are not passes. This is static analysis only and does not validate SAP activation or runtime; caller-supplied `LintABAP` on the latest source for the exact object set remains mandatory immediately before activation. Skip when no local serialized sources exist.
+
 ## Tool shortlist
 
 Query the active MCP server's live `tools/list` once; use task-relevant tools with their returned schemas. Identify candidates with `GetUserTransports` or `ListTransports`; inspect a request with `GetTransport` / `GetTransportInfo`; use `CheckTransportReadiness` to collect transport, dependency, inactive-object, ABAP Unit, and ATC evidence when available. Activate with `Activate` / `ActivateMultiple` only when requested. `CreateTransport` is state-changing and requires explicit authorization. Release and deletion are not available through this addon. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.

package/README.md

@@ -15,7 +15,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/badge/SAP-Business%20Application%20Studio-0A6ED1?style=flat-square&logo=sap&logoColor=white" alt="SAP Business Application Studio">
-  <img src="https://img.shields.io/badge/AI%20agents-Copilot%20%7C%20Claude%20%7C%20Codex%20%7C%20Cursor%20%7C%20Gemini%20%7C%20opencode%20%7C%20Pi-000000?style=flat-square" alt="Works with GitHub Copilot, Claude Code, OpenAI Codex, Cursor, Gemini CLI, opencode, and Pi Coding Agent">
+  <img src="https://img.shields.io/badge/AI%20agents-Copilot%20%7C%20Claude%20%7C%20Codex%20%7C%20Cursor%20%7C%20Gemini%20%7C%20opencode%20%7C%20Pi%20%7C%20OMP%20%7C%20Cline%20%7C%20Roo%20%7C%20Windsurf-000000?style=flat-square" alt="Works with GitHub Copilot, Claude Code, OpenAI Codex, Cursor, Gemini CLI, opencode, Pi Coding Agent, Oh My Pi, Cline, Roo Code, and Windsurf">
   <img src="https://img.shields.io/badge/MCP-enabled-7B61FF?style=flat-square" alt="MCP enabled">
   <img src="https://img.shields.io/badge/SAP%20ADT-connected-0A6ED1?style=flat-square&logo=sap&logoColor=white" alt="SAP ADT connected">
   <img src="https://img.shields.io/badge/ABAP-CDS%20%7C%20RAP-EA4AAA?style=flat-square" alt="ABAP CDS RAP">
@@ -89,7 +89,7 @@ Use the attached destination-prefixed tools directly in chat. Do not launch `sap
 
 **Included skills:** `abap-development` · `abap-testing-quality` · `cds-development` · `rap-development` · `abap-debugging` · `abap-runtime-analysis` · `rap-service-delivery` · `sap-standard-api-analysis` · `clean-core-extensibility` · `sap-sdlc-orchestration` · `sap-transport-release` · `hana-cloud-inspection` · `hana-cloud-native-development` · `hana-cloud-validation`
 
-Agents and skills install for the harnesses you pick during global installation: a multi-select offers GitHub Copilot and Claude Code pre-checked, plus OpenAI Codex, Cursor, Gemini CLI, opencode, and Pi Coding Agent. In non-interactive installs they are installed for GitHub Copilot only; run `sap-ai-dev --setup` afterwards to configure destinations or local SAP GUI systems. Repository-scoped installation instructions appear below.
+Agents and skills install for the harnesses you pick during global installation: a multi-select offers GitHub Copilot and Claude Code pre-checked, plus OpenAI Codex, Cursor, Gemini CLI, opencode, Pi Coding Agent, Oh My Pi (OMP), Cline, Roo Code, and Windsurf / Devin Desktop. In non-interactive installs they are installed for GitHub Copilot only; run `sap-ai-dev --setup` afterwards to configure destinations or local SAP GUI systems. Repository-scoped installation instructions appear below.
 
 ## ✨ Your SAP development cockpit, inside your AI assistant
 
@@ -334,7 +334,7 @@ sap-ai-dev --setup
 5. Choose Windows / smart card SSO or username/password when the prompt is available.
 6. Start each generated MCP server from VS Code's **MCP: List Servers** command.
 
-The same postinstall offers the bundled agents and skills for several AI coding harnesses in a checkbox picker. **GitHub Copilot** and **Claude Code** start pre-checked, so pressing **Enter** alone installs both; **Space** selects or deselects a harness, **a** toggles all seven, and confirming with none selected skips the step without changing files. When MCP setup succeeds, the generated managed MCP servers are also mirrored into selected harnesses that have a stable user-level JSON MCP configuration (Claude Code, Cursor, Gemini CLI, and Pi Coding Agent). GitHub Copilot continues to use the VS Code/BAS MCP configuration written during setup. With no interactive terminal, the assets are installed for GitHub Copilot only; set `SAP_AI_DEV_TOOLKIT_HARNESSES` to a comma-separated list of harness ids (`github-copilot`, `claude-code`, `codex`, `cursor`, `gemini-cli`, `opencode`, `pi-coding-agent`) to choose non-interactively.
+The same postinstall offers the bundled agents and skills for several AI coding harnesses in a checkbox picker. **GitHub Copilot** and **Claude Code** start pre-checked, so pressing **Enter** alone installs both; **Space** selects or deselects a harness, **a** toggles all eleven, and confirming with none selected skips the step without changing files. When MCP setup succeeds, generated managed MCP servers are also mirrored into selected harnesses with documented user-level JSON configuration (Claude Code, Cursor, Gemini CLI, Pi Coding Agent, OMP, and Windsurf / Devin Desktop). GitHub Copilot continues to use the VS Code/BAS MCP configuration written during setup. With no interactive terminal, the assets are installed for GitHub Copilot only; set `SAP_AI_DEV_TOOLKIT_HARNESSES` to a comma-separated list of harness ids (`github-copilot`, `claude-code`, `codex`, `cursor`, `gemini-cli`, `opencode`, `pi-coding-agent`, `omp`, `cline`, `roo-code`, `windsurf`) to choose non-interactively.
 
 Some current npm versions also require install hooks to be approved. If npm reports that `sap-ai-dev-toolkit`'s `postinstall` was blocked, allow it during a fresh install with `npm install --global --allow-scripts=sap-ai-dev-toolkit sap-ai-dev-toolkit`, or run `sap-ai-dev --setup` from an interactive terminal after installation.
 
@@ -418,6 +418,10 @@ During npm postinstall, or after interactive `sap-ai-dev --setup` in BAS or on a
 | Gemini CLI | `$HOME/.gemini/skills/` | — | `$HOME/.gemini/settings.json` |
 | opencode | `$XDG_CONFIG_HOME/opencode/skills/` (default `$HOME/.config/opencode/skills/`) | `$XDG_CONFIG_HOME/opencode/agents/<id>.md` (as subagents) | Not changed automatically |
 | Pi Coding Agent | `$PI_CODING_AGENT_DIR/skills/` (default `$HOME/.pi/agent/skills/`) | `$PI_CODING_AGENT_DIR/prompts/<id>.md` (as `/` prompt commands) | `$PI_CODING_AGENT_DIR/mcp.json` (default `$HOME/.pi/agent/mcp.json`) |
+| Oh My Pi (OMP) | `$HOME/.omp/agent/skills/` (overridden by `PI_CONFIG_DIR` or `PI_CODING_AGENT_DIR`) | — | `$HOME/.omp/agent/mcp.json` (same overrides) |
+| Cline | `$HOME/.cline/skills/` | — | Not changed automatically |
+| Roo Code | `$HOME/.roo/skills/` | — | Not changed automatically |
+| Windsurf / Devin Desktop | `$XDG_CONFIG_HOME/devin/skills/` (default `$HOME/.config/devin/skills/`); Windows: `$HOME/.codeium/windsurf/skills/` | — | `$XDG_CONFIG_HOME/devin/mcp_config.json` (default `$HOME/.config/devin/mcp_config.json`); Windows: `%APPDATA%\devin\mcp_config.json` |
 
 All 14 skills use the portable `SKILL.md` format and are installed verbatim. The 5 agents use Copilot's `.agent.md` format, so they are installed as native custom agents for harnesses with a custom-agent mechanism (GitHub Copilot, Claude Code, opencode), with frontmatter adapted where needed. Pi receives equivalent prompt templates (`/abap-developer`, `/sap-solution-architect`, and so on) because Pi exposes reusable personas through prompts rather than a separate custom-agent file type. Selecting several harnesses duplicates the small markdown payloads on disk.
 

package/dist/checksums.txt

@@ -1,5 +1,5 @@
-87b75dce6f9517696d1326526ae06bf1c216695283db7b2ee34f47335a861892  vsp-linux-x64
-c118ccd7043fc2eef9ad34d62ad78fb64c3ef3b4114d65b337b8d855b7b40f0d  vsp-linux-arm64
-c66c6b75b83d3d581f859fa0a21c5a6a6ca0c168019353e3cd34ac8ed4632e7e  vsp-darwin-x64
-6b7833dfd6de0b2d1f6dab921e6ba7dd795217c733552413b4382925590f4388  vsp-darwin-arm64
-8d1f0bf29a83d3b301c5bb9a34811c8c2a84d63285b93a7a393d0c942bf1d2f6  vsp-win32-x64.exe
+f10b759b5e320c6fec4c176ef9bce49f783d796eeb8a2476dd5898c94cb14afd  vsp-linux-x64
+a4c47e4c15538cc16b540d19f55771e4c1340389efeca815e1881eafd89e45c5  vsp-linux-arm64
+20a197921c88f539ea1a7f5236509dbaa9b9f906a6333e6fb1dce9f8b5eec85c  vsp-darwin-x64
+24a8810a17d31a434b92957ea41e6347b24e2a6a35e47b3b2fc13a16082a44c3  vsp-darwin-arm64
+b318fdf5194a7f15ebcf7ee912fb2493df21aba337540a2402f81786300fd0ea  vsp-win32-x64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.9.9906",
+  "version": "0.9.9909",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",
@@ -9,7 +9,7 @@
   },
   "dependencies": {
     "@abaplint/core": "2.119.0",
-    "@modelcontextprotocol/sdk": "1.30.1",
+    "@modelcontextprotocol/sdk": "1.32.1",
     "@sap/hana-client": "2.30.27",
     "terminal-kit": "^3.1.4",
     "undici": "^6.21.3",

package/patches/vsp-bas-proxy-auth.patch

@@ -620,10 +620,30 @@ index 0000000..5e880bd
 +	}
 +}
 diff --git a/pkg/adt/http.go b/pkg/adt/http.go
-index 0b4d9f1..3473536 100755
+index 0b4d9f1..f0b5b51 100755
 --- a/pkg/adt/http.go
 +++ b/pkg/adt/http.go
-@@ -499,6 +499,7 @@ func (t *Transport) fetchCSRFTokenFor(ctx context.Context, stateful bool) error
+@@ -313,7 +313,7 @@ func (t *Transport) request(ctx context.Context, path string, opts *RequestOptio
+ 	// The same expiry reaches a plain read as a successful-looking response that
+ 	// was in fact served by the identity provider. Nothing downstream would
+ 	// recognise the logon page it carries, so catch it here by origin.
+-	if resp.StatusCode < 400 && t.canReauth() && t.redirectedAwayFromSAP(resp) {
++	if t.canReauth() && ((resp.StatusCode < 400 && t.redirectedAwayFromSAP(resp)) || isSSOLoginResponse(resp, body)) {
+ 		t.setCSRFToken("")
+ 		t.setSessionID("")
+ 		if err := t.callReauthFunc(ctx); err != nil {
+@@ -448,6 +448,10 @@ func (t *Transport) retryRequest(ctx context.Context, path string, opts *Request
+ 	}
+ 	traceHTTPResponse(resp, body)
+ 
++	if t.canReauth() && (t.redirectedAwayFromSAP(resp) || isSSOLoginResponse(resp, body)) {
++		return nil, fmt.Errorf("SSO session is still unauthenticated after re-authentication on %s", path)
++	}
++
+ 	if resp.StatusCode >= 400 {
+ 		return nil, &APIError{
+ 			StatusCode: resp.StatusCode,
+@@ -499,6 +503,7 @@ func (t *Transport) fetchCSRFTokenFor(ctx context.Context, stateful bool) error
  // allowReauth exists to break a cycle: re-authenticating ends with a token
  // fetch of its own, and that fetch must not start another re-authentication.
  func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bool, stateful bool) error {
@@ -631,7 +651,7 @@ index 0b4d9f1..3473536 100755
  	token, status, redirected, err := t.probeCSRFToken(ctx, http.MethodHead, stateful)
  	if err != nil {
  		return err
-@@ -513,6 +514,29 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+@@ -513,6 +518,29 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
  		if err != nil {
  			return err
  		}
@@ -661,7 +681,16 @@ index 0b4d9f1..3473536 100755
  		if !isCSRFToken(token) {
  			// An expired SSO session rarely announces itself as a 401. ICF sends
  			// the request on to the identity provider, the redirect chain is
-@@ -537,6 +561,9 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+@@ -520,7 +548,7 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+ 			// 200 — with no CSRF token in it, because it is not ADT answering.
+ 			// A live ADT session always yields a token, so its absence here is
+ 			// the signal, and a hop to a foreign host is the confirmation.
+-			if allowReauth && t.canReauth() && getStatus != http.StatusForbidden {
++			if allowReauth && t.canReauth() && (getStatus != http.StatusForbidden || redirected || getRedirected) {
+ 				reason := fmt.Sprintf("no CSRF token (HEAD %d, GET %d)", status, getStatus)
+ 				if redirected || getRedirected {
+ 					reason = "the identity provider answered instead of SAP"
+@@ -537,6 +565,9 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
  				}
  				return t.fetchCSRFTokenWithReauth(ctx, false, stateful)
  			}
@@ -671,7 +700,7 @@ index 0b4d9f1..3473536 100755
  			switch getStatus {
  			case http.StatusUnauthorized:
  				return fmt.Errorf("authentication failed (401): check username/password")
-@@ -556,7 +583,11 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
+@@ -556,7 +587,11 @@ func (t *Transport) fetchCSRFTokenWithReauth(ctx context.Context, allowReauth bo
  // returns the token (empty when the server did not supply one), the status, and
  // whether the answer came from somewhere other than the SAP host.
  func (t *Transport) probeCSRFToken(ctx context.Context, method string, stateful bool) (token string, status int, redirected bool, err error) {
@@ -684,6 +713,42 @@ index 0b4d9f1..3473536 100755
  	if err != nil {
  		return "", 0, false, fmt.Errorf("building URL: %w", err)
  	}
+@@ -596,12 +631,34 @@ func (t *Transport) probeCSRFToken(ctx context.Context, method string, stateful
+ 		return "", 0, false, fmt.Errorf("executing request: %w", err)
+ 	}
+ 	defer resp.Body.Close()
++	body, err := io.ReadAll(io.LimitReader(resp.Body, 64*1024))
++	if err != nil {
++		return "", 0, false, fmt.Errorf("reading CSRF response: %w", err)
++	}
+ 	// Drain the body so the connection can be reused.
+ 	_, _ = io.Copy(io.Discard, resp.Body)
+ 	traceHTTPResponse(resp, nil)
+ 	t.adoptServerCookies(resp)
+ 
+-	return resp.Header.Get("X-CSRF-Token"), resp.StatusCode, t.redirectedAwayFromSAP(resp), nil
++	return resp.Header.Get("X-CSRF-Token"), resp.StatusCode, t.redirectedAwayFromSAP(resp) || isSSOLoginResponse(resp, body), nil
++}
++
++func isSSOLoginResponse(resp *http.Response, body []byte) bool {
++	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusForbidden {
++		return false
++	}
++	page := strings.ToLower(strings.TrimSpace(string(body)))
++	html := strings.Contains(strings.ToLower(resp.Header.Get("Content-Type")), "text/html") ||
++		strings.HasPrefix(page, "<!doctype html") || strings.HasPrefix(page, "<html")
++	if !html || !strings.Contains(page, "<form") {
++		return false
++	}
++	for _, marker := range []string{"samlrequest", "samlresponse", "sap-system-login", "sap-password", `type="password"`, `type='password'`} {
++		if strings.Contains(page, marker) {
++			return true
++		}
++	}
++	return false
+ }
+ 
+ // redirectedAwayFromSAP reports whether a response was ultimately served by
 diff --git a/pkg/adt/http_csrf_discovery_test.go b/pkg/adt/http_csrf_discovery_test.go
 new file mode 100644
 index 0000000..80741da
@@ -746,6 +811,98 @@ index 0000000..80741da
 +	}
 +}
 +
+diff --git a/pkg/adt/http_sso_same_host_test.go b/pkg/adt/http_sso_same_host_test.go
+new file mode 100644
+index 0000000..0c39b96
+--- /dev/null
++++ b/pkg/adt/http_sso_same_host_test.go
+@@ -0,0 +1,86 @@
++package adt
++
++import (
++	"context"
++	"io"
++	"net/http"
++	"net/http/httptest"
++	"strings"
++	"testing"
++)
++
++func TestSameHostLoginPageRefreshesSSO(t *testing.T) {
++	for _, method := range []string{http.MethodGet, http.MethodPost} {
++		for _, status := range []int{http.StatusOK, http.StatusUnauthorized, http.StatusForbidden} {
++			t.Run(method+"/"+http.StatusText(status), func(t *testing.T) {
++				refreshes := 0
++				server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++					cookie, err := r.Cookie("SAP_SESSIONID")
++					if err != nil || cookie.Value != "fresh" {
++						w.Header().Set("Content-Type", "text/html; charset=utf-8")
++						w.WriteHeader(status)
++						_, _ = io.WriteString(w, `<html><body><form action="/sap/saml2/sp/acs"><input name="SAMLRequest" value="fixture"></form></body></html>`)
++						return
++					}
++					w.Header().Set("X-CSRF-Token", "fresh-token")
++					w.Header().Set("Content-Type", "application/xml")
++					_, _ = io.WriteString(w, "<source>authenticated</source>")
++				}))
++				defer server.Close()
++				transport := NewTransportWithClient(&Config{
++					BaseURL: server.URL,
++					Cookies: map[string]string{"SAP_SESSIONID": "expired"},
++					ReauthFunc: func(context.Context) (map[string]string, error) {
++						refreshes++
++						return map[string]string{"SAP_SESSIONID": "fresh"}, nil
++					},
++				}, server.Client())
++				response, err := transport.Request(context.Background(), "/sap/bc/adt/source", &RequestOptions{Method: method})
++				if err != nil {
++					t.Fatalf("request failed: %v", err)
++				}
++				if refreshes != 1 || string(response.Body) != "<source>authenticated</source>" {
++					t.Fatalf("refreshes=%d body=%q, want one SSO refresh and authenticated source", refreshes, response.Body)
++				}
++			})
++		}
++	}
++}
++
++func TestOrdinaryForbiddenDoesNotRefreshSSO(t *testing.T) {
++	refreshes := 0
++	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++		w.WriteHeader(http.StatusForbidden)
++		_, _ = io.WriteString(w, "Missing development authorization")
++	}))
++	defer server.Close()
++	transport := NewTransportWithClient(&Config{BaseURL: server.URL, ReauthFunc: func(context.Context) (map[string]string, error) {
++		refreshes++
++		return nil, nil
++	}}, server.Client())
++	_, err := transport.Request(context.Background(), "/sap/bc/adt/source", &RequestOptions{Method: http.MethodGet})
++	if err == nil || refreshes != 0 {
++		t.Fatalf("err=%v refreshes=%d, want authorization error without SSO refresh", err, refreshes)
++	}
++}
++
++func TestSSOLoginPageAfterRefreshFailsWithoutLoop(t *testing.T) {
++	refreshes := 0
++	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++		if r.URL.Path == "/sap/bc/adt/source" {
++			w.Header().Set("Content-Type", "text/html")
++			_, _ = io.WriteString(w, `<html><form><input type="password"></form></html>`)
++			return
++		}
++		w.Header().Set("X-CSRF-Token", "fresh-token")
++	}))
++	defer server.Close()
++	transport := NewTransportWithClient(&Config{BaseURL: server.URL, ReauthFunc: func(context.Context) (map[string]string, error) {
++		refreshes++
++		return map[string]string{"SAP_SESSIONID": "fresh"}, nil
++	}}, server.Client())
++	_, err := transport.Request(context.Background(), "/sap/bc/adt/source", &RequestOptions{Method: http.MethodGet})
++	if err == nil || !strings.Contains(err.Error(), "still unauthenticated") || refreshes != 1 {
++		t.Fatalf("err=%v refreshes=%d, want explicit failure after one refresh", err, refreshes)
++	}
++}
 diff --git a/pkg/adt/servicebinding_publish_test.go b/pkg/adt/servicebinding_publish_test.go
 new file mode 100644
 index 0000000..93c19f9

package/src/abaplint.mjs

@@ -1,5 +1,13 @@
+import { lstat, readdir, readFile, realpath } from 'node:fs/promises';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
 import { Config, MemoryFile, Registry } from '@abaplint/core';
 
+const MAX_PROJECT_FILES = 20_000;
+const MAX_PROJECT_FILE_BYTES = 2 * 1024 * 1024;
+const MAX_PROJECT_SOURCE_BYTES = 32 * 1024 * 1024;
+const IGNORED_DIRECTORIES = new Set(['.git', '.hg', '.svn', '.build', '.next', '.cache', 'coverage', 'dist', 'node_modules']);
+const PROJECT_CONFIG_FILES = ['.abaplint.jsonc', 'abaplint.jsonc', '.abaplint.json', 'abaplint.json'];
+
 export const ABAP_LINT_TOOL = {
   name: 'LintABAP',
   description: 'Run abaplint on caller-supplied source files in memory; does not read workspace files or call SAP.',
@@ -26,6 +34,21 @@ export const ABAP_LINT_TOOL = {
   }
 };
 
+export const ABAP_LINT_PROJECT_TOOL = {
+  name: 'LintABAPProject',
+  description: 'Run read-only abaplint checks over serialized ABAP objects under the configured workspace root. Loads the project config and local dependency folders when present; does not call SAP, write files, or activate ABAP.',
+  inputSchema: {
+    type: 'object',
+    properties: {
+      directory: { type: 'string', description: 'Optional project subdirectory relative to the configured workspace root.' },
+      config: { type: 'object', description: 'Optional abaplint config object that overrides project config discovery.' }
+    },
+    required: [],
+    additionalProperties: false
+  },
+  annotations: { readOnlyHint: true }
+};
+
 function isObject(value) {
   return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
@@ -65,6 +88,170 @@ function errorResult(error) {
   };
 }
 
+function reportResult(report) {
+  return {
+    isError: false,
+    content: [{ type: 'text', text: JSON.stringify(report) }],
+    structuredContent: report
+  };
+}
+
+function lintReport(registry, filesChecked) {
+  const issues = registry.findIssues();
+  const counts = { Error: 0, Warning: 0, Info: 0 };
+  const reportIssues = issues.map(issue => {
+    counts[issue.getSeverity()] += 1;
+    const start = issue.getStart();
+    const end = issue.getEnd();
+    return {
+      filename: issue.getFilename(),
+      rule: issue.getKey(),
+      severity: issue.getSeverity(),
+      message: issue.getMessage(),
+      start: { line: start.getRow(), column: start.getCol() },
+      end: { line: end.getRow(), column: end.getCol() }
+    };
+  });
+  return {
+    status: reportIssues.length === 0 ? 'clean' : 'issues',
+    filesChecked,
+    issueCount: reportIssues.length,
+    errors: counts.Error,
+    warnings: counts.Warning,
+    infos: counts.Info,
+    issues: reportIssues
+  };
+}
+
+function pathIsWithin(parent, candidate) {
+  const path = relative(parent, candidate);
+  return path === '' || (path !== '..' && !path.startsWith(`..${sep}`) && !isAbsolute(path));
+}
+
+function validateProjectArguments(arguments_) {
+  if (!isObject(arguments_)) throw new Error('Arguments must be an object');
+  rejectUnknownFields(arguments_, new Set(['directory', 'config']), 'argument');
+  if (arguments_.directory !== undefined) {
+    if (typeof arguments_.directory !== 'string' || arguments_.directory.includes('\0') ||
+        isAbsolute(arguments_.directory) || /^[A-Za-z]:[\\/]/.test(arguments_.directory) ||
+        arguments_.directory.split(/[\\/]+/).includes('..')) {
+      throw new Error('directory must be a relative path inside the configured workspace root');
+    }
+  }
+  if (arguments_.config !== undefined && !isObject(arguments_.config)) {
+    throw new Error('config must be an object');
+  }
+}
+
+async function loadProjectConfig(directory, override) {
+  if (override !== undefined) return { config: new Config(JSON.stringify(override)), source: 'caller' };
+  for (const filename of PROJECT_CONFIG_FILES) {
+    const configPath = resolve(directory, filename);
+    let info;
+    try { info = await lstat(configPath); }
+    catch (error) {
+      if (error?.code === 'ENOENT') continue;
+      throw error;
+    }
+    if (info.isSymbolicLink() || !info.isFile()) throw new Error(`${filename} must be a regular file inside the workspace`);
+    try {
+      return { config: new Config(await readFile(configPath, 'utf8')), source: filename };
+    } catch (error) {
+      throw new Error(`Could not load ${filename}: ${error.message || error}`);
+    }
+  }
+  return { config: Config.getDefault(), source: 'default' };
+}
+
+function enableSyntaxRules(config) {
+  const projectConfig = config.get();
+  const rules = { ...(projectConfig.rules || {}) };
+  const disabled = [];
+  for (const rule of ['parser_error', 'check_syntax']) {
+    if (rules[rule] === false) disabled.push(rule);
+    else if (rules[rule] === undefined) rules[rule] = true;
+  }
+  return {
+    config: new Config(JSON.stringify({ ...projectConfig, rules })),
+    disabled
+  };
+}
+
+async function dependencyRoots(config, projectRoot) {
+  const declared = config.get()?.dependencies;
+  if (!Array.isArray(declared)) return { roots: [], missing: [], count: 0 };
+  const roots = [];
+  const missing = [];
+  for (const dependency of declared) {
+    const folder = dependency?.folder;
+    if (typeof folder !== 'string' || !folder.trim()) {
+      missing.push(String(folder || '(unspecified folder)'));
+      continue;
+    }
+    const relativeFolder = folder.replace(/^[\\/]+/, '');
+    if (/^[A-Za-z]:[\\/]/.test(relativeFolder) || relativeFolder.split(/[\\/]+/).includes('..')) {
+      throw new Error('Dependency folders must stay inside the configured project directory');
+    }
+    const candidate = resolve(projectRoot, relativeFolder || '.');
+    if (!pathIsWithin(projectRoot, candidate)) throw new Error('Dependency folders must stay inside the configured project directory');
+    let canonical;
+    try { canonical = await realpath(candidate); }
+    catch (error) {
+      if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') {
+        missing.push(folder);
+        continue;
+      }
+      throw error;
+    }
+    if (!pathIsWithin(projectRoot, canonical)) throw new Error('Dependency folders must stay inside the configured project directory');
+    const info = await lstat(canonical);
+    if (!info.isDirectory()) {
+      missing.push(folder);
+      continue;
+    }
+    roots.push(canonical);
+  }
+  return { roots, missing, count: declared.length };
+}
+
+async function collectProjectFiles(projectRoot, dependencies) {
+  const sourceFiles = [];
+  const dependencyFiles = [];
+  const pending = [projectRoot];
+  let totalBytes = 0;
+  while (pending.length) {
+    const directory = pending.pop();
+    const entries = await readdir(directory, { withFileTypes: true });
+    entries.sort((left, right) => left.name.localeCompare(right.name));
+    for (const entry of entries) {
+      const absolutePath = resolve(directory, entry.name);
+      if (entry.isDirectory()) {
+        const isDependencyPath = dependencies.some(root => pathIsWithin(absolutePath, root) || pathIsWithin(root, absolutePath));
+        if (!IGNORED_DIRECTORIES.has(entry.name) || isDependencyPath) pending.push(absolutePath);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const filename = relative(projectRoot, absolutePath).split(sep).join('/');
+      const basename = filename.split('/').at(-1);
+      const nameParts = basename.split('.');
+      if (nameParts.length < 3 || !nameParts[0] || !nameParts[1]) continue;
+      if (!new MemoryFile(filename, '').getObjectType()) continue;
+      const info = await lstat(absolutePath);
+      if (!info.isFile() || info.isSymbolicLink()) continue;
+      if (info.size > MAX_PROJECT_FILE_BYTES) throw new Error(`ABAP file exceeds ${MAX_PROJECT_FILE_BYTES} bytes: ${filename}`);
+      totalBytes += info.size;
+      if (totalBytes > MAX_PROJECT_SOURCE_BYTES) throw new Error(`Workspace ABAP sources exceed ${MAX_PROJECT_SOURCE_BYTES} bytes`);
+      const file = new MemoryFile(filename, await readFile(absolutePath, 'utf8'));
+      const isDependency = dependencies.some(root => pathIsWithin(root, absolutePath));
+      (isDependency ? dependencyFiles : sourceFiles).push(file);
+      if (sourceFiles.length + dependencyFiles.length > MAX_PROJECT_FILES) {
+        throw new Error(`Workspace contains more than ${MAX_PROJECT_FILES} ABAP files`);
+      }
+    }
+  }
+  return { sourceFiles, dependencyFiles };
+}
+
 export async function runABAPLint(arguments_) {
   try {
     validateArguments(arguments_);
@@ -74,31 +261,49 @@ export async function runABAPLint(arguments_) {
     const files = arguments_.files.map(({ filename, source }) => new MemoryFile(filename, source));
     const registry = new Registry(config).addFiles(files);
     await registry.parseAsync();
-    const issues = registry.findIssues();
-    const counts = { Error: 0, Warning: 0, Info: 0 };
-    const reportIssues = issues.map(issue => {
-      counts[issue.getSeverity()] += 1;
-      const start = issue.getStart();
-      const end = issue.getEnd();
-      return {
-        filename: issue.getFilename(),
-        rule: issue.getKey(),
-        severity: issue.getSeverity(),
-        message: issue.getMessage(),
-        start: { line: start.getRow(), column: start.getCol() },
-        end: { line: end.getRow(), column: end.getCol() }
-      };
+    return { isError: false, content: [{ type: 'text', text: JSON.stringify(lintReport(registry, files.length)) }] };
+  } catch (error) {
+    return errorResult(error);
+  }
+}
+
+export async function runABAPLintProject(arguments_, { workspaceRoot = process.cwd() } = {}) {
+  try {
+    validateProjectArguments(arguments_);
+    const root = await realpath(workspaceRoot);
+    const directory = resolve(root, arguments_.directory || '.');
+    if (!pathIsWithin(root, directory)) throw new Error('directory must stay inside the configured workspace root');
+    const projectRoot = await realpath(directory);
+    if (!pathIsWithin(root, projectRoot)) throw new Error('directory must stay inside the configured workspace root');
+    const projectInfo = await lstat(projectRoot);
+    if (!projectInfo.isDirectory()) throw new Error('directory must identify a workspace directory');
+
+    const { config: projectConfig, source: configSource } = await loadProjectConfig(projectRoot, arguments_.config);
+    const { config, disabled: disabledSyntaxRules } = enableSyntaxRules(projectConfig);
+    const dependencies = await dependencyRoots(config, projectRoot);
+    const { sourceFiles, dependencyFiles } = await collectProjectFiles(projectRoot, dependencies.roots);
+    const registry = new Registry(config);
+    registry.addDependencies(dependencyFiles);
+    registry.addFiles(sourceFiles);
+    await registry.parseAsync();
+
+    const report = lintReport(registry, sourceFiles.length);
+    if (report.filesChecked === 0) report.status = 'no-abap-files';
+    else if (report.status === 'clean' && (dependencies.missing.length || disabledSyntaxRules.length)) report.status = 'incomplete';
+    return reportResult({
+      ...report,
+      scope: 'workspace-static',
+      activation: 'not-performed',
+      workspaceDirectory: arguments_.directory || '.',
+      configSource,
+      targetRelease: config.getVersion(),
+      syntaxRules: { enabled: ['parser_error', 'check_syntax'].filter(rule => !disabledSyntaxRules.includes(rule)), disabled: disabledSyntaxRules },
+      dependencies: {
+        declared: dependencies.count,
+        filesLoaded: dependencyFiles.length,
+        missingFolders: dependencies.missing
+      }
     });
-    const report = {
-      status: reportIssues.length === 0 ? 'clean' : 'issues',
-      filesChecked: files.length,
-      issueCount: reportIssues.length,
-      errors: counts.Error,
-      warnings: counts.Warning,
-      infos: counts.Info,
-      issues: reportIssues
-    };
-    return { isError: false, content: [{ type: 'text', text: JSON.stringify(report) }] };
   } catch (error) {
     return errorResult(error);
   }

package/src/harness-mcp-config.mjs

@@ -7,7 +7,7 @@ import { decodeJsonFileBuffer } from './mcp-config.mjs';
 
 const MANAGED_ENV = 'SAP_AI_DEV_TOOLKIT_MANAGED';
 
-function mcpServersPath(harness, { home = process.env.HOME || homedir(), env = process.env } = {}) {
+function mcpServersPath(harness, { home = process.env.HOME || homedir(), env = process.env, platform = process.platform } = {}) {
   switch (harness.id) {
     case 'claude-code':
       return join(home, '.claude.json');
@@ -15,8 +15,16 @@ function mcpServersPath(harness, { home = process.env.HOME || homedir(), env = p
       return join(harnessRoot(harness, { home, env }), 'mcp.json');
     case 'gemini-cli':
       return join(harnessRoot(harness, { home, env }), 'settings.json');
+    case 'omp':
+      return join(harnessRoot(harness, { home, env }), 'mcp.json');
     case 'pi-coding-agent':
       return join(harnessRoot(harness, { home, env }), 'mcp.json');
+    case 'windsurf': {
+      const configRoot = platform === 'win32'
+        ? (typeof env?.APPDATA === 'string' && env.APPDATA.trim() ? env.APPDATA.trim() : join(home, 'AppData', 'Roaming'))
+        : (typeof env?.XDG_CONFIG_HOME === 'string' && env.XDG_CONFIG_HOME.trim() ? env.XDG_CONFIG_HOME.trim() : join(home, '.config'));
+      return join(configRoot, 'devin', 'mcp_config.json');
+    }
     default:
       return null;
   }

package/src/harnesses.mjs

@@ -1,5 +1,5 @@
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 
 export const HARNESS_ENV_VAR = 'SAP_AI_DEV_TOOLKIT_HARNESSES';
 export const DEFAULT_HARNESS_IDS = ['github-copilot', 'claude-code'];
@@ -38,6 +38,19 @@ export function piCodingAgentRoot({ home = process.env.HOME || homedir(), env =
   return override || join(home, '.pi', 'agent');
 }
 
+export function ompAgentRoot({ home = process.env.HOME || homedir(), env = process.env } = {}) {
+  const agentOverride = typeof env?.PI_CODING_AGENT_DIR === 'string' ? env.PI_CODING_AGENT_DIR.trim() : '';
+  if (agentOverride) return resolve(agentOverride);
+  const configDirectory = typeof env?.PI_CONFIG_DIR === 'string' ? env.PI_CONFIG_DIR.trim() : '';
+  return join(home, configDirectory || '.omp', 'agent');
+}
+
+export function windsurfSkillsRoot({ home = process.env.HOME || homedir(), env = process.env, platform = process.platform } = {}) {
+  if (platform === 'win32') return join(home, '.codeium', 'windsurf');
+  const override = typeof env?.XDG_CONFIG_HOME === 'string' ? env.XDG_CONFIG_HOME.trim() : '';
+  return join(override || join(home, '.config'), 'devin');
+}
+
 export function claudeCodeAgentDocument(source) {
   const frontmatter = splitFrontmatter(source);
   if (!frontmatter) throw new Error('unsupported agent frontmatter');
@@ -86,7 +99,11 @@ export const HARNESSES = [
   { id: 'cursor', label: 'Cursor', directory: '.cursor', supportsAgents: false },
   { id: 'gemini-cli', label: 'Gemini CLI', directory: '.gemini', supportsAgents: false },
   { id: 'opencode', label: 'opencode', directory: 'opencode', configHome: true, supportsAgents: true, agentFileName: agentMarkdownName, agentDocument: opencodeAgentDocument },
-  { id: 'pi-coding-agent', label: 'Pi Coding Agent', directory: '.pi/agent', supportsAgents: true, agentTargetPrefix: 'prompts', agentFileName: agentMarkdownName, agentDocument: piCodingAgentPromptDocument, root: piCodingAgentRoot }
+  { id: 'pi-coding-agent', label: 'Pi Coding Agent', directory: '.pi/agent', supportsAgents: true, agentTargetPrefix: 'prompts', agentFileName: agentMarkdownName, agentDocument: piCodingAgentPromptDocument, root: piCodingAgentRoot },
+  { id: 'omp', label: 'Oh My Pi (OMP)', directory: '.omp/agent', supportsAgents: false, root: ompAgentRoot },
+  { id: 'cline', label: 'Cline', directory: '.cline', supportsAgents: false },
+  { id: 'roo-code', label: 'Roo Code', directory: '.roo', supportsAgents: false },
+  { id: 'windsurf', label: 'Windsurf / Devin Desktop', directory: 'devin', supportsAgents: false, root: windsurfSkillsRoot }
 ];
 
 export function harnessById(id) {
@@ -97,8 +114,8 @@ export function harnessById(id) {
   return harness;
 }
 
-export function harnessRoot(harness, { home = process.env.HOME || homedir(), env = process.env } = {}) {
-  if (harness.root) return harness.root({ home, env });
+export function harnessRoot(harness, { home = process.env.HOME || homedir(), env = process.env, platform = process.platform } = {}) {
+  if (harness.root) return harness.root({ home, env, platform });
   if (harness.configHome) {
     const override = typeof env?.XDG_CONFIG_HOME === 'string' ? env.XDG_CONFIG_HOME.trim() : '';
     return join(override || join(home, '.config'), harness.directory);

package/src/launcher.mjs

@@ -107,7 +107,7 @@ async function runDoctor(destinations) {
       // unprefixed (get_source, run_query); match the slug-prefixed form too
       // in case this ever runs against a multi-destination server.
       const toolPrefix = `${slugifyDestination(destination.name)}_`;
-      const localSegments = new Set(['lint_abap', 'get_application_log', 'prepare_abap_change_set', 'apply_abap_change_set', 'check_transport_readiness', 'plan_abap_cloud_migration', 'generate_rap_regression_suite', 'run_rap_regression_suite']);
+      const localSegments = new Set(['lint_abap', 'lint_abap_project', 'get_application_log', 'prepare_abap_change_set', 'apply_abap_change_set', 'check_transport_readiness', 'plan_abap_cloud_migration', 'generate_rap_regression_suite', 'run_rap_regression_suite']);
       const isUpstreamTool = tool => (tool.name.startsWith(toolPrefix) ? tool.name.slice(toolPrefix.length) : tool.name);
       const upstreamCount = tools.filter(tool => !localSegments.has(isUpstreamTool(tool))).length;
       checks.push(doctorRow(destination.name, 'MCP tools/list', upstreamCount ? 'passed' : 'failed', `${upstreamCount} upstream tools and ${tools.length} total MCP tools returned; chat-picker binding is host-managed`));

package/src/mcp-proxy.mjs

@@ -1,7 +1,7 @@
 import { spawn as nodeSpawn } from 'node:child_process';
 import { once } from 'node:events';
 import { sanitizeChildEnv, slugifyDestination } from './bas-discovery.mjs';
-import { ABAP_LINT_TOOL, runABAPLint } from './abaplint.mjs';
+import { ABAP_LINT_PROJECT_TOOL, ABAP_LINT_TOOL, runABAPLint, runABAPLintProject } from './abaplint.mjs';
 import { createEngineeringTools } from './engineering-tools.mjs';
 import { brandedEnvValue } from './branding.mjs';
 import { diagnosticText, redactText } from './redact.mjs';
@@ -698,6 +698,12 @@ export class MCPProxy {
         });
       }
     }
+    const projectLintName = snakeCaseName(ABAP_LINT_PROJECT_TOOL.name);
+    publish(projectLintName, {
+      handler: arguments_ => runABAPLintProject(arguments_, {
+        workspaceRoot: brandedEnvValue(this.env, 'WORKSPACE_ROOT') || process.cwd()
+      })
+    }, { ...ABAP_LINT_PROJECT_TOOL, name: projectLintName });
     if (!merged.length && this.children.length) throw new Error('No destination child provided tools');
     // Swap atomically so a concurrent tools/call never sees a partial map.
     this.namespace = namespace;

package/src/setup.mjs

@@ -8,6 +8,7 @@ import { adtBaseUrl, adtPort, defaultAdtUrl, discoverSapGuiSystems, hasExplicitP
 import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedCloudFoundryServiceKeys, findOrphanedCloudFoundryServiceKeys } from './cf-destination.mjs';
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
 import { discoverCertificateDnsNames } from './tls-adt-proxy.mjs';
+import { findRemoteControllableSsoBrowsers } from './sso-browsers.mjs';
 
 const SETUP_COMMAND = 'sap-ai-dev --setup';
 
@@ -66,6 +67,45 @@ async function chooseLocalAuthMode(destination, { input = stdin, output = stdout
   }, { input, output });
 }
 
+function createSsoBrowserSelector({ discoverSsoBrowsers, input, output, env }) {
+  let selectedPath;
+  let selectionComplete = false;
+  return async destination => {
+    if (selectionComplete) return selectedPath;
+    selectionComplete = true;
+    print(output, formatStatus('Checking installed browsers for remote DevTools access.', 'progress', output, 'SSO'));
+    let result;
+    try {
+      result = await discoverSsoBrowsers({ env });
+    } catch (error) {
+      const reason = String(error?.message || error).replace(/\s+/g, ' ').slice(0, 240);
+      print(output, formatStatus(`Browser control check failed (${reason}). Setup will keep automatic browser discovery.`, 'warning', output, 'SSO'));
+      return undefined;
+    }
+    const { browsers = [], unavailable = [] } = result || {};
+    if (!browsers.length) {
+      const details = unavailable.map(browser => `${browser.name}: ${browser.reason}`).join('; ').slice(0, 300);
+      print(output, formatStatus(`No remotely controllable SSO browser was found${details ? ` (${details})` : ''}. Setup will keep automatic browser discovery.`, 'warning', output, 'SSO'));
+      return undefined;
+    }
+    if (browsers.length === 1) {
+      selectedPath = browsers[0].path;
+      print(output, formatStatus(`Using ${browsers[0].name}; it responded to a remote DevTools command.`, 'success', output, 'SSO browser'));
+      return selectedPath;
+    }
+    selectedPath = await selectPrompt({
+      message: `Browser for SSO (${destination.name})`,
+      defaultValue: browsers[0].path,
+      choices: browsers.map((browser, index) => ({
+        name: `${browser.name} (${browser.path})`,
+        value: browser.path,
+        shortcut: String(index + 1)
+      }))
+    }, { input, output });
+    return selectedPath;
+  };
+}
+
 async function confirmCloudFoundryImport({ input = stdin, output = stdout } = {}) {
   const readline = createInterface({ input, output });
   try {
@@ -238,7 +278,7 @@ async function confirmPrompt(message, { input = stdin, output = stdout } = {}) {
   return !/^n(?:o)?$/i.test(String(answer || '').trim());
 }
 
-function buildLocalClientDestination(destination, client, authMode, { multipleClients = false, duplicateSystemName = false } = {}) {
+function buildLocalClientDestination(destination, client, authMode, { multipleClients = false, duplicateSystemName = false, browserPath } = {}) {
   const name = localClientDestinationName(destination, client, { multipleClients, duplicateSystemName });
   const localDestination = { ...destination, name, serverName: name, client };
   const userInputId = `sap-ai-dev-${localDestination.serverName || localDestination.name}-user`.toLowerCase().replace(/[^a-z0-9_-]+/g, '-');
@@ -248,7 +288,7 @@ function buildLocalClientDestination(destination, client, authMode, { multipleCl
     { id: passwordInputId, type: 'promptString', description: `SAP password for ${localDestination.name}`, password: true }
   ];
   if (authMode === 'sso') {
-    localDestination.childEnv = { SAP_AUTH_MODE: 'sso' };
+    localDestination.childEnv = { SAP_AUTH_MODE: 'sso', ...(browserPath ? { SAP_BROWSER_EXEC: browserPath } : {}) };
     localDestination.inputs = [];
   } else {
     localDestination.childEnv = {
@@ -285,7 +325,7 @@ async function maybeConfigureTlsSelfHeal(destination, promptLabel, { input = std
 // collects the minimal ADT configuration directly from the user and produces
 // the same local destination shape as the SAP GUI flow, so installation,
 // credential inputs, and TLS handling stay identical.
-async function runManualEntryWizard({ env = process.env, input = stdin, output = stdout, detectAdtUrl } = {}) {
+async function runManualEntryWizard({ env = process.env, input = stdin, output = stdout, detectAdtUrl, selectSsoBrowser } = {}) {
   print(output, '');
   print(output, colorText('✍️  Manual system entry — skip discovery, add your SAP system directly', 'magenta', output));
   print(output, colorText('   The ADT URL is the base URL that Eclipse ADT or VS Code ADT tools use, for example https://myhost.example:44300.', 'cyan', output));
@@ -338,10 +378,11 @@ async function runManualEntryWizard({ env = process.env, input = stdin, output =
     } else {
       if (authMode === 'sso') warnSsoIpHost(destination, name, output);
       else await maybeConfigureTlsSelfHeal(destination, name, { input, output });
+      const browserPath = authMode === 'sso' ? await selectSsoBrowser(destination) : undefined;
       destination.authentication = localAuthenticationLabel(authMode);
       destination.authMode = authMode;
       for (const client of clients) {
-        expanded.push(buildLocalClientDestination(destination, client, authMode, { multipleClients: clients.length > 1 }));
+        expanded.push(buildLocalClientDestination(destination, client, authMode, { multipleClients: clients.length > 1, browserPath }));
       }
       print(output, formatStatus(`Added ${name} (client${clients.length === 1 ? '' : 's'} ${clients.join(', ')}).`, 'success', output, 'Manual entry'));
     }
@@ -469,7 +510,7 @@ function printConnectionInstructions(output, result) {
 
 // Checkbox selection over the discovered destinations plus, outside BAS, the
 // per-system confirmation prompts (clients, ADT URL, TLS self-heal, login).
-async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin, output = stdout, env = process.env, detectAdtUrl, previousAdtUrls = new Map() } = {}) {
+async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin, output = stdout, env = process.env, detectAdtUrl, previousAdtUrls = new Map(), selectSsoBrowser } = {}) {
   const orderedDestinations = [...destinations].sort((left, right) => {
     const leftRank = left.disabledReason ? 2 : (left.probe?.available === false ? 1 : 0);
     const rightRank = right.disabledReason ? 2 : (right.probe?.available === false ? 1 : 0);
@@ -495,7 +536,7 @@ async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin
   print(output, colorText('  Space = select/deselect · a = toggle all · m = add a system manually · Enter = confirm.', 'cyan', output));
   print(output, colorText('  💡 No system listed, or need an extra one? Press m to skip discovery and add any SAP system manually.', 'magenta', output));
   print(output, '');
-  const addManually = async () => (await runManualEntryWizard({ env, input, output, detectAdtUrl })).map(destination => ({
+  const addManually = async () => (await runManualEntryWizard({ env, input, output, detectAdtUrl, selectSsoBrowser })).map(destination => ({
     value: destination,
     name: `${destination.name} (manual, client ${destination.client})`
   }));
@@ -549,10 +590,11 @@ async function chooseDiscoveredDestinations(destinations, { isBas, input = stdin
       }
       if (authMode === 'sso') warnSsoIpHost(destination, promptLabel, output);
       else await maybeConfigureTlsSelfHeal(destination, promptLabel, { input, output });
+      const browserPath = authMode === 'sso' ? await selectSsoBrowser(destination) : undefined;
       destination.authentication = localAuthenticationLabel(authMode);
       destination.authMode = authMode;
       for (const client of clients) {
-        expanded.push(buildLocalClientDestination(destination, client, authMode, { multipleClients: clients.length > 1, duplicateSystemName }));
+        expanded.push(buildLocalClientDestination(destination, client, authMode, { multipleClients: clients.length > 1, duplicateSystemName, browserPath }));
       }
     }
     selected = expanded;
@@ -570,7 +612,8 @@ export async function runSetup({
   confirmCfImport = confirmCloudFoundryImport,
   install = installMcpConfig,
   includeSapDevelopmentToolsPrompt = false,
-  detectAdtUrl
+  detectAdtUrl,
+  discoverSsoBrowsers = findRemoteControllableSsoBrowsers
 } = {}) {
   const isBas = Boolean(env.H2O_URL);
   if (!isBas && (!input.isTTY || !output.isTTY)) {
@@ -581,6 +624,7 @@ export async function runSetup({
     print(output, formatStatus(`Interactive setup needs a terminal. Rerun ${SETUP_COMMAND} from a terminal.`, 'warning', output, 'SAP AI Dev Toolkit'));
     return { skipped: true, reason: 'non-tty' };
   }
+  const selectSsoBrowser = createSsoBrowserSelector({ discoverSsoBrowsers, input, output, env });
   print(output, '');
   print(output, colorText('💡 Tip: you can skip auto-discovery and add a system manually — press m in the destination picker, or take the wizard offer when nothing is found.', 'magenta', output));
   if (!isBas) print(output, formatStatus('Looking for local SAP GUI system configuration.', 'progress', output, 'Setup'));
@@ -721,11 +765,11 @@ export async function runSetup({
       ]
     }, { input, output });
     if (choice !== 'manual') return await exitWithoutDestinations();
-    selected = await runManualEntryWizard({ env, input, output, detectAdtUrl });
+    selected = await runManualEntryWizard({ env, input, output, detectAdtUrl, selectSsoBrowser });
     additiveSetup = true;
     if (!selected.length) return await exitWithoutDestinations();
   } else {
-    selected = await chooseDiscoveredDestinations(destinations, { isBas, input, output, env, detectAdtUrl, previousAdtUrls });
+    selected = await chooseDiscoveredDestinations(destinations, { isBas, input, output, env, detectAdtUrl, previousAdtUrls, selectSsoBrowser });
     additiveSetup = selected.length > 0;
   }
 

package/src/sso-browsers.mjs

@@ -1,8 +1,9 @@
-import { execFile } from 'node:child_process';
-import { access, constants } from 'node:fs/promises';
-import { homedir } from 'node:os';
-import { posix, win32 } from 'node:path';
+import { execFile, spawn } from 'node:child_process';
+import { access, constants, mkdtemp, rm } from 'node:fs/promises';
+import { homedir, tmpdir } from 'node:os';
+import { join, posix, win32 } from 'node:path';
 import { promisify } from 'node:util';
+import { WebSocket } from 'undici';
 
 const execFileAsync = promisify(execFile);
 
@@ -59,6 +60,155 @@ async function fileExists(path) {
   }
 }
 
+function remoteDebuggingEndpoint(output) {
+  return /DevTools listening on (ws:\/\/[^\s]+)/.exec(output)?.[1] || '';
+}
+
+function waitForRemoteDebuggingEndpoint(child, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    let output = '';
+    let settled = false;
+    const finish = (error, endpoint) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.stdout?.off('data', onData);
+      child.stderr?.off('data', onData);
+      child.off('error', onError);
+      child.off('close', onClose);
+      if (error) reject(error);
+      else resolve(endpoint);
+    };
+    const onData = chunk => {
+      output = `${output}${chunk}`.slice(-8192);
+      const endpoint = remoteDebuggingEndpoint(output);
+      if (endpoint) finish(null, endpoint);
+    };
+    const onError = error => finish(error);
+    const onClose = (code, signal) => finish(new Error(`browser exited before exposing DevTools (code ${code ?? 'unknown'}, signal ${signal || 'none'})`));
+    const timer = setTimeout(() => finish(new Error(`browser did not expose DevTools within ${timeoutMs}ms`)), timeoutMs);
+    child.stdout?.on('data', onData);
+    child.stderr?.on('data', onData);
+    child.once('error', onError);
+    child.once('close', onClose);
+  });
+}
+
+function controlBrowser(endpoint, timeoutMs) {
+  const url = new URL(endpoint);
+  if (url.protocol !== 'ws:' || !['localhost', '127.0.0.1', '::1', '[::1]'].includes(url.hostname)) {
+    throw new Error('browser exposed a non-local DevTools endpoint');
+  }
+
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const socket = new WebSocket(url.href);
+    const finish = error => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try { socket.close(); } catch {}
+      if (error) reject(error);
+      else resolve();
+    };
+    const timer = setTimeout(() => finish(new Error(`DevTools command timed out after ${timeoutMs}ms`)), timeoutMs);
+    socket.addEventListener('open', () => socket.send(JSON.stringify({ id: 1, method: 'Browser.getVersion' })));
+    socket.addEventListener('message', event => {
+      let response;
+      try { response = JSON.parse(event.data); }
+      catch { return finish(new Error('DevTools returned an invalid response')); }
+      if (response.id !== 1) return;
+      if (response.error) return finish(new Error(response.error.message || 'DevTools rejected Browser.getVersion'));
+      if (!response.result?.product) return finish(new Error('DevTools returned no browser version'));
+      finish();
+    });
+    socket.addEventListener('error', () => finish(new Error('could not connect to the browser DevTools endpoint')));
+    socket.addEventListener('close', () => {
+      if (!settled) finish(new Error('browser closed the DevTools connection'));
+    });
+  });
+}
+
+function waitForClose(child, timeoutMs) {
+  return new Promise(resolve => {
+    if (child.exitCode !== null || child.signalCode !== null) return resolve(true);
+    const timer = setTimeout(() => {
+      child.off('close', onClose);
+      resolve(false);
+    }, timeoutMs);
+    const onClose = () => {
+      clearTimeout(timer);
+      resolve(true);
+    };
+    child.once('close', onClose);
+  });
+}
+
+async function signalBrowserTree(child, platform, signal) {
+  if (platform === 'win32' && child.pid) {
+    try {
+      await execFileAsync('taskkill', [
+        '/pid', String(child.pid), '/t',
+        ...(signal === 'SIGKILL' ? ['/f'] : [])
+      ], { windowsHide: true, timeout: 1000 });
+      return;
+    } catch {}
+  }
+  try {
+    if (platform !== 'win32' && child.pid) process.kill(-child.pid, signal);
+    else child.kill(signal);
+  } catch {
+    try { child.kill(signal); } catch {}
+  }
+}
+
+async function stopBrowser(child, platform) {
+  if (!child || child.exitCode !== null || child.signalCode !== null) return;
+  await signalBrowserTree(child, platform, 'SIGTERM');
+  if (await waitForClose(child, 1000)) return;
+  await signalBrowserTree(child, platform, 'SIGKILL');
+  await waitForClose(child, 1000);
+}
+
+export async function probeSsoBrowser(browser, {
+  platform = process.platform,
+  timeoutMs = 5000,
+  spawnBrowser = spawn,
+  controlRemote = controlBrowser
+} = {}) {
+  let profile;
+  let child;
+  try {
+    profile = await mkdtemp(join(tmpdir(), 'sap-ai-dev-sso-probe-'));
+    child = spawnBrowser(browser.path, [
+      `--user-data-dir=${profile}`,
+      '--remote-debugging-port=0',
+      '--headless=new',
+      '--no-first-run',
+      '--no-default-browser-check',
+      'about:blank'
+    ], { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, detached: platform !== 'win32' });
+    const endpoint = await waitForRemoteDebuggingEndpoint(child, timeoutMs);
+    await controlRemote(endpoint, timeoutMs);
+    return { usable: true };
+  } catch (error) {
+    const reason = String(error?.message || error).replace(/\s+/g, ' ').slice(0, 240);
+    return { usable: false, reason };
+  } finally {
+    await stopBrowser(child, platform);
+    if (profile) await rm(profile, { recursive: true, force: true });
+  }
+}
+
+export async function findRemoteControllableSsoBrowsers({ probe = probeSsoBrowser, ...options } = {}) {
+  const candidates = await findSsoBrowsers(options);
+  const results = await Promise.all(candidates.map(async browser => ({ browser, ...await probe(browser) })));
+  return {
+    browsers: results.filter(result => result.usable).map(result => result.browser),
+    unavailable: results.filter(result => !result.usable).map(({ browser, reason }) => ({ ...browser, reason }))
+  };
+}
+
 // Every Chromium-based browser the runtime can drive, best first; SAP_BROWSER_EXEC pins one ahead of the rest.
 export async function findSsoBrowsers({ env = process.env, platform = process.platform, exists = fileExists, appPaths = registeredAppPaths } = {}) {
   const candidates = [];

package/tools.md

@@ -72,11 +72,12 @@ Hidden upstream tools are not directly callable through the proxy. Local workflo
 
 Broad/destructive surfaces such as object deletion, SQL trace, arbitrary SAP router calls, transport release/delete, RFC execution, debugger listen/delete-breakpoint helpers, and one-off generator/update helpers are intentionally not advertised by the BAS proxy. UI5 repository writes are hidden too: the ADT filestore only reads UI5 apps, so deploy them with SAP Fiori tools instead.
 
-## Destination-scoped workflow tools
+## Local and destination-scoped workflow tools
 
-The proxy adds local multi-step tools to each destination when their required upstream capabilities are available. Like the upstream tools above, they are exposed publicly in lowercase snake_case (`lint_abap`, `get_application_log`, `prepare_abap_change_set`, and so on):
+The proxy adds local tools to the MCP surface. Some are workspace-wide; others are added to each destination when their required upstream capabilities are available. Like the upstream tools above, they are exposed publicly in lowercase snake_case (`lint_abap`, `lint_abap_project`, `get_application_log`, and so on):
 
 - `LintABAP` — local in-memory ABAP linting.
+- `LintABAPProject` — scan serialized ABAP objects in the configured workspace root (SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT, defaulting to the MCP server working directory) using the project abaplint config and available local dependency folders. This is static analysis only; it does not contact SAP or activate objects.
 - `GetApplicationLog` — bounded convenience mapping to the upstream SAP application-log route when available.
 - `PrepareABAPChangeSet` and `ApplyABAPChangeSet` — review full-source diffs and recheck source before explicit writes.
 - `CheckTransportReadiness` — collect a whitelisted bundle of transport, dependency, inactive-object, ABAP Unit, and ATC results.