sap-ai-dev-toolkit 0.9.9920 → 0.9.9922

package/NOTICE

@@ -2,7 +2,8 @@ Third-party notices for sap-ai-dev-toolkit
 
 This package includes patched VSP (vibing-steampunk) binaries built from upstream commit
 9886d2727f47506368b0a3c2f1c1766f1200f747. The BAS proxy-auth change is documented in
-patches/vsp-bas-proxy-auth.patch. The following upstream notice is reproduced from VSP:
+patches/vsp-bas-proxy-auth.patch; the namespaced class-include EditSource fix is documented in
+patches/vsp-namespaced-class-include-edit.patch. The following upstream notice is reproduced from VSP:
 
 vibing-steampunk (vsp)
 Copyright (c) 2025-2026 Alice Vinogradova and contributors

package/README.md

@@ -234,7 +234,7 @@ The separate `integration-suite` stdio MCP server covers bounded discovery, auth
 Interactive `sap-ai-dev --setup` asks **"Add the SAP Integration Suite tools?"** before writing MCP configuration, preserves existing entries, and shows configured identities without credential values. Enter defaults to yes when credentials exist, no otherwise. `--tools` includes the companion checkbox; the empty-landscape menu offers Integration Suite-only setup. Run **`sap-ai-dev --setup-integration`** to configure only this server.
 
 - Detected credentials receive read-only capability checks. Core Cloud Foundry setup discovers `it-rt/api`, `apimanagement-apiportal/apiportal-apiaccess` and `apimanagement-devportal/devportal-apiaccess`; it can reuse/create the `sap-ai-dev-integration` key and, with explicit approval, dedicated `sap-ai-dev-integration-cpi`, `sap-ai-dev-integration-apim` or `sap-ai-dev-integration-devhub` instances. It pins plans/brokers visible to the targeted space, rejects ambiguous or other-organization plans, and does not grant entitlements.
-- Core service keys and separately typed optional records can be pasted as hidden JSON or supplied by downloaded file path. The user-only `~/.config/sap-ai-dev-toolkit/integration-suite.json` stores only normalized credentials (directory 0700/file 0600), never `mcp.json`; saving a key that cannot sign in requires confirmation.
+- Core service keys and separately typed optional records can be pasted as hidden JSON or supplied by downloaded file path; the paste option first asks which service the key is for (Cloud Integration, API Management, Developer Hub or an optional record). The user-only `~/.config/sap-ai-dev-toolkit/integration-suite.json` stores only normalized credentials (directory 0700/file 0600), never `mcp.json`; saving a key that cannot sign in requires confirmation.
 - Optional discovery/setup accepts **existing credentials only**. It does not provision services, create optional service keys, activate capabilities, assign roles or retarget Cloud Foundry. Startup and capability probes never provision anything.
 
 Core precedence remains per-side: complete explicit `CPI_URL/CPI_TOKEN_URL/CPI_CLIENT_ID/CPI_CLIENT_SECRET` (or `APIM_*` / `DEVHUB_*`) → matching `*_SERVICE_KEY` JSON → one unambiguous `VCAP_SERVICES` binding → saved setup key. `*_VCAP_SERVICE` and `*_BINDING` select custom labels/instances. Certificate-based core keys are rejected. Optional environment JSON overrides only its matching stored record; malformed optional input disables that adapter, not usable core clients.

package/dist/checksums.txt

@@ -1,5 +1,5 @@
-885ba61e5aa31e1bfe21953040a5cdb5e06c3eb648495f03b7cb035b2fd9d2c2  vsp-linux-x64
-34f392bfbd853dd2b24abd95fda351d25633b538728371f881ee475a65904b31  vsp-linux-arm64
-cee27c146031fd932bf974ca359c6c0263c1ea1c20fe120f5244948af5ae1743  vsp-darwin-x64
-320deb50652f0a29c8624c56e7cb150cb27a4e381b42c9b8c1edda1c3ad64a81  vsp-darwin-arm64
-574885013902ccd93645ca7890cdff1c02ea769799df019f1d086d41f9e2cb71  vsp-win32-x64.exe
+31902921b0d2b5349be8e392aae3632ca8c3dee26950ea30c412ec83271722f3  vsp-linux-x64
+df39b324fe419348f5157954d56c5f8d60e5bac28edc04a56e90c380b67de10d  vsp-linux-arm64
+754338fbbbe66260cac722677753b16a0a2f23127b947bf1f3a189044fa66c32  vsp-darwin-x64
+ac153052b5d02b2f19a536623c957369af3412f5bbe2eed0f6a43e8597ed0f1b  vsp-darwin-arm64
+722c6de352719dd9374932b56546189a75c29800e74da3bdcb0308b2034248ac  vsp-win32-x64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.9.9920",
+  "version": "0.9.9922",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/patches/vsp-namespaced-class-include-edit.patch

@@ -0,0 +1,134 @@
+diff --git a/pkg/adt/edit_namespaced_include_test.go b/pkg/adt/edit_namespaced_include_test.go
+new file mode 100644
+index 0000000..514ab35
+--- /dev/null
++++ b/pkg/adt/edit_namespaced_include_test.go
+@@ -0,0 +1,80 @@
++package adt
++
++import (
++	"context"
++	"io"
++	"net/http"
++	"net/http/httptest"
++	"strings"
++	"sync"
++	"testing"
++)
++
++// TestEditSource_NamespacedClassInclude guards against double-encoding the
++// class name of a namespaced class include: the object URL arrives with
++// "%2FABC%2F", and every request (read, lock, hash check, PUT, unlock,
++// activate) must keep exactly one encoding — never "%252F".
++func TestEditSource_NamespacedClassInclude(t *testing.T) {
++	const source = "CLASS lcl_x DEFINITION.\n  \" old\nENDCLASS.\n"
++	const classPath = "/sap/bc/adt/oo/classes/%2FABC%2FCL_TEST"
++
++	for _, include := range []string{"definitions", "implementations", "testclasses"} {
++		for _, withHash := range []bool{false, true} {
++			name := include
++			if withHash {
++				name += "/hash"
++			}
++			t.Run(name, func(t *testing.T) {
++				includePath := classPath + "/includes/" + include
++				var mu sync.Mutex
++				var puts []string
++				current := source
++				srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++					w.Header().Set("x-csrf-token", "TOKEN")
++					raw := r.URL.EscapedPath()
++					if strings.Contains(raw, "%25") {
++						t.Errorf("double-encoded request: %s %s", r.Method, r.RequestURI)
++						w.WriteHeader(http.StatusNotFound)
++						return
++					}
++					switch {
++					case r.URL.Query().Get("_action") == "LOCK":
++						w.Header().Set("Content-Type", "application/xml")
++						_, _ = w.Write([]byte(`<?xml version="1.0"?><asx:abap xmlns:asx="http://www.sap.com/abapxml">
++						  <asx:values><DATA><LOCK_HANDLE>HANDLE-1</LOCK_HANDLE>
++						  <MODIFICATION_SUPPORT>Modification</MODIFICATION_SUPPORT></DATA></asx:values></asx:abap>`))
++					case r.Method == http.MethodGet && raw == includePath:
++						mu.Lock()
++						_, _ = w.Write([]byte(current))
++						mu.Unlock()
++					case r.Method == http.MethodPut:
++						mu.Lock()
++						puts = append(puts, raw)
++						body, _ := io.ReadAll(r.Body)
++						current = string(body)
++						mu.Unlock()
++					default:
++						w.WriteHeader(http.StatusOK)
++					}
++				}))
++				defer srv.Close()
++
++				opts := &EditSourceOptions{}
++				if withHash {
++					opts.ExpectedSourceHash = SourceHash(source)
++				}
++				c := NewClient(srv.URL, "TESTUSER", "pw")
++				res, err := c.EditSourceWithOptions(context.Background(), includePath, "\" old", "\" new", opts)
++				if err != nil {
++					t.Fatalf("EditSourceWithOptions: %v", err)
++				}
++				if !res.Success {
++					t.Fatalf("edit failed: %s", res.Message)
++				}
++				if len(puts) != 1 || puts[0] != includePath {
++					t.Fatalf("PUT paths = %v, want [%s]", puts, includePath)
++				}
++			})
++		}
++	}
++}
+diff --git a/pkg/adt/workflows_edit.go b/pkg/adt/workflows_edit.go
+index 6da5df7..01c02e0 100644
+--- a/pkg/adt/workflows_edit.go
++++ b/pkg/adt/workflows_edit.go
+@@ -3,6 +3,7 @@ package adt
+ import (
+ 	"context"
+ 	"fmt"
++	"net/url"
+ 	"strings"
+ )
+ 
+@@ -204,9 +205,9 @@ func (c *Client) EditSourceWithOptions(ctx context.Context, objectURL, oldString
+ 		if idx := strings.Index(objectURL, classesPrefix); idx >= 0 {
+ 			rest := objectURL[idx+len(classesPrefix):]
+ 			if slashIdx := strings.Index(rest, "/"); slashIdx > 0 {
+-				classNameForMethod = rest[:slashIdx]
++				classNameForMethod = decodeClassNameSegment(rest[:slashIdx])
+ 			} else {
+-				classNameForMethod = rest
++				classNameForMethod = decodeClassNameSegment(rest)
+ 			}
+ 		}
+ 		result.Method = opts.Method
+@@ -227,7 +228,7 @@ func (c *Client) EditSourceWithOptions(ctx context.Context, objectURL, oldString
+ 			classesPrefix := "/sap/bc/adt/oo/classes/"
+ 			if strings.Contains(objectURL, classesPrefix) {
+ 				classStart := strings.Index(objectURL, classesPrefix) + len(classesPrefix)
+-				className = objectURL[classStart:includesIdx]
++				className = decodeClassNameSegment(objectURL[classStart:includesIdx])
+ 				includeType = ClassIncludeType(objectURL[includesIdx+len("/includes/"):])
+ 				parentClassURL = objectURL[:includesIdx]
+ 			}
+@@ -488,3 +489,14 @@ func (c *Client) EditSourceWithOptions(ctx context.Context, objectURL, oldString
+ 	}
+ 	return result, nil
+ }
++
++// decodeClassNameSegment turns the class-name path segment of an object URL
++// ("%2FABC%2FCL_TEST") into the raw name ("/ABC/CL_TEST"). Downstream helpers
++// (GetClassIncludeSourceURL, GetClassMethods, activation) escape the name
++// themselves, so passing the still-encoded segment would yield "%252F".
++func decodeClassNameSegment(segment string) string {
++	if decoded, err := url.PathUnescape(segment); err == nil {
++		return decoded
++	}
++	return segment
++}

package/scripts/build-vsp.mjs

@@ -33,7 +33,9 @@ async function main() {
   await mkdir(dirname(source), { recursive: true });
   await run('git', ['clone', '--filter=blob:none', upstream, source]);
   await run('git', ['-C', source, 'checkout', '--detach', commit]);
-  await run('patch', ['-p1', '-i', join(root, 'patches', 'vsp-bas-proxy-auth.patch')], { cwd: source });
+  for (const patchFile of ['vsp-bas-proxy-auth.patch', 'vsp-namespaced-class-include-edit.patch']) {
+    await run('patch', ['-p1', '-i', join(root, 'patches', patchFile)], { cwd: source });
+  }
   await mkdir(dist, { recursive: true });
   const checksums = [];
   for (const [goos, goarch, os, arch, extension] of targets) {

package/scripts/run-live-integration.mjs

@@ -30,7 +30,7 @@ const PROXY_URL = `ZAI_SmokeUrl${RUN}`;
 const PROXY_ODATA = `ZAI_SmokeOData${RUN}`;
 const PROXY_CPI = `ZAI_SmokeCpi${RUN}`;
 const config = resolveIntegrationConfig(process.env, { stored: readStoredIntegrationKeys() });
-const SECRETS = Object.values(config).filter(Boolean).map(side => side.clientSecret);
+const SECRETS = Object.values(config).filter(Boolean).map(side => side.clientSecret).filter(Boolean);
 const PRODUCT = `ZAI_SmokeProduct${RUN}`;
 const KVM = `ZAI_SmokeKvm${RUN}`;
 const CREDENTIAL = `ZAI_SMOKE_USER_${RUN}`;
@@ -99,7 +99,7 @@ async function invoke(url, { method = 'POST', body, headers = {}, auth = true, d
     const text = await response.text();
     let json;
     try { json = JSON.parse(text); } catch { /* not JSON */ }
-    result = { status: response.status, text, json };
+    result = { status: response.status, headers: Object.fromEntries(response.headers), text, json };
     if (done(result)) return result;
     await sleep(5000);
   }
@@ -562,7 +562,7 @@ await scenario('S41', 'runtime call to the template iFlow passes body and query
   expect(/\/anything\/configured/.test(result.json.url), `receiver url ${result.json.url}`);
   expect(result.json.args.probe === RUN, `query ${JSON.stringify(result.json.args)}`);
   expect(JSON.parse(result.json.data).kind === 'direct', `body ${result.json.data}`);
-  ctx.directGuid = result.json.headers['Sap-Messageprocessinglogid'];
+  ctx.directGuid = result.headers['sap_messageprocessinglogid'];
   expect(ctx.directGuid, 'no MPL id header forwarded');
   return `MPL ${ctx.directGuid}`;
 });
@@ -579,7 +579,7 @@ await scenario('S43', 'APIM proxy in front of CPI forwards the caller bearer tok
   const result = await invoke(proxy.runtime_url, { body: JSON.stringify({ via: 'apim-url-target', run: RUN }) });
   expect(result.status === 200, `HTTP ${result.status}: ${result.text.slice(0, 200)}`);
   expect(JSON.parse(result.json.data).via === 'apim-url-target', result.json.data);
-  ctx.apimGuid = result.json.headers['Sap-Messageprocessinglogid'];
+  ctx.apimGuid = result.headers['sap_messageprocessinglogid'];
   return `${proxy.runtime_url} → CPI → httpbin`;
 });
 
@@ -611,8 +611,8 @@ await scenario('S46', 'iFlow with Unicode description, POST receiver and static
   const { runtime } = await deployAndWait(IFLOW_POST);
   expect(runtime.Status === 'STARTED', JSON.stringify(runtime));
   const endpoints = ok(await call('cpi_list_service_endpoints', { iflow_id: IFLOW_POST }), 'endpoints').items;
-  ctx.postEndpoint = endpoints.flatMap(entry => entry.urls)[0] ?? ctx.cpiEndpoint.replace(`/http/ai/smoke${RUN}`, `/http/ai/post${RUN}`);
-  return `description "${listed.Description}"`;
+  ctx.postEndpoint = endpoints.flatMap(entry => entry.urls)[0] ?? ctx.cpiEndpoint?.replace(`/http/ai/smoke${RUN}`, `/http/ai/post${RUN}`);
+  expect(ctx.postEndpoint, 'no POST endpoint; run with S18 in ONLY');
 });
 
 await scenario('S47', 'POST receiver gets method, static query and body', async () => {
@@ -914,7 +914,7 @@ await scenario('S79', 'full chain after recovery: client → APIM (provider) →
   const proxy = ok(await call('apim_get_api_proxy', { name: PROXY_CPI_PROVIDER }), 'get');
   const result = await invoke(proxy.runtime_url, { body: '{"final":true}', done: response => response.status === 200 && /restored/.test(response.json?.url || '') });
   expect(result.status === 200 && JSON.parse(result.json.data).final === true, `HTTP ${result.status}`);
-  const detail = await waitForGuid(result.json.headers['Sap-Messageprocessinglogid']);
+  const detail = await waitForGuid(result.headers['sap_messageprocessinglogid']);
   expect(detail.log.Status === 'COMPLETED', detail.log.Status);
 });
 

package/src/setup.mjs

@@ -292,18 +292,20 @@ export function integrationSuiteCredentialStatus(env = process.env) {
     const config = resolveIntegrationConfig(env, { stored: readStoredIntegrationKeys(env) });
     const keys = ['cpi', 'apim', 'devhub', ...OPTIONAL_COMPONENT_KEYS];
     const side = (key, value) => {
-      if (!value) return 'not configured';
       const host = value.url ? new URL(value.url).host : key === 'aem' ? 'api.solace.cloud' : 'unknown';
       return `configured from ${value.source}${value.bindingName ? ` (${value.bindingName})` : ''}, host ${host}`;
     };
-    return { found: keys.some(key => Boolean(config[key])), config, lines: [
-      `Environment label: ${config.environment ?? 'default'} (tenant authority remains bound host identity)`,
-      ...keys.map(key => `${key.toUpperCase()}: ${side(key, config[key])}`),
-      ...(config.optional_config_errors ?? []).map(error => `${error.component.toUpperCase()}: invalid optional configuration (${error.source}); adapter disabled`)
+    const configured = keys.filter(key => config[key]);
+    const errors = (config.optional_config_errors ?? []).map(error => `${error.component.toUpperCase()}: invalid optional configuration (${error.source}); adapter disabled`);
+    if (!configured.length && !errors.length) return { found: false, config, lines: ['No Integration Suite credentials configured yet.'] };
+    return { found: configured.length > 0, config, lines: [
+      ...(config.environment ? [`Environment label: ${config.environment}`] : []),
+      ...configured.map(key => `${key.toUpperCase()}: ${side(key, config[key])}`),
+      ...errors
     ] };
   } catch (error) {
     const message = String(error?.message || '');
-    if (/^Configure CPI/.test(message)) return { found: false, config: null, lines: ['No Integration Suite component credentials were found in this environment.'] };
+    if (/^Configure CPI/.test(message)) return { found: false, config: null, lines: ['No Integration Suite credentials configured yet.'] };
     return { found: false, config: null, lines: [`Credentials found but not usable: ${message}`] };
   }
 }
@@ -330,7 +332,7 @@ function pastedServiceKey(side, value, env) {
 }
 
 async function printIntegrationVerification(config, { env, output, verifyIntegration }) {
-  const stop = startProgress('Checking configured core and optional Integration Suite access', { output, env, label: 'Integration Suite' });
+  const stop = startProgress('Checking Integration Suite access', { output, env, label: 'Integration Suite' });
   let report;
   try { report = await verifyIntegration(config, { env }); }
   finally { stop(); }
@@ -344,12 +346,12 @@ async function printIntegrationVerification(config, { env, output, verifyIntegra
   }
   const core = [report.cpi, report.apim, report.devhub].filter(side => side?.configured);
   const denied = core.flatMap(side => side.checks ?? []).filter(check => check.result === 'forbidden').length;
-  const message = !core.length ? 'No core clients configured; optional checks are reported separately.'
-    : report.ok ? `Configured core access verified${denied ? `; ${denied} capability checks were access-denied (cause not established)` : ''}.`
-      : 'Configured core reads did not pass. Inspect the individual access evidence; a role or entitlement diagnosis is not established.';
+  const message = !core.length ? 'No core service configured yet.'
+    : report.ok ? (denied ? `Connected; ${denied} area(s) were access-denied — the key may lack roles.` : 'Connection verified.')
+      : 'Sign-in or core read failed; see the lines above.';
   print(output, formatStatus(message, report.ok && !denied ? 'success' : 'warning', output, 'Integration Suite'));
   const optional = OPTIONAL_COMPONENT_KEYS.filter(side => report[side]?.configured);
-  if (optional.length) print(output, `  Optional capability completeness: ${report.optional_completeness?.complete === true ? 'complete' : 'unverified/partial'}; core access is a separate result.`);
+  if (optional.length) print(output, `  Optional services: ${report.optional_completeness?.complete === true ? 'all verified' : 'not fully verified'} (separate from core access).`);
   return report;
 }
 
@@ -470,6 +472,26 @@ async function useCloudFoundrySpace(target, context) {
   }
 }
 
+// The paste flow asks which service the key belongs to; APIM and Developer Hub keys share one OAuth shape,
+// so the type is never guessed from the key itself.
+async function chooseKeyType({ input, output, status }) {
+  return await selectPrompt({
+    message: colorText('Which service is this key for?', 'cyan', output),
+    defaultValue: ['CPI', 'APIM', 'DEVHUB'].find(side => !status.config?.[side.toLowerCase()]) ?? 'CPI',
+    choices: [
+      { value: 'CPI', shortcut: 'i', name: 'Cloud Integration (CPI) — Process Integration Runtime, plan api' },
+      { value: 'APIM', shortcut: 'a', name: 'API Management — plan apiportal-apiaccess' },
+      { value: 'DEVHUB', shortcut: 'd', name: 'Developer Hub — plan devportal-apiaccess (AuthGroup.API.Admin)' },
+      ...OPTIONAL_COMPONENT_KEYS.map(side => ({
+        value: side.toUpperCase(),
+        shortcut: { ctms: 't', ans: 'n', event_mesh: 'e', aem: 'm', aem_semp: 's', open_connectors: 'o', edge: 'g' }[side],
+        name: `Optional: ${OPTIONAL_INPUTS[side].label} (${OPTIONAL_INPUTS[side].variable}, existing credentials only)`
+      })),
+      { value: '', shortcut: 'b', name: 'Back' }
+    ]
+  }, { input, output });
+}
+
 // Verify the detected credentials online and let the user take CPI/APIM/DEVHUB keys from the logged-in CF space or
 // paste them. A key is checked online first and saved to the user-only store (never to mcp.json); it is used
 // when the environment has no key.
@@ -502,20 +524,13 @@ async function configureIntegrationCredentials({ env, input, output, verifyInteg
       : [];
     const choice = await selectPrompt({
       message: colorText('🔑 Integration Suite credentials', 'cyan', output),
-      defaultValue: healthy ? 'done' : (fixes[0]?.value ?? (target.available ? 'cf' : (status.found ? 'done' : 'cpi'))),
+      defaultValue: healthy ? 'done' : (fixes[0]?.value ?? (target.available ? 'cf' : (status.found ? 'done' : 'paste'))),
       choices: [
         ...fixes,
-        { name: !status.found ? 'Continue without credentials (operational tools need configured component access)' : (healthy ? 'Continue' : 'Continue with current access (unavailable capabilities remain unverified)'), value: 'done', shortcut: 'c' },
-        ...(target.available ? [{ name: `Use the logged-in CF space (${space}): find instances, reuse or create keys`, value: 'cf', shortcut: 'f' }] : []),
-        { name: 'Paste a Cloud Integration (CPI) service key — Process Integration Runtime, plan api', value: 'cpi', shortcut: 'p' },
-        { name: 'Paste an API Management service key — API Management, plan apiportal-apiaccess', value: 'apim', shortcut: 'a' },
-        { name: 'Paste a Developer Hub service key — API Management, Developer Hub, plan devportal-apiaccess (AuthGroup.API.Admin)', value: 'devhub', shortcut: 'd' },
-        ...OPTIONAL_COMPONENT_KEYS.map(side => ({
-          name: `Paste existing ${OPTIONAL_INPUTS[side].label} configuration — ${OPTIONAL_INPUTS[side].variable} (no provisioning)`,
-          value: `optional-${side}`,
-          shortcut: { ctms: 't', ans: 'n', event_mesh: 'e', aem: 'm', aem_semp: 's', open_connectors: 'o', edge: 'g' }[side]
-        })),
-        ...(status.found ? [{ name: 'Check the configured credentials online again', value: 'verify', shortcut: 'v' }] : [])
+        ...(target.available ? [{ value: 'cf', shortcut: 'f', name: `Get keys from Cloud Foundry (${space})` }] : []),
+        { value: 'paste', shortcut: 'p', name: 'Paste a service key (JSON or path to a .json file)' },
+        ...(status.found ? [{ value: 'verify', shortcut: 'v', name: 'Check credentials again' }] : []),
+        { value: 'done', shortcut: 'c', name: status.found ? (healthy ? 'Done' : 'Done (some checks did not pass)') : 'Skip for now (run sap-ai-dev --setup-integration later)' }
       ]
     }, { input, output });
     if (choice === 'done') return status;
@@ -527,8 +542,9 @@ async function configureIntegrationCredentials({ env, input, output, verifyInteg
       await createDedicatedInstance(choice.slice('create-'.length).toUpperCase(), context);
     } else if (choice === 'cf') {
       await useCloudFoundrySpace(target, context);
-    } else {
-      const side = (choice.startsWith('optional-') ? choice.slice('optional-'.length) : choice).toUpperCase();
+    } else if (choice === 'paste') {
+      const side = await chooseKeyType({ input, output, status });
+      if (!side) continue; // Back: show the menu again without refreshing status.
       const pasted = await textPrompt({
         message: `Paste existing ${side} credential JSON or the path to its .json file`,
         secret: true,
@@ -550,16 +566,12 @@ async function configureIntegrationCredentials({ env, input, output, verifyInteg
 
 async function promptIntegrationSuite({ env, alreadyConfigured, input, output, verifyIntegration = defaultVerifyIntegration, integrationCloudFoundry, ask = true }) {
   print(output, '');
-  print(output, formatStatus('SAP Integration Suite tools (core lifecycle and separately credentialed optional services).', 'step', output, 'Integration Suite'));
-  print(output, '  Adds the sap-ai-integration MCP server: author/configure/release, bounded monitoring and diagnosis, guarded recovery/retirement, and evidence-backed optional/native workflows.');
-  print(output, '  Writes require exact approval; private previews are not approval. Optional setup accepts existing credentials only, without provisioning. Agents: SAP Integration Architect, SAP Integration Developer.');
+  print(output, formatStatus('SAP Integration Suite tools', 'step', output, 'Integration Suite'));
+  print(output, '  Connects your AI agent to Cloud Integration (CPI), API Management and Developer Hub. Keys are checked read-only and stored only for you, never in mcp.json.');
   if (alreadyConfigured) print(output, '  Already configured in this MCP config; keeping it and refreshing its version.');
   const status = integrationSuiteCredentialStatus(env);
   for (const line of status.lines) print(output, `  ${line}`);
-  if (!status.found) {
-    print(output, '  Configure existing core or optional component credentials in the MCP host environment,');
-    print(output, '  or paste typed credential JSON in the next hidden step. Credentials are verified read-only and stored user-only, never in mcp.json.');
-  }
+  if (!status.found) print(output, '  No credentials found yet. Next you can get them from your Cloud Foundry space or paste a service key.');
   if (ask && !alreadyConfigured) {
     print(output, '');
     const defaultYes = status.found;