sap-ai-dev-toolkit 0.9.9921 → 0.9.9922

package/NOTICE

@@ -2,7 +2,8 @@ Third-party notices for sap-ai-dev-toolkit
 
 This package includes patched VSP (vibing-steampunk) binaries built from upstream commit
 9886d2727f47506368b0a3c2f1c1766f1200f747. The BAS proxy-auth change is documented in
-patches/vsp-bas-proxy-auth.patch. The following upstream notice is reproduced from VSP:
+patches/vsp-bas-proxy-auth.patch; the namespaced class-include EditSource fix is documented in
+patches/vsp-namespaced-class-include-edit.patch. The following upstream notice is reproduced from VSP:
 
 vibing-steampunk (vsp)
 Copyright (c) 2025-2026 Alice Vinogradova and contributors

package/dist/checksums.txt

@@ -1,5 +1,5 @@
-885ba61e5aa31e1bfe21953040a5cdb5e06c3eb648495f03b7cb035b2fd9d2c2  vsp-linux-x64
-34f392bfbd853dd2b24abd95fda351d25633b538728371f881ee475a65904b31  vsp-linux-arm64
-cee27c146031fd932bf974ca359c6c0263c1ea1c20fe120f5244948af5ae1743  vsp-darwin-x64
-320deb50652f0a29c8624c56e7cb150cb27a4e381b42c9b8c1edda1c3ad64a81  vsp-darwin-arm64
-574885013902ccd93645ca7890cdff1c02ea769799df019f1d086d41f9e2cb71  vsp-win32-x64.exe
+31902921b0d2b5349be8e392aae3632ca8c3dee26950ea30c412ec83271722f3  vsp-linux-x64
+df39b324fe419348f5157954d56c5f8d60e5bac28edc04a56e90c380b67de10d  vsp-linux-arm64
+754338fbbbe66260cac722677753b16a0a2f23127b947bf1f3a189044fa66c32  vsp-darwin-x64
+ac153052b5d02b2f19a536623c957369af3412f5bbe2eed0f6a43e8597ed0f1b  vsp-darwin-arm64
+722c6de352719dd9374932b56546189a75c29800e74da3bdcb0308b2034248ac  vsp-win32-x64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.9.9921",
+  "version": "0.9.9922",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/patches/vsp-namespaced-class-include-edit.patch

@@ -0,0 +1,134 @@
+diff --git a/pkg/adt/edit_namespaced_include_test.go b/pkg/adt/edit_namespaced_include_test.go
+new file mode 100644
+index 0000000..514ab35
+--- /dev/null
++++ b/pkg/adt/edit_namespaced_include_test.go
+@@ -0,0 +1,80 @@
++package adt
++
++import (
++	"context"
++	"io"
++	"net/http"
++	"net/http/httptest"
++	"strings"
++	"sync"
++	"testing"
++)
++
++// TestEditSource_NamespacedClassInclude guards against double-encoding the
++// class name of a namespaced class include: the object URL arrives with
++// "%2FABC%2F", and every request (read, lock, hash check, PUT, unlock,
++// activate) must keep exactly one encoding — never "%252F".
++func TestEditSource_NamespacedClassInclude(t *testing.T) {
++	const source = "CLASS lcl_x DEFINITION.\n  \" old\nENDCLASS.\n"
++	const classPath = "/sap/bc/adt/oo/classes/%2FABC%2FCL_TEST"
++
++	for _, include := range []string{"definitions", "implementations", "testclasses"} {
++		for _, withHash := range []bool{false, true} {
++			name := include
++			if withHash {
++				name += "/hash"
++			}
++			t.Run(name, func(t *testing.T) {
++				includePath := classPath + "/includes/" + include
++				var mu sync.Mutex
++				var puts []string
++				current := source
++				srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
++					w.Header().Set("x-csrf-token", "TOKEN")
++					raw := r.URL.EscapedPath()
++					if strings.Contains(raw, "%25") {
++						t.Errorf("double-encoded request: %s %s", r.Method, r.RequestURI)
++						w.WriteHeader(http.StatusNotFound)
++						return
++					}
++					switch {
++					case r.URL.Query().Get("_action") == "LOCK":
++						w.Header().Set("Content-Type", "application/xml")
++						_, _ = w.Write([]byte(`<?xml version="1.0"?><asx:abap xmlns:asx="http://www.sap.com/abapxml">
++						  <asx:values><DATA><LOCK_HANDLE>HANDLE-1</LOCK_HANDLE>
++						  <MODIFICATION_SUPPORT>Modification</MODIFICATION_SUPPORT></DATA></asx:values></asx:abap>`))
++					case r.Method == http.MethodGet && raw == includePath:
++						mu.Lock()
++						_, _ = w.Write([]byte(current))
++						mu.Unlock()
++					case r.Method == http.MethodPut:
++						mu.Lock()
++						puts = append(puts, raw)
++						body, _ := io.ReadAll(r.Body)
++						current = string(body)
++						mu.Unlock()
++					default:
++						w.WriteHeader(http.StatusOK)
++					}
++				}))
++				defer srv.Close()
++
++				opts := &EditSourceOptions{}
++				if withHash {
++					opts.ExpectedSourceHash = SourceHash(source)
++				}
++				c := NewClient(srv.URL, "TESTUSER", "pw")
++				res, err := c.EditSourceWithOptions(context.Background(), includePath, "\" old", "\" new", opts)
++				if err != nil {
++					t.Fatalf("EditSourceWithOptions: %v", err)
++				}
++				if !res.Success {
++					t.Fatalf("edit failed: %s", res.Message)
++				}
++				if len(puts) != 1 || puts[0] != includePath {
++					t.Fatalf("PUT paths = %v, want [%s]", puts, includePath)
++				}
++			})
++		}
++	}
++}
+diff --git a/pkg/adt/workflows_edit.go b/pkg/adt/workflows_edit.go
+index 6da5df7..01c02e0 100644
+--- a/pkg/adt/workflows_edit.go
++++ b/pkg/adt/workflows_edit.go
+@@ -3,6 +3,7 @@ package adt
+ import (
+ 	"context"
+ 	"fmt"
++	"net/url"
+ 	"strings"
+ )
+ 
+@@ -204,9 +205,9 @@ func (c *Client) EditSourceWithOptions(ctx context.Context, objectURL, oldString
+ 		if idx := strings.Index(objectURL, classesPrefix); idx >= 0 {
+ 			rest := objectURL[idx+len(classesPrefix):]
+ 			if slashIdx := strings.Index(rest, "/"); slashIdx > 0 {
+-				classNameForMethod = rest[:slashIdx]
++				classNameForMethod = decodeClassNameSegment(rest[:slashIdx])
+ 			} else {
+-				classNameForMethod = rest
++				classNameForMethod = decodeClassNameSegment(rest)
+ 			}
+ 		}
+ 		result.Method = opts.Method
+@@ -227,7 +228,7 @@ func (c *Client) EditSourceWithOptions(ctx context.Context, objectURL, oldString
+ 			classesPrefix := "/sap/bc/adt/oo/classes/"
+ 			if strings.Contains(objectURL, classesPrefix) {
+ 				classStart := strings.Index(objectURL, classesPrefix) + len(classesPrefix)
+-				className = objectURL[classStart:includesIdx]
++				className = decodeClassNameSegment(objectURL[classStart:includesIdx])
+ 				includeType = ClassIncludeType(objectURL[includesIdx+len("/includes/"):])
+ 				parentClassURL = objectURL[:includesIdx]
+ 			}
+@@ -488,3 +489,14 @@ func (c *Client) EditSourceWithOptions(ctx context.Context, objectURL, oldString
+ 	}
+ 	return result, nil
+ }
++
++// decodeClassNameSegment turns the class-name path segment of an object URL
++// ("%2FABC%2FCL_TEST") into the raw name ("/ABC/CL_TEST"). Downstream helpers
++// (GetClassIncludeSourceURL, GetClassMethods, activation) escape the name
++// themselves, so passing the still-encoded segment would yield "%252F".
++func decodeClassNameSegment(segment string) string {
++	if decoded, err := url.PathUnescape(segment); err == nil {
++		return decoded
++	}
++	return segment
++}

package/scripts/build-vsp.mjs

@@ -33,7 +33,9 @@ async function main() {
   await mkdir(dirname(source), { recursive: true });
   await run('git', ['clone', '--filter=blob:none', upstream, source]);
   await run('git', ['-C', source, 'checkout', '--detach', commit]);
-  await run('patch', ['-p1', '-i', join(root, 'patches', 'vsp-bas-proxy-auth.patch')], { cwd: source });
+  for (const patchFile of ['vsp-bas-proxy-auth.patch', 'vsp-namespaced-class-include-edit.patch']) {
+    await run('patch', ['-p1', '-i', join(root, 'patches', patchFile)], { cwd: source });
+  }
   await mkdir(dist, { recursive: true });
   const checksums = [];
   for (const [goos, goarch, os, arch, extension] of targets) {