sap-ai-dev-toolkit 0.9.9922 → 0.9.9924

package/patches/vsp-single-logon.patch

@@ -0,0 +1,258 @@
+diff --git a/pkg/adt/http.go b/pkg/adt/http.go
+index e420573..5386a26 100755
+--- a/pkg/adt/http.go
++++ b/pkg/adt/http.go
+@@ -12,6 +12,7 @@ import (
+ 	"os"
+ 	"strings"
+ 	"sync"
++	"sync/atomic"
+ 	"time"
+ )
+ 
+@@ -135,6 +136,10 @@ type Transport struct {
+ 	// from triggering simultaneous SAML dances.
+ 	reauthMu   sync.Mutex
+ 	lastReauth time.Time
++
++	// Logon single-flight: see http_logon_gate.go.
++	logonSlot    chan struct{}
++	logonSettled atomic.Bool
+ }
+ 
+ // NewTransport creates a new Transport with the given configuration.
+@@ -149,6 +154,7 @@ func NewTransportWithClient(cfg *Config, client HTTPDoer) *Transport {
+ 	t := &Transport{
+ 		config:     cfg,
+ 		httpClient: client,
++		logonSlot:  make(chan struct{}, 1),
+ 	}
+ 	if cfg.Cache {
+ 		t.cache = newResponseCache(cfg.CacheStore, cfg.CacheTTL)
+@@ -212,10 +218,10 @@ func (t *Transport) Request(ctx context.Context, path string, opts *RequestOptio
+ 		opts.Method = http.MethodGet
+ 	}
+ 	if t.cache == nil {
+-		return t.request(ctx, path, opts)
++		return t.gatedRequest(ctx, path, opts)
+ 	}
+ 	if !cacheable(path, opts) {
+-		resp, err := t.request(ctx, path, opts)
++		resp, err := t.gatedRequest(ctx, path, opts)
+ 		if isModifyingMethod(opts.Method) && !strings.HasPrefix(path, "/sap/bc/adt/datapreview/") {
+ 			t.cache.invalidate()
+ 		}
+@@ -229,7 +235,7 @@ func (t *Transport) Request(ctx context.Context, path string, opts *RequestOptio
+ 	if resp, ok := t.cache.get(key); ok {
+ 		return resp, nil
+ 	}
+-	resp, err := t.request(ctx, path, opts)
++	resp, err := t.gatedRequest(ctx, path, opts)
+ 	if err == nil && resp != nil && resp.StatusCode >= 200 && resp.StatusCode < 300 {
+ 		t.cache.put(key, resp)
+ 	}
+@@ -1062,6 +1068,8 @@ func (t *Transport) resetCookieJar() {
+ 	}
+ 	if jar, err := cookiejar.New(nil); err == nil {
+ 		client.Jar = jar
++		// The new jar holds no session: the next requests must share one logon again.
++		t.logonSettled.Store(false)
+ 	}
+ }
+ 
+diff --git a/pkg/adt/http_logon_gate.go b/pkg/adt/http_logon_gate.go
+new file mode 100644
+index 0000000..9e71c60
+--- /dev/null
++++ b/pkg/adt/http_logon_gate.go
+@@ -0,0 +1,76 @@
++package adt
++
++import (
++	"context"
++	"net/http"
++	"net/url"
++	"strings"
++)
++
++// Every request that reaches SAP without a security-session cookie is a new
++// logon: SAP authenticates it and opens a security session of its own, which
++// lingers in SM04 until it times out. MCP clients fan tool calls out in
++// parallel, so a cold transport used to send each of them without a cookie
++// and opened one session per call (dozens per burst for one user).
++//
++// gatedRequest lets exactly one request log on while the jar holds no session
++// cookie; the others wait for it and then reuse the cookie it brought back.
++// When that request succeeds without the server issuing a session cookie
++// (security sessions off, or a proxy chain that keeps them), the gate settles
++// open so requests are never serialized for nothing. Dropping the jar after an
++// expired session re-arms it.
++func (t *Transport) gatedRequest(ctx context.Context, path string, opts *RequestOptions) (*Response, error) {
++	if t.logonSlot == nil || t.logonSettled.Load() || t.hasSessionCookie() {
++		return t.request(ctx, path, opts)
++	}
++	select {
++	case t.logonSlot <- struct{}{}:
++	case <-ctx.Done():
++		return nil, ctx.Err()
++	}
++	if t.logonSettled.Load() || t.hasSessionCookie() {
++		<-t.logonSlot
++		return t.request(ctx, path, opts)
++	}
++	resp, err := t.request(ctx, path, opts)
++	if err == nil && !t.hasSessionCookie() {
++		t.logonSettled.Store(true)
++	}
++	<-t.logonSlot
++	return resp, err
++}
++
++// hasSessionCookie reports whether requests to the SAP system already carry
++// a security session: one the jar learned from the server, or one the caller
++// supplied for cookie authentication.
++func (t *Transport) hasSessionCookie() bool {
++	t.cookiesMu.RLock()
++	for name := range t.config.Cookies {
++		if isSessionCookieName(name) {
++			t.cookiesMu.RUnlock()
++			return true
++		}
++	}
++	t.cookiesMu.RUnlock()
++	client, ok := t.httpClient.(*http.Client)
++	if !ok || client.Jar == nil {
++		return false
++	}
++	base, err := url.Parse(strings.TrimRight(t.config.BaseURL, "/") + "/sap/bc/adt/")
++	if err != nil {
++		return false
++	}
++	for _, cookie := range client.Jar.Cookies(base) {
++		if isSessionCookieName(cookie.Name) {
++			return true
++		}
++	}
++	return false
++}
++
++// isSessionCookieName matches the ICF security-session cookie
++// (SAP_SESSIONID_<SID>_<client>). A MYSAPSSO2 logon ticket does not count:
++// every request presenting only the ticket opens another session.
++func isSessionCookieName(name string) bool {
++	return strings.HasPrefix(name, "SAP_SESSIONID")
++}
+diff --git a/pkg/adt/http_logon_gate_test.go b/pkg/adt/http_logon_gate_test.go
+new file mode 100644
+index 0000000..e973790
+--- /dev/null
++++ b/pkg/adt/http_logon_gate_test.go
+@@ -0,0 +1,108 @@
++package adt
++
++import (
++	"context"
++	"fmt"
++	"net/http"
++	"net/http/httptest"
++	"sync"
++	"sync/atomic"
++	"testing"
++	"time"
++)
++
++// sapSessionServer mimics ICF security sessions: a request without a live
++// SAP_SESSIONID cookie is a logon and, when issueCookies, gets a new one.
++type sapSessionServer struct {
++	issueCookies bool
++	logons       atomic.Int32
++	inFlight     atomic.Int32
++	peak         atomic.Int32
++	mu           sync.Mutex
++	live         map[string]bool
++}
++
++func (s *sapSessionServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
++	now := s.inFlight.Add(1)
++	defer s.inFlight.Add(-1)
++	for {
++		peak := s.peak.Load()
++		if now <= peak || s.peak.CompareAndSwap(peak, now) {
++			break
++		}
++	}
++	s.mu.Lock()
++	cookie, err := r.Cookie("SAP_SESSIONID_T4D_100")
++	if err != nil || !s.live[cookie.Value] {
++		id := fmt.Sprintf("S%d", s.logons.Add(1))
++		if s.issueCookies {
++			s.live[id] = true
++			http.SetCookie(w, &http.Cookie{Name: "SAP_SESSIONID_T4D_100", Value: id, Path: "/"})
++		}
++	}
++	s.mu.Unlock()
++	w.Header().Add("Set-Cookie", "sap-usercontext=sap-client=100; path=/")
++	time.Sleep(30 * time.Millisecond)
++	fmt.Fprint(w, "ok")
++}
++
++func newSessionTransport(t *testing.T, issueCookies bool) (*Transport, *sapSessionServer) {
++	t.Helper()
++	sap := &sapSessionServer{issueCookies: issueCookies, live: map[string]bool{}}
++	server := httptest.NewServer(sap)
++	t.Cleanup(server.Close)
++	return NewTransport(NewConfig(server.URL, "EMSDI0845", "secret", WithClient("100"))), sap
++}
++
++func burst(t *testing.T, transport *Transport, n int) {
++	t.Helper()
++	var wg sync.WaitGroup
++	errs := make(chan error, n)
++	for i := range n {
++		wg.Add(1)
++		go func() {
++			defer wg.Done()
++			if _, err := transport.Request(context.Background(), fmt.Sprintf("/sap/bc/adt/oo/classes/ZCL_%d/source/main", i), nil); err != nil {
++				errs <- err
++			}
++		}()
++	}
++	wg.Wait()
++	close(errs)
++	for err := range errs {
++		t.Fatalf("request failed: %v", err)
++	}
++}
++
++func TestTransport_ConcurrentColdRequestsShareOneLogon(t *testing.T) {
++	transport, sap := newSessionTransport(t, true)
++
++	burst(t, transport, 12)
++	burst(t, transport, 12)
++
++	if got := sap.logons.Load(); got != 1 {
++		t.Fatalf("logons = %d, want 1: parallel tool calls must reuse one SAP security session", got)
++	}
++}
++
++func TestTransport_LogonGateOpensWhenServerKeepsNoSession(t *testing.T) {
++	transport, sap := newSessionTransport(t, false)
++
++	burst(t, transport, 12)
++
++	if peak := sap.peak.Load(); peak < 2 {
++		t.Fatalf("peak concurrency = %d: without session cookies the gate must not serialize every request", peak)
++	}
++}
++
++func TestTransport_LogonGateRearmsAfterJarReset(t *testing.T) {
++	transport, sap := newSessionTransport(t, true)
++
++	burst(t, transport, 6)
++	transport.resetCookieJar()
++	burst(t, transport, 6)
++
++	if got := sap.logons.Load(); got != 2 {
++		t.Fatalf("logons = %d, want 2 (one per session)", got)
++	}
++}

package/scripts/build-vsp.mjs

@@ -33,7 +33,7 @@ async function main() {
   await mkdir(dirname(source), { recursive: true });
   await run('git', ['clone', '--filter=blob:none', upstream, source]);
   await run('git', ['-C', source, 'checkout', '--detach', commit]);
-  for (const patchFile of ['vsp-bas-proxy-auth.patch', 'vsp-namespaced-class-include-edit.patch']) {
+  for (const patchFile of ['vsp-bas-proxy-auth.patch', 'vsp-namespaced-class-include-edit.patch', 'vsp-single-logon.patch']) {
     await run('patch', ['-p1', '-i', join(root, 'patches', patchFile)], { cwd: source });
   }
   await mkdir(dist, { recursive: true });

package/src/btp-cli.mjs

@@ -0,0 +1,199 @@
+// Child-process runner for the SAP BTP CLI. It uses the user's own
+// `btp login --sso` session from the CLI configuration and never logs in by
+// itself (except loginBtpCli, called from the setup wizard). It never runs
+// `btp target`; every subaccount-scoped call passes --subaccount. Calls are
+// serialized so session refreshes inside the CLI cannot race.
+import { execFile, spawn } from 'node:child_process';
+import { constants, readFileSync } from 'node:fs';
+import { access } from 'node:fs/promises';
+import { delimiter, resolve } from 'node:path';
+import { IntegrationError } from './integration-http.mjs';
+import { diagnosticText } from './redact.mjs';
+import { userConfigFilePath, writeUserOnlyJson } from './integration-credentials.mjs';
+
+const CLI_TIMEOUT_MS = 120_000;
+// Global-account entitlement JSON carries an iconBase64 per service.
+const MAX_BUFFER = 32 * 1024 * 1024;
+const ERROR_CAP = 800;
+const LOGIN_REQUIRED = /Unknown session|Please log in|log in again|session (?:has )?expired/i;
+
+export const BTP_LOGIN_REQUIRED_MESSAGE = 'The btp CLI session is missing or expired (sessions last at most 12 hours). Run "btp login --sso" in a terminal, or sap-ai-dev --setup-btp, then retry.';
+
+/** Parse btp CLI JSON output; tolerates notices around the JSON. null for empty output, undefined when not JSON. */
+export function parseCliJson(text) {
+  const trimmed = String(text ?? '').trim();
+  if (!trimmed) return null;
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    // Retry on the outermost JSON value below.
+  }
+  const starts = [trimmed.indexOf('{'), trimmed.indexOf('[')].filter(index => index >= 0);
+  const end = Math.max(trimmed.lastIndexOf('}'), trimmed.lastIndexOf(']'));
+  if (!starts.length || end < 0) return undefined;
+  const start = Math.min(...starts);
+  if (end <= start) return undefined;
+  try {
+    return JSON.parse(trimmed.slice(start, end + 1));
+  } catch {
+    return undefined;
+  }
+}
+
+export function btpSettingsPath(env = process.env) {
+  return userConfigFilePath(env, 'btp.json');
+}
+
+/** Stored { cli?, config? } written by sap-ai-dev --setup-btp; {} when absent. */
+export function readBtpSettings(env = process.env) {
+  const path = btpSettingsPath(env);
+  let text;
+  try {
+    text = readFileSync(path, 'utf8');
+  } catch (error) {
+    if (error?.code === 'ENOENT') return {};
+    throw new Error(`Stored btp CLI settings at ${path} could not be read`);
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`Stored btp CLI settings at ${path} are not valid JSON; rerun sap-ai-dev --setup-btp`);
+  }
+}
+
+export async function storeBtpSettings(settings, env = process.env) {
+  return writeUserOnlyJson(btpSettingsPath(env), settings);
+}
+
+const trimmed = value => (typeof value === 'string' ? value.trim() : '');
+
+export function resolveBtpCliSettings(env = process.env, { stored = readBtpSettings(env) } = {}) {
+  const fromEnv = trimmed(env.BTP_CLI);
+  const fromStore = trimmed(stored?.cli);
+  const cli = fromEnv || fromStore || 'btp';
+  const cliSource = fromEnv ? 'environment' : fromStore ? 'stored' : 'PATH';
+  const config = trimmed(env.BTP_CLIENTCONFIG) || trimmed(stored?.config) || null;
+  return Object.freeze({ cli, cliSource, config });
+}
+
+/** Absolute path of the btp executable on PATH, or null. */
+export async function locateBtpCli(env = process.env) {
+  const executableNames = process.platform === 'win32' ? ['btp.exe', 'btp'] : ['btp'];
+  const searchPath = String(env.PATH || env.Path || '').split(delimiter).filter(Boolean);
+  for (const directory of searchPath) {
+    for (const executableName of executableNames) {
+      const candidate = resolve(directory, executableName);
+      try {
+        await access(candidate, constants.X_OK);
+        return candidate;
+      } catch {
+        // Continue searching PATH.
+      }
+    }
+  }
+  return null;
+}
+
+const childEnvironment = (env, config) => (config ? { ...env, BTP_CLIENTCONFIG: config } : env);
+
+const missingCliError = cli => new IntegrationError(
+  `btp CLI not found (${cli}). Install the SAP BTP command line interface from https://tools.hana.ondemand.com/#cloud, then rerun sap-ai-dev --setup-btp or set BTP_CLI to its path.`,
+  { code: 'BTP_CLI_MISSING' }
+);
+
+function flatten(flags = {}) {
+  const argv = [];
+  for (const [name, value] of Object.entries(flags)) {
+    if (value === undefined || value === null || value === false) continue;
+    if (value === true) argv.push(`--${name}`);
+    else argv.push(`--${name}`, String(value));
+  }
+  return argv;
+}
+
+function errorDetail(stderr, stdout, error) {
+  const raw = String(stderr || '').trim() || String(stdout || '').trim() || String(error?.message || '');
+  const lines = raw.split(/\r?\n/)
+    .map(line => line.trim())
+    .filter(line => line && !/^(?:✗ ERROR|ERROR|OK)$/.test(line) && !line.startsWith('SAP BTP command line interface'));
+  return diagnosticText(lines.join(' '), ERROR_CAP);
+}
+
+export function createBtpCli({ cli, config = null, env = process.env, execFileImpl = execFile } = {}) {
+  if (!cli) throw new Error('btp CLI runner needs the btp executable');
+  const childEnv = childEnvironment(env, config);
+  let queue = Promise.resolve();
+
+  const enqueue = operation => {
+    const result = queue.then(operation);
+    queue = result.then(() => undefined, () => undefined);
+    return result;
+  };
+
+  const exec = (words, argv) => enqueue(() => new Promise((resolvePromise, reject) => {
+    const label = words.join(' ');
+    const child = execFileImpl(cli, argv, {
+      env: childEnv,
+      timeout: CLI_TIMEOUT_MS,
+      maxBuffer: MAX_BUFFER,
+      windowsHide: true
+    }, (error, stdout, stderr) => {
+      if (error) {
+        if (error.code === 'ENOENT') {
+          reject(missingCliError(cli));
+          return;
+        }
+        if (error.code === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER') {
+          reject(new IntegrationError(`btp CLI "${label}" output exceeded 32 MiB; narrow the request`));
+          return;
+        }
+        if (error.killed) {
+          reject(new IntegrationError(`btp CLI "${label}" timed out after ${CLI_TIMEOUT_MS / 1000} s`, { code: 'BTP_CLI_TIMEOUT' }));
+          return;
+        }
+        if (LOGIN_REQUIRED.test(`${stderr ?? ''}\n${stdout ?? ''}`)) {
+          reject(new IntegrationError(BTP_LOGIN_REQUIRED_MESSAGE, { code: 'BTP_LOGIN_REQUIRED' }));
+          return;
+        }
+        reject(new IntegrationError(`btp CLI "${label}" failed: ${errorDetail(stderr, stdout, error)}`));
+        return;
+      }
+      resolvePromise(String(stdout ?? ''));
+    });
+    child?.stdin?.end();
+  }));
+
+  const text = (words, flags) => exec(words, ['--format', 'json', ...words, ...flatten(flags)]);
+
+  const json = async (words, flags) => {
+    const stdout = await text(words, flags);
+    const parsed = parseCliJson(stdout);
+    if (parsed === undefined) throw new IntegrationError(`btp CLI "${words.join(' ')}" returned output that is not JSON`);
+    return parsed;
+  };
+
+  const version = async () => {
+    const stdout = await exec(['--version'], ['--version']);
+    return stdout.match(/client v(\d+(?:\.\d+)+)/)?.[1] ?? null;
+  };
+
+  return { json, text, version };
+}
+
+/** Interactive `btp login --sso` on the caller's terminal (setup wizard only). */
+export function loginBtpCli({ cli, config = null, env = process.env, spawnImpl = spawn } = {}) {
+  return new Promise((resolvePromise, reject) => {
+    let child;
+    try {
+      child = spawnImpl(cli, ['login', '--sso'], { env: childEnvironment(env, config), stdio: 'inherit' });
+    } catch (error) {
+      reject(error?.code === 'ENOENT' ? missingCliError(cli) : error);
+      return;
+    }
+    child.once('error', error => reject(error?.code === 'ENOENT' ? missingCliError(cli) : error));
+    child.once('exit', code => {
+      if (code === 0) resolvePromise();
+      else reject(new IntegrationError(`btp login --sso exited with code ${code}`));
+    });
+  });
+}

package/src/btp-server.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+// sap-ai-btp: stdio MCP server for SAP BTP core platform administration through
+// the user's own btp CLI login (btp login --sso): account hierarchy, entitlements
+// and quotas, Service Manager instances and keys, destinations, trust and Cloud
+// Connectors. The toolkit stores no credentials for it.
+import { realpathSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { btpSettingsPath, createBtpCli, resolveBtpCliSettings } from './btp-cli.mjs';
+import { registerBtpTools } from './btp-tools.mjs';
+
+const packageMetadata = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8'));
+
+/** Create an injectable server runtime for tests and the stdio executable. */
+export function createBtpServer({ env = process.env, execFileImpl } = {}) {
+  const settings = resolveBtpCliSettings(env);
+  const cli = createBtpCli({ cli: settings.cli, config: settings.config, env, ...(execFileImpl ? { execFileImpl } : {}) });
+
+  const summary = Object.freeze({
+    cli: settings.cli,
+    cli_source: settings.cliSource,
+    config_file: settings.config ?? 'btp CLI default',
+    acting_user: 'the user signed in to the btp CLI (btp login --sso)'
+  });
+
+  const verify = async () => {
+    let cliVersion;
+    try {
+      cliVersion = await cli.version() ?? 'unknown';
+    } catch (error) {
+      cliVersion = `failed: ${error?.message || 'btp --version failed'}`;
+    }
+    let globalAccount;
+    try {
+      const account = await cli.json(['get', 'accounts/global-account']);
+      globalAccount = `ok (${account?.displayName}, subdomain ${account?.subdomain})`;
+    } catch (error) {
+      globalAccount = `failed: ${error?.message || 'reading the global account failed'}`;
+    }
+    return { cli_version: cliVersion, global_account: globalAccount };
+  };
+
+  const server = new McpServer({
+    name: 'sap-ai-btp',
+    version: packageMetadata.version
+  }, { capabilities: { tools: {} } });
+  registerBtpTools(server, { cli, summary, verify, env });
+
+  let closing;
+  const close = () => {
+    if (!closing) closing = server.close().catch(() => {});
+    return closing;
+  };
+
+  return { server, close, verify, connectionSummary: summary };
+}
+
+export async function runBtpServer({ env = process.env, stdin = process.stdin, stdout = process.stdout, stderr = process.stderr } = {}) {
+  if (process.argv.slice(2).some(argument => argument === '--help' || argument === '-h')) {
+    stdout.write([
+      'Usage: sap-ai-btp',
+      '',
+      'Starts a stdio MCP server for SAP BTP core platform administration through your own btp CLI',
+      'login: global account hierarchy, entitlements and quotas, Service Manager instances and service',
+      'keys, destinations, identity and destination trust, and Cloud Connectors. Creating instances and',
+      'service keys requires exact confirmation strings; credentials are always redacted.',
+      '',
+      'Sign in with "btp login --sso" (sessions last at most 12 hours); the toolkit stores no credentials.',
+      '  BTP_CLI                 path to the btp executable (else the location saved by sap-ai-dev --setup-btp, else btp on PATH)',
+      '  BTP_CLIENTCONFIG        btp CLI configuration file (else the saved value, else the btp CLI default)',
+      `  ${btpSettingsPath(env)}`,
+      '                          btp CLI location saved by sap-ai-dev --setup-btp (never mcp.json)',
+      '',
+      'HTTP_PROXY, HTTPS_PROXY and NO_PROXY are honored.',
+      '',
+      '  --check   verify the btp CLI and its login session; exit 1 when the check fails',
+      ''
+    ].join('\n'));
+    return;
+  }
+  let runtime;
+  try {
+    runtime = createBtpServer({ env });
+  } catch (error) {
+    stderr.write(`[sap-ai-btp] ${error.message}\n`);
+    process.exitCode = 1;
+    return;
+  }
+  if (process.argv.slice(2).includes('--check')) {
+    const report = await runtime.verify();
+    stdout.write(`${Object.entries(report).map(([name, result]) => `${name}: ${result}`).join('\n')}\n`);
+    await runtime.close();
+    if (Object.values(report).some(result => String(result).startsWith('failed'))) process.exitCode = 1;
+    return;
+  }
+
+  const transport = new StdioServerTransport(stdin, stdout, { maxBufferSize: 1024 * 1024 });
+  let closing;
+  const shutdown = () => {
+    if (!closing) closing = runtime.close().catch(() => {});
+    return closing;
+  };
+  const onStdinEnd = () => { void shutdown(); };
+  const onSignal = signal => {
+    void shutdown().finally(() => process.exit(signal === 'SIGINT' ? 130 : 143));
+  };
+  stdin.once('end', onStdinEnd);
+  process.once('SIGINT', onSignal);
+  process.once('SIGTERM', onSignal);
+  transport.onerror = () => stderr.write('[sap-ai-btp] MCP stdio transport failed.\n');
+
+  try {
+    await runtime.server.connect(transport);
+  } catch {
+    stderr.write('[sap-ai-btp] MCP server startup failed.\n');
+    await shutdown();
+    process.exitCode = 1;
+  }
+}
+
+if (process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  await runBtpServer();
+}