sap-ai-dev-toolkit 0.9.9923 → 0.9.9924

package/NOTICE

@@ -3,7 +3,8 @@ Third-party notices for sap-ai-dev-toolkit
 This package includes patched VSP (vibing-steampunk) binaries built from upstream commit
 9886d2727f47506368b0a3c2f1c1766f1200f747. The BAS proxy-auth change is documented in
 patches/vsp-bas-proxy-auth.patch; the namespaced class-include EditSource fix is documented in
-patches/vsp-namespaced-class-include-edit.patch. The following upstream notice is reproduced from VSP:
+patches/vsp-namespaced-class-include-edit.patch; the shared-logon fix for concurrent ADT requests is
+documented in patches/vsp-single-logon.patch. The following upstream notice is reproduced from VSP:
 
 vibing-steampunk (vsp)
 Copyright (c) 2025-2026 Alice Vinogradova and contributors

package/README.md

@@ -75,6 +75,16 @@ Use the attached destination-prefixed tools directly in chat. Do not launch `sap
 
 **Prerequisite:** Node.js 20 or newer. The pinned runtime ships with the package; no Go toolchain is installed or required.
 
+## 🆕 What's new
+
+| Version | Change |
+| --- | --- |
+| 0.9.9924 | **One SAP logon per runtime, shared by parallel tool calls.** AI assistants fire many tool calls at once; each used to reach SAP before the first security-session cookie came back, so every call logged on again and SM04 / the SAP GUI "already logged on" list filled with dozens of sessions. Now the first request logs on, the parallel ones wait for it and reuse its `SAP_SESSIONID` cookie (Basic, SSO and local SAP GUI entries alike); after an expired session the next burst again shares one fresh logon. |
+| 0.9.9923 | **Oh My Pi (OMP) receives all twelve agents** as task agents (`~/.omp/agent/agents/<id>.md`, dispatched by kebab-case id) next to the twenty-two skills. **Four new companion MCP servers:** SAP Datasphere (`sap-ai-datasphere`, incl. BW → Datasphere migration), SAP Build Process Automation (`sap-ai-process-automation`, all eight BPA APIs), SAP BTP platform administration (`sap-ai-btp`, on your own `btp login --sso`), and SAP Cloud ALM (`sap-ai-cloud-alm`), each with its own agent, skills and `--setup-*` wizard. |
+| 0.9.9922 | `EditSource` no longer double-encodes namespaced class names (`/NS/CL_…`) on class-include writes. |
+| 0.9.9921 | Simpler Integration Suite setup wizard: shorter intro, clearer status lines, and a single credential menu. |
+| 0.9.9920 | **Integration Suite companion** (`sap-ai-integration`, since 0.9.9914) expanded across the lifecycle: API Management content, documentation, runtime and monitoring reads, confirmation-gated cleanup and delete tools, and asynchronous Cloud Integration monitoring. |
+
 ## 🤖 Available agents and skills
 
 **Agents:** Twelve user-invocable custom agents are included. Select the best fit from the agent picker in your harness's chat (GitHub Copilot, Claude Code, or opencode), dispatch the matching OMP task agent by its kebab-case id, or use the matching Pi prompt command, as shown in Quick start. Harnesses without custom agents (OpenAI Codex, Cursor, Gemini CLI, Cline, Roo Code, Windsurf / Devin Desktop) get the same workflows as skills, for example `sap-integration-architect` and `integration-suite-delivery`.
@@ -100,11 +110,11 @@ Agents and skills install for the harnesses you pick during global installation:
 
 ## ✨ Your SAP development cockpit, inside your AI assistant
 
-`sap-ai-dev-toolkit` installs `sap-ai-dev`, discovers your BAS destinations or local SAP GUI systems, and exposes a curated SAP development toolset through MCP. Instead of manually switching between chat, terminal commands, repository searches, ADT screens, and SAP checks, describe the outcome you want and let the appropriate bundled agent coordinate the available tools.
+`sap-ai-dev-toolkit` installs `sap-ai-dev`, discovers your BAS destinations or local SAP GUI systems, and exposes a curated SAP development toolset through MCP. Optional companion servers from the same package reach the rest of the landscape: HANA Cloud, Integration Suite, Datasphere, Build Process Automation, the BTP platform, and Cloud ALM. Instead of manually switching between chat, terminal commands, repository searches, ADT screens, cockpits, and SAP checks, describe the outcome you want and let the appropriate bundled agent coordinate the available tools.
 
 <p align="center"><strong>💬 Request → 🔎 Inspect → 🧠 Reason → 🧑‍💻 Implement → 🧪 Verify → 📋 Report</strong></p>
 
-The workflow covers ABAP, CDS, RAP, repository analysis, table and query access, testing, ATC, application logs, transports, and controlled source changes. The live MCP tool list remains the source of truth for what your connected SAP system and active runtime mode expose.
+The workflow covers ABAP, CDS, RAP, repository analysis, table and query access, testing, ATC, application logs, transports, and controlled source changes, plus integration, data, process and platform operations through the companions. The live MCP tool list remains the source of truth for what your connected SAP system and active runtime mode expose.
 
 ## 🌟 Feature highlights
 
@@ -116,6 +126,13 @@ The workflow covers ABAP, CDS, RAP, repository analysis, table and query access,
 | 🧩 | **CDS + RAP development** | Explore models and dependencies, then build RAP business objects and services with system context. |
 | 🗃️ | **Ground decisions in SAP data** | Inspect DDIC structures, read table contents, and run controlled ABAP SQL queries. |
 | ☁️ | **Read-only HANA Cloud inspection** | Inspect an environment-bound HDI schema, object metadata, and capped query results without exposing deployment credentials. |
+| 🔌 | **Integration Suite lifecycle** | Build, release, deploy, monitor, diagnose and recover Cloud Integration and API Management content with retained releases and confirmation-gated writes. |
+| 🗄️ | **Datasphere and BW migration** | Model, deploy, load and administer Datasphere content; inventory BW models and reconcile BW against Datasphere after migration. |
+| ⚙️ | **Build Process Automation operations** | Inspect definitions and instances, unstick failed workflows, work user-task queues, test decisions, and trace business events across all eight BPA APIs. |
+| 🏛️ | **BTP platform administration** | Audit account hierarchy, entitlements and quotas, service instances and keys, destinations, trust and Cloud Connectors on your own `btp` CLI login. |
+| 📡 | **Cloud ALM observability** | Find exception and alert hotspots per DEV/TEST/PROD tier and correlate them with live CPI message logs and SLG1. |
+| 🧩 | **Agents in eleven AI harnesses** | Copilot, Claude Code, opencode and OMP get native agents, Pi gets prompt commands, and every harness gets the skills. |
+| 🔁 | **One logon per runtime** | Parallel tool calls share a single SAP security session instead of opening one per call. |
 | ✍️ | **Edit ABAP safely** | Update supported source, stage reviewed change sets, create transport requests, and run syntax checks before requested activation. |
 | ✅ | **Quality built into the flow** | Pair local ABAP linting with SAP syntax checks, ABAP Unit, ATC, editor diagnostics, and formatting. |
 | 🐞 | **Debug with system context** | Investigate dumps, traces, application logs, runtime failures, capabilities, and installed components. |
@@ -197,17 +214,17 @@ The package ships with twelve custom agents plus twenty-two task-focused Agent S
 
 ## 🗺️ How it fits together
 
-Each selected BAS destination becomes its own isolated MCP server identity. The MCP client discovers the live tools and schemas, the add-on routes calls to the correct runtime process, and the process reaches SAP ADT through the selected BAS destination.
+Each selected BAS destination or local SAP GUI system becomes its own isolated MCP server identity. The MCP client discovers the live tools and schemas, the add-on routes calls to the correct runtime process, and that process reaches SAP ADT through the selected route over one shared SAP logon. Companion servers (HANA, Integration Suite, Datasphere, Process Automation, BTP, Cloud ALM) are separate stdio MCP processes with their own user-only credentials, so an agent can combine them — for example a Cloud ALM alert, the matching CPI message log, and the ABAP SLG1 entry.
 
 ## 🧰 Optional full-stack companion MCP servers
 
-ABAP/RAP backend access is provided by this add-on's BAS proxy. For end-to-end SAP development, setup can also add managed companion MCP entries for frontend, CAP, browser validation, and read-only HANA inspection:
+ABAP/RAP backend access is provided by this add-on's destination-scoped runtime. For end-to-end SAP development, setup can also add managed companion MCP entries for frontend, CAP, browser validation, read-only HANA inspection, Integration Suite, Datasphere, Build Process Automation, BTP platform administration, and Cloud ALM:
 
 ```sh
 sap-ai-dev --setup --tools
 ```
 
-The companion entries are optional and are launched through `npx` only when the MCP client starts them. They are marked as managed by `sap-ai-dev-toolkit`, so rerunning setup can update or remove them without touching unrelated MCP servers. The HANA, Integration Suite and Datasphere companions use `--ignore-scripts` so the toolkit postinstall wizard cannot run during MCP startup.
+The companion entries are optional and are launched through `npx` only when the MCP client starts them. They are marked as managed by `sap-ai-dev-toolkit`, so rerunning setup can update or remove them without touching unrelated MCP servers. The companions shipped in this package (HANA, Integration Suite, Datasphere, Process Automation, BTP, Cloud ALM) use `--ignore-scripts` so the toolkit postinstall wizard cannot run during MCP startup. Each has a dedicated wizard: `sap-ai-dev --setup-integration`, `--setup-datasphere`, `--setup-process-automation`, `--setup-btp`, and `--setup-cloud-alm`.
 
 | MCP entry | Package | Launches | Use when the agent needs to |
 | --- | --- | --- | --- |
@@ -219,6 +236,7 @@ The companion entries are optional and are launched through `npx` only when the
 | `integration-suite` | `sap-ai-dev-toolkit` | `sap-ai-integration` | Build, deploy, undeploy, and monitor Cloud Integration content (iFlows, value mappings, script collections, security material, Partner Directory) and manage API Management providers, proxies, policies, products, and key value maps |
 | `datasphere` | `sap-ai-dev-toolkit` | `sap-ai-datasphere` | Model and administer SAP Datasphere: spaces, users, roles, database users, connections, modeling objects and packages, task chains, replication flows, Data Marketplace, consumption queries and Open SQL |
 | `process-automation` | `sap-ai-dev-toolkit` | `sap-ai-process-automation` | Inspect and operate SAP Build Process Automation across all eight BPA APIs: process definitions, workflow instances with contexts, logs and errors, stuck instances, user tasks and the user inbox, decisions, API triggers, automations, process visibility, administration jobs, process starts and business events |
+| `sap-btp` | `sap-ai-dev-toolkit` | `sap-ai-btp` | Audit and operate the BTP core platform through your own `btp login --sso`: account hierarchy, entitlements and quotas, Service Manager instances and service keys, destinations, trust, and Cloud Connectors |
 | `cloud-alm` | `sap-ai-dev-toolkit` | `sap-ai-cloud-alm` | Observe and triage SAP landscapes with SAP Cloud ALM: health, exception and alert hotspots per tier, Integration & Exception Monitoring records, monitoring events with CPI and SLG1 handoffs, analytics, feature and transport status, and confirmation-gated alert closing |
 
 Recommended profiles:
@@ -1094,6 +1112,8 @@ If `GetSystemInfo` or `RunQuery` reports a CSRF-token fetch failure, the runtime
 
 **`MCP config ... contains invalid JSON`** usually means one of three things, all healed automatically by setup: the file starts with a byte-order mark (Windows PowerShell `>` redirection, `Set-Content`, or Notepad's "UTF-8 with BOM" mode — invisible in editors and terminals), it contains comments or trailing commas (VS Code reads `mcp.json` as JSONC), or setup raced an editor save and read a torn file (retried once before healing). Unrecoverable content is backed up as `mcp.json.<kind>-<timestamp>.bak` and replaced; the backup path is printed in the setup warning. On older versions, re-save the file as UTF-8 without BOM (VS Code: "Change File Encoding → Save with Encoding → UTF-8") and rerun `sap-ai-dev --setup`.
 
+**SAP shows "You are already logged on to the system in the following sessions" with dozens of entries** (or SM04 fills with HTTP sessions of your user): runtimes before 0.9.9924 opened one SAP security session per parallel tool call until the first session cookie came back. Upgrade and restart the MCP server; each runtime process now logs on once and shares that session. Sessions left by older processes expire with the system's HTTP session timeout, or end them with **Cancel all existing logons** at the next SAP GUI logon. Every MCP server start (editor reload, `/mcp reload`, a second editor) is still one process with one logon of its own.
+
 If automatic runtime provisioning fails, check network access and the package's supported platform. You can install Go manually or set `GO_BINARY` as an explicit fallback. A trusted prebuilt executable can be supplied with `SAP_AI_DEV_TOOLKIT_BINARY`.
 
 ## 🧑‍💻 Development
@@ -1106,6 +1126,8 @@ npm test
 
 Install the checkout globally with `npm run install:local`, or use `npm run install:local -- --link` for a live workspace link. Verify without reinstalling using `npm run install:local -- --verify`: it checks the installed package version and, for a link, the actual workspace target, and refuses an outdated snapshot or a different checkout. After installation, exercise the installed executable with `sap-ai-integration --check`; npm-linked commands resolve their real entrypoint before starting the server.
 
+The ABAP runtime is upstream VSP pinned to one commit and patched with `patches/*.patch` (applied in the order listed in `scripts/build-vsp.mjs`). `npm run build:vsp` clones it into `.build/vibing-steampunk`, applies the patches, and builds `dist/`; run `go test ./pkg/adt/ ./internal/...` there to exercise a patch. To change a patch, commit the patched tree in `.build`, edit, and write `git diff` back to the patch file.
+
 The package repository is [grknylmz/sap-ai-dev-toolkit](https://github.com/grknylmz/sap-ai-dev-toolkit).
 
 ## 🚀 Publishing to npm

package/dist/checksums.txt

@@ -1,5 +1,5 @@
-31902921b0d2b5349be8e392aae3632ca8c3dee26950ea30c412ec83271722f3  vsp-linux-x64
-df39b324fe419348f5157954d56c5f8d60e5bac28edc04a56e90c380b67de10d  vsp-linux-arm64
-754338fbbbe66260cac722677753b16a0a2f23127b947bf1f3a189044fa66c32  vsp-darwin-x64
-ac153052b5d02b2f19a536623c957369af3412f5bbe2eed0f6a43e8597ed0f1b  vsp-darwin-arm64
-722c6de352719dd9374932b56546189a75c29800e74da3bdcb0308b2034248ac  vsp-win32-x64.exe
+8666b8126f460a6b1b3c64c5523eb5b942d2c1a795f406936cfb9e0f1c62e68c  vsp-linux-x64
+e920aa3fda3b3b5020893e0869737c8a2ca049db9eafdd9e19dfca021cefe24b  vsp-linux-arm64
+e56bf5a23cdbf889bff499a399b53fd247b2ef26b44e0d4affa6a20382303abd  vsp-darwin-x64
+3c794b489af29237480a27353cb3e98af35de1d81ad03761304da10fdb5df89d  vsp-darwin-arm64
+0c35ddd18c2edfb10486a056143ad438d79a737f55839e3adfb882b29438fa1a  vsp-win32-x64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.9.9923",
+  "version": "0.9.9924",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/patches/vsp-single-logon.patch

@@ -0,0 +1,258 @@
+diff --git a/pkg/adt/http.go b/pkg/adt/http.go
+index e420573..5386a26 100755
+--- a/pkg/adt/http.go
++++ b/pkg/adt/http.go
+@@ -12,6 +12,7 @@ import (
+ 	"os"
+ 	"strings"
+ 	"sync"
++	"sync/atomic"
+ 	"time"
+ )
+ 
+@@ -135,6 +136,10 @@ type Transport struct {
+ 	// from triggering simultaneous SAML dances.
+ 	reauthMu   sync.Mutex
+ 	lastReauth time.Time
++
++	// Logon single-flight: see http_logon_gate.go.
++	logonSlot    chan struct{}
++	logonSettled atomic.Bool
+ }
+ 
+ // NewTransport creates a new Transport with the given configuration.
+@@ -149,6 +154,7 @@ func NewTransportWithClient(cfg *Config, client HTTPDoer) *Transport {
+ 	t := &Transport{
+ 		config:     cfg,
+ 		httpClient: client,
++		logonSlot:  make(chan struct{}, 1),
+ 	}
+ 	if cfg.Cache {
+ 		t.cache = newResponseCache(cfg.CacheStore, cfg.CacheTTL)
+@@ -212,10 +218,10 @@ func (t *Transport) Request(ctx context.Context, path string, opts *RequestOptio
+ 		opts.Method = http.MethodGet
+ 	}
+ 	if t.cache == nil {
+-		return t.request(ctx, path, opts)
++		return t.gatedRequest(ctx, path, opts)
+ 	}
+ 	if !cacheable(path, opts) {
+-		resp, err := t.request(ctx, path, opts)
++		resp, err := t.gatedRequest(ctx, path, opts)
+ 		if isModifyingMethod(opts.Method) && !strings.HasPrefix(path, "/sap/bc/adt/datapreview/") {
+ 			t.cache.invalidate()
+ 		}
+@@ -229,7 +235,7 @@ func (t *Transport) Request(ctx context.Context, path string, opts *RequestOptio
+ 	if resp, ok := t.cache.get(key); ok {
+ 		return resp, nil
+ 	}
+-	resp, err := t.request(ctx, path, opts)
++	resp, err := t.gatedRequest(ctx, path, opts)
+ 	if err == nil && resp != nil && resp.StatusCode >= 200 && resp.StatusCode < 300 {
+ 		t.cache.put(key, resp)
+ 	}
+@@ -1062,6 +1068,8 @@ func (t *Transport) resetCookieJar() {
+ 	}
+ 	if jar, err := cookiejar.New(nil); err == nil {
+ 		client.Jar = jar
++		// The new jar holds no session: the next requests must share one logon again.
++		t.logonSettled.Store(false)
+ 	}
+ }
+ 
+diff --git a/pkg/adt/http_logon_gate.go b/pkg/adt/http_logon_gate.go
+new file mode 100644
+index 0000000..9e71c60
+--- /dev/null
++++ b/pkg/adt/http_logon_gate.go
+@@ -0,0 +1,76 @@
++package adt
++
++import (
++	"context"
++	"net/http"
++	"net/url"
++	"strings"
++)
++
++// Every request that reaches SAP without a security-session cookie is a new
++// logon: SAP authenticates it and opens a security session of its own, which
++// lingers in SM04 until it times out. MCP clients fan tool calls out in
++// parallel, so a cold transport used to send each of them without a cookie
++// and opened one session per call (dozens per burst for one user).
++//
++// gatedRequest lets exactly one request log on while the jar holds no session
++// cookie; the others wait for it and then reuse the cookie it brought back.
++// When that request succeeds without the server issuing a session cookie
++// (security sessions off, or a proxy chain that keeps them), the gate settles
++// open so requests are never serialized for nothing. Dropping the jar after an
++// expired session re-arms it.
++func (t *Transport) gatedRequest(ctx context.Context, path string, opts *RequestOptions) (*Response, error) {
++	if t.logonSlot == nil || t.logonSettled.Load() || t.hasSessionCookie() {
++		return t.request(ctx, path, opts)
++	}
++	select {
++	case t.logonSlot <- struct{}{}:
++	case <-ctx.Done():
++		return nil, ctx.Err()
++	}
++	if t.logonSettled.Load() || t.hasSessionCookie() {
++		<-t.logonSlot
++		return t.request(ctx, path, opts)
++	}
++	resp, err := t.request(ctx, path, opts)
++	if err == nil && !t.hasSessionCookie() {
++		t.logonSettled.Store(true)
++	}
++	<-t.logonSlot
++	return resp, err
++}
++
++// hasSessionCookie reports whether requests to the SAP system already carry
++// a security session: one the jar learned from the server, or one the caller
++// supplied for cookie authentication.
++func (t *Transport) hasSessionCookie() bool {
++	t.cookiesMu.RLock()
++	for name := range t.config.Cookies {
++		if isSessionCookieName(name) {
++			t.cookiesMu.RUnlock()
++			return true
++		}
++	}
++	t.cookiesMu.RUnlock()
++	client, ok := t.httpClient.(*http.Client)
++	if !ok || client.Jar == nil {
++		return false
++	}
++	base, err := url.Parse(strings.TrimRight(t.config.BaseURL, "/") + "/sap/bc/adt/")
++	if err != nil {
++		return false
++	}
++	for _, cookie := range client.Jar.Cookies(base) {
++		if isSessionCookieName(cookie.Name) {
++			return true
++		}
++	}
++	return false
++}
++
++// isSessionCookieName matches the ICF security-session cookie
++// (SAP_SESSIONID_<SID>_<client>). A MYSAPSSO2 logon ticket does not count:
++// every request presenting only the ticket opens another session.
++func isSessionCookieName(name string) bool {
++	return strings.HasPrefix(name, "SAP_SESSIONID")
++}
+diff --git a/pkg/adt/http_logon_gate_test.go b/pkg/adt/http_logon_gate_test.go
+new file mode 100644
+index 0000000..e973790
+--- /dev/null
++++ b/pkg/adt/http_logon_gate_test.go
+@@ -0,0 +1,108 @@
++package adt
++
++import (
++	"context"
++	"fmt"
++	"net/http"
++	"net/http/httptest"
++	"sync"
++	"sync/atomic"
++	"testing"
++	"time"
++)
++
++// sapSessionServer mimics ICF security sessions: a request without a live
++// SAP_SESSIONID cookie is a logon and, when issueCookies, gets a new one.
++type sapSessionServer struct {
++	issueCookies bool
++	logons       atomic.Int32
++	inFlight     atomic.Int32
++	peak         atomic.Int32
++	mu           sync.Mutex
++	live         map[string]bool
++}
++
++func (s *sapSessionServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
++	now := s.inFlight.Add(1)
++	defer s.inFlight.Add(-1)
++	for {
++		peak := s.peak.Load()
++		if now <= peak || s.peak.CompareAndSwap(peak, now) {
++			break
++		}
++	}
++	s.mu.Lock()
++	cookie, err := r.Cookie("SAP_SESSIONID_T4D_100")
++	if err != nil || !s.live[cookie.Value] {
++		id := fmt.Sprintf("S%d", s.logons.Add(1))
++		if s.issueCookies {
++			s.live[id] = true
++			http.SetCookie(w, &http.Cookie{Name: "SAP_SESSIONID_T4D_100", Value: id, Path: "/"})
++		}
++	}
++	s.mu.Unlock()
++	w.Header().Add("Set-Cookie", "sap-usercontext=sap-client=100; path=/")
++	time.Sleep(30 * time.Millisecond)
++	fmt.Fprint(w, "ok")
++}
++
++func newSessionTransport(t *testing.T, issueCookies bool) (*Transport, *sapSessionServer) {
++	t.Helper()
++	sap := &sapSessionServer{issueCookies: issueCookies, live: map[string]bool{}}
++	server := httptest.NewServer(sap)
++	t.Cleanup(server.Close)
++	return NewTransport(NewConfig(server.URL, "EMSDI0845", "secret", WithClient("100"))), sap
++}
++
++func burst(t *testing.T, transport *Transport, n int) {
++	t.Helper()
++	var wg sync.WaitGroup
++	errs := make(chan error, n)
++	for i := range n {
++		wg.Add(1)
++		go func() {
++			defer wg.Done()
++			if _, err := transport.Request(context.Background(), fmt.Sprintf("/sap/bc/adt/oo/classes/ZCL_%d/source/main", i), nil); err != nil {
++				errs <- err
++			}
++		}()
++	}
++	wg.Wait()
++	close(errs)
++	for err := range errs {
++		t.Fatalf("request failed: %v", err)
++	}
++}
++
++func TestTransport_ConcurrentColdRequestsShareOneLogon(t *testing.T) {
++	transport, sap := newSessionTransport(t, true)
++
++	burst(t, transport, 12)
++	burst(t, transport, 12)
++
++	if got := sap.logons.Load(); got != 1 {
++		t.Fatalf("logons = %d, want 1: parallel tool calls must reuse one SAP security session", got)
++	}
++}
++
++func TestTransport_LogonGateOpensWhenServerKeepsNoSession(t *testing.T) {
++	transport, sap := newSessionTransport(t, false)
++
++	burst(t, transport, 12)
++
++	if peak := sap.peak.Load(); peak < 2 {
++		t.Fatalf("peak concurrency = %d: without session cookies the gate must not serialize every request", peak)
++	}
++}
++
++func TestTransport_LogonGateRearmsAfterJarReset(t *testing.T) {
++	transport, sap := newSessionTransport(t, true)
++
++	burst(t, transport, 6)
++	transport.resetCookieJar()
++	burst(t, transport, 6)
++
++	if got := sap.logons.Load(); got != 2 {
++		t.Fatalf("logons = %d, want 2 (one per session)", got)
++	}
++}

package/scripts/build-vsp.mjs

@@ -33,7 +33,7 @@ async function main() {
   await mkdir(dirname(source), { recursive: true });
   await run('git', ['clone', '--filter=blob:none', upstream, source]);
   await run('git', ['-C', source, 'checkout', '--detach', commit]);
-  for (const patchFile of ['vsp-bas-proxy-auth.patch', 'vsp-namespaced-class-include-edit.patch']) {
+  for (const patchFile of ['vsp-bas-proxy-auth.patch', 'vsp-namespaced-class-include-edit.patch', 'vsp-single-logon.patch']) {
     await run('patch', ['-p1', '-i', join(root, 'patches', patchFile)], { cwd: source });
   }
   await mkdir(dist, { recursive: true });