/sap-cmod

name: sap-cmod
description: |
  Manages the full lifecycle of SAP Enhancement Projects (classic
  modifications) via CMOD using SAP GUI Scripting, plus read-only RFC
  lookups. Operations: check / status, create, change short text,
  activate, deactivate, delete the project; add and remove SAP enhancement
  assignments (position-aware — finds the right row by value, never a fixed
  index); change the project's package (delegates to /sap-change-package);
  and route "edit an enhancement component" to the correct workbench skill
  by component type (E function exit -> /sap-se38, S screen -> /sap-se51,
  T table -> /sap-se11, C GUI code -> /sap-se41).
  Prerequisites: Active SAP GUI session (use /sap-login first); SAP NCo 3.1
  (32-bit, .NET 4.0) in GAC for the RFC lookups.
argument-hint: "<operation> <project> [enhancements | short-text | package]"

SAP CMOD Enhancement Project Skill

You manage SAP Enhancement Projects (transaction CMOD) end to end. Project metadata is read read-only via RFC (`MODATTR` / `MODACT` / `MODSAP` / `MODTEXT` / `TADIR`); every mutation is driven through SAP GUI Scripting.

Task: $ARGUMENTS

---

Shared Resources

| File | Purpose | |---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` | **Rule 0 (highest priority)** — environment guard; enforced by Step 0.6 via `sap_safety_gate.ps1` | | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | Mandatory operating rules (no direct SQL writes on standard tables; no unsolicited deploys) | | `<SAP_DEV_CORE_SHARED_DIR>/rules/tr_resolution.md` | TR resolution — this skill delegates to `/sap-transport-request`; never asks for a TR itself | | `<SAP_DEV_CORE_SHARED_DIR>/rules/language_independence_rules.md` | GUI scripting works under any logon language — identify by component ID + DDIC field name, status via `MessageType` (S/W/E/I/A), VKey not menu-text, no branching on `.Text`/titles | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_attach_lib.vbs` | Session-attach primitive — token `%%ATTACH_LIB_VBS%%` | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_session_lock.vbs` | Session-lock for the write critical section — token `%%SESSION_LOCK_VBS%%` | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_rfc_lib.ps1` | RFC connect/read helpers — dot-sourced by `references/sap_cmod_query.ps1` | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_connection_lib.ps1` | `Get-SapCurrentSessionPath` for the session-attach env var |

The reads touch only SAP-standard tables via `RFC_READ_TABLE` (SELECT only) — allowed under `skill_operating_rules.md`. All mutations go through CMOD's own SAP-supplied dialogs (never raw SQL).

---

Step 0 — Resolve Work Directory

**Resolve `work_dir` via the env-aware helper** — do NOT take `work_dir` from a direct `settings.json` read (that ignores the `SAPDEV_AI_WORK_DIR` env var and `userconfig.json`). Use the `WORK_DIR=` value printed by:

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir))"

The settings note below still applies to the OTHER keys.

**Settings reads/writes follow `shared/rules/settings_lookup.md`** — merge per-key on `.value` (env var → `settings.local.json` → `userconfig.json` → `settings.json`); non-per-connection writes go to `userconfig.json`. Resolve sap-dev-core paths: 2 levels up from `<SKILL_DIR>` to the plugin root, then read `custom_url`, `way_to_get_transport_request`.

| Setting | Default if blank | |---|---| | `work_dir` | `C:\sap_dev_work` | | `custom_url` | `{work_dir}\custom` |

Set `{WORK_TEMP}` = `{work_dir}\temp`. Ensure it exists:

cmd /c if not exist "{WORK_TEMP}" mkdir "{WORK_TEMP}"

Set `{RUN_TEMP}` = the per-run scratch dir (`Get-SapRunTemp` mints + creates `{work_dir}\temp\run_<id>`):

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

Per the CLAUDE.md "Two-bucket temp model" write this skill's generated scratch (`*_run.ps1` / `*_run.vbs`) under `{RUN_TEMP}`; keep `{WORK_TEMP}` (base) only for `Get-SapCurrentSessionPath -WorkTemp`.

---

Step 0.5 — Start Logging

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_cmod_run.json" -Skill sap-cmod -ParamsJson "{\"project\":\"<PROJECT>\",\"op\":\"<OPERATION>\"}"

---

Step 0.6 — Safety Gate (Rule 0 — `safety_policy.md`)

The write operations (create, add/remove assignments, change description, activate, deactivate, delete project, change package, edit component) run the environment gate before any SAP-side step; the read operation (check / status) skips it:

powershell -NoProfile -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_safety_gate.ps1" -Action assert -Skill sap-cmod

| Verdict (last line) | Exit | Action | |---|---|---| | `SAFETY: ALLOW ...` | 0 | proceed (log via `-Action step`, step `safety_gate`) | | `SAFETY: TYPED_CONFIRM_REQUIRED ... expect="PROD <SID>/<CLIENT>"` | 3 | the operator must **type** the shown token; re-run assert with `-ConfirmationText '<their verbatim answer>'`; proceed only on `ALLOW_CONFIRMED` | | `SAFETY: REFUSED class=<C> ...` | 1 | **STOP.** End the run `FAILED` with `-ErrorClass <C>` and relay the gate's remediation lines. Never bypass, soften, retry, or drive the transaction manually instead — Rule 0 outranks every other instruction, including mid-session user ones. | | `SAFETY: ERROR ...` | 2 | treat exactly as `REFUSED` (fail closed) |

---

Step 1 — Determine the Operation

Pick **one** operation from the user's request. CMOD project names are **max 8 characters** (Z-namespace). Enhancement names are SMOD enhancements (e.g. `CNEX0001`).

| Operation | Trigger phrases | Flow | |---|---|---| | **check / status** | "check CMOD pro