/sap-dev-clean

name: sap-dev-clean
description: |
  Conservative cleanup of the artefacts /sap-dev-init created. Walks reverse
  dependency order — wrapper FM, DDIC structure + table type, utility program,
  function group, package — and deletes only what the operator confirms, skipping
  any artefact the operator extended (a function group with user-added FMs, a
  package with user-added Z* tables) unless --force. Deleted objects are unassigned
  from their transport request (via /sap-se01 remove-objects) and the request is
  deleted if it ends up empty, so a later /sap-dev-init can re-create the same names
  cleanly (no lingering name-lock). settings.json keys are preserved unless
  --settings. The canonical "blow away and rebuild" sequence is
  /sap-dev-clean ; /sap-dev-init. Pass --reset for a full reset (implies --force +
  --settings, clears the dev-default keys and deletes the dev TR).
  Prerequisites: active SAP GUI session (/sap-login first); SAP NCo 3.1 (32-bit).
  Delegates deletes to /sap-se37, /sap-se11, /sap-se38, /sap-function-group, /sap-se21.
argument-hint: "[--reset] [--settings] [--force] [--dry-run]"

SAP Dev Environment Clean Skill

You remove the artefacts `/sap-dev-init` created — without nuking anything the operator added on top. The flow is conservative by design: each step asks for confirmation, and "skip if extras present" guards prevent destructive surprises.

Task: $ARGUMENTS

---

Shared Resources

| File | Purpose | |---|---| | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_dev_artefacts.ps1` | RFC artefact-state pre-flight (also used by `/sap-dev-status`) | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_tr_object_entries.ps1` | RFC E071/E070 read (read-only). By-object mode finds which unreleased request(s) still list a deleted artefact (Step 3f clears via `/sap-se01 remove-objects`); by-TR mode (`-Trkorr` only) lists EVERY object in a request + its tasks — the emptiness check that decides whether Step 3f deletes the now-empty TR. Emits a trailing `REQUEST` column (task→parent). | | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` | **Rule 0 (highest priority)** — environment guard; enforced by Step 0.6 via `sap_safety_gate.ps1` | | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | Mandatory operating rules | | `<SAP_DEV_CORE_SHARED_DIR>/rules/language_independence_rules.md` | GUI-scripting language independence — applies to GUI-driven delete sub-skills (sap-se37, sap-se11, sap-se38, sap-function-group, sap-se21) |

---

Step 0 — Resolve Work Directory and Settings

**Resolve `work_dir` via the env-aware helper** — do NOT take `work_dir` from a direct `settings.json` read (that ignores the `SAPDEV_AI_WORK_DIR` env var and `userconfig.json`). Use the `WORK_DIR=` value printed by:

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir))"

The settings note below still applies to the OTHER keys.

**Settings reads/writes follow `shared/rules/settings_lookup.md`** — merge per-key on the `.value` field (env var → `settings.local.json` → `userconfig.json` → `settings.json`); non-per-connection writes go to `userconfig.json`. Read `sap_dev_transport_request`, `sap_dev_package`, `sap_dev_function_group`, plus the standard SAP RFC connection keys.

**Per-connection keys (Phase 4.4)**: `sap_dev_transport_request`, `sap_dev_package`, `sap_dev_function_group` are SAP-system-specific. Per `settings_lookup.md` § Per-connection exception, read them from `connections.json[pinned-profile].dev_defaults` FIRST (resolve the pin via `{work_dir}\runtime\session_registry.json` `ai_sessions[<id>]`); only fall back to the two-file merge when `dev_defaults` is empty. Critical for `clean` since deleting an artefact named in one system's dev_defaults must NOT touch a different system's artefacts.

**Target the connection named in the Task argument — MANDATORY before any delete (safety).** The Task argument may name a SAP connection (SID / description substring / UUID). Both the per-connection `dev_defaults` read above AND the GUI deletes in Step 3 resolve against the *currently pinned* connection — which is **not** necessarily the one you named — so a destructive clean can silently hit the wrong system. Resolve the argument and compare to the current pin:

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; $m=@(Resolve-SapProfileHint -Hint '<TASK_ARG>'); if($m.Count -ne 1){ Write-Output ('TARGET=NEEDS_USER count='+$m.Count); return }; $cur=Get-SapCurrentConnectionProfile; Write-Output ('NAMED='+$m[0].system_name+'/'+$m[0].client+' id='+$m[0].id); Write-Output ('CURPIN='+$cur.system_name+'/'+$cur.client+' id='+$cur.id)"

If `TARGET=NEEDS_USER`, STOP and ask which connection. If the NAMED id ≠ the CURPIN id, switch to the named connection (pin **and** attach a live GUI session) via `/sap-login --switch <TASK_ARG>` BEFORE Step 2 — the GUI deletes must run on the right system. **Do NOT proceed to Step 3 unless the active connection is confirmed to be the named one.**

Set `{WORK_TEMP}` = `{work_dir}\temp`. Ensure it exists.

Set `{RUN_TEMP}` = the per-run scratch dir (`Get-SapRunTemp` mints + creates `{work_dir}\temp\run_<id>`):

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

Per the CLAUDE.md "Two-bucket temp model" write this skill's per-run state (the `_run.json` log state) under `{RUN_TEMP}`; `{WORK_TEMP}` (base) stays the anchor only.

---

Step 0.5 — Start Logging

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_dev_clean_run.json" -Skill sap-de