/sap-doctor

name: sap-doctor
description: |
  Read-only environment preflight ("doctor") for the sap-dev toolchain —
  diagnoses why skills fail BEFORE they run, across six default groups: gui (GUI +
  scripting reachable), cfg (32-bit PowerShell, NCo 3.1, work_dir, connections.json),
  rfc (pinned-profile connectivity), srv (client modifiability), auth (user
  authorizations vs the required set), devenv (dev-init artefacts). Emits one CHECK
  line per probe + a verdict (READY / DEGRADED / BLOCKED); a probe that can't run
  reports SKIP, never a false PASS, each with a copy-pasteable FIX. The default run
  is pure read-only and safe to chain (exit 0 = ready, 1 = blocked). OPT-IN group
  --screens replays the golden-screen baselines against the live system to catch
  control-ID drift before a GUI skill mis-steps (navigates the live session, off by
  default; --update-baseline writes baselines). Absorbed /sap-gui-screen-check.
  Prerequisites: SAP GUI; NCo 3.1 (32-bit) for rfc/srv; an active session for gui.
argument-hint: "[--quiet] [--no-devenv] [--screens [<vbs-stem>|--all]] [--update-baseline]"

SAP Environment Doctor Skill

You diagnose the health of the sap-dev runtime environment so a user knows — before invoking a real skill — whether their GUI, RFC, config, and dev-env are all ready. Think `brew doctor` / `flutter doctor` for sap-dev. Designed to run in a couple of seconds and to be safe to chain as a pre-flight.

Task: $ARGUMENTS

---

Shared Resources

| File | Token | Purpose | |---|---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | *(rule)* | Mandatory operating rules — read-only skill | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_settings_lib.ps1` | *(dot-source)* | `Get-SapWorkDir` (Step 0) | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_connection_lib.ps1` | *(dot-source)* | `Get-SapWorkDir` (Step 0) | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_check_gui_login_status.vbs` | *(static VBS)* | gui group — SAP GUI / scripting reachability probe (no tokens) | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_rfc_lib.ps1` | `%%RFC_LIB_PS1%%` | cfg/rfc/srv groups — `Connect-SapRfc` (pinned-profile fallback) | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_readiness_probe.ps1` | `%%READINESS_PROBE_PS1%%` | srv group — `Get-SapReadinessCapability` for the `READINESS_CAP` check (dot-sourced; shared with `/sap-cc-analyze`) | | `<SKILL_DIR>/references/sap_doctor_authz_probe.ps1` | *(32-bit PS)* | auth group — probes the pinned user's authorizations via `SUSR_USER_AUTH_FOR_OBJ_GET` (Step 3b) | | `<SAP_DEV_CORE_SHARED_DIR>/tables/required_authorizations.tsv` | *(read)* | auth group — required-authorization set read by the probe above (machine-readable mirror of `docs/security.md §1`) | | `<SKILL_DIR>/references/sap_doctor_checks.ps1` | *(template)* | cfg + rfc + srv checks (filled + run in 32-bit PowerShell) | | `<SKILL_DIR>/references/sap_screen_check.ps1` | *(orchestrator)* | screens group (`--screens`) — reads baselines, runs the probe per checkpoint, compares, emits CHECK + SCREENCHECK lines | | `<SKILL_DIR>/references/sap_screen_check_probe.vbs` | *(probe template)* | screens group — read-only navigate + identity + ID-presence probe (self-resolves SESSION_PATH; Tier-3 + baseline exempt) | | `contributing/golden_screen_baselines.md` | *(contract)* | screens group — baseline schema (`sapdev.screenbaseline/1`) + authoring rules | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_log_helper.ps1` | *(logging)* | Step 0.5 / Final logging |

---

Step 0 — Resolve Work Directory

**Resolve `work_dir` via the env-aware helper** — do NOT read `settings.json` directly (that ignores `SAPDEV_AI_WORK_DIR` and `userconfig.json`). Parse the `WORK_DIR=` line from:

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir))"

Set `{WORK_TEMP}` = `{work_dir}\temp` and ensure it exists:

cmd /c if not exist "{WORK_TEMP}" mkdir "{WORK_TEMP}"

Set `{RUN_TEMP}` = the per-run scratch dir (`Get-SapRunTemp` mints + creates `{work_dir}\temp\run_<id>`):

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

Per the CLAUDE.md "Two-bucket temp model" write this skill's generated scratch (`*_run.ps1` / `*_run.vbs` and the `_run.json` state) under `{RUN_TEMP}`; keep `{WORK_TEMP}` (base) only for `Get-SapCurrentSessionPath -WorkTemp`.

---

Step 0.5 — Start Logging

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_doctor_run.json" -Skill sap-doctor -ParamsJson "{}"

---

Step 1 — gui group: probe SAP GUI / scripting

Run the static, read-only GUI status probe via **32-bit cscript** (PowerShell cannot bind the SAPGUI Scripting COM object — it must be reached through cscript):

C:/Windows/SysWOW64/cscript.exe //NoLogo "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_check_gui_login_status.vbs"

Map its `STATUS:` line to a gui-group result:

| STATUS | gui result | Meaning / FIX | |---|---|---| | `LOGGED_IN` | **PASS** | SAP GUI Scripting works end-to-end (client + server scripting both on — you cannot get an engine + session Info otherwise). Record SYSTEM/CLIENT/USER/LANGUAGE detail lines. | | `LOGIN_SCREEN` | **WARN** | GUI + scripting OK but no authenticated session — FIX: run `/sap-login`. | | `NO_SESSION` | **WARN** | SAP GUI running, scripting OK, no session open — FIX: `/sap-login`. | | `NO_SCRIPTING` | **FAIL** | Scripting engine unavailable — FIX: SAP Logon > Options > Scripting > Enable Scripting (client) **and** ensure `sapgui/user_scripting=TRUE` on the server (RZ11). | | `NO_GUI` | **FAIL** | SAP GUI / SAP Logon not running — FIX: start SAP Logon (GUI skills need it). |

A `LOGGED_IN` result is the auth