/sap-function-group

name: sap-function-group
description: |
  Full lifecycle for SAP function groups: check existence, create,
  re-activate, query PROGDIR state, and delete. Mode-aware — picks the
  RFC fast-path (`RS_FUNCTION_POOL_INSERT`, `RFC_READ_TABLE` on TLIBG /
  TFDIR / TADIR / PROGDIR) when possible, falls through to GUI scripting
  (SE37 menus + SE38 delete) when no RFC equivalent exists.
  Honours `userConfig.sap_dev_mode` (GUI / RFC); the default chain for
  each operation is documented in the SKILL.md mode dispatch table.
  Replaces the now-removed `sap-se37-fugr` skill — call this skill for
  every function-group lifecycle step. Deletion is irreversible: the
  skill MUST confirm with the user before delegating to /sap-se38.
  Prerequisites: SAP NCo 3.1 (32-bit, .NET 4.0) in GAC for RFC paths;
  active SAP GUI session (use /sap-login first) for GUI paths.
argument-hint: "<FUGR_ID> [\"<short description>\"] [package] [transport] [--activate-only|--check-state|--delete]"

SAP Function Group Skill

You manage SAP function-group lifecycle (check / create / activate / check state / delete). The skill picks RFC vs GUI per operation and per `userConfig.sap_dev_mode`; callers don't pick a transport.

Task: $ARGUMENTS

---

Shared Resources

| File | Purpose | |---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` | **Rule 0 (highest priority)** — environment guard; enforced by Step 0.6 via `sap_safety_gate.ps1` | | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | Mandatory operating rules | | `<SAP_DEV_CORE_SHARED_DIR>/rules/tr_resolution.md` | TR resolution flow — this skill delegates to `/sap-transport-request` instead of asking for the TR itself | | `<SAP_DEV_CORE_SHARED_DIR>/rules/language_independence_rules.md` | GUI-scripting language independence — identify by component ID + DDIC field name, status-bar checks via `MessageType` codes (S/W/E/I/A), VKey instead of menu-text, no branching on `.Text`/`.Tooltip`/window titles |

---

Operation × transport matrix

| Operation | RFC path | GUI path | Fallback chain (when `sap_dev_mode` unset) | |---|---|---|---| | **Check existence** | `RFC_READ_TABLE TLIBG` | implied by SE37 navigation | RFC → GUI | | **Create + activate** | `RS_FUNCTION_POOL_INSERT` (creates active FG in one call) | SE37 *Goto > Function Groups > Create* + activate | RFC → GUI | | **Activate only** | not supported via standard RFC | SE37 *Change Group* + Ctrl+F3 + Inactive-Objects worklist | GUI only | | **Check PROGDIR state** | `RFC_READ_TABLE PROGDIR` for `SAPL<FG>` | n/a | RFC only | | **Delete** | no clean RFC API | Step 3e — own VBS deletes `SAPL<FG>` via SE38 (Shift+F2) + shared walker | GUI only |

`--activate-only` and `--delete` always force the GUI path. Everything else follows the **mode precedence in Step 2** — `sap_dev_mode` takes priority over the fallback chain when set.

---

Step 0 — Resolve Work Directory and Defaults

**Resolve `work_dir` via the env-aware helper** — do NOT take `work_dir` from a direct `settings.json` read (that ignores the `SAPDEV_AI_WORK_DIR` env var and `userconfig.json`). Use the `WORK_DIR=` value printed by:

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir)); Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

The settings note below still applies to the OTHER keys.

**Settings reads/writes follow `shared/rules/settings_lookup.md`** — merge per-key on the `.value` field (env var → `settings.local.json` → `userconfig.json` → `settings.json`); non-per-connection writes go to `userconfig.json`. Resolve sap-dev-core paths: 2 levels up from `<SKILL_DIR>` to the plugin root, then `settings.json` and (if present) `settings.local.json`. Read `sap_dev_package`, `sap_dev_transport_request`, `sap_dev_mode`.

| Setting | Default if blank | |---|---| | `work_dir` | `C:\sap_dev_work` | | `sap_dev_mode` | `GUI` (per CLAUDE.md fallback chains) |

Set `{WORK_TEMP}` = `{work_dir}\temp`. Ensure it exists:

cmd /c if not exist "{WORK_TEMP}" mkdir "{WORK_TEMP}"

Set `{RUN_TEMP}` = the `RUN_TEMP=` value printed above — a fresh per-run scratch directory `{work_dir}\temp\run_<id>`, already created by `Get-SapRunTemp`. Resolve it **once here** and reuse the same value for the rest of this invocation; it isolates this run's generated wrappers / state / scratch files so concurrent runs (parallel sub-agents, multi-connection deploys) never collide. **`{WORK_TEMP}` stays the base temp dir** and is used ONLY for `Get-SapCurrentSessionPath -WorkTemp '{WORK_TEMP}'` (the session-attach plumbing derives `{work_dir}\runtime` from its parent, so it must see the base path, not the run dir). Everything the skill writes itself goes under `{RUN_TEMP}`.

---

Step 0.5 — Start Logging

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_function_group_run.json" -Skill sap-function-group -ParamsJson "{\"function_group\":\"<FUGR>\",\"mode\":\"<MODE>\"}"

State file: `{RUN_TEMP}\sap_function_group_run.json`. Best-effort.

---

Step 0.6 — Safety Gate (Rule 0 — `safety_policy.md`)

The write operations (create + activate — the default — plus `--activate-only` and `--delete`) run the environment gate before any SAP-side step; the read checks (`--check-state`, existence check) skip it:

powershell -NoProfile -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_safety_gate.ps1" -Action assert -Skill sap-function-group

| Verdict (last line) | Exit | Action | |---|---|---| | `SAFETY: ALLOW ...` | 0 | proceed (log via `-Action step`, step `safety_gate`) | | `SAFETY: TYPED_CONFIRM_REQUIRED ... expect="PROD <SID>/<CLIENT>"` | 3 | the operator must **type** the shown token; re-run assert with `-ConfirmationText '<their verbatim answer>'`;