/sap-job

name: sap-job
description: |
  Manages ABAP background jobs on a live SAP system — schedule, list, status, log,
  spool, cancel, delete. Mode-aware: prefers the RFC fast-path (schedule via the
  RFC-enabled Z_RUN_REPORT; list/status via TBTCO; spool id via TBTCP; delete via
  BP_JOB_DELETE) and falls through to GUI (SM36 schedule / SM37 operations) when
  RFC is unavailable, honouring userConfig.sap_dev_mode. Scheduling a report EXECUTES
  it (possibly recurring), and cancel/delete are destructive — the skill ALWAYS
  confirms those before acting, per skill_operating_rules Rule 5. Reads (list/status/
  log/spool) run without confirmation. Reuses Z_RUN_REPORT (deployed by /sap-dev-init)
  and delegates spool text to /sap-sp02 and abort detail to /sap-st22.
  Prerequisites: active SAP GUI session (/sap-login). The RFC path additionally needs
  SAP NCo 3.1 (32-bit) + Z_RUN_REPORT; without them the skill uses the SM36/SM37 GUI paths.
argument-hint: "schedule <PROGRAM> [--variant=V] [--start=immediate|YYYYMMDDHHMMSS|event:E] [--period=daily|weekly|monthly] [--jobname=N]   |   list [--user=U] [--jobname=Z*] [--from=YYYYMMDD] [--to=YYYYMMDD] [--status=R|Y|P|S|A|F]   |   <status|log|spool|cancel|delete> <JOBNAME> <JOBCOUNT> [--save-output=PATH]"

SAP Job Skill

You manage ABAP background jobs on a live SAP system. **Scheduling** a report runs it (possibly on a recurrence) and **cancel/delete** are destructive — those three verbs share the report-execution risk class, so this skill ALWAYS confirms them (Step 2.5) and never acts as an unconfirmed side effect of another skill. The monitoring verbs (**list / status / log / spool**) are read-only and run without a prompt.

Task: $ARGUMENTS

---

Shared Resources

| File | Purpose | |---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` | **Rule 0 (highest priority)** — environment guard; enforced by Step 0.6 via `sap_safety_gate.ps1` for the write modes (`schedule`, `cancel`, `delete`) | | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | Mandatory operating rules — **Rule 5 (report execution + destructive job ops require confirmation)** governs `schedule`, `cancel`, `delete` | | `<SAP_DEV_CORE_SHARED_DIR>/rules/language_independence_rules.md` | GUI-scripting language independence — component ID + DDIC field name, status via `MessageType` (S/W/E/I/A), VKey over menu-text, no `.Text`/`.Tooltip` branching | | `<SKILL_DIR>/references/sap_job_rfc.ps1` | RFC backend (32-bit PS): schedule (Z_RUN_REPORT), list/status (TBTCO), spool (TBTCP), delete (BP_JOB_DELETE); emits `JOB:` lines | | `<SKILL_DIR>/references/sap_sm36_schedule.vbs` | GUI schedule fallback — SM36 wizard (job → step → start condition → save); emits `JOB:` lines | | `<SKILL_DIR>/references/sap_sm37_ops.vbs` | GUI operations fallback — SM37 list/status/log/spool/cancel/delete; emits `JOB:` lines | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_rfc_lib.ps1` | NCo 3.1 connect + `New-RfcReadTable` / `Add-RfcField` / `Add-RfcOption` (dot-sourced by the backend) | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_gui_security_precheck.ps1` | Read-only allow-list pre-check (`saprules.xml`) before a GUI job-log `%PC` save | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_gui_security_sidecar.ps1` | OS-level watcher that auto-dismisses the SAP GUI Security dialog on the log save | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_artifact_lib.ps1` | `New-SapScopeKey` / `Register-SapArtifact` — register captured spool/log output for `/sap-evidence-pack`. Best-effort; never changes the verdict. |

**Delegated skills** (invoke via the Skill tool — do not re-implement): `/sap-login` (session), `/sap-sp02` (spool → file), `/sap-st22` (dump detail on an aborted job), `/sap-run-report` (to execute a report *foreground* / for variant maintenance), `/sap-gui-probe --record` (capture the SM36/SM37 control IDs live).

**Reuses `Z_RUN_REPORT`** — the RFC-enabled scheduling FM deployed by `/sap-dev-init` (Phase B, shared with `/sap-run-report`). No new FM; `/sap-job schedule` calls it by name over RFC for immediate scheduling.

---

Step 0 — Resolve Work Directory

Resolve `work_dir` via the env-aware helper (NOT a direct `settings.json` read):

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir)); Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

`{WORK_TEMP} = work_dir\temp`. Settings reads follow `shared/rules/settings_lookup.md`.

cmd /c if not exist "{WORK_TEMP}" mkdir "{WORK_TEMP}"

Set `{RUN_TEMP}` = the `RUN_TEMP=` value printed above (a fresh per-run scratch dir). Write the skill's generated scratch there; keep `{WORK_TEMP}` (base) only for `Get-SapCurrentSessionPath -WorkTemp '{WORK_TEMP}'`.

---

Step 0.5 — Start Logging

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_job_run.json" -Skill sap-job -ParamsJson "{\"mode\":\"<schedule|list|status|log|spool|cancel|delete>\",\"program\":\"<P|>\",\"backend\":\"<rfc|gui>\"}"

State file: `{RUN_TEMP}\sap_job_run.json`. Best-effort (Rule 4: never skip the call).

---

Step 0.6 — Safety Gate (Rule 0 — `safety_policy.md`)

The write modes (`schedule`, `cancel`, `delete`) run the environment gate before any SAP-side step; the read modes (`list`, `status`, `log`, `spool`) skip it:

powershell -NoProfile -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_safety_gate.ps1" -Action assert -Skill sap-job

| Verdict (last line) | Exit | Action | |---|---|---| | `SAFETY: ALLOW ...` | 0 | proceed (log via `-Action step`, step `safety_gate`); the Rule 5 confirms still apply | | `SAFETY: TYPED_CONFIRM_REQUIRED ... expect="PROD <SID>/<CLIENT>"` | 3 | the operator must **type** the shown token; re-run assert with `-ConfirmationText '<their verbatim a