/sap-login

name: sap-login
description: |
  Opens a SAP GUI connection and logs in using SAP GUI Scripting.
  Multi-profile connection store (Phase 4): save multiple SAP connections
  (different SID / Client / User / endpoint) at `{work_dir}\runtime\connections.json`,
  with passwords DPAPI-encrypted at rest. Picks the right one for this
  AI session via a 4-step identity compare and an AI-session pin.
  Also verifies SAP NCo 3.1 RFC connectivity (direct or load-balanced via
  MessageServer + LogonGroup + SystemID).
  Supports three connection methods: SAP Logon pad entry name (OpenConnection),
  load-balanced /M/<msrv>/G/<grp>/S/<sid> string, and direct /H/<host>/S/<port>.
  Checks existing sessions first; reuses the active connection when it
  matches the saved default.
  Prerequisites: SAP GUI installed, SAP GUI Scripting enabled (client + server).
argument-hint: "[--lang <CODE>] [--force] [--reclassify] [--list | --add | --switch <id> | --set-default <id> | --delete <id>]"

SAP GUI Login Skill

You open a SAP GUI connection and log in via SAP GUI Scripting, and optionally verify RFC connectivity via SAP NCo 3.1.

Task: $ARGUMENTS

---

Shared Resources

| File | Token | Purpose | |---|---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` | *(rule — Rule 0, highest priority)* | Environment classification + production guard. This skill is the classification entry point (Step 6.8) and enforces `prod_access=NONE` at selection time (Step 0.8). | | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | *(rule)* | Mandatory operating rules | | `<SAP_DEV_CORE_SHARED_DIR>/rules/language_independence_rules.md` | *(rule)* | GUI-scripting language independence — identify by component ID + DDIC field name, status-bar checks via `MessageType` codes (S/W/E/I/A), VKey instead of menu-text, no branching on `.Text`/`.Tooltip`/window titles | | `sap-dev-core/shared/scripts/sap_check_gui_login_status.vbs` | *(none — static)* | Check session status | | `sap-dev-core/shared/scripts/sap_login.vbs` | *(template)* | SAP GUI login VBScript. Tokens: `%%SAP_LOGON_DESCRIPTION%%`, `%%SAP_APPLICATION_SERVER%%`, `%%SAP_SYSTEM_NUMBER%%`, `%%SAP_MESSAGE_SERVER%%`, `%%SAP_LOGON_GROUP%%`, `%%SAP_SYSTEM_ID%%`, `%%SAP_SYSTEM_NAME%%`, `%%SAP_CLIENT%%`, `%%SAP_USER%%`, `%%SAP_PASSWORD%%`, `%%SAP_LANGUAGE%%`. | | `sap-dev-core/shared/scripts/sap_rfc_connect.ps1` | *(template)* | SAP NCo 3.1 RFC connection PowerShell. Now supports load-balanced login via `MessageServer + LogonGroup + SystemID`. | | `sap-dev-core/shared/scripts/sap_rfc_lib.ps1` | `%%RFC_LIB_PS1%%` | NCo helpers. `Connect-SapRfc` accepts either direct (`-Server` + `-Sysnr`) or load-balanced (`-MessageServer` + `-LogonGroup` + `-SystemID`). | | `sap-dev-core/shared/scripts/sap_dpapi.ps1` | *(none — static)* | DPAPI encrypt/decrypt for passwords at rest. CLI mode: `-Action protect|unprotect -Value <text>`. | | `sap-dev-core/shared/scripts/sap_connection_lib.ps1` | *(none — dot-source)* | **Multi-profile connection store**. 4-step identity compare, dedup-on-save, DPAPI password handling, legacy-settings migration. Storage: `{work_dir}\runtime\connections.json`. | | `sap-dev-core/shared/scripts/sap_session_broker.ps1` | *(none — invoke)* | Broker. New Phase-4 actions: `pin`, `unpin`, `set-connection-id`, `stuck`. New flags: `-AiSessionId`, `-WasCreated`, `-ForceUnpin`. | | `sap-dev-core/shared/scripts/sap_rfc_system_info.ps1` | *(none — direct invoke)* | RFC_SYSTEM_INFO + CVERS query. Step 6.2 calls this to capture `server_release_marker`, `software_components`. | | `sap-dev-core/shared/scripts/sap_safety_gate.ps1` | *(none — direct invoke)* | **Rule 0 gate.** Step 6.8 runs `-Action classify` (32-bit PS; T000 `CCCATEGORY`/`CCCORACTIV`/`CCNOCLIIND` for the pinned client) then `-Action set -Environment <E> -Source <T000\|USER>` to persist the classification on the profile. | | `sap-dev-core/shared/tables/sap_release_markers.tsv` | *(none — read by sap_rfc_system_info.ps1)* | (component, release range) → canonical marker lookup. | | `<SKILL_DIR>/sap_login_select.ps1` | *(none — direct invoke)* | **Selection driver**. Actions: `init`, `decide`, `list`, `set-default`, `switch`, `delete`, `finalize`, `check`, `landscape-entries`. Emits structured signals (`RESOLVED:`, `ATTACH_ACTIVE:`, `CONNECT_PROFILE:`, `PICK_NEEDED:`, `ADD_NEEDED:`, `SUCCESS:`, `AMBIGUOUS:`, `CONTINUE_TO_STEP1:`, `LANDSCAPE:`). | | `<SKILL_DIR>/references/sap_login_capture_active_session.vbs` | *(none — static)* | GUI-side capture. Phase-4 fields: `system_name`, `client`, `user`, `language`, `application_server`, `system_number`, `message_server`, `logon_group`, `program`, `screen_number`, plus GUI version. Emits flat JSON or `MULTI:<array>`. | | `<SKILL_DIR>/references/sap_close_connection.vbs` | *(none — static)* | Closes a SAP GUI connection by path (`/app/con[N]`, or a session path reduced to its connection). Used by **Step 0.9** to drop an active connection whose logon language differs from the requested one, so the login flow can reopen it fresh in the requested language. Verifies via connection-count decrease (renumber-proof). Emits `CLOSED: <path>` / `ERROR: <text>`. |

---

Step 0 — Resolve Work Directory (with first-run onboarding)

`/sap-login` is an onboarding entry point — resolve `{work_dir}` per **`<SAP_DEV_CORE_SHARED_DIR>\rules\work_dir_onboarding.md`** (probe → use the env value / soft tip / first-run prompt + set / migrate-on-change). **Never read `settings.json` directly for `work_dir`** — that ignores `SAPDEV_AI_WORK_DIR` + `userconfig.json`. Probe:

powershell -NoProfile -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_workdir_setup.ps1" -Action probe

Follow that doc to fix `{work_dir}` (set the env var / migrate when needed). Once `{work_dir}` is known, apply the **current-session env bridge** (doc Step E): prefix this run's PowerShell commands with `$env:SAPDEV_AI_WORK_DIR='{work_dir}';` (escape the `$` as `\$` when the comma