/sap-rfc-monitor

name: sap-rfc-monitor
description: |
  Diagnoses stuck tRFC / qRFC interface queues and audits the SM59 RFC
  destination register — read-only over RFC (no GUI). `queues` snapshots the
  tRFC (SM58) and inbound/outbound qRFC (SMQ2/SMQ1) queues: per-destination /
  per-queue depth, age, head-blocker error text, and the inbound-scheduler
  registration flag, then clusters the failed LUWs by root cause (target down /
  auth / data / not-registered) with one recommended action each. `destinations`
  parses RFCDES into an auditable register — type, target host, logon user, trust
  flag, and stored-credential PRESENCE flag (RFCDESSECU is never read) — plus the
  inbound trusted-system ACL, with an AI risk column. `retry` re-drives failed
  tRFC LUWs for one destination via RSARFCEX (confirm-gated, delegated to
  /sap-run-report) then authoritatively re-reads to verify CLEARED / REDUCED /
  UNCHANGED. LUW / queue DELETION is refused. Complements /sap-diagnose's `smq`
  interface triage as the standalone deep-dive. Prerequisites: SAP profile via
  /sap-login (RFC); SAP NCo 3.1 (32-bit) in GAC. No GUI session, no Z-object, no
  /sap-dev-init.
argument-hint: "queues [--dir=trfc|in|out|all] [--dest=D] [--queue=Q] [--top=N] [--save-output PATH] | destinations [--type=3|G|H|T|I|L] [--save-output PATH] | retry --dest=D"

SAP tRFC / qRFC Queue Monitor + Destination Register

You diagnose **stuck RFC interfaces** and audit **RFC destinations**, read-only over RFC. One `SYSFAIL` head-blocker silently halts everything queued behind it; this skill surfaces the whole picture in seconds and clusters hundreds of failed LUWs into a handful of causes with one recommended action each. The destinations half is the go-live / audit twin: RFCDES parsed into a risk-annotated register.

Task: $ARGUMENTS

**You are read-only against SAP for `queues` and `destinations`.** The only state change anywhere is `retry`, which executes the SAP-standard report RSARFCEX through /sap-run-report behind an evidence-first confirm gate. **LUW / queue deletion and unlock are refused** (manual SM58 / SMQ1 / SMQ2 pointer), never automated.

---

Shared Resources

| File | Token / call | Purpose | |---|---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` | *(rule)* | **Rule 0 (highest priority)** — environment guard; enforced by Step 5 via `sap_safety_gate.ps1` | | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | *(rule)* | Mandatory operating rules — reads always allowed; the one write (RSARFCEX) is a SAP-supplied API, confirm-gated | | `<SKILL_DIR>/references/sap_rfcq_read.ps1` | `-Area trfc\|qin\|qout\|qstate [-Dest -Queue -Top -HeadLuws -ExpectCleared -OutTsv]` | The tRFC/qRFC queue reader + retry verifier (RFC) | | `<SKILL_DIR>/references/sap_rfcdes_parse.ps1` | `[-Type -Max -OutTsv]` | RFCDES → destination register + tolerant RFCOPTIONS parser (RFC) | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_rfc_lib.ps1` | dot-sourced by the engines | NCo 3.1 connect + `RFC_READ_TABLE` helpers | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_object_resolver.ps1` | dot-sourced by the engines | `Read-SapTableRows` | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_artifact_lib.ps1` | dot-sourced by the engines + Step 6 | Scope key, artifact dir, `Register-SapArtifact` | | `/sap-run-report` | sub-skill | Executes RSARFCEX (`retry`) — owns the execution confirm gate | | `/sap-diagnose` | related | Triages interface incidents via its own lightweight `smq` reader (Wave-0 T1-B); this skill is the standalone deep-dive (destinations register, retry, richer clustering) — invoke directly or as a follow-up |

---

Step 0 — Resolve Work Directory and Settings

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir))"

Set `{RUN_TEMP}` (per-run scratch):

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

---

Step 0.5 — Start Logging

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_rfc_monitor_run.json" -Skill sap-rfc-monitor -ParamsJson "{}"

---

Step 1 — Parse Arguments & Mode Dispatch

First token selects the mode. Flags follow.

| Mode | Args | Access | |---|---|---| | `queues` | `[--dir=trfc\|in\|out\|all]` (default `all`), `[--dest=D]`, `[--queue=Q]`, `[--top=N]` (default 20), `[--save-output PATH]` | **read-only** | | `destinations` | `[--type=3\|G\|H\|T\|I\|L]`, `[--max=N]`, `[--save-output PATH]` | **read-only** | | `retry` | `--dest=D` (required) | **gated write** (RSARFCEX) |

`--dir` maps to engine `-Area`: `trfc`→`trfc`, `in`→`qin`, `out`→`qout`, `all`→`all`.

**Hard rules at parse time (fail loud — do NOT proceed):**

• Any **delete / unlock** request (e.g. "delete the stuck LUW", "unlock the

queue", "clear SMQ2") → **REFUSE**. Print the refusal + a manual pointer ("Delete/unlock is not automated. Use SM58 / SMQ1 / SMQ2 manually."), log end with `error_class=RFCQ_ACTION_REFUSED`, STOP. This is a refusal, not a gate.

• `retry` without `--dest` → usage ERROR, STOP.
• `destinations --test`, `destinations --diff --against <profile>`, qRFC

`retry --dir=in|out`, per-LUW retry → **not yet implemented (Phase 1.5 / v2)**. Tell the user, then continue only with the implemented behavior (or STOP if that was the whole request). See **Scope & Limitations**.

---

Step 2 — Ensure the RFC Profile

This skill needs an **RFC connection only — no GUI session**. A SAP profile must be pinned (`/sap-login`); the engines self-connect via it. If no profile is pinned, run `/sap-login` first.

**RFC unavailable → fail loud.** If an engine prints `STATUS: RFC_ERROR` (exit 2), report the failure and the **manual tcode path** (SM58