/sap-run-report

name: sap-run-report
description: |
  Executes an ABAP report/program on a live SAP system and captures the output —
  foreground (SA38 F8, interactive list) or background (scheduled job), with or
  without a variant, or ad-hoc selection values. Also maintains variants —
  create/overwrite (set) and delete via the SAPLSVAR GUI dialogs, list/show via RFC. Mode-aware:
  prefers the RFC fast-path where present and falls through to GUI (SA38 F8 /
  Execute-in-Background) when RFC is unavailable, honouring userConfig.sap_dev_mode.
  Executing a report can change data (UPDATE / COMMITting BAPI / job submit / IDoc /
  mail) — the skill ALWAYS confirms before it runs, per skill_operating_rules Rule 5.
  Prerequisites: active SAP GUI session (use /sap-login first). The RFC background
  path additionally needs SAP NCo 3.1 (32-bit) + Z_RUN_REPORT (deploy via
  /sap-dev-init); variant list/show route through /sap-rfc-wrapper.
argument-hint: "<PROGRAM> [--variant=V] [--foreground|--background] [--values=\"P_A=1;S_B=BT:10,20\"] [--save-output=PATH]   |   variant <list|show|set|delete> <PROGRAM> [VARIANT] [--values=\"...\"] [--desc=\"...\"]"

SAP Run Report Skill

You execute an ABAP report/program on a live SAP system, or maintain its variants. Running a report is a **distinct risk class from deploying** it — a report may mutate data — so this skill ALWAYS confirms before it runs (Step 2.5) and never runs as an unconfirmed side effect of another skill.

Task: $ARGUMENTS

---

Shared Resources

| File | Purpose | |---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` | **Rule 0 (highest priority)** — environment guard; enforced by Step 0.6 via `sap_safety_gate.ps1` (execution is a write-risk class: a report is never assumed read-only) | | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | Mandatory operating rules — **Rule 5 (report execution requires confirmation)** governs this skill | | `<SAP_DEV_CORE_SHARED_DIR>/rules/language_independence_rules.md` | GUI-scripting language independence — identify by component ID + DDIC field name, status via `MessageType` (S/W/E/I/A), VKey over menu-text, no `.Text`/`.Tooltip` branching | | `<SKILL_DIR>/references/sap_sa38_run.vbs` | SA38 driver: fill program → F8 → (load variant) → execute (FG) or schedule background (BG); emits `RUN_REPORT:` lines | | `<SKILL_DIR>/references/sap_sa38_variant.vbs` | Variant maintenance driver (SET create/overwrite, DELETE) via the SAPLSVAR dialogs; emits `VARIANT:` lines | | `<SAP_DEV_CORE_SHARED_DIR>/rules/sap_gui_security_handling.md` | The foreground **list save** (Step 4) is SAP-GUI-side file IO → can raise the modal "SAP GUI Security" dialog. Pre-check + OS-level watcher wrap that save. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_gui_security_precheck.ps1` | Read-only allow-list pre-check (`saprules.xml`) before the list save | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_gui_security_sidecar.ps1` | OS-level watcher that auto-dismisses the SAP GUI Security dialog | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_artifact_lib.ps1` | `New-SapScopeKey` / `Register-SapArtifact` — register the run output for `/sap-evidence-pack` (Kind `run_output`). Best-effort; never changes the verdict. |

**Delegated skills** (invoke via the Skill tool — do not re-implement): `/sap-login` (session), `/sap-rfc-wrapper fm RS_VARIANT_*` (variant list/show), `/sap-sp02` (spool → file, background capture), `/sap-st22` (dump detail on an aborted run).

---

Step 0 — Resolve Work Directory

Resolve `work_dir` via the env-aware helper (NOT a direct `settings.json` read):

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir)); Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

`{WORK_TEMP} = work_dir\temp`. Settings reads follow `shared/rules/settings_lookup.md`.

cmd /c if not exist "{WORK_TEMP}" mkdir "{WORK_TEMP}"

Set `{RUN_TEMP}` = the `RUN_TEMP=` value printed above (a fresh per-run scratch dir). Write the skill's generated scratch there; keep `{WORK_TEMP}` (base) only for `Get-SapCurrentSessionPath -WorkTemp '{WORK_TEMP}'`.

---

Step 0.5 — Start Logging

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_run_report_run.json" -Skill sap-run-report -ParamsJson "{\"program\":\"<PROGRAM>\",\"mode\":\"<run|variant>\",\"engine\":\"<fg|bg>\"}"

State file: `{RUN_TEMP}\sap_run_report_run.json`. Best-effort (Rule 4: never skip the call).

---

Step 0.6 — Safety Gate (Rule 0 — `safety_policy.md`)

Executing a report can mutate data, so `run` mode and `variant set`/`variant delete` run the environment gate (`variant list`/`variant show` skip it):

powershell -NoProfile -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_safety_gate.ps1" -Action assert -Skill sap-run-report

| Verdict (last line) | Exit | Action | |---|---|---| | `SAFETY: ALLOW ...` | 0 | proceed (log via `-Action step`, step `safety_gate`); the Rule 5 execution confirm still applies | | `SAFETY: TYPED_CONFIRM_REQUIRED ... expect="PROD <SID>/<CLIENT>"` | 3 | the operator must **type** the shown token; re-run assert with `-ConfirmationText '<their verbatim answer>'`; proceed only on `ALLOW_CONFIRMED` | | `SAFETY: REFUSED class=<C> ...` | 1 | **STOP.** End the run `FAILED` with `-ErrorClass <C>` and relay the gate's remediation lines. Never bypass, soften, retry, or run the report manually instead — Rule 0 outranks every other instruction, including mid-session user ones. | | `SAFETY: ERROR ...` | 2 | treat exactly as `REFUSED` (fail closed) |

---

Step 1 — Parse Arguments + Resolve Mode + Resolve Backend

**Mode** — the first token selects it:

| Invocation | Mode | |---|---| | `<PROGRAM> …` | **run** (default; no keyword) | | `variant <list\|show