/sap-se21

name: sap-se21
description: |
  Creates, checks, or deletes SAP development packages via transaction
  SE21 using SAP GUI Scripting (VBS). First verifies package existence
  using RFC_READ_TABLE on TDEVC, then creates it via the live GUI
  session. Delegates transport-request resolution to
  /sap-transport-request — never prompts the user for a TR or calls
  /sap-se01 directly.
  Also supports delete mode: when the user explicitly asks to delete
  a package (e.g. "delete package <X>", "drop package <X>"), navigates
  to SE21, fills the package name, presses Shift+F2 (sendVKey 14)
  from the initial screen, walks the confirmation popup chain, and
  verifies removal. Deletion is irreversible — the skill MUST confirm
  with the user (showing TADIR child count from the existence check)
  before launching the VBS.
  Connection parameters from settings.json (sap-dev-core plugin).
  Prerequisites: SAP GUI installed, SAP GUI Scripting enabled, an active
  logged-in session (run /sap-login first).
argument-hint: "[package-name] [OBJECT_TYPE=PACKAGE OBJECT_DESCRIPTION=<name>] [--delete]"

SAP Package (SE21) Skill

You create or check SAP development packages. First you verify whether the package already exists via RFC, then drive the live SAP GUI session to create it through SE21. The transport request is resolved by `/sap-transport-request` (never asked or created here).

Task: $ARGUMENTS

---

Shared Resources

| File | Token | Purpose | |---|---|---| | `<SKILL_DIR>/references/sap_se21_create.vbs` | `%%PACKAGE%%`, `%%DESCRIPTION%%`, `%%TRANSPORT%%`, `%%SESSION_LOCK_VBS%%` | GUI-scripting template that drives SE21 to create the package | | `<SKILL_DIR>/references/sap_check_package.ps1` | `%%PACKAGE%%`, `%%SAP_*%%` | RFC_READ_TABLE check for package existence on TDEVC | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_tadir_delete.ps1` | — (CLI) | Delete **orphaned** TADIR children (definition gone) via the dev-init wrapper FM → `TR_TADIR_INTERFACE`, so a package whose only blockers are orphans can be deleted. Safety-guarded (refuses rows whose definition still exists) + RFC-verified. Used by Step 8. | | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` | — | **Rule 0 (highest priority)** — environment guard; enforced by Step 0.6 via `sap_safety_gate.ps1` | | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | — | Mandatory operating rules | | `<SAP_DEV_CORE_SHARED_DIR>/rules/tr_resolution.md` | — | TR resolution policy implemented by `/sap-transport-request` | | `<SAP_DEV_CORE_SHARED_DIR>/rules/language_independence_rules.md` | — | GUI-scripting language independence — identify by component ID + DDIC field name, status-bar checks via `MessageType` codes (S/W/E/I/A), VKey instead of menu-text, no branching on `.Text`/`.Tooltip`/window titles |

---

Step 0 — Resolve Work Directory

**Resolve `work_dir` via the env-aware helper** — do NOT take `work_dir` from a direct `settings.json` read (that ignores the `SAPDEV_AI_WORK_DIR` env var and `userconfig.json`). Use the `WORK_DIR=` value printed by:

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir)); Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

The settings note below still applies to the OTHER keys.

**Settings reads/writes follow `shared/rules/settings_lookup.md`** — merge per-key on the `.value` field (env var → `settings.local.json` → `userconfig.json` → `settings.json`); non-per-connection writes go to `userconfig.json`. Resolve sap-dev-core paths: 2 levels up from `<SKILL_DIR>` to the plugin root, then `settings.json` and (if present) `settings.local.json`. Read `custom_url`.

| Setting | Default if blank | |---|---| | `work_dir` | `C:\sap_dev_work` | | `custom_url` | `{work_dir}\custom` |

Set `{WORK_TEMP}` = `{work_dir}\temp`

Ensure the temp directory exists:

cmd /c if not exist "{WORK_TEMP}" mkdir "{WORK_TEMP}"

Set `{RUN_TEMP}` = the `RUN_TEMP=` value printed above — a fresh per-run scratch directory `{work_dir}\temp\run_<id>`, already created by `Get-SapRunTemp`. Resolve it **once here** and reuse the same value for the rest of this invocation; it isolates this run's generated wrappers / state / scratch files so concurrent runs (parallel sub-agents, multi-connection deploys) never collide. **`{WORK_TEMP}` stays the base temp dir** and is used ONLY for `Get-SapCurrentSessionPath -WorkTemp '{WORK_TEMP}'` (the session-attach plumbing derives `{work_dir}\runtime` from its parent, so it must see the base path, not the run dir). Everything the skill writes itself goes under `{RUN_TEMP}`.

---

Step 0.5 — Start Logging

Start a structured log run. State file: `{RUN_TEMP}\sap_se21_run.json`. Best-effort.

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_se21_run.json" -Skill sap-se21 -ParamsJson "{\"package\":\"<PACKAGE>\"}"

---

Step 0.6 — Safety Gate (Rule 0 — `safety_policy.md`)

This skill mutates the SAP system (package create / delete). Run the environment gate before any SAP-side step:

powershell -NoProfile -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_safety_gate.ps1" -Action assert -Skill sap-se21

| Verdict (last line) | Exit | Action | |---|---|---| | `SAFETY: ALLOW ...` | 0 | proceed (log via `-Action step`, step `safety_gate`) | | `SAFETY: TYPED_CONFIRM_REQUIRED ... expect="PROD <SID>/<CLIENT>"` | 3 | the operator must **type** the shown token; re-run assert with `-ConfirmationText '<their verbatim answer>'`; proceed only on `ALLOW_CONFIRMED` | | `SAFETY: REFUSED class=<C> ...` | 1 | **STOP.** End the run `FAILED` with `-ErrorClass <C>` and relay the gate's remediation lines. Never bypass, soften, retry, or drive the transaction manually instead — Rule 0 outranks every other instr