/sap-se38

name: sap-se38
description: |
  Deploys ABAP source to a SAP system via SE38 (SAP GUI Scripting) — creates or
  updates programs: existence check, source upload (file path or pasted code),
  syntax check, save, activate, and (for Report type 1) selection-text update.
  Also three secondary modes on an existing program: check-and-fix ("fix PGM" /
  "check and fix PGM" with no source file — syntax-check, download, fix errors,
  re-upload, activate); change-attributes (Title / Status / Type / header fields
  via Goto → Attributes, then Save + Activate so it persists); delete ("delete
  program <X>" — irreversible, asks for explicit confirmation, verifies removal).
  Handles the SAPLSETX original-language popup and the Workbench-request popup per
  /sap-transport-request.
  Prerequisites: active SAP GUI session (/sap-login first).
argument-hint: "<program-name> [path-to-source]"

SAP SE38 Deploy Skill

You deploy ABAP source code to a live SAP system via SE38 using SAP GUI Scripting. The skill checks if the program exists, then creates or updates it.

Task: $ARGUMENTS

Shared Resources

| File | Purpose | |---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` | **Rule 0 (highest priority)** — environment guard; enforced by Step 0.6 via `sap_safety_gate.ps1` | | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | Mandatory operating rules | | `<SAP_DEV_CORE_SHARED_DIR>/rules/tr_resolution.md` | TR resolution flow — this skill delegates to `/sap-transport-request` (Step 1b) | | `<SAP_DEV_CORE_SHARED_DIR>/rules/language_independence_rules.md` | GUI-scripting language independence — identify by component ID + DDIC field name, status-bar checks via `MessageType` codes (S/W/E/I/A), VKey instead of menu-text, no branching on `.Text`/`.Tooltip`/window titles | | `<SAP_DEV_CORE_SHARED_DIR>/rules/abap_code_quality_rules.md` | ABAP code-quality rules — deployed program source must follow modern syntax, OOP scaffolds, no literal MESSAGE strings, perf-band-appropriate SQL. Run `/sap-check-abap` before deploy when the source isn't generator-emitted. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_log_lib.ps1` | Structured logger. Driven via the shared `sap_log_helper.ps1` wrapper that persists `run_id` between skill steps. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_log_helper.ps1` | Shared start/step/end wrapper around `sap_log_lib.ps1`. Persists run state to `{RUN_TEMP}\sap_se38_run.json` so this skill's discrete bash blocks share one logical run. Logging is best-effort and never breaks the skill. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_error_hints.ps1` | frequently_errors recorder. Step 6b feeds deploy syntax/activation errors (`-Action record -Source SE38 -RawOutputFile ...`) so FM/METHOD-related failures are captured to the team store. Best-effort; never changes the verdict. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_rfc_syntax_check.ps1` | Headless compiler syntax pre-check (Step 4.6) — runs `EDITOR_SYNTAX_CHECK` via the dev-init wrapper before the GUI deploy so a syntax error is caught pre-upload. Program type `1` only (self-contained); degrades to the Step 5 Ctrl+F2 when RFC/wrapper is unavailable. | | `<SAP_DEV_CORE_SHARED_DIR>/rules/sap_gui_security_handling.md` | SAP GUI Security dialog handling — the check-and-fix **source download** (Step A) is SAP-GUI-side file IO, so it can raise the modal "SAP GUI Security" dialog (which suspends the Scripting API and hangs cscript). Pre-check + OS-level watcher wrap that download. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_gui_security_precheck.ps1` | Read-only allow-list pre-check (`saprules.xml`) — `ALLOWED` (exit 0) / `NOT_COVERED` (exit 1). Used by Step A before the source download. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_gui_security_sidecar.ps1` | OS-level (Win32) watcher that auto-dismisses the SAP GUI Security dialog (ticks Remember + clicks Allow). Launched as a background process before the Step A download. |

---

Step 0 — Resolve Work Directory

**Resolve `work_dir` via the env-aware helper** — do NOT take `work_dir` from a direct `settings.json` read (that ignores the `SAPDEV_AI_WORK_DIR` env var and `userconfig.json`). Use the `WORK_DIR=` value printed by:

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir)); Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

The settings note below still applies to the OTHER keys.

**Settings reads/writes follow `shared/rules/settings_lookup.md`** — merge per-key on the `.value` field (env var → `settings.local.json` → `userconfig.json` → `settings.json`); non-per-connection writes go to `userconfig.json`. Resolve sap-dev-core paths: 2 levels up from `<SKILL_DIR>` to the plugin root, then `settings.json` and (if present) `settings.local.json`. Read `custom_url`.

| Setting | Default if blank | |---|---| | `work_dir` | `C:\sap_dev_work` | | `custom_url` | `{work_dir}\custom` |

Set `{WORK_TEMP}` = `{work_dir}\temp`

Ensure the temp directory exists:

cmd /c if not exist "{WORK_TEMP}" mkdir "{WORK_TEMP}"

Set `{RUN_TEMP}` = the `RUN_TEMP=` value printed above — a fresh per-run scratch directory `{work_dir}\temp\run_<id>`, already created by `Get-SapRunTemp`. Resolve it **once here** and reuse the same value for the rest of this invocation; it isolates this run's generated wrappers / state / scratch files so concurrent runs (parallel sub-agents, multi-connection deploys) never collide. **`{WORK_TEMP}` stays the base temp dir** and is used ONLY for `Get-SapCurrentSessionPath -WorkTemp '{WORK_TEMP}'` (the session-attach plumbing derives `{work_dir}\runtime` from its parent, so it must see the base path, not the run dir). Everything the skill writes itself goes under `{RUN_TEMP}`.

---

Step 0.5 — Start Logging

Start a structured log run for this skill invocation. The helper persists the