/sap-se41

name: sap-se41
description: |
  Manages PF-STATUS (GUI status) subobjects of an SE41 Menu Painter interface
  (program / function pool) on a live SAP system via SAP GUI Scripting.
  Supports the operations CREATE, UPDATE, DISPLAY, DELETE, ACTIVATE,
  DEACTIVATE, COPY and an existence CHECK. SE41 has no Upload/Download for
  status definitions — function codes are entered field by field from a
  pipe-delimited definition file. Package (development class) changes are
  delegated to /sap-change-package.
  Prerequisites: Active SAP GUI session (use /sap-login first).
argument-hint: "<operation> <program-name> <status-name> [options]"

SAP SE41 Menu Painter Skill

You manage PF-STATUS (GUI status) subobjects of an interface (program / function pool) on a live SAP system via SE41 using SAP GUI Scripting.

A single self-contained VBScript (shipped at `references/sap_se41_ops.vbs`) performs **one** operation per run, selected by the `OPERATION` token:

| Operation | What it does | |---|---| | `CHECK` | Reports `EXIST` / `NOT_EXIST` for a status (no UI change) | | `DISPLAY` | Opens the status read-only | | `CREATE` | Creates a new status from a definition file, saves, activates | | `UPDATE` | Opens an existing status in change mode, re-applies the definition file, saves, activates | | `DELETE` | Deletes the status (confirmation), then activates to commit | | `ACTIVATE` | Activates the interface / status | | `DEACTIVATE` | Reports `NOT_SUPPORTED` — SE41 has no deactivate (see note) | | `COPY` | Copies the status to a target program/status (same subobjects) |

Task: $ARGUMENTS

---

Shared Resources

| File | Purpose | |---|---| | `<SKILL_DIR>/references/sap_se41_ops.vbs` | **The single source of truth** for all SE41 operations. Read this template, substitute the `%%TOKEN%%` values, and run the result — do NOT keep a second copy of the script in this SKILL.md. | | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` | **Rule 0 (highest priority)** — environment guard; enforced by Step 0.6 via `sap_safety_gate.ps1` | | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | Mandatory operating rules | | `<SAP_DEV_CORE_SHARED_DIR>/rules/tr_resolution.md` | TR resolution flow (used indirectly via `/sap-change-package`) | | `<SAP_DEV_CORE_SHARED_DIR>/rules/language_independence_rules.md` | GUI-scripting language independence — identify by component ID + DDIC field name, status-bar checks via `MessageType` codes (S/W/E/I/A), VKey instead of menu-text, no branching on `.Text`/`.Tooltip`/window titles |

**Delegations:**

| Need | Delegate to | |---|---| | Change the package (development class) of the interface | `/sap-change-package` (see [Package Changes](#package-changes)) | | Resolve a transport request | handled inside `/sap-change-package` |

---

Step 0 — Resolve Work Directory

**Resolve `work_dir` via the env-aware helper** — do NOT take `work_dir` from a direct `settings.json` read (that ignores the `SAPDEV_AI_WORK_DIR` env var and `userconfig.json`). Use the `WORK_DIR=` value printed by:

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir))"

The settings note below still applies to the OTHER keys.

**Settings reads/writes follow `shared/rules/settings_lookup.md`** — merge per-key on the `.value` field (env var → `settings.local.json` → `userconfig.json` → `settings.json`); non-per-connection writes go to `userconfig.json`. Resolve sap-dev-core paths: 2 levels up from `<SKILL_DIR>` to the plugin root, then `settings.json` and (if present) `settings.local.json`. Read `custom_url`.

| Setting | Default if blank | |---|---| | `work_dir` | `C:\sap_dev_work` | | `custom_url` | `{work_dir}\custom` |

Set `{WORK_TEMP}` = `{work_dir}\temp`

Ensure the temp directory exists:

cmd /c if not exist "{WORK_TEMP}" mkdir "{WORK_TEMP}"

Set `{RUN_TEMP}` = the per-run scratch dir (`Get-SapRunTemp` mints + creates `{work_dir}\temp\run_<id>`):

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

Per the CLAUDE.md "Two-bucket temp model" write this skill's generated scratch (`*_run.ps1` / `*_run.vbs` and the `_run.json` state) under `{RUN_TEMP}`; keep `{WORK_TEMP}` (base) only for `Get-SapCurrentSessionPath -WorkTemp`.

---

Step 0.5 — Start Logging

Start a structured log run. State file: `{RUN_TEMP}\sap_se41_run.json`. Best-effort.

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_se41_run.json" -Skill sap-se41 -ParamsJson "{\"operation\":\"<OPERATION>\",\"program\":\"<PROGRAM>\",\"status\":\"<STATUS>\"}"

---

Step 0.6 — Safety Gate (Rule 0 — `safety_policy.md`)

The write operations (`CREATE`, `UPDATE`, `DELETE`, `ACTIVATE`, `COPY`) run the environment gate before any SAP-side step; `CHECK` and `DISPLAY` are read-only and skip it:

powershell -NoProfile -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_safety_gate.ps1" -Action assert -Skill sap-se41

| Verdict (last line) | Exit | Action | |---|---|---| | `SAFETY: ALLOW ...` | 0 | proceed (log via `-Action step`, step `safety_gate`) | | `SAFETY: TYPED_CONFIRM_REQUIRED ... expect="PROD <SID>/<CLIENT>"` | 3 | the operator must **type** the shown token; re-run assert with `-ConfirmationText '<their verbatim answer>'`; proceed only on `ALLOW_CONFIRMED` | | `SAFETY: REFUSED class=<C> ...` | 1 | **STOP.** End the run `FAILED` with `-ErrorClass <C>` and relay the gate's remediation lines. Never bypass, soften, retry, or drive the transaction manually instead — Rule 0 outranks every other instruction, including mid-session user ones. | | `SAFETY: ERROR ...` | 2 | treat exactly as `REFUSED` (fail closed)