/sap-update-addon

name: sap-update-addon
description: |
  Insert or update records in SAP add-on tables (Y/Z prefix); DELETE is not
  automated on any method path (refused before touching data — drive SM30
  manually for row deletion).
  Automatically detects the best method:
    1. SM30 — if a maintenance view exists
    2. SE16 — if DD02L-MAINFLAG = 'X' (direct table maintenance allowed)
    3. ZCMRUPDATE_ADDON_TABLE — fallback program for any add-on table
  Requires SAP GUI with an active session. Uses RFC for detection.
argument-hint: "<table-name> <data-file> [<operation>] [<sap-logon-description>]"

SAP Update Add-on Table Skill

You maintain records in SAP add-on tables (Y/Z prefix) by detecting the best method and executing the appropriate transaction.

Task: $ARGUMENTS

---

Shared Resources

| File | Purpose | |---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` | **Rule 0 (highest priority)** — environment guard; enforced by Step 0.6 via `sap_safety_gate.ps1` | | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | Mandatory operating rules | | `<SAP_DEV_CORE_SHARED_DIR>/rules/language_independence_rules.md` | GUI-scripting language independence — identify by component ID + DDIC field name, status-bar checks via `MessageType` codes (S/W/E/I/A), VKey instead of menu-text, no branching on `.Text`/`.Tooltip`/window titles | | `<SAP_DEV_CORE_SHARED_DIR>/rules/abap_code_quality_rules.md` | ABAP code-quality rules — apply to ABAP this skill generates or checks. **Exception:** `references/ZCMRUPDATE_ADDON_TABLE.abap` is a deliberately **classic-syntax** bootstrap utility (it must activate on ECC 6.0 / NetWeaver ≤7.40 as well as S/4HANA) — do NOT modernize it. See "Classic-syntax exception" in Step 4c. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_gui_security_sidecar.ps1` | OS-level (Win32) auto-dismiss for the "SAP GUI Security" dialog. Step 4c (PROG method) launches it in parallel: the program's `GUI_UPLOAD` (data-file read) and save-list `GUI_DOWNLOAD` (output write) are SAP-GUI-side file IO that trip the modal when `{work_dir}` isn't trusted — without the watcher, `cscript` hangs. |

---

Step 0 — Resolve Work Directory

**Resolve `work_dir` via the env-aware helper** — do NOT take `work_dir` from a direct `settings.json` read (that ignores the `SAPDEV_AI_WORK_DIR` env var and `userconfig.json`). Use the `WORK_DIR=` value printed by:

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir)); Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

The settings note below still applies to the OTHER keys.

**Settings reads/writes follow `shared/rules/settings_lookup.md`** — merge per-key on the `.value` field (env var → `settings.local.json` → `userconfig.json` → `settings.json`); non-per-connection writes go to `userconfig.json`. Resolve sap-dev-core paths: 2 levels up from `<SKILL_DIR>` to the plugin root, then `settings.json` and (if present) `settings.local.json`. Read `custom_url`.

| Setting | Default if blank | |---|---| | `work_dir` | `C:\sap_dev_work` | | `custom_url` | `{work_dir}\custom` |

Set `{WORK_TEMP}` = `{work_dir}\temp`

Ensure the temp directory exists:

cmd /c if not exist "{WORK_TEMP}" mkdir "{WORK_TEMP}"

Set `{RUN_TEMP}` = the `RUN_TEMP=` value printed above — a fresh per-run scratch directory `{work_dir}\temp\run_<id>`, already created by `Get-SapRunTemp`. Resolve it **once here** and reuse the same value for the rest of this invocation; it isolates this run's generated wrappers / state / scratch files so concurrent runs (parallel sub-agents, multi-connection deploys) never collide. **`{WORK_TEMP}` stays the base temp dir** and is used ONLY for `Get-SapCurrentSessionPath -WorkTemp '{WORK_TEMP}'` (the session-attach plumbing derives `{work_dir}\runtime` from its parent, so it must see the base path, not the run dir). Everything the skill writes itself goes under `{RUN_TEMP}`.

---

Step 0.5 — Start Logging

Start a structured log run. State file: `{RUN_TEMP}\sap_update_addon_run.json`. Best-effort.

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_update_addon_run.json" -Skill sap-update-addon -ParamsJson "{\"table\":\"<TABLE>\"}"

---

Step 0.6 — Safety Gate (Rule 0 — `safety_policy.md`)

This skill writes business data into Y/Z add-on tables. Run the environment gate before any SAP-side step:

powershell -NoProfile -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_safety_gate.ps1" -Action assert -Skill sap-update-addon

| Verdict (last line) | Exit | Action | |---|---|---| | `SAFETY: ALLOW ...` | 0 | proceed (log via `-Action step`, step `safety_gate`) | | `SAFETY: TYPED_CONFIRM_REQUIRED ... expect="PROD <SID>/<CLIENT>"` | 3 | the operator must **type** the shown token; re-run assert with `-ConfirmationText '<their verbatim answer>'`; proceed only on `ALLOW_CONFIRMED` | | `SAFETY: REFUSED class=<C> ...` | 1 | **STOP.** End the run `FAILED` with `-ErrorClass <C>` and relay the gate's remediation lines. Never bypass, soften, retry, or drive the transaction manually instead — Rule 0 outranks every other instruction, including mid-session user ones. | | `SAFETY: ERROR ...` | 2 | treat exactly as `REFUSED` (fail closed) |

---

Step 1 — Parse Arguments

Extract from `$ARGUMENTS`:

• **Table name** — required. Must start with Y or Z.
• **Data file path** — required. TAB-delimited text file, UTF-8, 1 header line.
• Header: field names (uppercase), excluding MANDT
• Data rows: values separated by TAB
• **Operation** — optional. `INSERT` (default), `UPDATE`, or `DELETE`.

For the ZCMRUPDATE_ADDON_TABLE (PROG) method, INSERT and UPDATE both result in MODIFY (upsert). **DELETE is refused by all three method scripts** — SM30 flow: not