SC4SAP Option
Single entrypoint to inspect live SAP state and edit the values stored in .sc4sap/sap.env — the dotenv file that holds SAP connection credentials, TLS settings, and the abap-mcp-adt-powerup blocklist policy for row-extraction safety.
Users should not edit sap.env blindly; this skill surfaces the current values (masking secrets), explains each option, lets the user pick what to change, and writes the file back safely with a backup.
Contents (only show rows you could resolve):
- Active profile:
<alias> [<tier>] with 🔒 if tier≠DEV — from <project>/.sc4sap/active-profile.txt + ~/.sc4sap/profiles/<alias>/sap.env → SAP_TIER. Show (legacy) when no active-profile.txt is set and a legacy sap.env is in use.
- System:
<SID> · client <MANDT> · user <BNAME> · lang <SPRAS> (from GetSession)
- Connection:
<SAP_URL> · auth <SAP_AUTH_TYPE> · type <SAP_SYSTEM_TYPE> · version <SAP_VERSION> · ABAP <ABAP_RELEASE>
- RFC backend:
<SAP_RFC_BACKEND or "odata (default)"> — if odata (or unset), append · <SAP_RFC_ODATA_SERVICE_URL> (with CSRF TTL = <SAP_RFC_ODATA_CSRF_TTL_SEC or "600">s); if native, append · ashost <SAP_RFC_ASHOST>:<SAP_RFC_SYSNR> or · mshost <SAP_RFC_MSHOST>/<SAP_RFC_SYSID>; if gateway, append · <SAP_RFC_GATEWAY_URL> (token masked)
- Industry:
<SAP_INDUSTRY or "(not set)"> — drives which industry/*.md consultant agents load
- Inactive objects:
<count> (0 = green, >0 = red) (from GetInactiveObjects)
- Active transport (pinned):
<TRKORR> — <description> if present in config.json → activeTransport, else "-"
- Blocklist (L4, MCP env): profile
<MCP_BLOCKLIST_PROFILE or "standard (default)"> · extend <n> entries · allow <n> entries
- Blocklist (L3, PreToolUse hook): profile
<config.json blocklistProfile> · extend/custom file presence
- sap.env path: absolute path being edited
If the user's intent is status-only (they just said "hud" / "show status"), render the panel and stop. Do not ask follow-up "what to change" questions unless the user continues.
Blocklist policy (optional — guard for GetTableContents / GetSqlQuery):
MCP_BLOCKLIST_PROFILE — minimal | standard | strict | off (default: standard)MCP_BLOCKLIST_EXTEND — comma-separated extra table names / patterns (always denied)MCP_ALLOW_TABLE — comma-separated whitelist for audited bypass
RFC backend (optional — selects transport for Screen / GUI Status / Text Element ops):
SAP_RFC_BACKEND — odata (default) | soap | native | gateway | zrfc
Per-backend env blocks (Native / Gateway / OData credentials and knobs) live in rfc-managed-keys.md. Read that file when the user asks to change the RFC backend or edit any SAP_RFC_* field.
XSUAA (only when SAP_AUTH_TYPE=xsuaa):
XSUAA_URL, XSUAA_CLIENT_ID, XSUAA_CLIENT_SECRET, XSUAA_TOKEN_URL
Do not manage keys that are not in this list — warn the user and skip.
1---2name: sc4sap-sap-option3description: View SAP system status snapshot and edit values in `.sc4sap/sap.env` (connection, blocklist) and HUD usage limits in `~/.claude/settings.json` → `env` — single entrypoint for all sc4sap runtime options4---56# SC4SAP Option78Single entrypoint to **inspect live SAP state** and **edit the values stored in `.sc4sap/sap.env`** — the dotenv file that holds SAP connection credentials, TLS settings, and the `abap-mcp-adt-powerup` blocklist policy for row-extraction safety.91011<Purpose>12`sap.env` is the single source of truth for per-user runtime configuration of the sc4sap MCP server. This skill also replaces the former `/sc4sap:hud` snapshot: before editing, it shows a compact status panel (system ID, client, user, inactive object count, active transport, blocklist profile) so the user can confirm which system they are about to change settings for.1314Users should not edit `sap.env` blindly; this skill surfaces the current values (masking secrets), explains each option, lets the user pick what to change, and writes the file back safely with a backup.15</Purpose>1617<Response_Prefix>18Every response triggered by this skill MUST begin with `[Model: <main-model> · Dispatched: <sub-summary>]` per [`../../common/model-routing-rule.md`](../../common/model-routing-rule.md) § Response Prefix Convention.19</Response_Prefix>2021<Use_When>22- User says "sap option", "show sap.env", "change SAP password", "switch SAP client", "change the blocklist profile", "loosen blocklist", "whitelist ACDOCA", "view SAP config", "SAP options".23- User says "change the industry", "change industry", "switch industry", "switch to retail", "switch to cosmetics" — route to the **Industry selection** flow described in `<Industry_Selection>` (updates `SAP_INDUSTRY` in `sap.env` and `industry` in `config.json` atomically).24- User says "hud", "show status", "show system info", "current SAP status", "which system am I connected to" — run the status snapshot (workflow step 3) and stop there unless the user then asks to edit.25- User says "switch profile", "switch to KR-QA", "change system", "use the PRD system", "list profiles", "add a new profile", "register another system", "remove profile", "edit KR-DEV", "rotate credentials for KR-PRD" — route to the **Profile management** flow described in `<Profile_Management>` (see [`profile-management.md`](profile-management.md)).26- User wants to change blocklist tier (`MCP_BLOCKLIST_PROFILE`) or manage `MCP_ALLOW_TABLE` / `MCP_BLOCKLIST_EXTEND`.27- User is rotating credentials, moving to a new SAP system, or flipping language/client.28- After `/sc4sap:setup` if the user wants to adjust without re-running full setup.29- User says "hud limit", "5h limit", "weekly limit", "extra limit", "usage budget", "configure limit" — route to the **HUD limits** flow (see `<HUD_Limits>`), which edits `~/.claude/settings.json` → `env`, not `sap.env`.30</Use_When>3132<Status_Snapshot>33When invoked with `status` / `show` / `hud` (or as the preamble to any edit flow), render this panel. Keep it compact — roughly 10–14 lines — and silence sections that can't be fetched (e.g. MCP disconnected) rather than failing.3435Contents (only show rows you could resolve):36- **Active profile**: `<alias> [<tier>]` with `🔒` if tier≠DEV — from `<project>/.sc4sap/active-profile.txt` + `~/.sc4sap/profiles/<alias>/sap.env` → `SAP_TIER`. Show `(legacy)` when no active-profile.txt is set and a legacy `sap.env` is in use.37- **System**: `<SID>` · client `<MANDT>` · user `<BNAME>` · lang `<SPRAS>` *(from `GetSession`)*38- **Connection**: `<SAP_URL>` · auth `<SAP_AUTH_TYPE>` · type `<SAP_SYSTEM_TYPE>` · version `<SAP_VERSION>` · ABAP `<ABAP_RELEASE>`39- **RFC backend**: `<SAP_RFC_BACKEND or "odata (default)">` — if `odata` (or unset), append `· <SAP_RFC_ODATA_SERVICE_URL>` (with CSRF TTL = `<SAP_RFC_ODATA_CSRF_TTL_SEC or "600">`s); if `native`, append `· ashost <SAP_RFC_ASHOST>:<SAP_RFC_SYSNR>` or `· mshost <SAP_RFC_MSHOST>/<SAP_RFC_SYSID>`; if `gateway`, append `· <SAP_RFC_GATEWAY_URL>` (token masked)40- **Industry**: `<SAP_INDUSTRY or "(not set)">` — drives which `industry/*.md` consultant agents load41- **Inactive objects**: `<count>` (0 = green, >0 = red) *(from `GetInactiveObjects`)*42- **Active transport (pinned)**: `<TRKORR> — <description>` if present in `config.json` → `activeTransport`, else "-"43- **Blocklist (L4, MCP env)**: profile `<MCP_BLOCKLIST_PROFILE or "standard (default)">` · extend `<n>` entries · allow `<n>` entries44- **Blocklist (L3, PreToolUse hook)**: profile `<config.json blocklistProfile>` · extend/custom file presence45- **sap.env path**: absolute path being edited4647If the user's intent is **status-only** (they just said "hud" / "show status"), render the panel and stop. Do not ask follow-up "what to change" questions unless the user continues.48</Status_Snapshot>4950<File_Path>51- **Active profile (multi-profile, default)**: read the alias from `<project>/.sc4sap/active-profile.txt`, then edit `~/.sc4sap/profiles/<alias>/sap.env`. Plugin-side mirrors (`industry`, `activeModules`, `blocklistProfile`, …) live in `~/.sc4sap/profiles/<alias>/config.json`. Every `sap.env` / `config.json` mention in this skill means these two files.52- **Legacy (no `active-profile.txt`)**: `<project>/.sc4sap/sap.env` + `<project>/.sc4sap/config.json`. Offer the migration flow in [`migration.md`](migration.md).53- If neither exists, tell the user to run `/sc4sap:setup` first. Do NOT create it from scratch here — setup handles the initial interactive credential flow.54</File_Path>5556<Managed_Keys>57Connection (required):58- `SAP_URL` — SAP host URL including port (e.g. `https://host:44300`)59- `SAP_CLIENT` — 3-digit client (e.g. `100`)60- `SAP_AUTH_TYPE` — `basic` | `xsuaa`61- `SAP_USERNAME` — SAP user ID62- `SAP_PASSWORD` — **secret — always mask when displaying**63- `SAP_LANGUAGE` — `EN`, `DE`, `KO`, ...64- `SAP_SYSTEM_TYPE` — `s4hana` | `cloud` | `ecc`65- `SAP_VERSION` — `S4` | `ECC`66- `ABAP_RELEASE` — e.g. `756`, `758`67- `SAP_INDUSTRY` — one of the 15 keys in `industry/README.md` (`retail` | `fashion` | `cosmetics` | `tire` | `automotive` | `pharmaceutical` | `food-beverage` | `chemical` | `electronics` | `construction` | `steel` | `utilities` | `banking` | `public-sector` | `other`). **Mirrored** to `.sc4sap/config.json` → `industry` whenever changed — both writes must succeed or neither.68- `TLS_REJECT_UNAUTHORIZED` — `0` (accept self-signed, dev only) or unset6970Blocklist policy (optional — guard for `GetTableContents` / `GetSqlQuery`):71- `MCP_BLOCKLIST_PROFILE` — `minimal` | `standard` | `strict` | `off` (default: `standard`)72- `MCP_BLOCKLIST_EXTEND` — comma-separated extra table names / patterns (always denied)73- `MCP_ALLOW_TABLE` — comma-separated whitelist for audited bypass7475RFC backend (optional — selects transport for Screen / GUI Status / Text Element ops):76- `SAP_RFC_BACKEND` — `odata` (default) | `soap` | `native` | `gateway` | `zrfc`7778Per-backend env blocks (Native / Gateway / OData credentials and knobs) live in [`rfc-managed-keys.md`](rfc-managed-keys.md). Read that file when the user asks to change the RFC backend or edit any `SAP_RFC_*` field.7980XSUAA (only when `SAP_AUTH_TYPE=xsuaa`):81- `XSUAA_URL`, `XSUAA_CLIENT_ID`, `XSUAA_CLIENT_SECRET`, `XSUAA_TOKEN_URL`8283Do not manage keys that are not in this list — warn the user and skip.84</Managed_Keys>8586<Workflow>87See [workflow.md](workflow.md).88</Workflow>8990<Profile_Management>91See [profile-management.md](profile-management.md). Handles multi-environment (Dev/QA/Prod) connection switching, tier-based readonly enforcement, OS-keychain-backed password storage, profile add/edit/remove/purge, and migration from legacy single-profile `.sc4sap/sap.env`.92</Profile_Management>9394<Industry_Selection>95See [industry-selection.md](industry-selection.md).96</Industry_Selection>9798<HUD_Limits>99See [hud-limits.md](hud-limits.md).100</HUD_Limits>101102<Validation>103- `SAP_URL`: must match `^https?://[^ ]+` and not end with `/`.104- `SAP_CLIENT`: exactly 3 digits.105- `SAP_AUTH_TYPE`: one of `basic` | `xsuaa`.106- `SAP_LANGUAGE`: 2-letter uppercase.107- `SAP_SYSTEM_TYPE`: one of `s4hana` | `cloud` | `ecc`.108- `SAP_VERSION`: one of `S4` | `ECC`.109- `ABAP_RELEASE`: 3-digit numeric (e.g. `750`, `756`).110- `SAP_INDUSTRY`: must be one of the 15 canonical keys listed in `<Managed_Keys>`. Reject unknown values; offer the selection menu from `<Industry_Selection>`. Lowercase, hyphen-separated (e.g., `food-beverage`, not `Food_Beverage`).111- `TLS_REJECT_UNAUTHORIZED`: `0` or unset. Warn that `0` is dev-only.112- `MCP_BLOCKLIST_PROFILE`: one of `minimal` | `standard` | `strict` | `off`. If user chooses `off`, require explicit confirmation ("This disables ALL row-extraction guards. Type `I UNDERSTAND` to proceed.").113- `MCP_BLOCKLIST_EXTEND` / `MCP_ALLOW_TABLE`: comma-separated uppercase table names (`[A-Z0-9_*]+` allowed; `*` is glob). Strip whitespace around commas.114- When adding to `MCP_ALLOW_TABLE`, explicitly warn that each entry is audited to stderr and is a soft bypass of the blocklist — user should remove entries when no longer needed.115- `SAP_PASSWORD`: no validation on content (may contain anything), but refuse empty.116- All `SAP_RFC_*` validation rules live in [`rfc-managed-keys.md`](rfc-managed-keys.md) → "Validation rules".117</Validation>118119<Security>120- Never print secrets (`SAP_PASSWORD`, `XSUAA_CLIENT_SECRET`) in chat output, diffs, logs, or confirmation prompts. Always mask.121- Never copy `sap.env` to any location outside `.sc4sap/` — no uploads to Notion, no pastes into issues.122- After writing, do not display the final file contents. Only summarize which keys changed.123- The backup `sap.env.bak` contains secrets — mention its existence but do not open/read it back to the user.124</Security>125126<Edge_Cases>127- **File missing** → stop, direct to `/sc4sap:setup`. Do not create.128- **File has syntax errors** (lines that are not `KEY=VALUE` or comments) → show the offending lines, ask user to clean manually, abort.129- **User wants to add a key not in `<Managed_Keys>`** → warn, ask to confirm adding as a custom key (append at end with a `# custom` comment). Do not validate content.130- **User wants to remove a required connection key** (e.g. `SAP_URL`) → refuse; required keys can only be changed, not removed.131- **Always tell the user the absolute path that was edited** (profile env vs legacy project env) so there is no ambiguity about which system changed.132</Edge_Cases>133134<Standalone_TUI>135See [standalone-tui.md](standalone-tui.md).136</Standalone_TUI>137138<Examples>139See [examples.md](examples.md).140</Examples>
babamba2