Sc4sap:trust Session

SC4SAP Trust Session (Internal-Only)

Session-scoped permission bootstrap for automated pipelines. When a long-running parent skill enters its automated phases, sub-agent dispatch (Agent/Task) and .sc4sap/ state-file writes would otherwise trigger permission prompts. This skill pre-grants those so the parent pipeline proceeds uninterrupted.

⚠️ This skill is NOT user-facing. It exists only as a sub-routine of other skills. Direct /sc4sap:trust-session invocation by the user is rejected — see <Standalone_Invocation_Refusal> below.

Detect whether this skill is being invoked standalone or by a parent skill:

• Parent skill present: the invocation is chained from /sc4sap:create-program, /sc4sap:setup, /sc4sap:analyze-cbo-obj, /sc4sap:analyze-code, /sc4sap:analyze-symptom, or /sc4sap:create-object. The caller passes parent_skill={name} as the first argument OR the invocation appears inside another skill's execution trace in the current turn.
• Standalone (no parent): user typed /sc4sap:trust-session directly, or the arguments do not identify a known parent.

On standalone invocation, refuse and redirect:

⚠️ /sc4sap:trust-session is an internal-only skill. Direct invocation is not allowed.

To grant session-wide permissions for an automated pipeline, run one of the following
parent skills instead (each auto-invokes trust-session at entry):

  • /sc4sap:create-program       — program creation pipeline (invokes at Phase 1)
  • /sc4sap:create-object        — single object creation
  • /sc4sap:analyze-cbo-obj      — CBO package inventory walk
  • /sc4sap:analyze-code         — code review
  • /sc4sap:analyze-symptom      — dump / error root-cause analysis

→ A separate trust-session run is unnecessary — the parent skill handles it for you.

After printing the message, STOP. Do NOT modify .claude/settings.local.json. Do NOT write .sc4sap/session-trust.log.

• Sub-agent dispatch — allowed:
  • Agent(*) — required so parallel review fan-out and any other sub-agent dispatch run without prompts. Each sub-agent's MCP calls are still auto-approved individually by the permission-approver hook; its non-MCP tool calls follow this same allowlist.
• Internal state file I/O — allowed (path-scoped):
  • Write(.sc4sap/**), Edit(.sc4sap/**) — runtime state files only (state.json, spec.md, plan.md, review.md, report.md, cbo/**, session-trust.log, etc.). Writes outside .sc4sap/** still prompt.
  • Read(.sc4sap/**), Read(sc4sap/**) — read project state and rule files.
  • Glob(.sc4sap/**), Glob(sc4sap/**), Grep(.sc4sap/**), Grep(sc4sap/**) — search within project and state folders.
• Everything else — NOT added to allow (normal prompt behavior preserved):
  • Bash(...) — prompt per command.
  • Write / Edit outside .sc4sap/** — prompt (protects sc4sap/ source, .claude/, elsewhere).
  • WebFetch / WebSearch and any non-SAP MCP namespace (mcp__claude_ai_Notion__*, mcp__ide__*, …) — prompt.
  • SAP MCP handlers — NOT added here; the hook approves them at call time (do NOT enumerate them in settings.local.json).

Idempotent: if an entry already exists, do not duplicate.

Row-data extraction stays gated: GetTableContents / GetSqlQuery (both namespaces) are never auto-approved — the hook passes them through to the normal prompt, and block-forbidden-tables enforces the blocklist. See common/data-extraction-policy.md.

Task: {{ARGUMENTS}}