0.6.5 - Open-source posture tooling & hardened web recorder

🇫🇷 Release « posture open source outillée ». Le source est désormais public (CyrilM29/robotframework-sapfx) et les bibliothèques s'installent depuis PyPI (pip install robotframework-sapfx) ; l'export public est outillé et fail-closed (scan anti-fuite bloquant), la publication PyPI passe par Trusted Publishing (aucun token stocké). Côté produit : le recorder web masque les champs sensibles (paiement, OTP) dès la capture, son export redémarre sur l'URL de départ de l'enregistrement, et les deux recorders portent l'identité aicabra. Dézippez, install.cmd, c'est prêt.

What's new

Open-source posture, tooled

• The full source tree is public on CyrilM29/robotframework-sapfx, and the libraries install from PyPI: pip install robotframework-sapfx (libraries only; this ZIP remains the one full install with recorders, agents and MCP wiring).
• scripts/export_public_tree.py is the export-per-release tool behind the posture: git archive + fail-closed transforms (every pattern must match an exact count) + a blocking byte-level leak scan, binaries included. The PyPI publication runs through a Trusted Publishing workflow (OIDC, pypi environment, no stored token), guarded tag == version.
• The project presentation video (3 min 20) ships in the public repo and is linked from the READMEs (GitHub and PyPI).

Web recorder: sensitive fields masked at capture time (extension 0.9.0 → 0.9.2)

• sensitiveMask extends the password-only masking to payment and OTP fields (autocomplete tokens cc-number/cc-csc/cc-exp*/one-time-code/current-password/new-password, plus deliberately narrow name/id/aria-label patterns) → <SECRET> placeholder. Real values never reach the recorded flow, sessionStorage or the exports; every masked field keeps its fallback xpath line. Locked by an offline E2E test.
• Honest clipboard fallback: copy() falls back to a temporary-textarea execCommand('copy') when navigator.clipboard is missing (non-secure http origins, the typical intranet WebGUI host) or rejects, and the button reports the fallback's REAL result. Storage and download failures now surface instead of silently losing data.
• Exports bootstrap on the recording START url (caught by a live probe: record login → dashboard, then export; the old export replayed from the wrong page). Remembered at the first rec, consumed by suites and documents, cleared by clear, round-trip safe. Live-validated end-to-end.

Recorder identity and movable windows

• The web recorder panel carries the aicabra medallion (28 px data-URI baked into the bundle: no network request, silent hide under a strict img-src CSP) and advertises its drag affordance; the desktop recorder GUI gains an aicabra banner that doubles as a second drag handle, useful when the native title bar sits off-screen above a full-screen SAP GUI.

Proof numbers: 1009 unit tests · 93 % coverage · 17/17 live scenarios. UI5 1.60 → 2.0-nightly compatibility unchanged; rf-mcp pin stays at 0.35.0.

Attachment: sapfx-pack-0.6.5-win.zip : self-contained Windows deployment pack (both wheels, business resources, recorders + MV3 extension, sample suites, maintenance scripts, test agents + sapfx skill). Install: unzip, then install.cmd (options -WithMcp, -WithBrowsers). This ZIP was tested from a fresh extraction before publication: sidecar + 68 internal SHA-256 OK, install.cmd -WithMcp clean through cmd.exe (imports OK, Robot Framework 7.4.2, rf-mcp plugins OK), 27/27 sample-suite dry-run, sapfx-mcp overlay announcing itself. SHA-256: 68cf9040f08ef73131ce02fb24a5c6ca01b7f81528dd9b6317072b087c88b538.

Ops note: after updating the libraries, restart the rf-mcp server : the process freezes the imported library class and instance (field note in the repo).

0.6.4 — SAPFX by name: renamed distribution, recorder HTML reports

🇫🇷 Release « SAPFX de nom ». Le nom de code interne devient le nom du projet partout : la distribution s'appelle désormais robotframework-sapfx (bibliothèques et keywords inchangés — rien à modifier dans vos suites). Les deux recorders gagnent un rapport HTML de documentation auto-contenu, 4e format d'export ; le moteur natif du recorder desktop nomme désormais les touches virtuelles dynamiquement. Dézippez, install.cmd, c'est prêt.

What's new

Project renamed to SAPFX

• Distribution robotframework-sapecclibrary → robotframework-sapfx (wheel filename follows; installer glob, pack READMEs and NOTICE updated). Library and module names are unchanged — SapEccLibrary, SapFioriLibrary, SapApiLibrary, sapfx_common — so existing suites and imports keep working as-is.
• New medallion logo (ROBOTFRAMEWORK-SAPFX · ECC UI5 API LIBRARY RECORDER): 512 master + 1024 detoured source, extension icons 16/48/128 and recorder GUI icon regenerated.

HTML documentation report — 4th recorder export, both channels (concept from RoboSAPiens' saveHtmlReport, re-implemented, NOTICE extended)

• Desktop: --export-report (CLI + GUI checkbox) writes a self-contained page — French business phrase per step with the exact RF line alongside (the report never invents), per-step screenshots inlined as data-URIs when --screenshots ran, password= arguments always masked. Mixed cross-channel transcripts render too (Fiori/UI5 and API keywords phrased).
• Web recorder: rapport HTML (.html) entry in the export menu — same self-contained page, one chapter per scenario. MV3 extension 0.7.0 → 0.8.0.
• The raw recording is still never modified — every export derives from it.

Dynamic vkey names in the desktop recorder

• The native record engine resolves virtual-key names beyond the static table through GuiSession.GetVKeyDescription (wired while recording, restored on teardown, COM-failure-safe): Send Vkey 17 now gains its # Shift+F5 comment. The static table keeps priority so outputs stay stable off-SAP.

Proof numbers: 974 unit tests · 93 % coverage · 17/17 live scenarios. UI5 1.60 → 2.0-nightly compatibility unchanged; rf-mcp pin stays at 0.35.0.

Attachment: sapfx-pack-0.6.4-win.zip — self-contained Windows deployment pack (both wheels, business resources, recorders + MV3 extension, sample suites, maintenance scripts, test agents + sapfx skill). Install: unzip, then install.cmd (options -WithMcp, -WithBrowsers). This ZIP was tested from a fresh extraction before publication: sidecar + 68 internal SHA-256 OK, install.cmd -WithMcp clean through cmd.exe (imports OK — Robot Framework 7.4.2, rf-mcp plugins OK), 27/27 sample-suite dry-run, sapfx-mcp overlay announcing itself. SHA-256: abfbd385ec2d05732c4e609c9e679dd56ef1247cea107fbfd1f63e2fe3e592a1.

Ops note: after updating the libraries, restart the rf-mcp server — the process freezes the imported library class and instance (field note in the repo).

0.6.3 — Agentic perception: numbered maps, sapfx skill, mechanical agent loops

🇫🇷 Release « perception agentique ». L'agent voit l'écran comme une carte numérotée (@N) et agit par référence — sur SAP GUI ET sur Fiori ; la boîte à outils s'apprend en un appel (skill sapfx) ; les boucles de feedback des agents plan → generate → heal sont désormais fermées mécaniquement (gardes, pas de la prose) ; compatibilité rf-mcp 0.35.0 revalidée et épinglée. Dézippez, install.cmd, c'est prêt.

What's new

Numbered screen/page maps — act by reference (Vibium map/@e1 pattern, applied to SAP)

• ECC: Get Screen Map numbers every actionable target of the live screen (@N + verified human label + id + type + current value — same affordance engine as the semantic perception), and Resolve/Click/Fill Screen Ref act by number. References are ephemeral (last numbered perception) and re-verified before every action: screen changed or element gone = actionable failure naming Get Screen Map. The Set-of-Mark annotated screenshot legend feeds the same @N table — the vision → deterministic-action loop is closed.
• Fiori mirror: Get Ui5 Page Map reduces the UI5 control tree to its numbered actionable targets (editable types marked * with value; human label from text/title/placeholder/tooltip), and Resolve/Click/Fill Ui5 Ref act by number — liveness re-checked against the rendered registry, frame scope respected, composite-control fill targets the inner <input>.
• Interactive piloting only (rf-mcp guidance says so too): suites keep speaking business keywords over resources/ locators — convention #1 unchanged.

sapfx toolkit skill (install-as-a-skill)

• .claude/skills/sapfx/SKILL.md: one skill call teaches an assistant the three channels (GUI/Fiori/API), the perception → action loop, the non-negotiable conventions and the agent cycle. Shipped in the Windows pack.

Agent feedback loops closed mechanically

• Stale-plan marker: a healer-flagged spec (> **Statut : PÉRIMÉE (date)**) now fails check_spec_sync.py until the planner re-explores; generation divergences are recorded in the spec before re-stamping; docs/heal-journal.md keeps the healer's diagnosis per session.
• New guard check_conventions.py: conventions #1/#2 (no raw locators in generated suites, no Sleep) are now enforced on artifacts — generator gate, post-edit hook, CI.

rf-mcp 0.35.0 — compat guard window widened to [0.31, 0.36) after wheel-level re-validation (plugin contracts byte-identical; lazy-proxy-safe probe); deployment pin bumped to rf-mcp==0.35.0.

Fixed

• Pack .cmd launchers shipped with LF-only line endings: double-clicking install.cmd echoed «'M' n'est pas reconnu…» parser errors (install still completed). Fixed in depth — .gitattributes exception, launchers converted, and the pack builder now normalizes every staged .cmd to CRLF (unit-locked). This 0.6.3 ZIP was tested from a fresh extraction before publication: sidecar + 68 internal SHA-256 OK, install.cmd -WithMcp clean through cmd.exe, 27/27 sample-suite dry-run, sapfx-mcp overlay announcing itself on rf-mcp 0.35.0.
• check_spec_sync.py was blind to ventilated suites (tests/robot/{api, ui/ecc, ui/fiori, cross}) — now recursive.

Proof numbers: 963 unit tests · 93 % coverage · 17/17 live scenarios. UI5 1.60 → 2.0-nightly compatibility unchanged; MV3 extension 0.6.0 unchanged.

Attachment: sapfx-pack-0.6.3-win.zip — self-contained Windows deployment pack (both wheels, business resources, recorders + MV3 extension, sample suites, maintenance scripts, test agents + sapfx skill). Install: unzip, then install.cmd (options -WithMcp, -WithBrowsers). SHA-256: 582adb372d898d8ca0385c5bfb1d213adab7ec54f57600ce99684e1fb5dbd1a5.

Ops note: after updating the libraries, restart the rf-mcp server — the process freezes the imported library class and instance (field note in the repo).

0.6.2 — Agentic MCP overlay, API channel in MCP, industrial test layout

Warning

Known issue (fixed in 0.6.3): double-clicking install.cmd in this pack echoes two cosmetic parser errors (« 'M' n'est pas reconnu… » — LF-only line endings). The installation itself completes correctly; to avoid the noise, run powershell -ExecutionPolicy Bypass -File install.ps1 instead, or take 0.6.3.

🇫🇷 Le pack Windows 0.6.2 : surcouche MCP sapfx-mcp (état SAP par providers, canal vision, hot-reload), le canal API rejoint la couche MCP, et la ventilation industrielle des tests encodée dans les agents — validé live sur les trois canaux (SAP GUI 16/16, UI5 12/12, API 9/9).

What's new

• sapfx-mcp overlay launcher — mounts the rf-mcp server unchanged and adds sapfx_state (diff-by-default screen perception, enriched live application state with modal detection), sapfx_screenshot (real MCP image content, plain or Set-of-Mark annotated with its number -> id legend) and sapfx_reload (plugin-layer hot-reload), behind a startup compatibility guard. Live-validated through a real MCP stdio client on SAP GUI (16/16) and UI5 (12/12).
• The API channel joins the MCP layer — new SapApiPlugin (guidance, keyword map, honest no-screen state provider) plus the List Api Sessions keyword (open aliases, base_url, auth flags — never credentials). Live-validated 9/9 against a live SAP Gateway.
• Agentic-layer upgrade — refreshed selector guidance and intent maps (multi-session, Set-of-Mark screenshots, visual baselines, dynamic timeouts…), smart perception diffs, session hygiene encoded in the planner/generator/healer agents, a /sap-maintain maintenance orchestrator and a blind healer evaluation harness.
• Industrial project layout for generated tests: suites ventilated by channel, page objects, environment data under variables/ — the healer repairs the automation layer, never test bodies.

Proof numbers: 921 unit tests · 93 % coverage · 17/17 live scenarios

Attachment: sapfx-pack-0.6.2-win.zip (SHA-256 cf8c6fbfea2f8ff643afbcc5ee2508c39598b765e3d85e7f688133b52ef320a8) — unzip on the target PC, then install.cmd (-WithMcp renders the MCP configs pointing at the sapfx-mcp launcher, -WithBrowsers adds Playwright Chromium).

The source repository is private — access on request: cyril@montiel.me.

0.6.1 — Dynamic wait settings & review-hardened recorders

🇫🇷 Réglages d'attente ajustables en cours de suite sur les deux canaux, échecs génériques qui nomment leur voie de diagnostic, et la passe de revue post-0.6.0 des recorders — le tout validé en direct contre A4H.

What's new

Dynamic wait settings on both channels. Set Default Timeout / Set Poll Interval (SapEccLibrary) and their Fiori mirrors Set Ui5 Timeout / Set Poll Interval (SapFioriLibrary): widen the timeout around one slow transaction or a heavy Fiori app without imposing it on the whole suite. Each keyword returns the previous value as a Robot time string, ready to restore in a teardown; scope stays the library instance (SUITE), so nothing leaks into the next suite. Live-validated on both channels — the shortened timeout is the actual wait fallback (measured ~5s instead of 30s on ECC, ~2s instead of 15s on the Fiori tree probe).

Failures that name their next step. The two most generic Fiori dead-ends now point to the diagnostics layer: an exhausted fallback chain (Resolve Ui5 With Fallback) names Log Fiori Diagnostics, and a missing UI5 tree (Get Ui5 Page Tree) names Get Page Composition — aligning them with the self-correcting-errors policy the targeted failures already followed. Also removed: a dead error-type constant left over from the pre-fork Run Transaction.

Review fix pass on the recorders (post-0.6.0). Run Transaction namespace-tcode comparison hardened (both Info.Transaction forms, /IWFND/… no longer mistaken for a nav prefix — verified live on SAP GUI 8.00); --transpile-vbs now detects real-world VBS encodings (ANSI/UTF-16 BOM or BOM-less) instead of silently corrupting them; spec exports render interpolated data as Markdown code spans (no more *LH* turning italic); the polling record engine records uncheck and field-clear actions; and the --replay CLI no longer masks the real step error behind a screenshot-context failure.

Everything re-validated live (2026-07-22, 26/26): ECC smoke + a dedicated dynamic-settings suite vs ABAP Platform A4H, Fiori smoke vs the OpenUI5 Demo Kit, hybrid smoke, and the enriched failure messages observed on a real non-UI5 page.

Proof numbers: 845 unit tests · 93 % coverage · 17/17 live scenarios.

Attachment — sapfx-pack-0.6.1-win.zip (SHA-256 e27c8f7dadd66bf7bb2e65ac5e74b6b84daf213cda8a2819754686dba61bb7a1): self-contained Windows pack — both wheels, business resources, both recorders (incl. the MV3 extension), sample suites, maintenance scripts, test agents. Unzip, then install.cmd (options: -WithMcp, -WithBrowsers).

0.6.0 — Recorders: from raw takes to maintainable suites

🇫🇷 Les recorders passent du brouillon au test maintenable : exports resource-first/spec, replay partout, transpileur VBS ALT+F12 — validés en direct contre A4H et une vraie app Fiori Elements.

What's new

Recorders — from raw takes to maintainable suites. The recorded transcript is now a draft: both recorders export a complete replayable .robot suite, a resource-first pair (business keywords + ${LOC_…} variables — no raw id left in the test, the layer the healing agent repairs) and a specs/-format Markdown plan feeding the plan → generate → heal agent cycle.

Replay everywhere. Desktop --replay re-runs a recording against the already-open SAP GUI session via the new Attach To Open Session keyword; the web recorder replays in-page with the same resolution engines, first failure marked. --transpile-vbs converts SAP GUI's built-in ALT+F12 VBS recordings through the same state machine — no SAP session needed.

Self-healing from day one. Recorded UI5 steps carry their shortest-xpath fallback; the resource-first export turns it into Resolve Ui5 With Fallback. Desktop --semantic lines export as Resolve Element With Healing … label=… keywords.

Live assertions & richer capture. Desktop hotkeys (Ctrl+Alt+A value / Ctrl+Alt+V visual baseline) insert checks while recording; grid context menus, tree nodes and tracked cells map natively. The web recorder captures the non-SAP zones of hybrid pages (dom engine), a right-click assertion menu, deferred Enter, smart waits and compaction. Extension 0.4.1 → 0.7.0 (recording survives reloads, explicit cross-frame state, RF value escaping).

Hardening pass. Whitespace-normalized name=/text= matching (dom + wc engines), Robot Framework escaping of recorded values on both channels, spec exports keep ids out of the steps, demo videos for both channels.

Everything re-validated live: ECC vs ABAP Platform A4H (record → exports → dryrun → replay, 3/3) and the web recorder against a real Fiori Elements List Report (measured effect Travels (4,133) → (91), resume-after-reload, exported pair green under real robot, 1/1).

Proof numbers: 823 unit tests · 93 % coverage · 17/17 live scenarios.

Attachment — sapfx-pack-0.6.0-win.zip (SHA-256 47d10e604079a68bd7c5647ab346d361bec877fbca989ec150a459ea1086193a): self-contained Windows pack — both wheels, business resources, both recorders (incl. the MV3 extension), sample suites, maintenance scripts, test agents. Unzip, then install.cmd (options: -WithMcp, -WithBrowsers).

Source repository is private — access on request: cyril@montiel.me.

0.5.8 — Accessibility locators, Fiori diagnostics & support alignment

🇫🇷 Release « accessibilité & diagnostic ». Les moteurs dom et wc gagnent les localisateurs d'accessibilité (role= ARIA calculé, name= nom accessible — le localisateur « intention utilisateur », façon getByRole(name=…)) ; la nouvelle couche Get Fiori Diagnostics explique en un appel un écran Fiori qui ne répond pas ; et les supports (agents de test, hints MCP, GUI du recorder desktop) sont réalignés sur le produit. Dézippez, install.cmd, c'est prêt.

What's new

Accessibility locators (dom & wc engines)

• role= on the dom engine now matches the computed ARIA role: an explicit role attribute still wins, but plain HTML semantics resolve too — a bare <button>, a[href] → link, input[type=checkbox] → checkbox, h1–h6 → heading… (pragmatic HTML-AAM subset, case-insensitive). A React/Angular/vanilla widget no longer needs role attributes sprinkled in its markup to be addressable.
• New name= selector key = the accessible name (simplified accname in W3C precedence order: aria-labelledby, aria-label, the UI5 Web Components accessible-name attribute / accessibleName property, label[for]/wrapping label, alt, button value, visible text, title, placeholder), with the engines' usual matching rules (case-insensitive substring or /regex/). Available on BOTH the dom engine (user-intent locators, Playwright getByRole(name=…) style: role=button name=Fermer la notification) and the wc engine (an icon-only ui5-button or an unlabelled ui5-input is addressed by what a screen reader would announce). Flows through Resolve Ui5 With Fallback's wc=/dom= forms unchanged.
• Proven offline: fiori_wc_smoke.robot 7/7 (accessible-name attribute AND non-reflected accessibleName property) and fiori_hybrid_smoke.robot 6/6 (implicit role=button via aria-label, role=textbox named by its label[for]); web recorder regenerated (bundle embedded).

Fiori diagnostics layer

• Get Fiori Diagnostics — ONE JSON-safe dict aggregating the hybrid composition probe, the UI5 control tree (short probe, None when absent, never touching Get Ui5 Page Tree's mode=diff state), normalized console/page errors (Browser 20 bricks, incremental by default, truncation always announced) and the ARIA snapshot of the non-SAP regions. Every section is best-effort (failures land in collection_errors, never abort the diagnostic) and the issues synthesis is actionable: first JS/console error quoted, a missing UI5 tree names the recommended fallback engines and the iframes to scope into. Respects Set Ui5 Frame / Push Ui5 Frame.
• Log Fiori Diagnostics — same collection rendered as a Markdown report in the Robot log (issues first), teardown-friendly.

Support alignment (test agents · MCP hints · recorder GUI)

• The rf-mcp Fiori hints and the sap-healer agent now cite the FULL fallback chain (role → xpath → sid → wc → dom); the hints also cover the dom engine, Get Page Composition and the nested-frame stack (Push/Pop Ui5 Frame); the planner/generator/healer agents reference Get Page Composition / Get Fiori Diagnostics at their perception steps (VS Code chat modes regenerated).
• The desktop recorder launcher GUI now exposes the CLI's --engine auto|native|poll (capture/record) and --semantic (native record → human keywords by visible label) options, which had been CLI-only since 0.2.0/0.4.0.

Proof numbers: 750 unit tests (720 → 750) · 93 % coverage · 17/17 live scenarios. UI5 1.60 → 2.0-nightly compatibility unchanged; MV3 extension 0.4.1 unchanged.

Attachment: sapfx-pack-0.5.8-win.zip — self-contained Windows deployment pack (both wheels, business resources, recorders + MV3 extension, sample suites, maintenance scripts, test agents). Install: unzip, then install.cmd (options -WithMcp, -WithBrowsers). SHA-256: 5a4b713f4c6682b9350d5b8bdf61617359b80cecd92b5539a7c31b6e2fbcc896.

Ops note: after updating the libraries, restart the rf-mcp server — the process freezes the imported library class and instance (field note in the repo).

Source repository is private - access on request: cyril@montiel.me.

0.5.7 — Hybrid Fiori sessions + secure ECC multi-session

🇫🇷 Release « sessions hybrides ». Deux axes livrés ensemble : côté Fiori, les pages hybrides (sonde de composition, moteur DOM générique, pile de frames imbriquées) ; côté ECC, le multi-session par alias en sécurité (2e fenêtre sans re-login, bascule explicite, teardown isolé). Chaque keyword a été piloté en direct pas-à-pas via rf-mcp puis verrouillé par une suite reproductible rejouée par le vrai robot. Dézippez, install.cmd, c'est prêt.

What's new

Fiori hybrid sessions (one page, several technologies per region)

• Get Page Composition — hybrid perception probe: which technologies coexist where (classic UI5 runtime / ui5-* Web Components hosts / WebGUI lsdata elements / React-Angular-Vue hints), the recommended engines in fallback order, and every iframe with a reusable Browser selector plus its own probed composition (best-effort, never a failed perception).
• Generic dom engine — the 5th resolution engine (Resolve/Click/Fill Dom …, Get Dom Text, Get Dom Match Count, Dom Element Should Be Visible): the non-SAP regions of a hybrid page (React/Angular/vanilla widgets) enter the same grammar — CSS + text + ARIA role + attributes, light-DOM CSS paths, and a dom= last-resort form in Resolve Ui5 With Fallback (role→xpath→sid→wc→dom, healing telemetry included).
• Nested-frame stack — Push Ui5 Frame / Pop Ui5 Frame / Get Ui5 Frame Stack: nested-iframe scoping (Browser level1 >>> level2 chaining) for composite launchpads; a surplus Pop fails loudly. Set Ui5 Frame keeps its exact semantics — fully backward compatible.
• Proven offline by tests/robot/fiori_hybrid_smoke.robot 5/5 (four technologies, two genuinely nested frame levels), after the same cycle was driven live step-by-step through rf-mcp.

ECC multi-session registry (two live sessions, safely)

• Open Sap Session (second connection by string or SAP Logon entry; optional RSYST-* login with a never-logged Robot Secret password; alias rollback on failure) and Create Gui Session (second window on the ACTIVE connection — scripted /o, no re-login hence no multi-logon popup: the recommended path for "write in one session, verify in the other").
• Switch / List / Close / Close All Sap Sessions, Get Active Sap Session — explicit multiplexing (one active session at a time), JSON-safe inventory (rf-mcp compatible), isolated teardown: closing an alias never closes a connection another alias still uses.
• STA safety rail: the owning COM thread is remembered per alias; cross-thread access gets a defensive CoInitialize (the marshalled mode the rf-mcp state providers rely on) and SAPFX_STRICT_COM_THREAD=1 upgrades it to an actionable error instead of COM's cryptic RPC_E_WRONG_THREAD.
• Proven live by tests/robot/ecc_multisession_smoke.robot 4/4 vs the ABAP Platform Trial A4H (independent transactions per alias, surviving session still drivable), after the same cycle was driven step-by-step through rf-mcp.

Fixed

• Sid Should Be Visible (and the sid= fallback form) passed the element state as a string to Browser's internal Python API (KeyError: 'visible' — Robot's argument conversion does not apply through get_library_instance). Both now use the real ElementState enum + timedelta timeout. Caught live by the new hybrid smoke.

Proof numbers: 720 unit tests (677 → 720) · 93 % coverage · 17/17 live scenarios. UI5 1.60 → 2.0-nightly compatibility unchanged; MV3 extension 0.4.1 unchanged.

Attachment: sapfx-pack-0.5.7-win.zip — self-contained Windows deployment pack (both wheels, business resources, recorders + MV3 extension, sample suites, maintenance scripts, test agents). Install: unzip, then install.cmd (options -WithMcp, -WithBrowsers). SHA-256: 5937309695d6c72616d2ceb4a780bc38261fd7c32812450cf341887017631a0b.

Ops note: after updating the libraries, restart the rf-mcp server — the process freezes the imported library class and instance (field note in the repo).

0.5.6 — Productization hardening + cross-channel demonstration campaigns

🇫🇷 Release « productization hardening + campagnes cross-canal ». Le durcissement de mise en production (scope de session, sécurité des secrets, CI qualifiée) est coupé en 0.5.6, accompagné de trois campagnes de démonstration auto-suffisantes validées en direct — une par canal. Dézippez, install.cmd, c'est prêt.

What's new

Productization hardening

• All stateful libraries use Robot SUITE scope; API and Fiori state is partitioned by the rf-mcp synthetic-test namespace (ECC remains one live session per process).
• Python 3.10+ across both distributions and CI (3.10/3.12 matrix); mypy also covers the ECC and Fiori public façades.
• Robot Framework 7.4 Secret values are accepted at the IDP, OData Basic-auth and RFC boundaries; cross-origin API URLs and redirects are blocked before an Authorization header can escape, and disabled TLS verification is warned.
• CI runs an offline Browser/Web-Components smoke and qualifies the downloadable ZIP by installing it outside the checkout (MCP + Chromium), publishing a CycloneDX SBOM and build provenance.
• New comms/ version-sync guard: any version cited in the communication base must match pyproject.toml.

Cross-channel demonstration campaigns (self-contained — import the libraries directly, no resources/ reuse — and validated live)

• tests/robot/exploratory_campaign_a4h.robot (ECC, live A4H 4/4): delivery-class inventory (DD07L/CONTFLAG), a reversible SCARR CRUD write cycle (SE16 « Create Entries » → read-back → delete → back to 0), and a dynamic TADIR catalog sweep classifying every TABL object of the Flight and EPM packages as a real table (counted) or a type-E structure.
• tests/robot/exploratory_campaign_fiori.robot (Fiori, visible browser, 6/6): cookie-consent handling, control-tree inventory, a reversible SearchField interaction, a dynamic control-type role↔xpath convergence sweep, and the xpath locator grammar (hierarchy + @controlType predicate).
• tests/robot/cross_paradigm_api_visual.robot (API + GUI + visual, 3/3): the EPM product count agrees across OData $count (SEPMRA_SHOP/Products) and SE16 (SNWD_PD), and the SE16 screen is sealed by a perceptual-hash baseline (Screen Should Match Baseline).

Proof numbers unchanged: 677 unit tests · 93 % coverage · 17/17 live scenarios.

Attachment: sapfx-pack-0.5.6-win.zip — self-contained Windows deployment pack (both wheels, business resources, recorders + MV3 extension, 6 sample suites, maintenance scripts, test agents). Install: unzip, then install.cmd (options -WithMcp, -WithBrowsers).

0.5.5 - Security preflights, hardening guide, business vocabulary, FLP intents, IDP login

🇫🇷 Version « packaging & distribution » : le pack Windows rattrape la passe de hardening sécurité de juillet et les nouveaux keywords d'entreprise (vocabulaire métier, navigation FLP par intent, login IDP). Tout voyage dans le wheel — dézippez, install.cmd, c'est prêt.

What's new in the pack

Security / environment preflights — three read-only keyword pairs verify the posture of the test environment and name the exact setting to fix:

• Scripting Should Be Fully Enabled — server-side scripting posture (RZ11), incl. the per-user confinement path (user_scripting_per_user + S_SCR).
• Abap List Should Be Readable — detects classic ABAP lists rendered as an opaque shell and names the SAP GUI accessibility mode to provision.
• Client Security Should Be Hardened — SAP GUI client patched vs CVE-2025-0055 (input-history weak encryption, fixed from 8.00 PL9) and leftover SAPHistory*.db databases to purge.

See the new « Environment preflights » section in the pack README (EN/FR).

Enterprise keywords (new)

• Lookup Business Term (both libraries) — FR/EN business terms resolve to the ABAP field/table; ambiguity is always refused with the candidate list, never a silent first match.
• Open Fiori App — Fiori launchpad navigation by SemanticObject-action intent hash: stable across catalog reorganizations, themes and languages.
• Log In Via Identity Provider — SAP IAS / Azure AD / generic login forms, single-page and two-step flows detected dynamically, password never logged.

Robustness proven by new smokes (in the source repo's CI): UI5 1.136 legacy-free, strict-CSP injection (no CSP relaxation needed on the system under test), Work Zone iframe scenarios.

Numbers

• 669 automated unit tests, 94% measured coverage (85% CI floor)
• Libraries and distributions at 0.5.5 (Apache 2.0)

Install

Unzip sapfx-pack-0.5.5-win.zip, then:

install.cmd                 REM libraries only (ECC + Fiori + API)
install.cmd -WithMcp        REM + rf-mcp plugins & agent workspace
install.cmd -WithBrowsers   REM + Playwright Chromium

Full instructions in the pack's README.md / README.fr.md.

---

The source repository is private — access on request: cyril@montiel.me