ConnectWise PSA skills and tools under ops/connectwise (hub-sanitized 2026-11-01: client intel, internal workflow/credential/member/company ids, archived-page apiToken/sessionId stripped to placeholders)

ops/connectwise/README.md

@@ -0,0 +1,37 @@
+# ops/connectwise — ConnectWise PSA skills & tools
+
+Published from VistaNet's Hermes fleet skill set (`~/.hermes/skills`).
+
+**Credentials are NOT embedded.** Scripts resolve CW API auth from
+`~/.secrets/connectwise` (a KV file) or `CW_*` environment variables.
+Required keys:
+
+```
+CW_COMPANY_ID=VNI
+CW_PUBLIC_KEY=...
+CW_PRIVATE_KEY=...
+CW_CLIENT_ID=<uuid from CW Developer Network>
+```
+
+Note: the fleet stores the public key with a leading `+`
+(`CW_PUBLIC_KEY=+...`); the loaders normalize it (`lstrip("+")` / `++` collapse)
+before building the `companyid+publickey:privatekey` Basic auth string.
+A `clientId` header is always required — 401 with a valid Basic auth means the
+client ID is missing or disabled.
+
+| Directory | Purpose | Scripts |
+|---|---|---|
+| `connectwise/` | CW API core: schedule entries, ticket create/notes, board & status IDs, env-var auth | `connectwise_api.py`, `cw_company_ticket_audit.py`, `cw_week_schedule_plan.py` |
+| `connectwise-msp/` | Deep PSA reference: auth format, `cwendpoints.json` (full API spec), ticket fetching, time notes | `cw_api.py` (workhorse: `cw_request()`), reads `~/.secrets/connectwise` |
+| `connectwise-reporting/` | Cross-company reporting recipes (server-side filtering traps, raw API auth) | `top-companies-by-hours.py`, `fetch-customer-time-entries.py` |
+| `connectwise-n8n-automation/` | CW × n8n automation patterns | — (docs) |
+| `connectwise-open-tickets-robust/` | Robust open-ticket fetching (handles empty/stale API results) | `schedule_cert_renewals.py` |
+| `connectwise-open-tickets-report/` | Open-ticket report generator | `generate_open_tickets.py` |
+| `connectwise-psa-reporting/` | Raw API reporting quirks + API reference | — (docs) |
+| `cw-triage-workflow/` | ConnectWise triage workflow for n8n triage builds | — (docs) |
+
+Sanitization applied on publish: hardcoded `client id`, public key, and private
+key literals were replaced with `_load_cw_client_id()` / `_load_creds()` loaders
+and `<PLACEHOLDER>` text in the reference docs. Run scripts with system Python
+(`/usr/bin/python3` on the fleet host) — the Hermes-bundled 3.14 runtime lacks
+`requests`.