proxmox-opslisted

# proxmox-ops Judgment layer for Proxmox VE. The API gives you hands; this skill is the part that checks twice. Read operations are free. Write operations follow the golden rule. No exceptions. ## Credentials All scripts source `~/.config/claude-homelab/credentials.env` if it exists, falling back to environment variables. Expected: ``` PROXMOX_HOST=192.168.1.10:8006 # host[:port] PROXMOX_TOKEN_ID=claude@pve!claude # user@realm!tokenname PROXMOX_TOKEN_SECRET=uuid-secret PROXMOX_VERIFY_TLS=false # self-signed default; true if proper certs ``` API auth header: `Authorization: PVEAPIToken=${PROXMOX_TOKEN_ID}=${PROXMOX_TOKEN_SECRET}`. Base URL: `https://${PROXMOX_HOST}/api2/json`. **Never use root@pam.** Always a dedicated token with privilege separation: user `claude@pve`, role `PVEAuditor` on `/` for read-only, elevate later with `PVEVMAdmin` on a restricted path (e.g. `/vms/<test-id>`) for the write phase. If the configured token turns out to be root@pam, warn and recommend recreating it before doing anything else. **Missing credentials or 401:** don't improvise — show the state, point to `/homelab`, stop. **Token pasted in chat:** warn (it's in history now), tell the user to delete the token in Datacenter → Permissions → API Tokens and re-run `bash ~/.claude/skills/proxmox-ops/scripts/setup.sh` in their own terminal. ## Golden rule — write operations Applies to: start/stop/shutdown/reset/delete of VM or CT, config changes, snapshot delete, stora