Working Hours Reporting

Working Directory Secret File

When the user wants the credentials reused later, store them only in the current working directory, never in the skill directory.

Use this file name:

• .working-hours-reporting.local.json

Expected shape:

{
  "cnb_token": "<CNB_TOKEN>",
  "cnb_git_username": "<CNB_GIT_USERNAME>",
  "timesheet_username": "<TIMESHEET_USERNAME>",
  "timesheet_password": "<TIMESHEET_PASSWORD>"
}

Safety rules:

• Treat this file as local-only runtime state.
• If the current directory is a Git repository, check whether .gitignore already ignores .working-hours-reporting.local.json.
• If the file is not ignored, warn the user before saving. Prefer adding the ignore rule before writing secrets.
• Read from this file first on later runs. Ask only for missing keys.
• Never copy values from this file into the skill files.

Inputs

Collect only what is needed for the current run:

• Repository source: CNB MCP, Git URL, or local repository path
• Repository identifier and author filter
• Exact reporting date
• Timesheet URL
• Required field mapping for the target form
• Credentials supplied during the session, loaded from local environment variables, or read from .working-hours-reporting.local.json

If any required value is missing, ask for it explicitly. Do not invent credentials, repository paths, branch names, or field mappings.

Retrieval Strategy

Use this order:

1. Try CNB MCP first for repository metadata or repository-scoped operations.
2. If CNB MCP does not expose commit history, use Git with the minimum access needed.
3. Filter commits by the exact reporting date and the requested author.
4. If the first Git query returns no matching commit, rerun the check with git log --all or the equivalent full-reference scan before concluding the author has no commit for that date.
5. Build a short work summary from commit titles and touched areas.

Hard stop rule:

• If the Git or repository query still returns no commit for the target date and author after the full-reference scan, stop the workflow.
• Do not open the filing form for submission.
• Do not create an empty, generic, or guessed work-hours entry.

Prefer one compact summary sentence for the timesheet unless the user explicitly wants multiple lines.

Read workflow-notes.md when you need the detailed retrieval and filing sequence.

Browser Filing

Use Playwright MCP for the timesheet flow.

Required browser behavior:

• Reuse the existing logged-in session when possible.
• If login is required, request credentials at runtime or read local sources.
• Fill only the fields the user asked for.
• Verify the submitted entry appears in the list or that the page shows a success signal.

If the form uses custom controls, prefer real user interactions first. Use DOM-level fallback only when the component blocks normal input and the fallback does not weaken correctness.

Secret Rules

Apply these rules without exception:

• Keep real credentials out of SKILL.md, references/, agents/openai.yaml, and examples.
• Use placeholder names such as CNB_TOKEN, TIMESHEET_USERNAME, and TIMESHEET_PASSWORD.
• Do not print bearer tokens in shell commands unless the user explicitly chose that path for the live run.
• Do not copy secrets into screenshots, saved logs, design docs, or commit summaries.
• When summarizing the completed run, mention the result and the work summary, not the credentials used.

Read secret-handling.md before using any credential in a live run.

Output Standard

At the end of a successful run, report only:

• The date filed
• The repository and author filter used
• The final work summary that was submitted
• The submission result or current review state

If the run fails, report the exact blocking step and the minimum additional input needed from the user.