Initial

README.md

@@ -29,7 +29,7 @@ The current UI is a Vue/Vite view layer over the Express API. All create/update/
 - PSADT Best Practice Verifier for saved scripts, rendered profiles, and pasted script content with severity scoring, line-aware findings, remediation text, and rule metadata.
 - Intune Publishing Wizard for PSADT Win32 deployment plans, including package source, `.intunewin` tracking, command style, UI compatibility, requirements, detection rules, return-code policy, assignment rings, status, Graph app ID, and visibility.
 - Microsoft Graph Intune tracking for PSADT deployments, with Graph environment configuration managed under Config / Intune plus mobile app linking, status sync, failure review, device/user status rows, and sync run history.
-- Host Library with searchable/sortable/paginated table and modal add/edit flow.
+- Host Library with searchable/sortable/paginated table, modal add/edit flow, and VMware vCenter VM import wizard with preview filters and credential attachment.
 - Credential Vault as its own menu item with encrypted-at-rest secrets and modal add/edit flow.
 - RunPlan Library with searchable/sortable/paginated table, modal composer, and execute action.
 - Aggregate job log viewer with search/filter/pagination.
@@ -158,6 +158,11 @@ Important environment variables:
 | `DEFAULT_ADMIN_NAME` | First-run admin display name. |
 | `POWERSHELL_BIN` | PowerShell executable. Defaults to `pwsh`. |
 | `ALLOW_SCRIPT_EXECUTION` | Set `false` to disable actual RunPlan execution. |
+| `VCENTER_ENABLED` | Enables VMware vCenter VM discovery and Host import workflows. |
+| `VCENTER_BASE_URL` | vCenter REST API root, for example `https://vcenter.contoso.local`. |
+| `VCENTER_USERNAME` | vCenter account used by the backend to create API sessions. |
+| `VCENTER_PASSWORD` | vCenter password. Prefer environment pinning for production deployments. |
+| `VCENTER_ALLOW_UNTRUSTED_TLS` | Set `true` to allow self-signed/private CA vCenter certificates. |
 | `CATALOG_CHECK_INTERVAL_MINUTES` | Minutes between catalog upstream-version checks. `0` disables. |
 | `AUTO_PROMOTE_INTERVAL_MINUTES` | Minutes between auto-promote soak checks. `0` disables. |
 | `TOOLS_DIR` | Directory for bundled tools. Defaults to `./tools`. |
@@ -498,6 +503,9 @@ Payload:
 | --- | --- | --- | --- |
 | `GET` | `/api/hosts` | User | List host library. |
 | `POST` | `/api/hosts` | User | Create host. |
+| `GET` | `/api/hosts/import/vcenter/status` | User | Return effective vCenter import configuration status without the password. |
+| `POST` | `/api/hosts/import/vcenter/preview` | User | Authenticate to vCenter, search VM inventory, and return import candidates. |
+| `POST` | `/api/hosts/import/vcenter` | User | Import selected vCenter VM candidates as hosts, attaching the chosen credential/defaults. |
 | `PUT` | `/api/hosts/:id` | User | Update host. |
 | `DELETE` | `/api/hosts/:id` | User | Delete host. |
 
@@ -523,6 +531,47 @@ Payload:
 `personal`, `shared`, or `group`; hosts default to `shared`. RunPlans can only
 target hosts visible to the operator who creates or edits them.
 
+VMware vCenter import uses the effective Config / Integrations values (`vcenter_*` settings or the `VCENTER_*` environment variables). The backend creates a vCenter REST session with `POST /api/session`, lists VMs from `/api/vcenter/vm`, and then best-effort enriches each candidate from guest identity/networking endpoints. FQDN and IP discovery depends on VMware Tools data; when guest data is unavailable, the import falls back to the VM name as the host address and records the limitation in host notes.
+
+Preview payload:
+
+```json
+{
+  "filter": {
+    "field": "hostname",
+    "operator": "contains",
+    "value": "ENG-ENT"
+  },
+  "limit": 100
+}
+```
+
+Import payload:
+
+```json
+{
+  "filter": {
+    "field": "hostname",
+    "operator": "contains",
+    "value": "ENG-ENT"
+  },
+  "limit": 100,
+  "vmIds": ["vm-101", "vm-205"],
+  "credentialId": "cred_...",
+  "transport": "winrm",
+  "port": null,
+  "tags": ["engineering", "vcenter-import"],
+  "visibility": "group",
+  "groupId": "grp_..."
+}
+```
+
+`field` can be `hostname`, `name`, `fqdn`, or `ip`. `operator` can be
+`contains`, `equals`, `startsWith`, or `endsWith`. If `vmIds` is empty, all
+previewed candidates that match the filter are considered. Existing visible
+hosts with the same name, address, or FQDN are skipped and returned in the
+`skipped` array so imports can be rerun safely.
+
 ### Script Library
 
 | Method | Route | Auth | Description |