xiaohei/xmwork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11 Commits 2 Branches 0 Tags
main
Commit Graph
11 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
gongzhiyong 8ab440154b chore(perms): allow ssh/scp/sftp/rsync for agent deployment tasks 
Adds to permissions.allow:
- ssh, scp, sftp (remote exec + file transfer)
- ssh-add, ssh-keygen, ssh-copy-id (key management)
- rsync (fast file sync)

No Dockerfile change -> no rebuild needed; settings.json is bind-mounted
into the container. After git pull, /exit + restart claude to reload.
 2026-04-25 02:18:47 +08:00
gongzhiyong c90de4e4ee feat(tools): one-shot install missing runtime deps for skills 
Added in this image:
- pandoc 2.17.1          universal doc converter
- yq v4.53.2              YAML CLI query
- sqlite3 3.40.1          local cache storage
- codex-cli 0.124.0       OpenAI Codex CLI (for codex:codex-rescue agent)
- pip-audit               CVE scanner
- python-docx, pypdf, openpyxl, python-pptx, Pillow, pandas, markdown
                          (for potential anthropic-skills docx/pdf/xlsx/pptx)

Skipped:
- omc CLI: macOS-brew-only, plugin-level skills work without the CLI
- chrome-for-testing: ARM64 unsupported, we use system chromium

Verified all tools load in fresh container.
 2026-04-25 00:04:35 +08:00
gongzhiyong a42aa34f5a feat(browser): install chromium + agent-browser for agent-browser skill 
Root cause of agent-browser skill failing:
- Skill loaded but 'agent-browser' CLI wasn't installed
- Debian bookworm main has no chromium (moved to backports)
- Chrome for Testing has no Linux ARM64 builds

Fix:
- Add bookworm-backports (via TUNA mirror) + install chromium + sandbox
- npm i -g agent-browser (pins to CLI version 0.26.0)
- Set env vars to pin chromium path for agent-browser/Playwright/Puppeteer

Verified in container:
  chromium 147.0.7727.101
  agent-browser 0.26.0
  agent-browser screenshot https://example.com -> 3742 bytes PNG saved

Usage: just run commands like
  agent-browser open https://...
  agent-browser screenshot <url> <out>
No need to pass --executable-path; env var AGENT_BROWSER_CHROMIUM_PATH
(and equivalents for Playwright/Puppeteer) makes chromium the default.
 2026-04-24 23:51:44 +08:00
gongzhiyong ab2ea0730e fix(plugins): expose host Claude plugins + skills to container 
Root cause of '容器里看不到任何 SK':
- Container's /root/.claude was an isolated named volume (empty)
- Host plugins live in ~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/
- installed_plugins.json embeds ABSOLUTE paths like /Users/$USER/.claude/...
  which don't resolve in container

Fix:
1. docker-compose.yml
   - Bind-mount ${HOME}/.claude/plugins -> /root/.claude/plugins (ro)
   - Bind-mount ${HOME}/.claude/skills  -> /root/.claude/skills  (ro)
   - Pass HOST_HOME env var
2. scripts/container-entrypoint.sh (new)
   - If HOST_HOME != HOME, symlink HOST_HOME -> /root so the absolute
     paths inside installed_plugins.json resolve (e.g.
     /Users/gongzhiyong/.claude/... -> /root/.claude/...)
3. Dockerfile
   - Install entrypoint, wire it into ENTRYPOINT via tini

Verified: all 4 installed plugins (oh-my-claudecode, superpowers,
frontend-design, planning-with-files) + 3 skills (agent-browser,
find-skills, omc-reference) visible in container.
 2026-04-24 23:16:14 +08:00
gongzhiyong 1277fa91d7 chore(perms): unblock 'git reset --hard' (move from deny to prompt) 
- Removed Bash(git reset --hard*) and Bash(git clean -fd*) from deny list.
- git reset --hard and git clean -fd are not in allow either, so Claude
  will prompt for confirmation each time (safest middle ground).
- git clean -fdx remains denied (removes ignored files = dangerous).
- Updated CLAUDE.md permission summary to reflect new model.
 2026-04-24 22:47:20 +08:00
gongzhiyong 2dd513f036 fix(compose): make .azure and .config/gh mounts writable 
az CLI crashes trying to write session cache to /root/.azure with :ro.
gh CLI has similar need. Mount them read-write (the host's Azure/gh
login state is intended to be shared, and the CLI's writes are cache/
session tokens going into the normal location).
 2026-04-24 22:23:18 +08:00
gongzhiyong e5e5f939ee feat: 13 specialist agents + 3 team orchestration commands + az CLI + read-everywhere perms 
Agents (10 new, total 13):
- python-fastapi-expert   — chat-gw / xiaoshou / CloudCost / kb-chat-python
- nestjs-expert           — gongdan backend
- react-frontend-expert   — xiaoshou/gongdan/casdoor web
- mcp-tools-architect     — chat-gw tool registry + auth pipeline
- celery-worker-expert    — CloudCost async tasks + beat
- security-auditor        — OWASP + secrets + auth (read-only)
- test-engineer           — coverage + flaky + e2e
- ci-cd-engineer          — 6 repos GitHub Actions
- azure-aca-expert        — ACA + Bicep + Key Vault
- docs-writer             — README / API / runbook

Team orchestration commands:
- /team-feature   — brainstorm → architect → split → parallel impl → QA
- /team-bug-fix   — triage → RCA → fix → regression test → review
- /team-refactor  — scope → test-first → batch → verify

Infrastructure:
- Dockerfile: add Azure CLI (native apt package)
- docker-compose.yml: mount ~/.azure and ~/.config/gh (read-only)
- scripts/enter.sh: banner showing agents/commands on start
- scripts/install-plugins.sh: helper to install superpowers/OMC/agent-browser

Permissions (.claude/settings.json):
- Full read access: az, gh, kubectl, psql SELECT, redis GET/KEYS/INFO
- Controlled write: gh pr create/comment, git push origin (not main)
- Hard deny: az */update|create|delete, gh pr merge, git push --force,
  alembic downgrade, kubectl apply/delete, sudo, rm -rf /

Docs:
- CLAUDE.md: new 'Agent 团队' + '权限模型' sections
- README.md: full agent roster + permission summary

Note: Dockerfile changed — run 'docker compose build' to install Azure CLI
 2026-04-24 22:20:13 +08:00
gongzhiyongandClaude Opus 4.6 2a1692250c fix: improve bootstrap compatibility and add audit pre-requisites 
Use plain arrays instead of associative arrays in bootstrap.sh for
broader shell compatibility; add tool installation prep step to
audit-deps command.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-24 19:40:27 +08:00
gongzhiyong b39fbddd84 feat: add 5 more team assets (upstream sync, migration review, pre-commit hook) 
Commands:
- /sync-upstream [--dry-run]   — casdoor-internal upstream sync with commit classification
- /check-migrations [repo|all] — Alembic/Prisma/Drizzle consistency checker (focuses on xiaoshou pending migrations)

Specialist agents:
- migration-reviewer — Critical/High/Low severity review for DB schema changes across
  all 6 repos (Alembic, Prisma, Drizzle, xorm Sync2, raw SQL)

Playbooks:
- playbooks/casdoor-upstream-rebase.md — quarterly upstream rebase flow
  with commit classification, batched merging, cross-repo JWT compat check, rollback criteria

Hooks (active by default via settings.json):
- .claude/hooks/pre-commit-check.sh — PreToolUse on Bash:
  * blocks inline secrets in command strings (10+ patterns: sk-ant-, ghp_, AKIA, PEM, etc.)
  * on git commit, scans staged diff for same patterns
  * blocks diffs > 5000 lines (override with [huge-diff-ok] in commit msg)
- settings.json: wire PreToolUse hook
 2026-04-23 23:57:41 +08:00
gongzhiyong bc7f53790e feat: add team agent library (3 slash commands + 2 specialist agents) 
Commands (.claude/commands/):
- /audit-deps [repo|all]    — CVE + outdated deps audit with risk ranking
- /add-ci <repo>            — add GitHub Actions CI matching repo's stack
- /review-pr <pr>           — deep PR review, comment-only (no auto-approve)

Specialist agents (.claude/agents/):
- casdoor-specialist        — Go/Beego expert, upstream fork safety
- lobechat-brand-guardian   — protect 242 locale de-branding on rebase

README.md: add '团队可以/应该写什么' section
 - categorizes 6 types of content for ai-ops
 - specifies PR flow, reviewer checklist, refresh mechanism

.gitignore: exclude .claude/settings.local.json and reports/
 2026-04-23 23:36:24 +08:00
gongzhiyong 3112ca1d7c initial: team agent workstation for 6-repo matrix 
- Dockerfile (Node/Python/Go/Bun + claude-code + gh cli)
- docker-compose.yml (flexible REPOS_DIR, 7 mounts, 6 cache volumes)
- CLAUDE.md (team conventions + red lines + per-repo build/test cmds)
- .claude/settings.json (allow/deny permissions)
- Makefile + scripts/{enter,bootstrap,run-task}.sh
- README.md (onboarding guide)
 2026-04-23 23:11:16 +08:00