gongzhiyong
8ab440154b
chore(perms): allow ssh/scp/sftp/rsync for agent deployment tasks
...
Adds to permissions.allow:
- ssh, scp, sftp (remote exec + file transfer)
- ssh-add, ssh-keygen, ssh-copy-id (key management)
- rsync (fast file sync)
No Dockerfile change -> no rebuild needed; settings.json is bind-mounted
into the container. After git pull, /exit + restart claude to reload.
2026-04-25 02:18:47 +08:00
gongzhiyong
1277fa91d7
chore(perms): unblock 'git reset --hard' (move from deny to prompt)
...
- Removed Bash(git reset --hard*) and Bash(git clean -fd*) from deny list.
- git reset --hard and git clean -fd are not in allow either, so Claude
will prompt for confirmation each time (safest middle ground).
- git clean -fdx remains denied (removes ignored files = dangerous).
- Updated CLAUDE.md permission summary to reflect new model.
2026-04-24 22:47:20 +08:00
gongzhiyong
e5e5f939ee
feat: 13 specialist agents + 3 team orchestration commands + az CLI + read-everywhere perms
...
Agents (10 new, total 13):
- python-fastapi-expert — chat-gw / xiaoshou / CloudCost / kb-chat-python
- nestjs-expert — gongdan backend
- react-frontend-expert — xiaoshou/gongdan/casdoor web
- mcp-tools-architect — chat-gw tool registry + auth pipeline
- celery-worker-expert — CloudCost async tasks + beat
- security-auditor — OWASP + secrets + auth (read-only)
- test-engineer — coverage + flaky + e2e
- ci-cd-engineer — 6 repos GitHub Actions
- azure-aca-expert — ACA + Bicep + Key Vault
- docs-writer — README / API / runbook
Team orchestration commands:
- /team-feature — brainstorm → architect → split → parallel impl → QA
- /team-bug-fix — triage → RCA → fix → regression test → review
- /team-refactor — scope → test-first → batch → verify
Infrastructure:
- Dockerfile: add Azure CLI (native apt package)
- docker-compose.yml: mount ~/.azure and ~/.config/gh (read-only)
- scripts/enter.sh: banner showing agents/commands on start
- scripts/install-plugins.sh: helper to install superpowers/OMC/agent-browser
Permissions (.claude/settings.json):
- Full read access: az, gh, kubectl, psql SELECT, redis GET/KEYS/INFO
- Controlled write: gh pr create/comment, git push origin (not main)
- Hard deny: az */update|create|delete, gh pr merge, git push --force,
alembic downgrade, kubectl apply/delete, sudo, rm -rf /
Docs:
- CLAUDE.md: new 'Agent 团队' + '权限模型' sections
- README.md: full agent roster + permission summary
Note: Dockerfile changed — run 'docker compose build' to install Azure CLI
2026-04-24 22:20:13 +08:00
gongzhiyong and Claude Opus 4.6
2a1692250c
fix: improve bootstrap compatibility and add audit pre-requisites
...
Use plain arrays instead of associative arrays in bootstrap.sh for
broader shell compatibility; add tool installation prep step to
audit-deps command.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-24 19:40:27 +08:00
gongzhiyong
b39fbddd84
feat: add 5 more team assets (upstream sync, migration review, pre-commit hook)
...
Commands:
- /sync-upstream [--dry-run] — casdoor-internal upstream sync with commit classification
- /check-migrations [repo|all] — Alembic/Prisma/Drizzle consistency checker (focuses on xiaoshou pending migrations)
Specialist agents:
- migration-reviewer — Critical/High/Low severity review for DB schema changes across
all 6 repos (Alembic, Prisma, Drizzle, xorm Sync2, raw SQL)
Playbooks:
- playbooks/casdoor-upstream-rebase.md — quarterly upstream rebase flow
with commit classification, batched merging, cross-repo JWT compat check, rollback criteria
Hooks (active by default via settings.json):
- .claude/hooks/pre-commit-check.sh — PreToolUse on Bash:
* blocks inline secrets in command strings (10+ patterns: sk-ant-, ghp_, AKIA, PEM, etc.)
* on git commit, scans staged diff for same patterns
* blocks diffs > 5000 lines (override with [huge-diff-ok] in commit msg)
- settings.json: wire PreToolUse hook
2026-04-23 23:57:41 +08:00
gongzhiyong
bc7f53790e
feat: add team agent library (3 slash commands + 2 specialist agents)
...
Commands (.claude/commands/):
- /audit-deps [repo|all] — CVE + outdated deps audit with risk ranking
- /add-ci <repo> — add GitHub Actions CI matching repo's stack
- /review-pr <pr> — deep PR review, comment-only (no auto-approve)
Specialist agents (.claude/agents/):
- casdoor-specialist — Go/Beego expert, upstream fork safety
- lobechat-brand-guardian — protect 242 locale de-branding on rebase
README.md: add '团队可以/应该写什么' section
- categorizes 6 types of content for ai-ops
- specifies PR flow, reviewer checklist, refresh mechanism
.gitignore: exclude .claude/settings.local.json and reports/
2026-04-23 23:36:24 +08:00
gongzhiyong
3112ca1d7c
initial: team agent workstation for 6-repo matrix
...
- Dockerfile (Node/Python/Go/Bun + claude-code + gh cli)
- docker-compose.yml (flexible REPOS_DIR, 7 mounts, 6 cache volumes)
- CLAUDE.md (team conventions + red lines + per-repo build/test cmds)
- .claude/settings.json (allow/deny permissions)
- Makefile + scripts/{enter,bootstrap,run-task}.sh
- README.md (onboarding guide)
2026-04-23 23:11:16 +08:00
gongzhiyong