feat: 13 specialist agents + 3 team orchestration commands + az CLI + read-everywhere perms
Agents (10 new, total 13):
- python-fastapi-expert — chat-gw / xiaoshou / CloudCost / kb-chat-python
- nestjs-expert — gongdan backend
- react-frontend-expert — xiaoshou/gongdan/casdoor web
- mcp-tools-architect — chat-gw tool registry + auth pipeline
- celery-worker-expert — CloudCost async tasks + beat
- security-auditor — OWASP + secrets + auth (read-only)
- test-engineer — coverage + flaky + e2e
- ci-cd-engineer — 6 repos GitHub Actions
- azure-aca-expert — ACA + Bicep + Key Vault
- docs-writer — README / API / runbook
Team orchestration commands:
- /team-feature — brainstorm → architect → split → parallel impl → QA
- /team-bug-fix — triage → RCA → fix → regression test → review
- /team-refactor — scope → test-first → batch → verify
Infrastructure:
- Dockerfile: add Azure CLI (native apt package)
- docker-compose.yml: mount ~/.azure and ~/.config/gh (read-only)
- scripts/enter.sh: banner showing agents/commands on start
- scripts/install-plugins.sh: helper to install superpowers/OMC/agent-browser
Permissions (.claude/settings.json):
- Full read access: az, gh, kubectl, psql SELECT, redis GET/KEYS/INFO
- Controlled write: gh pr create/comment, git push origin (not main)
- Hard deny: az */update|create|delete, gh pr merge, git push --force,
alembic downgrade, kubectl apply/delete, sudo, rm -rf /
Docs:
- CLAUDE.md: new 'Agent 团队' + '权限模型' sections
- README.md: full agent roster + permission summary
Note: Dockerfile changed — run 'docker compose build' to install Azure CLI
gongzhiyong
e5e5f939ee