mirror of
https://github.com/leonvanzyl/autocoder.git
synced 2026-01-30 06:12:06 +00:00
a9a0fcd865
Implement hierarchical command security with project and org-level configs:
WHAT'S NEW:
- Project-level YAML config (.autocoder/allowed_commands.yaml)
- Organization-level config (~/.autocoder/config.yaml)
- Pattern matching (exact, wildcards, local scripts)
- Hardcoded blocklist (sudo, dd, shutdown - never allowed)
- Org blocklist (terraform, kubectl - configurable)
- Helpful error messages with config hints
- Comprehensive documentation and examples
ARCHITECTURE:
- Hierarchical resolution: Hardcoded → Org Block → Org Allow → Global → Project
- YAML validation with 50 command limit per project
- Pattern matching: exact ("swift"), wildcards ("swift*"), scripts ("./build.sh")
- Secure by default: all examples commented out
TESTING:
- 136 unit tests (pattern matching, YAML, hierarchy, validation)
- 9 integration tests (real security hook flows)
- All tests passing, 100% backward compatible
DOCUMENTATION:
- examples/README.md - comprehensive guide with use cases
- examples/project_allowed_commands.yaml - template (all commented)
- examples/org_config.yaml - org config template (all commented)
- PHASE3_SPEC.md - mid-session approval spec (future enhancement)
- Updated CLAUDE.md with security model documentation
USE CASES:
- iOS projects: Add Swift toolchain (xcodebuild, swift*, etc.)
- Rust projects: Add cargo, rustc, clippy
- Enterprise: Block aws, kubectl, terraform org-wide
- Custom scripts: Allow ./scripts/build.sh
PHASES:
✅ Phase 1: Project YAML + blocklist (implemented)
✅ Phase 2: Org config + hierarchy (implemented)
📋 Phase 3: Mid-session approval (spec ready, not implemented)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
18 lines
327 B
Plaintext
18 lines
327 B
Plaintext
claude-agent-sdk>=0.1.0,<0.2.0
|
|
python-dotenv>=1.0.0
|
|
sqlalchemy>=2.0.0
|
|
fastapi>=0.115.0
|
|
uvicorn[standard]>=0.32.0
|
|
websockets>=13.0
|
|
python-multipart>=0.0.17
|
|
psutil>=6.0.0
|
|
aiofiles>=24.0.0
|
|
apscheduler>=3.10.0,<4.0.0
|
|
pywinpty>=2.0.0; sys_platform == "win32"
|
|
pyyaml>=6.0.0
|
|
|
|
# Dev dependencies
|
|
ruff>=0.8.0
|
|
mypy>=1.13.0
|
|
pytest>=8.0.0
|