假设一次编程会话中出现 N 个确认弹窗：
- 其中安全操作占比约 95%（绝大多数操作是安全的）
- 危险操作占比约 5%

人类行为模式：
- 早期弹窗（前20个）：认真阅读，捕获率较高（假设30%）
- 中期弹窗（20-60个）：快速浏览，捕获率下降（假设10%）
- 后期弹窗（60个以上）：机械点击，捕获率极低（假设3%）

加权平均捕获率 ≈ 13.6%（与实验数据吻合）

工具调用请求
      │
      ▼
┌─────────────┐
│  分类器模型  │ ← 输入：命令内容 + 上下文信息
└─────────────┘
      │
      ├──[低风险/可逆]──→ 自动执行
      │
      ├──[中风险]──→ 附加条件执行 / 日志记录
      │
      └──[高风险/不可逆]──→ 拦截 + 通知用户

# Auto Mode分类器决策逻辑示意（简化版）

class RiskLevel:
    SAFE = "safe"           # 可逆、低影响，自动执行
    LOW_RISK = "low_risk"   # 轻微风险，自动执行但记录日志
    MEDIUM_RISK = "medium"  # 中等风险，附加条件执行
    HIGH_RISK = "high"      # 高风险或不可逆，拦截并通知
    BLOCKED = "blocked"     # 明确的危险操作，直接阻止

def classify_tool_call(tool_call, context):
    """
    评估工具调用的风险级别
    
    参数:
        tool_call: 工具调用信息（命令、参数等）
        context: 执行上下文（工作目录、环境、历史等）
    
    返回:
        risk_level: 风险级别
        reasoning: 判断依据
        actions: 建议的处理动作
    """
    # 1. 检查可逆性
    if not is_reversible(tool_call):
        return RiskLevel.HIGH_RISK, "操作不可逆", ["block", "notify_user"]
    
    # 2. 检查数据安全
    if involves_sensitive_data(tool_call, context):
        return RiskLevel.HIGH_RISK, "涉及敏感数据", ["block", "notify_user"]
    
    # 3. 检查影响范围
    if affects_production(context):
        return RiskLevel.MEDIUM_RISK, "影响生产环境", ["require_confirmation"]
    
    # 4. 检查网络访问
    if has_external_network_access(tool_call):
        return RiskLevel.LOW_RISK, "涉及网络访问", ["execute", "log"]
    
    # 5. 默认安全
    return RiskLevel.SAFE, "可逆且低影响", ["execute"]

┌─────────────────────────────────┐
│     企业自托管环境（本地）        │
│                                 │
│  ┌───────────┐  ┌────────────┐ │
│  │ Claude    │  │ 内部服务    │ │
│  │ Code会话  │←→│ 数据库/注册表│ │
│  │ (执行层)  │  │ (内网访问)  │ │
│  └─────┬─────┘  └────────────┘ │
│        │                        │
│        │ 对话数据（加密传输）     │
└────────┼────────────────────────┘
         │
         ▼
┌─────────────────┐
│ Anthropic云端    │
│ (推理层)         │
│ Claude模型推理   │
└─────────────────┘

# claude-code-self-hosted-config.yaml
# 自托管Claude Code环境配置文件

environment:
  name: "enterprise-dev-env"
  version: "1.0.0"
  
  # 基础镜像配置
  base_image: "ubuntu:22.04"
  
  # 预装工具链
  tools:
    - name: "nodejs"
      version: "20.x"
    - name: "python"
      version: "3.12"
    - name: "go"
      version: "1.22"
    - name: "rust"
      version: "stable"
    - name: "docker"
      version: "latest"
  
  # 内部服务访问配置
  internal_services:
    - name: "internal-registry"
      host: "registry.internal.corp"
      port: 443
      auth: "vault://secret/registry-credentials"
    
    - name: "staging-database"
      host: "db.staging.internal"
      port: 5432
      network: "private"
    
    - name: "ci-server"
      host: "ci.internal.corp"
      port: 8080

# 安全配置
security:
  # Auto Mode配置
  auto_mode:
    enabled: true
    block_irreversible: true
    log_all_executions: true
    audit_log_path: "/var/log/claude-code/audit.jsonl"
  
  # 数据保护
  data_protection:
    source_code_residency: "local"       # 源代码保留在本地
    build_artifacts_residency: "local"   # 构建产物保留在本地
    conversation_data: "encrypted"       # 对话数据加密传输
  
  # 网络策略
  network:
    outbound:
      allowed_hosts:
        - "api.anthropic.com"    # 仅允许访问Anthropic推理API
      denied: "*"
    inbound:
      enabled: false             # 禁止公网入站

# 合规配置
compliance:
  data_residency: "on-premise"
  audit_logging: true
  retention_period_days: 90
  pci_dss_mode: false
  hipaa_mode: false

#!/usr/bin/env python3
"""
Claude Code Auto Mode 安全配置管理脚本
用于生成和管理团队级安全策略
"""

import json
import yaml
from pathlib import Path
from dataclasses import dataclass, asdict
from typing import List, Dict, Optional


@dataclass
class SecurityPolicy:
    """安全策略配置"""
    policy_name: str
    auto_mode_enabled: bool
    block_patterns: List[str]
    allow_patterns: List[str]
    require_confirmation_patterns: List[str]
    audit_logging: bool
    max_session_duration_minutes: int


# 预定义的危险命令模式
DANGEROUS_PATTERNS = [
    r"rm\s+-rf\s+/",              # 递归删除根目录
    r"rm\s+-rf\s+~",              # 递归删除用户目录
    r"mkfs\.\w+\s+/dev/",         # 格式化磁盘设备
    r"dd\s+.*of=/dev/[sh]d",      # 直接写入磁盘设备
    r":\(\)\{.*\|\:&\};:",        # Fork bomb
    r"chmod\s+-R\s+777\s+/",      # 递归修改根目录权限
    r">\s*/dev/sda",              # 覆写磁盘
    r"curl\s+.*\|\s*(ba)?sh",     # 管道执行远程脚本
    r"wget\s+.*\|\s*(ba)?sh",     # 管道执行远程脚本
    r"git\s+push\s+.*--force\s+origin\s+main",  # 强制推送主分支
]

# 需要人工确认的中等风险模式
CONFIRMATION_PATTERNS = [
    r"git\s+reset\s+--hard",      # 硬重置Git
    r"git\s+clean\s+-fd",         # 清理未跟踪文件
    r"docker\s+rm\s+-f",          # 强制删除容器
    r"docker\s+rmi\s+-f",         # 强制删除镜像
    r"npm\s+publish",             # 发布npm包
    r"pip\s+install\s+--user",    # 用户级安装
    r"sudo\s+",                   # 任何sudo命令
    r"systemctl\s+(stop|disable)", # 停止/禁用服务
]


def generate_team_policy(
    team_name: str,
    environment: str = "development",
    strict_mode: bool = False
) -> SecurityPolicy:
    """
    生成团队安全策略
    
    参数:
        team_name: 团队名称
        environment: 环境类型 (development/staging/production)
        strict_mode: 是否启用严格模式
    
    返回:
        SecurityPolicy 配置对象
    """
    # 生产环境自动启用严格模式
    if environment == "production":
        strict_mode = True
    
    policy = SecurityPolicy(
        policy_name=f"{team_name}_{environment}_policy",
        auto_mode_enabled=True,
        block_patterns=DANGEROUS_PATTERNS.copy(),
        allow_patterns=[
            r"ls\s+",
            r"cat\s+",
            r"grep\s+",
            r"git\s+(status|log|diff|add|commit)",
            r"npm\s+(install|run|test)",
            r"python\s+.*\.py",
        ],
        require_confirmation_patterns=CONFIRMATION_PATTERNS.copy(),
        audit_logging=True,
        max_session_duration_minutes=240 if strict_mode else 480,
    )
    
    # 严格模式额外配置
    if strict_mode:
        policy.require_confirmation_patterns.extend([
            r"git\s+push",                # 所有推送都需确认
            r"docker\s+(build|run)",      # Docker操作需确认
            r"npm\s+publish",             # 发布需确认
        ])
        policy.max_session_duration_minutes = 120  # 更短的会话限制
    
    return policy


def export_policy_yaml(policy: SecurityPolicy, output_path: str):
    """将策略导出为YAML配置文件"""
    policy_dict = asdict(policy)
    with open(output_path, 'w', encoding='utf-8') as f:
        yaml.dump(policy_dict, f, default_flow_style=False, allow_unicode=True)
    print(f"安全策略已导出到: {output_path}")


def export_policy_json(policy: SecurityPolicy, output_path: str):
    """将策略导出为JSON配置文件"""
    policy_dict = asdict(policy)
    with open(output_path, 'w', encoding='utf-8') as f:
        json.dump(policy_dict, f, indent=2, ensure_ascii=False)
    print(f"安全策略已导出到: {output_path}")


if __name__ == "__main__":
    # 生成开发环境策略
    dev_policy = generate_team_policy(
        team_name="backend-team",
        environment="development",
        strict_mode=False
    )
    export_policy_yaml(dev_policy, "/data/user/work/dev_security_policy.yaml")
    
    # 生成生产环境策略（自动启用严格模式）
    prod_policy = generate_team_policy(
        team_name="backend-team",
        environment="production",
        strict_mode=True
    )
    export_policy_yaml(prod_policy, "/data/user/work/prod_security_policy.yaml")
    
    print("
=== 策略摘要 ===")
    print(f"开发环境 - 拦截模式数: {len(dev_policy.block_patterns)}, "
          f"确认模式数: {len(dev_policy.require_confirmation_patterns)}")
    print(f"生产环境 - 拦截模式数: {len(prod_policy.block_patterns)}, "
          f"确认模式数: {len(prod_policy.require_confirmation_patterns)}")

#!/usr/bin/env python3
"""
Claude Code Auto Mode 审计日志分析工具
用于分析Auto Mode的决策记录，识别潜在安全风险
"""

import json
from datetime import datetime, timedelta
from collections import Counter, defaultdict
from pathlib import Path


def load_audit_logs(log_path: str) -> list:
    """加载JSONL格式的审计日志"""
    logs = []
    with open(log_path, 'r', encoding='utf-8') as f:
        for line in f:
            if line.strip():
                logs.append(json.loads(line))
    return logs


def analyze_block_rate(logs: list) -> dict:
    """分析拦截率和漏网率指标"""
    total_calls = len(logs)
    blocked = sum(1 for l in logs if l.get("action") == "blocked")
    auto_executed = sum(1 for l in logs if l.get("action") == "execute")
    confirmed = sum(1 for l in logs if l.get("action") == "require_confirmation")
    
    return {
        "total_tool_calls": total_calls,
        "auto_executed": auto_executed,
        "blocked": blocked,
        "required_confirmation": confirmed,
        "block_rate": f"{blocked / total_calls * 100:.1f}%" if total_calls else "N/A",
    }


def identify_risk_patterns(logs: list, top_n: int = 10) -> list:
    """识别最常被拦截的命令模式"""
    blocked_commands = [
        l.get("command", "unknown")
        for l in logs
        if l.get("action") == "blocked"
    ]
    return Counter(blocked_commands).most_common(top_n)


def generate_report(log_path: str, output_path: str):
    """生成安全审计报告"""
    logs = load_audit_logs(log_path)
    
    report = {
        "report_date": datetime.now().isoformat(),
        "summary": analyze_block_rate(logs),
        "top_blocked_commands": identify_risk_patterns(logs),
        "recommendations": [],
    }
    
    # 生成建议
    block_rate = report["summary"].get("block_rate", "0%")
    if "blocked" in str(report["summary"]) and report["summary"]["blocked"] > 0:
        report["recommendations"].append(
            "检测到被拦截的危险命令，建议审查相关代码路径是否存在系统性风险"
        )
    
    with open(output_path, 'w', encoding='utf-8') as f:
        json.dump(report, f, indent=2, ensure_ascii=False)
    
    return report


if __name__ == "__main__":
    # 示例：分析过去7天的审计日志
    report = generate_report(
        log_path="/var/log/claude-code/audit.jsonl",
        output_path="/data/user/work/security_audit_report.json"
    )
    print(json.dumps(report, indent=2, ensure_ascii=False))