# .claude/auto-mode-config.yaml
# Claude Code Auto Mode 安全策略配置

auto_mode:
  enabled: true
  risk_threshold: medium  # low | medium | high
  
  # 可逆操作：自动执行，无需确认
  auto_execute:
    - pattern: "create_file"
      conditions:
        path_scope: "local_workspace"
    - pattern: "run_tests"
      conditions:
        environment: "sandbox"
    - pattern: "git_commit"
      conditions:
        branch: "feature/*"
        force_push: false
    
  # 需要确认的操作
  require_confirmation:
    - pattern: "install_dependency"
      risk_level: medium
    - pattern: "modify_config"
      path_scope: "shared"
    - pattern: "git_merge"
      target_branch: "main"
    
  # 直接拦截的操作
  block:
    - pattern: "delete_file"
      conditions:
        path_scope: "production"
    - pattern: "git_push"
      conditions:
        force: true
        target: "main"
    - pattern: "execute_shell"
      command_regex: "rm\\s+-rf\\s+/"
    - pattern: "database_operation"
      operation: "DROP|TRUNCATE"
      environment: "production"
      
  # 审计日志
  audit_log:
    enabled: true
    destination: ".claude/audit-log.jsonl"
    log_all_calls: true

# custom_safety_rules.py
# Claude Code Auto Mode 自定义安全规则扩展

import re
from typing import Dict, Any

class CustomSafetyClassifier:
    """自定义安全分类规则，与Auto Mode分类器协同工作"""
    
    # 不可逆操作模式库
    IRREVERSIBLE_PATTERNS = [
        r"rm\s+-rf\s+/",           # 递归删除根目录
        r"git\s+push\s+--force",    # 强制推送
        r"DROP\s+(TABLE|DATABASE)", # 删除数据库对象
        r"truncate\s+table",        # 清空表
        r"shred\s+-u",              # 安全删除文件
        r"mkfs\.\w+\s+/dev/",       # 格式化磁盘
    ]
    
    # 敏感文件路径
    SENSITIVE_PATHS = [
        r"/etc/",
        r"~/.ssh/",
        r"~/.aws/",
        r"\.env\.production",
        r"credentials\.(json|yaml|yml)",
    ]
    
    def classify(self, tool_call: Dict[str, Any]) -> Dict[str, Any]:
        """对工具调用进行风险分类
        
        Args:
            tool_call: 包含工具名称、参数、上下文信息的字典
            
        Returns:
            分类结果，包含风险等级和建议操作
        """
        command = tool_call.get("command", "")
        file_path = tool_call.get("path", "")
        
        # 检查不可逆操作模式
        for pattern in self.IRREVERSIBLE_PATTERNS:
            if re.search(pattern, command, re.IGNORECASE):
                return {
                    "risk_level": "high",
                    "action": "block",
                    "reason": f"匹配不可逆操作模式: {pattern}",
                    "matched_rule": pattern
                }
        
        # 检查敏感路径访问
        for path_pattern in self.SENSITIVE_PATHS:
            if re.search(path_pattern, file_path):
                return {
                    "risk_level": "high",
                    "action": "require_confirmation",
                    "reason": f"访问敏感路径: {path_pattern}",
                    "matched_rule": path_pattern
                }
        
        # 默认：允许Auto Mode分类器自行判断
        return {
            "risk_level": "delegated",
            "action": "auto",
            "reason": "交由Auto Mode分类器处理"
        }


# 使用示例
if __name__ == "__main__":
    classifier = CustomSafetyClassifier()
    
    # 模拟一个危险命令
    test_call = {
        "tool": "execute_shell",
        "command": "rm -rf /var/log/app",
        "path": "/var/log/app"
    }
    
    result = classifier.classify(test_call)
    print(f"命令: {test_call['command']}")
    print(f"风险等级: {result['risk_level']}")
    print(f"建议操作: {result['action']}")
    print(f"原因: {result['reason']}")
    
    # 输出:
    # 命令: rm -rf /var/log/app
    # 风险等级: high
    # 建议操作: block
    # 原因: 匹配不可逆操作模式: rm\s+-rf\s+/

# claude-code-self-hosted.yaml
# 自托管Claude Code环境部署配置

apiVersion: apps/v1
kind: Deployment
metadata:
  name: claude-code-runtime
  namespace: ai-coding
spec:
  replicas: 3
  selector:
    matchLabels:
      app: claude-code-runtime
  template:
    metadata:
      labels:
        app: claude-code-runtime
    spec:
      containers:
        - name: claude-code
          image: anthropic/claude-code-runtime:latest
          env:
            - name: ANTHROPIC_API_KEY
              valueFrom:
                secretKeyRef:
                  name: anthropic-credentials
                  key: api-key
            - name: AUTO_MODE_ENABLED
              value: "true"
            - name: SAFETY_CLASSIFIER_LEVEL
              value: "strict"
            - name: AUDIT_LOG_PATH
              value: "/var/log/claude-code/audit.jsonl"
          volumeMounts:
            - name: workspace
              mountPath: /workspace
            - name: sdk-cache
              mountPath: /opt/sdks
            - name: audit-logs
              mountPath: /var/log/claude-code
          resources:
            requests:
              memory: "4Gi"
              cpu: "2"
            limits:
              memory: "8Gi"
              cpu: "4"
      volumes:
        - name: workspace
          persistentVolumeClaim:
            claimName: claude-workspace-pvc
        - name: sdk-cache
          persistentVolumeClaim:
            claimName: sdk-cache-pvc
        - name: audit-logs
          persistentVolumeClaim:
            claimName: audit-logs-pvc
---
# 网络策略：限制出站流量，仅允许访问Anthropic推理API
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: claude-code-egress
  namespace: ai-coding
spec:
  podSelector:
    matchLabels:
      app: claude-code-runtime
  policyTypes:
    - Egress
  egress:
    # 允许访问Anthropic推理API
    - to:
        - namespaceSelector: {}
      ports:
        - protocol: TCP
          port: 443
    # 允许访问内部数据库
    - to:
        - podSelector:
            matchLabels:
              app: internal-database
      ports:
        - protocol: TCP
          port: 5432
    # 允许访问内部注册表
    - to:
        - podSelector:
            matchLabels:
              app: internal-registry
      ports:
        - protocol: TCP
          port: 5000

# 检查当前Auto Mode状态
claude-code config get auto_mode

# 启用Auto Mode
claude-code config set auto_mode enabled true

# 设置风险阈值（low=最严格，high=最宽松）
claude-code config set auto_mode risk_threshold medium

# 查看审计日志
claude-code audit log --tail 50

// .claude/project-config.json
{
  "auto_mode": {
    "enabled": true,
    "risk_threshold": "medium",
    "team_policy": {
      "allowed_operations": [
        "create_file",
        "edit_file",
        "run_tests",
        "git_commit",
        "git_push"
      ],
      "blocked_operations": [
        "force_push",
        "delete_branch:main",
        "execute_shell:rm -rf",
        "database:drop"
      ],
      "require_review": [
        "install_dependency",
        "modify_ci_config",
        "deploy_to_staging"
      ]
    },
    "notifications": {
      "on_block": true,
      "on_require_review": true,
      "channel": "slack"
    }
  }
}

# audit_analyzer.py
# 分析Auto Mode审计日志，生成安全报告

import json
from datetime import datetime, timedelta
from collections import Counter
from pathlib import Path

def analyze_audit_log(log_path: str) -> dict:
    """分析Auto Mode审计日志
    
    Args:
        log_path: 审计日志文件路径（JSONL格式）
        
    Returns:
        安全分析报告
    """
    stats = {
        "total_calls": 0,
        "auto_executed": 0,
        "blocked": 0,
        "require_review": 0,
        "blocked_commands": [],
        "risk_distribution": Counter(),
        "hourly_activity": Counter(),
    }
    
    with open(log_path, "r") as f:
        for line in f:
            entry = json.loads(line)
            stats["total_calls"] += 1
            
            action = entry.get("action", "unknown")
            if action == "auto_execute":
                stats["auto_executed"] += 1
            elif action == "block":
                stats["blocked"] += 1
                stats["blocked_commands"].append({
                    "command": entry.get("command", ""),
                    "reason": entry.get("reason", ""),
                    "timestamp": entry.get("timestamp", "")
                })
            elif action == "require_confirmation":
                stats["require_review"] += 1
            
            risk = entry.get("risk_level", "unknown")
            stats["risk_distribution"][risk] += 1
            
            hour = datetime.fromisoformat(
                entry.get("timestamp", "")
            ).hour
            stats["hourly_activity"][hour] += 1
    
    # 计算拦截率
    dangerous_total = stats["blocked"] + stats["require_review"]
    if dangerous_total > 0:
        stats["block_rate"] = stats["blocked"] / dangerous_total * 100
    else:
        stats["block_rate"] = 0
    
    return stats

def print_report(stats: dict):
    """打印安全分析报告"""
    print("=" * 60)
    print("Claude Code Auto Mode 安全审计报告")
    print("=" * 60)
    print(f"总工具调用数: {stats['total_calls']}")
    print(f"自动执行: {stats['auto_executed']}")
    print(f"被拦截: {stats['blocked']}")
    print(f"需人工确认: {stats['require_review']}")
    print(f"危险命令拦截率: {stats['block_rate']:.1f}%")
    print()
    print("风险级别分布:")
    for level, count in stats["risk_distribution"].most_common():
        print(f"  {level}: {count}")
    print()
    print("被拦截的命令（最近10条）:")
    for cmd in stats["blocked_commands"][-10:]:
        print(f"  [{cmd['timestamp']}] {cmd['command']}")
        print(f"    原因: {cmd['reason']}")

# 使用示例
if __name__ == "__main__":
    report = analyze_audit_log(".claude/audit-log.jsonl")
    print_report(report)