@dusky-bluehour/agent-service 0.6.5 → 0.6.7

package/common/settings/security-policy.json

@@ -0,0 +1,221 @@
+{
+  "schema_version": "1.0.0",
+  "policy_id": "strict-dev",
+  "description_ko": "프로젝트 단위 자동화 실행을 위한 보안 중심 권한 정책",
+  "shared_permissions": {
+    "read_all": true,
+    "edit_all": true,
+    "allow_bash": [
+      "mkdir *",
+      "touch *",
+      "ls *",
+      "cat *",
+      "grep *",
+      "find *",
+      "echo *",
+      "cd *",
+      "pwd",
+      "tail *",
+      "head *",
+      "git status",
+      "git log *",
+      "git diff *",
+      "git branch",
+      "node *",
+      "npx *",
+      "npm *",
+      "pnpm *",
+      "yarn *",
+      "jest *",
+      "vitest *",
+      "pytest *",
+      "docker ps *",
+      "docker images *",
+      "docker logs *",
+      "docker run *",
+      "docker build *",
+      "docker-compose up *",
+      "docker-compose build *"
+    ],
+    "ask_bash": [
+      "git add *",
+      "git commit *",
+      "git push *",
+      "git pull *",
+      "git fetch *",
+      "git merge *",
+      "git rebase *",
+      "git reset *",
+      "git clean *",
+      "git checkout .",
+      "git restore .",
+      "git branch -D *",
+      "git push --force *",
+      "git push -f *",
+      "rm *",
+      "rm -r *",
+      "rm -rf *",
+      "rm -f *",
+      "mv *",
+      "cp *",
+      "cp -r *",
+      "docker rm *",
+      "docker rmi *",
+      "docker system prune *",
+      "docker volume rm *",
+      "docker network rm *",
+      "docker-compose down *"
+    ],
+    "deny_bash": [
+      "npm install -g *",
+      "npm i -g *",
+      "pnpm add -g *",
+      "pnpm install -g *",
+      "yarn global add *",
+      "brew install *",
+      "brew uninstall *",
+      "pip install *",
+      "pip uninstall *",
+      "sudo *",
+      "su *",
+      "chmod *",
+      "chown *",
+      "chgrp *",
+      "kill *",
+      "killall *",
+      "pkill *",
+      "shutdown *",
+      "reboot*",
+      "halt*",
+      "poweroff*",
+      "ifconfig *",
+      "route *",
+      "iptables *",
+      "pfctl *",
+      "diskutil *",
+      "hdiutil *",
+      "dd *",
+      "format *",
+      "curl * | bash",
+      "curl * | sh",
+      "curl * | zsh",
+      "wget * | bash",
+      "wget * | sh",
+      "* | sudo *",
+      "security *",
+      "defaults write *",
+      "launchctl *",
+      "scutil *",
+      "nvram *",
+      "csrutil *",
+      "softwareupdate *",
+      "xcode-select *"
+    ],
+    "deny_read": [
+      "//System/**",
+      "//Library/**",
+      "//bin/**",
+      "//sbin/**",
+      "//usr/**",
+      "//etc/**",
+      "//var/**",
+      "//private/**",
+      "//tmp/**",
+      "//opt/**",
+      "~/.ssh/**",
+      "~/.aws/**",
+      "~/.config/gcloud/**",
+      "~/.docker/**",
+      "~/.kube/**",
+      "~/.npmrc",
+      "~/.gitconfig",
+      "~/.zshrc",
+      "~/.bashrc",
+      "~/.bash_profile",
+      "~/.zprofile",
+      "~/Library/Safari/**",
+      "~/Library/Application Support/Google/Chrome/**",
+      "~/Library/Keychains/**",
+      "~/Library/Mail/**",
+      "//usr/local/Cellar/**",
+      "//opt/homebrew/**",
+      "./.env",
+      "./.env.*",
+      "./secrets/**",
+      "./config/credentials.json"
+    ],
+    "deny_edit": [
+      "//System/**",
+      "//Library/**",
+      "//bin/**",
+      "//sbin/**",
+      "//usr/**",
+      "//etc/**",
+      "//var/**",
+      "//private/**",
+      "//tmp/**",
+      "//opt/**",
+      "~/.ssh/**",
+      "~/.aws/**",
+      "~/.config/gcloud/**",
+      "~/.docker/**",
+      "~/.kube/**",
+      "~/.npmrc",
+      "~/.gitconfig",
+      "~/.zshrc",
+      "~/.bashrc",
+      "~/.bash_profile",
+      "~/.zprofile",
+      "~/Library/Safari/**",
+      "~/Library/Application Support/Google/Chrome/**",
+      "~/Library/Keychains/**",
+      "~/Library/Mail/**",
+      "//usr/local/Cellar/**",
+      "//opt/homebrew/**",
+      "./.env",
+      "./.env.*",
+      "./secrets/**",
+      "./config/credentials.json"
+    ]
+  },
+  "claude_code": {
+    "default_mode": "acceptEdits",
+    "disable_bypass_permissions_mode": "disable",
+    "additional_directories": [],
+    "enabled_plugins": {
+      "code-review@claude-code-plugins": true,
+      "frontend-design@claude-code-plugins": true,
+      "commit-commands@claude-code-plugins": true
+    },
+    "local_overrides": {
+      "ask_bash": [
+        "git push *",
+        "docker-compose down *"
+      ],
+      "additional_directories": []
+    }
+  },
+  "antigravity": {
+    "editor_settings": {
+      "autonomy_level": "balanced",
+      "require_approval": {
+        "destructive_shell": true,
+        "git_write": true,
+        "filesystem_delete": true
+      },
+      "blocked_tool_groups": [
+        "system-admin",
+        "credential-files"
+      ]
+    }
+  },
+  "codex": {
+    "runtime_policy": {
+      "sandbox_mode": "workspace-write",
+      "network_access": "restricted",
+      "git_write_actions": "ask",
+      "destructive_shell": "deny",
+      "global_package_installs": "deny"
+    }
+  }
+}