scc-cli 1.5.3__py3-none-any.whl

scc_cli/schemas/org-v1.schema.json

@@ -0,0 +1,456 @@
+{
+    "$schema": "http://json-schema.org/draft-07/schema#",
+    "$id": "https://scc-cli.dev/schemas/org-v1.json",
+    "title": "SCC Organization Config v1",
+    "description": "Schema for SCC organization configuration files with governance features. Supports Phase 2 federated team configs.",
+    "type": "object",
+    "$defs": {
+        "ConfigSource": {
+            "description": "Discriminated union for team config source types (no directory for security)",
+            "oneOf": [
+                {"$ref": "#/$defs/ConfigSourceGitHub"},
+                {"$ref": "#/$defs/ConfigSourceGit"},
+                {"$ref": "#/$defs/ConfigSourceURL"}
+            ]
+        },
+        "ConfigSourceGitHub": {
+            "type": "object",
+            "description": "GitHub repository config source for external team config files",
+            "properties": {
+                "source": {
+                    "type": "string",
+                    "const": "github",
+                    "description": "Source type discriminator"
+                },
+                "owner": {
+                    "type": "string",
+                    "pattern": "^[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?$",
+                    "description": "GitHub organization or user name"
+                },
+                "repo": {
+                    "type": "string",
+                    "pattern": "^[a-zA-Z0-9._-]+$",
+                    "description": "GitHub repository name"
+                },
+                "branch": {
+                    "type": "string",
+                    "default": "main",
+                    "description": "Git branch to use"
+                },
+                "path": {
+                    "type": "string",
+                    "default": "",
+                    "description": "Path within repository to config file (empty string = repo root)"
+                },
+                "headers": {
+                    "type": "object",
+                    "additionalProperties": {"type": "string"},
+                    "description": "HTTP headers for authentication (supports ${VAR} expansion)"
+                }
+            },
+            "required": ["source", "owner", "repo"],
+            "additionalProperties": false
+        },
+        "ConfigSourceGit": {
+            "type": "object",
+            "description": "Generic Git repository config source for external team config files",
+            "properties": {
+                "source": {
+                    "type": "string",
+                    "const": "git",
+                    "description": "Source type discriminator"
+                },
+                "url": {
+                    "type": "string",
+                    "pattern": "^(https://|git@)",
+                    "description": "Git clone URL (HTTPS or SSH)"
+                },
+                "branch": {
+                    "type": "string",
+                    "default": "main",
+                    "description": "Git branch to use"
+                },
+                "path": {
+                    "type": "string",
+                    "default": "",
+                    "description": "Path within repository to config file (empty string = repo root)"
+                }
+            },
+            "required": ["source", "url"],
+            "additionalProperties": false
+        },
+        "ConfigSourceURL": {
+            "type": "object",
+            "description": "URL-based config source for external team config files (HTTPS only)",
+            "properties": {
+                "source": {
+                    "type": "string",
+                    "const": "url",
+                    "description": "Source type discriminator"
+                },
+                "url": {
+                    "type": "string",
+                    "pattern": "^https://",
+                    "description": "HTTPS URL to team config (HTTP forbidden)"
+                },
+                "headers": {
+                    "type": "object",
+                    "additionalProperties": {"type": "string"},
+                    "description": "HTTP headers for authentication (supports ${VAR} expansion)"
+                }
+            },
+            "required": ["source", "url"],
+            "additionalProperties": false
+        },
+        "TrustGrant": {
+            "type": "object",
+            "description": "Trust delegation from org to federated team",
+            "properties": {
+                "inherit_org_marketplaces": {
+                    "type": "boolean",
+                    "default": true,
+                    "description": "Whether team inherits org-level marketplace definitions"
+                },
+                "allow_additional_marketplaces": {
+                    "type": "boolean",
+                    "default": false,
+                    "description": "Whether team can define additional marketplaces"
+                },
+                "marketplace_source_patterns": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "default": [],
+                    "description": "URL patterns (with globstar) allowed for team marketplaces"
+                }
+            },
+            "additionalProperties": false
+        }
+    },
+    "properties": {
+        "$schema": {"type": "string", "description": "JSON Schema reference URL"},
+        "schema_version": {
+            "type": "string",
+            "pattern": "^1\\.[0-9]+\\.[0-9]+$",
+            "description": "Semantic version of this schema (must start with 1.x.x)"
+        },
+        "min_cli_version": {
+            "type": "string",
+            "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$",
+            "description": "Minimum SCC CLI version required to use this config"
+        },
+        "organization": {
+            "type": "object",
+            "description": "Organization identification",
+            "properties": {
+                "name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Display name of the organization"
+                },
+                "id": {
+                    "type": "string",
+                    "pattern": "^[a-z0-9-]+$",
+                    "description": "URL-safe organization identifier"
+                },
+                "contact": {
+                    "type": "string",
+                    "description": "Contact email or URL for the organization"
+                }
+            },
+            "required": ["name", "id"]
+        },
+        "security": {
+            "type": "object",
+            "description": "Hard security boundaries (NEVER overridable by teams or projects)",
+            "properties": {
+                "blocked_plugins": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Plugin patterns to block (supports fnmatch wildcards)"
+                },
+                "blocked_mcp_servers": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "fnmatch patterns to block MCP servers in SCC-managed config (org/team/project). Does NOT affect MCP servers bundled inside marketplace plugins."
+                },
+                "blocked_base_images": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Docker base image patterns to block (supports fnmatch wildcards)"
+                },
+                "allow_stdio_mcp": {
+                    "type": "boolean",
+                    "default": false,
+                    "description": "Whether stdio-type MCP servers are allowed. Disabled by default because stdio servers have elevated privileges (mounted workspace, network, tokens)."
+                },
+                "allowed_stdio_prefixes": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Absolute path prefixes where stdio commands must reside. If not set, any absolute path is allowed (when allow_stdio_mcp is true). Uses realpath + commonpath for secure validation."
+                },
+                "safety_net": {
+                    "type": "object",
+                    "description": "Configuration for scc-safety-net plugin (blocks destructive git commands)",
+                    "properties": {
+                        "action": {
+                            "type": "string",
+                            "enum": ["block", "warn", "allow"],
+                            "default": "block",
+                            "description": "Action mode: block (stop execution), warn (show warning but allow), allow (no checks)"
+                        },
+                        "block_force_push": {
+                            "type": "boolean",
+                            "default": true,
+                            "description": "Block git push --force and +refspec force pushes"
+                        },
+                        "block_reset_hard": {
+                            "type": "boolean",
+                            "default": true,
+                            "description": "Block git reset --hard (destroys uncommitted changes)"
+                        },
+                        "block_branch_force_delete": {
+                            "type": "boolean",
+                            "default": true,
+                            "description": "Block git branch -D (force delete without merge check)"
+                        },
+                        "block_checkout_restore": {
+                            "type": "boolean",
+                            "default": true,
+                            "description": "Block git checkout -- <file> and git restore <file> (discards file changes)"
+                        },
+                        "block_clean": {
+                            "type": "boolean",
+                            "default": true,
+                            "description": "Block git clean -f (deletes untracked files)"
+                        },
+                        "block_stash_destructive": {
+                            "type": "boolean",
+                            "default": true,
+                            "description": "Block git stash drop/clear (permanently loses stashed work)"
+                        }
+                    },
+                    "additionalProperties": false
+                }
+            },
+            "additionalProperties": false
+        },
+        "defaults": {
+            "type": "object",
+            "description": "Default settings (baseline, can be extended if delegated)",
+            "properties": {
+                "allowed_plugins": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Default allowed plugins (can be extended by teams)"
+                },
+                "allowed_mcp_servers": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Default allowed MCP server patterns"
+                },
+                "enabled_plugins": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Baseline enabled plugins for all teams (plugin@marketplace format)"
+                },
+                "disabled_plugins": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Plugins explicitly disabled (overrides enabled_plugins)"
+                },
+                "extra_marketplaces": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Additional marketplace names to include (references top-level marketplaces)"
+                },
+                "cache_ttl_hours": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 168,
+                    "default": 24,
+                    "description": "Organization config cache TTL in hours (1-168, default 24)"
+                },
+                "network_policy": {
+                    "type": "string",
+                    "enum": ["corp-proxy-only", "unrestricted", "isolated"],
+                    "description": "Network access policy"
+                },
+                "session": {
+                    "type": "object",
+                    "properties": {
+                        "timeout_hours": {
+                            "type": "integer",
+                            "minimum": 1,
+                            "maximum": 24,
+                            "description": "Session timeout in hours (1-24)"
+                        },
+                        "auto_resume": {
+                            "type": "boolean",
+                            "description": "Whether sessions can be automatically resumed"
+                        }
+                    },
+                    "additionalProperties": false
+                }
+            },
+            "additionalProperties": false
+        },
+        "delegation": {
+            "type": "object",
+            "description": "Delegation rules controlling what teams/projects can add",
+            "properties": {
+                "teams": {
+                    "type": "object",
+                    "description": "What teams are allowed to add",
+                    "properties": {
+                        "allow_additional_plugins": {
+                            "type": "array",
+                            "items": {"type": "string"},
+                            "description": "Plugin patterns teams can add (use ['*'] for unrestricted)"
+                        },
+                        "allow_additional_mcp_servers": {
+                            "type": "array",
+                            "items": {"type": "string"},
+                            "description": "Team names or patterns that can add MCP servers"
+                        },
+                        "allow_network_override": {
+                            "type": "array",
+                            "items": {"type": "string"},
+                            "description": "Network policies teams can override to"
+                        }
+                    },
+                    "additionalProperties": false
+                },
+                "projects": {
+                    "type": "object",
+                    "description": "Project-level delegation settings",
+                    "properties": {
+                        "inherit_team_delegation": {
+                            "type": "boolean",
+                            "description": "Whether teams can delegate to projects (master switch)"
+                        }
+                    },
+                    "additionalProperties": false
+                }
+            },
+            "additionalProperties": false
+        },
+        "profiles": {
+            "type": "object",
+            "description": "Team profiles with configurations and delegation settings",
+            "additionalProperties": {
+                "type": "object",
+                "properties": {
+                    "description": {
+                        "type": "string",
+                        "description": "Human-readable description of this team profile"
+                    },
+                    "additional_plugins": {
+                        "type": "array",
+                        "items": {"type": "string"},
+                        "description": "Additional plugins enabled for this team"
+                    },
+                    "additional_mcp_servers": {
+                        "type": "array",
+                        "items": {
+                            "type": "object",
+                            "properties": {
+                                "name": {"type": "string", "description": "MCP server name"},
+                                "type": {
+                                    "type": "string",
+                                    "enum": ["sse", "stdio", "http"],
+                                    "description": "MCP server connection type (sse, stdio, or http)"
+                                },
+                                "url": {
+                                    "type": "string",
+                                    "format": "uri",
+                                    "description": "MCP server URL (required for sse and http types)"
+                                },
+                                "command": {
+                                    "type": "string",
+                                    "description": "Command to run (required for stdio type)"
+                                },
+                                "args": {
+                                    "type": "array",
+                                    "items": {"type": "string"},
+                                    "description": "Command arguments (for stdio type)"
+                                },
+                                "env": {
+                                    "type": "object",
+                                    "additionalProperties": {"type": "string"},
+                                    "description": "Environment variables for stdio type (values can use ${VAR} syntax)"
+                                },
+                                "headers": {
+                                    "type": "object",
+                                    "additionalProperties": {"type": "string"},
+                                    "description": "HTTP headers for sse/http types (values can use ${VAR} syntax)"
+                                }
+                            },
+                            "required": ["name", "type"],
+                            "oneOf": [
+                                {"properties": {"type": {"const": "sse"}}, "required": ["url"]},
+                                {"properties": {"type": {"const": "http"}}, "required": ["url"]},
+                                {"properties": {"type": {"const": "stdio"}}, "required": ["command"]}
+                            ]
+                        },
+                        "description": "Additional MCP servers for this team"
+                    },
+                    "network_policy": {
+                        "type": "string",
+                        "enum": ["corp-proxy-only", "unrestricted", "isolated"],
+                        "description": "Override network policy for this team"
+                    },
+                    "session": {
+                        "type": "object",
+                        "properties": {
+                            "timeout_hours": {"type": "integer", "minimum": 1, "maximum": 24},
+                            "auto_resume": {"type": "boolean"}
+                        },
+                        "additionalProperties": false
+                    },
+                    "delegation": {
+                        "type": "object",
+                        "description": "Team-level delegation to projects",
+                        "properties": {
+                            "allow_project_overrides": {
+                                "type": "boolean",
+                                "description": "Whether projects can add to this team's config"
+                            }
+                        },
+                        "additionalProperties": false
+                    },
+                    "config_source": {
+                        "$ref": "#/$defs/ConfigSource",
+                        "description": "External config source (if set, team is federated)"
+                    },
+                    "trust": {
+                        "$ref": "#/$defs/TrustGrant",
+                        "description": "Trust delegation controls for federated teams"
+                    }
+                }
+            }
+        },
+        "stats": {
+            "type": "object",
+            "description": "Usage statistics configuration",
+            "properties": {
+                "enabled": {
+                    "type": "boolean",
+                    "description": "Whether to collect usage statistics"
+                },
+                "user_identity_mode": {
+                    "type": "string",
+                    "enum": ["hash", "clear", "anonymous"],
+                    "description": "How to identify users in stats (hash=SHA256, clear=username, anonymous=no identifier)"
+                },
+                "retention_days": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 365,
+                    "description": "Number of days to retain stats (1-365)"
+                }
+            },
+            "additionalProperties": false
+        }
+    },
+    "required": ["schema_version", "organization"]
+}

scc_cli/schemas/team-config.v1.schema.json

@@ -0,0 +1,163 @@
+{
+    "$schema": "http://json-schema.org/draft-07/schema#",
+    "$id": "https://scc-cli.dev/schemas/team-config.v1.json",
+    "title": "SCC Team Config v1",
+    "description": "Schema for external team configuration files (Phase 2: Federated Team Configs)",
+    "type": "object",
+    "properties": {
+        "$schema": {
+            "type": "string",
+            "description": "JSON Schema reference URL"
+        },
+        "schema_version": {
+            "type": "integer",
+            "const": 1,
+            "description": "Schema version (must be 1)"
+        },
+        "enabled_plugins": {
+            "type": "array",
+            "items": {"type": "string"},
+            "default": [],
+            "description": "Plugins enabled by this team config (format: plugin-name@marketplace)"
+        },
+        "disabled_plugins": {
+            "type": "array",
+            "items": {"type": "string"},
+            "default": [],
+            "description": "Glob patterns for plugins to disable (removes from org defaults)"
+        },
+        "marketplaces": {
+            "type": "object",
+            "description": "Team-defined marketplace sources (key = marketplace name)",
+            "additionalProperties": {
+                "$ref": "#/$defs/MarketplaceSource"
+            },
+            "default": {}
+        }
+    },
+    "required": ["schema_version"],
+    "additionalProperties": false,
+    "$defs": {
+        "MarketplaceSource": {
+            "description": "Discriminated union for marketplace source types",
+            "oneOf": [
+                {"$ref": "#/$defs/MarketplaceSourceGitHub"},
+                {"$ref": "#/$defs/MarketplaceSourceGit"},
+                {"$ref": "#/$defs/MarketplaceSourceURL"},
+                {"$ref": "#/$defs/MarketplaceSourceDirectory"}
+            ]
+        },
+        "MarketplaceSourceGitHub": {
+            "type": "object",
+            "description": "GitHub repository marketplace source",
+            "properties": {
+                "source": {
+                    "type": "string",
+                    "const": "github",
+                    "description": "Source type discriminator"
+                },
+                "owner": {
+                    "type": "string",
+                    "pattern": "^[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?$",
+                    "description": "GitHub organization or user name"
+                },
+                "repo": {
+                    "type": "string",
+                    "pattern": "^[a-zA-Z0-9._-]+$",
+                    "description": "GitHub repository name"
+                },
+                "branch": {
+                    "type": "string",
+                    "default": "main",
+                    "description": "Git branch to use"
+                },
+                "path": {
+                    "type": "string",
+                    "default": "/",
+                    "description": "Path within repository to marketplace root"
+                },
+                "headers": {
+                    "type": "object",
+                    "additionalProperties": {"type": "string"},
+                    "description": "HTTP headers for authentication (supports ${VAR} expansion)"
+                }
+            },
+            "required": ["source", "owner", "repo"],
+            "additionalProperties": false
+        },
+        "MarketplaceSourceGit": {
+            "type": "object",
+            "description": "Generic Git repository marketplace source",
+            "properties": {
+                "source": {
+                    "type": "string",
+                    "const": "git",
+                    "description": "Source type discriminator"
+                },
+                "url": {
+                    "type": "string",
+                    "pattern": "^(https://|git@)",
+                    "description": "Git clone URL (HTTPS or SSH)"
+                },
+                "branch": {
+                    "type": "string",
+                    "default": "main",
+                    "description": "Git branch to use"
+                },
+                "path": {
+                    "type": "string",
+                    "default": "/",
+                    "description": "Path within repository to marketplace root"
+                }
+            },
+            "required": ["source", "url"],
+            "additionalProperties": false
+        },
+        "MarketplaceSourceURL": {
+            "type": "object",
+            "description": "URL-based marketplace source (HTTPS only)",
+            "properties": {
+                "source": {
+                    "type": "string",
+                    "const": "url",
+                    "description": "Source type discriminator"
+                },
+                "url": {
+                    "type": "string",
+                    "pattern": "^https://",
+                    "description": "HTTPS URL to marketplace manifest (HTTP forbidden)"
+                },
+                "headers": {
+                    "type": "object",
+                    "additionalProperties": {"type": "string"},
+                    "description": "HTTP headers for authentication (supports ${VAR} expansion)"
+                },
+                "materialization_mode": {
+                    "type": "string",
+                    "enum": ["self_contained", "metadata_only", "best_effort"],
+                    "default": "self_contained",
+                    "description": "How to fetch marketplace content"
+                }
+            },
+            "required": ["source", "url"],
+            "additionalProperties": false
+        },
+        "MarketplaceSourceDirectory": {
+            "type": "object",
+            "description": "Local directory marketplace source",
+            "properties": {
+                "source": {
+                    "type": "string",
+                    "const": "directory",
+                    "description": "Source type discriminator"
+                },
+                "path": {
+                    "type": "string",
+                    "description": "Local filesystem path (absolute or relative to org config)"
+                }
+            },
+            "required": ["source", "path"],
+            "additionalProperties": false
+        }
+    }
+}

scc_cli/services/__init__.py

@@ -0,0 +1 @@
+"""Services layer - domain logic separated from UI."""