chore(claude): security hardening — dangerous-commands hook, settings в git, restricted DB, throttle #2150

Merged

lekss361 merged 3 commits from chore/claude-security-hardening into main

2026-07-02 15:23:12 +00:00

Author	SHA1	Message	Date
bot-backend	4ecb639492	fix(claude-hooks): review fixes — git -C variant, main-hotfix false positive, known-bypass docstring All checks were successful CI / changes (pull_request) Successful in 7s Details CI / backend-tests (pull_request) Has been skipped Details CI / frontend-tests (pull_request) Has been skipped Details CI / openapi-codegen-check (pull_request) Has been skipped Details	2026-07-02 18:22:10 +03:00
bot-backend	0bbfd0e13e	fix(claude-hooks): strip commit-message contents before pattern match (false positive)	2026-07-02 18:15:50 +03:00
bot-backend	4a33347aee	chore(claude): security hardening — hooks/settings в git, dangerous-commands hook, restricted DB для reviewer/qa - .claude/settings.json закоммичен (секретов нет): бот-окна и чистые checkout получают hooks/deny/statusLine вместо молчаливого их отсутствия - новый PreToolUse hook check-dangerous-commands.py: ловит force/amend/no-verify/ rm -rf/reset --hard/push в main И внутри powershell-обёрток (deny-префиксы позиционны); 24/24 тест-кейсов; + Read-deny **/.env - postgres MCP reviewer/qa → --access-mode=restricted (декларируемый read-only теперь enforced, не проза) - auto-analyst: принята throttle-политика ready>=10 (конфликт с work-as-analyst устранён, just-in-time нарезка) - defaultMode:auto перенесён на project-уровень (глобально снят — balance_platform вернулся к обычным промптам)	2026-07-02 18:10:26 +03:00

Author

SHA1

Message

Date

bot-backend

4ecb639492

fix(claude-hooks): review fixes — git -C variant, main-hotfix false positive, known-bypass docstring

CI / changes (pull_request) Successful in 7s

Details

CI / backend-tests (pull_request) Has been skipped

Details

CI / frontend-tests (pull_request) Has been skipped

Details

CI / openapi-codegen-check (pull_request) Has been skipped

Details

2026-07-02 18:22:10 +03:00

bot-backend

0bbfd0e13e

fix(claude-hooks): strip commit-message contents before pattern match (false positive)

2026-07-02 18:15:50 +03:00

bot-backend

4a33347aee

chore(claude): security hardening — hooks/settings в git, dangerous-commands hook, restricted DB для reviewer/qa

- .claude/settings.json закоммичен (секретов нет): бот-окна и чистые checkout
  получают hooks/deny/statusLine вместо молчаливого их отсутствия
- новый PreToolUse hook check-dangerous-commands.py: ловит force/amend/no-verify/
  rm -rf/reset --hard/push в main И внутри powershell-обёрток (deny-префиксы позиционны);
  24/24 тест-кейсов; + Read-deny **/.env
- postgres MCP reviewer/qa → --access-mode=restricted (декларируемый read-only
  теперь enforced, не проза)
- auto-analyst: принята throttle-политика ready>=10 (конфликт с work-as-analyst устранён,
  just-in-time нарезка)
- defaultMode:auto перенесён на project-уровень (глобально снят — balance_platform
  вернулся к обычным промптам)

2026-07-02 18:10:26 +03:00