Skip to content

Release 1.7.1: Personal profile enforcement and proxy env improvements #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
CCimen merged 1 commit into from
Jan 22, 2026
Merged

Release 1.7.1: Personal profile enforcement and proxy env improvements #93

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
227 changes: 227 additions & 0 deletions examples/11-release-readiness-org.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,227 @@
{
"$schema": "../src/scc_cli/schemas/org-v1.schema.json",
"schema_version": "1.0.0",
"min_cli_version": "1.7.0",
"organization": {
"name": "Release Readiness Org",
"id": "release-readiness-org",
"contact": "platform@example.com"
},
"marketplaces": {
"official-plugins": {
"source": "github",
"owner": "CCimen",
"repo": "sandboxed-code-plugins",
"branch": "main",
"path": "/"
}
},
"security": {
"blocked_plugins": [
"*-experimental",
"*-deprecated",
"malicious-*",
"untrusted-*"
],
"blocked_mcp_servers": [
"*.untrusted.com",
"evil-*",
"localhost:*"
],
"allow_stdio_mcp": false,
"allowed_stdio_prefixes": [
"/usr/local/bin",
"/opt/approved-tools"
],
"safety_net": {
"action": "block",
"block_force_push": true,
"block_reset_hard": true,
"block_branch_force_delete": true,
"block_checkout_restore": true,
"block_clean": true,
"block_stash_destructive": true
}
},
"defaults": {
"enabled_plugins": [
"scc-safety-net@official-plugins"
],
"disabled_plugins": [
"legacy-tools@official-plugins"
],
"allowed_plugins": [
"*@official-plugins"
],
"allowed_mcp_servers": [
"https://mcp.context7.com/*",
"https://mcp.mermaid.ai/*",
"https://www.shadcn.io/*",
"https://mcp.internal.example.com/*",
"mcp.context7.com",
"mcp.mermaid.ai",
"www.shadcn.io",
"mcp.internal.example.com",
"/usr/local/bin/*"
],
"extra_marketplaces": [
"official-plugins"
],
"cache_ttl_hours": 24,
"network_policy": "corp-proxy-only",
"session": {
"timeout_hours": 12,
"auto_resume": true
}
},
"delegation": {
"teams": {
"allow_additional_plugins": [
"*"
],
"allow_additional_mcp_servers": [
"*"
]
},
"projects": {
"inherit_team_delegation": true
}
},
"profiles": {
"platform": {
"description": "Platform engineering tools and core MCP access",
"additional_plugins": [
"platform-tooling@official-plugins",
"infra-helper@official-plugins"
],
"additional_mcp_servers": [
{
"name": "context7",
"type": "http",
"url": "https://mcp.context7.com/mcp",
"headers": {
"X-API-Key": "${CONTEXT7_API_KEY}"
}
}
],
"network_policy": "corp-proxy-only",
"delegation": {
"allow_project_overrides": false
}
},
"frontend": {
"description": "Frontend team with design and UI MCP servers",
"additional_plugins": [
"frontend-toolkit@official-plugins",
"ui-kit@official-plugins"
],
"additional_mcp_servers": [
{
"name": "shadcn",
"type": "http",
"url": "https://www.shadcn.io/api/mcp"
},
{
"name": "mermaid-mcp",
"type": "sse",
"url": "https://mcp.mermaid.ai/sse"
}
],
"network_policy": "unrestricted",
"delegation": {
"allow_project_overrides": true
}
},
"backend": {
"description": "Backend services team with internal API MCP",
"additional_plugins": [
"backend-tooling@official-plugins"
],
"additional_mcp_servers": [
{
"name": "internal-api",
"type": "http",
"url": "https://mcp.internal.example.com/backend",
"headers": {
"Authorization": "Bearer ${INTERNAL_API_TOKEN}"
}
}
],
"network_policy": "corp-proxy-only",
"session": {
"timeout_hours": 10,
"auto_resume": false
},
"delegation": {
"allow_project_overrides": true
}
},
"data": {
"description": "Data team with catalog MCP and longer sessions",
"additional_plugins": [
"data-tooling@official-plugins",
"notebook-helper@official-plugins"
],
"additional_mcp_servers": [
{
"name": "data-catalog",
"type": "http",
"url": "https://mcp.internal.example.com/data"
}
],
"network_policy": "corp-proxy-only",
"session": {
"timeout_hours": 24,
"auto_resume": true
},
"delegation": {
"allow_project_overrides": true
}
},
"browser-automation": {
"description": "Browser automation team using Playwright MCP",
"additional_plugins": [
"browser-tools@official-plugins"
],
"additional_mcp_servers": [
{
"name": "playwright",
"type": "stdio",
"command": "/usr/local/bin/npx",
"args": [
"@playwright/mcp@latest"
],
"env": {
"PLAYWRIGHT_BROWSERS_PATH": "${HOME}/.cache/ms-playwright"
}
}
],
"network_policy": "isolated",
"delegation": {
"allow_project_overrides": false
}
},
"security": {
"description": "Security team with scanning tools and isolated network policy",
"additional_plugins": [
"security-audit@official-plugins"
],
"additional_mcp_servers": [
{
"name": "sec-scan",
"type": "http",
"url": "https://mcp.internal.example.com/security"
}
],
"network_policy": "isolated",
"delegation": {
"allow_project_overrides": false
}
}
},
"stats": {
"enabled": true,
"user_identity_mode": "hash",
"retention_days": 90
}
}
2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ build-backend = "hatchling.build"

[project]
name = "scc-cli"
version = "1.7.0"
version = "1.7.1"
description = "Run Claude Code in Docker sandboxes with team configs and git worktree support"
readme = "README.md"
license = "MIT"
Expand Down
34 changes: 30 additions & 4 deletions src/scc_cli/application/launch/apply_personal_profile.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,16 @@

from __future__ import annotations

from dataclasses import dataclass
from dataclasses import dataclass, field
from pathlib import Path
from typing import Any

from scc_cli.application.interaction_requests import ConfirmRequest
from scc_cli.application.personal_profile_policy import (
ProfilePolicySkip,
filter_personal_profile_mcp,
filter_personal_profile_settings,
)
from scc_cli.ports.personal_profile_service import PersonalProfileService


Expand Down Expand Up @@ -35,11 +41,13 @@ class ApplyPersonalProfileRequest:
workspace_path: Path to the workspace.
interactive_allowed: Whether the UI may prompt for confirmation.
confirm_apply: Optional confirmation response when prompted.
org_config: Optional org config for security enforcement.
"""

workspace_path: Path
interactive_allowed: bool
confirm_apply: bool | None = None
org_config: dict[str, Any] | None = None


@dataclass(frozen=True)
Expand Down Expand Up @@ -74,11 +82,13 @@ class ApplyPersonalProfileResult:
profile_id: Identifier for the profile, if one exists.
applied: Whether the profile was applied.
message: Optional message to render at the edge.
skipped_items: Items skipped due to org security policy.
"""

profile_id: str | None
applied: bool
message: str | None = None
skipped_items: list[ProfilePolicySkip] = field(default_factory=list)


ApplyPersonalProfileOutcome = ApplyPersonalProfileConfirmation | ApplyPersonalProfileResult
Expand Down Expand Up @@ -162,15 +172,30 @@ def apply_personal_profile(
existing_settings = existing_settings or {}
existing_mcp = existing_mcp or {}

profile_settings = profile.settings or {}
profile_mcp = profile.mcp or {}
policy_skips: list[ProfilePolicySkip] = []
if request.org_config:
profile_settings, skipped_plugins = filter_personal_profile_settings(
profile_settings,
request.org_config,
)
profile_mcp, skipped_mcps = filter_personal_profile_mcp(
profile_mcp,
request.org_config,
)
policy_skips.extend(skipped_plugins)
policy_skips.extend(skipped_mcps)

merged_settings = dependencies.profile_service.merge_personal_settings(
request.workspace_path,
existing_settings,
profile.settings or {},
profile_settings,
)
merged_mcp = dependencies.profile_service.merge_personal_mcp(existing_mcp, profile.mcp or {})
merged_mcp = dependencies.profile_service.merge_personal_mcp(existing_mcp, profile_mcp)

dependencies.profile_service.write_workspace_settings(request.workspace_path, merged_settings)
if profile.mcp:
if profile_mcp:
dependencies.profile_service.write_workspace_mcp(request.workspace_path, merged_mcp)

dependencies.profile_service.save_applied_state(
Expand All @@ -183,4 +208,5 @@ def apply_personal_profile(
profile_id=profile.profile_id,
applied=True,
message="[green]Applied personal profile.[/green]",
skipped_items=policy_skips,
)
Loading
Loading