Skip to content

Commit 34ab92c

Browse files
katarzyna-koltun-mxkatarzyna-koltun-mx
authored
Merge branch 'development' into clarify-azure-licensing-multiple-clusters
2 parents 02ff8e0 + 83ba1e2 commit 34ab92c

2,365 files changed

Lines changed: 83708 additions & 31688 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.claude/hooks/audit-log.sh‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/usr/bin/env bash
2+
# audit-log.sh — Post-execution hook
3+
#
4+
# Logs every tool invocation to .claude/audit.log.
5+
# This hook never blocks execution (always exits 0).
6+
#
7+
# IMPORTANT: Do not modify, disable, or bypass this hook.
8+
9+
set -uo pipefail
10+
11+
# ---------------------------------------------------------------------------
12+
# 1. Read hook input from stdin
13+
# ---------------------------------------------------------------------------
14+
INPUT="$(cat)"
15+
16+
TOOL_NAME="$(printf '%s' "$INPUT" | jq -r '.tool_name // "unknown"' 2>/dev/null || echo "unknown")"
17+
18+
COMMAND="$(printf '%s' "$INPUT" | jq -r '.tool_input.command // ""' 2>/dev/null || echo "")"
19+
20+
# ---------------------------------------------------------------------------
21+
# 2. Determine log file path (relative to project root)
22+
# ---------------------------------------------------------------------------
23+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
24+
LOG_FILE="$(dirname "$SCRIPT_DIR")/audit.log"
25+
26+
# ---------------------------------------------------------------------------
27+
# 3. Write log entry
28+
# ---------------------------------------------------------------------------
29+
TIMESTAMP="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
30+
31+
if [[ -n "$COMMAND" ]]; then
32+
printf '[%s] tool=%s command=%s\n' "$TIMESTAMP" "$TOOL_NAME" "$COMMAND" >> "$LOG_FILE" 2>/dev/null || true
33+
else
34+
printf '[%s] tool=%s\n' "$TIMESTAMP" "$TOOL_NAME" >> "$LOG_FILE" 2>/dev/null || true
35+
fi
36+
37+
# Never block execution
38+
exit 0

‎.claude/hooks/validate-bash-command.sh‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
#!/usr/bin/env bash
2+
# validate-bash-command.sh — Pre-execution hook (Layer 3 guardrail)
3+
#
4+
# Claude Code invokes this hook before every Bash tool call.
5+
# Input: JSON on stdin {"tool_name":"Bash","tool_input":{"command":"..."}}
6+
# Output: exit 0 to allow, exit 2 with JSON {"error":"..."} to block.
7+
#
8+
# IMPORTANT: Do not modify, disable, or bypass this hook.
9+
10+
set -euo pipefail
11+
12+
# ---------------------------------------------------------------------------
13+
# 1. Read hook input from stdin and extract the command
14+
# ---------------------------------------------------------------------------
15+
INPUT="$(cat)"
16+
17+
TOOL_NAME="$(printf '%s' "$INPUT" | jq -r '.tool_name // ""' 2>/dev/null || true)"
18+
19+
# Only validate Bash commands — allow everything else through.
20+
# If TOOL_NAME is empty (parse failure), fall through to check the command anyway (fail closed).
21+
if [[ -n "$TOOL_NAME" && "$TOOL_NAME" != "Bash" ]]; then
22+
exit 0
23+
fi
24+
25+
COMMAND="$(printf '%s' "$INPUT" | jq -r '.tool_input.command // ""' 2>/dev/null || true)"
26+
27+
if [[ -z "$COMMAND" ]]; then
28+
exit 0
29+
fi
30+
31+
# ---------------------------------------------------------------------------
32+
# 2. Blocked patterns — glob-style matching
33+
# Each pattern is checked against the full command string (case-insensitive).
34+
# ---------------------------------------------------------------------------
35+
BLOCKED_PATTERNS=(
36+
# AWS — Destructive operations
37+
"aws * delete*"
38+
"aws * remove*"
39+
"aws * destroy*"
40+
"aws * terminate*"
41+
"aws * deregister*"
42+
"aws * purge*"
43+
"aws s3 rm *"
44+
"aws s3 rb *"
45+
"aws cloudformation delete-stack*"
46+
47+
# AWS — Provisioning & scaling
48+
"aws ec2 run-instances*"
49+
"aws ec2 stop-instances*"
50+
"aws autoscaling set-desired-capacity*"
51+
"aws autoscaling update-auto-scaling-group*"
52+
"aws application-autoscaling *"
53+
"aws ecs update-service*"
54+
55+
# AWS — IAM
56+
"aws iam delete*"
57+
"aws iam create*"
58+
"aws iam put*"
59+
"aws iam attach*"
60+
61+
# Kubernetes — Mutations
62+
"kubectl delete *"
63+
"kubectl apply *"
64+
"kubectl create *"
65+
"kubectl patch *"
66+
"kubectl scale *"
67+
"kubectl rollout *"
68+
"kubectl drain *"
69+
"kubectl cordon *"
70+
"kubectl exec *"
71+
"kubectl edit *"
72+
73+
# Terraform / IaC
74+
"terraform destroy*"
75+
"terraform apply*"
76+
"terraform import *"
77+
"terraform state rm *"
78+
"terraform taint *"
79+
80+
# Helm
81+
"helm install *"
82+
"helm upgrade *"
83+
"helm delete *"
84+
"helm uninstall *"
85+
"helm rollback *"
86+
87+
# Git — Destructive
88+
"git push --force*"
89+
"git push -f *"
90+
"git push --force-with-lease*"
91+
"git push origin main*"
92+
"git push origin master*"
93+
"git reset --hard*"
94+
"git clean -f*"
95+
96+
# File system — Destructive
97+
"rm -rf /"
98+
"rm -rf /*"
99+
"rm -rf ~"
100+
"rm -rf ~/*"
101+
"rm -rf ..*"
102+
"mkfs.*"
103+
"dd if=*/dev/*"
104+
105+
# Credential access via cat/less/head/tail
106+
"cat */.aws/*"
107+
"cat */.kube/*"
108+
"cat */.ssh/*"
109+
"cat *.env"
110+
"cat *.env.*"
111+
"cat */secrets/*"
112+
"cat *credentials*"
113+
"less */.aws/*"
114+
"less */.ssh/*"
115+
"head */.aws/*"
116+
"head */.ssh/*"
117+
"tail */.aws/*"
118+
"tail */.ssh/*"
119+
120+
# Network & remote access
121+
"ssh *"
122+
"scp *"
123+
"curl *|*sh"
124+
"curl *|*bash"
125+
"wget *|*sh"
126+
"wget *|*bash"
127+
128+
# Privilege escalation
129+
"sudo *"
130+
"sudo"
131+
"chmod 777 *"
132+
"chown root *"
133+
)
134+
135+
# ---------------------------------------------------------------------------
136+
# 3. Check function — matches a single sub-command against all patterns
137+
# ---------------------------------------------------------------------------
138+
check_command() {
139+
local cmd="$1"
140+
# Trim leading/trailing whitespace using parameter expansion
141+
cmd="${cmd#"${cmd%%[![:space:]]*}"}"
142+
cmd="${cmd%"${cmd##*[![:space:]]}"}"
143+
144+
if [[ -z "$cmd" ]]; then
145+
return 0
146+
fi
147+
148+
# Convert to lowercase using parameter expansion
149+
local cmd_lower="${cmd,,}"
150+
151+
for pattern in "${BLOCKED_PATTERNS[@]}"; do
152+
local pattern_lower="${pattern,,}"
153+
154+
# shellcheck disable=SC2254
155+
if [[ "$cmd_lower" == $pattern_lower ]]; then
156+
printf '{"error":"BLOCKED by guardrail hook: command matches blocked pattern: %s"}\n' "$pattern" >&2
157+
exit 2
158+
fi
159+
done
160+
161+
return 0
162+
}
163+
164+
# ---------------------------------------------------------------------------
165+
# 4. Split on pipes and command chains, then check each sub-command
166+
# ---------------------------------------------------------------------------
167+
# Replace common chain operators with newlines using parameter expansion
168+
# Order matters: replace && and || before | to avoid double-splitting ||
169+
NORMALIZED="${COMMAND//&&/$'\n'}"
170+
NORMALIZED="${NORMALIZED//||/$'\n'}"
171+
NORMALIZED="${NORMALIZED//;/$'\n'}"
172+
NORMALIZED="${NORMALIZED//|/$'\n'}"
173+
174+
while IFS= read -r subcmd; do
175+
check_command "$subcmd"
176+
done <<< "$NORMALIZED"
177+
178+
# If we reach here, the command is allowed
179+
exit 0

‎.claude/rules/aws.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# AWS Rules
2+
3+
## Environment Context
4+
5+
- We use **AWS Bedrock** for AI model invocation
6+
- Sandbox accounts are accessed via **Mendix SSO**
7+
- **Production accounts exist on the same machine** — DO NOT use them
8+
- If a command references an AWS profile or region you don't recognize, STOP and ask
9+
10+
## Credential Safety
11+
12+
- NEVER read files in `~/.aws/` (credentials, config, SSO cache)
13+
- NEVER output or display AWS access keys, secret keys, or session tokens
14+
- NEVER set or export `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, or `AWS_SESSION_TOKEN` in commands
15+
- If you need to verify identity, use `aws sts get-caller-identity` — this is safe and read-only
16+
17+
## Allowed Operations (Read-Only)
18+
19+
These AWS CLI commands are safe and auto-approved:
20+
21+
- `aws * describe*` — describe any resource
22+
- `aws * list*` — list any resources
23+
- `aws * get*` — get resource details
24+
- `aws s3 ls` — list S3 buckets and objects
25+
- `aws sts get-caller-identity` — verify current identity
26+
27+
## Blocked Operations
28+
29+
### Destructive (deny — never allowed)
30+
- `aws * delete*`, `aws * remove*`, `aws * destroy*`, `aws * terminate*`
31+
- `aws * deregister*`, `aws * purge*`
32+
- `aws s3 rm`, `aws s3 rb`
33+
- `aws cloudformation delete-stack`
34+
35+
### Provisioning & Scaling (deny — never allowed)
36+
- `aws ec2 run-instances`, `aws ec2 stop-instances`
37+
- `aws autoscaling set-desired-capacity`, `aws autoscaling update-auto-scaling-group`
38+
- `aws application-autoscaling *`
39+
- `aws ecs update-service`
40+
41+
### IAM (deny — never allowed)
42+
- `aws iam create*`, `aws iam delete*`, `aws iam put*`, `aws iam attach*`
43+
44+
## Verification Steps
45+
46+
Before running any AWS command:
47+
48+
1. **Check the profile** — is this a sandbox account? If unsure, run `aws sts get-caller-identity` first
49+
2. **Check the region** — is this an expected region? If it looks unfamiliar, ask the user
50+
3. **Check the action** — is this read-only? If it mutates state, do NOT run it
51+
4. **When in doubt** — explain the command and let the human decide

‎.claude/rules/security.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Security Rules
2+
3+
These rules are loaded automatically by Claude Code at session start. They are non-negotiable.
4+
5+
## Safety Rules (NON-NEGOTIABLE)
6+
7+
1. NEVER run commands that delete, destroy, or modify production resources
8+
2. NEVER use AWS credentials for production accounts — only sandbox accounts
9+
3. NEVER deploy code, infrastructure, or configuration changes — a human must do this
10+
4. NEVER run `terraform apply`, `terraform destroy`, `kubectl apply`, `kubectl delete` against production
11+
5. NEVER read or output secrets, API keys, tokens, or credentials from files or environment variables
12+
6. NEVER run commands with `sudo`
13+
7. NEVER run `rm -rf` on any path outside the current project directory
14+
8. NEVER disable, bypass, or modify the guardrail hooks in `.claude/hooks/`
15+
9. NEVER push to `main` or `master` branches directly
16+
17+
## Core Principles
18+
19+
- **The agent works FOR you** — it must never take irreversible actions without explicit human approval
20+
- **Deny by default** — if a command is not explicitly allowed, it should require human confirmation
21+
- **Credentials are off-limits** — never read, display, or transmit secrets, tokens, or credentials
22+
- **Guardrails are mandatory** — the `.claude/hooks/` scripts must remain active and unmodified
23+
24+
## When In Doubt
25+
26+
If you are unsure whether a command is safe to run, **do not run it**. Instead:
27+
1. Explain what command you would run and why
28+
2. Describe the potential risks
29+
3. Wait for the human to decide
30+
31+
It is always better to ask than to act when safety is uncertain.

‎.claude/scripts/README.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Claude Helper Scripts
2+
3+
Utility scripts to support Claude Code when working with this documentation repository.
4+
5+
## resolve-doc-url.sh
6+
7+
Resolves a documentation URL to its source markdown file.
8+
9+
### Usage
10+
11+
```bash
12+
.claude/scripts/resolve-doc-url.sh "/path/to/page/"
13+
```
14+
15+
### Examples
16+
17+
```bash
18+
# Find the file for a specific URL
19+
.claude/scripts/resolve-doc-url.sh "/community-tools/contribute-to-mendix-docs/"
20+
# Output: content/en/docs/community-tools/contribute-to-mendix-docs/_index.md
21+
22+
# Check if a URL exists
23+
.claude/scripts/resolve-doc-url.sh "/some/page/"
24+
# Exit code 0 if found, 1 if not found
25+
```
26+
27+
### Benefits
28+
29+
- **Fast**: Uses grep optimized for file-only output
30+
- **Token-efficient**: Returns only the file path, no surrounding context
31+
- **Reliable**: Matches exact URL in front matter using fixed-string search
32+
33+
### When to Use
34+
35+
- Following cross-references between documentation pages
36+
- Validating internal links
37+
- Finding files by their published URL
38+
- Checking if a URL is already in use

‎.claude/scripts/resolve-doc-url.sh‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/bin/bash
2+
# Resolve a documentation URL to its source markdown file
3+
# Usage: resolve-doc-url.sh "/url/path/"
4+
5+
if [ -z "$1" ]; then
6+
echo "Usage: resolve-doc-url.sh <url>"
7+
echo "Example: resolve-doc-url.sh '/community-tools/contribute-to-mendix-docs/'"
8+
exit 1
9+
fi
10+
11+
# Search for the URL in front matter
12+
# Using grep with -l (files only) and -F (fixed string) for speed
13+
grep -rl --include="*.md" "^url: $1$" content/en/docs/
14+
15+
# Exit code 0 if found, 1 if not found

0 commit comments

Comments
 (0)