Repository navigation
feat(governance): REQ-067 出厂治理内置化 —— 上游默认禁项零明文 - #156
Merged
Merged
Conversation
与 REQ-065 修订同一口径:alpha 原生行为封装,用户配置只放用户自己的东西。 customize-opencode 的出厂禁用不再以 permission.skill deny 明文写进 ~/.alpha/alpha.jsonc: - FACTORY_DENIED_SKILLS 内置清单;main 算 effective(清单 − 用户解禁)→ ALPHA_FACTORY_DENY_SKILLS(env)→ ext config hook 内存注入 permission deny + 键入兜底占位(set-if-absent,用户显式配置让位); - Governance.skills 加 allowFactory(解禁名单);normalize 把出厂项从 deny 收敛剔除(历史数据自愈);治理面板出厂项开关改走解禁语义; - boot 剥离存量明文(stripFactoryGovernanceLeaves:deny 叶 + 治理打底 + 占位指纹判定,用户自禁/自建同名不碰); - gov-read 返回 factoryDenied,菜单过滤读有效禁用集(用户禁 ∪ 出厂禁); - 顺手:来源徽标「导入」判定覆盖 imported-claude/agents(REQ-063 补漏)。 真机实测:重启后 alpha.jsonc 零 permission/占位明文(仅剩 mcp/agent 用户 内容 + skills 用户目录);菜单 customize-opencode 仍被过滤、graphify 仍被 default-deny 挡。 测试:strip 3 例 + governance 3 例 + ext factory-deny 3 例;全量 73+587 pass。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
用户拍板(2026-07-08,与 REQ-065 修订同一口径):出厂即禁的上游技能(customize-opencode)是产品内置行为,不该以
permission.skill: deny明文出现在用户配置里 ——~/.alpha/alpha.jsonc只放用户自己的东西。实现
FACTORY_DENIED_SKILLS;main 算 effective(清单 − 用户解禁)→ env → ext config hook 内存注入 deny + 键入兜底占位(set-if-absent);skills.allowFactory(用户解禁记录 —— 用户动作才进文件);面板出厂项开关走解禁语义;normalize 自愈历史 deny;factoryDenied,REQ-066 菜单过滤读有效禁用集;真机实测(本机 dev)
重启后
alpha.jsonc零治理明文(剩 mcp/agent 用户内容 + skills 用户目录一条);菜单 customize-opencode 仍被过滤,graphify 仍被 default-deny 挡。测试
新增 9 例;alpha-check 全绿(ext 73 + ui-mac 587)。
🤖 Generated with Claude Code