#!/usr/bin/env bash
# install.sh - Team Claude configuration installer.
#
# This example is intentionally conservative:
# - it never writes API keys or secrets;
# - it backs up existing editor config before copying files;
# - it installs only files that exist in the team config repository.
 
set -euo pipefail
 
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'
 
TEAM_CONFIG_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BACKUP_ROOT="${HOME}/.claude-config-backups"
BACKUP_DIR="${BACKUP_ROOT}/$(date +%Y%m%d-%H%M%S)"
 
log_info() {
    printf "%b[INFO]%b %s\n" "${GREEN}" "${NC}" "$1"
}
 
log_warn() {
    printf "%b[WARN]%b %s\n" "${YELLOW}" "${NC}" "$1"
}
 
log_error() {
    printf "%b[ERROR]%b %s\n" "${RED}" "${NC}" "$1" >&2
}
 
log_success() {
    printf "%b[SUCCESS]%b %s\n" "${BLUE}" "${NC}" "$1"
}
 
show_banner() {
    printf "%b" "${BLUE}"
    printf "================================================\n"
    printf "  Team Claude config installer\n"
    printf "================================================\n"
    printf "%b" "${NC}"
}
 
detect_os() {
    case "${OSTYPE:-unknown}" in
        linux-gnu*) OS="linux"; PLATFORM="Linux" ;;
        darwin*) OS="macos"; PLATFORM="macOS" ;;
        msys*|cygwin*) OS="windows"; PLATFORM="Windows (Git Bash)" ;;
        *)
            log_error "Unsupported OS: ${OSTYPE:-unknown}"
            exit 1
            ;;
    esac
 
    log_info "Detected platform: ${PLATFORM}"
}
 
check_dependencies() {
    log_info "Checking dependencies..."
 
    if ! command -v git >/dev/null 2>&1; then
        log_error "Git is required. Install Git first."
        exit 1
    fi
 
    if ! command -v claude >/dev/null 2>&1; then
        log_warn "Claude Code CLI was not found in PATH. Install it before using team workflows."
    fi
 
    if command -v node >/dev/null 2>&1; then
        log_info "Node.js: $(node --version)"
    else
        log_warn "Node.js was not found. JavaScript-related team scripts may not work."
    fi
}
 
resolve_editor_dirs() {
    case "${OS}" in
        linux)
            VSCODE_USER_DIR="${HOME}/.config/Code/User"
            CURSOR_USER_DIR="${HOME}/.config/Cursor/User"
            ;;
        macos)
            VSCODE_USER_DIR="${HOME}/Library/Application Support/Code/User"
            CURSOR_USER_DIR="${HOME}/Library/Application Support/Cursor/User"
            ;;
        windows)
            APPDATA_DIR="${APPDATA:-${HOME}/AppData/Roaming}"
            VSCODE_USER_DIR="${APPDATA_DIR}/Code/User"
            CURSOR_USER_DIR="${APPDATA_DIR}/Cursor/User"
            ;;
    esac
}
 
backup_dir_if_exists() {
    local src="$1"
    local name="$2"
 
    if [[ -d "${src}" ]]; then
        mkdir -p "${BACKUP_DIR}"
        cp -R "${src}" "${BACKUP_DIR}/${name}"
        log_info "Backed up ${src} -> ${BACKUP_DIR}/${name}"
    fi
}
 
backup_existing_config() {
    log_info "Backing up existing editor config..."
 
    backup_dir_if_exists "${VSCODE_USER_DIR}" "vscode-user"
    backup_dir_if_exists "${CURSOR_USER_DIR}" "cursor-user"
 
    if [[ -d "${BACKUP_DIR}" ]]; then
        log_success "Backup complete: ${BACKUP_DIR}"
    else
        log_info "No existing editor config found to back up."
    fi
}
 
copy_file_if_exists() {
    local src="$1"
    local dest="$2"
 
    if [[ -f "${src}" ]]; then
        mkdir -p "$(dirname "${dest}")"
        cp "${src}" "${dest}"
        log_info "Installed $(basename "${src}") -> ${dest}"
    else
        log_warn "Skipped missing source file: ${src}"
    fi
}
 
install_editor_config() {
    log_info "Installing editor config..."
 
    copy_file_if_exists "${TEAM_CONFIG_DIR}/vscode/settings.json" "${VSCODE_USER_DIR}/settings.json"
    copy_file_if_exists "${TEAM_CONFIG_DIR}/vscode/keybindings.json" "${VSCODE_USER_DIR}/keybindings.json"
    copy_file_if_exists "${TEAM_CONFIG_DIR}/vscode/extensions.json" "${VSCODE_USER_DIR}/extensions.json"
 
    copy_file_if_exists "${TEAM_CONFIG_DIR}/cursor/settings.json" "${CURSOR_USER_DIR}/settings.json"
    copy_file_if_exists "${TEAM_CONFIG_DIR}/cursor/keybindings.json" "${CURSOR_USER_DIR}/keybindings.json"
}
 
install_claude_config() {
    log_info "Installing Claude team config..."
 
    local claude_dir="${HOME}/.claude"
    mkdir -p "${claude_dir}"
 
    copy_file_if_exists "${TEAM_CONFIG_DIR}/claude/language.json" "${claude_dir}/language.json"
 
    if [[ -d "${TEAM_CONFIG_DIR}/claude/skills" ]]; then
        mkdir -p "${claude_dir}/skills"
        cp -R "${TEAM_CONFIG_DIR}/claude/skills/." "${claude_dir}/skills/"
        log_info "Installed team skills -> ${claude_dir}/skills"
    else
        log_warn "Skipped missing team skills directory."
    fi
}
 
validate_installation() {
    log_info "Validating installation..."
 
    if [[ ! -d "${HOME}/.claude" ]]; then
        log_error "Claude config directory was not created."
        exit 1
    fi
 
    log_success "Validation passed."
}
 
main() {
    show_banner
    detect_os
    resolve_editor_dirs
    check_dependencies
    backup_existing_config
    install_editor_config
    install_claude_config
    validate_installation
 
    log_success "Installation complete."
    log_warn "Review copied files before committing or sharing local config."
}
 
main "$@"
 

#!/bin/bash
# .git/hooks/pre-commit - 提交前检查脚本
# 集成Claude Code进行自动代码审查
 
set -e
 
# ==================== 配置 ====================
CLAUDE_API_KEY="${ANTHROPIC_API_KEY}"
CLAUDE_MODEL="claude-sonnet-4-6"
 
# ==================== Python代码格式化 ====================
format_python() {
    log_info "格式化Python代码..."
    PYTHON_FILES=$(get_staged_files | grep '\.py$' || true)
 
    if [[ -z "$PYTHON_FILES" ]]; then
        log_info "没有Python文件需要格式化"
        return 0
    fi
 
    # 使用Black格式化
    if command -v black &> /dev/null; then
        echo "$PYTHON_FILES" | xargs black --quiet
        log_info "Black格式化完成"
    fi
 
    # 使用Ruff检查
    if command -v ruff &> /dev/null; then
        if ! echo "$PYTHON_FILES" | xargs ruff check; then
            log_error "Ruff检查失败，请修复错误后再提交"
            exit 1
        fi
    fi
 
    # 重新添加格式化后的文件
    echo "$PYTHON_FILES" | xargs git add
}
 
# ==================== Claude Code代码审查 ====================
claude_code_review() {
    log_info "运行Claude Code审查..."
 
    STAGED_FILES=$(get_staged_files)
    if [[ -z "$STAGED_FILES" ]]; then
        return 0
    fi
 
    # 生成diff
    DIFF=$(git diff --cached)
 
    # 调用Claude API进行代码审查
    REVIEW_PROMPT="你是一个严格的代码审查专家。请审查以下代码变更..."
 
    # ... API调用逻辑
 
    # 检查是否有严重问题
    if echo "$REVIEW_RESULT" | grep -q "【严重】"; then
        log_error "发现严重问题，提交被拒绝"
        exit 1
    fi
 
    log_info "代码审查通过"
}
 
# ==================== 主函数 ====================
main() {
    log_info "开始pre-commit检查..."
    format_python
    claude_code_review
    log_info "所有检查通过，允许提交"
}
 
main

#!/bin/bash
# .git/hooks/commit-msg - 提交信息规范化脚本
 
# Conventional Commits规范检查
check_conventional_commits() {
    # 允许的类型
    TYPES="feat|fix|docs|style|refactor|perf|test|chore|build|ci|revert"
 
    # 检查格式：type(scope): description
    if ! echo "$COMMIT_MSG" | grep -qE "^($TYPES)(\(.+\))?: .+"; then
        log_warn "提交信息不符合Conventional Commits规范"
        return 1
    fi
    return 0
}
 
# 使用Claude自动生成commit message
generate_commit_msg() {
    DIFF=$(git diff --cached)
 
    PROMPT="根据以下代码diff，生成一条符合Conventional Commits规范的提交信息..."
 
    # 调用Claude API生成
    # ...
}

## <!-- .claude/skills/team-standards/SKILL.md -->
 
name: team-standards
description: 团队编码标准和最佳实践
 
---
 
你是团队编码标准的守护者。根据以下规范进行代码审查和指导：
 
## Python代码规范
 
- 使用Black格式化，行宽88字符
- 使用Ruff进行lint检查
- 类型注解覆盖率 > 80%
- 遵循Google Python Style Guide
 
## JavaScript/TypeScript规范
 
- 使用Prettier格式化
- 使用ESLint + TypeScript strict模式
- 优先函数式编程风格
 
## API设计规范
 
- RESTful命名
- 统一错误响应格式：`{ data, error }`
- 版本化路径：`/api/v1/...`

# .github/workflows/claude-ci.yml
name: Claude Code CI
 
on:
  pull_request:
    branches: [main, develop]
  push:
    branches: [main, develop]
 
env:
  ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
 
jobs:
  code-review:
    name: Claude代码审查
    runs-on: ubuntu-latest
    steps:
      - name: Checkout代码
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
 
      - name: 获取变更的文件
        id: changed-files
        uses: tj-actions/changed-files@v39
 
      - name: Claude代码审查
        if: steps.changed-files.outputs.any_changed == 'true'
        run: |
          DIFF=$(git diff origin/${{ github.base_ref }}...HEAD)
 
          # 调用Claude API进行审查
          REVIEW=$(curl -s https://api.anthropic.com/v1/messages \
            -H "x-api-key: $ANTHROPIC_API_KEY" \
            -H "anthropic-version: 2023-06-01" \
            -H "content-type: application/json" \
            -d "{
              "model": "claude-sonnet-4-6",
              "max_tokens": 4096,
              "messages": [{
                "role": "user",
                "content": "请审查以下PR的代码变更..."
              }]
            }" | jq -r '.content[0].text')
 
          echo "## Claude代码审查结果" >> $GITHUB_STEP_SUMMARY
          echo "$REVIEW" >> $GITHUB_STEP_SUMMARY
 
  quality-check:
    name: 代码质量检查
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-python@v4
        with:
          python-version: "3.11"
      - run: pip install black ruff pytest pytest-cov
      - run: black --check .
      - run: ruff check .
      - run: pytest --cov --cov-report=xml

#!/usr/bin/env python3
"""
Claude使用情况监控脚本
跟踪团队成员的Claude API调用和成本
"""
 
import sqlite3
from datetime import datetime, timedelta
 
def log_api_call(user, model, prompt_tokens, completion_tokens, purpose=None, success=True):
    """记录一次API调用"""
    total_tokens = prompt_tokens + completion_tokens
    # 计算成本（Sonnet 4.6定价）
    cost = (prompt_tokens * 0.003 + completion_tokens * 0.015) / 1000
 
    # 存储到数据库
    # ...
 
def generate_usage_report(days=7):
    """生成使用情况报告"""
    # 总体统计、按用户统计、按目的统计
    # ...
    return {
        "period_days": days,
        "overall": {...},
        "by_user": [...],
        "success_rate": 98.5
    }

// settings.json（用户级或项目级均可）
{
  "modelOverrides": {
    "claude-sonnet-4-6": "arn:aws:bedrock:us-east-1:123456:model/claude-sonnet",
    "claude-opus-4-6": "your-azure-deployment-name"
  }
}

# 使用 --worktree 标志启动，自动创建Git worktree隔离环境
claude --worktree

// .claude/settings.json
{
  "worktree": {
    "sparsePaths": [
      "packages/frontend/**",
      "packages/shared/**",
      "package.json",
      "tsconfig.json"
    ]
  }
}

// 管理员托管的远程设置
{
  "parentSettingsBehavior": "first-wins",
  "permissions": {
    "allow": ["Read", "Grep", "Glob"],
    "deny": ["Bash"]
  }
}

claude project purge

# ❌ 硬编码（找死）
ANTHROPIC_API_KEY = "sk-ant-api03-XXXXXXXX"
 
# ❌ 提交到Git（自杀）
# .env文件未加入.gitignore
 
# ❌ 明文配置文件（送死）
api_key: "sk-ant-api03-XXXXXXXX"
 
# ❌ 前端代码（群体自杀）
const API_KEY = "sk-ant-api03-XXXXXXXX";

# ✅ 方案1：环境变量 + Secrets Manager
import boto3
 
def get_api_key() -> str:
    """从AWS Secrets Manager获取API Key"""
    client = boto3.client('secretsmanager', region_name='us-east-1')
    response = client.get_secret_value(SecretId='prod/anthropic/api-key')
    return response['SecretString']
 
# ✅ 方案2：HashiCorp Vault
import hvac
 
def get_api_key_from_vault() -> str:
    """从Vault获取API Key"""
    client = hvac.Client(url='https://vault.example.com:8200')
    client.auth.approle.login(
        role_id=os.getenv("VAULT_ROLE_ID"),
        secret_id=os.getenv("VAULT_SECRET_ID")
    )
    secret = client.secrets.kv.v2.read_secret_version(
        path='anthropic/api-key',
        mount_point='secret'
    )
    return secret['data']['data']['key']

declare -A PATTERNS=(
    ["anthropic_api_key"]="sk-ant-api[0-9]{2}-[a-zA-Z0-9_-]{95,}"
    ["aws_access_key"]="AKIA[0-9A-Z]{16}"
    ["aws_secret_key"]="[0-9a-zA-Z/+=]{40}"
    ["openai_api_key"]="sk-[a-zA-Z0-9]{48}"
    ["github_token"]="ghp_[a-zA-Z0-9]{36}"
    ["private_key"]="-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----"
    ["password"]="password\\s*[=:]\\s*['\"][^'\"]{8,}['\"]"
)

class SensitiveDataFilter(logging.Filter):
    """日志脱敏过滤器"""
 
    @staticmethod
    def mask_sensitive_data(text: str) -> str:
        """脱敏文本中的敏感信息"""
        # API Key: sk-ant-api03-*** → sk-ant-api03-*****
        # Email: j***[email protected]
        # Phone: 123-***-7890
        # Credit Card: **** **** **** 3456
        # ...