surshar / claude-code
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
Built by Anthropic · github.com/anthropics
poteat/sec-default-ceiling-hold ▾
Branches
adam/restoreadd-claude-github-actions-1747935723354add-code-review-pluginadd-frontend-design-pluginadd-github-connection-issue-templateadd-github-issue-templateadd-oncall-triage-workflowadd-readme-jokeant-kurt/mdm-examplesashwin-ant-patch-1ashwin/changelogashwin/changelogbumpashwin/checkoutashwin/codereviewmcpashwin/emailashwin/lockactionashwin/lockstaleashwin/logoutputashwin/modelashwin/pluginimportashwin/plugininfoashwin/taskreaperashwin/triageactionashwin/updatetimeoutaudit-readmebcherny-patch-1bcherny-patch-2bcherny-patch-3bcherny-patch-4bcherny-patch-5bcherny-patch-6bcherny-patch-7boris/adbfboris/aierboris/bktrboris/bzxyboris/cmyyboris/cuxgboris/euwsboris/eydaboris/fwbeboris/gityboris/istcboris/iuniboris/jymyboris/limcboris/lptzboris/nvkoboris/oauyboris/pcdvboris/pumgboris/rmbxboris/triage-fix-83803boris/uiywboris/uqboboris/vregboris/xgswboris/zivmbranch-without-e2bd68fcatherinewu-patch-1changelog-fixes-accuracychrislloyd/issue-lifecycle-labelschrislloyd/lifecycle-commentschrislloyd/sweep-lifecycle-labelsci/update-base-actionclaude/add-docs-line-05PIZclaude/add-joke-readme-3T29Kclaude/add-joke-readme-gqXhbclaude/add-joke-readme-uRXrNclaude/admiring-maxwell-7yikbkclaude/create-webpage-011CTxkmvzbUBGm9Mbmd5XE3claude/create-workflow-011CUHtvcx9tytLLhKuA5Wcdclaude/diff-pane-empty-auto-openclaude/fix-dedupe-security-011KCEcMStuJsasHxaFQhJ44claude/fix-deny-rules-symlink-cjxxnclaude/fix-issue-582-01AdiZnk8hM92mKFr4JyoGFqclaude/fix-permission-mode-casing-016NKbAVJXGzFqwhQKrjwoTAclaude/investigate-workflow-config-011CUKnhpbage9BLno96Adg1claude/mobile-app-issues-triage-ubjnpjclaude/plugin-sh-hooks-explicit-bash-9efw07claude/project-thread-hu4835claude/remove-oncall-label-bGF7Hclaude/slack-add-accept-with-feedback-fgEPdclaude/slack-add-biome-box-text-lint-PTH22claude/slack-add-blocked-marketplaces-8e3yJclaude/slack-add-feedback-prompt-text-5J5dvclaude/slack-add-mcp-context-warning-3yuzzclaude/slack-add-teleport-hooks-P308gclaude/slack-auto-show-plan-FqT4oclaude/slack-clarify-changelog-slashcommands-kNW37claude/slack-fix-apikey-retry-loop-urBQXclaude/slack-fix-bash-permission-parsing-HRvGKclaude/slack-fix-file-permissions-access-dKH8rclaude/slack-fix-hook-selection-bug-i4NdQclaude/slack-fix-idle-notification-ui-l01Hoclaude/slack-fix-memory-leak-4OwLBclaude/slack-fix-skill-sync-cache-H41nUclaude/slack-fix-stop-hooks-firing-mmVHtclaude/slack-fix-vscode-extension-regression-DXP3fclaude/slack-handle-disk-space-issues-s86VEclaude/slack-improve-frontend-accessibility-a6d1Xclaude/slack-improve-quoted-message-display-lxqhAclaude/slack-improve-resume-summaries-7hWj8claude/slack-investigate-user-mapping-salt-ONsG9claude/slack-make-no-comment-default-Qqha8claude/slack-make-pr-comment-optional-xF8PGclaude/slack-remove-marketplace-json-uoyktclaude/slack-session-014VVY33EZNjXYg4c8aYP5fJclaude/slack-session-01GC9L5U6niZZBz3qBj6GsCNclaude/slack-session-01GzKi42xM3SphuxeQ4De88Uclaude/slack-session-01J2SCbthhCpS9pYhPYNoBdYclaude/slack-session-01JdzTD5VfLXs28YrPZmYCrNclaude/slack-session-01JHHMf2F77yGNArsAE73AeTclaude/slack-session-01MSazjv2q93ZWpLnj5aZJLSclaude/slack-session-01QHjRGT3G4Ms8sz1AR8AFZPclaude/slack-session-01TVVViCDbuP8W3n5mVSUSQKclaude/slack-session-01TZZQuvvVtYnVo5ec6HPx8sclaude/slack-session-01Uro32UMnxVhQwMZzc37Fnvclaude/slack-session-shYxQdaisy/plugin-dev/public-marketplacedaisy/plugin-schema/schemastore-urldaisy/ralph-wiggum/public-marketplacedalton/readme-update-data-usagedevsec/pin-actionsdickson/explanatory-output-styledocs/update-installation-instructionsfeat/devcontainer-claude-extension-and-vscode-urlsfix-lock-closed-issues-paginationfix-stale-issue-autoclosingfix-sweep-locked-issuesfix/agent-yaml-frontmatter-hookify-plugindevfix/devcontainer-powerlevel10k-typofix/plugin-dev-manifestfix/ralph-wiggum-disable-model-invocationfix/ralph-wiggum-permission-patternfvolcic/code-review-comment-updatefvolcic/code-review-updatesfvolcic/minor-code-review-fixesgithub-api-cachehackyon/update-to-claude-code-actionigorkofman-patch-1inigo/cleanupinigo/triage-prompt-accuracykashyap/code-review-batch-outputkurt/settings-examplesmainmhegazy/sg-sync-2.0.12mods-run-flags-and-list-mtimeoct/cleanup-workflow-permissionsoct/gh-wrapper-improvementsoct/gh-wrapper-scriptoct/increase-oncall-triage-timeoutoct/non-write-users-checkoct/update-h1-linksoct/use-label-script-for-triagepoteat/agents-md-bare-switchespoteat/agents-md-loaded-line-debugpoteat/diff-auto-open-fullscreen-onlypoteat/diff-auto-open-paritypoteat/diff-awaits-surfacepoteat/diff-docked-pane-starts-at-its-headerpoteat/diff-finished-rebasepoteat/diff-focus-namespoteat/diff-hunks-one-childpoteat/diff-inline-earlier-filespoteat/diff-lazy-pinpoteat/diff-literal-command-namepoteat/diff-mod-telemetry-gapspoteat/diff-open-after-fetchpoteat/diff-openpane-unknownpoteat/diff-paritypoteat/diff-parity-2poteat/diff-read-paritypoteat/diff-reopen-paritypoteat/diff-toasts-showpoteat/diff-viewport-compatpoteat/mod-tests-portpoteat/mod-tests-seatpoteat/modspoteat/mods-agents-mdpoteat/mods-telemetry-fixespoteat/revert-two-mods-changespoteat/sec-default-ceiling-holdpoteat/sec-default-collector-rowpoteat/sec-default-deny-rules-holdpoteat/sec-default-holdspoteat/sec-default-managed-mods-onlypoteat/telemetry-complete-rowspoteat/telemetry-destinationspoteat/telemetry-fixtures-collectorpoteat/telemetry-session-versionpoteat/telemetry-types-pathrboyce/action-duperboyce/action-dupe-commentrboyce/action-triage-manualrboyce/readme-garemove-changelog-entryremove-commit-e2bd68frevert-6369-ashwin/taskreaperrevert-9304-revert-6369-ashwin/taskreaperroyarsan/gateway-aws-exampleroyarsan/gateway-gcp-agent-platformroyarsan/gateway-gcp-examplesarahdeaton/managed-settings-hipaa-examplesec-default-prompt-composesec-default-session-appendsecurity-hardening-gh-actionssgrider/plugin-1125sidb/feature-devsidb/fix-feature-dev-agentssidb/fix-npm-linktemp-admin-branchThariqS-patch-1whu/opus-migrationwhyuan-code-reviewworkflow-update-2024Tags
v2.0.73v2.0.74v2.0.76v2.1.0v2.1.1v2.1.100v2.1.101v2.1.104v2.1.105v2.1.107v2.1.108v2.1.109v2.1.11v2.1.110v2.1.111v2.1.112v2.1.113v2.1.114v2.1.116v2.1.117v2.1.118v2.1.119v2.1.12v2.1.120v2.1.121v2.1.122v2.1.123v2.1.126v2.1.128v2.1.129v2.1.131v2.1.132v2.1.133v2.1.136v2.1.137v2.1.138v2.1.139v2.1.14v2.1.140v2.1.141v2.1.142v2.1.143v2.1.144v2.1.145v2.1.146v2.1.147v2.1.148v2.1.149v2.1.15v2.1.150v2.1.152v2.1.153v2.1.154v2.1.156v2.1.157v2.1.158v2.1.159v2.1.16v2.1.160v2.1.161v2.1.162v2.1.163v2.1.165v2.1.166v2.1.167v2.1.168v2.1.169v2.1.17v2.1.170v2.1.172v2.1.173v2.1.174v2.1.175v2.1.176v2.1.177v2.1.178v2.1.179v2.1.181v2.1.183v2.1.185v2.1.186v2.1.187v2.1.19v2.1.190v2.1.191v2.1.193v2.1.195v2.1.196v2.1.197v2.1.198v2.1.199v2.1.2v2.1.20v2.1.200v2.1.201v2.1.202v2.1.203v2.1.204v2.1.205v2.1.206v2.1.207v2.1.208v2.1.209v2.1.21v2.1.210v2.1.211v2.1.212v2.1.214v2.1.215v2.1.216v2.1.217v2.1.218v2.1.219v2.1.22v2.1.220v2.1.221v2.1.222v2.1.223v2.1.224v2.1.225v2.1.226v2.1.227v2.1.228v2.1.229v2.1.23v2.1.231v2.1.232v2.1.233v2.1.234v2.1.235v2.1.236v2.1.237v2.1.238v2.1.239v2.1.240v2.1.241v2.1.243v2.1.245v2.1.246v2.1.247v2.1.248v2.1.25v2.1.250v2.1.251v2.1.252v2.1.257v2.1.258v2.1.259v2.1.260v2.1.261v2.1.263v2.1.265v2.1.266v2.1.267v2.1.268v2.1.269v2.1.27v2.1.270v2.1.271v2.1.272v2.1.273v2.1.274v2.1.275v2.1.276v2.1.277v2.1.278v2.1.280v2.1.281v2.1.282v2.1.283v2.1.284v2.1.285v2.1.286v2.1.287v2.1.288v2.1.289v2.1.29v2.1.290v2.1.291v2.1.292v2.1.293v2.1.294v2.1.295v2.1.296v2.1.299v2.1.3v2.1.30v2.1.300v2.1.301v2.1.302v2.1.303v2.1.304v2.1.305v2.1.306v2.1.307v2.1.308v2.1.309v2.1.31v2.1.32v2.1.33v2.1.34v2.1.36v2.1.37v2.1.38v2.1.39v2.1.4v2.1.41v2.1.42v2.1.44v2.1.45v2.1.47v2.1.49v2.1.5v2.1.50v2.1.51v2.1.52v2.1.53v2.1.55v2.1.56v2.1.58v2.1.59v2.1.6v2.1.61v2.1.62v2.1.63v2.1.66v2.1.68v2.1.69v2.1.7v2.1.70v2.1.71v2.1.72v2.1.73v2.1.74v2.1.75v2.1.76v2.1.77v2.1.78v2.1.79v2.1.80v2.1.81v2.1.83v2.1.84v2.1.85v2.1.86v2.1.87v2.1.88v2.1.89v2.1.9v2.1.90v2.1.91v2.1.92v2.1.94v2.1.96v2.1.97v2.1.98Alice Poteatsec-default: an organization's ceiling on a tool holds over the plugins a person installs
318196e · 21 days ago
History
26 lines · 864 BRaw
| 1 | import type { EventResult } from 'claude-code' |
| 2 | |
| 3 | import Verdicts from './verdicts' |
| 4 | |
| 5 | /** |
| 6 | * What the `tool.check` hook's failure handler answers on a tool under an |
| 7 | * organization's ceiling: its verdict when within the ceiling, else that. |
| 8 | * |
| 9 | * No verdict stays none, so a run that rejected still fails the call. Where |
| 10 | * the organization set no ceiling the verdict passes as it is. |
| 11 | * |
| 12 | * @param caught the verdict the handler would return, if it has one |
| 13 | * @param ceiling the question's `ceiling`, which the engine pins |
| 14 | * @returns the verdict the handler returns |
| 15 | */ |
| 16 | export function underCeiling( |
| 17 | caught: EventResult<'tool.check'> | undefined, |
| 18 | ceiling: string | undefined, |
| 19 | ) { |
| 20 | const isOver = |
| 21 | caught !== undefined && |
| 22 | ceiling !== undefined && |
| 23 | Verdicts.isOverCeiling(caught, ceiling) |
| 24 | |
| 25 | return isOver ? Verdicts.uncheckedCeiling(ceiling) : caught |
| 26 | } |