LH-114214: Add SCCFM agent plugin - #30
Open
huides00 wants to merge 4 commits into
Open
Conversation
Package guided setup, teardown, and synchronized CLI and Ansible skills for Claude Code and Codex. Gate mutating commands with exact-plan approvals while allowing schema-proven read-only operations. Document installation, authentication, capabilities, and the end-user workflow.
Point package-description links at GitHub Pages and GitHub so they remain valid when the README is rendered on PyPI. This allows Python artifact verification to accept both the wheel and source distribution.
huides00
marked this pull request as ready for review
August 26, 2026 12:55
huides00
requested review from
Scoombe,
afercal and
siddhuwarrier
as code owners
August 26, 2026 12:55
Add the checked-in collection release entry required after the initial release seed has already been consumed. This lets release rehearsal update the date without rewriting published changelog history.
Scoombe
reviewed
Aug 26, 2026
Scoombe
left a comment
Scoombe
left a comment
Collaborator
There was a problem hiding this comment.
I found three issues in the safety and teardown paths that are not covered by the current tests.
Harden the command guard against leading environment assignments and shell wrappers. Prefixed SCCFM and Ansible commands can no longer bypass review. Record the exact Ansible collection installed by the setup helper and preserve other reported copies during teardown. Prefer the owned copy during diagnostics. Add Windows-specific hook commands to both manifests and cover the findings with regression tests.
Consistency CheckNo consistency issues found. Checker output |
Scoombe
approved these changes
Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://cisco-sbg.atlassian.net/browse/LH-114214
Description
This adds an installable SCC Firewall Manager agent plugin for Claude Code and Codex. It guides users through version-matched CLI and Ansible setup, local token configuration, health checks, read-only operations, and safe teardown while keeping plugin versioning independent from the repository release.
Mutating operations now require a reviewed command and an exact, short-lived confirmation before execution. The shared safety gate binds approval to the precise command, prevents edits such as removing
--checkfrom being authorized, and is covered by automated tests and end-user documentation.