open/ktg-plugin-marketplace
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions

docs(ultraplan-local): document security hardening in README and CLAUDE.md

Browse source 
Add Security hardening section to ultraplan-local README covering all 4
defense layers. Update architecture tree to include hooks directory.
Update root marketplace README with security summary and hook count.
Update CLAUDE.md architecture section with Phase 2.4 and --allowedTools.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-04-08 18:35:34 +02:00
commit 8e2b868826
3 changed files with 21 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
plugins/ultraplan-local/CLAUDE.md
View file

@ -81,7 +81,9 @@ Flags can be combined: `--local --fg`, `--external --quick`.
**Decompose:** Parse plan -> Analyze step dependencies -> Group into sessions -> Identify parallel waves -> Generate session specs + dependency graph + launch script.
**Execute:** Parse plan -> Detect Execution Strategy -> Single-session (step loop) or multi-session (parallel waves via `claude -p`) -> Verification -> Report.
**Execute:** Parse plan -> Security scan (Phase 2.4) -> Detect Execution Strategy -> Single-session (step loop) or multi-session (parallel waves via `claude -p` with scoped `--allowedTools`) -> Verification -> Report.
**Security:** 4-layer defense-in-depth: plugin hooks (pre-bash-executor, pre-write-executor), prompt-level denylist (works in headless sessions), pre-execution plan scan (Phase 2.4), scoped `--allowedTools` replacing `--dangerously-skip-permissions`. Hard Rules 14-16 enforce verify command security, repo-boundary writes, and sensitive path protection.
**Pipeline:** Research briefs feed into planning via `--research`. The planning orchestrator uses brief context to enrich exploration and skip redundant research.