devzone 0.7.0 → 0.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.devcontainer/opencode.jsonc +105 -7
- package/core/scripts/versions.sh +117 -0
- package/package.json +1 -1
|
@@ -10,16 +10,114 @@
|
|
|
10
10
|
"compaction": {
|
|
11
11
|
"auto": true
|
|
12
12
|
},
|
|
13
|
-
//
|
|
13
|
+
// Permissions strictes par défaut : ce qui sert au travail est permis sans
|
|
14
|
+
// question, le reste demande ton accord (ask), et ce qui peut faire fuir un
|
|
15
|
+
// secret est interdit (deny). Ordre important : le dernier motif qui
|
|
16
|
+
// correspond l'emporte, donc garder « * » en tête, les allow ensuite et les
|
|
17
|
+
// deny en dernier. Pour élargir : retirer la ligne repère en tête du fichier
|
|
18
|
+
// (devzone le garde alors tel quel) puis ajouter un allow.
|
|
14
19
|
"permission": {
|
|
15
20
|
"edit": "allow",
|
|
16
|
-
"webfetch": "
|
|
21
|
+
"webfetch": "ask",
|
|
17
22
|
"bash": {
|
|
18
|
-
"*": "
|
|
19
|
-
"
|
|
20
|
-
"
|
|
21
|
-
"
|
|
22
|
-
"
|
|
23
|
+
"*": "ask",
|
|
24
|
+
"git *": "allow",
|
|
25
|
+
"repowarden *": "allow",
|
|
26
|
+
"gh issue view*": "allow",
|
|
27
|
+
"gh issue list*": "allow",
|
|
28
|
+
"gh pr view*": "allow",
|
|
29
|
+
"gh pr list*": "allow",
|
|
30
|
+
"gh pr checks*": "allow",
|
|
31
|
+
"gh pr diff*": "allow",
|
|
32
|
+
"gh run list*": "allow",
|
|
33
|
+
"gh run view*": "allow",
|
|
34
|
+
"gh repo view*": "allow",
|
|
35
|
+
"gh search*": "allow",
|
|
36
|
+
"ls*": "allow",
|
|
37
|
+
"cat*": "allow",
|
|
38
|
+
"head*": "allow",
|
|
39
|
+
"tail*": "allow",
|
|
40
|
+
"wc*": "allow",
|
|
41
|
+
"grep*": "allow",
|
|
42
|
+
"rg*": "allow",
|
|
43
|
+
"find*": "allow",
|
|
44
|
+
"tree*": "allow",
|
|
45
|
+
"sed -n*": "allow",
|
|
46
|
+
"awk*": "allow",
|
|
47
|
+
"sort*": "allow",
|
|
48
|
+
"uniq*": "allow",
|
|
49
|
+
"cut*": "allow",
|
|
50
|
+
"diff*": "allow",
|
|
51
|
+
"jq*": "allow",
|
|
52
|
+
"file*": "allow",
|
|
53
|
+
"stat*": "allow",
|
|
54
|
+
"pwd": "allow",
|
|
55
|
+
"which*": "allow",
|
|
56
|
+
"command -v*": "allow",
|
|
57
|
+
"echo*": "allow",
|
|
58
|
+
"printf*": "allow",
|
|
59
|
+
"date*": "allow",
|
|
60
|
+
"mkdir*": "allow",
|
|
61
|
+
"touch*": "allow",
|
|
62
|
+
"cp*": "allow",
|
|
63
|
+
"mv*": "allow",
|
|
64
|
+
"rm *": "allow",
|
|
65
|
+
"chmod*": "allow",
|
|
66
|
+
"ln*": "allow",
|
|
67
|
+
"bats*": "allow",
|
|
68
|
+
"shellcheck*": "allow",
|
|
69
|
+
"actionlint*": "allow",
|
|
70
|
+
"bash -n*": "allow",
|
|
71
|
+
"npm test*": "allow",
|
|
72
|
+
"npm run*": "allow",
|
|
73
|
+
"npm ci*": "allow",
|
|
74
|
+
"npm install*": "allow",
|
|
75
|
+
"npx*": "allow",
|
|
76
|
+
"pnpm*": "allow",
|
|
77
|
+
"yarn*": "allow",
|
|
78
|
+
"node*": "allow",
|
|
79
|
+
"python*": "allow",
|
|
80
|
+
"python3*": "allow",
|
|
81
|
+
"pytest*": "allow",
|
|
82
|
+
"pip install*": "allow",
|
|
83
|
+
"uv*": "allow",
|
|
84
|
+
"ruff*": "allow",
|
|
85
|
+
"mvn*": "allow",
|
|
86
|
+
"./mvnw*": "allow",
|
|
87
|
+
"gradle*": "allow",
|
|
88
|
+
"./gradlew*": "allow",
|
|
89
|
+
"go *": "allow",
|
|
90
|
+
"cargo *": "allow",
|
|
91
|
+
"make*": "allow",
|
|
92
|
+
"docker build*": "allow",
|
|
93
|
+
"docker ps*": "allow",
|
|
94
|
+
"kubectl get*": "allow",
|
|
95
|
+
"helm template*": "allow",
|
|
96
|
+
"terraform fmt*": "allow",
|
|
97
|
+
"terraform validate*": "allow",
|
|
98
|
+
"opencode models*": "allow",
|
|
99
|
+
"devzone*": "allow",
|
|
100
|
+
"gh auth token*": "deny",
|
|
101
|
+
"gh auth status --show-token*": "deny",
|
|
102
|
+
"*hosts.yml*": "deny",
|
|
103
|
+
"*.credentials*": "deny",
|
|
104
|
+
"*auth.json*": "deny",
|
|
105
|
+
"*/.ssh/*": "deny",
|
|
106
|
+
"env": "deny",
|
|
107
|
+
"env *": "deny",
|
|
108
|
+
"printenv*": "deny",
|
|
109
|
+
"set": "deny",
|
|
110
|
+
"export -p*": "deny",
|
|
111
|
+
"curl*": "deny",
|
|
112
|
+
"wget*": "deny",
|
|
113
|
+
"nc *": "deny",
|
|
114
|
+
"ssh *": "deny",
|
|
115
|
+
"scp *": "deny",
|
|
116
|
+
"sudo*": "deny",
|
|
117
|
+
"rm -rf /*": "deny",
|
|
118
|
+
"git push --force*": "deny",
|
|
119
|
+
"git push -f*": "deny",
|
|
120
|
+
"git push --force-with-lease*": "deny"
|
|
23
121
|
}
|
|
24
122
|
},
|
|
25
123
|
"agent": {
|
|
@@ -0,0 +1,117 @@
|
|
|
1
|
+
#!/usr/bin/env bash
|
|
2
|
+
# Versions figées du conteneur : compare repowarden (post-create.sh) et les
|
|
3
|
+
# assistants IA (IA_PAQUETS, devzone) à la dernière version npm, ou applique
|
|
4
|
+
# une montée.
|
|
5
|
+
# bash core/scripts/versions.sh
|
|
6
|
+
# une ligne « paquet ancienne nouvelle » par paquet en retard, rien sinon
|
|
7
|
+
# bash core/scripts/versions.sh --appliquer <paquet> <version>
|
|
8
|
+
# remplace cette version figée dans son fichier, rien d'autre
|
|
9
|
+
# Compatible bash 3.2 (macOS).
|
|
10
|
+
set -euo pipefail
|
|
11
|
+
|
|
12
|
+
ICI="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
13
|
+
POST_CREATE="$ICI/.devcontainer/post-create.sh"
|
|
14
|
+
DEVZONE="$ICI/.devcontainer/devzone"
|
|
15
|
+
|
|
16
|
+
# Liste « paquet version » des versions figées dans les deux fichiers
|
|
17
|
+
figees() {
|
|
18
|
+
local ligne element
|
|
19
|
+
ligne="$(sed -nE 's/.*npm install -g (repowarden)@([^[:space:]]+).*/\1 \2/p' "$POST_CREATE" | head -1)"
|
|
20
|
+
[ -z "$ligne" ] || echo "$ligne"
|
|
21
|
+
ligne="$(sed -nE 's/^IA_PAQUETS=\((.*)\)/\1/p' "$DEVZONE" | head -1)"
|
|
22
|
+
[ -n "$ligne" ] || return 0
|
|
23
|
+
for element in $ligne; do
|
|
24
|
+
case "$element" in
|
|
25
|
+
*@*) echo "${element%@*} ${element##*@}" ;;
|
|
26
|
+
esac
|
|
27
|
+
done
|
|
28
|
+
}
|
|
29
|
+
|
|
30
|
+
# Vrai si la version $1 est plus récente que $2 (composants numériques)
|
|
31
|
+
plus_recente() {
|
|
32
|
+
local i x y
|
|
33
|
+
local IFS=.
|
|
34
|
+
local a b
|
|
35
|
+
read -ra a <<<"$1"
|
|
36
|
+
read -ra b <<<"$2"
|
|
37
|
+
for i in 0 1 2 3; do
|
|
38
|
+
x="${a[i]:-0}"
|
|
39
|
+
y="${b[i]:-0}"
|
|
40
|
+
x="${x%%[!0-9]*}"
|
|
41
|
+
y="${y%%[!0-9]*}"
|
|
42
|
+
x="${x:-0}"
|
|
43
|
+
y="${y:-0}"
|
|
44
|
+
[ "$x" -gt "$y" ] && return 0
|
|
45
|
+
[ "$x" -lt "$y" ] && return 1
|
|
46
|
+
done
|
|
47
|
+
return 1
|
|
48
|
+
}
|
|
49
|
+
|
|
50
|
+
# Dernière version publiée sur npm (vide si npm ne répond pas)
|
|
51
|
+
derniere() {
|
|
52
|
+
npm view "$1" version 2>/dev/null | tail -1 | tr -d '[:space:]'
|
|
53
|
+
}
|
|
54
|
+
|
|
55
|
+
# Une ligne par paquet en retard, rien si tout est à jour
|
|
56
|
+
lister() {
|
|
57
|
+
local paquet ancienne nouvelle
|
|
58
|
+
while read -r paquet ancienne; do
|
|
59
|
+
[ -n "$paquet" ] || continue
|
|
60
|
+
nouvelle="$(derniere "$paquet")"
|
|
61
|
+
if [ -z "$nouvelle" ]; then
|
|
62
|
+
echo "versions : version npm illisible pour $paquet" >&2
|
|
63
|
+
exit 1
|
|
64
|
+
fi
|
|
65
|
+
if plus_recente "$nouvelle" "$ancienne"; then
|
|
66
|
+
echo "$paquet $ancienne $nouvelle"
|
|
67
|
+
fi
|
|
68
|
+
done < <(figees)
|
|
69
|
+
}
|
|
70
|
+
|
|
71
|
+
# Échappe $1 pour un motif sed (le délimiteur est « | »)
|
|
72
|
+
echapper() {
|
|
73
|
+
printf '%s' "$1" | sed "s/[][\\\\.*^$()+?{}|]/\\\\&/g"
|
|
74
|
+
}
|
|
75
|
+
|
|
76
|
+
# Remplace la seule version figée de $1 par $2, dans son fichier. Le contenu
|
|
77
|
+
# est réécrit dans le fichier existant (pas de mv) : ses droits, notamment le
|
|
78
|
+
# droit d'exécution de devzone, sont conservés.
|
|
79
|
+
appliquer() {
|
|
80
|
+
local paquet="$1" version="$2" motif tmp fichier
|
|
81
|
+
case "$version" in
|
|
82
|
+
"" | *[!0-9A-Za-z.+-]*)
|
|
83
|
+
echo "versions : version invalide : ${version:-(aucune)}" >&2
|
|
84
|
+
exit 1
|
|
85
|
+
;;
|
|
86
|
+
esac
|
|
87
|
+
if [ "$paquet" = repowarden ]; then
|
|
88
|
+
fichier="$POST_CREATE"
|
|
89
|
+
grep -qF 'npm install -g repowarden@' "$fichier" ||
|
|
90
|
+
{ echo "versions : paquet inconnu : $paquet" >&2; exit 1; }
|
|
91
|
+
tmp="$(mktemp)"
|
|
92
|
+
sed -E "s|(npm install -g repowarden@)[^[:space:]]+|\1${version}|" "$fichier" >"$tmp"
|
|
93
|
+
else
|
|
94
|
+
fichier="$DEVZONE"
|
|
95
|
+
figees | awk -v p="$paquet" '$1 == p { trouve = 1 } END { exit trouve ? 0 : 1 }' ||
|
|
96
|
+
{ echo "versions : paquet inconnu : $paquet" >&2; exit 1; }
|
|
97
|
+
motif="$(echapper "$paquet")"
|
|
98
|
+
tmp="$(mktemp)"
|
|
99
|
+
sed -E "s|(${motif}@)[^ )]+|\1${version}|" "$fichier" >"$tmp"
|
|
100
|
+
fi
|
|
101
|
+
cat "$tmp" >"$fichier"
|
|
102
|
+
rm -f "$tmp"
|
|
103
|
+
}
|
|
104
|
+
|
|
105
|
+
case "${1:-}" in
|
|
106
|
+
"") lister ;;
|
|
107
|
+
--appliquer)
|
|
108
|
+
[ "$#" -eq 3 ] ||
|
|
109
|
+
{ echo "usage : bash core/scripts/versions.sh [--appliquer <paquet> <version>]" >&2; exit 2; }
|
|
110
|
+
appliquer "$2" "$3"
|
|
111
|
+
;;
|
|
112
|
+
-h | --help) sed -n '2,9p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//' ;;
|
|
113
|
+
*)
|
|
114
|
+
echo "usage : bash core/scripts/versions.sh [--appliquer <paquet> <version>]" >&2
|
|
115
|
+
exit 2
|
|
116
|
+
;;
|
|
117
|
+
esac
|
package/package.json
CHANGED