repowarden 4.9.3 → 4.10.0-next.4

package/bin/repowarden

@@ -21,6 +21,8 @@
 #   repowarden npm-publication                     publication npm automatique
 #   repowarden app init                            GitHub App des workflows (une fois)
 #   repowarden bot [init|rapport]                  bot d'organisation (dépôt de pilotage)
+#   repowarden agents init [--claude] [--opencode] garde-fou des agents IA
+#   repowarden garde [--format claude|opencode]    vérifie une action d'agent
 #   repowarden --version
 set -euo pipefail
 
@@ -38,11 +40,55 @@ source "$ROOT/hooks/lib/ui.sh"
 # shellcheck source=../hooks/lib/i18n.sh
 source "$ROOT/hooks/lib/i18n.sh"
 
-aide() { sed -n '2,24p' "$ROOT/bin/repowarden" | sed 's/^# \{0,1\}//'; }
+# Clé d'aide d'une commande, alias compris ; vide si la commande est inconnue.
+help_key_r() {
+    case "$1" in
+        install) REPLY=help.install ;;
+        uninstall) REPLY=help.uninstall ;;
+        bots) REPLY=help.bots ;;
+        bot) REPLY=help.bot ;;
+        agents) REPLY=help.agents ;;
+        garde | guard) REPLY=help.garde ;;
+        cc | commit) REPLY=help.cc ;;
+        code-mort | deadcode) REPLY=help.code-mort ;;
+        ticket) REPLY=help.ticket ;;
+        tickets) REPLY=help.tickets ;;
+        pr) REPLY=help.pr ;;
+        run) REPLY=help.run ;;
+        app) REPLY=help.app ;;
+        migrer | migrate) REPLY=help.migrer ;;
+        proteger | protect) REPLY=help.proteger ;;
+        npm-publication | npm-publish) REPLY=help.npm-publication ;;
+        "" | statut | status) REPLY=help.statut ;;
+        *) REPLY="" ;;
+    esac
+}
+
+aide() { _tr help.main; printf '%b\n' "$_T" >&2; }
 
 commande="${1:-}"
+cmd="$commande"
 [ $# -eq 0 ] || shift
-case "$commande" in
+
+# Une seule interception : le premier argument de la sous-commande, testé
+# avant l'exécution (code 0, rien n'est fait). Seul ce premier argument
+# compte : cc -m "--help" reste un message. pr et run gardent leurs
+# sous-commandes (label, checks, rerun, list), dispatchées plus bas.
+case "${1:-}" in
+    -h | --help | help)
+        help_key_r "$cmd"
+        if [ -n "$REPLY" ]; then
+            _tr "$REPLY"
+            printf '%b\n' "$_T"
+            exit 0
+        fi
+        err_t install.unknown_arg "$cmd"
+        aide
+        exit 1
+        ;;
+esac
+
+case "$cmd" in
     install)
         # npx : paquet dans un cache temporaire, effaçable à tout moment ;
         # des hooks globaux y pointeraient vers un dossier disparu
@@ -59,6 +105,28 @@ case "$commande" in
     ticket) exec bash "$ROOT/bin/ticket" "$@" ;;
     ticket-comment) exec bash "$ROOT/bin/ticket-comment" "$@" ;;
     ticket-label) exec bash "$ROOT/bin/ticket-label" "$@" ;;
+    pr)
+        if [ $# -ge 1 ]; then
+            case "$1" in
+                label) exec bash "$ROOT/bin/pr-label" "${@:2}" ;;
+                checks) exec bash "$ROOT/bin/pr-checks" "${@:2}" ;;
+                *) err_t install.unknown_arg "$1"; _tr help.pr; printf '%b\n' "$_T" >&2; exit 1 ;;
+            esac
+        else
+            _tr help.pr; printf '%b\n' "$_T"; exit 0
+        fi
+        ;;
+    run)
+        if [ $# -ge 1 ]; then
+            case "$1" in
+                rerun) exec bash "$ROOT/bin/run-rerun" "${@:2}" ;;
+                list) exec bash "$ROOT/bin/run-list" "${@:2}" ;;
+                *) err_t install.unknown_arg "$1"; _tr help.run; printf '%b\n' "$_T" >&2; exit 1 ;;
+            esac
+        else
+            _tr help.run; printf '%b\n' "$_T"; exit 0
+        fi
+        ;;
     pr-label) exec bash "$ROOT/bin/pr-label" "$@" ;;
     run-rerun) exec bash "$ROOT/bin/run-rerun" "$@" ;;
     run-list) exec bash "$ROOT/bin/run-list" "$@" ;;
@@ -69,15 +137,20 @@ case "$commande" in
     app) exec bash "$ROOT/bin/app" "$@" ;;
     bots) exec bash "$ROOT/bin/bots" "$@" ;;
     bot) exec bash "$ROOT/bin/bot" "$@" ;;
+    agents) exec bash "$ROOT/bin/agents" "$@" ;;
+    garde | guard) exec bash "$ROOT/bin/garde" "$@" ;;
     -v | --version | version)
         repowarden_version_r "$ROOT"
         echo "$REPLY"
         ;;
     "" | statut | status) exec bash "$ROOT/bin/statut" "$@" ;;
-    -h | --help | help) aide ;;
+    -h | --help | help)
+        _tr help.main
+        printf '%b\n' "$_T"
+        ;;
     *)
-        err_t install.unknown_arg "$commande"
-        aide >&2
+        err_t install.unknown_arg "$cmd"
+        aide
         exit 1
         ;;
 esac

package/bin/run-list

@@ -10,19 +10,8 @@ source "$ROOT/hooks/lib/common.sh"
 source "$ROOT/hooks/lib/i18n.sh"
 
 aide() {
-    cat <<EOF
-Usage: repowarden run list [--workflow <nom>] [--limit N]
-
-Liste les runs de workflows récents.
-
-Options:
-  --workflow <nom>   Filtre par nom de workflow
-  --limit N          Nombre max de runs (défaut: 20)
-
-Exemples:
-  repowarden run list
-  repowarden run list --workflow "CI" --limit 10
-EOF
+    _tr help.run
+    printf '%b\n' "$_T"
 }
 
 if [[ "$1" == "--help" || "$1" == "-h" ]]; then

package/bin/run-rerun

@@ -10,21 +10,8 @@ source "$ROOT/hooks/lib/common.sh"
 source "$ROOT/hooks/lib/i18n.sh"
 
 aide() {
-    cat <<EOF
-Usage: repowarden run rerun <run-id|--failed|--workflow <nom>>
-
-Relance un workflow GitHub Actions.
-
-Options:
-  <run-id>           ID du run à relancer
-  --failed           Relance le dernier run échoué du repo
-  --workflow <nom>   Relance le dernier run du workflow spécifié
-
-Exemples:
-  repowarden run rerun 123456789
-  repowarden run rerun --failed
-  repowarden run rerun --workflow "CI"
-EOF
+    _tr help.run
+    printf '%b\n' "$_T"
 }
 
 [ $# -ge 1 ] || { aide >&2; exit 1; }

package/bin/statut

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
+# Usage : repowarden statut   (ou repowarden, sans argument)
+#
 # État de repowarden sur ce poste et dans le dépôt courant, puis la commande
-# suivante à lancer (l'équivalent de « gh auth status » ou « brew doctor ») :
-#   repowarden statut        (ou repowarden, sans argument)
+# suivante à lancer (l'équivalent de « gh auth status » ou « brew doctor »).
 # Lecture seule : rien n'est modifié.
 set -euo pipefail
 

package/bin/ticket

@@ -18,16 +18,36 @@ source "$ROOT/hooks/lib/common.sh"
 # shellcheck source=../hooks/lib/tickets.sh
 source "$ROOT/hooks/lib/tickets.sh"
 
-aide() { sed -n '2,9p' "$0" | sed 's/^# \{0,1\}//'; }
+aide() { _tr help.ticket; printf '%b\n' "$_T" >&2; }
 
 [ -n "$GIT_TOPLEVEL" ] || { err_t install.not_repo; exit 1; }
 cd "$GIT_TOPLEVEL"
 
+# Vrai si remote.origin.fetch couvre déjà la branche $1 : ligne exacte, ou
+# refspec générale d'un clone normal. Évite d'empiler la même ligne à chaque
+# appel (la config de l'utilisateur est laissée intacte quand elle suffit).
+refspec_covers() {
+    local ligne
+    while IFS= read -r ligne; do
+        case "$ligne" in
+            "+refs/heads/$1:refs/remotes/origin/$1" | "+refs/heads/*:refs/remotes/origin/*") return 0 ;;
+        esac
+    done < <(git config --get-all remote.origin.fetch)
+    return 1
+}
+
 # Se place sur la branche $1 (locale, ou suivie depuis origin)
 switch_to() {
     if git show-ref -q --verify "refs/heads/$1"; then
         git switch -q "$1"
     else
+        # Clone mono-branche : la ref du ticket existe sans être suivie, et
+        # « switch --track » la refuse (« … is not a branch ») tant que la
+        # refspec ne la couvre pas. On la couvre une seule fois, puis on suit.
+        if ! refspec_covers "$1"; then
+            git config --add remote.origin.fetch "+refs/heads/$1:refs/remotes/origin/$1"
+        fi
+        git fetch -q origin
         git switch -q --track -c "$1" "origin/$1"
     fi
 }
@@ -37,7 +57,7 @@ prendre() { gh issue edit "$1" --add-assignee @me >/dev/null 2>&1 || true; }
 
 cmd_ticket() {
     local n="$1" json etat titre etiquettes base
-    command -v gh >/dev/null || { err_t bot.no_gh; exit 1; }
+    gh_ready || exit 1
     step_t tk.cli.fetch "$n"
     git fetch -q origin --prune
     ticket_remote_branch_r "$n"
@@ -83,7 +103,7 @@ cmd_nouveau() {
         shift
     done
     [ -n "$titre" ] || { err_t tk.cli.title_required; exit 1; }
-    command -v gh >/dev/null || { err_t bot.no_gh; exit 1; }
+    gh_ready || exit 1
     if tickets_managed; then
         etiquettes+=(--label "$S_AVALIDER")
         [ -z "$type" ] || etiquettes+=(--label "type: $type")
@@ -119,7 +139,9 @@ case "${1:-}" in
         if [ -n "$REPLY" ]; then
             info_t tk.cli.current "$branche" "$REPLY"
         else
-            ticket_hint "$branche"
+            err_t tk.cli.no_ticket_here
+            aide >&2
+            exit 1
         fi
         ;;
     *)

package/bin/ticket-comment

@@ -10,19 +10,16 @@ source "$ROOT/hooks/lib/common.sh"
 source "$ROOT/hooks/lib/i18n.sh"
 
 aide() {
-    cat <<EOF
-Usage: repowarden ticket comment <n> "<texte>"
-
-Ajoute un commentaire sur le ticket #<n>.
-
-Exemples:
-  repowarden ticket comment 123 "Conception retenue : ..."
-  repowarden ticket comment 456 "PR prête pour review"
-EOF
+    _tr help.ticket
+    printf '%b\n' "$_T"
 }
 
+case "${1:-}" in
+    -h | --help) aide; exit 0 ;;
+esac
+
 [ $# -ge 2 ] || { aide >&2; exit 1; }
-command -v gh >/dev/null || { err_t bot.no_gh; exit 1; }
+gh_ready || exit 1
 
 n="${1}"
 texte="${2}"

package/bin/ticket-label

@@ -10,23 +10,16 @@ source "$ROOT/hooks/lib/common.sh"
 source "$ROOT/hooks/lib/i18n.sh"
 
 aide() {
-    cat <<EOF
-Usage: repowarden ticket label <n> <label> [--remove]
-
-Ajoute ou retire un label sur le ticket #<n>.
-
-Options:
-  --remove    Retire le label au lieu de l'ajouter
-
-Exemples:
-  repowarden ticket label 123 "validé"
-  repowarden ticket label 123 "statut: backlog"
-  repowarden ticket label 123 "wip" --remove
-EOF
+    _tr help.ticket
+    printf '%b\n' "$_T"
 }
 
+case "${1:-}" in
+    -h | --help) aide; exit 0 ;;
+esac
+
 [ $# -ge 2 ] || { aide >&2; exit 1; }
-command -v gh >/dev/null || { err_t bot.no_gh; exit 1; }
+gh_ready || exit 1
 
 n="${1}"
 label="${2}"

package/bin/tickets

@@ -34,7 +34,7 @@ done
 if [ "$commande" = sync ]; then
     # shellcheck source=../hooks/lib/tickets.sh
     source "$ROOT/hooks/lib/tickets.sh"
-    command -v gh >/dev/null || { err_t bot.no_gh; exit 1; }
+    gh_ready || exit 1
     [ -n "$GIT_TOPLEVEL" ] || { err_t install.not_repo; exit 1; }
     cd "$GIT_TOPLEVEL"
     tickets_sync force
@@ -42,12 +42,11 @@ if [ "$commande" = sync ]; then
     exit 0
 fi
 if [ "$commande" != init ]; then
-    sed -n '2,16p' "$0" | sed 's/^# \{0,1\}//'
-    [ "$commande" = "" ] || [ "$commande" = -h ] || [ "$commande" = --help ]
+    _tr help.tickets; printf '%b\n' "$_T"
     exit
 fi
 
-command -v gh >/dev/null || { err_t bot.no_gh; exit 1; }
+gh_ready || exit 1
 [ -n "$GIT_TOPLEVEL" ] || { err_t install.not_repo; exit 1; }
 cd "$GIT_TOPLEVEL"
 [ -n "$REPO" ] || REPO="$(gh repo view --json nameWithOwner -q .nameWithOwner)"

package/hooks/agents/repowarden-garde.js

@@ -0,0 +1,16 @@
+// Garde-fou repowarden pour opencode (écrit par repowarden agents init) :
+// chaque outil est soumis à « repowarden garde » avant de s'exécuter. Refus
+// (code 2) → erreur rendue à l'agent, avec la commande à lancer. repowarden
+// absent ou en panne : rien n'est bloqué.
+// Plugins opencode : https://opencode.ai/docs/plugins/ (tool.execute.before)
+import { spawnSync } from "node:child_process"
+
+export const RepowardenGarde = async ({ directory }) => ({
+  "tool.execute.before": async (input, output) => {
+    const r = spawnSync("repowarden", ["garde"], {
+      input: JSON.stringify({ tool: input.tool, args: output.args, cwd: directory }),
+      encoding: "utf8",
+    })
+    if (r.status === 2) throw new Error((r.stderr || "").trim())
+  },
+})

package/hooks/lang/node.sh

@@ -44,15 +44,17 @@ node_test() {
 # inaccessible : prouvé) ; knip s'il est installé dans le projet (fichiers,
 # exports, dépendances non référencés : candidats)
 node_deadcode() {
-    local ran=""
+    local ran="" a_tsc=0 a_knip=0
     if [ -f tsconfig.json ] && [ -x node_modules/.bin/tsc ]; then
         ran=1
+        a_tsc=1
         node_modules/.bin/tsc --noEmit -p . --noUnusedLocals --noUnusedParameters \
             --allowUnreachableCode false --pretty false 2>/dev/null |
             sed -nE 's/^(.+)\(([0-9]+),[0-9]+\): error (TS6133|TS6138|TS6192|TS6196|TS6198|TS7027): (.*)$/prouve\t\1\t\2\t\4/p'
     fi
     if [ -x node_modules/.bin/knip ] && has node; then
         ran=1
+        a_knip=1
         _tr dc.knip_file
         local m_file="$_T"
         _tr dc.knip_export
@@ -71,5 +73,15 @@ node_deadcode() {
                         for (const d of i[k] || []) out(i.file, 0, process.env.M_DEP + " " + d.name);
                 }'
     fi
-    [ -n "$ran" ] || deadcode_tool_missing "JavaScript / TypeScript" "typescript / knip"
+    if [ -z "$ran" ]; then
+        deadcode_tool_missing "JavaScript / TypeScript" "typescript / knip"
+    elif [ "$a_tsc" = 0 ]; then
+        # knip seul : les variables, paramètres et imports inutilisés restent à analyser
+        _tr dc.scope.locals
+        deadcode_partial "JavaScript / TypeScript" typescript "$_T" "npm i -D typescript"
+    elif [ "$a_knip" = 0 ]; then
+        # tsc seul : les fichiers, exports et dépendances non référencés restent à analyser
+        _tr dc.scope.files
+        deadcode_partial "JavaScript / TypeScript" knip "$_T" "npm i -D knip"
+    fi
 }

package/hooks/lang/python.sh

@@ -63,17 +63,29 @@ python_test() {
 # vulture (confiance 100 % : prouvé, en dessous : candidat — les frameworks
 # appellent des fonctions par leur nom)
 python_deadcode() {
-    local ran=""
+    local ran="" a_ruff=0 a_vulture=0
     if python_has ruff; then
         ran=1
+        a_ruff=1
         python_run ruff check --select F401,F811,F841 --output-format concise --quiet --exit-zero . 2>/dev/null |
             sed -nE 's/^(.+):([0-9]+):[0-9]+: F[0-9]+ (\[\*\] )?(.*)$/prouve\t\1\t\2\t\4/p'
     fi
     if python_has vulture; then
         ran=1
+        a_vulture=1
         python_run vulture . --min-confidence 60 --exclude ".venv,venv,node_modules,build,dist,site-packages" 2>/dev/null |
             sed -nE -e 's/^(.+):([0-9]+): (.*) \(100% confidence\)$/prouve\t\1\t\2\t\3/p' \
                 -e 's/^(.+):([0-9]+): (.*) \(([0-9]+)% confidence\)$/candidat\t\1\t\2\t\3 (\4 %)/p'
     fi
-    [ -n "$ran" ] || deadcode_tool_missing Python "ruff / vulture"
+    if [ -z "$ran" ]; then
+        deadcode_tool_missing Python "ruff / vulture"
+    elif [ "$a_ruff" = 0 ]; then
+        # vulture seul : les imports et variables inutilisés restent à analyser
+        _tr dc.scope.imports
+        deadcode_partial Python ruff "$_T" "pip install ruff"
+    elif [ "$a_vulture" = 0 ]; then
+        # ruff seul : les fonctions et classes inutilisées restent à analyser
+        _tr dc.scope.functions
+        deadcode_partial Python vulture "$_T" "pip install vulture"
+    fi
 }

package/hooks/lib/common.sh

@@ -370,7 +370,9 @@ check_version() {
     root="${HOOKS_DIR%/hooks}"
     repowarden_version_r "$root"
     installed="$REPLY"
-    [ -n "$installed" ] || return 0
+    # 0.0.0-dev : version inconnue (clone sans tags, git clone --depth) ;
+    # aucune comparaison possible, pas de fausse alerte à chaque commit
+    [ -n "$installed" ] && [ "$installed" != 0.0.0-dev ] || return 0
     local IFS=.
     # shellcheck disable=SC2206 # découpage voulu sur les points
     w=($wanted) i=($installed)

package/hooks/lib/deadcode.sh

@@ -17,11 +17,23 @@
 # Code mort introduit depuis $1 (base) dans les fichiers lus sur stdin.
 # Retour : 1 si un élément bloque selon le réglage deadcode.
 deadcode_projects() {
-    local base="$1" changed added found dir p plugins niveau f l msg path proven=0 cand=0 mode ignore pat code var
-    local ran="" file
-    changed="$(mktemp)"
-    added="$(mktemp)"
-    found="$(mktemp)"
+    local base="$1" changed added found partial dir p plugins niveau f l msg path proven=0 cand=0 mode ignore pat code var
+    local ran="" file tmp partiel=0
+    # Un dossier temporaire unique : les fichiers de l'analyse, dont le
+    # fichier témoin de l'analyse partielle (voir deadcode_partial). Créés
+    # vides tout de suite : sans plugin ni fichier non suivi, rien ne les
+    # ouvrirait en écriture, et leur lecture (« done < found ») échouerait.
+    tmp="$(mktemp -d)"
+    changed="$tmp/changed"
+    added="$tmp/added"
+    found="$tmp/found"
+    partial="$tmp/partial"
+    : >"$changed"
+    : >"$added"
+    : >"$found"
+    : >"$partial"
+    DEADCODE_PARTIAL_FILE="$partial"
+    export DEADCODE_PARTIAL_FILE
     cat >"$changed"
 
     # Lignes ajoutées ou modifiées (fichier:ligne), du commit de base à
@@ -109,14 +121,18 @@ deadcode_projects() {
             attention_t dc.candidate "$path" "$msg"
         fi
     done <"$found"
-    rm -f "$changed" "$added" "$found"
+    # Une analyse partielle (outil absent) interdit tout feu vert sans réserve
+    [ ! -s "$partial" ] || partiel=1
+    rm -rf "$tmp"
 
     if [ -z "$ran" ]; then
         info_t dc.nothing
         return 0
     fi
     if [ "$proven" = 0 ] && [ "$cand" = 0 ]; then
-        ok_t dc.none
+        if [ "$partiel" = 1 ]; then attention_t dc.none_partial
+        else ok_t dc.none
+        fi
         return 0
     fi
     [ "$cand" = 0 ] || info_t dc.summary_candidates "$cand"
@@ -137,8 +153,29 @@ deadcode_projects() {
 }
 
 # Outil d'analyse absent : signalé, sans faire échouer le mode strict
-# (la détection de code mort reste une aide, pas un prérequis du projet)
-deadcode_tool_missing() { attention_t dc.tool_missing "$1" "$2"; }
+# (la détection de code mort reste une aide, pas un prérequis du projet).
+# Un outil totalement absent compte comme une analyse partielle.
+deadcode_tool_missing() {
+    attention_t dc.tool_missing "$1" "$2"
+    deadcode_partial_note "$1"
+}
+
+# Analyse partielle : $1 langage, $2 outil absent, $3 ce qui n'est pas analysé
+# (déjà traduit, clé dc.scope.*), $4 installation à donner.
+# Un des outils du langage manque : ce qu'il couvre n'est pas analysé, et la
+# fin de l'analyse ne dira pas que tout va bien (voir deadcode_projects).
+deadcode_partial() {
+    attention_t dc.partial "$1" "$2" "$3" "$4"
+    deadcode_partial_note "$1"
+}
+
+# Note l'analyse partielle : les plugins tournent dans un sous-shell de tube
+# ({ … } |), une variable ne reviendrait pas — le signal passe par un fichier
+# témoin sous le dossier temporaire de l'analyse
+deadcode_partial_note() {
+    [ -n "${DEADCODE_PARTIAL_FILE:-}" ] || return 0
+    printf '%s\n' "$1" >>"$DEADCODE_PARTIAL_FILE"
+}
 
 # Java (Maven, Gradle) : règles PMD dont le résultat est prouvé — import,
 # champ, méthode ou variable privés jamais utilisés dans leur portée

package/hooks/lib/forge.sh

@@ -45,3 +45,24 @@ github_sans_rulesets() {
     local reponse
     ! reponse="$(gh api "repos/$1/rulesets" 2>&1)" && [[ "$reponse" == *"403"* ]]
 }
+
+# gh présent (rien n'est affiché)
+gh_present() { command -v gh >/dev/null 2>&1; }
+
+# gh présent et connecté : gh auth status réussi
+gh_connected() { gh_present && gh auth status >/dev/null 2>&1; }
+
+# Contrôle partagé des commandes qui parlent à GitHub (bin/ticket, bin/tickets,
+# bin/app) : gh installé ET connecté, sinon le message du problème et un échec.
+# Sans gh : bot.no_gh ; sans connexion : gh.not_logged (la commande de
+# connexion, le scope workflow étant requis pour pousser .github/workflows/).
+gh_ready() {
+    if ! gh_present; then
+        err_t bot.no_gh
+        return 1
+    fi
+    if ! gh_connected; then
+        err_t gh.not_logged
+        return 1
+    fi
+}

package/hooks/lib/i18n/en.sh

@@ -63,6 +63,7 @@ _msg_en() {
         tk.cli.issue_created_branch) _M="Ticket #%s created." ;;
         tk.cli.title_required) _M="Ticket title required: repowarden ticket nouveau \"<title>\"" ;;
         tk.cli.current) _M="Branch %s: ticket #%s." ;;
+        tk.cli.no_ticket_here) _M="No ticket for this branch." ;;
         cc.ticket_offer) _M="No ticket for this branch. Create one now (title: the description)? [y/N]: " ;;
         cc.ticket_created) _M="Ticket #%s created and referenced in the message." ;;
         cc.preview) _M="Message" ;;
@@ -106,6 +107,25 @@ _msg_en() {
         install.keys_migrated) _M="repogarde.* settings (%s) renamed to repowarden.*" ;;
         help.alias.feat) _M="(branch: feature/ accepted)" ;;
         help.alias.fix) _M="(branch: bugfix/, hotfix/ accepted)" ;;
+        # Help texts for commands (--help): single source shown by bin/repowarden
+        help.main) _M="Usage: repowarden <command> [options] · detailed help: repowarden <command> --help\n\n  repowarden                                     post status and next step\n  repowarden statut                              (same)\n  repowarden install [--global] [--lang fr|en]   activate hooks (install.sh)\n  repowarden uninstall [--global] [--purge]      remove them (before npm uninstall -g)\n  repowarden bots                                GitHub repo bots (CI, releases, tickets…)\n  repowarden cc                                  commit assistant\n  repowarden code-mort                           new dead code in branch\n  repowarden ticket                              ticket of the current branch\n  repowarden ticket <n>                          branch of ticket (created, linked if needed)\n  repowarden ticket nouveau \"<title>\"            new ticket\n  repowarden ticket comment <n> \"<text>\"         add a comment\n  repowarden ticket label <n> <label> [--remove] manage ticket labels\n  repowarden pr label <n> <label> [--remove]     manage PR labels\n  repowarden pr checks <n>                       show PR checks\n  repowarden run rerun <id|--failed|--workflow>  rerun a workflow\n  repowarden run list [--workflow <name>]        list recent runs\n  repowarden tickets init                        set up ticket tracking (GitHub)\n  repowarden tickets sync                        my assigned tickets → local branches\n  repowarden proteger [options]                  protect GitHub branches\n  repowarden migrer [--pr] [--hooks]             migrate from repogarde to repowarden\n  repowarden npm-publication                     automate npm publication\n  repowarden app init                            GitHub App for workflows (once)\n  repowarden bot [init|rapport]                  org bot (pilot repo)\n  repowarden agents init [--claude] [--opencode] AI agent guard (Claude Code, opencode)\n  repowarden garde                               checks an agent action (called by its hook)\n  repowarden --version                           installed version" ;;
+        help.statut) _M="Usage: repowarden statut   (or repowarden, no args)\n\nRead-only status of repowarden on this machine and in the current repo,\nplus the next command to run (like \"gh auth status\" or \"brew doctor\")." ;;
+        help.install) _M="Usage: repowarden install [--global] [--lang fr|en] [--bots | --sans-bots]\n\nActivate repowarden hooks (install.sh).\n  --global       all repos (and commit assistant: git cc)\n  --lang fr|en   message language (asked once if unset)\n  --bots         then propose repo bots (repowarden bots)\n  --sans-bots    never propose bots" ;;
+        help.uninstall) _M="Usage: repowarden uninstall [--global] [--purge] [--scan FOLDER]\n\nRemove repowarden hooks (only if owned). Do before npm uninstall -g.\n  --global        also remove global installation\n  --purge         remove caches and list repos still pointing to repowarden\n  --scan FOLDER   check repos in FOLDER still using repowarden (with --purge)" ;;
+        help.bots) _M="Usage: repowarden bots\n\nSet up GitHub repo bots (CI, releases, cleanup, tickets, App, protection,\nnpm): one global question, per-bot confirmation, preview, final confirmation.\nNothing done without consent. Can be rerun. Also via install --bots.\nNeeds a terminal, gh logged in and admin rights on the repo." ;;
+        help.bot) _M="Usage: repowarden bot [--repo o/r]… [--dry-run] [--rapport FILE]\n       repowarden bot rapport FILE\n       repowarden bot init\n\nOrg bot: nightly (and on demand) updates adopted projects (protection,\nmigration), publishes a report to the \"Rapport du bot repowarden\" issue.\n--dry-run shows without changes. init writes .github/workflows/bot.yml.\nUses installation token of the bot App (repowarden app init --bot)." ;;
+        help.cc) _M="Usage: repowarden cc [git commit options]   (alias: git cc)\n       repowarden cc -m \"description\" [--type T] [--scope S] [--breaking NOTE] [--body TEXT] [--refs \"Ticket: #12\"]\n       repowarden cc --dry-run\n\nConventional commit assistant: guides header, body and footer, runs hooks.\nBatch mode (-m etc.): same checks, type/scope inferred from branch if omitted.\n  --strict    any refused answer stops (nothing committed)\n  --dry-run   show message without committing" ;;
+        help.code-mort) _M="Usage: repowarden code-mort [base]\n\nDead code introduced by your branch (like CI): only added/changed lines\nsince base (commits, staged/uncommitted, new files). Default: merge-base\nwith origin/main. See docs/code-mort.md (proven vs candidates)." ;;
+        help.ticket) _M="Usage: repowarden ticket <n>                          branch for ticket (created, linked if needed)\n       repowarden ticket                              ticket of current branch\n       repowarden ticket nouveau \"<title>\" [--type fix] [--description \"…\"]\n       repowarden ticket comment <n> \"<text>\"         add comment\n       repowarden ticket label <n> <label> [--remove] manage labels\n\nTicket first: taking <n> assigns to you and switches to its branch\n(created from develop if needed). \"nouveau\" creates a ticket (\"à valider\"\nif tracking is managed). Needs gh connected (https://cli.github.com)." ;;
+        help.tickets) _M="Usage: repowarden tickets init [--repo owner/name] [--sans-validation-auto]\n       repowarden tickets sync\n\nSets up ticket tracking: labels, issue template, workflow; classifies\nexisting tickets; records PR branches. sync checks out local branches for\ntickets assigned to you (auto with ticketSync=auto, manual by default)." ;;
+        help.pr) _M="Usage: repowarden pr label <n> <label> [--remove]\n       repowarden pr checks <n>\n\nlabel adds or removes a label from PR #<n>; checks shows its checks\n(name, conclusion, status, link).\nExamples:\n  repowarden pr label 123 \"ready-for-review\"\n  repowarden pr label 123 \"needs-changes\" --remove\n  repowarden pr checks 123" ;;
+        help.run) _M="Usage: repowarden run rerun <run-id|--failed|--workflow <name>>\n       repowarden run list [--workflow <name>] [--limit N]\n\nrerun restarts a GitHub Actions workflow. list shows recent runs\n(default limit 20).\nExamples:\n  repowarden run rerun --failed\n  repowarden run list --workflow \"CI\" --limit 10" ;;
+        help.proteger) _M="Usage: repowarden proteger [--repo owner/name] [--checks \"repowarden,tests (ubuntu-latest)\"]\n       [--relecteurs N] [--codeowners] [--environnement NAME] [--approbateurs \"login …\"]\n       [--sans-tags] [--dry-run] [--verifier]\n\nProtects GitHub repo per .repowarden.conf: required PR, required checks,\nno force push/deletion, ruleset, squash merges, v* tags reserved to\nworkflows, optional human approvals. --verifier checks online rules\nwithout changes. Needs gh and admin rights." ;;
+        help.migrer) _M="Usage: repowarden migrer [--pr] [--hooks]\n\nMigrates from repogarde to repowarden (docs/migration-v4.md): configs,\nworkflows, renames, lists manual steps left. Safe to rerun.\n  --pr     on chore/migration-repowarden-vN: commit, push and PR\n  --hooks  also move leftover lefthook hooks to .git/hooks-lefthook/" ;;
+        help.npm-publication) _M="Usage: repowarden npm-publication [--repo owner/name] [--workflow release.yml]\n       [--environnement NAME] [--dry-run]\n\nSets up automatic npm publishing per release via OIDC (trusted publishing,\nprovenance). Needs npm logged in, package exists; if interrupted resumes.\nWorkflow: release.yml publishes via npm-publish.yml." ;;
+        help.garde) _M="Usage: repowarden garde [--format claude|opencode]   (reads the action on standard input)\n\nAI agent guard, called by the agent's hook before each action (repowarden\nagents init wires it): exit code 0 allowed, 2 refused with the command to\nrun. In a repowarden repository: no change on a detached HEAD, on a\nprotected branch, or outside a ticket branch when the repository tracks its\ntickets; branches created by repowarden ticket <n>, commits by repowarden\ncc; no --no-verify, no git add . / -A / --all. Requires jq." ;;
+        help.agents) _M="Usage: repowarden agents init [--claude] [--opencode] [--projet | --global]\n\nWires the guard (repowarden garde) into AI agents: Claude Code PreToolUse\nhook (.claude/settings.json), opencode plugin\n(.opencode/plugins/repowarden-garde.js). Without --claude or --opencode:\nboth. --projet (default): repository files, to commit; --global: user\nconfiguration. Re-runnable: existing files are completed, never\noverwritten." ;;
+        help.app) _M="Usage: repowarden app init [--repo owner/name] [--nom NAME] [--administration]\n       repowarden app init --bot\n\nCreates/sets up a GitHub App for repowarden workflows (Actions token doesn't\ntrigger other workflows; App token does). Browser-based manifest, minimal\npermissions, credentials stored securely, installed on repo. --bot for org\nbot (pilot repo). Needs gh and node. Rerunnable." ;;
         # Hooks and language plugins
         hook.pre_commit.1) _M="Commit refused: branch name does not follow the convention." ;;
         hook.pre_commit.2) _M="Direct commit on '%s' forbidden. Create a branch: git switch -c feat/my-feature" ;;
@@ -127,6 +147,7 @@ _msg_en() {
         hook.pre_push.5) _M="%s: no changed file, nothing to test." ;;
         hook.pre_push.6) _M="Nothing to test (branch deletion only)." ;;
         hook.pre_push.7) _M="Pre-push OK" ;;
+        hook.pre_push.workflow_scope) _M="gh token without the 'workflow' scope: GitHub will refuse a push touching .github/workflows/. Allow it (then sign in again): gh auth refresh -h github.com -s workflow" ;;
         hook.pre_push.lint.missing) _M="%s not installed, %s not checked (install: %s)." ;;
         hook.pre_push.lint.run) _M="%s: %s" ;;
         hook.branch_hint.1) _M="Branch name \"%s\" does not follow the convention: commits and pushes will be refused. Rename:" ;;
@@ -310,6 +331,7 @@ _msg_en() {
         ci.proteger.tags_none) _M="not protected (--sans-tags)" ;;
         ci.proteger.unknown_team) _M="Unknown or inaccessible team: %s (format @organisation/team)" ;;
         ci.proteger.unknown_user) _M="Unknown user: %s" ;;
+        mig.unknown_version) _M="repowarden version unknown (clone without tags): git -C %s fetch --tags, or REPOWARDEN_MAJEURE=4 repowarden migrer." ;;
         mig.no_major) _M="repowarden major version not found (%s): REPOWARDEN_MAJEURE=4 repowarden migrer." ;;
         mig.dirty) _M="Uncommitted changes: commit or stash before repowarden migrer --pr." ;;
         mig.pr_open) _M="Migration PR already open (%s): nothing to do." ;;
@@ -376,6 +398,12 @@ _msg_en() {
         dc.candidate) _M="%s: %s (candidate: check for dynamic usage)" ;;
         dc.nothing) _M="No file in an analysable language among the changes: nothing to check." ;;
         dc.none) _M="No new dead code." ;;
+        dc.none_partial) _M="No new dead code in what was analysed: partial analysis, see above." ;;
+        dc.partial) _M="%s: %s not installed: %s (%s)." ;;
+        dc.scope.functions) _M="unused functions and classes not analysed" ;;
+        dc.scope.imports) _M="unused imports and variables not analysed" ;;
+        dc.scope.locals) _M="unused variables, parameters and imports not analysed" ;;
+        dc.scope.files) _M="unreferenced files, exports and dependencies not analysed" ;;
         dc.summary_candidates) _M="%s candidate(s) to check: not blocking (reflection, framework or public API calls are possible)." ;;
         dc.summary_proven) _M="%s proven dead code item(s): remove them, or ignore them (deadcodeIgnore)." ;;
         dc.summary_strict) _M="%s dead code item(s) (deadcode = strict mode)." ;;
@@ -397,6 +425,7 @@ _msg_en() {
         ci.notify.failure) _M="❌ %s: release workflow failed: %s" ;;
         # GitHub CLI
         bot.no_gh) _M="GitHub CLI (gh) required: https://cli.github.com" ;;
+        gh.not_logged) _M="gh not logged in: gh auth login -s workflow" ;;
         # npm package
         npm.npx_global) _M="npx uses a temporary folder: global hooks would point to a deleted folder. Install the package first: npm install -g repowarden, then repowarden install --global." ;;
         npm.no_npm) _M="npm required: https://nodejs.org" ;;
@@ -641,6 +670,25 @@ _msg_en() {
         run.listing.workflow) _M="Listing runs for workflow \"%s\"..." ;;
         # PR checks
         pr.checks.checking) _M="Checking checks for PR #%s..." ;;
+        # AI agent guard (repowarden garde, repowarden agents)
+        garde.format) _M="Unknown format \"%s\": claude or opencode." ;;
+        garde.no_jq) _M="repowarden garde: jq missing, action not checked (install jq: https://jqlang.org)." ;;
+        garde.json) _M="repowarden garde: unreadable JSON input, action not checked." ;;
+        garde.detache) _M="change refused: detached HEAD in %s.\n  → Switch to a ticket's branch: repowarden ticket <n>" ;;
+        garde.protegee) _M="change refused: \"%s\" is a protected branch.\n  → Work on a ticket's branch: repowarden ticket <n>" ;;
+        garde.protegee_libre) _M="change refused: \"%s\" is a protected branch.\n  → Create a work branch: git switch -c <type>/<topic>" ;;
+        garde.hors_ticket) _M="change refused: branch \"%s\" is not a ticket's branch (<type>/<n>-<topic>).\n  → Take the ticket: repowarden ticket <n>" ;;
+        garde.branche) _M="command refused: \"%s\" creates a branch; here, branches come from tickets.\n  → repowarden ticket <n>" ;;
+        garde.commit) _M="command refused: \"%s\"; commits go through the assistant (only --amend --no-edit is allowed).\n  → repowarden cc -m \"<description>\" --refs \"Ticket : #<n>\"" ;;
+        garde.no_verify) _M="command refused: \"%s\" bypasses the repowarden hooks.\n  → Run it again without --no-verify and fix what the hooks report." ;;
+        garde.add_tout) _M="command refused: \"%s\" adds the whole repository.\n  → Add files one by one: git add <files>" ;;
+        agents.added) _M="%s: guard added (%s)." ;;
+        agents.present) _M="%s: guard already in place (%s)." ;;
+        agents.kept) _M="%s: %s exists and differs from the template; kept as is (template: %s)." ;;
+        agents.bad_json) _M="%s: %s is not valid JSON; nothing was changed." ;;
+        agents.no_jq) _M="jq is required to update %s (https://jqlang.org)." ;;
+        agents.versionner) _M="To commit: git add %s" ;;
+        agents.no_repowarden) _M="The guard calls \"repowarden garde\": repowarden must be on the PATH (npm install -g repowarden)." ;;
         *) _M="" ;;
     esac
 }