feat: clean install (Gitea en dur, scan off) + durcissement sécurité entreprise
Gitea - lien « Code source » hardcodé (REPO_SOURCE_URL) vers le dépôt, toujours visible - retrait complet du réglage configurable (api.ts, route+store settings, SettingsView, i18n, help, tests) Découverte des dépôts - aucune racine de scan par défaut → pas de scan au premier démarrage (clean install) - corrige la découverte des dépôts à l'INTÉRIEUR d'une racine qui est elle-même un repo (depth 0 = conteneur de scan, on descend ; depth > 0 = feuille) Sécurité « enterprise-deployable » - en-têtes HTTP durcis (CSP, X-Frame-Options, nosniff, Referrer-Policy, HSTS conditionnel, no-store API), header Server retiré - permissions DB 0o600 / dossier de données 0o700 ; error handler sanitisé ; garde Content-Type sur les mutations - chiffrement au repos AES-256-GCM des secrets (server_secret, clé privée VAPID) via SecretBox - journal d'audit (migration #7) + endpoint /audit-logs + RGPD export/effacement + UI Réglages - SECURITY.md, docs/ENTERPRISE_DEPLOYMENT.md, sections README EN/FR, SBOM CycloneDX en CI CI - pack-smoke packe depuis le contexte du package (cd packages/server) au lieu de « npm pack -w » : corrige l'embarquement de @arboretum/shared dans le tarball Purge des données personnelles du dépôt public - suppression de spikes/s4-discovery/result.json, reformulation du VERDICT - chemin de test générique, anonymisation des 5 fixtures de dialogues Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -1,6 +1,6 @@
|
||||
# Spike S4 — Découverte JSONL + registre — VERDICT : ✅ GO
|
||||
|
||||
Exécuté le 2026-06-11 sur la machine de Johan (CLI 2.1.170/2.1.173 actifs, transcripts 2.1.139 → 2.1.173). Script : `scan.mjs`, résultats bruts : `result.json`.
|
||||
Exécuté sur un poste de dev (CLI 2.1.170/2.1.173 actifs, transcripts 2.1.139 → 2.1.173). Script : `scan.mjs`.
|
||||
|
||||
## Critères Go
|
||||
|
||||
|
||||
@@ -1,141 +0,0 @@
|
||||
{
|
||||
"scan": {
|
||||
"files": 1318,
|
||||
"bytes": 470368918,
|
||||
"ok": 1316,
|
||||
"noCwd": 2,
|
||||
"noSessionId": 0,
|
||||
"empty": 0,
|
||||
"errors": 0,
|
||||
"mb": "449",
|
||||
"scanMs": "1368",
|
||||
"okPct": "99.8 %"
|
||||
},
|
||||
"mungeValidation": {
|
||||
"mungeMatch": 1316,
|
||||
"mungeMismatch": 0,
|
||||
"mismatchSamples": []
|
||||
},
|
||||
"lineTypes": {
|
||||
"user": 1315,
|
||||
"last-prompt": 1313,
|
||||
"attachment": 1308,
|
||||
"assistant": 1204,
|
||||
"queue-operation": 1001,
|
||||
"ai-title": 470,
|
||||
"file-history-snapshot": 431,
|
||||
"system": 398,
|
||||
"permission-mode": 387,
|
||||
"agent-name": 228,
|
||||
"mode": 219,
|
||||
"bridge-session": 6
|
||||
},
|
||||
"versions": {
|
||||
"2.1.139": 16,
|
||||
"2.1.140": 86,
|
||||
"2.1.142": 19,
|
||||
"2.1.143": 113,
|
||||
"2.1.144": 58,
|
||||
"2.1.145": 81,
|
||||
"2.1.146": 43,
|
||||
"2.1.150": 137,
|
||||
"2.1.152": 59,
|
||||
"2.1.153": 18,
|
||||
"2.1.156": 80,
|
||||
"2.1.159": 77,
|
||||
"2.1.160": 58,
|
||||
"2.1.161": 102,
|
||||
"2.1.162": 60,
|
||||
"2.1.163": 3,
|
||||
"2.1.165": 20,
|
||||
"2.1.166": 6,
|
||||
"2.1.168": 83,
|
||||
"2.1.169": 74,
|
||||
"2.1.170": 90,
|
||||
"2.1.173": 33
|
||||
},
|
||||
"registry": {
|
||||
"count": 3,
|
||||
"entries": [
|
||||
{
|
||||
"file": "1061541.json",
|
||||
"pid": 1061541,
|
||||
"sessionId": "026cc229-c1cd-4327-9c53-68406794e870",
|
||||
"cwd": "/home/johan/WebstormProjects",
|
||||
"status": "busy",
|
||||
"waitingFor": null,
|
||||
"kind": "interactive",
|
||||
"version": "2.1.170",
|
||||
"peerProtocol": 1,
|
||||
"updatedAt": 1781192047718,
|
||||
"alive": true,
|
||||
"procStartOk": true
|
||||
},
|
||||
{
|
||||
"file": "1701999.json",
|
||||
"pid": 1701999,
|
||||
"sessionId": "8733906c-832a-4e74-aab7-7d8b2f5eb9d2",
|
||||
"cwd": "/home/johan/WebstormProjects",
|
||||
"status": "idle",
|
||||
"waitingFor": null,
|
||||
"kind": "interactive",
|
||||
"version": "2.1.173",
|
||||
"peerProtocol": 1,
|
||||
"updatedAt": 1781191339305,
|
||||
"alive": true,
|
||||
"procStartOk": true
|
||||
},
|
||||
{
|
||||
"file": "597768.json",
|
||||
"pid": 597768,
|
||||
"sessionId": "95f8eaf3-feeb-4fbe-8848-fa7a994c8d7f",
|
||||
"cwd": "/home/johan/WebstormProjects",
|
||||
"status": "busy",
|
||||
"waitingFor": null,
|
||||
"kind": "interactive",
|
||||
"version": "2.1.170",
|
||||
"peerProtocol": 1,
|
||||
"updatedAt": 1781192263383,
|
||||
"alive": true,
|
||||
"procStartOk": true
|
||||
}
|
||||
]
|
||||
},
|
||||
"attachment": {
|
||||
"inWebstormProjects": 573,
|
||||
"outside": 743,
|
||||
"topDirs": {
|
||||
"(racine)": 323,
|
||||
"beehelp_prospect": 133,
|
||||
"techos_web": 31,
|
||||
"beehelp_api": 27,
|
||||
"techos_api": 23,
|
||||
"beehelp_web": 15,
|
||||
"teknoroot-simulator-web": 5,
|
||||
"beehelp_claude_marketplace": 3,
|
||||
"beehelp_lambdas": 2,
|
||||
"teknoroot-simulator-api": 2,
|
||||
"Beehelp_iac": 1,
|
||||
"Techos_V1_outdated": 1,
|
||||
"bee-tiptap-resolver": 1,
|
||||
"beehelp_api-wt-qualiobee-docs": 1,
|
||||
"beehelp_api-wt": 1
|
||||
}
|
||||
},
|
||||
"failuresSample": [
|
||||
{
|
||||
"fp": "/home/johan/.claude/projects/-home-johan-WebstormProjects-beehelp-api/0811ca37-c488-45aa-8a9e-5ecd6c87dfeb.jsonl",
|
||||
"why": "pas de cwd",
|
||||
"types": [
|
||||
"queue-operation"
|
||||
]
|
||||
},
|
||||
{
|
||||
"fp": "/home/johan/.claude/projects/-tmp/59e9a9f8-a5f2-4773-b1f6-72fa8b9514a9.jsonl",
|
||||
"why": "pas de cwd",
|
||||
"types": [
|
||||
"queue-operation"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user