Scripts & Outils

#!/bin/bash
# Claude Code status line — barre de contexte segmentée
# Par David Perrot — legeek.tech
input=$(cat)

used_pct=$(echo "$input" | jq -r '.context_window.used_percentage // empty')
ctx_size=$(echo "$input" | jq -r '.context_window.context_window_size // empty')
input_tokens=$(echo "$input" | jq -r '.context_window.current_usage.input_tokens // empty')
cache_read=$(echo "$input" | jq -r '.context_window.current_usage.cache_read_input_tokens // empty')
cache_write=$(echo "$input" | jq -r '.context_window.current_usage.cache_creation_input_tokens // empty')
output_tokens=$(echo "$input" | jq -r '.context_window.current_usage.output_tokens // empty')
model=$(echo "$input" | jq -r '.model.display_name // empty')
cwd=$(echo "$input" | jq -r '.workspace.current_dir // empty')

RST="\033[0m"; BLD="\033[1m"; DIM="\033[2m"
FG_GRN="\033[32m"; FG_YEL="\033[33m"; FG_RED="\033[31m"; FG_CYN="\033[36m"
BG_CYN="\033[46m"; BG_MAG="\033[45m"; BG_GRN="\033[42m"; BG_YEL="\033[43m"
BG_DIM="\033[100m"; DARK="\033[30m"; WHT="\033[97m"

pct_of() {
  local val="$1"
  [ -z "$val" ] || [ "$val" = "null" ] || [ "$val" = "0" ] && echo "0" && return
  [ -z "$ctx_size" ] || [ "$ctx_size" = "0" ] && echo "0" && return
  echo "scale=0; $val * 100 / $ctx_size" | bc
}

# Render segment: n chars wide, bg color, short label, full label
bar_seg() {
  local n="$1" bg="$2" short="$3" full="$4"
  [ "$n" -le 0 ] && return

  # Choose label that fits
  local lbl=""
  if   [ "$n" -ge "${#full}"  ]; then lbl="$full"
  elif [ "$n" -ge "${#short}" ]; then lbl="$short"
  elif [ "$n" -ge 2 ]          ; then lbl="${short:0:$n}"
  fi

  local ll=${#lbl}
  local pad=$(( n - ll ))
  local pl=$(( pad / 2 ))
  local pr=$(( pad - pl ))

  printf "${bg}${DARK}"
  [ "$pl" -gt 0 ] && printf '%*s' "$pl" ''
  printf '%s' "$lbl"
  [ "$pr" -gt 0 ] && printf '%*s' "$pr" ''
  printf "${RST}"
}

if [ -z "$used_pct" ]; then
  printf "${FG_CYN}%s${RST}  %s" "$model" "$(basename "$cwd")"
else
  used_int=$(printf "%.0f" "$used_pct")

  pct_conv=$(pct_of "$input_tokens")
  pct_mcp=$(pct_of "$cache_write")
  pct_ctxt=$(pct_of "$cache_read")
  pct_out=$(pct_of "$output_tokens")

  # Global color
  if   [ "$used_int" -ge 80 ] 2>/dev/null; then gc="$FG_RED"
  elif [ "$used_int" -ge 50 ] 2>/dev/null; then gc="$FG_YEL"
  else gc="$FG_GRN"; fi

  printf "${BLD}${gc}%3d%%${RST} " "$used_int"

  BAR_W=48

  # Used portion in chars
  used_w=$(( used_int * BAR_W / 100 ))
  [ "$used_w" -lt 1 ] && used_w=0

  # Raw segment widths proportional within the used portion
  if [ "$used_int" -gt 0 ]; then
    w_conv=$(( pct_conv * used_w / used_int ))
    w_mcp=$(( pct_mcp  * used_w / used_int ))
    w_ctxt=$(( pct_ctxt * used_w / used_int ))
    w_out=$(( pct_out  * used_w / used_int ))
  else
    w_conv=0; w_mcp=0; w_ctxt=0; w_out=0
  fi

  # Enforce minimum 2 chars for any non-zero segment
  MIN=2
  bump=0
  for v in pct_conv pct_mcp pct_ctxt pct_out; do
    eval "pv=\$$v"
    eval "wv=w_$(echo $v | sed 's/pct_//')"
    eval "wval=\$$wv"
    if [ "$pv" -gt 0 ] && [ "$wval" -lt "$MIN" ]; then
      eval "$wv=$MIN"
      bump=$(( bump + MIN - wval ))
    fi
  done

  # Steal bump from the largest segment
  largest="w_conv"
  lval=$w_conv
  for ww in w_mcp w_ctxt w_out; do
    eval "tv=\$$ww"
    if [ "$tv" -gt "$lval" ]; then lval=$tv; largest=$ww; fi
  done
  eval "$largest=$(( $lval - bump ))"
  eval "[ \$$largest -lt 0 ] && $largest=0"

  # Recompute totals
  filled=$(( w_conv + w_mcp + w_ctxt + w_out ))
  diff=$(( used_w - filled ))
  w_conv=$(( w_conv + diff ))
  [ "$w_conv" -lt 0 ] && w_conv=0

  unused_w=$(( BAR_W - used_w ))
  [ "$unused_w" -lt 0 ] && unused_w=0

  # Render: CONV | MCP | CTXT | OUT | unused
  bar_seg "$w_conv"  "$BG_CYN" "CONV"  "CONV ${pct_conv}%"
  bar_seg "$w_mcp"   "$BG_MAG" "MCP"   "MCP ${pct_mcp}%"
  bar_seg "$w_ctxt"  "$BG_GRN" "CTXT"  "CTXT ${pct_ctxt}%"
  bar_seg "$w_out"   "$BG_YEL" "OUT"   "OUT ${pct_out}%"

  if [ "$unused_w" -gt 0 ]; then
    printf "${BG_DIM}${DARK}%*s${RST}" "$unused_w" ''
  fi
fi

{
  "$schema": "https://github.com/fastfetch-cli/fastfetch/raw/dev/doc/json_schema.json",
  "logo": {
    "type": "small"
  },
  "display": {
    "separator": " → "
  },
  "modules": [
    "title",
    "separator",
    "os",
    "kernel",
    "shell",
    "terminal",
    "cpu",
    "gpu",
    "memory",
    "disk",
    "battery",
    "uptime",
    "break",
    "colors"
  ]
}

use_default_settings: true

general:
  instance_name: "OpenClaw SearXNG"
  enable_metrics: false

search:
  safe_search: 0
  default_lang: "fr"
  formats:
    - html
    - json

server:
  secret_key: "changez-moi-par-une-vraie-cle"
  bind_address: "0.0.0.0"
  port: 8080
  limiter: false
  public_instance: false

engines:
  - name: google
    engine: google
    shortcut: g
    disabled: false
  - name: duckduckgo
    engine: duckduckgo
    shortcut: ddg
    disabled: false
  - name: bing
    engine: bing
    shortcut: b
    disabled: false
  - name: wikipedia
    engine: wikipedia
    shortcut: wp
    disabled: false

  searxng:
    image: searxng/searxng:latest
    volumes:
      - ~/searxng/settings.yml:/etc/searxng/settings.yml:ro
      - ~/searxng/limiter.toml:/etc/searxng/limiter.toml:ro
    restart: unless-stopped
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID

{
  "tools": {
    "web": {
      "search": {
        "enabled": true,
        "provider": "searxng",
        "searxng": {
          "baseUrl": "http://searxng:8080"
        }
      }
    }
  }
}

#!/bin/bash
# Audit rapide de tous tes projets Node.js et Python
# Usage: chmod +x audit-deps.sh && ./audit-deps.sh

echo "=== Audit des dependances ==="
echo ""

# Node.js
if command -v npm &>/dev/null; then
  echo "[npm] Scan en cours..."
  npm audit 2>/dev/null || echo "[npm] Aucun projet Node.js ici"
  echo ""
fi

# Python
if command -v pip &>/dev/null; then
  if ! command -v pip-audit &>/dev/null; then
    echo "[pip] Installation de pip-audit..."
    pip install pip-audit -q
  fi
  echo "[pip] Scan en cours..."
  pip-audit 2>/dev/null || echo "[pip] Aucun environnement Python actif"
  echo ""
fi

echo "=== Audit termine ==="

#!/bin/bash
# Verifie les commits suspects depuis le 8 mars 2026

echo "=== Commits depuis le 8 mars ==="
git log --since="2026-03-08" --stat --oneline

echo ""
echo "=== Diff avec le remote ==="
git diff origin/main..HEAD --stat

echo ""
echo "=== Reflog (detecte les force-push) ==="
git reflog --since="2026-03-08" | head -20

#!/bin/bash
# Active la signature GPG sur tous tes commits

# Genere une cle GPG (RSA 4096, pas d'expiration)
gpg --full-generate-key

# Recupere l'ID de ta cle
KEY_ID=$(gpg --list-secret-keys --keyid-format=long \
  | grep sec | awk '{print $2}' | cut -d"/" -f2)
echo "Cle GPG: $KEY_ID"

# Configure Git globalement
git config --global user.signingkey $KEY_ID
git config --global commit.gpgsign true

uname -a            # Ubuntu 22.04 ou supérieur
docker --version    # Docker 20+ installé et running
node --version      # Node.js 20+
free -h             # 16 GB recommandé (8 GB minimum + swap)
df -h /             # 40 GB libres (image sandbox = 2 GB)

ARCH=$(uname -m)
curl -sL -o /tmp/openshell.tar.gz \
  "https://github.com/NVIDIA/OpenShell/releases/latest/download/openshell-${ARCH}-unknown-linux-musl.tar.gz"

cd /tmp && tar xzf openshell.tar.gz

# Vérifier que c'est un vrai binaire
file openshell
# ELF 64-bit LSB pie executable, x86-64, static-pie linked

install -m 755 openshell /usr/local/bin/openshell
openshell --version
# openshell 0.0.10

rm /tmp/openshell /tmp/openshell.tar.gz

cd /opt
git clone https://github.com/NVIDIA/NemoClaw.git
cd NemoClaw

# Vérifier que c'est le bon repo
head -6 package.json
# "description": "NemoClaw — run OpenClaw inside OpenShell with NVIDIA inference"
# "license": "Apache-2.0"
# "bin": { "nemoclaw": "./bin/nemoclaw.js" }

npm install -g .
nemoclaw --help   # Doit afficher le menu CLI

mkdir -p ~/.nemoclaw && chmod 700 ~/.nemoclaw
echo '{"nvidia_api_key":"nvapi-VOTRE_CLE"}' > ~/.nemoclaw/credentials.json
chmod 600 ~/.nemoclaw/credentials.json

# Vérifier si le port 8080 est occupé
lsof -i :8080

# Si oui, patcher le onboard
sed -i 's/const gwArgs = \["--name", "nemoclaw"\];/const gwArgs = ["--name", "nemoclaw", "--port", "8180"];/' \
  /opt/NemoClaw/bin/lib/onboard.js

# Vérifier le patch
grep 'gwArgs' /opt/NemoClaw/bin/lib/onboard.js
# const gwArgs = ["--name", "nemoclaw", "--port", "8180"];

lsof -i :18789

# Si occupé par OpenClaw
docker stop openclaw-openclaw-gateway-1 openclaw-searxng-1

# Pour rollback plus tard :
# docker start openclaw-openclaw-gateway-1 openclaw-searxng-1

export NVIDIA_API_KEY='nvapi-VOTRE_CLE'
nemoclaw onboard

# Le wizard déroule 7 étapes :
# [1/7] Preflight   — Docker OK, OpenShell OK, No GPU → cloud
# [2/7] Gateway     — démarre sur port 8180 (patché)
# [3/7] Sandbox     — télécharge ~2 GB, crée le sandbox
# [4/7] Inference   — Nemotron 3 Super 120B via NVIDIA Cloud
# [5/7] Provider    — nvidia-nim créé
# [6/7] OpenClaw    — lancé dans le sandbox
# [7/7] Policies    — pypi, npm appliquées

nemoclaw status                    # Liste le sandbox
nemoclaw nemoclaw-test status      # Phase: Ready
openshell status                   # Status: Connected
openshell sandbox list             # nemoclaw-test Ready

# Test de connexion au sandbox
printf 'whoami && openclaw --version\nexit\n' | \
  timeout 15 openshell sandbox connect nemoclaw-test
# sandbox           ← PAS root (isolation OK)
# OpenClaw 2026.3.11

printf 'export ANTHROPIC_API_KEY=dummy-rerouted-by-nemoclaw
export OPENAI_API_KEY=nvapi-VOTRE_CLE
export OPENAI_BASE_URL=https://integrate.api.nvidia.com/v1
openclaw agent --session-id test -m "Bonjour, qui es-tu ?" --json 2>&1
exit
' | timeout 90 nemoclaw nemoclaw-test connect

# Résultat attendu :
# "status": "ok"
# "provider": "nvidia"
# "model": "nemotron-3-super-120b-a12b"
# Temps de réponse : ~9 secondes

# Supprimer l'ancienne config
printf 'rm -f /sandbox/.openclaw/openclaw.json\nexit\n' | \
  timeout 10 openshell sandbox connect nemoclaw-test

# Écrire la config avec Gemini (ADAPTER votre clé)
printf 'cat > /sandbox/.openclaw/openclaw.json << "ENDCFG"
{
  "tools": {
    "web": {
      "search": {
        "enabled": true,
        "provider": "gemini",
        "gemini": {
          "apiKey": "AIzaSy-VOTRE-CLE-GEMINI"
        }
      }
    }
  }
}
ENDCFG
echo DONE
exit
' | timeout 15 openshell sandbox connect nemoclaw-test

cat > /opt/NemoClaw/nemoclaw-blueprint/policies/presets/gemini-search.yaml << 'YAML'
preset:
  name: gemini-search
  description: "Google Gemini API access for web search"

network_policies:
  gemini_api:
    name: gemini_api
    endpoints:
      - host: generativelanguage.googleapis.com
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: POST, path: "/**" }
      - host: www.googleapis.com
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: POST, path: "/**" }
    binaries:
      - path: /usr/local/bin/openclaw
      - path: /usr/bin/node
YAML

cd /opt/NemoClaw
node -e 'require("./bin/lib/policies").applyPreset("nemoclaw-test", "gemini-search")'
# Applied preset: gemini-search

# Dans /opt/NemoClaw/scripts/telegram-bridge.js
# Ligne 95, REMPLACER :
#   export NVIDIA_API_KEY='${API_KEY}' && nemoclaw-start...
# PAR :
#   export NVIDIA_API_KEY='${API_KEY}' ANTHROPIC_API_KEY=dummy OPENAI_API_KEY='${API_KEY}' OPENAI_BASE_URL=https://integrate.api.nvidia.com/v1 && nemoclaw-start...

# En une commande sed :
sed -i "s|export NVIDIA_API_KEY='\${API_KEY}' \&\& nemoclaw-start|export NVIDIA_API_KEY='\${API_KEY}' ANTHROPIC_API_KEY=dummy OPENAI_API_KEY='\${API_KEY}' OPENAI_BASE_URL=https://integrate.api.nvidia.com/v1 \&\& nemoclaw-start|" \
  /opt/NemoClaw/scripts/telegram-bridge.js

cat > /opt/NemoClaw/start-bridge.sh << 'SH'
#!/bin/bash
export NVIDIA_API_KEY='nvapi-VOTRE_CLE'
export TELEGRAM_BOT_TOKEN='VOTRE_TOKEN_BOTFATHER'
export SANDBOX_NAME='nemoclaw-test'
export ALLOWED_CHAT_IDS='VOTRE_CHAT_ID_TELEGRAM'
pkill -f telegram-bridge 2>/dev/null
sleep 1
nohup node /opt/NemoClaw/scripts/telegram-bridge.js > /tmp/nemoclaw-telegram.log 2>&1 &
echo "Bridge demarre PID=$!"
sleep 3
tail -15 /tmp/nemoclaw-telegram.log
SH
chmod +x /opt/NemoClaw/start-bridge.sh

# Lancer le bridge
bash /opt/NemoClaw/start-bridge.sh

# Surveiller les logs
tail -f /tmp/nemoclaw-telegram.log