security: remove hardcoded abiba-bot credentials from CI workflow

Replaced manual 'git clone' with password in URL with actions/checkout@v4. Runner already auto-checkouts the repo - manual clone was redundant. Also fixed YAML syntax issues in Config validation and No secrets check steps. Credentials were exposed in git history since initial commit.
contract: add host + Health URL columns, use health_url param
2026-07-13 00:30:14 +00:00 · 2026-07-13 00:30:14 +00:00 · 2026-07-13 00:30:14 +00:00 · 2026-07-13 00:30:14 +00:00 · 2026-07-08 17:57:17 +00:00 · 2026-07-08 17:57:14 +00:00
2 changed files with 4 additions and 3 deletions
@@ -14,10 +14,10 @@ jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
+      - uses: actions/checkout@v4
      - run: python3 --version
      - run: node --version
      - run: echo "Runner works!"
-      - run: git clone --depth 1 http://abiba-bot:***REMOVED***@192.168.68.17:3000/SyslogSolution/zulip-platform-plugins.git .

      - name: Python syntax check
        run: |
@@ -45,8 +45,8 @@ print('✅ config.yaml.example valid')
    runs-on: ubuntu-latest
    needs: [validate]
    steps:
+      - uses: actions/checkout@v4
      - run: echo "🚀 Deploy tag $(echo $GITHUB_REF_NAME)"
-      - run: git clone --depth 1 http://abiba-bot:***REMOVED***@192.168.68.17:3000/SyslogSolution/zulip-platform-plugins.git .

      - name: Deploy to Tanko (canary)
        run: ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 jerome@192.168.68.122 "cd /root && bash -s" < scripts/deploy.sh --ct=tanko --mode=native "$GITHUB_REF_NAME" 2>&1 || echo "⚠️ Tanko deploy skipped"
@@ -67,6 +67,7 @@ DEFAULT_STREAM = "agent-hub"
 DEFAULT_ALL_BOTS_USER_ID = 1
 DEFAULT_POLL_INTERVAL = 3.0
 MAX_ZULIP_MESSAGE = 10000
+TRUNCATION_NOTICE = "\n\n[...truncated at Zulip limit]"
 ECHO_TAG_PREFIX = "hermes-zulip-"
 RECONNECT_BACKOFF = [2, 5, 10, 30, 60]
 DEDUP_WINDOW = 300  # 5 minutes
@@ -120,7 +121,7 @@ def _truncate(text: str, limit: int = MAX_ZULIP_MESSAGE) -> str:
    """Truncate to Zulip's message limit with notice."""
    if len(text) <= limit:
        return text
-    return text[:limit] + "\n\n[...truncated at Zulip limit]"
+    return text[:limit - len(TRUNCATION_NOTICE)] + TRUNCATION_NOTICE


 def _parse_zulip_timestamp(ts: Any) -> datetime:
Author	SHA1	Message	Date
Abiba (pi)	aeb79c6286	security: remove hardcoded abiba-bot credentials from CI workflow Replaced manual 'git clone' with password in URL with actions/checkout@v4. Runner already auto-checkouts the repo - manual clone was redundant. Also fixed YAML syntax issues in Config validation and No secrets check steps. Credentials were exposed in git history since initial commit.	2026-07-13 00:30:14 +00:00
Abiba (pi)	897e8d36e8	contract: add host + Health URL columns, use health_url param - Added Host column (Abiba: 192.168.68.24, Hermes agents: 192.168.68.123) - Changed Health Port → Health URL with full http://host:port/health URLs - Updated Check 1 to reference {{health_url}} instead of {{health_port}} - Added .gitignore for .agents/ (OpenProse run state)	2026-07-13 00:30:14 +00:00
Abiba (pi)	459815c0cc	feat: /zulip-test command + standardized health schema v1 - Added /zulip-test self-test command (7 checks: queue, identity, @all-bots, health, poll loop, echo prevention, API send) - Standardized health endpoint to zulip-health/v1 schema (nested zulip{} object, checks{} map, platform/agent metadata) - Saved pi extension source to pi-zulip-extension/extension-src/ (with all fixes: dynamic @all-bots, health sync, logging) - Added extension src to repo for deployment tracking - Updated vault with final contract status report	2026-07-13 00:30:14 +00:00
Abiba (pi)	773c67db8f	contract: Zulip extension verification report + cross-platform contract - Full contract verification for pi (TypeScript) and Hermes (Python) Zulip plugins - Fixed @all-bots user_id (1→20) — now dynamically resolved from Zulip API - Fixed last_event_id stale display in health endpoint (B2) - Fixed display_recipient logging (B3) - Added bot_user_id and all_bots_user_id to health endpoint - Created OpenProse cross-platform verification contract (docs/contracts/) - Created Hermes plugin deployment script (scripts/deploy-hermes-zulip.py) Pi extension: 8/9 checks pass (LLM relay untested — no external DMs) Hermes adapter: 9/10 checks pass (deployment pending)	2026-07-13 00:30:14 +00:00
Abiba (pi)	0c15159a5f	merge: feat/zulip-streaming into master — _strip_html + streaming support	2026-07-08 17:57:17 +00:00
Abiba (pi)	19c52a9425	fix(zulip): account for TRUNCATION_NOTICE overhead in _truncate The truncation notice '[...truncated at Zulip limit]' was appended AFTER slicing at MAX_ZULIP_MESSAGE (10000), causing the final message to exceed Zulip's API limit. This fix subtracts the notice length from the slice so the total stays within bounds.	2026-07-08 17:57:14 +00:00
jerome	c9a1717e12	fix(zulip): add _strip_html for slash command matching Zulip delivers message content as HTML (<p>/approve</p>). The gateway slash command parser expects plain text, so HTML tags prevent command matching. This helper strips HTML tags and decodes common entities (&, <, etc.). Per contract: zulip-approval-fix.prose.md Applied to: Mumuni (CT114), Tanko (CT112), Koby (CT111)	2026-07-08 03:18:03 -04:00
Abiba	ca95d47dc8	feat: add edit_message + streaming support to Zulip adapter Implements edit_message() using Zulip's PATCH /api/v1/messages/{id} API. Enables the Hermes GatewayStreamConsumer to progressively update Zulip messages during agent generation, giving users real-time visibility into agent thinking via progressive edits. Adds _api_patch() helper for PATCH HTTP method.	2026-07-06 00:01:00 +00:00