fix(discord): stop "is typing…" orphaned by typing-loop recreate race

.github/workflows/fleet-ci-fail-alert.yml

@@ -0,0 +1,76 @@
+# Fleet-added (Apollo). NOT upstream — do not expect on NousResearch/hermes-agent.
+# Fires a single LOUD ping to the fleet #alerts channel ONLY when a real CI
+# workflow concludes in failure. The failure-filter lives HERE (`if: failure`)
+# because the Hermes webhook adapter filters by event TYPE only, not payload
+# conclusion — a deliver_only route on raw check_suite/status would also fire on
+# SUCCESS and re-create the flood this replaces. Zero-LLM: the receiver route is
+# deliver_only, so this is a pure notification, never an agent run.
+name: Fleet CI-fail alert
+
+on:
+  workflow_run:
+    workflows:
+      - "Tests"
+      - "Lint (ruff + ty)"
+      - "Fleet SAST (semgrep)"
+      - "Fleet Secret Scan (gitleaks)"
+      - "OSV-Scanner"
+      - "Supply Chain Audit"
+    types:
+      - completed
+
+permissions:
+  contents: read
+
+jobs:
+  notify-on-failure:
+    name: notify-on-failure
+    runs-on: ubuntu-latest
+    # Only on a genuine failure of the upstream workflow. Success/cancelled/skipped → no-op.
+    if: ${{ github.event.workflow_run.conclusion == 'failure' }}
+    steps:
+      - name: Sign and POST CI-failure event
+        env:
+          CI_FAIL_WEBHOOK_SECRET: ${{ secrets.CI_FAIL_WEBHOOK_SECRET }}
+          WEBHOOK_URL: https://hooks.angventures.io/webhooks/ci-fail
+          WF_NAME: ${{ github.event.workflow_run.name }}
+          WF_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          WF_SHA: ${{ github.event.workflow_run.head_sha }}
+          WF_URL: ${{ github.event.workflow_run.html_url }}
+          WF_ACTOR: ${{ github.event.workflow_run.actor.login }}
+          REPO: ${{ github.repository }}
+          WF_EVENT: ${{ github.event.workflow_run.event }}
+        run: |
+          set -euo pipefail
+          if [ -z "${CI_FAIL_WEBHOOK_SECRET:-}" ]; then
+            echo "::error::CI_FAIL_WEBHOOK_SECRET is not set; cannot sign the alert." >&2
+            exit 1
+          fi
+          # Build the JSON body. event_type=ci_failure is what the receiver route
+          # filters on (X-GitHub-Event header is also set to the same value).
+          BODY="$(jq -nc \
+            --arg event_type "ci_failure" \
+            --arg repo "$REPO" \
+            --arg workflow "$WF_NAME" \
+            --arg branch "$WF_BRANCH" \
+            --arg sha "$WF_SHA" \
+            --arg run_url "$WF_URL" \
+            --arg actor "$WF_ACTOR" \
+            --arg trigger "$WF_EVENT" \
+            '{event_type:$event_type, repo:$repo, workflow:$workflow, branch:$branch, sha:$sha, run_url:$run_url, actor:$actor, trigger:$trigger}')"
+          # Generic HMAC-SHA256 hex over the raw body → X-Webhook-Signature.
+          SIG="$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$CI_FAIL_WEBHOOK_SECRET" | sed 's/^.* //')"
+          CODE="$(curl -sS -o /tmp/resp.txt -w '%{http_code}' \
+            -X POST "$WEBHOOK_URL" \
+            -H "Content-Type: application/json" \
+            -H "X-GitHub-Event: ci_failure" \
+            -H "X-GitHub-Delivery: ci-fail-${WF_SHA}-${GITHUB_RUN_ID}" \
+            -H "X-Webhook-Signature: ${SIG}" \
+            --data "$BODY")"
+          echo "Receiver responded HTTP $CODE"
+          cat /tmp/resp.txt || true
+          # 2xx = delivered/accepted. Non-2xx fails the step so the miss is visible.
+          case "$CODE" in
+            2*) echo "CI-failure alert delivered." ;;
+            *) echo "::error::CI-fail alert POST returned HTTP $CODE" >&2; exit 1 ;;
+          esac

.github/workflows/fleet-sast.yml

@@ -0,0 +1,41 @@
+# Fleet-added (Apollo/greploop posture-B floor). NOT upstream — do not expect on NousResearch/hermes-agent.
+# Provides the `sast` deterministic-floor component. Diff-aware where it helps, full-tree gate at ERROR.
+name: Fleet SAST (semgrep)
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fleet-sast-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sast:
+    name: sast
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install semgrep
+        run: pip install "semgrep==1.46.0"
+
+      - name: Run semgrep (ERROR severity gate)
+        run: |
+          semgrep \
+            --config=p/python \
+            --config=p/secrets \
+            --severity=ERROR \
+            --error \
+            --quiet \
+            hermes/

.github/workflows/fleet-secret-scan.yml

@@ -0,0 +1,61 @@
+# Fleet-added (Apollo/greploop posture-B floor). NOT upstream — do not expect on NousResearch/hermes-agent.
+# Provides the `secret_scan` deterministic-floor component. DIFF-SCOPED on PRs: scans only the PR
+# commit range, NOT full history (the fork inherits ~768 generic-api-key false positives in upstream
+# test fixtures/docs — a full-tree scan would pin this RED forever). On push to main, scans the push range.
+name: Fleet Secret Scan (gitleaks)
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fleet-secret-scan-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  secret_scan:
+    name: secret_scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (full history for range scan)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Compute scan range
+        id: range
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            BASE="${{ github.event.pull_request.base.sha }}"
+            HEAD="${{ github.event.pull_request.head.sha }}"
+          else
+            BASE="${{ github.event.before }}"
+            HEAD="${{ github.sha }}"
+          fi
+          # Guard against the all-zero "before" SHA on first push / new branch.
+          if ! git cat-file -e "${BASE}^{commit}" 2>/dev/null; then
+            BASE="$(git rev-parse "${HEAD}~1" 2>/dev/null || echo "${HEAD}")"
+          fi
+          echo "base=${BASE}" >> "$GITHUB_OUTPUT"
+          echo "head=${HEAD}" >> "$GITHUB_OUTPUT"
+          echo "scanning ${BASE}..${HEAD}"
+
+      - name: Install gitleaks
+        run: |
+          VER=8.18.4
+          curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${VER}/gitleaks_${VER}_linux_x64.tar.gz" -o gl.tgz
+          tar xzf gl.tgz gitleaks
+          sudo mv gitleaks /usr/local/bin/
+
+      - name: Gitleaks (diff-scoped)
+        run: |
+          gitleaks detect \
+            --source . \
+            --no-banner \
+            --redact \
+            --log-opts="${{ steps.range.outputs.base }}..${{ steps.range.outputs.head }}" \
+            --exit-code 1

.gitleaks.toml

@@ -0,0 +1,24 @@
+# Gitleaks configuration for the hermes-agent fork.
+#
+# Extends the stock gitleaks ruleset and allowlists the obviously-fake credential
+# *fixtures* the test suite uses (mocked clients / redaction tests, never real).
+# They surfaced only because the diff-scoped scan re-reads them as "added" lines
+# when a large test file is split/moved (PR #66).
+#
+# gitleaks `stopwords` allowlist a finding when its detected SECRET contains one
+# of these substrings (case-insensitive). gitleaks strips the literal "..." from
+# the secret it evaluates, so we match the distinctive ALPHANUMERIC token of each
+# fake fixture. These tails are specific to the known fakes; a real high-entropy
+# key does not contain them (verified with an sk-ant-api03 injection negative
+# test that is still CAUGHT with this config).
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Fake test-fixture API keys (mocked clients / redaction tests, never real)."
+stopwords = [
+  "1234567890",  # test-key-1234567890 (AIAgent constructor stub) / test-k...7890
+  "2mno",        # gsk_ab...2mno / sk-ant...2mno (redaction fixtures)
+  "mnop",        # sk-or-...mnop (key-masking fixture)
+]