Harden ops workflow auth and stale checks

bin/ops-helpers.sh

@@ -5,15 +5,41 @@
 # and do not revive deprecated bash worker loops.
 # ───────────────────────────────────────────────────────────────────────
 
-export GITEA="${GITEA:-http://143.198.27.163:3000}"
+resolve_gitea_url() {
+    if [ -n "${GITEA:-}" ]; then
+        printf '%s\n' "${GITEA%/}"
+        return 0
+    fi
+    if [ -f "$HOME/.hermes/gitea_api" ]; then
+        python3 - "$HOME/.hermes/gitea_api" <<'PY'
+from pathlib import Path
+import sys
+
+raw = Path(sys.argv[1]).read_text().strip().rstrip("/")
+print(raw[:-7] if raw.endswith("/api/v1") else raw)
+PY
+        return 0
+    fi
+    if [ -f "$HOME/.config/gitea/base-url" ]; then
+        tr -d '[:space:]' < "$HOME/.config/gitea/base-url"
+        return 0
+    fi
+    echo "ERROR: set GITEA or create ~/.hermes/gitea_api" >&2
+    return 1
+}
+
+export GITEA="$(resolve_gitea_url)"
 export OPS_DEFAULT_REPO="${OPS_DEFAULT_REPO:-Timmy_Foundation/timmy-home}"
 export OPS_CORE_REPOS="${OPS_CORE_REPOS:-Timmy_Foundation/the-nexus Timmy_Foundation/timmy-home Timmy_Foundation/timmy-config Timmy_Foundation/hermes-agent}"
 
 ops-token() {
     local token_file
-    for token_file in "$HOME/.hermes/gitea_token_vps" "$HOME/.config/gitea/token" "$HOME/.config/gitea/codex-token"; do
+    for token_file in \
+        "$HOME/.config/gitea/timmy-token" \
+        "$HOME/.hermes/gitea_token_vps" \
+        "$HOME/.hermes/gitea_token_timmy"; do
         if [ -f "$token_file" ]; then
-            cat "$token_file"
+            tr -d '[:space:]' < "$token_file"
             return 0
         fi
     done
@@ -264,3 +290,5 @@ ops-assign-codex() { ops-assign "$1" "codex-agent" "${2:-$OPS_DEFAULT_REPO}"; }
 ops-assign-groq() { ops-assign "$1" "groq" "${2:-$OPS_DEFAULT_REPO}"; }
 ops-assign-claude() { ops-assign "$1" "claude" "${2:-$OPS_DEFAULT_REPO}"; }
 ops-assign-ezra() { ops-assign "$1" "ezra" "${2:-$OPS_DEFAULT_REPO}"; }
+ops-assign-perplexity() { ops-assign "$1" "perplexity" "${2:-$OPS_DEFAULT_REPO}"; }
+ops-assign-kimiclaw() { ops-assign "$1" "KimiClaw" "${2:-$OPS_DEFAULT_REPO}"; }