v0.2.10

Eye Of Hermes v0.2.10

Audit follow-up after the v0.2.9 catalog-review fixes (mojomast/EOH#29, #30, #31). Still exactly 11 composable tools. The v0.2.9 prompt-trust and confirm fixes are unchanged.

Changed

• Security and correctness (#29): cap live-relay and HUD-bridge request bodies and reject invalid lengths; route untrusted and keyed HTTP through the public-address fetch helper with connection pinning and per-hop redirect checks. Private-LAN Overpass, Nominatim, Valhalla, OSRM, and Wayback URLs are refused; public HTTPS and explicit loopback still work. Scrub secrets from tool errors, refuse credential-like import paths, lock the MCP pending map, and tighten HUD token file mode, child environments, and outbound header values.
• Capabilities (#30): add godseye_query op=sdr_receivers to list nearest public SDR receivers (filter by platform, band, or frequency; does not start audio). Tighten tool-error fix text, document shipped extension ops, and drop the retired "key install" mention from the admin schema lead.
• Tests, CI and install docs (#31): GitHub Actions CI for pytest, Node unit tests, hermes plugins validate against Hermes v0.23.0, and scripts/secret_scan.py.

Notes

• Requires mojomast/gods-eye-view main at or after b361a25 (merge of pull request #5, public SDR receiver layer). Without that app checkout, the layer is not available on the globe.
• Plugin id remains godseye; install via Hermes plugins / catalog when the pin lands.

v0.2.9

Eye Of Hermes v0.2.9

Catalog review follow-up for NousResearch/hermes-agent#149691 (mojomast/EOH#32). Still exactly 11 composable tools.

Changed

• Watch-alert titles are treated as quoted third-party data: newlines and control characters are stripped, titles are length-capped, and they are shown as title="…". The system prompt no longer tells the model to trust [EOH watch alert] lines. This applies on both pre_llm_call and deliver=inject.
• godseye_admin app_start, app_stop, app_restart and rebuild require confirm=true, and those ops are refused inside batch. Pane Start/Stop buttons are unchanged.
• ui/open-link and hermes-gev:ask only act after a click on an Open/Copy bar in the pane.
• Runtime config re-posting stops once the app acknowledges gev:config-applied.

Notes

• Requires mojomast/gods-eye-view main at or after b361a25 (merge of pull request #5, public SDR receiver layer). Without that app checkout, the layer is not available on the globe.
• Plugin id remains godseye; install via Hermes plugins / catalog when the pin lands.

v0.2.8

Eye Of Hermes v0.2.8

Public SDR receivers layer (docs + tool enum on the EOH side). Still exactly 11 composable tools.

Added

• sdr-receivers in the live layer tools / tools_snapshot, with analyst-skill docs for the PUBLIC SDR card, floating waterfall, audio+waterfall filter, pin-click play gesture, deep links, and native-audio limits.

Notes

• Requires mojomast/gods-eye-view main at or after b361a25 (merge of pull request #5, public SDR receiver layer). Without that app checkout, the layer is not available on the globe.
• Plugin id remains godseye; install via Hermes plugins / catalog when the pin lands.

v0.2.6

Eye Of Hermes v0.2.6

Hermes-declared street-level secrets. Still exactly 11 composable tools.

Changed

• GOOGLE_MAPS_API_KEY, alternate GOOGLE_API_KEY, and MAPILLARY_CLIENT_TOKEN are declared in plugin.yaml requires_env (rich form, optional in the description, secret: true) and read only via Hermes agent.secret_scope.get_secret.
• Removed the v0.2.4 fallback that read ~/.config/gods-eye-view.env / GEV_ENV_FILE / GODSEYE_ENV_FILE (Hermes catalog rule 11).
• Missing keys return KEY_MISSING with a Hermes fix hint; register() never crashes.

Notes

• Install prompts for the optional street-level keys; skip them and the rest of EOH still loads.
• God's Eye View's own pane/client env file is unchanged for the Node app; it is not a credential source for this plugin's street-level server lookups.

v0.2.5 — fix plugin.yaml duplicate name

Fixed

Restored a clean plugin.yaml after v0.2.4 introduced a duplicated name: godseye (Hermes: found duplicate key name), which blocked the EOH toolset from loading. Added a safe bump script and a strict YAML duplicate-key test.

Still exactly 11 composable tools.

v0.2.4 — streetlevel keys, pane capture, osm Overpass fallback

Fixed

• Street-level keys fall back to ~/.config/gods-eye-view.env (or GEV_ENV_FILE / GODSEYE_ENV_FILE) when unset in the process. Values never appear in results, errors, or logs.
• godseye_capture op=pane captures inside scene.postRender after requestRender so the WebGL drawing buffer is intact.
• godseye_query op=osm falls back to the same public Overpass mirrors as find_places when the pane returns OVERPASS_NOT_CONFIGURED.

Still exactly 11 composable tools. Catalog pin unchanged. Deploy to moltussy-1 not included in this release step.

v0.2.3 — compare/timeline surface host

Fixed

Compare swipe and Wayback timeline no longer leave a black globe on a photoreal stack. Both acquire a visible imagery surface first (GEV acquireImageryComparison({ switchPolicy: 'esri-if-photoreal' }), with Esri globe fallback) before draping XYZ layers, and release the lease on stop. Returns no_visible_surface instead of a hide-only swipe when no host is available.

Still exactly 11 composable tools. Catalog pin unchanged.

Eye Of Hermes v0.2.2

Eye Of Hermes (EOH) v0.2.2

Polish sweep from the moltussy-1 feature pass. Plugin id remains godseye. Exactly 11 composable tools.

Fixes

1. Resolve Esri Wayback tile releases from waybackconfig.json (black globe after imagery A/B, zoom, or pin drawers).
2. Chicago geocoding + weather preset under pane_busy / no_pane.
3. Transit follow_vehicle: real follow or clear unsupported error (no false ok).
4. Fire watches: default radius_km for center areas; FIRMS retry/backoff.
5. Pin research grounding (Louvre vs homonyms) and stable pin IDs.
6. Overlays HTTP fallback when the relay lives in another process; action to open the Overlays sidebar.
7. Harden WebGL context recovery.
8. Prefer most recently focused visible pane; cut pane command timeout to ~20–30s.
9. Skill: never re-enable user-disabled layers unless asked; do not skill_manage godseye-analyst.
10. Composer/scene respect user-disabled layers.
11. Cesium pin warnings (heightReference / outline on terrain).
12. Clearer feed-down status and adsb.lol flights fallback note.
13. Document Hermes chat markdown table rendering (upstream Webapp).
14. godseye_capture accepts detail (concise|full).

Verify

• python3 -m pytest -q tests — 405 passed, 1 skipped (at PR tip).
• Schema measure: 11 tools, o200k ≈ 7861.

Install: pin mojomast/EOH at tag v0.2.2.

Eye Of Hermes v0.2.0

The user-facing name is Eye Of Hermes (EOH). Plugin id godseye, the godseye_ tool prefix, /gev, routes, and the repository name are unchanged.

The model catalog is eleven composable tools: godseye_view, godseye_query, godseye_layers, godseye_feeds, godseye_annotate, godseye_nav, godseye_track, godseye_scene, godseye_watch, godseye_capture, and godseye_admin. Their registered schemas are about 6.6k o200k_base tokens (6636). The catalog those tools replaced was about 30k o200k_base tokens (30133) across 97 tools, measured on this tree before investigation export. Old Hermes names are not registered. router.dispatch_legacy is the only path that still runs one.

This release also adds a per-turn map line, concise tool output (detail defaults to concise), and fix-it errors (code, message, fix). Pins are ground-clamped, and a pin info drawer shows title, markdown, images, and links. godseye_query op=brief_and_show flies a brief onto the globe. Live commands route to the chat's pane. /gev slash commands, the godseye:godseye-analyst playbook, godseye_doctor, a saved home view, share links, and guided tours are included. Annotations, camera, and caption persist per session and come back when a pane reopens. godseye_scene op=export writes GeoJSON, KML, and an optional pack zip. Tests replay hand-written HTTP fixtures and block the public network. A lost WebGL context is recovered in the same pane, and recovery calls window.__godsEyeView.recreateViewer when that hook is present. The time slider is godseye_nav op=timeline: mode=wayback scrubs Esri World Imagery Wayback releases, and mode=events shows earthquakes, fires, and stored watch alerts.

Breaking changes

• Retired tool names are no longer registered and are not listed in plugin.yaml provides_tools. Call one of the eleven composable tools with an op. A saved call that still uses a retired name runs only through router.dispatch_legacy. Scenes, tours, /gev, the relay, and the pane keep bare action names such as fly_to_location.

Changed

• Pane branding: the panel header, loader, page title, status line and open button now say Eye Of Hermes (EOH) (gev/panel_brand.js, re-applied by a MutationObserver when the app re-renders); the header tooltip credits God's Eye View. Pane status messages and the pane loading text use the new name.
• Renamed the user-facing title to Eye Of Hermes (EOH) (pane title, plugin description, /gev help, skill, README). Plugin id godseye, tool names, /gev, routes and repo name are unchanged.

Added

• Time slider on the EOH pane, driven by godseye_nav op=timeline. The sub-action is an argument named timeline: set, play, step, stop, state, list_dates. mode=wayback scrubs Esri World Imagery Wayback release dates over the current view (swipe or fade). mode=events shows USGS quakes and NASA FIRMS fires, plus stored watch alerts, as pins that appear when the playhead reaches them. from/to default to the last 7 days for events. The catalog is cached for six hours and not refetched inside two seconds. Tiles are for viewing only; photorealistic 3D tiles are hidden, not sampled. The slider is stored with the scene and with investigations, and it is restored on pane reopen and WebGL recovery. User scrubs persist through /live/timeline.
• Composable tools, the rest of the catalog. godseye_layers, godseye_feeds, godseye_annotate, godseye_nav, godseye_track, godseye_scene, godseye_watch, godseye_capture, and godseye_admin join godseye_view and godseye_query. The camera read is godseye_view op=state (there is no separate state tool). Investigation export is godseye_scene op=export. godseye_view also gains op=show, and godseye_query gains op=terrain and op=features. Every legacy name is unregistered. dispatch_legacy still runs one. Feed ops keep the person-tracking refusal and the CCTV/ALPR public-camera limit. The golden selection set covers every op.
• Composable tools, phase A. godseye_view (op fly, move, zoom, globe, home, share, panes) and godseye_query (op find_places, osm, context, what_is_here, brief, brief_and_show, analyst, military, poi, resolve_area, entity) call the existing handlers through one router. The 18 names those ops replaced are not registered. router.dispatch_legacy still runs a saved call that uses one of those names. Scenes, tours, /gev, the relay, and the pane keep their bare action names. fly accepts style (nvg and night vision mean surveillance) and then calls set_visual_style. here=true, or a "near me" / "this area" phrase, reads the open pane's camera and then calls the original lookup. The map of every tool, including ones not routed yet, is docs/COMPOSABLE-TOOLS.md. Selection checks live in evals/selection_golden.json (pytest, offline). evals/run_selection.py scores that set with a live model only when an API key is set and CI is unset. evals/measure_schemas.py prints schema bytes and token counts.
• Automatic WebGL recovery. On webglcontextlost the pane prefers window.__godsEyeView.recreateViewer when that hook is present (the hook owns loseContext, destroy, and the new viewer, and rebinds the voice runner). Otherwise the pane calls WEBGL_lose_context.loseContext() before viewer.destroy() and creates a new viewer in the same container. Either path restores the saved scene with the existing restore_commands (camera heading, pitch, and roll, pins and annotations, drawer, filters, layers, and the time slider). The click-to-reload card stays as the fallback. GODSEYE_GL_RECOVER=0, or glRecover: false in plugin-data/godseye/config.json, turns recovery off (env wins). After 3 losses in 20 seconds, recovery stops and the card is shown. The relay reports {code:"CONTEXT_LOST", message, fix} when the context is lost and {code:"CONTEXT_RESTORED", message} when recovery succeeds; both are drained into the next turn. Intentional teardown still releases the context before destroy. scripts/gl_recover_harness.mjs (port 4233) forces loseContext() and checks that the camera and pins come back.
• Per-turn map state. When Hermes provides pre_llm_call, the plugin injects one line (pane connected/busy/closed, camera center, range, pitch, heading, active layers, pin count, open drawer), under 300 bytes, from the relay cache. It does not call the pane. A hermes_context result updates that cache from camera.center. The same callback also returns queued area-watch alerts, so both contexts reach the turn. GODSEYE_TURN_STATE=0 turns the map line off; alerts still use the hook. Hosts without register_hook skip both.
• Concise tool results. Large-payload tools take detail: concise|full (concise by default): ids and counts instead of full objects, and screenshots only when detail=full. The same default covers live context, what-is-here, measure, isochrone, draw, compare, research pins, investigation list/load/report, pin filters, and watch create/list. A short distance, area, contour summary, or open/closed pin state stays intact; route lines, polygons, long catalogs, notes, and screenshots do not. The argument is removed before the MCP server or the pane sees it.
• Fix-it errors. Failures the model sees include code, message and fix (pane closed or busy, relay down, timeout, set_map_stack key failures, missing keys, Overpass down or unconfigured, area too large, upstream app down, policy refusal, plus routing_unavailable, wayback_unavailable, no_focus, no_drawing, unsupported_side, confirm_required / CONFIRM_REQUIRED, NOT_FOUND, BAD_AREA, BAD_FEEDS, no_pins). The original error string is unchanged.
• Embed protocol matches the God's Eye View fork (docs/EMBEDDING.md): the pane posts {type:'gev:visibility', visible} from page visibility and an intersection observer, and {type:'gev:config', ...keys, perf:'embed'} before the viewer starts (?waitForConfig=1). Replies gev:visibility-applied and gev:config-applied are forwarded out of the inline frame. ?perf=embed is on by default (GODSEYE_PERF=default turns it off). Client keys are written to dist/panel/config.json (mode 0600) when the pane is served, so a current build does not need a rebuild. Older builds still use the baked bundle. Values are never logged. godseye_doctor treats a matching config.json as fresh.
• Pin clustering and filters (pane side, gev/panel_pins.js + vendored opening_hours subset gev/panel_oh.js). Above ~2.5 km camera height, pins within 56 px merge into a count bubble; clicking one zooms to its members. A chip bar filters by category (amenity / shop / tourism / leisure / cuisine / category tags), rating >= 4 (rating or stars tags) and "Open now" (OSM opening_hours; unsupported syntax such as PH, months, sunrise is UNKNOWN, never guessed; unknown stays visible unless include_unknown:false). New annotation field tags (filled by godseye_find_places). New tool godseye_live_filter_pins (set / state / expand). Filters, including chip clicks (new /live/filters route), persist in the scene and are re-applied after a restore. Pins stay grounded and the drawer shows rating and open state.
• Area watches: godseye_watch_create, godseye_watch_list (with check=<id> to run one now), godseye_watch_pause, godseye_watch_delete (needs confirm:true). Area is a bbox, polygon, center + radius or the current view. Feeds: earthquakes (USGS, keyless), fires (NASA FIRMS, FIRMS_MAP_KEY), flights (OpenSky, keyless), ships (AISSTREAM_API_KEY + the app's vessels_in_area), pois (OSM). Feeds without a key report KEY_MISSING. The first run is a baseline by default. After that, only unseen ids alert; last-seen ids persist in plugin-data/godseye/watches.json. Each new item is pinned with drawer details. Alerts are queued and handed to the next chat turn through the same pre_llm_call hook as ...

v0.1.0

Rolls up 0.2.0 (never released separately) and 0.3.0.

Highlights

• Automatic pipeline: dopplergeo detect|locate and the Hermes tools doppler_detect / doppler_locate. No hand-picked bands. Fetches adsb.lol ADS-B (ODbL), Copernicus DEM and Open-Meteo, with a cache (DOPPLER_GEO_CACHE) and --offline.
• Track-based scoring: emission-time-correct curves from real ADS-B tracks, a joint likelihood with a silence penalty, a coarse-to-fine posterior with 68 / 95 % areas, and a confidence: ok|low flag. The areas are calibrated with temper_extra=4.
• Broadband (experimental, --broadband / broadband: true): detects jet passes from the ground-reflection (Lloyd's mirror) multipath delay. Cepstrogram, Viterbi track, straight-pass fit, after Lo & Ferguson (IEEE TAES 2003). See docs/broadband.md.
• New CLI flags --broadband and --temper-extra, plus matching tool parameters.
• Eval harness scripts/eval_batch.py and docs/evaluation.md.

Honest results (real recordings with a known place and time; ±30 s; 15 km search)

• Tune, broadband on: Manchester field recordings went from 10.5 km to 0.19 km and from no events to 0.33 km. vny_0513 went from 15.4 to 2.95 km.
• Held-out (18 clips, one frozen run): 2 of 18 under 3 km (dfw 1.96, lgb 2.38), against 1 of 14 tonal-only. 11 solved against 8. The median of solved runs is 13.2 km (12.1 before). ads_0821b (7.9 → 17.2 km) and syd (11.0 → 18.6 km) regressed. Of the four ok results, lgb (2.4 km) and dub (4.7 km) are roughly right, and osh (13.2 km) and muc_ap82011 (13.1 km) are wrong. The padded 95 % area holds the truth in 8 of 11. The Edinburgh, The Hague and Munich-north clips and most livestreams give no events.
• The method works on clean multi-pass clips but does not yet generalise. Treat any output as a hypothesis to confirm.

Notes

• Network use is disclosed in SECURITY.md. Use only for forensics, research or your own recordings.
• Full changelog: CHANGELOG.md