v0.2.10

Eye Of Hermes v0.2.10

Audit follow-up after the v0.2.9 catalog-review fixes (mojomast/EOH#29, #30, #31). Still exactly 11 composable tools. The v0.2.9 prompt-trust and confirm fixes are unchanged.

Changed

• Security and correctness (#29): cap live-relay and HUD-bridge request bodies and reject invalid lengths; route untrusted and keyed HTTP through the public-address fetch helper with connection pinning and per-hop redirect checks. Private-LAN Overpass, Nominatim, Valhalla, OSRM, and Wayback URLs are refused; public HTTPS and explicit loopback still work. Scrub secrets from tool errors, refuse credential-like import paths, lock the MCP pending map, and tighten HUD token file mode, child environments, and outbound header values.
• Capabilities (#30): add godseye_query op=sdr_receivers to list nearest public SDR receivers (filter by platform, band, or frequency; does not start audio). Tighten tool-error fix text, document shipped extension ops, and drop the retired "key install" mention from the admin schema lead.
• Tests, CI and install docs (#31): GitHub Actions CI for pytest, Node unit tests, hermes plugins validate against Hermes v0.23.0, and scripts/secret_scan.py.

Notes

• Requires mojomast/gods-eye-view main at or after b361a25 (merge of pull request #5, public SDR receiver layer). Without that app checkout, the layer is not available on the globe.
• Plugin id remains godseye; install via Hermes plugins / catalog when the pin lands.