Construct v1.2.1

The Hermes plugin's security review (the catalog's, at 1.2.0), and an examples polish.

• Options only by their whole names. Construct's command line, and every subcommand's, refuses a prefix of an
  option (--ou for --out); before, argparse took prefixes, so a check of flags by name could be walked around.
  The plugin's construct_command now reads a command line as Construct's own parser does, in a child, without
  running it, and decides on what the parser understood: options that call a model over the network (--base-url,
  --key-env, the --critic-* options), rounds ... run wherever its options stand, and writes outside the project
  are refused.
• No program paths from a tool call. --freecad and --blender are refused in the plugin; the programs it runs
  come from its settings, a CONSTRUCT_* variable or the PATH.
• Minimal environments. Chrome, ffmpeg, Blender, FreeCAD, Java (NetLogo) and the plugin's own Construct child
  get what a program needs to start and keep its files, and Construct's CONSTRUCT_* settings for the child; never
  the rest of the environment, where provider keys live (construct_hologram/procenv.py).
• NetLogo code is approved first. A run of a model from outside the installed Models Library, or with setup/
  go code the agent wrote, always goes through Hermes's approval prompt, showing the code, whatever Ask before
  running programs is set to; an approval covers that code only.
• The plugin's README says so, and its skill references no longer show the direct model calls the plugin refuses.

Examples polish: every gallery example checked again, by measurement and in the solid view, for slips the light
forgives. One small kit-plan addition; nothing else in the library changed.

• Measured, not eyeballed: every example's compiled surfaces were checked for parts that float clear of
  everything (none at rest), articulations that nest the wrong way round, glass that the solid view, exports and
  kits would make opaque, and printed text that is upside down, off its part or hidden under a cover.
• SERUM 2 / 61: with the control deck open, two knobs, a fader and the ASSIGN key hung in the air above the
  keybed: their own turns were ordered before the deck's opening, and Construct nests articulations by order, so
  they moved about their closed-deck pivots. They now move after the deck. The display covers' dark fill hid the
  display text from above; the covers are drawn as outlines in the light and stay glass in the solid view.
• Vespa GS 150: the owner's chrome bars, rack, mudguard hoop and badge carrier rebuilt as continuous tubes that
  meet the body and clear the factory parts. Its kit follows: the badge carrier, held only by the two legshield bars,
  is moulded with them, each cowl with the lower return it lifts with; 28 pieces on 2 plates in 22 steps.
• Kit plans name pieces (names in kit-plan.json, {"owner-rear-rack": "owner-rear-rack"}): a merged piece is
  named for what its parts' ids share, and the Vespa's owner parts share only "owner" (its booklet read "build the
  dual seat, with the owner"); a plan can now name such a piece by any part in it.
• Leica M3: the lens's name ring capped the front element and its inscription was cut by the lens's lip; it is a
  ring on the recessed step now, inscribed Summicron and 5 cm 1:2. The ASA/DIN reminder read upside down; the
  vulcanite ran past the flat front into the air.
• Eames Lounge Chair (Claude Opus 5.5): the headrest cushion stood 5 to 7 cm off its shell and the back cushion
  floated over a hollow up to 22 cm deep; both now rest on their shells.
• Omega Speedmaster 321, Patek Philippe 5320G, Volkswagen T1 Samba: crystals, sapphires and skylights whose ids
  did not say glass were opaque in the solid view; renamed, the dials show. The 5320G's dial text also shows in the
  light now (its sapphire's faint fill hid it).
• Duomo di Milano: the Madonnina was drawn as data, in the palette's pink, so the great spire ended in a pink tip;
  she is drawn in the building's light now.
• New example: State Bench, an invented instrument (GPT-6.1 Sol, masterpiece): an original bench for repeatable
  numerical experiments on dynamical systems, at object scale what KESTREL is at ship scale; its plots are computed
  RK4 runs of a Duffing oscillator.
• Every changed example was judged again by a fresh independent critic, recorded in its scene; each README says what
  changed under Revised after the run. Left as they are, and why: the Skyline's door
  frames run 1 to 2 cm outboard of its roof (a refit of the roof, not a polish); the Andromeda galaxy's arms are
  dust lanes, so its solid view is ribbons (a galaxy has no surfaces); the Braun SK 4's legends under its glass lid
  are hidden in the light's x-ray, because the viewer lets glass hide the text under it (a viewer change, for a later
  release).

The kits are attached (construct-kit-<slug>.zip): plates to print, the booklet and the 3D guide. construct-1.2.1.zip is the NetLogo extension and construct-blender-1.2.1.zip the Blender add-on. The Hermes plugin installs from this repository: hermes plugins install rtmandreyev/construct#hermes/construct.

Full list: CHANGELOG · delta from 1.2.0: v1.2.0...v1.2.1