Hermes Feishu Streaming Card v4.2.10

v4.2.10 closes two runtime gaps found during the repository audit: non-loopback sidecar interactions now use dedicated request authentication, and interaction deadlines are enforced by the sidecar instead of being display-only.

Highlights

• Adds hfc-sidecar-request-v1 HMAC proofs that bind the HTTP method, canonical path, and raw body for card actions, interaction result reads, and message-summary reads when non-loopback authentication is enabled.
• Enforces absolute interaction deadlines across buttons, form submissions, result polling, card refresh, and retention cleanup.
• Rejects late callbacks idempotently and prevents expired interactions from returning to completed.
• Sends one distinct best-effort interaction.failed event when the Gateway poll deadline is reached, without replaying the original request.
• Adds SHA-pinned Node 24 GitHub Actions, CodeQL, weekly Dependabot updates, Ubuntu Python 3.9-3.12, full macOS testing, a fixed Windows portable runtime/server suite, PowerShell installer checks, and Docker Compose smoke coverage.

Verified release provenance

• Merge commit: c4939cf03c0880b5104302cdf0e1ea56733df744
• Annotated tag object: a245d71865a5fac18e9fce4816e2dae769484f14
• Pull request: #201
• Release workflow: 31355945949
• Exact merge-SHA local gate: 2475 passed, 6 skipped
• Release workflow: Ubuntu 3.9-3.12, macOS, Windows, PowerShell, Feishu SDK, and Docker jobs all passed before asset upload.
• A fresh public-tag installation resolved v4.2.10 to the merge commit above, loaded package and distribution version 4.2.10 from site-packages, passed dependency checks, and exposed the CLI successfully.

Assets

• hermes-feishu-card-v4.2.10-macos.tar.gz — sha256:e3b99556ce81b2ff4346ec3a908700f9f0dd3177d6cc4e2b7ad17674d13b61f5
• hermes-feishu-card-v4.2.10-linux.tar.gz — sha256:e3b99556ce81b2ff4346ec3a908700f9f0dd3177d6cc4e2b7ad17674d13b61f5
• hermes-feishu-card-v4.2.10-windows.zip — sha256:2dcfa8f8ff45e34616a7ee4626c1b6643eaf98ffae844c72f6946c5ca0de1b04
• hermes-feishu-card-v4.2.10-checksums.txt — sha256:b34f5feb244c2fb48cdd880dad285222a454e16138f71875cc88df62f143d8d7

The downloaded packages were checked against the published checksum file before this release note was finalized.

Upgrade

macOS / Linux:

export HFC_VERSION=v4.2.10
bash install.sh

Docker:

export HFC_VERSION=v4.2.10
bash install-docker.sh

Windows PowerShell:

$env:HFC_VERSION = "v4.2.10"
irm "https://raw.githubusercontent.com/baileyh8/hermes-feishu-streaming-card/v4.2.10/install.ps1" | iex

After upgrading, run hermes-feishu-card doctor --config <config> --hermes-dir <hermes-agent> --explain and hermes-feishu-card status --config <config>.

Full changelog: v4.2.9...v4.2.10