git log --author=686f6c61 --external
Open Source Contributions
- ossOrca
Problem: `orchestration check` returned an empty success while the inbox still held mail from a previous Run. Supervision map #15190 cites the work.
Solution: On a host with several Runs, the command the product tells you to run (`orca orchestration check`) returned `ok: true` and `count: 0` for the pane-bound Run, while `inbox` still showed unread mail from a previous Run and `check --run <other>` returned `consumer_fenced`. PR #14751 adds an optional `crossRunUnread` field on the `check` result, resolved through `run_coordinator_handles` (the live column is cleared when the pane is rebound). Tracking issue #15190, which maps the orchestration supervision loop, lists @686f6c61 among that map's open attempts.
TypeScript · Orchestration · RPC · SQLite
- ossHermes Agent
Problem: In the desktop app, resuming a session mid-turn painted the inflight dump as plain text and duplicated the structured rows (reasoning and tool-call).
Solution: Fixed the bug where the gateway projected inflight.assistant as plain text next to the turn's structured parts, duplicating it when switching sessions. The fix stops projecting the plain dump when the turn tail already has structure, scopes the suppression to the live tail after the last user message and requires a structure-bearing row for same-turn carry, with regression tests. The original PR (#76744) was closed without merging and the same work landed on main via #77713 (a salvage keeping authorship on the three fix commits). Shipped in "The Herald Release" (Hermes Agent v0.20.0 / v2026.8.3), whose contributor credits list me.
TypeScript · Desktop · LLM
- ossHermes Agent
Problem: The prompt_caching.cache_ttl=off setting was ignored on the Mixture of Agents (MoA) paths and the fallback stubs, which kept applying prompt caching.
Solution: Fixed the bug where disabling prompt caching (prompt_caching.cache_ttl=off) was not honored on the Mixture of Agents paths nor the fallback stubs. The fix propagates the opt-out to those paths. The original PR (#76113) was closed and the same work landed on main via #76622 (a salvage keeping authorship), within the v0.20.0 cycle.
Python · LLM · Prompt Caching
- ossHermes Agent
Problem: Attribution chore: adds the contributor email mapping (github@00b.tech → 686f6c61) so the attribution audit passes when cherry-picked commits from salvages land on main.
Solution: An attribution infrastructure chore in the Hermes Agent repo: it adds the contributors/emails/github@00b.tech file mapping to 686f6c61, prepared ahead of the PR #76113 salvage (cache_ttl=off / MoA stubs) so the contributor attribution audit passes when the cherry-picked commits land on main. Without that mapping, the audits that verify the salvage commits belong to a registered contributor could fail to recognize the authorship of the fixes.
Infra · GitHub · Attribution · OSS
- ossHermes Agent
Problem: Split-delivery bug in the gateway: on long payload-less replies, the final send was duplicated or swallowed. Independent diagnosis credited in the fix that landed on main.
Solution: In the gateway, split delivery of long payload-less replies duplicated or swallowed the final send. I opened PR #78556 fixing the same issue independently. The fix that landed on main (#79669, merged) closes my PR and explicitly credits me for the independent diagnosis of the bug; the merged code was another contributor's, with my diagnosis acknowledged in the credits.
Python · Gateway · LLM
- ossHermes Agent
Problem: Rate-limit rotation quarantined the wrong key: it benched a healthy fallback credential for days instead of the actually exhausted one, because the agent's pool entry id went stale after refreshing env credentials.
Solution: Fixed the bug where, on adopting an env credential mid-run, `_try_refresh_env_client_credentials` did not call `sync_credential_pool_entry_id()` and the agent kept pointing at the old pool entry; on a 429, `mark_exhausted_and_rotate` resolved by `credential_id` (ignoring the disagreeing `api_key_hint`) and quarantined the healthy key for days while the exhausted one stayed live. The fix works across three layers: rebind the pool entry id right after adopting the env credential (run_agent.py), trust the `api_key_hint` when it disagrees with `credential_id` (agent/credential_pool.py) and regression tests at both layers (79/79 passing). The original PR (#79180) was closed without merging and the same work landed on main via #82149 (a cherry-picked salvage keeping authorship). Fixes #79156.
Python · Credential Pool · Rate Limiting · LLM
- ossHermes Agent
Problem: The automatic endpoint rewrite on auxiliary calls also rewrote /anthropic → /v1 for Anthropic-only gateways (Bailian) and for paths containing api.minimax, breaking compression and vision with 404s. Salvage of my PR #83782 onto main, authorship preserved.
Solution: The automatic endpoint rewrite in `_to_openai_base_url` rewrote `/anthropic` → `/v1` for any host, breaking Anthropic-only gateways like Bailian (`/apps/anthropic` became `/apps/v1` → 404) and producing false positives when `api.minimax` appeared in the path. The policy is inverted to a dual-surface host allowlist (MiniMax family; the ZAI `/paas/v4` mapping is kept): Anthropic-only gateways keep their path. This PR's fixup anchors the marker to the host via urlparse (exact or subdomain suffix match). It is the class-wide completion of the point fix #85466: it reaches the aux-iteration call sites and the API-key branch where no `api_mode` is in scope, which per-site guards could not. The original PR (#83782) was closed without merging and the same work landed on main via #85532 (a salvage keeping authorship on the fix commit). Fixes #83642. Tests: 20/20, 3 sabotage-verified.
Python · Gateway · Endpoint Rewrite · LLM
- ossHermes Agent
Problem: Diagnosis of the two transcript-spool defects in restart recovery (replay order and field fidelity), credited in the PR that fixes them: filename-order replay broke tool-call/response adjacency and structured fields were dropped.
Solution: My PR #78323 (fix(state): verify FTS rebuild write path; spool pending-cap overflow) found and correctly diagnosed both transcript-spool defects: the ordering bug (recovery walks sorted(glob("*.json")) and uuid4 names re-insert out of order after a burst of pending-cap spools) and the fidelity bug (its append_kwargs loop is the direct attempt at the fidelity bug). PR #84785, opened by another contributor as a supersede of #78323, explicitly credits that diagnosis ("found both of these defects first, and diagnosed both correctly") and explains it is not a mechanical rebase but work on the current code: commit de0f20ff05b landed the runtime spool independently and rewrote the regions my PR touched, leaving both defects still live on main. The fix orders by (ts, seq, filename) mirroring drain_transcript_spool, preserves the structured fields and stops the session replay after the first failure (10 new tests). Not a merge of my own: it is issue/diagnosis credit.
Python · Gateway · Spool · Diagnóstico
- ossHermes Agent
Problem: On Desktop, the Files panel of a password-gated remote listed with the native bearer but Download returned 401: saveGatewayFile always rode the OAuth cookie partition.
Solution: Files-panel listing on a password-gated remote uses `hermes:api` (native bearer, then OAuth-partition cookies), but download went through `saveGatewayFile`, which always rode that cookie partition. A cookieless native session could list files and still 401 on Download. Merged PR #90546 (20 August 2026) makes save/read use the same bearer-then-cookie choice as REST, names `resolveGatedDownloadAuth` and adds tests pinning bearer first, then cookie, and session-token for token/local. Supersedes #89013. Primary credit to @686f6c61 in the PR body and co-authorship on both fix commits. Fixes #88987.
TypeScript · Desktop · Auth · Electron
- ossHermes Agent
Problem: On Windows, hermes update could start a standalone gateway beside Desktop when a stale autostart entry remained, accumulating processes that competed for ports and state. The fix respects Desktop lifecycle ownership.
Solution: Fixed the bug where the post-`hermes update` cold-start relied on “an autostart artifact exists and no gateway PID is detected,” without knowing that Desktop already controlled the lifecycle through its `serve` process. `_desktop_owns_gateway_lifecycle()` checks the spawn ledger first and falls back to this install's Python processes, excluding orphaned control planes; the condition guards both the pre-update plan and the check immediately before spawning. My original PR #76745 was closed when the work landed through salvage PR #92698, which explicitly credits @686f6c61 and preserves my authorship on main commit `4ccc4b6`. The merged version also hardens subcommand classification and was validated with 9 focused tests, 4 live Linux checks and 10 Windows checks. Fixes #76129.
Python · Windows · Desktop · Process Lifecycle
- ossHermes Agent
Problem: A WebSocket session disconnected mid-turn could remain immortal in memory: the reaper consumed its only timer while the turn was still running and never checked it again. The fix reschedules the check until the turn finishes.
Solution: Fixed the leak where a session detached from its WebSocket mid-turn could remain indefinitely in `_sessions`, with `ended_at` set to NULL and its agent retained in memory. `_schedule_ws_orphan_reap` armed a single timer; if it fired while `running` was still true, `_ws_session_is_orphaned()` returned false and the reaper exited without scheduling another check, while the TTL and capacity eviction paths also skipped running sessions. The fix from my original PR #85598 rearms the same grace period for detached sessions that are still working, allowing a later run to release them once the turn has finished, with a fake-timer regression test. The work landed on main through consolidated PR #93361, which explicitly credits @686f6c61 and preserves my authorship on commit `66420e0`. Fixes #85578.
Python · Gateway · WebSocket · Sessions
- ossHermes Agent
Problem: The Routines pane crashed on JSON-RPC rejections with a numeric name: React 19 tried to call trim() on that value and hid the original failure. The fix normalizes those rejections as Errors without mutating the received object.
Solution: Fixed the failure where a gateway/IPC request rejected with a plain object —for example, `{ name: -32000 }`— made React 19's error formatter throw `(e.name || "").trim is not a function`, taking down the Routines pane instead of showing its "Could not load cronjobs" state. `requestForBot()` now routes both dispatch paths (`host.requestProfile` and `host.request`) through `asRpcError()`, which accepts cross-realm values, creates a fresh Error for unsafe rejections, preserves the original value in `cause`, and also works with frozen or sealed objects. Original PR #94621 was closed when the work was consolidated into salvage PR #95016, which explicitly credits @686f6c61 and preserves authorship on both commits that landed on main (`a837c7a` and `961635c`). In #94621, teknium confirmed: “Thanks @686f6c61! The frozen-rejection copy in your second commit was exactly right.” The regression covers numeric names, strings, null, frozen objects, and pass-through of safe Errors; 561 tests pass. Issue #94471 was closed and Bot Mode tracker #94726 marks the fix as FIXED.
JavaScript · Desktop · React · JSON-RPC
- ossHermes Agent
Problem: After quitting Desktop following an SSH session, the remote hermes serve --isolated backend could remain alive, retaining its lockfile and state.db. Teardown now terminates only the remote process whose ownership it can prove.
Solution: Fixed the process-leak half of #91668: the SSH backend detaches through setsid/nohup so it can be reused, which meant closing the transport did not clean it up and remote `hermes serve --isolated` processes accumulated. `teardownSshConnection` reads `backend.lock.json`, reuses `cleanupStale` to kill only a provably owned PID, and performs remote cleanup before cancelling the forward and closing SSH; the coordinator also gains a terminal `shutdown()` to stop reconnect callbacks from spawning another backend during quit. My original PR #94628 was closed when the work was included in multi-gateway salvage #95085, merged on 26 August 2026, which preserves my authorship on main commits `28a73f8` and `3c1a170`. The salvage correctly excludes the unrelated composer/timeout-bag fix and keeps only the two SSH teardown commits. The original tests passed 91/91; the combined salvage validation passed 247/247 across 12 suites and the attribution audit was green. No live reproduction against a real SSH host was run.
TypeScript · Electron · SSH · Process Lifecycle
- ossHermes Studio
Problem: The dashboard token estimator did not count reasoning_content when checking the context-compression threshold, undercounting usage by hundreds of thousands of tokens with DeepSeek/Kimi thinking payloads.
Solution: Hermes Studio (the web dashboard for Hermes Agent) undercounted context usage because its token estimator only counted content and tool_calls, ignoring reasoning_content and reasoning. With thinking-mode payloads (DeepSeek/Kimi), which are echoed back on later turns, real context was underestimated by hundreds of thousands of tokens and compression never triggered until the upstream failed with an HTTP 400. The fix includes that content in the estimate and adds a unit test. Merged straight into main.
TypeScript · LLM · Context
- ossllama.cpp
Problem: Anthropic API didn't support thinking blocks or signatures for reasoning models.
Solution: Added thinking content blocks support to Anthropic Messages API. Fixed missing signature fields and duplicate content_block_start events in streaming. Tested with DeepSeek-R1 and Qwen3-Thinking.
C++ · Anthropic API · Streaming
- ossLangChain
Problem: Tool call chunks without index failed to merge properly in streaming, causing 422 errors.
Solution: Fixed bug where tool_call_chunks without valid index failed to merge properly in streaming with stream_mode="messages". Modified merge_lists() function to merge chunks by shared id or sequentially. Added unit tests.
Python · LLM · Streaming
- ossllama.cpp
Problem: Chat templates crashed when applying |length filter on Undefined type in minja engine.
Solution: Full flow trace through minja engine: missing keys return Undefined (not None), so `is not none` evaluates True and `|length` fails on Undefined. Audited all templates in models/templates/, identified 4 vulnerable (Apriel, DeepSeek-R1-Distill-Qwen-32B, DeepSeek-R1-Distill-Llama-8B, llama-cpp-deepseek-r1) and 8 fragile. Proposed template fix (`is defined` guard) and engine fix (register length on value_undefined_t).
C++ · Jinja · Minja
- ossMicrosoft Calculator
Problem: Inverse hyperbolic functions (sinh^-1, cosh^-1) errored with values > 10^100 due to incorrect validation.
Solution: Bug analysis where IsCurrentTooBigForTrig() applied the 10^100 limit indiscriminately to all trigonometric and hyperbolic functions. Inverse hyperbolics are logarithms in disguise (sinh^-1(x) = ln(x + sqrt(x^2 + 1))), with no periodicity issues. Proposed fix: check m_bInv flag before rejecting large values to exempt inverse hyperbolics.
C++ · Windows · Math
- ossnuclei-templates
Problem: CVE-2026-26335: RCE in Calero VeraSMART due to hardcoded ASP.NET machine keys.
Solution: Template request to detect CVE-2026-26335 (CVSS 9.8) in Calero VeraSMART (pre-2022 R1). Shared ASP.NET cryptographic keys across installations allow forging malicious ViewState and achieving unauthenticated remote code execution via deserialization.
YAML · Security · CVE
- ossOpenRouter SDK
Problem: Missing sourcemaps caused build tool errors like SWC.
Solution: Identified that .npmignore excluded .map files despite tsconfig.json generating them. OpenAI includes 844 and Anthropic 296 sourcemaps in their SDKs. Proposed solution to include the 652 .map files.
TypeScript · npm · Build Tools
- ossnuclei-templates
Problem: xinclude-injection template generated false positives due to overly permissive regex.
Solution: The regex `root:.*?:[0-9]*:[0-9]*:` matched minified JavaScript content like `PEAM_root:config:123:456:`. Fixed to `root:[^:]*:\d+:\d+:` to restrict to non-colon characters and require at least one digit in UID/GID.
YAML · Regex · Security
- ossLlamaIndex
Problem: DocumentBlock incorrectly coerced empty strings to None in optional fields.
Solution: Fixed bug where DocumentBlock class converted empty strings to None using Python truthiness evaluation. Changed `or` logic to explicit `is None` checks in document_mimetype and title fields. Added unit tests.
Python · LLM · Pydantic
- ossllama.cpp
Problem: Vulkan Docker couldn't detect GPUs due to missing libglvnd libraries.
Solution: Mesa Vulkan ICD couldn't initialize properly and vkEnumeratePhysicalDevices() returned empty list. Added libglvnd0, libgl1, libglx0, libegl1 and libgles2 libraries to Dockerfile.
Docker · Vulkan · Mesa
- osstheHarvester
Problem: Missing THC (ip.thc.org) integration for subdomain enumeration.
Solution: New module integrating THC for subdomain enumeration. Free API with no rate limits or API key required. Includes 24 tests and full documentation.
Python · OSINT · Security
- ossnuclei-templates
Problem: CVE-2025-34291: CORS vulnerability in Langflow AI allowing token theft.
Solution: Template to detect CVE-2025-34291 in Langflow AI (≤1.6.9). Misconfigured CORS reflects any origin with credentials allowed, chained with RCE via /api/v1/validate/code.
YAML · Security · CVE