git log --author=686f6c61 --external
Open Source Contributions
- ossHermes Agent
Problem: In the desktop app, resuming a session mid-turn painted the inflight dump as plain text and duplicated the structured rows (reasoning and tool-call).
Solution: Fixed the bug where the gateway projected inflight.assistant as plain text next to the turn's structured parts, duplicating it when switching sessions. The fix stops projecting the plain dump when the turn tail already has structure, scopes the suppression to the live tail after the last user message and requires a structure-bearing row for same-turn carry, with regression tests. The original PR (#76744) was closed without merging and the same work landed on main via #77713 (a salvage keeping authorship on the three fix commits). Shipped in "The Herald Release" (Hermes Agent v0.20.0 / v2026.8.3), whose contributor credits list me.
TypeScript · Desktop · LLM
- ossHermes Agent
Problem: The prompt_caching.cache_ttl=off setting was ignored on the Mixture of Agents (MoA) paths and the fallback stubs, which kept applying prompt caching.
Solution: Fixed the bug where disabling prompt caching (prompt_caching.cache_ttl=off) was not honored on the Mixture of Agents paths nor the fallback stubs. The fix propagates the opt-out to those paths. The original PR (#76113) was closed and the same work landed on main via #76622 (a salvage keeping authorship), within the v0.20.0 cycle.
Python · LLM · Prompt Caching
- ossHermes Agent
Problem: Attribution chore: adds the contributor email mapping (github@00b.tech → 686f6c61) so the attribution audit passes when cherry-picked commits from salvages land on main.
Solution: An attribution infrastructure chore in the Hermes Agent repo: it adds the contributors/emails/github@00b.tech file mapping to 686f6c61, prepared ahead of the PR #76113 salvage (cache_ttl=off / MoA stubs) so the contributor attribution audit passes when the cherry-picked commits land on main. Without that mapping, the audits that verify the salvage commits belong to a registered contributor could fail to recognize the authorship of the fixes.
Infra · GitHub · Attribution · OSS
- ossHermes Agent
Problem: Split-delivery bug in the gateway: on long payload-less replies, the final send was duplicated or swallowed. Independent diagnosis credited in the fix that landed on main.
Solution: In the gateway, split delivery of long payload-less replies duplicated or swallowed the final send. I opened PR #78556 fixing the same issue independently. The fix that landed on main (#79669, merged) closes my PR and explicitly credits me for the independent diagnosis of the bug; the merged code was another contributor's, with my diagnosis acknowledged in the credits.
Python · Gateway · LLM
- ossHermes Agent
Problem: Rate-limit rotation quarantined the wrong key: it benched a healthy fallback credential for days instead of the actually exhausted one, because the agent's pool entry id went stale after refreshing env credentials.
Solution: Fixed the bug where, on adopting an env credential mid-run, `_try_refresh_env_client_credentials` did not call `sync_credential_pool_entry_id()` and the agent kept pointing at the old pool entry; on a 429, `mark_exhausted_and_rotate` resolved by `credential_id` (ignoring the disagreeing `api_key_hint`) and quarantined the healthy key for days while the exhausted one stayed live. The fix works across three layers: rebind the pool entry id right after adopting the env credential (run_agent.py), trust the `api_key_hint` when it disagrees with `credential_id` (agent/credential_pool.py) and regression tests at both layers (79/79 passing). The original PR (#79180) was closed without merging and the same work landed on main via #82149 (a cherry-picked salvage keeping authorship). Fixes #79156.
Python · Credential Pool · Rate Limiting · LLM
- ossHermes Agent
Problem: The automatic endpoint rewrite on auxiliary calls also rewrote /anthropic → /v1 for Anthropic-only gateways (Bailian) and for paths containing api.minimax, breaking compression and vision with 404s. Salvage of my PR #83782 onto main, authorship preserved.
Solution: The automatic endpoint rewrite in `_to_openai_base_url` rewrote `/anthropic` → `/v1` for any host, breaking Anthropic-only gateways like Bailian (`/apps/anthropic` became `/apps/v1` → 404) and producing false positives when `api.minimax` appeared in the path. The policy is inverted to a dual-surface host allowlist (MiniMax family; the ZAI `/paas/v4` mapping is kept): Anthropic-only gateways keep their path. This PR's fixup anchors the marker to the host via urlparse (exact or subdomain suffix match). It is the class-wide completion of the point fix #85466: it reaches the aux-iteration call sites and the API-key branch where no `api_mode` is in scope, which per-site guards could not. The original PR (#83782) was closed without merging and the same work landed on main via #85532 (a salvage keeping authorship on the fix commit). Fixes #83642. Tests: 20/20, 3 sabotage-verified.
Python · Gateway · Endpoint Rewrite · LLM
- ossHermes Agent
Problem: Diagnosis of the two transcript-spool defects in restart recovery (replay order and field fidelity), credited in the PR that fixes them: filename-order replay broke tool-call/response adjacency and structured fields were dropped.
Solution: My PR #78323 (fix(state): verify FTS rebuild write path; spool pending-cap overflow) found and correctly diagnosed both transcript-spool defects: the ordering bug (recovery walks sorted(glob("*.json")) and uuid4 names re-insert out of order after a burst of pending-cap spools) and the fidelity bug (its append_kwargs loop is the direct attempt at the fidelity bug). PR #84785, opened by another contributor as a supersede of #78323, explicitly credits that diagnosis ("found both of these defects first, and diagnosed both correctly") and explains it is not a mechanical rebase but work on the current code: commit de0f20ff05b landed the runtime spool independently and rewrote the regions my PR touched, leaving both defects still live on main. The fix orders by (ts, seq, filename) mirroring drain_transcript_spool, preserves the structured fields and stops the session replay after the first failure (10 new tests). Not a merge of my own: it is issue/diagnosis credit.
Python · Gateway · Spool · Diagnóstico
- ossHermes Studio
Problem: The dashboard token estimator did not count reasoning_content when checking the context-compression threshold, undercounting usage by hundreds of thousands of tokens with DeepSeek/Kimi thinking payloads.
Solution: Hermes Studio (the web dashboard for Hermes Agent) undercounted context usage because its token estimator only counted content and tool_calls, ignoring reasoning_content and reasoning. With thinking-mode payloads (DeepSeek/Kimi), which are echoed back on later turns, real context was underestimated by hundreds of thousands of tokens and compression never triggered until the upstream failed with an HTTP 400. The fix includes that content in the estimate and adds a unit test. Merged straight into main.
TypeScript · LLM · Context
- ossllama.cpp
Problem: Anthropic API didn't support thinking blocks or signatures for reasoning models.
Solution: Added thinking content blocks support to Anthropic Messages API. Fixed missing signature fields and duplicate content_block_start events in streaming. Tested with DeepSeek-R1 and Qwen3-Thinking.
C++ · Anthropic API · Streaming
- ossLangChain
Problem: Tool call chunks without index failed to merge properly in streaming, causing 422 errors.
Solution: Fixed bug where tool_call_chunks without valid index failed to merge properly in streaming with stream_mode="messages". Modified merge_lists() function to merge chunks by shared id or sequentially. Added unit tests.
Python · LLM · Streaming
- ossllama.cpp
Problem: Chat templates crashed when applying |length filter on Undefined type in minja engine.
Solution: Full flow trace through minja engine: missing keys return Undefined (not None), so `is not none` evaluates True and `|length` fails on Undefined. Audited all templates in models/templates/, identified 4 vulnerable (Apriel, DeepSeek-R1-Distill-Qwen-32B, DeepSeek-R1-Distill-Llama-8B, llama-cpp-deepseek-r1) and 8 fragile. Proposed template fix (`is defined` guard) and engine fix (register length on value_undefined_t).
C++ · Jinja · Minja
- ossMicrosoft Calculator
Problem: Inverse hyperbolic functions (sinh^-1, cosh^-1) errored with values > 10^100 due to incorrect validation.
Solution: Bug analysis where IsCurrentTooBigForTrig() applied the 10^100 limit indiscriminately to all trigonometric and hyperbolic functions. Inverse hyperbolics are logarithms in disguise (sinh^-1(x) = ln(x + sqrt(x^2 + 1))), with no periodicity issues. Proposed fix: check m_bInv flag before rejecting large values to exempt inverse hyperbolics.
C++ · Windows · Math
- ossnuclei-templates
Problem: CVE-2026-26335: RCE in Calero VeraSMART due to hardcoded ASP.NET machine keys.
Solution: Template request to detect CVE-2026-26335 (CVSS 9.8) in Calero VeraSMART (pre-2022 R1). Shared ASP.NET cryptographic keys across installations allow forging malicious ViewState and achieving unauthenticated remote code execution via deserialization.
YAML · Security · CVE
- ossOpenRouter SDK
Problem: Missing sourcemaps caused build tool errors like SWC.
Solution: Identified that .npmignore excluded .map files despite tsconfig.json generating them. OpenAI includes 844 and Anthropic 296 sourcemaps in their SDKs. Proposed solution to include the 652 .map files.
TypeScript · npm · Build Tools
- ossnuclei-templates
Problem: xinclude-injection template generated false positives due to overly permissive regex.
Solution: The regex `root:.*?:[0-9]*:[0-9]*:` matched minified JavaScript content like `PEAM_root:config:123:456:`. Fixed to `root:[^:]*:\d+:\d+:` to restrict to non-colon characters and require at least one digit in UID/GID.
YAML · Regex · Security
- ossLlamaIndex
Problem: DocumentBlock incorrectly coerced empty strings to None in optional fields.
Solution: Fixed bug where DocumentBlock class converted empty strings to None using Python truthiness evaluation. Changed `or` logic to explicit `is None` checks in document_mimetype and title fields. Added unit tests.
Python · LLM · Pydantic
- ossllama.cpp
Problem: Vulkan Docker couldn't detect GPUs due to missing libglvnd libraries.
Solution: Mesa Vulkan ICD couldn't initialize properly and vkEnumeratePhysicalDevices() returned empty list. Added libglvnd0, libgl1, libglx0, libegl1 and libgles2 libraries to Dockerfile.
Docker · Vulkan · Mesa
- osstheHarvester
Problem: Missing THC (ip.thc.org) integration for subdomain enumeration.
Solution: New module integrating THC for subdomain enumeration. Free API with no rate limits or API key required. Includes 24 tests and full documentation.
Python · OSINT · Security
- ossnuclei-templates
Problem: CVE-2025-34291: CORS vulnerability in Langflow AI allowing token theft.
Solution: Template to detect CVE-2025-34291 in Langflow AI (≤1.6.9). Misconfigured CORS reflects any origin with credentials allowed, chained with RCE via /api/v1/validate/code.
YAML · Security · CVE