git log --author=686f6c61 --external
Open Source Contributions
- ossHermes Agent
Problem: In the desktop app, resuming a session mid-turn painted the inflight dump as plain text and duplicated the structured rows (reasoning and tool-call).
Solution: Fixed the bug where the gateway projected inflight.assistant as plain text next to the turn's structured parts, duplicating it when switching sessions. The fix stops projecting the plain dump when the turn tail already has structure, scopes the suppression to the live tail after the last user message and requires a structure-bearing row for same-turn carry, with regression tests. The original PR (#76744) was closed without merging and the same work landed on main via #77713 (a salvage keeping authorship on the three fix commits). Shipped in "The Herald Release" (Hermes Agent v0.20.0 / v2026.8.3), whose contributor credits list me.
TypeScript · Desktop · LLM
- ossHermes Agent
Problem: The prompt_caching.cache_ttl=off setting was ignored on the Mixture of Agents (MoA) paths and the fallback stubs, which kept applying prompt caching.
Solution: Fixed the bug where disabling prompt caching (prompt_caching.cache_ttl=off) was not honored on the Mixture of Agents paths nor the fallback stubs. The fix propagates the opt-out to those paths. The original PR (#76113) was closed and the same work landed on main via #76622 (a salvage keeping authorship), within the v0.20.0 cycle.
Python · LLM · Prompt Caching
- ossHermes Agent
Problem: Split-delivery bug in the gateway: on long payload-less replies, the final send was duplicated or swallowed. Independent diagnosis credited in the fix that landed on main.
Solution: In the gateway, split delivery of long payload-less replies duplicated or swallowed the final send. I opened PR #78556 fixing the same issue independently. The fix that landed on main (#79669, merged) closes my PR and explicitly credits me for the independent diagnosis of the bug; the merged code was another contributor's, with my diagnosis acknowledged in the credits.
Python · Gateway · LLM
- ossHermes Agent
Problem: Rate-limit rotation quarantined the wrong key: it benched a healthy fallback credential for days instead of the actually exhausted one, because the agent's pool entry id went stale after refreshing env credentials.
Solution: Fixed the bug where, on adopting an env credential mid-run, `_try_refresh_env_client_credentials` did not call `sync_credential_pool_entry_id()` and the agent kept pointing at the old pool entry; on a 429, `mark_exhausted_and_rotate` resolved by `credential_id` (ignoring the disagreeing `api_key_hint`) and quarantined the healthy key for days while the exhausted one stayed live. The fix works across three layers: rebind the pool entry id right after adopting the env credential (run_agent.py), trust the `api_key_hint` when it disagrees with `credential_id` (agent/credential_pool.py) and regression tests at both layers (79/79 passing). The original PR (#79180) was closed without merging and the same work landed on main via #82149 (a cherry-picked salvage keeping authorship). Fixes #79156.
Python · Credential Pool · Rate Limiting · LLM
- ossHermes Studio
Problem: The dashboard token estimator did not count reasoning_content when checking the context-compression threshold, undercounting usage by hundreds of thousands of tokens with DeepSeek/Kimi thinking payloads.
Solution: Hermes Studio (the web dashboard for Hermes Agent) undercounted context usage because its token estimator only counted content and tool_calls, ignoring reasoning_content and reasoning. With thinking-mode payloads (DeepSeek/Kimi), which are echoed back on later turns, real context was underestimated by hundreds of thousands of tokens and compression never triggered until the upstream failed with an HTTP 400. The fix includes that content in the estimate and adds a unit test. Merged straight into main.
TypeScript · LLM · Context
- ossllama.cpp
Problem: Anthropic API didn't support thinking blocks or signatures for reasoning models.
Solution: Added thinking content blocks support to Anthropic Messages API. Fixed missing signature fields and duplicate content_block_start events in streaming. Tested with DeepSeek-R1 and Qwen3-Thinking.
C++ · Anthropic API · Streaming
- ossLangChain
Problem: Tool call chunks without index failed to merge properly in streaming, causing 422 errors.
Solution: Fixed bug where tool_call_chunks without valid index failed to merge properly in streaming with stream_mode="messages". Modified merge_lists() function to merge chunks by shared id or sequentially. Added unit tests.
Python · LLM · Streaming
- ossllama.cpp
Problem: Chat templates crashed when applying |length filter on Undefined type in minja engine.
Solution: Full flow trace through minja engine: missing keys return Undefined (not None), so `is not none` evaluates True and `|length` fails on Undefined. Audited all templates in models/templates/, identified 4 vulnerable (Apriel, DeepSeek-R1-Distill-Qwen-32B, DeepSeek-R1-Distill-Llama-8B, llama-cpp-deepseek-r1) and 8 fragile. Proposed template fix (`is defined` guard) and engine fix (register length on value_undefined_t).
C++ · Jinja · Minja
- ossMicrosoft Calculator
Problem: Inverse hyperbolic functions (sinh^-1, cosh^-1) errored with values > 10^100 due to incorrect validation.
Solution: Bug analysis where IsCurrentTooBigForTrig() applied the 10^100 limit indiscriminately to all trigonometric and hyperbolic functions. Inverse hyperbolics are logarithms in disguise (sinh^-1(x) = ln(x + sqrt(x^2 + 1))), with no periodicity issues. Proposed fix: check m_bInv flag before rejecting large values to exempt inverse hyperbolics.
C++ · Windows · Math
- ossnuclei-templates
Problem: CVE-2026-26335: RCE in Calero VeraSMART due to hardcoded ASP.NET machine keys.
Solution: Template request to detect CVE-2026-26335 (CVSS 9.8) in Calero VeraSMART (pre-2022 R1). Shared ASP.NET cryptographic keys across installations allow forging malicious ViewState and achieving unauthenticated remote code execution via deserialization.
YAML · Security · CVE
- ossOpenRouter SDK
Problem: Missing sourcemaps caused build tool errors like SWC.
Solution: Identified that .npmignore excluded .map files despite tsconfig.json generating them. OpenAI includes 844 and Anthropic 296 sourcemaps in their SDKs. Proposed solution to include the 652 .map files.
TypeScript · npm · Build Tools
- ossnuclei-templates
Problem: xinclude-injection template generated false positives due to overly permissive regex.
Solution: The regex `root:.*?:[0-9]*:[0-9]*:` matched minified JavaScript content like `PEAM_root:config:123:456:`. Fixed to `root:[^:]*:\d+:\d+:` to restrict to non-colon characters and require at least one digit in UID/GID.
YAML · Regex · Security
- ossLlamaIndex
Problem: DocumentBlock incorrectly coerced empty strings to None in optional fields.
Solution: Fixed bug where DocumentBlock class converted empty strings to None using Python truthiness evaluation. Changed `or` logic to explicit `is None` checks in document_mimetype and title fields. Added unit tests.
Python · LLM · Pydantic
- ossllama.cpp
Problem: Vulkan Docker couldn't detect GPUs due to missing libglvnd libraries.
Solution: Mesa Vulkan ICD couldn't initialize properly and vkEnumeratePhysicalDevices() returned empty list. Added libglvnd0, libgl1, libglx0, libegl1 and libgles2 libraries to Dockerfile.
Docker · Vulkan · Mesa
- osstheHarvester
Problem: Missing THC (ip.thc.org) integration for subdomain enumeration.
Solution: New module integrating THC for subdomain enumeration. Free API with no rate limits or API key required. Includes 24 tests and full documentation.
Python · OSINT · Security
- ossnuclei-templates
Problem: CVE-2025-34291: CORS vulnerability in Langflow AI allowing token theft.
Solution: Template to detect CVE-2025-34291 in Langflow AI (≤1.6.9). Misconfigured CORS reflects any origin with credentials allowed, chained with RCE via /api/v1/validate/code.
YAML · Security · CVE