nesquena-hermes
7192d856af
Last refresh was at v0.51.44 (130 contributors / 568 PR credits). Since then, 14 releases shipped (v0.51.45 through v0.51.58) with 78 attributed PRs from 20 distinct contributors, adding 7 first-time contributors: - @lucasrc — auth-hardening trilogy (#2191/#2192/#2193) → sustained 3-PR bucket - @LumenYoung — stale-stream guard + 3 streaming-correctness fixes → sustained 4-PR bucket - @MrFant — 2 PRs (reasoning_content whitelist, message preservation) - @xz-dev — 2 PRs (thinking-card state, session-scoped metering) - @legeantbleu — French (fr) locale (#2142) - @ayushere — ctl.sh bash 3.2 macOS compat (#2117) - @plerohellec — single PR Bucket promotions (existing contributors who moved up): - @dobby-d-elf: 2 → 6 PRs (jumps from two-PR list into top contributors) - @samuelgudi: 1 → 2 - @michael-dg: 1 → 2 - @vcavichini: 1 → 2 - @hualong1009: 1 → 2 Top contributor PR-count updates (top 7 changed materially): | Contributor | Before | After | Delta | Latest release | |-------------------|-------:|------:|------:|---------------| | @franksong2702 | 92 | 117 | +25 | Unreleased | | @Michaelyklam | 81 | 92 | +11 | v0.51.57 | | @bergeouss | 61 | 62 | +1 | v0.51.46 | | @ai-ag2026 | 49 | 55 | +6 | v0.51.47 | | @dso2ng | 21 | 23 | +2 | v0.51.51 | | @jasonjcwu | 13 | 16 | +3 | v0.51.55 | | @Jordan-SkyLF | 6 | 12 | +6 | Unreleased | Header refreshed: 130 → 137 contributors, 568 → 646 PR credits, refresh tag bumped to v0.51.58. Notable contributions paragraphs in both files updated with the new work (manual /compress async pair, worktree status + guarded remove, fork-from-here, opencode-go resolver, the LumenYoung + lucasrc + dobby-d-elf entries). Source of truth: CHANGELOG.md attribution lines `**PR #N** by @user` between the v0.51.44 header and the Unreleased section, plus baseline buckets in the previous CONTRIBUTORS.md. Cross-bucket sanity check passes (no handle appears in multiple buckets; 21 + 13 + 19 + 84 = 137 unique handles).
16 KiB
Contributors
Hermes WebUI is a community project. 137 people have shipped code that landed in a release tag — including the long tail of folks whose work was salvaged into batch releases or absorbed via Co-authored-by trailers. This file is the canonical credit roll.
A contributor's PR count is the number of distinct PRs they get credit for: PRs they authored that merged directly, PRs they authored that were closed-but-absorbed into a release commit (batch merges, salvage rewrites), and PRs where they were explicitly attributed in CHANGELOG.md. All three count the same.
Total contributors tracked: 137 Total PR credits: 646 Last refreshed: v0.51.58, 2026-05-13
Generated from git log + the GitHub PR list (merged and closed) + the CHANGELOG.md attribution lines (PR #N by @user, (credit: @user), @user — PR #N). If your name is missing or wrong, open a PR against CONTRIBUTORS.md — we cross-check against the changelog on each release.
Top contributors (5+ PRs landed)
| # | Contributor | PRs | First release | Latest release |
|---|---|---|---|---|
| 1 | @franksong2702 | 117 | v0.49.3 |
v0.51.58 |
| 2 | @Michaelyklam | 92 | v0.50.240 |
v0.51.57 |
| 3 | @bergeouss | 62 | v0.48.0 |
v0.51.46 |
| 4 | @ai-ag2026 | 55 | v0.50.279 |
v0.51.47 |
| 5 | @dso2ng | 23 | v0.50.227 |
v0.51.51 |
| 6 | @jasonjcwu | 16 | v0.50.227 |
v0.51.55 |
| 7 | @Jordan-SkyLF | 12 | v0.50.18 |
v0.51.58 |
| 8 | @aronprins | 10 | v0.44.0 |
v0.50.233 |
| 9 | @JKJameson | 10 | v0.50.233 |
v0.51.31 |
| 10 | @starship-s | 10 | v0.50.128 |
v0.51.58 |
| 11 | @ccqqlo | 9 | v0.44.0 |
v0.50.270 |
| 12 | @24601 | 8 | v0.50.233 |
v0.51.5 |
| 13 | @armorbreak001 | 7 | v0.50.47 |
v0.50.50 |
| 14 | @NocGeek | 7 | v0.50.251 |
v0.50.252 |
| 15 | @dobby-d-elf | 6 | v0.51.38 |
v0.51.58 |
| 16 | @Hinotoi-agent | 6 | v0.50.12 |
v0.51.44 |
| 17 | @iRonin | 6 | v0.41.0 |
v0.41.0 |
| 18 | @Sanjays2402 | 6 | v0.50.292 |
v0.51.31 |
| 19 | @cloudyun888 | 5 | v0.50.47 |
v0.50.140 |
| 20 | @fxd-jason | 5 | v0.50.245 |
v0.50.249 |
| 21 | @happy5318 | 5 | v0.50.238 |
v0.51.31 |
Sustained contributors (3–4 PRs landed)
| Contributor | PRs | First release | Latest release |
|---|---|---|---|
| @bsgdigital | 4 | v0.50.228 |
v0.50.258 |
| @fecolinhares | 4 | v0.50.238 |
v0.50.250 |
| @frap129 | 4 | v0.50.140 |
v0.50.233 |
| @KingBoyAndGirl | 4 | v0.50.238 |
v0.50.240 |
| @LumenYoung | 4 | v0.51.47 |
v0.51.55 |
| @qxxaa | 4 | v0.50.233 |
v0.51.37 |
| @renheqiang | 4 | v0.50.61 |
v0.50.95 |
| @Thanatos-Z | 4 | v0.50.257 |
v0.50.278 |
| @AlexeyDsov | 3 | v0.50.267 |
v0.50.278 |
| @deboste | 3 | v0.50.269 |
v0.50.297 |
| @dutchaiagency | 3 | v0.50.281 |
v0.50.286 |
| @lucasrc | 3 | v0.51.57 |
v0.51.57 |
| @pavolbiely | 3 | v0.50.159 |
v0.50.233 |
Two-PR contributors (19)
@ChaseFlorell, @gabogabucho, @hacker1e7, @hualong1009, @lost9999, @michael-dg, @mmartial, @MrFant, @nickgiulioni1, @renatomott, @ruxme, @Saik0s, @samuelgudi, @shruggr, @TaraTheStar, @vansour, @vcavichini, @xz-dev, @zichen0116.
Single-PR contributors (84)
Each of these folks landed exactly one PR that shipped — a bug fix, a locale, a security hardening, a doc improvement, an infrastructure tweak. Every one moved the project forward.
@29n, @amlyczz, @andrewy-wizard, @Argonaut790, @Asunfly, @ayushere, @betamod, @Bobby9228, @bschmidy10, @carlytwozero, @davidsben, @DavidSchuchert, @DelightRun, @DrMaks22, @eba8, @eov128, @galvani, @GeoffBao, @georgebdavis, @GiggleSamurai, @hacker2005, @halmisen, @hermes-gimmethebeans, @hi-friday, @huangzt, @indigokarasu, @insecurejezza, @jeffscottward, @Jellypowered, @jimdawdy-hub, @JinYue-GitHub, @joaompfp, @jundev0001, @KayZz69, @kcclaw001, @kevin-ho, @koshikai, @kowenhaoai, @lawrencel1ng, @legeantbleu, @likawa3b, @lucky-yonug, @lx3133584, @MacLeodMike, @mangodxd, @mariosam95, @MatzAgent, @mbac, @migueltavares, @mittyok, @ng-technology-llc, @octo-patch, @plerohellec, @rhelmer, @rickchew, @ryan-remeo, @ryansombraio, @s905060, @SaulgoodMan-C, @sbe27, @shaoxianbilly, @sheng-di, @sixianli, @skspade, @smurmann, @snuffxxx, @spektro33, @Stampede, @suinia, @sunnysktsang, @tgaalman, @thadreber-web, @the-own-lab, @tomaioo, @trucuit, @vCillusion, @vikarag, @wali-reheman, @watzon, @woaijiadanoo, @xingyue52077, @yunyunyunyun-yun, @yzp12138, @zenc-cp.
How credit is tracked
Most PRs in this repo land via one of four paths:
- Direct merge — your PR is reviewed and merged on its own. Author shows up directly in
git logand on the PR'smerged_attimestamp. - Squash into a batch release — your PR is merged together with several other contributor PRs into a single release commit (e.g.
release: v0.51.55 — 9-PR contributor batch). The original PR closes (not merges) on GitHub but the squashed release commit carries aCo-authored-by: <you>trailer plus an entry inCHANGELOG.mdcrediting you by username and PR number. - Salvaged from a larger PR — when a PR mixes one good change with several unrelated or risky ones, we split it: the good parts ship in a clean follow-up PR, you get credit in the CHANGELOG entry, and the original PR is closed with a salvage map showing what went where.
- Auto-rebase + auto-fix — for merge-ready contributor PRs with mechanical blockers (CHANGELOG conflicts, lint, drifted tests), a maintainer rebases the contributor's branch, fixes the blockers, and force-pushes back. The
Co-authored-bytrailer preserves your authorship.
All four paths count as a contribution. GitHub's merged_at field only catches path 1; paths 2-4 show as "closed" on the contributor's PR even though the work is live in master. That's why this file consults the CHANGELOG attribution lines, not just GitHub's merged-PR list.
Special thanks
- @aronprins —
v0.50.0UI overhaul (PR #242). The CSS-only redesign that defined the design tokens, theme architecture, and three-panel layout that the rest of the app builds on. PR #242 didn't merge as-is, but it is the design language of the app. - @franksong2702 — most prolific external contributor across the project's history. 117 PRs spanning the session sidebar, mobile/responsive layout, workspace state machine, profile context, slash autocomplete, breadcrumb navigation, streaming-session exemption, cron output preservation, embedded terminal, the manual-compress async start/status endpoint pair, the worktree status surface (PR #2109) + guarded remove (PR #2156) for the lifecycle umbrella #2057, session post-render dedup (PR #2166), the
/api/sessionnative-WebUI fast path (PR #2170), tail-window response trim (PR #2171), the second-wave stale-stream guard extension (PR #2158), CSP report collector (PR #2160), and the long tail of polish. - @Michaelyklam — most prolific contributor of late-2025/early-2026. 92 PRs covering Docker hardening, profile-scoped skills, KaTeX delimiter parsing, Codex quota surfacing, Goal command, Kanban polish, auto-compression toast lifetime, the localization parity backfills, the v0.51.51 mobile Insights bucketing/layout pair (PRs #2120/#2121), the Hermes run adapter RFC (PR #2105 for #1925), the fork-from-here absolute-index fix (PR #2198 for #2184), and the opencode-go custom-provider overlap routing fix (PR #2204 for #1894).
- @bergeouss — provider-management UI, OAuth status, two-container Docker docs, profile isolation hardening, Reveal-in-Finder, the OpenRouter free-tier live fetch, and most of Settings → Providers. 62 PRs.
- @ai-ag2026 — autonomous-AI contributor (Hermes Agent-driven). 55 PRs focused on session recovery (state.db sidecar reconciliation, orphan
.bakrecovery, audit + safe-repair endpoints), workspace/run lifecycle health, the crash-safe turn-journal RFC, the append-only turn-journal helper (PR #2059), the matching lifecycle-events layer (PR #2062), theContent-Security-Policy-Report-Onlyheader (PR #2084), and the per-cron toast notification toggle (PR #2100). - @Jordan-SkyLF — Live streaming, session recovery, workspace fallback, and a recent burst of presentation polish: the manual "Refresh usage" button on the Provider quota card (PR #2150), cancelled-turn status classification (PR #2151), Firefox sidebar scroll stabilization (PR #2200), early provisional session titles (PR #2202), target-aware "What's new?" links (PR #2207), and MCP tools overflow fix in Settings (PR #2210). 12 PRs total.
- @LumenYoung — newer contributor focused on the streaming hot path's correctness. 4 PRs including the original stale-stream writeback guard (PR #2136 — the bug class the next two releases extended), gateway-state alive-null classification (PR #2075), compression-banner anchor alignment (PR #2182), and context-progress ring auto-refresh on compression complete (PR #2188).
- @iRonin — security hardening sprint (PRs #196–#204): session memory leak fix, CSP + Permissions-Policy headers, slow-client connection timeout, optional HTTPS/TLS, upstream branch tracking, CLI session file-browser support. Six consecutive, focused, high-quality security PRs.
- @indigokarasu — visual redesign proposal (PR #213). Icon rail sidebar, design token system, 7 themes. Didn't merge as-is but shaped the design language that landed in v0.50.0.
- @zenc-cp — anti-hallucination guard for the ReAct loop (PR #133). Three-layer approach (ephemeral prompt, live token filtering, session-history cleanup) that the streaming pipeline still uses.
- @deboste — reverse-proxy auth, mobile responsive layout, model routing (PRs #3, #4, #5). Three of the very first community PRs. Early foundation work.
- @Hinotoi-agent — security fixes spanning profile
.envisolation (PR #351), session-import workspace validation (PR #2048), and bandit B105 hardening. Subtle, high-leverage credential and path-traversal fixes. - @lucasrc — auth-hardening trilogy in v0.51.57 (PRs #2191/#2192/#2193): thread-safe login rate limiter with PBKDF2 key separation, password-hash cache invalidation on settings change, and the full 64-char HMAC-SHA256 session signature with backwards-compatible migration bridge. Three coordinated security PRs that landed together.
- @jasonjcwu — composer and transcript polish, 16 PRs. Recent: silent compress-status during session switch (PR #2185), concurrent-send loss fix (PR #2186), in-transcript steer message badge (PR #2187), plus sidebar collapse via active-rail click (PR #2054).
- @dobby-d-elf — frontend reliability and motion polish: workspace fallback on deleted directories (PR #2138), iPhone PWA bottom-scroll fix (PR #2143), the new "Activity: X tools" composer footer animation (PR #2203) and its follow-up tuning (PR #2212).
If you've contributed and aren't here, open a PR. We cross-check the CHANGELOG on every release, but if a credit fell through (a Co-authored-by trailer that didn't make it into the changelog entry, an attribution in a PR comment that should be in the release notes), this list is the right place to fix it.