I find these by running the software on an unusual setup (Fedora, Python 3.14), then tracing the failure with git blame. Every fix is small, tested and authored as victorv2i.

NousResearch/hermes-agent ↗

The agent runtime my own assistant runs on. Six fixes, all found by running it.

• #46863 Open Filed 2026-06-15 · +32 / -10

  fix(delegation): validate batch input before resolving credentials

  Batch delegation resolved its credentials before validating the batch, so an over-cap or malformed batch reported a missing delegation provider instead of the real input error. The fix moves validation first.

  Maintainer review kept it open and re-confirmed the premise on current main.

• #47489 Closed Filed 2026-06-16 · +70 / -15

  fix(skills): pass encoding="utf-8" on skills-hub file I/O

  Skills Hub state files were written without an explicit encoding, so non-ASCII skill metadata raised a UnicodeEncodeError on a Windows locale that is not UTF-8 and left the install record truncated.

  Closed 2026-07-25 and the fix shipped. Upstream retired the whole class of bug in one pass across 139 call sites, salvaging eleven contributor patches into it with authorship preserved. This was one of the eleven.

• #47492 Open Filed 2026-06-16 · +50 / -0

  fix(tools): reap tar/ssh subprocesses on non-timeout errors in SSH bulk upload

  The SSH bulk upload only killed its tar and ssh children on a timeout, so any other failure from communicate() left a zombie pair behind on a long-running gateway.

  Maintainer review kept it open with the premise confirmed. Third-party triage later checked it against a neighbouring pull request and found the two address distinct causes.

• #47669 Closed Filed 2026-06-17 · +76 / -1

  fix(state): order replayed conversation by id, not timestamp

  A feature commit had flipped replayed conversation ordering from id back to timestamp, silently reopening the tool-adjacency bug an earlier merged pull request had closed. Found with git blame, filed with a regression test.

  Closed 2026-07-14 as redundant. Main already carried the ordering guarantee by the time it was reviewed.

• #63366 Open Filed 2026-07-12 · +29 / -1

  fix(curator): abort rollback when safety snapshot fails

  Skill rollback promised a safety snapshot before replacing the live tree, but the snapshot function reports expected failure by returning nothing and rollback only handled raised exceptions. It now fails closed before touching anything.

  Maintainer review kept it open with the premise confirmed on current main.

• #63382 Open Filed 2026-07-12 · +46 / -3

  fix(backup): keep same-second snapshots distinct

  Quick snapshot ids carried one-second precision, so two snapshots taken in the same second reused one directory and the second silently overwrote the first recovery point.

  Maintainer review kept it open and asked for one more change: keep snapshots in time order past nine same-second collisions, with a test.

odysseus-dev/odysseus ↗

Both merged. Both filed against the project's dev branch, per its contributing rules.

• #4387 Merged Filed 2026-06-16 · +1 / -1

  test: stop test_skill_index_prompt_injection leaking a stub prefs_routes

  A test installed a fake preferences module into sys.modules and never removed it, so a later test that imported the real one failed depending on run order. One line, moved onto monkeypatch so teardown reverts it.

  Merged 2026-06-18.

• #4464 Merged Filed 2026-06-16 · +92 / -8

  fix(email): validate IMAP/SMTP ports instead of crashing with 500

  A non-numeric IMAP or SMTP port crashed three email endpoints with an HTTP 500, because the port was coerced with a bare int(). Bad input now returns the endpoints' own error shape.

  Merged 2026-06-26.