Skip to content

Engineering that lands.
Tools that travel.

From reliability fixes in LangChain and Microsoft Semantic Kernel to independent use of our tools: a public record of work accepted and built on outside Hermes Labs.

Verified 2026-10-20 UTCExplore the record ↓

LangChain · 144k ★

Fixed thinking + tools crash in ChatAnthropic.bind_tools()

Anthropic’s API rejects forced tool_choice when extended thinking is enabled. LangChain’s bind_tools() could forward a forced tool choice while thinking was enabled, producing a 400 response. Ported the guard the structured-output path already had.

Pull requestlangchain/pull/35544StatusMergedReleasedlangchain-anthropic 1.3.5
Microsoft Semantic Kernel · 28k ★

Fixed ChatHistoryTruncationReducer silently deleting system prompts

The truncation reducer was calling extract_range, a summarization helper that filters out system and developer messages. System prompts were being dropped with no warning. Ported Microsoft’s own .NET fix to the Python SDK.

Pull requestsemantic-kernel/pull/13610StatusMergedReleasedpython-1.41.1
microsoft/semantic-kernel

.Net: fix: prevent duplicate "null" in JSON Schema type arrays for nullable parameters

Use value equality to avoid duplicate null entries in strict JSON Schema type arrays, with three regression tests.

Read the case study →

PR #13635Merged2026-06-16
Merge evidence
stanfordnlp/dspy

fix(evaluate): raise descriptive ValueError on empty devset instead of ZeroDivisionError

Reject an empty Evaluate devset with a descriptive ValueError before metric-summary division, with a regression test.

Read the case study →

PR #9978Merged2026-08-26
Merge evidence

4 fixes above are part of the upstream contribution record, alongside work in PyTorch Ignite, Optuna, React Router, Nuxt, MobX (28k ★), Cloudflare Workers SDK (4.4k ★), and others. Browse authored merged pull requests on GitHub.

How these fixes get made: the case studies explain the defect, regression evidence, attribution and exact upstream outcome.

Explore the contributions

Browse accepted upstream work and the integrations that take our tools into other projects. Every entry links to the public source.

Upstream Contributions · 71

Code, workflow and technical documentation changes accepted upstream, alongside reports that led to implemented corrections.

View all 71 upstream contributions outcomes
CodeGraphContext/CodeGraphContext

docs(skills): point Cursor skill at current setup docs

Replace deleted setup-document paths in the CodeGraphContext Cursor skill with current installation and MCP setup paths.

Attribution

PR author roli-lpci; responsible human contributor Rolando Bosch. Authored external contribution accepted by upstream maintainers.

fsspec/filesystem_spec

Document compressed file usage and optional codecs

Document compressed-file round trips, codec discovery and optional Zstandard backends, including explicit versus inferred compression behavior.

Attribution

PR author roli-lpci; responsible human contributor Rolando Bosch. Authored external contribution accepted by upstream maintainers.

Thytu/Agentarium

Fix README Quick Start: undefined names and private constructor

Repair the Agentarium README Quick Start to use the public Agent.create_agent factory and consistent Alice/Bob variables; identify provider configuration prerequisite.

Attribution

PR author roli-lpci; responsible human contributor Rolando Bosch. Authored external contribution accepted by upstream maintainers.

db-migrate/node-db-migrate

chore: replace mkdirp with native fs.promises.mkdir

Replace mkdirp with native fs.promises.mkdir in migration-directory creation and test setup, removing the dependency.

Attribution

PR author roli-lpci; responsible human contributor Rolando Bosch. Authored external contribution accepted by upstream maintainers.

sinonjs/sinon

chore: replace rimraf with native filesystem cleanup

Replaces the prebuild rimraf command with native Node filesystem cleanup and removes the direct rimraf dependency.

Attribution

Direct PR endpoint identifies roli-lpci as author; the founder identity is established by the organization profile. Institutional attribution is recorded only when explicit in the PR body.

PrefectHQ/fastmcp

Docs: show post-call inspection of tool text results

Reported missing post-call inspection guidance. The accepted middleware documentation example inspects tool-result text, preserves non-text blocks and surfaces checker failures. Documentation/example change; no deployed protection is inferred.

Attribution

Report: Roli Bosch (roli-lpci). Merged PR author: Amazinghorseli. Roli Bosch is explicitly credited as co-author.

yunaremaia/mcp-guard

feat: add prompt injection detection for MCP metadata (MCP008)

Adds MCP008 known-pattern metadata scanning and optional deterministic Little Canary structural filtering, with bounded inspection and documented limitations.

Attribution

Direct PR endpoint identifies roli-lpci as author; the founder identity is established by the organization profile. Institutional attribution is recorded only when explicit in the PR body.

armelhbobdad/bmad-module-skill-forge

chore: bump lintlang 0.8.1 → 0.8.2

Updates the existing lint:instructions command from LintLang 0.8.1 to 0.8.2.

Attribution

Direct PR endpoint identifies roli-lpci as author; the founder identity is established by the organization profile. Institutional attribution is recorded only when explicit in the PR body.

bytebase/dbhub

docs: point CLAUDE.md at src/connectors/interface.ts

Corrected the connector interface path in CLAUDE.md from src/interfaces/connector.ts to src/connectors/interface.ts.

Attribution

PR author is roli-lpci; the PR body explicitly identifies Rolando Bosch as the responsible human contributor and Hermes Labs as the autonomous engineering infrastructure.

pipecat-ai/pipecat

AGENTS.md: point RTVI at the rtvi/ package

Corrects the RTVI source path in AGENTS.md from the removed rtvi.py module to the current rtvi/ package, so agent instructions point at code that exists.

Attribution

The public PR body carries the hermes-labs:attribution block naming Hermes Labs' autonomous engineering infrastructure and Rolando Bosch as the responsible human contributor.

bethington/ghidra-mcp

docs(claude): drop two test paths removed with tests/performance

Removes two tests/performance paths from the CLAUDE.md verification table after that directory was deleted, so the per-file test guidance names only existing tests.

Attribution

The public PR body carries the hermes-labs:attribution block naming Hermes Labs' autonomous engineering infrastructure and Rolando Bosch as the responsible human contributor.

reduxjs/redux

chore: replace rimraf cleanup with fs.rmSync

Replaced rimraf in the root clean command with a small Node fs.rmSync script, preserving recursive, forced removal and bounded retries, and removed rimraf and its exclusive pnpm lockfile dependency closure. Upstream cleanup comparison covered nested, hidden, read-only and missing content plus symlink preservation; Windows locked-file behavior was not validated.

Attribution

The public PR body carries the hermes-labs:attribution block naming Hermes Labs engineering infrastructure and Rolando Bosch as the responsible human contributor.

bytedance/deer-flow

fix(skills): align Vercel deploy name and mounted script path

Aligned the bundled Vercel deploy skill directory with its public name and changed its four commands to the actual /mnt/skills/public/vercel-deploy/scripts/deploy.sh mount. Added coverage that loads the skill through DeerFlow’s runtime loader and checks the resolved mounted path; the PR reports 26 focused skill tests passed, while a clean full backend suite was unavailable.

Attribution

The public PR body carries the hermes-labs:attribution block naming Hermes Labs engineering infrastructure and Rolando Bosch as the responsible human contributor.

react-hook-form/react-hook-form

chore: replace rimraf cleanup with fs.rmSync

Replaced the rimraf-based dist cleanup command with Node fs.rmSync and removed the direct rimraf dependency and its exclusive pnpm lockfile entries. The upstream comparison and validation were reported on macOS; Windows locked-file behavior was not validated.

Attribution

The public PR body carries the hermes-labs:attribution block naming Hermes Labs engineering infrastructure and Rolando Bosch as the responsible human contributor.

simonw/llm

Fix AsyncResponse.log_to_db

Use completed async-response conversion when logging to SQLite, retaining the precompletion await-required error.

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

UKGovernmentBEIS/inspect_ai

Fix math() scoring a symbolic answer differently depending on target notation

Normalize symbolic target notation in math scoring so equivalent plain-text and LaTeX targets receive consistent verdicts.

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

watchlight-ai-beacon/watchlight-de

fix: add PERSON exclusions to sanitize

Add explicit per-call PERSON exclusions in Python and TypeScript so known organization names can bypass only the optional PERSON heuristic while other enabled detectors continue to run.

Attribution

The public PR body carries the hermes-labs:attribution block naming Hermes Labs engineering infrastructure and Rolando Bosch as the responsible human contributor.

crewAIInc/crewAI

fix(memory): honor read_only on update and recall access times (#7368)

Honors read_only on unified-memory update and recall access-time paths, with regression tests in the memory test suite.

Attribution

PR author is roli-lpci; the Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

vectorize-io/hindsight

feat(python-client): add task-local retain suspension

Adds task-local retain suspension to the Hindsight Python client with dedicated regression tests.

Attribution

PR author is roli-lpci; the Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

apify/apify-cli

fix: restore retry backoff when removing files

Restore retry and backoff options when recursively removing files after the earlier rimraf-to-fs.rm migration, preserving force behavior and error propagation.

Attribution

The public PR body carries the hermes-labs:attribution block naming Hermes Labs engineering infrastructure and Rolando Bosch as the responsible human contributor.

travisennis/cake

fix(tools): reject lossy JSON argument repair

Reject lossy tool-argument JSON repair that could discard extra objects, doubled braces, or provider markup after a valid prefix, while preserving complete valid JSON and raw-control-character escaping.

Attribution

The public PR body carries the hermes-labs:attribution block naming Hermes Labs engineering infrastructure and Rolando Bosch as the responsible human contributor.

nolabs-ai/nono-packs

fix: verify nono provenance before permission remediation

Require Nono provenance evidence - output naming Nono, or a successful `nono why --self` result with status DENIED - before pack guidance recommends sandbox permission remediation, route unconfirmed permission errors to a non-sandbox diagnosis, and stop inferring active profiles, across twelve harness packs.

Attribution

PR author is roli-lpci and the PR body carries the Hermes Labs attribution block naming Rolando Bosch as the responsible human contributor. This attributes the authored record; it does not infer commissioning by the upstream project, adoption, or first discovery.

nolabs-ai/nono

fix(cli): gate diagnostic remedies on observed evidence

Show path and network remediation guidance only when supervised diagnostics contain corresponding path or network-denial evidence, without changing sandbox enforcement.

Attribution

The public PR body carries the hermes-labs:attribution block naming Hermes Labs engineering infrastructure and Rolando Bosch as the responsible human contributor.

travisennis/cake

ci: run offline evaluation and metrics fixture tests

Run the existing offline evaluation-harness and session-metrics fixture suites in CI and the full local fixture aggregate for code-affecting changes.

Attribution

The public PR body carries the hermes-labs:attribution block naming Hermes Labs engineering infrastructure and Rolando Bosch as the responsible human contributor.

travisennis/cake

Fix misleading wall-time attribution in session metrics

Report invocation wall time separately from cumulative, potentially overlapping tool work and scheduled retry delays; remove unsupported exclusive-remainder and wall-share columns while retaining measurable activity from incomplete invocations.

Attribution

The public PR body carries the hermes-labs:attribution block naming Hermes Labs engineering infrastructure and Rolando Bosch as the responsible human contributor.

travisennis/cake

fix(tools): parse Bash judge verdicts strictly

Require Cake's Bash LLM judge to parse the complete response as strict JSON, allowing only one optional plain or json Markdown fence, so trailing or malformed content fails closed while tool-argument repair remains separate.

Attribution

The public PR body carries the hermes-labs:attribution block naming Hermes Labs engineering infrastructure and Rolando Bosch as the responsible human contributor.

travisennis/cake

feat(config): report skill catalog prompt size

Add cake debug skills to report selected skill-catalog XML size, approximate token count, and description lengths with advisory thresholds, without changing prompt rendering or skill filtering.

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

useblocks/sphinx-needs

📚 Document nested ports in needflow

Document a copyable Sphinx-Needs configuration for rendering nested portin and portout needs inside a parent needflow block.

Attribution

The final public PR body carries the hermes-labs:attribution block naming Hermes Labs engineering infrastructure and Rolando Bosch as the responsible human contributor.

watchlight-ai-beacon/watchlight-de

docs: explain subagent tool inheritance

Document that an explicit same-named deepagents `subagents` entry with `tools: []` stops inheritance of the parent's custom tools, while framework middleware tools (e.g. deepagents filesystem tools) remain and need separate confinement.

Attribution

The public PR body carries the hermes-labs:attribution block naming autonomous agent selection/production through Hermes Labs engineering infrastructure and Rolando Bosch as the responsible human contributor.

Azure/Azurite

chore: replace rimraf with native fs.rm()

chore: replace rimraf with native fs.rm()

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

graphql-hive/graphql-eslint

fix: replace deprecated ESLint context methods for v10 compatibility

fix: replace deprecated ESLint context methods for v10 compatibility

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

griptape-ai/griptape

LocalVectorStoreDriver namespace match accuracy

Reported namespace leakage in LocalVectorStoreDriver. The maintainer replaced prefix matching with exact namespace matching and added a regression test.

Attribution

Report: Roli Bosch (roli-lpci). Merged PR author: cjkindel.

dherault/serverless-offline

chore: replace fs-extra with native Node.js fs APIs

chore: replace fs-extra with native Node.js fs APIs

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

mozilla/addons-linter

chore(deps): replace chalk with native util.styleText

chore(deps): replace chalk with native util.styleText

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

redis/ioredis

fix: replace deprecated url.parse() with WHATWG URL API

fix: replace deprecated url.parse() with WHATWG URL API

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

cloudflare/workers-sdk

chore: replace glob with tinyglobby

chore: replace glob with tinyglobby

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

facebook/jscodeshift

chore: replace micromatch with picomatch

chore: replace micromatch with picomatch

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

bryanrsmith/eslint-plugin-sort-class-members

fix: replace deprecated context.getSourceCode() for ESLint 10 compatibility

fix: replace deprecated context.getSourceCode() for ESLint 10 compatibility

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

javascript-obfuscator/javascript-obfuscator

Replace mkdirp with native fs.mkdirSync({ recursive: true })

Replace mkdirp with native fs.mkdirSync({ recursive: true })

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

getsentry/sentry-javascript

chore(remix): Replace glob with native recursive fs walk

chore(remix): Replace glob with native recursive fs walk

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

getsentry/sentry-javascript

ref(sveltekit): Replace recast + @babel/parser with acorn

ref(sveltekit): Replace recast + @babel/parser with acorn

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

microsoft/semantic-kernel

Python: Fix ChatHistoryTruncationReducer deleting system prompt

Preserve the first system/developer message during Python chat-history truncation and handle the target_count=1 boundary.

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

danger/danger-js

refactor: replace p-limit with inline concurrency limiter

refactor: replace p-limit with inline concurrency limiter

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

postcss/postcss-cli

chore: replace fs-extra with native Node.js fs

chore: replace fs-extra with native Node.js fs

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

langchain-ai/langchain

fix(anthropic): drop forced tool_choice when thinking is enabled

Drop forced tool_choice with a warning when Anthropic extended thinking is enabled; preserve auto and unaffected requests.

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

ngrx/platform

feat(eslint-plugin): add ESLint v10 compatibility

feat(eslint-plugin): add ESLint v10 compatibility

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

sibiraj-s/eslint-plugin-file-progress

fix: add ESLint 10 compatibility

fix: add ESLint 10 compatibility

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

pytorch/ignite

replace typing hints in ignite/handlers/tqdm_logger.py

replace typing hints in ignite/handlers/tqdm_logger.py

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

graphistry/pygraphistry

infra: replace flake8 with ruff for linting (closes #466)

infra: replace flake8 with ruff for linting (closes #466)

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

webpack/stylus-loader

chore(deps): replace fast-glob with tinyglobby

chore(deps): replace fast-glob with tinyglobby

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

remix-run/react-router

chore: replace chalk with picocolors

chore: replace chalk with picocolors

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

cloudflare/workers-sdk

chore(create-cloudflare): remove unused chalk dependency

chore(create-cloudflare): remove unused chalk dependency

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

florisla/stm32loader

chore: replace flake8, black and isort with ruff

chore: replace flake8, black and isort with ruff

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

optuna/optuna

Simplify Union type alias in optuna/samplers/_cmaes.py

Simplify Union type alias in optuna/samplers/_cmaes.py

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

orval-labs/orval

chore(deps): replace chalk with native util.styleText

chore(deps): replace chalk with native util.styleText

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

nuxt/nuxt

docs: add shared/ directory to Nuxt 4 upgrade guide

docs: add shared/ directory to Nuxt 4 upgrade guide

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

web-infra-dev/rsbuild

docs: fix trailing comma in zh html/template code example

docs: fix trailing comma in zh html/template code example

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

antfu/case-police

fix: use context.filename for ESLint 10 compatibility

fix: use context.filename for ESLint 10 compatibility

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

Integrations & Adoption · 6

Accepted integrations and independent implementations, from agent workflows to CI and static document checks.

Independent use

Little Canary techniques in Preflight

Preflight independently adapted Little Canary decode-and-recheck and de-obfuscation techniques for static PDF text, with explicit source and license attribution. This is downstream implementation, not a Hermes-authored PR.

View all 6 integrations & adoption outcomes
samvitgersappa/Orbit

Use Little Canary SecurityPipeline in injection adapter

Repair the Little Canary adapter to use SecurityPipeline, preserve advisory behavior, and distinguish completed, degraded, unavailable, and failed screening.

Attribution

PR author is roli-lpci; Hermes organization profile identifies Roli Bosch as founder. This attributes the founder-authored record; it does not infer institutional commission or first discovery.

thehaven/haven-overlay

thehaven/haven-overlay

An independent maintainer provides Gentoo packaging in the unofficial Haven overlay, which tracks upstream releases across successive ebuild bumps. Its metadata.xml records hermes-labs-ai/lintlang as the upstream remote.

Attribution

Third-party package metadata names hermes-labs-ai/lintlang as upstream.

DavidMChan/preflight

Little Canary techniques adapted in Preflight

Preflight independently adapted Little Canary decode-and-recheck and de-obfuscation techniques for static PDF text, with explicit source and license attribution. This is downstream implementation, not a Hermes-authored PR.

Attribution

Independent downstream authors; no Hermes authorship of this implementation.

character-ai/larch

character-ai/larch

Character.AI Larch pinned LintLang 0.3.1 in agent-linter CI; a linked public workflow run succeeded.

Attribution

Independent repository configuration references Hermes Labs LintLang. No authorship of the original integration is attributed to Hermes.

all-source-os/all-source

zer0dex-inspired AllSource architecture

AllSource independently built on zer0dex’s compressed-index architecture. Its author credits zer0dex for changing the roadmap; the repository implements compressed markdown index generation over memory projections.

Attribution

Independent downstream authors; no Hermes authorship of this implementation.

oveku/mnemosyne

zer0dex-inspired retrieval implementation

Mnemosyne independently implemented a compressed knowledge index, auto-context endpoint and retrieval evaluation, explicitly crediting zer0dex as inspiration. The external author authored and merged the implementation.

Attribution

Independent downstream authors; no Hermes authorship of this implementation.

Sources and counting

An issue and its resulting fix count once. Integrations are separate from upstream contributions. Listings and pending submissions stay outside both totals. Reporter, PR author and independent implementer are credited on each source record.

Download the structured ledger, including historical merged distribution records. Browse authored merged PRs on GitHub.

Back to the open-source catalog.