3ee2f5d693
* docs: refresh contributor tally for v0.51.390 (248 contributors) Regenerated via scripts/regen_contributors.py after fixing three real over-counting bugs in the generator (release-vehicle PR# leak, reporter false-positives, prose-token leakage — see workspace commit). Net: - 248 contributors / 1092 credits (corrected; the prior generator inflated this with ~106 spurious release-vehicle co-author credits + reporter mentions) - CONTRIBUTORS.md now recognizes 3+ PR contributors in ranked tables and lists everyone with 1-2 PRs in a combined roll, so nobody already credited is dropped - README top-10 snapshot + notable-contribution counts updated to match (franksong 180, Michaelyklam 118, rodboev 83 [new], ai-ag2026 75, bergeouss 70) Every name in the tally is authorship-verified (merged PR, CHANGELOG attribution, or a Co-authored-by trailer); bug reporters / relayers / confirmers are no longer miscredited as authors. * docs: add generated-region markers so the contributor tally regenerates cleanly Wraps the machine-generated tables in CONTRIBUTORS.md + README.md with <!-- BEGIN/END GENERATED CONTRIBUTORS --> markers. scripts/regen_contributors.py --apply now splices fresh tables between them on each run while leaving the hand-written prose (How credit is tracked, Special thanks, README Notable contributions) untouched. Verified idempotent: a second --apply is a no-op. This is what the weekly refresh cron runs. Tally re-synced to current master: 248 contributors / 1093 credits. --------- Co-authored-by: nesquena-hermes <nesquena-hermes@users.noreply.github.com> Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>
23 KiB
Contributors
Hermes WebUI is a community project. This file is the canonical credit roll.
A contributor's PR count is the number of distinct PRs they get credit for: PRs they authored that merged directly, PRs they authored that were closed-but-absorbed into a release commit (batch merges, salvage rewrites, cherry-picked-and-attributed work), and PRs where they were explicitly attributed in CHANGELOG.md. All count the same. Bug reports, confirmations, and review feedback are deeply appreciated but are not counted as authored PRs here.
Generated by scripts/regen_contributors.py in the maintainer workspace, which unions three sources — the GitHub merged-PR list, CHANGELOG.md attribution lines, and Co-authored-by: trailers on commits that landed on master (the canonical signal for a CLOSED PR whose commits were cherry-picked in and attributed). A credit is only counted when it resolves to the contributor's own PR number; release/batch "vehicle" PRs and bug-reporter mentions do not generate credit. The tables between the markers below are regenerated automatically; the prose around them is maintained by hand. If your name is missing or wrong, open a PR against CONTRIBUTORS.md — we cross-check against the changelog on each release.
248 people have shipped code that landed in a release tag — including the long tail of folks whose work was salvaged into batch releases or absorbed via Co-authored-by trailers.
Total contributors tracked: 248
Total PR credits: 1093
Last refreshed: v0.51.391, 2026-06-13
The ranked tables below recognize contributors with 3 or more landed PRs. Everyone with one or two PRs is listed in the 1–2 PR contributors roll — every one of them moved the project forward.
Top contributors (5+ PRs landed)
| # | Contributor | PRs | First release | Latest release |
|---|---|---|---|---|
| 1 | @franksong2702 | 181 | v0.49.3 |
v0.51.384 |
| 2 | @Michaelyklam | 118 | v0.50.240 |
v0.51.198 |
| 3 | @rodboev | 83 | v0.51.223 |
v0.51.384 |
| 4 | @ai-ag2026 | 75 | v0.50.279 |
v0.51.367 |
| 5 | @bergeouss | 70 | v0.48.0 |
v0.51.385 |
| 6 | @AJV20 | 34 | v0.51.93 |
v0.51.227 |
| 7 | @dso2ng | 30 | v0.50.227 |
v0.51.327 |
| 8 | @starship-s | 19 | v0.50.123 |
v0.51.153 |
| 9 | @jasonjcwu | 16 | v0.50.227 |
v0.51.235 |
| 10 | @dobby-d-elf | 15 | v0.51.38 |
v0.51.161 |
| 11 | @pamnard | 13 | v0.51.186 |
v0.51.332 |
| 12 | @Jordan-SkyLF | 12 | v0.50.18 |
v0.51.66 |
| 13 | @Sanjays2402 | 12 | v0.50.292 |
v0.51.337 |
| 14 | @aronprins | 10 | v0.44.0 |
v0.51.45 |
| 15 | @JKJameson | 10 | v0.50.198 |
v0.51.31 |
| 16 | @ccqqlo | 9 | v0.44.0 |
v0.50.270 |
| 17 | @Hinotoi-agent | 9 | v0.50.10 |
v0.51.367 |
| 18 | @24601 | 8 | v0.50.189 |
v0.51.5 |
| 19 | @LumenYoung | 8 | v0.51.47 |
v0.51.99 |
| 20 | @mysoul12138 | 8 | v0.51.161 |
v0.51.303 |
| 21 | @armorbreak001 | 7 | v0.50.47 |
v0.50.50 |
| 22 | @b3nw | 7 | v0.51.198 |
v0.51.384 |
| 23 | @happy5318 | 7 | v0.50.238 |
v0.51.268 |
| 24 | @NocGeek | 7 | v0.50.251 |
v0.50.252 |
| 25 | @iRonin | 6 | v0.41.0 |
v0.41.0 |
| 26 | @AlexeyDsov | 5 | v0.50.267 |
v0.51.197 |
| 27 | @bsgdigital | 5 | v0.50.159 |
v0.51.31 |
| 28 | @Carry00 | 5 | v0.51.132 |
v0.51.303 |
| 29 | @cloudyun888 | 5 | v0.50.47 |
v0.50.140 |
| 30 | @fxd-jason | 5 | v0.50.245 |
v0.50.250 |
| 31 | @george-andraws | 5 | v0.51.139 |
v0.51.153 |
Sustained contributors (3–4 PRs landed)
| Contributor | PRs | First release | Latest release |
|---|---|---|---|
| @fecolinhares | 4 | v0.50.238 |
v0.50.250 |
| @frap129 | 4 | v0.50.140 |
v0.50.233 |
| @Isla-Liu | 4 | v0.51.100 |
v0.51.142 |
| @KingBoyAndGirl | 4 | v0.50.238 |
v0.50.240 |
| @qxxaa | 4 | v0.50.210 |
v0.51.37 |
| @renheqiang | 4 | v0.50.61 |
v0.50.95 |
| @Thanatos-Z | 4 | v0.50.257 |
v0.50.278 |
| @xz-dev | 4 | v0.51.55 |
v0.51.196 |
| @zapabob | 4 | v0.51.186 |
v0.51.267 |
| @andrewkangkr | 3 | v0.51.185 |
v0.51.222 |
| @deboste | 3 | v0.17.1 |
v0.50.297 |
| @dutchaiagency | 3 | v0.50.281 |
v0.50.286 |
| @espokaos-ops | 3 | v0.51.92 |
v0.51.94 |
| @lucasrc | 3 | v0.51.57 |
v0.51.57 |
| @mccxj | 3 | v0.51.75 |
v0.51.148 |
| @Mubashirrrr | 3 | v0.51.231 |
v0.51.233 |
| @pavolbiely | 3 | v0.50.159 |
v0.50.233 |
1–2 PR contributors
200 more people each landed one or two PRs that shipped — a bug fix, a locale, a security hardening, a doc improvement, an infrastructure tweak. Every one moved the project forward.
@29n, @86cloudyun-afk, @AdoneyGalvan, @aether-agent, @aliceisjustplaying, @allenliang2022, @alvistar, @amlyczz, @andrewy-wizard, @antoniocarlos97ss, @Argonaut790, @arshkumarsingh, @ashbuildslife, @Asunfly, @ayushere, @bambalados, @bengdan, @betamod, @bjb2, @Bobby9228, @bschmidy10, @camr, @carlytwozero, @Charanis, @ChaseFlorell, @Chukwuebuka-20, @chwps, @claw-io, @cnogrin, @colin-chang, @cyberdyne187, @DanielMaly, @darkopetrovic, @davidsben, @DavidSchuchert, @ddiall, @DelightRun, @dev-rehaann, @dotBeeps, @DrMaks22, @eba8, @eleboucher, @emanon312, @eov128, @Fail-Safe, @fantasticsquirrel, @FrancescoFarinola, @gabogabucho, @gakugaku, @galvani, @gavinssr, @GeoffBao, @georgebdavis, @GiggleSamurai, @gottipx, @gsurenull, @Habib1001-m, @hacker1e7, @hacker2005, @halmisen, @haolf000, @heagandev, @hermes-gimmethebeans, @hi-friday, @hualong1009, @huangzt, @indigokarasu, @insecurejezza, @intellectronica, @JayC-L, @jeffscottward, @Jellypowered, @jianongHe, @jimdawdy-hub, @JinYue-GitHub, @jja881, @joaompfp, @jundev0001, @junjunjunbong, @Karlineal, @KayZz69, @kcclaw001, @kevin-ho, @koshikai, @kowenhaoai, @kuishou68, @lambyangzhao, @lawrencel1ng, @leap233, @legeantbleu, @leszek3737, @likawa3b, @linuxid10t, @liuqiangweb-svg, @lost9999, @luanxu-dev, @lucky-yonug, @lurebat, @Luxciax, @lx3133584, @Lynn-Lee, @Lyr-GW, @MacLeodMike, @malulian, @mangodxd, @mariosam95, @MatzAgent, @mbac, @michael-dg, @migueltavares, @MinhoJJang, @mittyok, @mmartial, @MrFant, @mslovy, @mvanhorn, @nanookclaw, @ng-technology-llc, @nickgiulioni1, @NottheGuy007, @octo-patch, @OneFat3, @PatrickNoFilter, @PeterDaveHello, @PINKIIILQWQ, @pix0127, @plerohellec, @puneetdixit200, @Pythonming2020, @reinocheong, @renatomott, @rhelmer, @rickchew, @rly09, @RobertoVillegas, @ruxme, @ryan-remeo, @ryansombraio, @s905060, @Saik0s, @samuelgudi, @SaulgoodMan-C, @sbe27, @shaoxianbilly, @sheng-di, @shruggr, @sixianli, @sjh9714, @skspade, @smurmann, @snuffxxx, @someaka, @spektro33, @Stampede, @starGazerK, @stocky789, @suinia, @sunilkumarvalmiki, @sunnysktsang, @swftwolfzyq, @syntheticgio, @t3chn0pr13st, @Tamaz-sujashvili, @TaraTheStar, @tgaalman, @thadreber-web, @thanhtoantnt, @the-own-lab, @theh4v0c, @theseussss, @tiansiyuan, @timlawrenz, @toanalien, @tomaioo, @TomBanksAU, @trucuit, @ts2111, @v2psv, @vanshaj-pahwa, @vansour, @vcavichini, @vCillusion, @vikarag, @viraatdas, @waldmanz, @wali-reheman, @watzon, @weidzhou, @weiwei83, @wind-chant, @wirtsi, @woaijiadanoo, @xingyue52077, @xolom, @XtremXpert, @xx77yy, @yunyunyunyun-yun, @yzp12138, @zenc-cp, @zichen0116.
How credit is tracked
Most PRs in this repo land via one of four paths:
- Direct merge — your PR is reviewed and merged on its own. Author shows up directly in
git logand on the PR'smerged_attimestamp. - Squash into a batch release — your PR is merged together with several other contributor PRs into a single release commit (e.g.
release: v0.51.55 — 9-PR contributor batch). The original PR closes (not merges) on GitHub but the squashed release commit carries aCo-authored-by: <you>trailer plus an entry inCHANGELOG.mdcrediting you by username and PR number. - Salvaged from a larger PR — when a PR mixes one good change with several unrelated or risky ones, we split it: the good parts ship in a clean follow-up PR, you get credit in the CHANGELOG entry, and the original PR is closed with a salvage map showing what went where.
- Auto-rebase + auto-fix — for merge-ready contributor PRs with mechanical blockers (CHANGELOG conflicts, lint, drifted tests), a maintainer rebases the contributor's branch, fixes the blockers, and force-pushes back. The
Co-authored-bytrailer preserves your authorship.
All four paths count as a contribution. GitHub's merged_at field only catches path 1; paths 2-4 show as "closed" on the contributor's PR even though the work is live in master. That's why this file consults the CHANGELOG attribution lines and Co-authored-by trailers, not just GitHub's merged-PR list. Credit is always tied to your PR number — the release/batch PRs the maintainer opens to ship a batch, and bug reports or review confirmations attributed in the changelog, do not generate a contributor credit.
Special thanks
- @aronprins —
v0.50.0UI overhaul (PR #242). The CSS-only redesign that defined the design tokens, theme architecture, and three-panel layout that the rest of the app builds on. PR #242 didn't merge as-is, but it is the design language of the app. - @franksong2702 — most prolific external contributor across the project's history. 180 PRs spanning the session sidebar, mobile/responsive layout, workspace state machine, profile context, slash autocomplete, breadcrumb navigation, streaming-session exemption, cron output preservation, embedded terminal, the manual-compress async start/status endpoint pair, the worktree status surface (PR #2109) + guarded remove (PR #2156) for the lifecycle umbrella #2057, session post-render dedup (PR #2166), the
/api/sessionnative-WebUI fast path (PR #2170), tail-window response trim (PR #2171), the second-wave stale-stream guard extension (PR #2158), CSP report collector (PR #2160), and the long tail of polish. - @Michaelyklam — most prolific contributor of late-2025/early-2026. 118 PRs covering Docker hardening, profile-scoped skills, KaTeX delimiter parsing, Codex quota surfacing, Goal command, Kanban polish, auto-compression toast lifetime, the localization parity backfills, the v0.51.51 mobile Insights bucketing/layout pair (PRs #2120/#2121), the Hermes run adapter RFC (PR #2105 for #1925), the fork-from-here absolute-index fix (PR #2198 for #2184), and the opencode-go custom-provider overlap routing fix (PR #2204 for #1894).
- @rodboev — 83 PRs and counting, with a strong focus on Windows / cross-platform correctness and test reliability: the
ctl.shWindows process-tree-kill fix, the local Windows full-suite signal work, slash-command autocomplete polish, and a broad sweep of frontend and infrastructure fixes. - @ai-ag2026 — autonomous-AI contributor (Hermes Agent-driven). 75 PRs focused on session recovery (state.db sidecar reconciliation, orphan
.bakrecovery, audit + safe-repair endpoints), workspace/run lifecycle health, the crash-safe turn-journal RFC, the append-only turn-journal helper (PR #2059), the matching lifecycle-events layer (PR #2062), theContent-Security-Policy-Report-Onlyheader (PR #2084), and the per-cron toast notification toggle (PR #2100). - @bergeouss — provider-management UI, OAuth status, two-container Docker docs, profile isolation hardening, Reveal-in-Finder, the OpenRouter free-tier live fetch, and most of Settings → Providers. 70 PRs.
- @Jordan-SkyLF — Live streaming, session recovery, workspace fallback, and a burst of presentation polish: the manual "Refresh usage" button on the Provider quota card (PR #2150), cancelled-turn status classification (PR #2151), Firefox sidebar scroll stabilization (PR #2200), early provisional session titles (PR #2202), target-aware "What's new?" links (PR #2207), and MCP tools overflow fix in Settings (PR #2210). 12 PRs total.
- @LumenYoung — contributor focused on the streaming hot path's correctness. 8 PRs including the original stale-stream writeback guard (PR #2136 — the bug class the next two releases extended), gateway-state alive-null classification (PR #2075), compression-banner anchor alignment (PR #2182), and context-progress ring auto-refresh on compression complete (PR #2188).
- @iRonin — security hardening sprint (PRs #196–#204): session memory leak fix, CSP + Permissions-Policy headers, slow-client connection timeout, optional HTTPS/TLS, upstream branch tracking, CLI session file-browser support. Six consecutive, focused, high-quality security PRs.
- @indigokarasu — visual redesign proposal (PR #213). Icon rail sidebar, design token system, 7 themes. Didn't merge as-is but shaped the design language that landed in v0.50.0.
- @zenc-cp — anti-hallucination guard for the ReAct loop (PR #133). Three-layer approach (ephemeral prompt, live token filtering, session-history cleanup) that the streaming pipeline still uses.
- @deboste — reverse-proxy auth, mobile responsive layout, model routing (PRs #3, #4, #5). Three of the very first community PRs. Early foundation work.
- @Hinotoi-agent — security fixes spanning profile
.envisolation (PR #351), session-import workspace validation (PR #2048), and bandit B105 hardening. Subtle, high-leverage credential and path-traversal fixes. - @lucasrc — auth-hardening trilogy in v0.51.57 (PRs #2191/#2192/#2193): thread-safe login rate limiter with PBKDF2 key separation, password-hash cache invalidation on settings change, and the full 64-char HMAC-SHA256 session signature with backwards-compatible migration bridge. Three coordinated security PRs that landed together.
- @jasonjcwu — composer and transcript polish, 16 PRs. Recent: silent compress-status during session switch (PR #2185), concurrent-send loss fix (PR #2186), in-transcript steer message badge (PR #2187), plus sidebar collapse via active-rail click (PR #2054).
- @dobby-d-elf — frontend reliability and motion polish: workspace fallback on deleted directories (PR #2138), iPhone PWA bottom-scroll fix (PR #2143), the new "Activity: X tools" composer footer animation (PR #2203) and its follow-up tuning (PR #2212).
If you've contributed and aren't here, open a PR. We cross-check the CHANGELOG on every release, but if a credit fell through (a Co-authored-by trailer that didn't make it into the changelog entry, an attribution in a PR comment that should be in the release notes), this list is the right place to fix it.