Update CONTRIBUTORS.md and the README contributors section to reflect 130 contributors and 568 PR credits as of v0.51.44 (was 66/142 at v0.50.245). The numbers grew because: - The previous refresh was 1 release-cycle ago (50+ tags + 8 batch releases of contributor PRs ago). - The new counting rule explicitly includes closed-but-absorbed PRs: PRs whose original branch shows "closed" on GitHub but whose content shipped via batch-release squash with a Co-authored-by trailer, or via salvage rewrite with CHANGELOG attribution. This better reflects what users actually contributed. The compilation pipeline: 1. Pull every closed PR from gh api (state=closed, both merged and unmerged on GitHub) — 1421 PRs. 2. Walk CHANGELOG.md release-by-release and extract: - `PR #N by @user` (canonical bullet form) - `(#N by @user`, `(PR #N by @user`, `(#N, @user;` - `PRs #A, #B by @user` (plural) - `@user — PR #N`, `@user — N PR (#A, #B)` - `(credit: @user)` and `(credit: @userA and @userB)` 3. For every PR# mentioned in CHANGELOG, union the explicit @-attributed users with the gh PR author (when external). Maintainer accounts (@nesquena, @nesquena-hermes) are excluded. 4. For PRs merged on GitHub but not mentioned in CHANGELOG (very early PRs, non-noteworthy direct merges), credit the gh author. 5. Three salvaged-design contributors not directly in CHANGELOG are credited in the special-thanks roll: @indigokarasu (#213 → v0.50.0 design language), @andrewy-wizard (#177 → initial Chinese locale absorbed into v0.42.0), @zenc-cp (#133 → anti-hallucination guard absorbed into streaming.py). Pre-cleaning step strips HTML entities (` ` etc.) before PR# scan to avoid false matches. PR# regex requires a whitespace/paren/bracket preceder so identifiers like `--key=123` and `(##10`-style headings don't pollute the count. Per-user first/last release computed from: - For merged-on-GH PRs: the smallest tag whose creator-date is >= the PR's merged_at timestamp. - For absorbed PRs: the release section in CHANGELOG that explicitly attributes to the user (or the earliest release that mentions the PR# if no explicit attribution exists for that user). CONTRIBUTORS.md sections: - Top contributors (5+ PRs) — 20 people, ranked - Sustained contributors (3–4 PRs) — 11 people - Two-PR contributors — 14 people, flat list - Single-PR contributors — 85 people, flat list - How credit is tracked — four paths described - Special thanks — 11 highlight blurbs README contributors section trimmed to top-10 table + notable- contribution blurbs (29 distinct contributors mentioned with concrete PR numbers). Same data, condensed for the README. No code changes. Docs only.
13 KiB
Contributors
Hermes WebUI is a community project. 130 people have shipped code that landed in a release tag — including the long tail of folks whose work was salvaged into batch releases or absorbed via Co-authored-by trailers. This file is the canonical credit roll.
A contributor's PR count is the number of distinct PRs they get credit for: PRs they authored that merged directly, PRs they authored that were closed-but-absorbed into a release commit (batch merges, salvage rewrites), and PRs where they were explicitly attributed in CHANGELOG.md. All three count the same.
Total contributors tracked: 130
Total PR credits: 568
Last refreshed: v0.51.44, 2026-05-11
Generated from git log + the GitHub PR list (merged and closed) + the CHANGELOG.md attribution lines (PR #N by @user, (credit: @user), @user — PR #N). If your name is missing or wrong, open a PR against CONTRIBUTORS.md — we cross-check against the changelog on each release.
Top contributors (5+ PRs landed)
| # | Contributor | PRs | First release | Latest release |
|---|---|---|---|---|
| 1 | @franksong2702 | 92 | v0.49.3 |
v0.51.44 |
| 2 | @Michaelyklam | 81 | v0.50.240 |
v0.51.40 |
| 3 | @bergeouss | 61 | v0.48.0 |
v0.51.18 |
| 4 | @ai-ag2026 | 49 | v0.50.279 |
v0.51.44 |
| 5 | @dso2ng | 21 | v0.50.227 |
v0.51.37 |
| 6 | @jasonjcwu | 13 | v0.50.227 |
v0.51.43 |
| 7 | @aronprins | 10 | v0.44.0 |
v0.50.233 |
| 8 | @JKJameson | 10 | v0.50.233 |
v0.51.31 |
| 9 | @ccqqlo | 9 | v0.44.0 |
v0.50.270 |
| 10 | @24601 | 8 | v0.50.233 |
v0.51.5 |
| 11 | @starship-s | 8 | v0.50.128 |
v0.51.8 |
| 12 | @armorbreak001 | 7 | v0.50.47 |
v0.50.50 |
| 13 | @NocGeek | 7 | v0.50.251 |
v0.50.252 |
| 14 | @Hinotoi-agent | 6 | v0.50.12 |
v0.51.44 |
| 15 | @iRonin | 6 | v0.41.0 |
v0.41.0 |
| 16 | @Jordan-SkyLF | 6 | v0.50.18 |
v0.50.27 |
| 17 | @Sanjays2402 | 6 | v0.50.292 |
v0.51.31 |
| 18 | @cloudyun888 | 5 | v0.50.47 |
v0.50.140 |
| 19 | @fxd-jason | 5 | v0.50.245 |
v0.50.249 |
| 20 | @happy5318 | 5 | v0.50.238 |
v0.51.31 |
Sustained contributors (3–4 PRs landed)
| Contributor | PRs | First release | Latest release |
|---|---|---|---|
| @bsgdigital | 4 | v0.50.228 |
v0.50.258 |
| @fecolinhares | 4 | v0.50.238 |
v0.50.250 |
| @frap129 | 4 | v0.50.140 |
v0.50.233 |
| @KingBoyAndGirl | 4 | v0.50.238 |
v0.50.240 |
| @qxxaa | 4 | v0.50.233 |
v0.51.37 |
| @renheqiang | 4 | v0.50.61 |
v0.50.95 |
| @Thanatos-Z | 4 | v0.50.257 |
v0.50.278 |
| @AlexeyDsov | 3 | v0.50.267 |
v0.50.278 |
| @deboste | 3 | v0.50.269 |
v0.50.297 |
| @dutchaiagency | 3 | v0.50.281 |
v0.50.286 |
| @pavolbiely | 3 | v0.50.159 |
v0.50.233 |
Two-PR contributors (14)
@ChaseFlorell, @dobby-d-elf, @gabogabucho, @hacker1e7, @lost9999, @mmartial, @nickgiulioni1, @renatomott, @ruxme, @Saik0s, @shruggr, @TaraTheStar, @vansour, @zichen0116.
Single-PR contributors (85)
Each of these folks landed exactly one PR that shipped — a bug fix, a locale, a security hardening, a doc improvement, an infrastructure tweak. Every one moved the project forward.
@29n, @amlyczz, @andrewy-wizard, @Argonaut790, @Asunfly, @betamod, @Bobby9228, @bschmidy10, @carlytwozero, @davidsben, @DavidSchuchert, @DelightRun, @DrMaks22, @eba8, @eov128, @galvani, @GeoffBao, @georgebdavis, @GiggleSamurai, @hacker2005, @halmisen, @hermes-gimmethebeans, @hi-friday, @hualong1009, @huangzt, @indigokarasu, @insecurejezza, @jeffscottward, @Jellypowered, @jimdawdy-hub, @JinYue-GitHub, @joaompfp, @jundev0001, @KayZz69, @kcclaw001, @kevin-ho, @koshikai, @kowenhaoai, @lawrencel1ng, @likawa3b, @lucky-yonug, @lx3133584, @MacLeodMike, @mangodxd, @mariosam95, @MatzAgent, @mbac, @michael-dg, @migueltavares, @mittyok, @ng-technology-llc, @octo-patch, @rhelmer, @rickchew, @ryan-remeo, @ryansombraio, @s905060, @samuelgudi, @SaulgoodMan-C, @sbe27, @shaoxianbilly, @sheng-di, @sixianli, @skspade, @smurmann, @snuffxxx, @spektro33, @Stampede, @suinia, @sunnysktsang, @tgaalman, @thadreber-web, @the-own-lab, @tomaioo, @trucuit, @vcavichini, @vCillusion, @vikarag, @wali-reheman, @watzon, @woaijiadanoo, @xingyue52077, @yunyunyunyun-yun, @yzp12138, @zenc-cp.
How credit is tracked
Most PRs in this repo land via one of four paths:
- Direct merge — your PR is reviewed and merged on its own. Author shows up directly in
git logand on the PR'smerged_attimestamp. - Squash into a batch release — your PR is merged together with several other contributor PRs into a single release commit (e.g.
release: v0.51.44 — 5-PR contributor batch). The original PR closes (not merges) on GitHub but the squashed release commit carries aCo-authored-by: <you>trailer plus an entry inCHANGELOG.mdcrediting you by username and PR number. - Salvaged from a larger PR — when a PR mixes one good change with several unrelated or risky ones, we split it: the good parts ship in a clean follow-up PR, you get credit in the CHANGELOG entry, and the original PR is closed with a salvage map showing what went where.
- Auto-rebase + auto-fix — for merge-ready contributor PRs with mechanical blockers (CHANGELOG conflicts, lint, drifted tests), a maintainer rebases the contributor's branch, fixes the blockers, and force-pushes back. The
Co-authored-bytrailer preserves your authorship.
All four paths count as a contribution. GitHub's merged_at field only catches path 1; paths 2-4 show as "closed" on the contributor's PR even though the work is live in master. That's why this file consults the CHANGELOG attribution lines, not just GitHub's merged-PR list.
Special thanks
- @aronprins —
v0.50.0UI overhaul (PR #242). The CSS-only redesign that defined the design tokens, theme architecture, and three-panel layout that the rest of the app builds on. PR #242 didn't merge as-is, but it is the design language of the app. - @franksong2702 — most prolific external contributor across the project's history. 92 PRs spanning the session sidebar, mobile/responsive layout, workspace state machine, profile context, slash autocomplete, breadcrumb navigation, streaming-session exemption, cron output preservation, embedded terminal, and a long tail of polish.
- @Michaelyklam — most prolific contributor of late-2025/early-2026. 81 PRs covering Docker hardening, profile-scoped skills, KaTeX delimiter parsing, Codex quota surfacing, Goal command, Kanban polish, auto-compression toast lifetime, and the localization parity backfills.
- @bergeouss — provider-management UI, OAuth status, two-container Docker docs, profile isolation hardening, Reveal-in-Finder, the OpenRouter free-tier live fetch, and most of Settings → Providers. 61 PRs.
- @ai-ag2026 — autonomous-AI contributor (Hermes Agent-driven). 49 PRs focused on session recovery (state.db sidecar reconciliation, orphan
.bakrecovery, audit + safe-repair endpoints), workspace/run lifecycle health, and the crash-safe turn-journal RFC. - @iRonin — security hardening sprint (PRs #196–#204): session memory leak fix, CSP + Permissions-Policy headers, slow-client connection timeout, optional HTTPS/TLS, upstream branch tracking, CLI session file-browser support. Six consecutive, focused, high-quality security PRs.
- @indigokarasu — visual redesign proposal (PR #213). Icon rail sidebar, design token system, 7 themes. Didn't merge as-is but shaped the design language that landed in v0.50.0.
- @zenc-cp — anti-hallucination guard for the ReAct loop (PR #133). Three-layer approach (ephemeral prompt, live token filtering, session-history cleanup) that the streaming pipeline still uses.
- @Jordan-SkyLF — live streaming, session recovery, workspace fallback (PRs #366, #367, #394–#397). Six interlocking improvements that landed across v0.50.18–v0.50.27.
- @deboste — reverse-proxy auth, mobile responsive layout, model routing (PRs #3, #4, #5). Three of the very first community PRs. Early foundation work.
- @Hinotoi-agent — security fixes spanning profile
.envisolation (PR #351), session-import workspace validation (PR #2048), and bandit B105 hardening. Subtle, high-leverage credential and path-traversal fixes.
If you've contributed and aren't here, open a PR. We cross-check the CHANGELOG on every release, but if a credit fell through (a Co-authored-by trailer that didn't make it into the changelog entry, an attribution in a PR comment that should be in the release notes), this list is the right place to fix it.