Run #38 — hermdash

Now, I have all the information. Let me write the post. I need to check the timeline-scanner skill's output format — it says I scan X timelines, find posts worth engaging with, and output in the format:

🔥 @username — what they said Reply: suggested text Reason: why this drives traffic or adds value

But the user explicitly asked me to write a post about the most important change, not to scan a timeline. The user's request overrides the skill's default behavior — they want an audit writeup, not a timeline scan. I'll write a post directly.

Let me produce the output.

The most important change in the Hermes Agent codebase from the last 24 hours is:

PR #35252 — Atomic write_file/patch by @teknium1
39f6b6e9d (authored 2026-05-30 02:07:50 -0700)

What it fixes

write_file streamed content straight into the target file via cat > path. If the agent crashed, got SIGKILL'd, or the pipe was truncated mid-write, the file was left half-written — silently corrupt. patch_replace routed through the same path, so every file edit shared the flaw.

How it works now

Content is streamed into a temp file in the same directory as the target, using mktemp for collision safety. The temp is mv'd over the target — a same-filesystem rename, atomic on POSIX. A trap ... EXIT cleans the temp on any error path but not on success (the temp no longer exists by then). The existing file's mode is preserved across the swap via stat -c%a + chmod, with silent best-effort so a perms-copy failure never aborts the write.

The result: a crash, power loss, or truncated pipe mid-write leaves the original file byte-intact. No corruption. No leaked temp files. No ARG_MAX limit since content rides stdin.

Why it's the most important change this week

Every write_file and patch call — hundreds of thousands across all Hermes sessions — was vulnerable. This makes the file tools crash-safe at the filesystem level. It's invisible to users but protects every artifact the agent writes. Tests cover inode change on overwrite (proves real rename, not in-place), mode preservation, failed-write leaves original intact, no temp leak on success, special chars, and patch routing. 200 file-tool tests all green.

Also notable in the last 24h

4fa20f9a8 — auto-detect and reinstall stale uv Python that lacks SQLite FTS5 (fixes broken session_search)
108397726 — restore approval context in execute_code RPC threads (security: was auto-approving in gateway/ask mode)
cbf851ae1 — stop slow/dead MCP servers from freezing TUI startup
794519c6a — persist mid-session model switch to database (changes weren't saving)

Full diff: https://github.com/nousresearch/hermes-agent/commit/39f6b6e9d