I Merged 348 PRs. Here Are The 11 Bugs That Tested My Sanity.

The Windows Curse

Bugs in open source rarely look like simple syntax errors. They look like complete system failures. While contributing to advanced Graph RAG tools like cognee and AI frameworks like openclaw, I noticed a silent killer. Most maintainers build on Unix systems. They use Mac. They use Linux. Windows users are often left in the dark.

In cognee, users were facing a chaotic OS Error 3. Windows was struggling with long file paths during dataset context resolution. It completely broke the local database integration. I dove into the LanceDB integration and wrote a fix to automatically prefix Windows paths. This bypassed the legacy path limits.

fix(lancedb): automatically prefix windows paths to resolve OS Error 3 for long paths (fixes #2941) #3123
aniruddhaadak80 posted on Jun 20, 2026
Closes #2941

This PR automatically normalizes and prefixes absolute Windows paths for the vector_db_url when using local filesystem storage. This resolves OS Error 3 triggered by LanceDB subprocesses when generating long file paths for persisting vector data on Windows.

The exact same thing was happening in openclaw. The install tests were failing exclusively on Windows machines. I restructured the symlink tests to respect Windows environment paths.

test: make install-safe-path symlink tests compatible with Windows #90275
aniruddhaadak80 posted on Jun 04, 2026

Summary: Run the existing install-path symlink boundary tests on Windows when directory junctions are supported. Use Windows junctions for directory links while preserving dir symlinks elsewhere. Keep production install-path behavior unchanged. Treat temporary-directory or cleanup failures in the capability probe as unsupported test environments instead of failing module import.

Real behavior proof:
- Three install-safe-path symlink boundary tests were unconditionally skipped on Windows.
- Native Windows Azure VM (Standard_D4ads_v6) through Crabbox.
- After patch: `node scripts/run-vitest.mjs src/infra/install-safe-path.test.ts`
- Evidence: 24/24 tests passed on native Windows.

The Silent AI Crashes

AI agents are powerful. But they are incredibly fragile when they receive unexpected data. In the hermes-agent repository, I found a bug where the system would panic if an API returned an empty response. I implemented a fix to handle None responses gracefully from the ACP permission requests.

fix(permissions): handle None response from ACP request_permission #13457
aniruddhaadak80 posted on Apr 21, 2026

This PR hardens the ACP Hermes permission-approval bridge by safely handling an unexpected None result from request_permission, preventing attribute errors and defaulting to a safe deny.

Changes Made:
- Return "deny" when request_permission resolves to None in the approval callback.
- Add a unit test covering the None response case to ensure the callback denies safely.

Back in cognee, I tackled two more critical architecture flaws. First, the graph engine was initializing before the dataset context was actually ready. This order dependency bug caused random failures. I rewired the visualization logic to wait for resolution.

fix(visualize): resolve dataset context before initializing graph engine #3114
aniruddhaadak80 posted on Jun 20, 2026
Closes #3007

Currently, visualize_graph() initializes the graph engine without any dataset context, falling back to the default empty graph database instead of the actual per-dataset database where cognify writes. This fix matches the dataset resolution logic in search() by resolving datasets via get_authorized_existing_datasets and providing the dataset UUID to get_unified_engine().

Second, I found a vulnerability where global settings were exposed and public registration was left wide open. I locked it down.

fix(security): restrict global settings and disable public registration #3115
aniruddhaadak80 posted on Jun 20, 2026
Closes #3084

This PR addresses the security vulnerabilities reported in #3084:
- Requires superuser privileges for POST /api/v1/settings to prevent global configuration takeover.
- Fully masks LLM and VectorDB API keys in GET /api/v1/settings to prevent leaking key prefixes.
- Adds a COGNEE_PUBLIC_REGISTRATION_ENABLED environment variable to allow administrators to disable public self-registration.

The Database Labyrinth

The most intense debugging sessions happened inside Tracer-Cloud/opensre. I spent weeks clearing out a lineup of database logic errors and QA edge cases. These were the kinds of bugs that only show up under heavy load or specific cloud configurations. I shipped five separate pull requests to stabilize their systems.

Batch 2 Edge Cases

I expanded the database logic to catch unhandled state changes.

fix: Database logic expansion for QA Edge Cases (Batch 2) #626
aniruddhaadak80 posted on Apr 17, 2026

_build_database_directive() has been expanded exponentially to train the AI to:
- Parse red herrings
- Distinguish between dual fault symptoms versus single root causes
- Infer missing Storage metrics organically
- Ignore healthy oscillating traffic metrics
- Trace WAL replication lags adequately

Batch 3 Edge Cases

I patched another layer of database failures.

fix: Database logic expansion for QA Edge Cases (Batch 3) #627
aniruddhaadak80 posted on Apr 17, 2026
Resolves #606, #607, #608, #609, #610

Expands the _build_database_directive() function to correctly train the LLM to:
- Identify Compositional Faults (treating simultaneous CPU and Storage constraints as independent sources while filtering out connection bounds)
- Infer replication lag from bare WAL metrics despite missing Replica metrics
- Accurately ignore historical maintenance distractions via timestamps
- Identify stale autoscaling recovery
- Distinguish VACUUM-driven Checkpoint Storms

RDS Testing

I corrected broken testing environment directives for their relational databases.

fix: Database directives for RDS QA testing #625
aniruddhaadak80 posted on Apr 17, 2026
Resolves #598 and #599

Supplies the agent with specific database directives that inform the RCA logic of standard scenarios like Connection Exhaustion and Free Storage exhaustion.

Validation Status

I fixed a critical bug by including eks_* keys so the system could correctly identify a healthy state.

Fix: Include eks_* keys in _INVESTIGATED_EVIDENCE_KEYS for is_clearly_healthy (Fixes #582) #617
aniruddhaadak80 posted on Apr 16, 2026
Fixes #582

The is_clearly_healthy() short-circuit relies on the presence of keys in _INVESTIGATED_EVIDENCE_KEYS to verify that an investigation collected evidence. This set was missing all Kubernetes / EKS keys. Because of this gap, investigations finding pure-Kubernetes workloads in a healthy state missed the short-circuit and incorrectly ran the root cause LLM.

This PR adds the missing EKS investigation keys:
- eks_pods
- eks_events
- eks_deployments
- eks_node_health
- eks_pod_logs

Synthetic QA

I resolved an alerting classification bug so healthy alerts were no longer flagged as broken.

fix(synthetic-qa): Identify healthy alerts correctly (#596) #618
aniruddhaadak80 posted on Apr 16, 2026
Fixes: #596

Cause: The LLM extraction step was classifying 'healthy' and scheduled checks (which have severity 'info' and state 'normal') as is_noise=True. Even if it bypassed noise extraction, the LLM was assuming it didn't need to gather investigation metrics because the alert explicitly said the database was normal, leading to an empty sequence of actions. This empty sequence caused the is_clearly_healthy function to loop infinitely because condition 4 requires at least one investigative operation.

Fix:
- Noise Extraction: Updated app/nodes/extract_alert/extract.py prompt to explicitly state that informational states and health checks are NOT noise.
- Planner Prompt Guidance: Updated to handle healthy states correctly.