hermes-config/skills/devops/hermes-config-management/templates/dot-gitignore.md

Canonical .gitignore for ~/.hermes/

Place this at ~/.hermes/.gitignore to safely version-control your Hermes config without committing secrets or ephemeral data.

# Secrets — never commit these
.env
auth.json
honcho.json

# Ephemeral runtime data
logs/
cache/
sessions/
state-snapshots/
checkpoints/
spawn-trees/
sandboxes/
whatsapp/
pairing/
notes/
plugins/
cron/output/
backups/

# Downloaded binaries
node/
bin/
lsp/
hermes-agent/
platforms/

# SQLite databases (handled by daily snapshot cron)
memory_store.db
state.db
state.db-shm
state.db-wal

# Lock files
*.lock
gateway.pid
gateway_state.json
processes.json

# Shell history
.hermes_history

# OS files
.DS_Store
Thumbs.db

# Generated metadata
.install_method
.skills_prompt_snapshot.json
.update_check
interrupt_debug.log
models_dev_cache.json

# Backup files
*.bak.*

# Git credentials
.git-credentials

Explanation of Key Exclusions

Secrets: .env contains API keys (OpenRouter, Matrix, etc.). auth.json contains OAuth tokens for Spotify, GitHub Copilot, etc. Both are plaintext.

SQLite DBs: memory_store.db (holographic memory) and state.db (session store) change on every session. Git handles binary diffs poorly — daily snapshot cron is better.

Binaries: node/, bin/, lsp/, hermes-agent/, platforms/ are all downloaded by the Hermes installer and can be recreated by reinstalling.

Plugins: plugins/ contains bundled plugins that are reinstalled via hermes plugins enable — no need to version-control.

Files to Track

git add .gitignore README.md config.yaml SOUL.md memories/ skills/ scripts/ cron/ \
        kanban.db reading_*.json channel_directory.json