!apps/desktop/src/global.d.ts
!apps/desktop/src/plugins/*/plugin.js
!apps/desktop/src/vite-env.d.ts
!hermes_cli/data/
# — ignore so `git status` stays clean and update's autostash skips them.
# (launch-time stale-bytecode sweep). Runtime state, never a code change.
# `data/` pattern above would otherwise swallow it.
# `npm run sync-assets` (see web/package.json).
# also created in-repo when an agent operates in this checkout). Plans, audit
# and `hermes update`'s untracked autostash does not treat it as a local edit (#66189 / #54855).
# automation-blueprints-index.json is a build artifact emitted by
# bootstrap installer. It is Hermes-managed runtime state, never a code change —
# Bundled community plugin index seed (shipped as package data) — the bare
# by `hermes update` / launch-time self-heal. Runtime state, never a code change
# by accident via 3a69e34702, removed in the #72002 salvage).
# Checkout fingerprint the __pycache__ tree was last validated against
# CLI config (may contain sensitive SSH paths)
# committed to the repo root. See the hermes-release skill.
# Cross-process web UI build lock (flock target, always empty)
# cut (passed to `gh release create --notes-file`); the GitHub Release itself
# Desktop demo-run scratch output (hermes writes demo/*.txt during recorded
# Desktop/bootstrap install marker written into the managed checkout root by the
# e.g. hermes-bots): plugin.js IS the source, not tsc output. No .tsx
# every build).
# EXCEPT bundled plain-ESM plugin entries (adopted SDK-consumer plugins,
# git for the same reason as skills-index.json (large, generated, change
# ignore it so `hermes update`'s `git stash push --include-untracked` does not
# image-provider (fal.media) URL — they are NEVER committed to the repo. The
# infographic-check CI job is what actually enforces this.
# Installer-written method stamp in the managed checkout root (scripts/install.sh).
# interrupted; consumed by launch-time recovery. Never commit it (was tracked
# Interrupted-update breadcrumb + recovery lock written next to the shared venv
# Local editor / agent tooling (machine-specific; keep in global config, not the repo)
# logs, and per-session caches are never artifacts of the codebase.
# Nix
# No trailing slash: also matches node_modules SYMLINKS (worktrees often
# Per-release changelog drafts. These exist only transiently during a release
# Persistent dev sandbox dir (scripts/dev-sandbox.sh --persistent)
# Playwright visual regression baselines — cached from main in CI, not committed
# PR body is the archive. See the hermes-agent-dev skill's
# PR infographics are rendered locally and embedded in PR descriptions via the
# pr-infographic-workflow reference (storage rule + lapse #8 / #COMMIT-1).
# Private keys
# regenerated by scripts/tool_search_livetest.py. Never an artifact of the repo.
# Release script temp files
# Repo-root build/debug artifacts that must never be committed
# resolves the stale .js OVER the .tsx — never track these)
# Runtime marker written by hermes update when a lazy dependency refresh is
# Runtime metadata only — never a code change. Ignore so `git status` stays clean
# Sandbox dirs used by the install/update E2E (tests/install/). The suffix is
# sibling exists, so the stale-shadow hazard above cannot apply.
# sidestepped by an `infograficos/` directory (#70552). .gitignore is only
# Skills Hub state (lives in ~/.hermes/skills/.hub/ at runtime, but just in case)
# skills.json + skills-meta.json are build artifacts emitted by
# slip into a commit and break `npm ci` on CI with ENOTDIR).
# Spelling variants are listed because a single `infographic/` pattern was
# stores the published notes. They are not a build artifact and must never be
# symlink node_modules to the main checkout; the dir-only pattern let one
# the first line of defence and cannot stop `git add -f` at all — the
# the route name, so each route gets its own tree and two can run at once.
# Tool Search live-test harness output — non-deterministic model transcripts,
# treat it as a local edit and autostash it on every run (#38529).
# tsc-emitted artifacts (a stray `tsc -b` compiles into src/, and vite then
# walkthroughs). Throwaway artifacts, never part of the app.
# Web UI assets — synced from @nous-research/ui at build time via
# Web UI build output
# website/scripts/extract-automation-blueprints.py during prebuild.
# website/scripts/extract-skills.py during prebuild — keep them out of
# Working directory for the Hermes Agent's session state (~/.hermes/ at runtime;
#
%SystemDrive%/
*.pem
*.ppk
*.pyc*
*.tsbuildinfo
*-snapshots/
.act-sandbox-agent.*
.build/
.bytecode-fingerprint
.bytecode-fingerprint.tmp
.codex/
.cursor/
.direnv/
.DS_Store
.env
.env.development
.env.development.local
.env.local
.env.production.local
.env.test
.env.test.local
.gemini/
.hermes/
.hermes-bootstrap-complete
.hermes-docker/
.hermes-sandbox/
.hermes-sandbox-e2e*/
.lazy-refresh-incomplete
.mcp.json
.nix-stamps/
.notebooklm-cli-venv/
.notebooklm-home/
.notebooklm-playwright/
.op.env
.pip-cache/
.pytest_cache/
.pytest-cache/
.release_notes.md
.skills_prompt_snapshot.json
.update-incomplete
.update-incomplete.lock
.uv-cache/
.venv
.venv/
.vscode/
.web_ui_build.lock
.worktrees/
.zed/
/*.png.bak
/.hermes-runtime/
/.install_method
/_pycache/
/bin/
/pm/.lock.json.lock
/default.tar.gz
/log.txt
/sqlite_leak_fix.png
/venv.old/
/venv.stale.runtime-*/
/venv/
__pycache__/
__pycache__/model_tools.cpython-310.pyc
__pycache__/web_tools.cpython-310.pyc
act/
agent-browser/
apps/desktop/build/
apps/desktop/demo/
apps/desktop/dist/
apps/desktop/release/
apps/desktop/src/**/*.d.ts
apps/desktop/src/**/*.js
apps/desktop/src/**/*.js.map
apps/shared/src/**/*.d.ts
apps/shared/src/**/*.js
apps/shared/src/**/*.js.map
browser-use/
cli-config.yaml
compose.hermes.local.yml
config/mcporter.json
data/
data/*
docs/superpowers/*
environments/benchmarks/evals/
examples/
export*
hermes-*/*
hermes_agent.egg-info/
hermes_cli/scripts/
hermes_cli/tui_dist/*
hermes_cli/web_dist/
ignored/
images/
infografico/
infograficos/
infographic/
infographics/
logs/
mini-swe-agent/
models-dev-upstream/
native/fts5_cjk/*.so
node_modules
opencode.json
playwright-report/
privvy*
RELEASE_v*.md
result
run_datagen_kimik2-thinking.sh
run_datagen_megascience_glm4-6.sh
run_datagen_sonnet.sh
source-data/*
run_datagen_megascience_glm4-6.sh
data/*
MagicMock/
# No trailing slash: also matches node_modules SYMLINKS (worktrees often
# symlink node_modules to the main checkout; the dir-only pattern let one
# slip into a commit and break `npm ci` on CI with ENOTDIR).
node_modules
browser-use/
agent-browser/
# Private keys
*.ppk
*.pem
privvy*
images/
__pycache__/
hermes_agent.egg-info/
wandb/
testlogs
playwright-report/
test-results/
# Playwright visual regression baselines — cached from main in CI, not committed
*-snapshots/

# CLI config (may contain sensitive SSH paths)
cli-config.yaml

# Skills Hub state (lives in ~/.hermes/skills/.hub/ at runtime, but just in case)
skills/.hub/
ignored/
.worktrees/
environments/benchmarks/evals/

# Web UI build output
hermes_cli/web_dist/
# Cross-process web UI build lock (flock target, always empty)
.web_ui_build.lock
apps/desktop/build/
apps/desktop/dist/

# tsc-emitted artifacts (a stray `tsc -b` compiles into src/, and vite then
# resolves the stale .js OVER the .tsx — never track these)
apps/desktop/src/**/*.js
apps/desktop/src/**/*.js.map
apps/desktop/src/**/*.d.ts
# EXCEPT bundled plain-ESM plugin entries (adopted SDK-consumer plugins,
# e.g. hermes-bots): plugin.js IS the source, not tsc output. No .tsx
# sibling exists, so the stale-shadow hazard above cannot apply.
!apps/desktop/src/plugins/*/plugin.js
!apps/desktop/src/global.d.ts
!apps/desktop/src/vite-env.d.ts

# Build/debug artifacts that must never be committed
/log.txt
/sqlite_leak_fix.png
/*.png.bak
*.tar.gz
*.tgz
apps/shared/src/**/*.js
apps/shared/src/**/*.js.map
apps/shared/src/**/*.d.ts
apps/desktop/release/
# stage-and-swap Desktop rebuild output (#86443); removed after the swap, but
# a killed build must not leave the checkout dirty
apps/desktop/.staging-*/
*.tsbuildinfo

# Web UI assets — synced from @nous-research/ui at build time via
# `npm run sync-assets` (see web/package.json).
web/public/fonts/
web/public/ds-assets/

# Release script temp files
.release_notes.md
mini-swe-agent/

# Nix
.direnv/
.nix-stamps/
result
website/static/api/skills-index.json
# skills.json + skills-meta.json are build artifacts emitted by
# website/scripts/extract-skills.py during prebuild — keep them out of
# git for the same reason as skills-index.json (large, generated, change
# every build).
website/static/api/skills.json
website/static/api/skills-meta.json
# Plugin catalog JSON is generated from plugin-catalog/ during prebuild.
website/static/api/plugins.json
website/static/api/plugin-catalog.json
website/static/api/plugins-meta.json
# automation-blueprints-index.json is a build artifact emitted by
# website/scripts/extract-automation-blueprints.py during prebuild.
website/static/api/automation-blueprints-index.json
models-dev-upstream/

# Local editor / agent tooling (machine-specific; keep in global config, not the repo)
.codex/
.cursor/
.gemini/
.zed/
.mcp.json
opencode.json
config/mcporter.json

hermes_cli/tui_dist/*
hermes_cli/scripts/
docs/superpowers/*
# Working directory for the Hermes Agent's session state (~/.hermes/ at runtime;
# also created in-repo when an agent operates in this checkout). Plans, audit
# logs, and per-session caches are never artifacts of the codebase.
.hermes/

# Desktop/bootstrap install marker written into the managed checkout root by the
# bootstrap installer. It is Hermes-managed runtime state, never a code change —
# ignore it so `hermes update`'s `git stash push --include-untracked` does not
# treat it as a local edit and autostash it on every run (#38529).
.hermes-bootstrap-complete

# Persistent dev sandbox dir (scripts/dev-sandbox.sh --persistent)
.hermes-sandbox/
# Sandbox dirs used by the install/update E2E (tests/install/). The suffix is
# the route name, so each route gets its own tree and two can run at once.
.hermes-sandbox-e2e*/

# Interrupted-update breadcrumb + recovery lock written next to the shared venv
# by `hermes update` / launch-time self-heal. Runtime state, never a code change
# — ignore so `git status` stays clean and update's autostash skips them.
.update-incomplete
.update-incomplete.lock

# Checkout fingerprint the __pycache__ tree was last validated against
# (launch-time stale-bytecode sweep). Runtime state, never a code change.
.bytecode-fingerprint
.bytecode-fingerprint.tmp

# Installer-written method stamp in the managed checkout root (scripts/install.sh).
# Runtime metadata only — never a code change. Ignore so `git status` stays clean
# and `hermes update`'s untracked autostash does not treat it as a local edit (#66189 / #54855).
/.install_method
install-stamp.json

# Tool Search live-test harness output — non-deterministic model transcripts,
# regenerated by scripts/tool_search_livetest.py. Never an artifact of the repo.

scripts/out/

# Per-release changelog drafts. These exist only transiently during a release
# cut (passed to `gh release create --notes-file`); the GitHub Release itself
# stores the published notes. They are not a build artifact and must never be
# committed to the repo root. See the hermes-release skill.

# Desktop demo-run scratch output (hermes writes demo/*.txt during recorded
# walkthroughs). Throwaway artifacts, never part of the app.

# PR infographics are rendered locally and embedded in PR descriptions via the
# image-provider (fal.media) URL — they are NEVER committed to the repo. The
# PR body is the archive. See the hermes-agent-dev skill's
# pr-infographic-workflow reference (storage rule + lapse #8 / #COMMIT-1).
#
# Spelling variants are listed because a single `infographic/` pattern was
# sidestepped by an `infograficos/` directory (#70552). .gitignore is only
# the first line of defence and cannot stop `git add -f` at all — the
# infographic-check CI job is what actually enforces this.
# Runtime marker written by hermes update when a lazy dependency refresh is
# interrupted; consumed by launch-time recovery. Never commit it (was tracked
# by accident via 3a69e34702, removed in the #72002 salvage).

# Disposable profile created by scripts/probe_active_session_exclusivity.py
.probe-home/
skills/.hub/
source-data/*
temp_vision_images/
test_durations.json
testlogs
test-results/
tests/quick_test_dataset.jsonl
tests/sample_dataset.jsonl
tmp/
wandb/
web/public/ds-assets/
web/public/fonts/
website/static/api/automation-blueprints-index.json
website/static/api/skills.json
website/static/api/skills-index.json
website/static/api/skills-meta.json
# ── generated icon assets (see scripts/generate_icons.py) ──────────────────
# Regenerated on demand by every consuming pipeline (website/desktop/
# installer/web prebuild via scripts/generate-icons.mjs). Sources of truth:
# assets/nous-girl-*.svg + assets/backgrounds/.
assets/icon-master.svg
assets/icon-master-dark.svg
apps/desktop/assets/icon.png
apps/desktop/assets/icon.ico
apps/desktop/assets/icon.icns
apps/desktop/assets/icon-dark.png
apps/desktop/assets/icon-dark.ico
apps/desktop/assets/icon-dark.icns
apps/desktop/assets/appx/*.png
apps/desktop/public/apple-touch-icon.png
apps/desktop/public/nous-girl.png
apps/desktop/public/nous-girl-dark.png
apps/bootstrap-installer/src-tauri/icons/*.png
apps/bootstrap-installer/src-tauri/icons/icon.ico
apps/bootstrap-installer/src-tauri/icons/icon.icns
apps/bootstrap-installer/public/nous-girl.png
website/static/img/logo.png
website/static/img/logo-dark.png
website/static/img/nous-logo.png
website/static/img/nous-logo-dark.png
website/static/img/favicon-16x16.png
website/static/img/favicon-32x32.png
website/static/img/apple-touch-icon.png
website/static/img/favicon.ico
website/static/img/favicon.svg
web/public/favicon.ico