mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-11-06 05:17:15 +00:00
Maciej Lisiewski
7062229090
pnpm 12.15.0 (native executable) installs every JS workspace from one pnpm-lock.yaml, imported from package-lock.json with the same resolved versions. website/, the WhatsApp bridge and the photon sidecar stay separate npm projects. Configuration moves from .npmrc and the root manifest into pnpm-workspace.yaml: the 14-day minimumReleaseAge and its excludes, overrides, allowBuilds (the old allowScripts set, with strictDepBuilds failing any unlisted build script), engineStrict, sideEffectsCache: false (in-place rebuilds must not write into the store) and verifyDepsBeforeRun: false (a `pnpm run` never installs). The pnpm version is pinned in pm/lock.json and in root devEngines. pmOnFail: ignore keeps that pin out of pnpm-lock.yaml: a leading pin document makes osv-scanner read zero packages. scripts/build/node-deps.mjs enforces the exact version instead, and every lock reader refuses a multi-document lock. A root preinstall refuses `npm install`; devEngines onFail is warn so npx (MCP servers, the tsc linter) keeps working inside the checkout. User-machine installs run --frozen-lockfile --trust-lockfile (release age is checked when locking, in CI, not per user). node-deps removes npm-era node_modules trees before the first pnpm install. Nix builds the store with fetchPnpmDeps and a hash file that CI checks.
150 lines
3.0 KiB
Plaintext
150 lines
3.0 KiB
Plaintext
# Git
|
|
.git
|
|
.gitignore
|
|
.gitmodules
|
|
|
|
# Python
|
|
__pycache__
|
|
*.py[cod]
|
|
*$py.class
|
|
*.so
|
|
.Python
|
|
*.egg-info/
|
|
dist/
|
|
build/
|
|
!scripts/build/
|
|
!scripts/build/**
|
|
|
|
# Virtual environments
|
|
venv/
|
|
env/
|
|
ENV/
|
|
|
|
# Dependencies
|
|
node_modules
|
|
**/node_modules
|
|
.venv
|
|
**/.venv
|
|
.notebooklm-cli-venv/
|
|
.notebooklm-playwright/
|
|
.pip-cache/
|
|
.uv-cache/
|
|
.cache/
|
|
.build/
|
|
|
|
# Built artifacts that are regenerated inside the image. Excluded so local
|
|
# rebuilds on the developer's machine don't invalidate the dependency-install layer
|
|
# that now depends on the full ui-tui/packages/hermes-ink/ tree being present.
|
|
ui-tui/dist/
|
|
ui-tui/packages/hermes-ink/dist/
|
|
|
|
# CI/CD
|
|
.github
|
|
|
|
# Environment files
|
|
.env
|
|
.env.*
|
|
# ...but keep the template: docker/stage2-hook.sh seeds $HERMES_HOME/.env from
|
|
# /opt/hermes/.env.example on first boot (OOF-285 — excluding it silently broke
|
|
# first-boot .env seeding and the API_SERVER_KEY generation that depends on it).
|
|
!.env.example
|
|
|
|
# IDE
|
|
.vscode/
|
|
.idea/
|
|
*.swp
|
|
*.swo
|
|
|
|
# Testing
|
|
.pytest_cache/
|
|
.coverage
|
|
htmlcov/
|
|
|
|
# Documentation
|
|
*.md
|
|
!skills/**/*.md
|
|
!optional-skills/**/*.md
|
|
|
|
# Runtime data (bind-mounted at /opt/data; must not leak into build context)
|
|
data/
|
|
.hermes-docker/
|
|
.notebooklm-home/
|
|
|
|
# Compose/profile runtime state (bind-mounted; avoid ownership/secret issues)
|
|
hermes-config/
|
|
runtime/
|
|
|
|
# ---------- Not needed inside the Docker image ----------
|
|
|
|
# Desktop app source (Tauri/Electron); the app is never installed in the container.
|
|
# apps/shared is the dashboard↔desktop websocket helper and is linked from
|
|
# web/package.json as a workspace:* dep — keep it in the build context.
|
|
# apps/desktop is the Webapp renderer's build input (webapp_build stage); its
|
|
# local build outputs stay out.
|
|
apps/
|
|
!apps/shared/
|
|
!apps/shared/**
|
|
!apps/desktop/
|
|
!apps/desktop/**
|
|
apps/desktop/dist/
|
|
apps/desktop/dist-webapp/
|
|
apps/desktop/build/
|
|
apps/desktop/release/
|
|
# The negations above override the global dependency and secret rules.
|
|
apps/**/node_modules
|
|
apps/desktop/**/.env
|
|
apps/desktop/**/.env.*
|
|
apps/desktop/**/.vite
|
|
apps/desktop/**/.cache
|
|
apps/desktop/**/coverage
|
|
apps/desktop/**/playwright-report
|
|
apps/desktop/**/test-results
|
|
apps/desktop/**/*.p12
|
|
apps/desktop/**/*.pfx
|
|
apps/desktop/**/*.pem
|
|
apps/desktop/**/*.key
|
|
|
|
# Test suite — not shipped in production images
|
|
tests/
|
|
|
|
# Documentation site (Docusaurus)
|
|
website/
|
|
|
|
# Keep the source artwork needed by web's icon-generation prebuild.
|
|
assets/
|
|
!assets/
|
|
assets/*
|
|
!assets/nous-girl-black.svg
|
|
!assets/nous-girl-white.svg
|
|
!assets/dmg-volume.png
|
|
!assets/backgrounds/
|
|
!assets/backgrounds/**
|
|
infographic/
|
|
|
|
# Plugin-level docs (hermes-achievements ships docs/ but the runtime doesn't read them)
|
|
plugins/hermes-achievements/docs/
|
|
|
|
# Nix / Homebrew / AUR packaging metadata — irrelevant to Docker
|
|
nix/
|
|
flake.nix
|
|
flake.lock
|
|
packaging/
|
|
|
|
# Design and planning documents
|
|
plans/
|
|
.plans/
|
|
.hermes/
|
|
|
|
# Repo-level dotfiles that are git-only or dev-tooling config
|
|
.envrc
|
|
.gitattributes
|
|
.hadolint.yaml
|
|
.mailmap
|
|
|
|
# Debug/export artifacts — must never reach image layers (COPY . .)
|
|
/log.txt
|
|
/sqlite_leak_fix.png
|
|
/*.png.bak
|
|
*.tar.gz
|
|
*.tgz
|