fix(update): ignore flat-install runtime state by class, not by file name

The flat-install block listed state.db and kanban.db sidecars one by one,
so any other root-level SQLite store (response_store.db, a future ledger)
and its -wal/-shm/-journal sidecars would still be swept by the updater's
`git stash push --include-untracked` and unlinked under the running
gateway (#110648). Replace the per-file lines with root-anchored globs
(`/*.db`, `/*.db-wal`, ...). No tracked root-level *.db exists, and
`git ls-files -ci --exclude-standard` is unchanged before/after, so the
globs newly ignore nothing that is committed.

Also add the rest of the flat-install runtime roots the previous fold
missed: the credential siblings from
gateway/platforms/base.py::_ROOT_CREDENTIAL_PATHS (.anthropic_oauth.json,
google_token.json, google_oauth_pending.json, auth/,
webhook_subscriptions.json), the active pairing location platforms/
(gateway/pairing.py), kanban/, gateway_state.json, processes.json,
cron.pid, the channel directory/alias and feishu pairing stores,
pending_messages/, checkpoints/, plugin-data/, hooks/, and the Discord
message-recovery db under gateway/ (gateway/ itself is tracked, so only
that file pattern is ignored). `/.credentials/` had no producer -- the
real dir is `credentials/` (web_routers/files.py, _ROOT_CREDENTIAL_PATHS)
-- so it is replaced. `/state-snapshots/` is dropped: the existing
unanchored `*-snapshots/` rule already matches it.

The test tuple now carries one representative per ignored class and its
comment no longer claims _ROOT_CREDENTIAL_PATHS enumerates the sidecar
set (that is `_sqlite_files`).

.gitignore

@@ -169,42 +169,56 @@ docs/superpowers/*
 .hermes-bootstrap-complete
 
 # Flat-install runtime state (checkout root == $HERMES_HOME, e.g. installs made
-# with HERMES_INSTALL_DIR=$HERMES_HOME or by older installers): the live session
-# store, its SQLite sidecars and retired-WAL capture dirs, quick snapshots, the
-# legacy transcripts, the cron job store (jobs.json) and executions ledger,
-# gateway lock/pid files, cache/spill directories, and the profile's own
-# config/credential/memory/profile roots are Hermes-managed runtime state,
-# never code changes.
+# with HERMES_INSTALL_DIR=$HERMES_HOME or by older installers): every root-level
+# SQLite store (state.db, kanban.db, response_store.db, ...) with its
+# WAL/SHM/journal sidecars and retired-WAL capture dirs, the legacy transcripts,
+# the cron job store (jobs.json) and executions ledger, gateway lock/pid/state
+# files, cache/spill directories, and the profile's own config/credential/
+# memory/profile/pairing roots are Hermes-managed runtime state, never code
+# changes. (`*-snapshots/` above already covers state-snapshots/.)
 # Ignore them so `hermes update`'s `git stash push --include-untracked` cannot
 # sweep the live state.db/-wal into the stash and unlink it under the running
 # gateway (#110648). Nested installs keep all of this under $HERMES_HOME outside
 # the checkout, where the `.hermes/` rule above already applies.
-/state.db
-/state.db-wal
-/state.db-shm
-/state.db-journal
-/state.db.retired-wal-*/
-/kanban.db
-/kanban.db-wal
-/kanban.db-shm
-/kanban.db-journal
-/state-snapshots/
+/*.db
+/*.db-wal
+/*.db-shm
+/*.db-journal
+/*.db.retired-wal-*/
+/gateway/discord_message_recovery.db*
 /sessions/
 /browser-profile/
 /cron/executions.db
 /cron/jobs.json
+/cron.pid
 /gateway.lock
 /gateway.pid
+/gateway_state.json
+/processes.json
 /hook_outputs/
+/hooks/
 /cache/
+/checkpoints/
+/pending_messages/
+/plugin-data/
+/kanban/
 /config.yaml
 /auth.json
 /auth.lock
+/auth/
+/.anthropic_oauth.json
+/google_token.json
+/google_oauth_pending.json
+/webhook_subscriptions.json
+/channel_directory.json
+/channel_aliases.json
+/feishu_comment_pairing.json
 /memories/
 /profiles/
-/.credentials/
+/credentials/
 /mcp-tokens/
 /pairing/
+/platforms/
 
 # Persistent dev sandbox dir (scripts/dev-sandbox.sh --persistent)
 .hermes-sandbox/

tests/hermes_cli/test_update_flat_install_state_gitignore.py

@@ -18,12 +18,9 @@ import pytest
 REPO_ROOT = Path(__file__).resolve().parents[2]
 
 # Runtime state that lives at $HERMES_HOME's root on a flat install, exactly as
-# ``hermes update`` would sweep it: the session store plus its SQLite sidecars
-# (gateway/platforms/base.py _ROOT_CREDENTIAL_PATHS enumerates the same set) and
-# retired-WAL capture dirs, quick snapshots, the legacy transcript dir, the
-# default kanban board, the cron job store (cron/jobs.py JOBS_FILE) and
-# executions ledger, gateway lock/pid files, the cache/spill directories and the
-# config/auth/memory/profile/credential/pairing roots.
+# ``hermes update`` would sweep it: one representative per ignored class. The
+# sidecar names mirror ``_sqlite_files`` in gateway/platforms/base.py; the
+# credential entries mirror ``_ROOT_CREDENTIAL_PATHS`` there.
 FLAT_INSTALL_RUNTIME_STATE = (
     "state.db",
     "state.db-wal",
@@ -31,26 +28,43 @@ FLAT_INSTALL_RUNTIME_STATE = (
     "state.db-journal",
     "state.db.retired-wal-20260914T000000Z-1234/manifest.json",
     "kanban.db",
-    "kanban.db-wal",
-    "kanban.db-shm",
-    "kanban.db-journal",
+    "response_store.db",
+    "response_store.db-wal",
+    "gateway/discord_message_recovery.db",
     "state-snapshots/2026-09-14T06-00-00-pre-update/state.db",
     "sessions/2026-09-14_06-00-00_abcd123d.jsonl",
     "browser-profile/Cookies",
     "cron/executions.db",
     "cron/jobs.json",
+    "cron.pid",
     "gateway.lock",
     "gateway.pid",
+    "gateway_state.json",
+    "processes.json",
     "hook_outputs/2026-09-14_06-00-00/tool.json",
+    "hooks/on_session_end.sh",
     "cache/banner_snapshot.json",
+    "checkpoints/abcd123d/0001.json",
+    "pending_messages/telegram.json",
+    "plugin-data/example/state.json",
+    "kanban/boards/x",
     "config.yaml",
     "auth.json",
     "auth.lock",
+    "auth/google_oauth.json",
+    ".anthropic_oauth.json",
+    "google_token.json",
+    "google_oauth_pending.json",
+    "webhook_subscriptions.json",
+    "channel_directory.json",
+    "channel_aliases.json",
+    "feishu_comment_pairing.json",
     "memories/MEMORY.md",
     "profiles/work/config.yaml",
-    ".credentials/github_token",
+    "credentials/github_token",
     "mcp-tokens/server.json",
     "pairing/telegram.json",
+    "platforms/pairing/x.json",
 )