pack export [--enabled-only] [--name NAME]
Emit a pack YAML on stdout from the current install: repo + exact SHA of each git-installed plugin plus sanitized non-secret plugins.entries config. Local-only plugins (no git provenance) are listed as warning comments, never as installable entries. Secrets, capability grants, and allow_* gates are always stripped.
From the official Hermes Agent CLI reference.