.gitignore

node_modules/
dist/
.env
*.log
.DS_Store

# Generated CL compatibility identity embedded by prepare:package. It must stay
# untracked so the manifest cannot hash itself.
src/generated/compatibility-version.json

# Maintainer planning notes are TRACKED in this repository (`devlog/`). Security
# material is not: see the "Security working notes" section of AGENTS.md.
#
# These exclusions were previously enforced by devlog's own .gitignore, which stops
# applying now that devlog is not a separate repository. Reference clones are
# third-party source with their own licenses and must never enter this history.
devlog/_chase/_cca/
devlog/_chase/_litellm/
devlog/_chase/DSCodex/
devlog/_fin/opencode-cursor/
devlog/_plan/*/_ref_*/
devlog/**/*-security-redaction/
devlog/**/*_security_findings/
devlog/**/security-advisory-draft*

# Scratch space. Security working notes — unreleased findings, draft advisories,
# exploit reasoning, pre-disclosure patch plans — belong here or in a
# `mktemp -d` path, and nowhere else. Not devlog/, not a private repo. See the
# "Security working notes" section of AGENTS.md.
.tmp/
.opencode/

# Capability probes from the trusted-artifact directory check
# (src/lab/artifacts/secure-fs.ts detectArtifactIoMode). The probe is normally
# unlinked immediately, but a process that dies between rename and unlink leaves
# an empty file behind, and they accumulate in whatever directory the check ran
# from. They are machine-local scratch and must never be committed.
.dirfd-probe-*

# Local agent/session artifacts
# These are per-machine agent state (goalplans, ledgers, evidence scratch).
# They are never part of the product and must not be committed, not even with
# `git add -f` — see tests/repo-hygiene.test.ts, which fails if any path here
# becomes tracked again.
.codexclaw/
**/.codexclaw/
.omo/
**/.omo/

# Local development worktrees
.worktrees/

# Test-generated artifacts
# Trailing slash matched directories only, but the same tests also leave plain
# files behind when a run dies mid-write -- and on Windows those can stay locked
# by an exiting child, so they cannot simply be deleted. An unignorable leftover
# blocks the release preflight's clean-tree check for work that has nothing to do
# with it, so ignore both shapes.
tests/.tmp-*
.claude/

# Retired Go native-runtime experiment. `go/` is not part of the build, the
# typecheck, or the test path, and nothing in `src/` imports it. A single file
# from it (go/internal/cli/config_parity.go) has now been committed by a broad
# `git add` three separate times and reached `dev` once — see
# tests/repo-hygiene.test.ts, which fails if any path here becomes tracked again.
go/