__pycache__/
*.py[cod]
*$py.class
*.egg-info/
dist/
build/
.env
.env.local
.env.*.local
.env.production
.env.keys
.venv/
*.db
*.sqlite3
.mypy_cache/
.ruff_cache/
.pytest_cache/
secrets/

# Session/token files — contain live credentials, never commit
tradovate_session.json
*.session.json
state/tradovate_token.json

# Runtime state — never commit (a committed guardrails_state.json with stale
# OPEN breakers + monotonic timestamps poisoned fresh checkouts; see 22.4.2)
state/guardrails_state.json
state/guardrails_state.json.bak*
state/onboarding_state.json
.env.bak*

# Node toolchain artifacts (CLI builds use bun; npm install is local-only)
node_modules/
src/cli/package-lock.json
state/guardrail_prefs.json
state/platform_session.json
