# Local planning artefacts: absolute paths and usernames from a dev machine.
# Tracked here, not in .git/info/exclude, so it survives a fresh clone.
.superpowers/

__pycache__/
*.pyc
.pytest_cache/
.venv/
venv/
dist/
build/
*.egg-info/

# Superpowers-created worktrees live here; they are checkouts, not content.
.worktrees/

# The OAuth client baked into release builds (decision D1). CI writes this
# file from repository secrets immediately before `python -m build`; it must
# never be committed, because a secret in git history is permanent even
# after deletion and that forecloses the cheap rotation an installed-app
# secret depends on. tool.hatch.build.targets.wheel.artifacts in
# pyproject.toml re-includes it for the wheel, since hatchling excludes
# VCS-ignored files by default. test_embedded_client.py asserts this line
# exists -- deleting it reddens the suite.
src/gsc_mcp/_embedded.py

# The same OAuth client in the form scripts/publish_client.py writes for
# upload to the `client` release tag, which is how a SOURCE checkout gets a
# client (release wheels use _embedded.py above). Never committed, for the
# same reason -- and specifically because GitHub's secret scanner reads
# repository content but not release assets, so committing this is the one
# move that could get the client revoked by Google.
/client.json

# Live smoke-run findings. These name real client properties and real URLs
# from the operator's own Search Console, which the public repo must never
# carry. Keep the notes locally; port only the scrubbed defect descriptions
# into docs/ or an issue.
/docs/findings-*.md

# Working notes name real client properties. They stay on the machine.
/tasks/
