# Dependencies — never commit installed packages; lockfiles are the source
# of truth and CI runs npm ci everywhere.
node_modules/

# OS noise
.DS_Store

# Personal session notes (kept locally, never tracked)
GEMMA4_EVAL_SESSION_NOTES.md
last_5_days.md

# Stale scaffolding must not return
desktop-guard/windows/src/_tmp/

# Defender hook config is written on the endpoint at runtime by Desktop Guard
# (refreshConfig / RefreshConfig) and can carry a backend token. Never commit
# it, least of all into a DG hooks-source bundle: electron-builder ships that
# folder's whole contents in every macOS build. scripts/build-hooks.sh --check
# fails on any tracked defender-config.* file.
desktop-guard/macos/resources/hooks-source/defender-config.*
desktop-guard/windows/resources/hooks-source/defender-config.*

# Python bytecode cache (created when defender hook scripts are imported during dev/test)
__pycache__/
*.pyc

# Embeddable Python fetched by the release workflow (SHA-pinned, embedded into the exe)
desktop-guard/windows/python-embed.zip
# Staged by release-desktop-guard.yml from desktop-guard/ui/sibling-extensions/ and
# embedded in the Windows DG exe — never commit.
desktop-guard/windows/sibling-extensions/

# Selector-health probe run artifacts (harness: .claude/commands/selector-health.md)
browser-extension/test/selector-health-reports/

# Claude Code local worktrees (session-local checkouts, meaningless to other clones)
.claude/worktrees/

# Graphify: graph.json + manifest are tracked for team sharing; the AST cache
# is a per-machine build artifact and rebuilds locally, and .graphify_root is
# an absolute path to the local checkout.
graphify-out/cache/
graphify-out/.graphify_root
# Dated rebuild snapshots duplicate the canonical graph (~32 MB each) — local only.
graphify-out/20*/
