__pycache__/
*.pyc
.venv/
.env
state.db
traces/
*.ics
.DS_Store
dist/
.pytest_cache/
.ruff_cache/
.waku/
.waku.bak-*/
.waku.prerename-bak/
# Any ALTERNATE agent home, not just the default one. DISCORD_HOME gives the
# bot its own memory (see waku/gateway/discord.py); WAKU_HOME can point anywhere.
# Without this glob only `.waku/` was covered, so a second home's SOUL.md,
# usage.jsonl and outbox/ were tracked — the exact files you least want pushed.
.waku-*/
.env.prerename-bak

# Delegated coding deliverables (dated run folders + auto-run logs)
waku_workspace/

# Google OAuth: the client file you download from Cloud Console, and any token
# it produces. Nothing here should ever be committed — belt and braces, because
# the docs used to tell people to drop credentials.json in the repo root.
credentials.json
client_secret*.json
*token*.json
.gcp/

# Disposable design mockups: propose, decide, implement, delete.
docs/proposals/*.html

# DeepEval writes a telemetry file here on every run
.deepeval/

# built by lab/one-memory-every-agent/build_grok_plugin.py
lab/one-memory-every-agent/grok-plugin/

# board sources for videos stay private (conventions §6); commit PNG screenshots
lab/**/*.excalidraw
!lab/kimi-k3/**/*.excalidraw
!lab/pi-agent/**/*.excalidraw

# evals/hosted_docker/test_image.py plants waku/_c1_context_probe/ inside an
# admitted build-context tree to prove the ignore files keep secrets out of the
# image. Its files are NAMED like real secrets -- deploy.pem, deploy.key,
# id_rsa, .aws/credentials -- and the fixture deletes them in a finally. This
# line covers the run that is killed before the finally: without it, the next
# `git add -A` stages two files called deploy.pem and deploy.key into a public
# repository, and nobody reads that diff twice.
waku/_c1_context_probe/
