# Credentials and secrets
credentials/*
!credentials/.gitkeep
org/*
.env
*.pem
*.key
*.p12
src/privacyfence/_telegram_credentials.py
scripts/dev_env.sh
# scripts/sync_room_directory.py's OAuth token for the admin-scoped Google
# Cloud project it syncs the room directory from -- dev-mode data_dir() is
# the repo root, same as the other credential paths above.
.room_sync_token.json

# User configuration (keep only the .example)
config/settings.yaml
config/settings.local.yaml

# Local runtime caches (dev-mode data_dir() is the repo root -- see paths.py)
resource_name_cache.json
update_check_cache.json
# SEC-23: this install's own random id (daemon_main.get_or_create_deployment_id) --
# dev-mode data_dir() is the repo root, same as the caches above.
deployment_id
# SEC-06 bootstrap-link discovery files (web/server.py's mint_bootstrap_url) --
# same dev-mode-data_dir()-is-the-repo-root reasoning as deployment_id above.
approvals_url
settings_url

# QA fixture manifest (keep only the .example) -- reveals which real
# project/space/folder/calendar/list/channel/chat a QA environment uses,
# on which real accounts. See tests/fixtures/qa_environment.yaml.example.
tests/fixtures/qa_environment.yaml

# Claude Code
.claude/*
# ...except the shared project settings (hooks, permissions) checked in for the whole team.
!.claude/settings.json

# Lock files
*.lock

# Python
*.pyc
__pycache__/
*.py[cod]
*.egg-info/
.eggs/
build/
dist/
.venv/
venv/

# Node (mcpb/shim/, cloudflare/downloads/)
node_modules/
*.tsbuildinfo
env/
.wrangler/

# Test / coverage artifacts
.coverage
.coverage.*
htmlcov/
coverage.xml
coverage.json
.pytest_cache/
.mypy_cache/
.ruff_cache/
# tests/integration/test_browser_smoke.py's own failure-artifact capture
# (screenshot/DOM/console/daemon log) -- written lazily, only on a failing
# run, never something to commit.
test-results/

# Logs
*.log
logs/

# macOS
.DS_Store
*.dmg
*.mcpb

# IDE
.idea/
.vscode/
