# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
env/
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
# Anchored to the repository root. These are setuptools build artifacts from the standard
# Python template, and unanchored they match a directory named `lib` at ANY depth — which
# silently swallowed `frontend/src/lib/`, a source directory. A source file that git
# ignores is worse than a missing one: it builds locally and breaks for everyone else.
# The neighbouring `build/`, `dist/` and friends have the same shape; they are left alone
# because nothing currently collides with them, and widening this edit would be a change
# nobody has a failing case for.
/lib/
/lib64/
parts/
sdist/
var/
wheels/
*.egg-info/
.installed.cfg
*.egg

# Virtual Environment
.venv
venv/
ENV/

# IDE
.idea/
.vscode/
*.swp
*.swo
.DS_Store

# Testing & Coverage
.coverage
.coverage.*
.pytest_cache/
htmlcov/
.ruff_cache/
.mypy_cache/
.pyright/

# Node / UI
node_modules/
dist/
ui/dist/
ui/node_modules/
frontend/node_modules
frontend/node_modules/
.vite/

# Secrets & Environment
.env
.env.*
!.env.example
credentials/

# GitHub App credentials.
# The App's private key downloads as a `.pem` straight into whatever directory
# the browser points at, and a repository root is a normal place for it to land.
# `*.key` covers the same key in the other extension people reach for; measured
# 2026-09-04, `git ls-files` matched zero paths under either, so nothing tracked
# is orphaned by these rules.
*.pem
*.key
# `.env.github_app` is already matched by the `.env.*` glob above, but only
# incidentally. A credential protected by accident is one edit to an unrelated
# glob away from not being protected at all, so it is named here on purpose.
.env.github_app

# Builder Worktrees & Swarm State
.worktrees/
.swarm/

# Evaluation Reports
evals/reports/*.json
!evals/reports/.gitkeep

