# Backups (local only - don't commit to repo)
backups/

# Session scratch (one-off dedup/EWS tooling — never commit)
.dup*
.find*
.ews_*.xml
.x.json

# Remediation-tool cache (live Graph API responses — may contain user data)
.cache-remediation/
tmp-remediation/

# Bitdefender skill cache (identity/structure only — no secrets/PII)
.claude/skills/bitdefender/.cache/

# B2 skill cache (holds the live B2 authorization token — a SECRET)
.claude/skills/b2/.cache/

# Local settings (machine-specific)
.claude/settings.local.json
.claude/identity.json
.claude/current-mode
.claude/coord-broadcasts-seen
.claude/scheduled_tasks.lock

# Session-recovery ledger (machine-local — transcripts are per-machine)
.claude/state/

# /autotask command — kept local/undistributed (Syncro is the default PSA; Autotask is opt-in).
# Remove this line to distribute /autotask to the fleet. See .claude/memory/feedback_psa_default_syncro.md
.claude/commands/autotask.md

# Temporary files
*.tmp
*.log
*.bak
.claude/tmp/
tmp/

# Live secrets / tokens — never commit
.token
.token_*
*.jwt
token.txt
.token.txt

# OS files
.DS_Store
Thumbs.db
desktop.ini

# IDE/Editor
.vscode/
.idea/
*.swp
*.swo
*~

# Python
__pycache__/
*.pyc
*.pyo
venv/
.env

# Node
node_modules/
.npm/

# Rust
target/
Cargo.lock

# Build outputs
dist/
build/
*.exe
*.dll
*.so
*.dylib

# ClaudeTools specific
.encryption-key
*.key
.pytest_cache/
.venv/
*.db
*.sqlite
logs/
.claude/tokens.json
**/.tokens.json
.claude/context-recall-config.env
.claude/context-recall-config.env.backup
.claude/context-cache/
.claude/context-queue/
api/.env

# MCP Configuration (may contain secrets)
.mcp.json
Pictures/
.grepai/
# Radio processor
projects/radio-show/audio-processor/test-data/*.mp3
projects/radio-show/audio-processor/*.egg-info/

# Large binary diagnostic artifacts (memory dumps, extracted case archives) —
# keep raw dumps out of git; record findings in markdown instead.
clients/internal-infrastructure/datto-bsod-case-2026-05-16.zip
clients/internal-infrastructure/datto-bsod-case-2026-05-16/

temp/

# Microsoft Office temp/lock files
~$*

# Wiki synthesis staging (transient; review-before-apply). Keep only the README.
.claude/wiki_staging/*
!.claude/wiki_staging/README.md
.tmp-*

# Controller/API scratch files (transient session temp; never commit)
.sta.json
.dev.json
.nc.json
.nc2.json
.cj_tmp
.q*
.po_*.json
.put*.json
.hdr
.csrf_tmp

# Transient coord softfail queue (machine-local; drains on /sync, never committed)
.claude/coord-queue.jsonl
.boot.bin
.bd2_*
.watch_targets.py

# Session billing/invoice-calc + ad-hoc scratch written to repo root (transient; never commit).
# Hidden .txt/.sh files are scratch-only here (legit scripts live as scripts/*.sh, not dot-prefixed);
# .json is listed by exact name to avoid catching tracked .hosts.json/.devs.json/.mcp.json.example.
.*.txt
.*.sh
.invcfg
.inv/
.one.json
.rmm-token
.rmm-url

# Scratch output from ocu/openclaw tooling (empty error/json artifacts)
.ocu.*

# EDR isolation watcher local state (no secrets, per-host)
.claude/scripts/.edr-watch-state.json
