__pycache__/
*.py[cod]
*$py.class
*.egg-info/
dist/
build/
.eggs/
*.egg
# Stray PEP 517 build-backend wheels that a local `python -m build` / pip can
# drop in the repo root (hatchling, build, pluggy, …). Never part of winpodx.
/*.whl
.venv/
venv/

# AppImage build artifacts (packaging/appimage/ local builds)
*.AppImage
squashfs-root/
.pytest_cache/
.ruff_cache/
*.so
.mypy_cache/
.hypothesis/
env/

# AI config (actual files in .priv-storage/, root has symlinks)
.priv-storage/
CLAUDE.md
.cursorrules
.claude
.vscode
WORK_STATUS.md
# Additional per-tool files routed via .priv-storage chain or
# explicitly local. CLAUDE.md Section 8 ("AI Tooling Footprint Ban")
# requires these never reach git history.
.mcp.json
AGENTS.md
CLAUDE.local.md
demo.png

# Backup toolkit (generic, not project-specific)
tmp-igbkp/

# Per-install agent bearer token staged into the OEM bind mount.
# Never commit — carries a per-install secret.
config/oem/agent_token.txt

# Synthetic SMBIOS disguise blob, generated into the OEM bind mount at
# compose time (#246). Runtime artefact — never commit.
config/oem/winpodx-smbios.bin

# Rust reverse-open shim build tree (~21 MB of regenerable Cargo artifacts).
# Already ignored by the nested config/oem/reverse-open/shim/.gitignore, but
# listing it at the ROOT too keeps it out of the sdist: hatchling's sdist VCS
# walk honors the root .gitignore, so a maintainer-local build (where the shim
# was compiled) produces a clean tarball. Only the committed shim/bin/ prebuilt
# .exe should ship. (The CI release builds from a fresh checkout, so target/
# never exists there — published artifacts are clean regardless.)
config/oem/reverse-open/shim/target/

# Coverage / test artefacts.
.coverage
htmlcov/

# Editor / OS scratch files.
*.tmp
*.bak
*.old
*.orig
*.swp
*.swo
*~
.DS_Store
Thumbs.db
.idea/
*.iml

# Secret-shaped files — defensive denylist so a stray .env / key never
# slips into a commit. Currently no such files in tree.
.env
.env.*
*.env
*.pem
*.key
*.crt
*.p12
*.pfx
id_rsa*
id_ed25519*

# Editor / assistant scratch & backup paths
CLAUDE.md.bak
AGENTS.md.bak
.cursorrules.bak
WORK_STATUS.md.bak
.gitignore.bak
.codex/
.aider*
.continue/
.cline/
.roo/
uninstall-backup-*/
.priv-storage/.allow-setup-reread