.gitignore

# Local tooling & scratch
node_modules/
# ANCHORED to the repository root, and it has to be: this is where the installer
# bootstraps pnpm. A bare `tools/` matches a directory of that name at ANY depth -
# which silently swallowed scripts/tools/ (the maintainer scripts) until
# check-no-secrets caught three tracked files hidden by an ignore rule.
/tools/
.scratch/
*.log

# THE APP'S LAST-RESORT ROOT, beside the checkout. `$VNCODE_HOME` defaults to the
# platform's own per-user data directory and the harness home is `<root>/home`
# inside it; `<tree>/.vncode` is only used when even that data root cannot be
# written - which is exactly the workspace-scoped confinement this repository's own
# checks run inside. It holds a whole harness home (sessions, credentials), so it
# must never be committed. Anchored, for the reason the /tools/ rule above records.
/.vncode/

# A version bump unpacks a throwaway harness install and drives pnpm through a
# local npm cache; both are hundreds of MB of node_modules that NOTHING in this
# repo reads (the checks resolve the pinned line from an npm install and the
# profile mirror, never from here). They are anchored to the root and spelled
# with a leading dot so a real directory of either name inside a package stays
# trackable - the same trap `/dsh-diagrams/` documents further down.
/.upgrade/
/.npm-cache/

# CREDENTIALS. Nothing of these shapes may ever be staged, because a secret in a
# commit is a secret on GitHub for as long as the repository exists - in every
# fork and every clone - even after the file is deleted. The harness keeps its
# own credentials in `$DSH_HOME/.credentials.yaml`, which defaults to `~/.dsh`
# and is therefore OUTSIDE this tree; these rules are the belt for the case where
# DSH_HOME is pointed inside it, or a copy is dropped here by hand.
# `scripts/checks/check-no-secrets.mjs` asserts every line below still exists AND
# fails the build if a credential-shaped string reaches any staged file.
.env
.env.*
.credentials.yaml
*.credentials.yaml
*.pem
*.key
*.p12
*.pfx
id_rsa*
id_ed25519*
.netrc
# An .npmrc can carry a registry token. Nothing in this pack needs one (it ships
# zero npm dependencies); if you ever need a committed one, force-add it.
.npmrc

# The shell's Rust build tree (app/). Cargo writes hundreds of megabytes of
# objects and binaries under app/target/, and none of it is content:
# `run-desktop.*` rebuilds it, and a fresh clone builds it once. The rule is
# written as a bare `target/` because a cargo WORKSPACE puts the directory at the
# workspace root, and any crate added under app/crates/ keeps it there.
target/

# The PROTOTYPING LAB (`dsh-proto-lab`) is a workshop, not an exhibit: `lab_new`
# generates runs into `<workspace>/lab/` for the agent to try things in, and a
# repository that accumulated every sketch anyone ever generated would stop being
# a plugin pack. What ships is the GENERATOR and the checked example library, not
# what was made with them - the examples live in
# `packages/dsh-proto-lab/skills/*/examples/` and ARE committed.
#
# Anchored, for the reason the `/dsh-diagrams/` rule documents below: an
# unanchored `lab/` also matches any `lab/` directory inside a package.
# `DSH_PROTO_LAB_ROOT` can point the lab somewhere else entirely; this rule is
# what keeps the DEFAULT location out of every commit.
/lab/

# The browser profile `check-lab-render.mjs` builds while it drives a headless
# Chrome. A profile is a hundred files of cache and it is created per run; the
# check removes it itself, and this is the belt for the run that is killed.
packages/dsh-proto-lab/checks/.tmp/

# The vendoring DOWNLOAD CACHE, the same shape as the diagrams rule further down:
# `vendor/build.mjs` installs the pinned p5 once into `vendor/node_modules` and
# reads two published files out of it. What is committed is the generated
# `lib/vendor/p5.min.js` beside its `VERSION.json`; the install is an input.
packages/dsh-proto-lab/vendor/node_modules/
packages/dsh-proto-lab/vendor/.cache/

# The diagram DATABASE must never be committed. dsh-diagrams keeps one file per
# conversation plus one shared library under $DSH_HOME/dsh-diagrams/, and
# $DSH_HOME defaults to ~/.dsh (outside this repo). These rules are the belt for
# the case where DSH_HOME is pointed inside the tree, or a copy is dropped here.
#
# They are ANCHORED to the repository root on purpose. An unanchored
# `dsh-diagrams/` also matches `packages/dsh-diagrams/` - the PACKAGE of the same
# name - which silently ignored all 18 of its tracked files, so the NEXT file
# added inside that package would have been invisible to `git status` and skipped
# by `git add -A`: present locally, passing local tests, never committed.
# check-no-secrets.mjs fails if any tracked file is ignored, which is what keeps
# these two rules anchored.
/dsh-diagrams/
/library.json

# Exported diagram sources are LOCAL material, not repo content: they are
# verbatim copies of what the library stores, so committing them would put the
# diagram database on GitHub in another form. docs/diagrams/ stays on the
# machine that exported it, with its own drift check beside it.
docs/diagrams/

# The vendoring DOWNLOAD CACHE. `vendor/design/build.mjs` fetches the pinned
# upstream commit ONCE into vendor/design/.cache/<sha>.tar.gz and reuses it, so a
# rebuild costs no network. The tarball is an INPUT to a generated tree that is
# already committed under lib/vendor/design/ - 4.8 MB of bytes nothing reads at
# build or run time - so it stays local, per-machine.
packages/dsh-diagrams/vendor/design/.cache/

# The dsh-frontend-craft vendoring caches, the same shape: `build.mjs` fetches
# the pinned Impeccable commit once into `.cache/<sha>.tar.gz`, and
# `build-engine.mjs` stages the wasm-bindgen output in `.cache/wasm-out`. Both
# are INPUTS; the bytes they produce are committed under `lib/vendor/impeccable/`
# and hashed by its VERSION.json.
packages/dsh-frontend-craft/vendor/impeccable/.cache/

# Editors / OS
.DS_Store
Thumbs.db
.vscode/
.idea/