# Deployed to /opt/ai-tools/.gitignore: install.sh installs it; the RPM ships this as
# %{_datadir}/ai-tools/gitignore and its %post copies it into place when absent (the live file
# is not rpm-owned, so an erase preserves it). The source is named without the leading dot so
# git does not read it as ignore rules for the source tree itself.
#
# ── Default-deny home-dir repo for /opt/ai-tools ──────────────────────────
# Ignore everything, then re-include ONLY durable, operator-owned assets.
# Rationale: this tree holds auth tokens (.credentials.json, .claude.json),
# conversation logs (history.jsonl, sessions/), and nvm/npm/cache churn.
# Committing must be done as the operator, never the sandboxed agent.
/*

# Repo metadata + git identity
!/.gitignore
!/.gitconfig

# Shared assets: the one agent-agnostic copy of each kind that every agent symlinks to. Each
# agent's own skills/ and agents/ below are re-included as well -- they hold those symlinks plus
# anything agent-specific, and a committed symlink faithfully records what that agent carried.
!/skills/
!/subagents/

# ── Agent control planes: re-include selectively ──────────────────────────
# Each agent owns a config directory under this home whose NAME its manifest declares
# (.claude for Claude Code), so these patterns match ANY dot-directory rather than one name --
# a second agent's guardrails are captured without editing this base-owned file. The other
# dot-directories here (.nvm, .npm, .cache, .local) hold no file matching the re-includes
# below, and git tracks files rather than directories, so admitting their directory entries
# costs nothing.
!/.*/
/.*/*
# Agent-authored guardrails (root:ai-tools, not agent-writable)
!/.*/settings.json
!/.*/*-hook.sh
# Skills (whole tree)
!/.*/skills/
# Auto-memory: only the memory/ dirs, never the session logs beside them
!/.*/projects/
/.*/projects/*
!/.*/projects/*/
/.*/projects/*/*
!/.*/projects/*/memory/

# ── Hard secret denylist (belt-and-suspenders) ────────────────────────────
# Re-asserted last so a future negation edit can never expose these.
.credentials.json
.claude.json
history.jsonl
*.pem
*.key
.env
session-env/
sessions/
