node_modules/
data/
*.log
.DS_Store
# credentials — never commit
*.kubeconfig
deploy/opensandbox/*.kubeconfig
deploy/opensandbox/sandbox.example.toml

# strategy doc copy (lives in the pm knowledge base; not committed here)
211.09-*.md

# CAPD workload cluster kubeconfig (credential)
infra/local/*.kubeconfig
infra/local/stripe-billing-*-fixtures.json

projects-to-deploy
.tmp
# no env file is ever committed (.env, .cli-key.env, …) — the checked-in
# mirror is .env.example (different suffix, not matched).
*.env
# EXCEPT the dev-N harness port maps: documented non-secret config that
# up.sh/down.sh/status.sh source (see .pm/wN/dev-N/ports.env headers).
!ports.env
.playwright-mcp
# stray screenshots dropped at repo root (should live under .playwright-mcp/)
/*.png

# `lego/cli/` is the checked-in import-based bex launcher. Do not use that
# path for an untracked Render CLI checkout; use a temporary directory or
# RENDER_BIN.

# Python bytecode caches
__pycache__/
*.py[cod]

# Upstream OpenSandbox checkout created by the controller-patch CI job; on a
# self-hosted runner this lands inside the reused workspace (never committed).
.opensandbox-upstream/
bex-desktop/
# External CI runner source checkout.
/external/block-eden-mono/
