Files
J3vbandClaude Fable 5 ead64cdc20 chore(lint): errorlint + exhaustive + switch-exhaustiveness-check, and permissions.deny for generated files (#1462)
* chore(claude): deny hand-edits to generated files via permissions.deny

CLAUDE.md already says the sqlc, protocol and tauri-typegen outputs are
never hand-edited; this turns the sentence into a permission rule so the
Edit/Write tools refuse those paths outright.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jwaz4CHGAz85Rpypjvto5a

* chore(lint): switch-exhaustiveness-check on the client, default branch counts as exhaustive

A switch over a string union that misses a member is a silent drop, not a
type error. Every existing default-less switch already covers its union, so
this adds no exceptions; the four switches with a default keep it as the
deliberate catch-all.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jwaz4CHGAz85Rpypjvto5a

* chore(lint): enable errorlint and exhaustive in golangci and fix the 110 hits

errorlint: 68 fmt.Errorf sites wrapped the inner error with %v, which hid it
from errors.Is/As upstream — now %w; 6 == / != comparisons on sentinel
errors become errors.Is (the recover() branch in the router asserts the
recovered value is an error first); 36 ClientError type assertions become
errors.As, so a wrapped ClientError still reaches the client with its code.
Three test assertions the autofixer inverted (!ok || code mismatch) are
restored by hand.

exhaustive (default-signifies-exhaustive): one hit, the hub simulation's
FaultStatus switch — FaultOK moves from an if-guard into the switch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jwaz4CHGAz85Rpypjvto5a

* chore(claude): path-scoped rules for the three generated-code workflows

.claude/rules/{db-change,protocol-change,gendocs}.md load only when Claude
reads a matching source-of-truth file, so the db-change / protocol-change
skills and the gendocs regeneration step surface at the moment they apply
instead of relying on the CLAUDE.md table being remembered. .gitignore
whitelists .claude/rules/ next to skills/, workflows/ and settings.json.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jwaz4CHGAz85Rpypjvto5a

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-30 20:22:55 +02:00

138 lines
3.8 KiB
Plaintext

# Docker secrets
.env
Server/.env
# Claude Code — local-only by default. The exceptions are committed on purpose:
# a cloud session clones this repo and sees ONLY tracked files, so the CLAUDE.md
# files, skills and workflows have to be here or it starts with no instructions.
# Machine-local state (settings.local.json, locks) stays ignored.
.claude/*
!.claude/skills/
!.claude/workflows/
!.claude/rules/
!.claude/settings.json
CLAUDE.local.md
.mcp.json
# GitHub Copilot instructions (internal)
.github/copilot-instructions.md
.github/instructions/
# Agent worktrees (Mission Control fleet isolation)
.worktrees/
# AI-specific / internal planning docs
docs/brain/
docs/CODEMAPS/
docs/designs/
docs/research/
docs/superpowers/
/skills/
# Detailed security reports for findings that are not yet fixed. This repo is
# public (docs/security.md): reproduction traces for a live defect must never
# be committed. Findings are coordinated through private GitHub Security
# Advisories; only opaque identifiers and safe status go in tracked plans.
docs/security-findings/
# Mutation-testing output (npm run test:mutate). Local-only by design: a
# surviving-mutant report maps exactly which behaviour nothing tests.
Client/.stryker-tmp/
Client/reports/
# Server runtime artifacts
Server/chatserver.exe
Server/chatserver.exe~
Server/owncord-server.exe
Server/server.exe
Server/config.yaml
Server/data/
# Prebuilt plugin example (RL-08). Built from the main.go beside it with the
# TinyGo toolchain that directory's README pins. Read by nothing in the build
# or test graph, and not byte-reproducible on another machine: TinyGo embeds
# absolute host paths from the building machine's Go SDK and module cache, and
# has no -trimpath equivalent.
#
# Deliberately NOT a blanket *.wasm rule. Client/public/rnnoise.wasm is a
# vendored npm artifact this repository does not build and the client fetches
# at runtime; ignoring it would break voice noise suppression.
Server/plugin/examples/hello/hello.wasm
# Test coverage artifacts
*.out
Server/cov.out
Server/cover.out
Server/coverage.out
Server/ws_cover.out
Server/ws_cov.out
# Client build artifacts
Client/publish/
Client/publish-single/
Client/publish-release/
# HTML mockups (large design reference files)
Client/login-mockup.html
Client/ui-mockup.html
# Tauri typegen (auto-generated IPC bindings)
Client/src/generated/
.typecache
# Node modules
node_modules/
# AI tooling
.gstack/
.claude-flow/
.rust-review-results/
# Bug-hunt ledger: shared so contributors can add findings. Only the ledger and
# its renderer are tracked; hunt transcripts, .bak snapshots and debris patches
# are per-session scratch and stay local.
#
# FINDINGS.md is deliberately NOT tracked (RL-07): it is 100% derived from
# findings-ledger.json, and every hunt would otherwise write a fresh ~1.06 MB
# blob into permanent history for a file a reader can regenerate in under a
# second with `node .superpowers/render-ledger.mjs`.
.superpowers/*
!.superpowers/findings-ledger.json
!.superpowers/render-ledger.mjs
.claude/worktrees/
# Internal dev tools (e.g. tools/livekit-server.exe) are ignored, but the
# owncord-introspect MCP server is a committed, shared dev tool.
tools/*
!tools/mcp-introspect/
tools/mcp-introspect/node_modules/
.cache/
# Internal dev files (root-level scratch only)
/SKILL.md
TODOS.md
DESIGN.md
Client/CLIENT-REVIEW.md
# Agent tooling state
.serena/
# Client env (holds API keys - never commit)
Client/.env
# Rust review output
.rust-review-results/
# Claude Code worktrees (local scratch, never commit)
.claude/worktrees/
# local server run logs
server.log
# Knowledge-graph output. The tool and its 20.41 MB tracked payload were removed
# in a5f7d95 (#1413, RL-06). The rule stays so a machine that still has the local
# directory — it reached ~208 MB with cache and dated snapshots — does not see it
# as untracked noise.
graphify-out/