.gitignore

# ─────────────────────────────────────────────────────────────────────────────
# @axiomcode/reasoning-java — .gitignore
#
# Tracked by design: src/**, src/souffle/*.dl, src/souffle/export_manifest.tsv,
# src/templates/*.map, src/pipeline/run-souffle.sh, .claude/agents/*.md,
# tsconfig.json.  (package-lock.json is deliberately NOT tracked — see below.)
# Everything below is machine-local, generated, or secret.
# ─────────────────────────────────────────────────────────────────────────────

# ── Dependencies ─────────────────────────────────────────────────────────────
node_modules
node_modules/
# and the bare name: `node_modules/` matches a directory only, so a symlink named node_modules slips past it
node_modules
jspm_packages/
web_modules/
.pnp
.pnp.*
.yarn/*
!.yarn/patches
!.yarn/plugins
!.yarn/releases
!.yarn/sdks
!.yarn/versions

# ── TypeScript build output ──────────────────────────────────────────────────
# dist/ is regenerated by `npm run build` (and by the `prepare` lifecycle hook),
# so it is never a source of truth. .tsbuildinfo lands in dist/ per tsconfig,
# but the loose pattern catches stray locations too.
dist/

# ...EXCEPT inside a fixture's vendored packages. A fixture vendors a dependency whose
# PUBLISHED surface is its `dist/index.d.ts` — that copy is hand-written source, never
# build output, and the whole point of the fixture is that the manifest's `types` points
# into a directory the parser skips by name. The blanket `dist/` above silently dropped
# it: `git add -A` reported success, the file never entered the index, and the fixture
# then asserted on a package staged from nowhere. Both lines are needed — git does not
# descend into an excluded directory, so the directory itself must be re-included first.
# ...EXCEPT inside a fixture's vendored packages, in ANY language's test tree. A fixture
# vendors a dependency whose PUBLISHED surface is a checked-in `dist/index.d.ts` — that
# copy is hand-written source, never build output, and the point of the fixture is that
# the manifest's `types` points into a directory the parser skips by name.
#
# `build` and `out` are here for the same reason `dist` is: the staging code looks for a
# package's declarations in all three, so a fixture can legitimately vendor a package
# that publishes into any of them. Covering only `dist` left the identical trap set for
# the next one.
#
# Both lines per directory are needed — git does not descend into an excluded directory,
# so the directory itself must be re-included before its contents can be.
# ...and these six lines were DEAD for the whole time they existed. A pattern containing a
# slash is anchored to the directory holding this file, so `test/**/vendor/**/dist/` matches
# a TOP-LEVEL `test/` and the suites live under `graph/test/`. `git check-ignore` confirms
# it: a vendored dist under graph/test/ was still ignored by the blanket above, and the one
# such file in the index survived only because it was force-added. Case
# 60-ts-emit-helpers shipped in #813 with four files and without its `lib/dist/`, so its
# golden had been blessed against inputs that existed only in one working tree and the case
# failed for everybody else from the day it landed.
#
# The rule is stated positively instead: a fixture's INPUTS are inputs whatever they are
# called, and nothing under a cases/ or fixtures/ tree is ever build output of THIS
# repository. `test/tools/no-ignored-fixtures.sh` still enforces the invariant; it could not
# catch this one, because a file that was never added is not a file it can see.
!graph/test/**/cases/**
!graph/test/**/fixtures/**
build/
out/
lib-cov/

# ...EXCEPT the Python case that tests the parser's OWN build-output exclusion (#564).
# `build/lib/pkg` inside it is a byte-identical setuptools artifact and must stay
# checked in for the case to catch a regression; `build/__init__.py` beside it is the
# CONTROL — a legitimate source package literally named `build` — which the blanket
# `build/` rule above would otherwise drop silently, same as the vendor case above. A
# negation MUST come after the rule it excepts — gitignore is last-match-wins, and a
# negation placed before the blanket it is meant to except (as the vendor `build/`
# lines above are) is dead: the blanket re-ignores everything the exception just
# re-included.
!graph/test/python/cases/15-build-artifact-exclusion/src/build/
!graph/test/python/cases/15-build-artifact-exclusion/src/build/**
*.tsbuildinfo
.tsbuildinfo
*.d.ts.map
*.js.map

# ── Soufflé engine: per-run artifacts ────────────────────────────────────────
# run-souffle.sh stages facts into <intermediate>/souffle-facts, generates a C++
# translation of the .dl program, and links a native binary. All disposable;
# only the .dl rules are source.
souffle-facts/
souffle-program.cpp
souffle-engine-*
.souffle-gen.log
*.facts
*.dl.cpp
*.dl.o
# Compiled engine binaries (the real cache lives in ~/.cache/AxiomCode-Souffle,
# outside the repo — this guards against AXIOM_SOUFFLE_CACHE being pointed here).
.souffle-cache/
souffle-cache/

# ── Generated IR / analysis artifacts ────────────────────────────────────────
# The client/library IR (all-*.csv per src/constants/schema.ts) and the engine's
# call-graph exports are produced by the pipeline, never hand-authored.
all-*.csv
call-chain-edges.csv
call-chain-*.csv
# The bundle stage's output (src/bundle/SCHEMA.md): the database, the headered core
# tables, and the raw per-language relations it was built from.
graph.sqlite
graph.sqlite-journal
csv/
raw/
client-ir/
library-ir/
intermediate/
inter/
*-ir/
# Validation / benchmark workspaces used by the callgraph-validate and
# impact-compare agents (bytecode oracles, dynamic traces, diff reports).
oracle/
oracles/

# .NET build output. The C# ground-truth tool and the runtime instrumenter are
# real source under graph/test/csharp/, and `dotnet build` drops obj/ and bin/
# beside them. This repository had no such pattern because nothing in it was C#
# until now, and the first commit after those directories stopped matching the
# `oracle/` rule above carried 50-odd generated files, a project.assets.json and
# four binaries into the tree.
[Oo]bj/
[Bb]in/
# ...except the repository's own bin/, which is the CLI and not build output: without this every new
# file there, bin/axiomcode.js included, is silently left out of a commit (#1229).
!/bin/
*.user

reports/
scratch/
.scratch/
tmp/
temp/
*.oracle.csv
*.diff.csv

# ── JVM artifacts (bytecode oracle runs, compiled classes) ────────────────────
# No jars are vendored today; `git add -f` a specific one if that ever changes.
*.class
*.jar
*.war
*.ear
*.hprof
hs_err_pid*.log
replay_pid*.log
target/
.gradle/
.mvn/wrapper/maven-wrapper.jar
# ...EXCEPT the Java case that tests build-output exclusion itself (#1545). Its target/ is the construct, and
# app/build/ and src/main/js/target/ are the controls: real source in a directory named like a build's. Placed
# after both blankets (build/ above, target/ here), since gitignore is last-match-wins.
!graph/test/java/cases/62-build-output-is-not-source/src/**/target/
!graph/test/java/cases/62-build-output-is-not-source/src/**/target/**
!graph/test/java/cases/62-build-output-is-not-source/src/**/build/
!graph/test/java/cases/62-build-output-is-not-source/src/**/build/**
# ...and the Gradle case: build/ beside a build script is the construct (the parser must skip it by that
# anchor, not because git ignores it), and src/main/java/app/build/ is the control.
!graph/test/java/cases/64-gradle-build-output-is-not-source/src/**/build/
!graph/test/java/cases/64-gradle-build-output-is-not-source/src/**/build/**

# ── Secrets & local configuration ────────────────────────────────────────────
.env
.env.*
!.env.example
!.env.template
*.pem
*.key
*.p12
*.keystore
credentials.json
secrets.json
.npmrc
.netrc

# ── Logs & diagnostics ───────────────────────────────────────────────────────
logs/
*.log
npm-debug.log*
yarn-debug.log*
yarn-error.log*
pnpm-debug.log*
lerna-debug.log*
.pnpm-debug.log*
*.pid
*.seed
*.pid.lock
report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
profile-*
*.cpuprofile
*.heapsnapshot

# ── Test & coverage output ───────────────────────────────────────────────────
coverage/
*.lcov
.nyc_output/
.jest-cache/
junit.xml
test-results/

# ── Tool caches ──────────────────────────────────────────────────────────────
.cache/
.npm/
.eslintcache
.stylelintcache
.node_repl_history
.tsc-alias-cache/
*.tgz

# ── Claude Code / agent local state ──────────────────────────────────────────
# .claude/agents/*.md are project source and stay tracked; personal settings,
# session state, and agent scratch output do not.
.claude/
CLAUDE.local.md

# ── Editor & IDE ─────────────────────────────────────────────────────────────
.vscode/*
!.vscode/settings.json
!.vscode/extensions.json
!.vscode/launch.json
!.vscode/tasks.json
.idea/
*.iml
*.ipr
*.iws
*.sublime-project
*.sublime-workspace
.history/
*.swp
*.swo
*~
.\#*
\#*\#

# ── OS cruft ─────────────────────────────────────────────────────────────────
.DS_Store
.DS_Store?
._*
.Spotlight-V100
.Trashes
.fseventsd
.AppleDouble
.LSOverride
Icon?
Thumbs.db
Thumbs.db:encryptable
ehthumbs.db
Desktop.ini
$RECYCLE.BIN/
.directory
.nfs*

# ── Safety net: never ignore engine source ───────────────────────────────────
!src/**/*.ts
!src/**/*.dl
!src/**/*.sh
!src/souffle/export_manifest.tsv
!src/templates/*.map

# ── Safety net: a fixture's INPUTS are enforced, not enumerated ──────────────
# An earlier draft of this listed every source extension under every fixture directory.
# That list is unmaintainable and was already wrong: it covered `fixtures/` but not
# `cases/`, and a negation broad enough to cover both would also have re-included the
# per-run work directories, which is how 122 generated files were committed once before.
#
# So the rules above stay narrow and `test/tools/no-ignored-fixtures.sh` enforces the
# invariant directly: it fails the suite if any file present under test/ is ignored, and
# if any vendored package's declared `types` is missing from the index. A guard that
# checks the property beats a pattern list that tries to anticipate it.

# A work directory at the REPOSITORY ROOT, which the per-suite lines below do not
# cover. Scratch written there is measurement scaffolding: run scripts, corpus
# outputs and issue drafts, which routinely carry absolute paths to a machine and to
# whatever corpus was measured. `git add -A` from the root stages all of it, and a
# commit-message guard cannot catch it because the leak is in the FILE, not the
# message. Ignored here so the safe habit is the default one.
.work/

# ── Java engine test suite: per-run work dirs and the generated JDK index ─────
graph/test/java/.work/

# Python bytecode from the test tools
__pycache__/
*.pyc

# fixture harness work directories (generated per run). The plain `.work/` is the one
# run-tests.sh itself uses; the `.work-*` variants are the fixtures'. Only the latter was
# listed, so every run of the TypeScript suite left an untracked directory behind.
graph/test/typescript/.work/
graph/test/typescript/.work-*/
graph/test/javascript/.work/
# the torture and realapp harnesses' own per-run work directories (217 generated files of
# them were committed with the engine and rewritten by every run)
graph/test/javascript/torture/.work/
graph/test/javascript/realapp/.work/

# the one-command pipeline keeps its IR and scratch here
.intermediate/

# lock files are not committed: the engine is not published as a locked artifact, and two
# workspaces' locks drifted on every parser sync
package-lock.json
# A JavaScript fixture dependency is a real package under node_modules — that is the shape
# the parser resolves and the shape the library join is written for.
!graph/test/javascript/cases/*/src/node_modules/
graph/test/*/.work-skill/
__pycache__/

# C# engine dev scratch: compiled binaries and staged facts from run-tests.sh / devrun.sh
.cs-case-work/
# staging-test.sh's default work dir, the same way .cs-case-work/ is the case
# runner's. Without it a run of the C# suite leaves an untracked directory, and
# the next `git add -A` in that tree commits a scratch tree full of absolute
# machine paths.
.cs-staging-work/
.cs-dev-cache/

# evaluation graders: run locally, never shipped in the plugin
plugins/axiomcode/validate/

# agent working notes: local only, never in the repo
CLAUDE.md
AGENTS.md
.claude/
.cursor/
.codex/
.copilot/
.agents/
# ...except what the plugin ships to other agents: Codex reads its marketplace from .agents/plugins/,
# and Gemini CLI loads the plugin's AGENTS.md as the extension's context file.
!/.agents/
/.agents/*
!/.agents/plugins/
!/plugins/axiomcode/AGENTS.md

# The C# corpus manifest names the evaluation set and is deliberately NOT committed.
# corpus.tsv.template documents the format; the filled-in copy lives outside the repo
# (CS_CORPUS_MANIFEST, default ~/.config/axiom/cs-corpus.tsv). See corpus/manifest.sh.
graph/test/csharp/corpus/corpus.tsv