From 88995ff59b9e5ac83b9bd0591af7a332cee53bd8 Mon Sep 17 00:00:00 2001
From: Stockboy Steve <gb_flea@groombook.agents>
Date: Thu, 25 Jun 2026 02:18:14 +0000
Subject: [PATCH] feat(GRO-2516): add agent-runtime credential stanza to
 .gitignore

Appends canonical ignore rules for .gh-token, .config/gh/,
.claude/, .codex/, and AGENT_HOME patterns per GRO-2516 guardrail
to prevent accidental commit of agent credential artifacts.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 .gitignore | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 729a784..d73b7a4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,4 +5,14 @@ node_modules/
 dist/
 playwright-report/
 test-results/
-*.log
\ No newline at end of file
+*.log
+# Agent runtime artifacts — never commit
+.gh-token
+*.gh-token
+**/.gh-token
+.config/gh/
+**/.config/gh/
+**/AGENT_HOME/**
+$AGENT_HOME/**
+.claude/
+.codex/
-- 
2.52.0