.claude/settings.local.json was tracked — the one file in the workspace whose
whole purpose is to stay out of version control. .gitignore has listed it since
it was added and line 130 even carries the git rm --cached command, but gitignore
cannot act on a path git already tracks, so the rule had never once fired.
Nothing leaked. Both committed versions held four permission rules and no env
keys, checked per commit rather than only at HEAD. The risk was prospective: the
next person to put a credential in the local overrides file would have committed
it, and the ignore rule would have stayed silent about it.
The four rules are worth sharing, so they move rather than disappear. They allow
chrome-devtools screenshot/snapshot/navigate and puppeteer evaluate — visual
verification, which is routine work in a Flutter UI and not one person's
preference. settings.json is committed by design and already carries 16 allow
and 43 deny rules, so they now sit with their peers. Anyone cloning this repo
keeps the tooling; before this commit they only got it by accident.
The file itself stays on disk, so no one loses local settings. It is simply no
longer shared, and the existing ignore rule now has something it can act on.
Closes T-1.
Co-Authored-By: Claude <noreply@anthropic.com>
jpmschweitzerandClaude
69de933ab0