From ec710e4ee03c0e53afa2737261217c86d94b630c Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Fri, 13 Nov 2026 00:46:20 +0000
Subject: [PATCH] Refuse tracked Claude project-local settings

Add the durable-workflow/.github#355 tracked-path refusal to
scripts/check-public-boundary.sh, before the content scans. It scans the
complete tracked tree, prints only the path, and never reads the file.
.gitignore now covers root and nested .claude/settings.local.json.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .gitignore                       | 2 ++
 scripts/check-public-boundary.sh | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/.gitignore b/.gitignore
index 2a113424..5a7c2106 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,3 +25,5 @@ yarn-error.log
 /.vscode/*
 !/.vscode/mcp.json
 /.zed
+.claude/settings.local.json
+**/.claude/settings.local.json
diff --git a/scripts/check-public-boundary.sh b/scripts/check-public-boundary.sh
index 7f1274b4..d694c4f3 100755
--- a/scripts/check-public-boundary.sh
+++ b/scripts/check-public-boundary.sh
@@ -6,6 +6,12 @@ cd "$root"
 
 status=0
 
+# Claude Code's personal local settings must never be tracked (.github#355).
+if git ls-files -z | tr '\0' '\n' | grep -E '(^|/)\.claude/settings\.local\.json$'; then
+  echo 'refused: tracked .claude/settings.local.json' >&2
+  exit 1
+fi
+
 pattern_from_hex() {
   local hex="$1"
   local output=""