# What NOT to upload to the Comfy registry. `comfy node publish` zips the
# git-tracked tree and honours this file (comfy_cli/file_utils.py:zip_files,
# gitignore syntax). Everything here stays in git and stays on GitHub -- this
# only trims the published artifact.
#
# `tools/` is the development test harness. Nothing under it is imported at
# runtime, and it is where two of the three findings that got 1.0.0 Flagged
# live -- the process spawn in check_all.py and the dynamic import in
# check_planner.py. The registry's YARA scan has no taint analysis, so a test
# runner starting pytest reads the same as a node shelling out at load. Not
# shipping a test harness to end users is right on its own terms; clearing two
# false positives is the bonus.
#
# The trigger words are described here rather than quoted, because this file
# ships. Quoting them put them in the published zip, where the scanner reads
# them exactly as it would read code. tools/check_publish.py enforces that.
tools/

# 2.3 MB of documentation screenshots that no code path opens. README.md and
# pyproject both reference them by absolute media.githubusercontent.com URL, so
# the rendered listing is unaffected -- see the .gitattributes note about
# raw.githubusercontent serving the LFS pointer instead of the image.
docs/img/

# Developer documentation. CLAUDE.md is instructions for an agent working on
# this repo and DEVLOG.md is 2000+ lines of build history; neither is of any use
# to someone installing the pack, and both are on GitHub for anyone who wants
# them. They also discuss the registry's own scan patterns by name, and 1.0.2
# proved that a scan finding can be raised against a sentence in a markdown
# file: docs/DEVLOG.md:1966 was Flagged for quoting a class name while
# explaining why it had been Flagged. README.md and PROMPTING.md still ship --
# those are for users.
CLAUDE.md
docs/DEVLOG.md

# Session documents. These were written for whoever picks the work up next --
# a handoff between agents, a GPU test protocol, a deferred-engineering memo --
# and they are useful on GitHub for exactly that reason. They must not be in
# the published artifact, because they name THIS machine -- the pack's install
# path, a user Desktop, the ComfyUI log, the venv interpreter, the reference
# stills of one specific graph, and the filename of a voice take belonging to
# somebody who is not the installer. A published pack that tells a stranger
# where somebody's desktop is has leaked something whatever else it does right.
#
# The paths are DESCRIBED and not written out, for the reason the header of
# this file gives about scanner tokens: this file ships, so anything quoted in
# it lands in the zip. tools/check_publish.py enforces that, and caught this
# very comment quoting them on its first run.
#
# BETA_NOTES.md is here for a duller reason: it describes 1.2.0-beta1, is
# marked superseded, and is not 2.0.0 user material.
docs/GROK_TO_CLAUDE.md
docs/GROK_V2_HANDBACK.md
docs/GROK_V2_GPU_TESTS.md
docs/POST_V2.md
BETA_NOTES.md