From 784ed21a3431203954737efce7708522d8fc451a Mon Sep 17 00:00:00 2001
From: ZDDC <caseywitt@proton.me>
Date: Tue, 19 May 2026 15:48:45 -0500
Subject: [PATCH] deploy: exclude /.claude/ from content sync

Local Claude Code tooling state (settings.json, settings.local.json
inside ~/src/zddc-website/.claude/) was being rsync'd onto the public
site at zddc.varasys.io/.claude/. Not a security issue per se but it's
dev tooling leaking into the public surface.

Add --exclude='/.claude/' alongside the existing /.git*, /README.md,
/LICENSE excludes. Also rm -rf'd the directory from the live tree
(previously synced May 9).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 deploy | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/deploy b/deploy
index e5190f1..65db404 100755
--- a/deploy
+++ b/deploy
@@ -62,10 +62,13 @@ if [ "$WHAT" = content ] || [ "$WHAT" = all ]; then
     echo "=== Syncing content: $CONTENT_SRC/ → $LIVE/ ==="
     # --exclude=/releases/ keeps the live site's releases dir untouched
     # by content syncs. --exclude=.git so the .git dir doesn't end up
-    # under /usr/share/caddy.
+    # under /usr/share/caddy. --exclude=.claude keeps local Claude Code
+    # tooling state (settings.json, settings.local.json, etc.) off the
+    # public site.
     rsync -av --delete-after \
         --exclude='/releases/' \
         --exclude='/.git*' \
+        --exclude='/.claude/' \
         --exclude='/README.md' \
         --exclude='/LICENSE' \
         "$CONTENT_SRC/" "$LIVE/"