Gitignore build artifacts and fix statusline index.lock contention

- Add dashboard/.svelte-kit/, dashboard/build/, dashboard/mockups/, and
  .claude/ to .gitignore
- Untrack 817 committed build artifacts (git rm --cached)
- Replace git-changes statusline widget with cached custom-command that
  skips git diff when index.lock is held and caches results for 30s
- Add allow-list exception to protected-files-guard for .git/index.lock
  deletion

Author: AnExiledDev

.gitignore

@@ -52,11 +52,19 @@ container/.devcontainer/.codeforge-preserve
 # Specs (local working directory)
 .specs/
 
+# Claude Code local state
+.claude/
+
 # CLI-specific
 cli/.pytest_cache/
 cli/.ruff_cache/
 .codeforge/data/
 
+# Dashboard-specific
+dashboard/.svelte-kit/
+dashboard/build/
+dashboard/mockups/
+
 # Docs-specific
 docs/.astro/
 

container/.codeforge/config/ccstatusline-settings.json

@@ -93,7 +93,10 @@
 			},
 			{
 				"id": "a529e50e-b9f3-4150-a812-937ab81545e8",
-				"type": "git-changes",
+				"type": "custom-command",
+				"commandPath": "/usr/local/bin/ccstatusline-git-changes",
+				"timeout": 500,
+				"preserveColors": false,
 				"backgroundColor": "bgBrightBlue"
 			},
 			{

container/.devcontainer/features/ccstatusline/install.sh

@@ -116,6 +116,65 @@ CWD_EOF
 chmod +x /usr/local/bin/ccstatusline-cwd
 echo "[ccstatusline] ✓ CWD helper installed at /usr/local/bin/ccstatusline-cwd"
 
+# Create cached git-changes helper script
+# Caches git diff --shortstat output to avoid index.lock contention
+# from the statusline polling every render tick
+echo "[ccstatusline] Creating git-changes helper..."
+cat > /usr/local/bin/ccstatusline-git-changes <<'GITCHANGES_EOF'
+#!/bin/bash
+# Cached git-changes widget — avoids index.lock contention
+# Caches git diff --shortstat for CACHE_TTL seconds (default 30)
+CACHE_TTL="${CCSTATUSLINE_GIT_CACHE_TTL:-30}"
+CACHE_FILE="/tmp/ccstatusline-git-changes-$$"
+
+# Read cwd from Claude Code JSON on stdin
+CWD=$(jq -r '.cwd // empty' 2>/dev/null)
+[ -z "$CWD" ] && exit 0
+
+# Use cwd hash so different projects don't share cache
+CACHE_KEY=$(echo "$CWD" | md5sum | cut -c1-8)
+CACHE_FILE="/tmp/ccstatusline-git-changes-${CACHE_KEY}"
+
+# Return cached value if fresh enough
+if [ -f "$CACHE_FILE" ]; then
+    AGE=$(( $(date +%s) - $(stat -c %Y "$CACHE_FILE" 2>/dev/null || echo 0) ))
+    if [ "$AGE" -lt "$CACHE_TTL" ]; then
+        cat "$CACHE_FILE"
+        exit 0
+    fi
+fi
+
+# Skip if lock is held (don't queue behind another git operation)
+if [ -f "$CWD/.git/index.lock" ]; then
+    [ -f "$CACHE_FILE" ] && cat "$CACHE_FILE"
+    exit 0
+fi
+
+# Run git diff with a short timeout
+UNSTAGED=$(timeout 3 git -C "$CWD" diff --shortstat 2>/dev/null || true)
+STAGED=$(timeout 3 git -C "$CWD" diff --cached --shortstat 2>/dev/null || true)
+
+# Parse insertions/deletions
+INS=0; DEL=0
+for STAT in "$UNSTAGED" "$STAGED"; do
+    I=$(echo "$STAT" | grep -oP '\d+(?=\s+insertions?)' || true)
+    D=$(echo "$STAT" | grep -oP '\d+(?=\s+deletions?)' || true)
+    INS=$(( INS + ${I:-0} ))
+    DEL=$(( DEL + ${D:-0} ))
+done
+
+OUTPUT=""
+[ "$INS" -gt 0 ] && OUTPUT="+${INS}"
+[ "$DEL" -gt 0 ] && OUTPUT="${OUTPUT:+${OUTPUT} }-${DEL}"
+[ -z "$OUTPUT" ] && OUTPUT="clean"
+
+echo "$OUTPUT" > "$CACHE_FILE"
+echo "$OUTPUT"
+GITCHANGES_EOF
+
+chmod +x /usr/local/bin/ccstatusline-git-changes
+echo "[ccstatusline] ✓ Git-changes helper installed at /usr/local/bin/ccstatusline-git-changes"
+
 # Create wrapper script to protect configuration
 echo "[ccstatusline] Creating wrapper script..."
 cat > /usr/local/bin/ccstatusline-wrapper <<'WRAPPER_EOF'

container/.devcontainer/plugins/devs-marketplace/plugins/protected-files-guard/scripts/guard-protected-bash.py

@@ -20,7 +20,11 @@
         r"(^|/)\.env\.(?!example$)[^/]+$",
         "Blocked: .env.* files contain secrets - edit manually if needed",
     ),
-    (r"(^|/)\.git(/|$)", "Blocked: .git is managed by git"),
+    (
+        r"(^|/)\.git(/|$)",
+        "Blocked: .git is managed by git",
+        {"allow": [r"\.git/index\.lock$"]},
+    ),
     (
         r"(^|/)package-lock\.json$",
         "Blocked: package-lock.json - use npm install instead",
@@ -158,8 +162,13 @@ def extract_write_targets(command: str) -> list[str]:
 def check_path(file_path: str) -> tuple[bool, str]:
     """Check if file path matches any protected pattern."""
     normalized = file_path.replace("\\", "/")
-    for pattern, message in PROTECTED_PATTERNS:
+    for entry in PROTECTED_PATTERNS:
+        pattern, message = entry[0], entry[1]
+        opts = entry[2] if len(entry) > 2 else {}
         if re.search(pattern, normalized, re.IGNORECASE):
+            # Check if path matches an allow-list exception
+            if any(re.search(a, normalized) for a in opts.get("allow", [])):
+                continue
             return True, message
     return False, ""