# Allowlist: ignore everything, then opt in safe files only.
# New files pi creates (auth, caches, sessions) stay ignored by default.
/*

!/.gitignore
!/README.md
!/settings.json
!/keybindings.json
!/extensions/
!/themes/
!/skills/
!/agents/
!/prompts/
!/workflows/

# Never commit, even if allowlisted above by mistake
auth.json
mcp-auth.json
*.key
*.pem
.env*