# Allowlist: ignore everything, then opt in safe files only.
# New files pi creates (auth, caches, sessions) stay ignored by default.
/*

!/.gitignore
!/README.md
!/settings.json
!/keybindings.json
!/extensions/
!/themes/
!/skills/
!/agents/
!/prompts/
!/workflows/
!/models.json
# CLIProxyAPI connection only — the API key lives in auth.json
!/pi-cliproxyapi-provider/
/pi-cliproxyapi-provider/*
!/pi-cliproxyapi-provider/config.json

# Never commit, even if allowlisted above by mistake
auth.json
mcp-auth.json
*.key
*.pem
.env*