From 2419e7421d1744fd2c7b66eb73787e88f43465fd Mon Sep 17 00:00:00 2001
From: 0xrsydn <rafayrussani@gmail.com>
Date: Wed, 23 Sep 2026 11:01:51 +0700
Subject: [PATCH] chore(gitignore): ignore sops vault, age key, and pi local
 state

---
 .gitignore | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/.gitignore b/.gitignore
index 452494e..eaea8df 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,6 +8,15 @@
 .pi/agent/sessions/
 .pi/pi-acp/session-map.json
 
+# sops vault + age identity — NEVER commit these
+# (the vault is encrypted, but its age private key must stay off any remote)
+.secrets/
+.config/sops/
+*.enc.env
+*.enc.yaml
+*.enc.yml
+*.enc.json
+
 # Environment files / credentials
 .env
 .env.*
@@ -53,6 +62,14 @@
 .pi/agent/npm/node_modules/
 .pi/agent/npm/package-lock.json
 
+# Pi machine-local state (not portable config)
+.pi/agent/git/
+.pi/agent/fff/
+.pi/agent/trust.json
+
+# Nested git repo (caelestia shell), not a submodule
+.config/quickshell/caelestia/
+
 # Logs / ephemeral databases / sessions
 *.log
 *.jsonl