diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..0b4a399
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,10 @@
+# Agent runtime artifacts — never commit
+.gh-token
+*.gh-token
+**/.gh-token
+.config/gh/
+**/.config/gh/
+**/AGENT_HOME/**
+$AGENT_HOME/**
+.claude/
+.codex/