feat(create): always exclude node_modules from .gitignore after git init

Bundled `@org` templates may ship without a `.gitignore` (or with one
that omits `node_modules`), so the user's first commit could end up
tracking installed dependencies. Add a small post-`git init` step that
guarantees the line is present.

- `create/utils.ts` — new `ensureGitignoreNodeModules(projectDir)` that:
  - creates a fresh `.gitignore` containing `node_modules\n` when none
    exists (the bundled-monorepo case),
  - appends `node_modules\n` when a `.gitignore` exists but omits it
    (terminating the previous line first if the file lacks a trailing
    newline),
  - is a no-op when `node_modules` (or `node_modules/`) already
    appears as a standalone line.
- `create/bin.ts` — call the helper from the monorepo branch right
  after `git init` succeeds. Both the builtin `vite:monorepo` (whose
  template's `_gitignore` already lists `node_modules`) and the
  bundled `@org` monorepo path now end up with the line guaranteed.

Tests:
- 5 unit tests over the helper (fresh, append, no-newline, no-op,
  trailing-slash variant).
- The bundled-monorepo snap-test gains a `cat my-mono/.gitignore`
  step verifying the file is created with `node_modules`.
- Existing `new-vite-monorepo` snap-test stays byte-stable — the
  template-shipped gitignore already lists `node_modules`, so the
  helper is a no-op there.

Author: fengmk2

packages/cli/snap-tests/create-org-bundled-monorepo/snap.txt

@@ -37,3 +37,6 @@ peerDependencyRules:
 
 > test -d my-mono/.git && echo 'Git initialized' || echo 'No git' # git-init prompt covers bundled monorepo path
 Git initialized
+
+> cat my-mono/.gitignore # node_modules excluded even though tarball shipped no .gitignore
+node_modules

packages/cli/snap-tests/create-org-bundled-monorepo/steps.json

@@ -3,6 +3,7 @@
     "node $SNAP_CASES_DIR/.shared/mock-npm-registry.mjs -- vp create @your-org:workspace --no-interactive --directory my-mono # bundled monorepo: extract tarball, scaffold, inject create.defaultTemplate",
     "cat my-mono/vite.config.ts # create.defaultTemplate auto-set to @your-org",
     "cat my-mono/pnpm-workspace.yaml # workspace markers preserved",
-    "test -d my-mono/.git && echo 'Git initialized' || echo 'No git' # git-init prompt covers bundled monorepo path"
+    "test -d my-mono/.git && echo 'Git initialized' || echo 'No git' # git-init prompt covers bundled monorepo path",
+    "cat my-mono/.gitignore # node_modules excluded even though tarball shipped no .gitignore"
   ]
 }

packages/cli/src/create/__tests__/utils.spec.ts

@@ -1,7 +1,12 @@
-import { describe, expect, it } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 
 import {
   deriveDefaultPackageName,
+  ensureGitignoreNodeModules,
   formatTargetDir,
   getProjectDirFromPackageName,
 } from '../utils.js';
@@ -87,3 +92,50 @@ describe('deriveDefaultPackageName', () => {
     expect(result.length).toBeGreaterThan(0);
   });
 });
+
+describe('ensureGitignoreNodeModules', () => {
+  let projectDir: string;
+
+  beforeEach(() => {
+    projectDir = fs.mkdtempSync(path.join(os.tmpdir(), 'vp-gitignore-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(projectDir, { recursive: true, force: true });
+  });
+
+  function gitignore(): string {
+    return fs.readFileSync(path.join(projectDir, '.gitignore'), 'utf-8');
+  }
+
+  it('creates a fresh `.gitignore` with `node_modules` when none exists', () => {
+    ensureGitignoreNodeModules(projectDir);
+    expect(gitignore()).toBe('node_modules\n');
+  });
+
+  it('appends `node_modules` to an existing `.gitignore` that omits it', () => {
+    fs.writeFileSync(path.join(projectDir, '.gitignore'), 'dist\n*.log\n');
+    ensureGitignoreNodeModules(projectDir);
+    expect(gitignore()).toBe('dist\n*.log\nnode_modules\n');
+  });
+
+  it('terminates the last line first when the existing file lacks a trailing newline', () => {
+    fs.writeFileSync(path.join(projectDir, '.gitignore'), 'dist');
+    ensureGitignoreNodeModules(projectDir);
+    expect(gitignore()).toBe('dist\nnode_modules\n');
+  });
+
+  it('is a no-op when `node_modules` already appears as a standalone line', () => {
+    const existing = '# Logs\n*.log\nnode_modules\ndist\n';
+    fs.writeFileSync(path.join(projectDir, '.gitignore'), existing);
+    ensureGitignoreNodeModules(projectDir);
+    expect(gitignore()).toBe(existing);
+  });
+
+  it('treats `node_modules/` (with trailing slash) as a match', () => {
+    const existing = 'node_modules/\ndist\n';
+    fs.writeFileSync(path.join(projectDir, '.gitignore'), existing);
+    ensureGitignoreNodeModules(projectDir);
+    expect(gitignore()).toBe(existing);
+  });
+});

packages/cli/src/create/bin.ts

@@ -65,7 +65,7 @@ import {
   executeRemoteTemplate,
 } from './templates/index.ts';
 import { BuiltinTemplate, TemplateType } from './templates/types.ts';
-import { deriveDefaultPackageName, formatTargetDir } from './utils.ts';
+import { deriveDefaultPackageName, ensureGitignoreNodeModules, formatTargetDir } from './utils.ts';
 
 const helpMessage = renderCliDoc({
   usage: 'vp create [TEMPLATE] [OPTIONS] [-- TEMPLATE_OPTIONS]',
@@ -873,6 +873,7 @@ Use \`vp create --list\` to list all available templates, or run \`vp create --h
         if (!compactOutput) {
           prompts.log.success('Git repository initialized');
         }
+        ensureGitignoreNodeModules(fullPath);
       } else {
         prompts.log.warn('Failed to initialize git repository');
         if (gitResult.stderr) {

packages/cli/src/create/utils.ts

@@ -112,6 +112,29 @@ export function setPackageName(projectDir: string, packageName: string) {
   });
 }
 
+/**
+ * Make sure the scaffolded project's `.gitignore` excludes `node_modules`.
+ *
+ * Called right after `git init` so even bundled `@org` templates (which
+ * may ship without a `.gitignore`) don't end up tracking installed
+ * dependencies on the user's first commit. No-op when an existing
+ * `.gitignore` already lists `node_modules`.
+ */
+export function ensureGitignoreNodeModules(projectDir: string): void {
+  const gitignorePath = path.join(projectDir, '.gitignore');
+  let content = '';
+  try {
+    content = fs.readFileSync(gitignorePath, 'utf-8');
+  } catch {
+    // No existing .gitignore — we'll write a fresh one below.
+  }
+  if (/^\s*node_modules\/?\s*$/m.test(content)) {
+    return;
+  }
+  const prefix = content === '' || content.endsWith('\n') ? '' : '\n';
+  fs.appendFileSync(gitignorePath, `${prefix}node_modules\n`);
+}
+
 export function formatDisplayTargetDir(targetDir: string) {
   const normalized = targetDir.split(path.sep).join('/');
   if (normalized === '' || normalized === '.') {