`.dev.vars` is not gitignored, so the documented local-dev workflow leaves API credentials one `git add -A` from being committed

[3x3xX3N0N]

Describe the bug

The repository documents putting Cloudflare API credentials in .dev.vars, but nothing in .gitignore excludes that file, so following the documented workflow leaves a credentials file sitting in the working tree ready to be committed by git add -A.

Two tracked templates instruct exactly that:

• examples/assets/.dev.vars.example:1-2 — "Copy to .dev.vars for local development, or set these as secrets in production with wrangler secret put <NAME>." The file goes on to describe creating an R2 API token with S3 credentials.
• examples/think-compare-runtimes/.dev.vars.example:1 — "Copy to .dev.vars for local development."

wrangler dev reads .dev.vars from each example's directory, so the file lands inside the repo by design. Current .gitignore ends at packages/computer/dist/bin/computerd-* with no .dev.vars entry, and git check-ignore examples/assets/.dev.vars matches nothing.

This is not theoretical — I hit it while working through the examples. After creating examples/think/.dev.vars with a real API token as the docs describe, git status listed it as an ordinary untracked file:

$ git status --short
?? examples/think/.dev.vars

One git add -A away from a committed token, with no warning.

Expected behavior

.dev.vars is ignored at any depth, so the documented local-development workflow cannot leak credentials. The .dev.vars.example templates stay tracked, since they carry no secrets and are the thing users copy from.

Steps to reproduce

1. Follow examples/assets/.dev.vars.example: cp examples/assets/.dev.vars.example examples/assets/.dev.vars and fill in real credentials.
2. git status --short → the file appears as untracked, not ignored.
3. git check-ignore -v examples/assets/.dev.vars → no match.

Proposed fix

Add to .gitignore:

# Local secrets for `wrangler dev`. Every example documents putting
# Cloudflare API credentials in a .dev.vars file that wrangler reads
# from the example's directory; they must never be committed.
.dev.vars
**/.dev.vars

The pattern matches the exact filename, so both .dev.vars.example templates remain tracked. Verified against the current tree:

path	result
examples/assets/.dev.vars.example	tracked (correct)
examples/think-compare-runtimes/.dev.vars.example	tracked (correct)
examples/assets/.dev.vars	ignored (correct)
examples/think/.dev.vars	ignored (correct)
.dev.vars (root)	ignored (correct)

Patch on a branch if it is useful: https://github.com/3x3xX3N0N/computer/tree/fix/gitignore-dev-vars (single commit, one file, six added lines). Happy to open a PR if a maintainer asks — CONTRIBUTING.md says not to open one unsolicited.

Worth a separate look: git log -S".dev.vars" -- .gitignore shows no prior attempt, so this looks like an oversight rather than a deliberate choice.

Environment

• cloudflare/computer at 76d9e75 (current main)
• Reproduced on a clean checkout; not specific to any OS or runtime