@firenet-designs/fnd-cli 2.3.3 → 2.6.0

package/dist/lib/workspace.d.ts

@@ -1,3 +1,4 @@
+import type { RpcConfig } from './rpc.js';
 /**
  * Mutagen-backed workspace helpers.
  *
@@ -30,12 +31,15 @@ export interface SshTarget {
     host: string;
     user: string;
 }
-export interface DevtoolsPorts {
-    /** Remote-debugging port of the browser on the caller's LOCAL machine. */
+/** A reverse-tunnel port pair: `ssh -R <remote>:localhost:<local>`. */
+export interface PortPair {
+    /** Port on the caller's LOCAL machine (the tunnel destination). */
     local: number;
-    /** Port opened on the REMOTE (via `ssh -R`) that tunnels back to the local browser. */
+    /** Port opened on the REMOTE (via `ssh -R`) that tunnels back to the local port. */
     remote: number;
 }
+/** For --devtools: `local` is the browser's remote-debugging port on the caller's machine. */
+export type DevtoolsPorts = PortPair;
 /**
  * Which side wins when the same path changed on both ends since the last sync.
  * `remote` = this server (the box where the workspace shell runs); `local` = the
@@ -47,6 +51,8 @@ export type SyncSource = 'local' | 'remote';
 export interface WorkspaceContext {
     /** Chrome DevTools MCP tunnel, when --devtools was passed; undefined otherwise. */
     devtools?: DevtoolsPorts;
+    /** Mutagen ignore patterns derived from the project's .gitignore files (--ignore-vcs); undefined syncs everything. */
+    ignores?: string[];
     /** Absolute path of the current dir on the LOCAL machine (one side of the sync). */
     localCwd: string;
     /** Basename of the local cwd — the leaf of the remote directory path. */
@@ -55,6 +61,8 @@ export interface WorkspaceContext {
     localUser: string;
     /** Where the mirror lives on the REMOTE, e.g. /home/fnd/<localUser>/<localDirName>. */
     remoteDir: string;
+    /** Local-command RPC server + tunnel, when --rpc was passed; undefined otherwise. */
+    rpc?: RpcConfig;
     /** Which endpoint wins conflicts (the Mutagen alpha in two-way-resolved); undefined flags conflicts instead. */
     source?: SyncSource;
     /** Unique Mutagen session name for this workspace. */
@@ -72,18 +80,48 @@ export declare const slugify: (value: string) => string;
 /** A unique Mutagen session name for a workspace on the given local directory. */
 export declare const buildSyncName: (dirName: string) => string;
 /**
- * Parse the --devtools value. Accepts `port` (same port on both ends) or
- * `remote:local`, where `local` is the caller's machine (where the browser runs)
- * and `remote` is the port opened on the workspace host.
+ * Parse a reverse-tunnel port value. Accepts `port` (same port on both ends) or
+ * `remote:local`, where `local` is the caller's machine and `remote` is the
+ * port opened on the workspace host. `flag` names the flag in error messages.
  */
-export declare const parseDevtoolsPort: (raw: string) => DevtoolsPorts;
+export declare const parsePortPair: (raw: string, flag: string) => PortPair;
 /** Build the immutable facts for a workspace session from the local environment + flags. */
 export declare const buildContext: (opts: {
     cwd: string;
     devtools?: DevtoolsPorts;
+    ignoreVcs?: boolean;
     remoteBase: string;
+    rpc?: RpcConfig;
     source?: SyncSource;
 }) => WorkspaceContext;
+/**
+ * Translate one .gitignore line into Mutagen ignore patterns. `base` is the
+ * directory holding the .gitignore, as a posix path relative to the sync root
+ * ('' for the root file). Mutagen's syntax already matches gitignore's for the
+ * pieces that pass through untouched (`*`, `**`, `?`, `[...]`, `!` negation,
+ * trailing `/` for directory-only) — what needs translating is scope:
+ *
+ * - A pattern with a slash is anchored to the .gitignore's own directory, so it
+ *   becomes an absolute pattern under `base` (`/dist` in src/.gitignore →
+ *   `/src/dist`).
+ * - A slashless pattern matches at any depth AT OR BELOW `base`. At the root
+ *   that is exactly Mutagen's unanchored behavior, so it passes through as-is;
+ *   under a subdirectory it becomes `/base/p` plus `/base/**\/p` (both forms, so
+ *   the match doesn't depend on `**` matching zero segments).
+ *
+ * Returns [] for blanks and comments.
+ */
+export declare const translateGitignoreLine: (line: string, base: string) => string[];
+/**
+ * Walk the project and turn every .gitignore into Mutagen ignore patterns, each
+ * resolved relative to the directory of the .gitignore that declared it. Files
+ * are ordered root-first so deeper .gitignore patterns come later — Mutagen
+ * gives later patterns precedence, which mirrors git. `.git` and `node_modules`
+ * are never descended into (git does not consult .gitignore files inside
+ * ignored or metadata directories), and symlinked directories are skipped to
+ * avoid cycles.
+ */
+export declare const collectVcsIgnores: (rootDir: string) => string[];
 /** POSIX single-quote a string so it can be embedded safely in the remote shell script. */
 export declare const shQuote: (value: string) => string;
 /**
@@ -98,17 +136,27 @@ export interface RemoteCleanupOptions {
     deleteRemoteDir?: boolean;
     /** Strip this project's chrome-devtools MCP entry — only when the workspace registered one (--devtools). */
     removeDevtoolsMcp?: boolean;
+    /** Strip this project's local-shell MCP entry — only when the workspace registered one (--rpc). */
+    removeRpcMcp?: boolean;
 }
-/** Run the remote-side teardown over a fresh ssh connection. */
+/**
+ * Run the remote-side teardown over a fresh ssh connection. Forces a remote PTY
+ * with `-tt`: the MCP-remove step runs under an *interactive* login shell
+ * (`$SHELL -lic`, so `claude2` aliases in rc files resolve — see
+ * `claudeMcpRemoveScript`), and an interactive bash without a PTY prints
+ * "cannot set terminal process group / no job control in this shell". `-tt`
+ * forces allocation even when this cleanup runs without a local TTY, mirroring
+ * the `-t` the interactive session ssh uses.
+ */
 export declare const runRemoteCleanup: (target: string, remoteDir: string, opts?: RemoteCleanupOptions) => Promise<number>;
 /**
  * The remote-side teardown script. Runs from inside the workspace dir so the
  * `claude` CLI's local scope resolves to the right project. The chrome-devtools
- * MCP entry is stripped only when `removeDevtoolsMcp` is set — i.e. when the
- * workspace registered one via --devtools; without it we never touch the user's
- * MCP config. The synced files themselves are left in place — they are a real
- * copy, not a mount — unless `deleteRemoteDir` is set, in which case the
- * workspace dir is removed after any MCP config is stripped.
+ * and local-shell MCP entries are stripped only when their flags are set — i.e.
+ * when the workspace registered them via --devtools / --rpc; without them we
+ * never touch the user's MCP config. The synced files themselves are left in
+ * place — they are a real copy, not a mount — unless `deleteRemoteDir` is set,
+ * in which case the workspace dir is removed after any MCP config is stripped.
  */
 export declare const buildCleanupScript: (remoteDir: string, opts?: RemoteCleanupOptions) => string;
 /** True if an `ssh` client is on PATH (works on Windows, macOS, Linux). */
@@ -121,7 +169,9 @@ export declare const hasMutagen: () => boolean;
  * winner. When a `source` is given, it becomes the Mutagen alpha endpoint and
  * the mode switches to two-way-resolved (alpha always wins conflicts), so
  * `--source remote` puts the server first and `--source local` puts this
- * machine first. Labels let `workspace cleanup` find and terminate orphans.
+ * machine first. Labels let `workspace --cleanup` find and terminate orphans.
+ * `ctx.ignores` (from --ignore-vcs) excludes gitignored paths from the sync so
+ * each side keeps its own build artifacts and platform-specific binaries.
  */
 export declare const buildMutagenCreateArgs: (ctx: WorkspaceContext, target: string) => string[];
 /** Arguments for `mutagen sync flush <name>` — block until one full sync completes. */

package/dist/lib/workspace.js

@@ -1,7 +1,8 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { randomInt } from 'node:crypto';
+import { readdirSync, readFileSync } from 'node:fs';
 import { userInfo } from 'node:os';
-import { basename } from 'node:path';
+import { basename, join } from 'node:path';
 export const DEFAULT_MOUNT_BASE = '/home/fnd';
 /** Parse a `user@host` string, throwing a friendly error otherwise. */
 export const parseSshTarget = (raw) => {
@@ -23,15 +24,15 @@ export const slugify = (value) => value
 /** A unique Mutagen session name for a workspace on the given local directory. */
 export const buildSyncName = (dirName) => `fnd-ws-${slugify(dirName)}-${randomInt(0, 1_000_000).toString(36)}`;
 /**
- * Parse the --devtools value. Accepts `port` (same port on both ends) or
- * `remote:local`, where `local` is the caller's machine (where the browser runs)
- * and `remote` is the port opened on the workspace host.
+ * Parse a reverse-tunnel port value. Accepts `port` (same port on both ends) or
+ * `remote:local`, where `local` is the caller's machine and `remote` is the
+ * port opened on the workspace host. `flag` names the flag in error messages.
  */
-export const parseDevtoolsPort = (raw) => {
+export const parsePortPair = (raw, flag) => {
     const toPort = (value) => {
         const n = Number(value);
         if (!Number.isInteger(n) || n < 1 || n > 65_535) {
-            throw new Error(`--devtools port must be an integer 1-65535 (got "${value}")`);
+            throw new Error(`${flag} port must be an integer 1-65535 (got "${value}")`);
         }
         return n;
     };
@@ -43,7 +44,7 @@ export const parseDevtoolsPort = (raw) => {
     if (parts.length === 2) {
         return { local: toPort(parts[1]), remote: toPort(parts[0]) };
     }
-    throw new Error(`--devtools must be "port" or "remote:local" (got "${raw}")`);
+    throw new Error(`${flag} port must be "port" or "remote:local" (got "${raw}")`);
 };
 /** Build the immutable facts for a workspace session from the local environment + flags. */
 export const buildContext = (opts) => {
@@ -54,18 +55,131 @@ export const buildContext = (opts) => {
     const remoteDir = `${base}/${localUser}/${localDirName}`;
     return {
         devtools: opts.devtools,
+        ignores: opts.ignoreVcs ? collectVcsIgnores(localCwd) : undefined,
         localCwd,
         localDirName,
         localUser,
         remoteDir,
+        rpc: opts.rpc,
         source: opts.source,
         syncName: buildSyncName(localDirName),
     };
 };
+/**
+ * Translate one .gitignore line into Mutagen ignore patterns. `base` is the
+ * directory holding the .gitignore, as a posix path relative to the sync root
+ * ('' for the root file). Mutagen's syntax already matches gitignore's for the
+ * pieces that pass through untouched (`*`, `**`, `?`, `[...]`, `!` negation,
+ * trailing `/` for directory-only) — what needs translating is scope:
+ *
+ * - A pattern with a slash is anchored to the .gitignore's own directory, so it
+ *   becomes an absolute pattern under `base` (`/dist` in src/.gitignore →
+ *   `/src/dist`).
+ * - A slashless pattern matches at any depth AT OR BELOW `base`. At the root
+ *   that is exactly Mutagen's unanchored behavior, so it passes through as-is;
+ *   under a subdirectory it becomes `/base/p` plus `/base/**\/p` (both forms, so
+ *   the match doesn't depend on `**` matching zero segments).
+ *
+ * Returns [] for blanks and comments.
+ */
+export const translateGitignoreLine = (line, base) => {
+    // Trailing whitespace is meaningless unless backslash-escaped.
+    let p = line.replace(/(?<![\\])[ \t]+$/, '');
+    if (p === '' || p.startsWith('#'))
+        return [];
+    let negated = false;
+    if (p.startsWith('!')) {
+        negated = true;
+        p = p.slice(1);
+    }
+    else if (p.startsWith(String.raw `\!`) || p.startsWith(String.raw `\#`)) {
+        p = p.slice(1);
+    }
+    let dirOnly = false;
+    if (p.endsWith('/')) {
+        dirOnly = true;
+        p = p.replace(/\/+$/, '');
+    }
+    const anchored = p.includes('/');
+    p = p.replace(/^\/+/, '');
+    if (p === '')
+        return [];
+    const withBase = (rel) => `/${[base, rel].filter(Boolean).join('/')}`;
+    const targets = anchored ? [withBase(p)] : base === '' ? [p] : [withBase(p), withBase(`**/${p}`)];
+    return targets.map((t) => `${negated ? '!' : ''}${t}${dirOnly ? '/' : ''}`);
+};
+/**
+ * Walk the project and turn every .gitignore into Mutagen ignore patterns, each
+ * resolved relative to the directory of the .gitignore that declared it. Files
+ * are ordered root-first so deeper .gitignore patterns come later — Mutagen
+ * gives later patterns precedence, which mirrors git. `.git` and `node_modules`
+ * are never descended into (git does not consult .gitignore files inside
+ * ignored or metadata directories), and symlinked directories are skipped to
+ * avoid cycles.
+ */
+export const collectVcsIgnores = (rootDir) => {
+    const found = [];
+    const walk = (dir, base) => {
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return; // unreadable dir — nothing to collect there
+        }
+        for (const entry of entries) {
+            if (entry.isDirectory()) {
+                if (entry.name === '.git' || entry.name === 'node_modules')
+                    continue;
+                walk(join(dir, entry.name), base === '' ? entry.name : `${base}/${entry.name}`);
+            }
+            else if (entry.name === '.gitignore') {
+                found.push({ base });
+            }
+        }
+    };
+    walk(rootDir, '');
+    found.sort((a, b) => a.base.split('/').filter(Boolean).length - b.base.split('/').filter(Boolean).length);
+    return found.flatMap(({ base }) => {
+        let content;
+        try {
+            content = readFileSync(join(rootDir, ...base.split('/').filter(Boolean), '.gitignore'), 'utf8');
+        }
+        catch {
+            return [];
+        }
+        return content.split('\n').flatMap((line) => translateGitignoreLine(line, base));
+    });
+};
 /** POSIX single-quote a string so it can be embedded safely in the remote shell script. */
 export const shQuote = (value) => `'${value.replaceAll("'", `'\\''`)}'`;
 /** MCP server name registered for the workspace's chrome-devtools tunnel. */
 const DEVTOOLS_MCP_NAME = 'chrome-devtools';
+/** MCP server name registered for the --rpc local-command tunnel. */
+const RPC_MCP_NAME = 'local-shell';
+/**
+ * The `claude` CLIs an MCP entry is registered with / removed from. `claude2` is
+ * an overflow instance some remotes run alongside `claude`; both need the same
+ * project-local MCP config so whichever the user opens sees the workspace tools.
+ * Each is guarded by its own `command -v` — a remote without a given CLI just
+ * skips it. Keep add and remove over the same list so cleanup is complete.
+ *
+ * These are emitted as LITERAL command words, never `for cli in …; do "$cli" …`.
+ * On some remotes `claude2` is a shell *alias* (defined in ~/.bashrc / ~/.zshrc),
+ * and aliases are only expanded when the command word is a literal read by the
+ * parser — an alias never expands from a variable like `"$cli"`. Alias support is
+ * also why the add/remove blocks run under an *interactive* login shell (see the
+ * `-lic` note below): rc files, where the alias lives, are sourced only for
+ * interactive shells.
+ */
+const CLAUDE_CLIS = ['claude', 'claude2'];
+/**
+ * Emit a guarded per-CLI block for each entry in {@link CLAUDE_CLIS}. `cli` is
+ * interpolated literally (not via a variable) so a shell-alias `claude2` still
+ * expands. `command -v` gates each one so a remote missing a CLI just skips it;
+ * `body(cli)` returns the lines to run inside the guard.
+ */
+const forEachClaudeCli = (body) => CLAUDE_CLIS.flatMap((cli) => [`if command -v ${cli} >/dev/null 2>&1; then`, ...body(cli).map((l) => `  ${l}`), 'fi']);
 /**
  * Bash lines (run on the REMOTE, from inside the workspace dir) that register the
  * chrome-devtools MCP with the `claude` CLI. Local scope keys off the current
@@ -73,33 +187,60 @@ const DEVTOOLS_MCP_NAME = 'chrome-devtools';
  * A prior entry is cleared first so a re-connect after a crashed session is
  * idempotent. Skips gracefully if the claude CLI is missing.
  *
- * The block runs inside a login shell (`$SHELL -lc`): the outer script arrives as
- * a non-login ssh command whose PATH lacks the node/nvm/volta/Homebrew dirs that
- * login profiles add, so a bare `command -v claude` misses an installed CLI. A
- * login shell reproduces the same PATH the interactive session below gets.
+ * The block runs inside an *interactive* login shell (`$SHELL -lic`). Login (`-l`)
+ * because the outer script arrives as a non-login ssh command whose PATH lacks the
+ * node/nvm/volta/Homebrew dirs that login profiles add, so a bare `command -v
+ * claude` would miss an installed CLI. Interactive (`-i`) because on some remotes
+ * `claude2` is a shell alias defined in ~/.bashrc / ~/.zshrc, and those rc files
+ * are sourced only for interactive shells — a plain `-lc` command shell never sees
+ * the alias. The `ssh -t` PTY is what lets `-i` run without job-control warnings.
  */
 const claudeDevtoolsAddScript = (remotePort, okMessage) => {
     const body = [
-        'if command -v claude >/dev/null 2>&1; then',
-        `  claude mcp remove ${DEVTOOLS_MCP_NAME} >/dev/null 2>&1 || true`,
-        `  claude mcp add ${DEVTOOLS_MCP_NAME} -- npx -y chrome-devtools-mcp@latest --browserUrl http://127.0.0.1:${remotePort}`,
-        `  echo ${shQuote(okMessage)}`,
-        'else',
-        '  echo "WARNING: claude CLI not found on the remote; skipped chrome-devtools MCP config." >&2',
-        'fi',
+        'configured=""',
+        ...forEachClaudeCli((cli) => [
+            `${cli} mcp remove ${DEVTOOLS_MCP_NAME} >/dev/null 2>&1 || true`,
+            `${cli} mcp add ${DEVTOOLS_MCP_NAME} -- npx -y chrome-devtools-mcp@latest --browserUrl http://127.0.0.1:${remotePort}`,
+            'configured=1',
+        ]),
+        `if [ -n "$configured" ]; then echo ${shQuote(okMessage)}; else echo "WARNING: claude CLI not found on the remote; skipped chrome-devtools MCP config." >&2; fi`,
     ].join('\n');
-    return [`"\${SHELL:-bash}" -lc ${shQuote(body)}`];
+    return [`"\${SHELL:-bash}" -lic ${shQuote(body)}`];
 };
 /**
- * Bash lines (run on the REMOTE, from inside the workspace dir) that remove the
- * chrome-devtools MCP this workspace registered. Local scope keys off the current
+ * Bash lines (run on the REMOTE, from inside the workspace dir) that register the
+ * --rpc local-shell MCP with the `claude` CLI as a Streamable HTTP server. The
+ * URL points at the reverse-tunnelled port, which the workspace's `ssh -R`
+ * forwards back to the RPC server on the calling machine. Same login-shell and
+ * idempotency reasoning as `claudeDevtoolsAddScript`.
+ */
+const claudeRpcAddScript = (remotePort, okMessage) => {
+    const body = [
+        'configured=""',
+        ...forEachClaudeCli((cli) => [
+            `${cli} mcp remove ${RPC_MCP_NAME} >/dev/null 2>&1 || true`,
+            `${cli} mcp add --transport http ${RPC_MCP_NAME} http://127.0.0.1:${remotePort}/mcp`,
+            'configured=1',
+        ]),
+        `if [ -n "$configured" ]; then echo ${shQuote(okMessage)}; else echo "WARNING: claude CLI not found on the remote; skipped local-shell MCP config." >&2; fi`,
+    ].join('\n');
+    return [`"\${SHELL:-bash}" -lic ${shQuote(body)}`];
+};
+/**
+ * Bash lines (run on the REMOTE, from inside the workspace dir) that remove an
+ * MCP entry this workspace registered. Local scope keys off the current
  * directory, so it targets only the workspace project. No-op if the entry or the
  * claude CLI is absent. Runs under a login shell for the same PATH reason as
  * `claudeDevtoolsAddScript`.
  */
-const claudeDevtoolsRemoveScript = () => {
-    const body = ['if command -v claude >/dev/null 2>&1; then', `  claude mcp remove ${DEVTOOLS_MCP_NAME}`, 'fi'].join('\n');
-    return [`"\${SHELL:-bash}" -lc ${shQuote(body)}`];
+const claudeMcpRemoveScript = (name) => {
+    const body = forEachClaudeCli((cli) => [
+        // Tolerate failure: if the entry was never registered (or already gone) the
+        // remove exits non-zero — that's success for us, so never let it abort the
+        // rest of the teardown (dir deletion, the other CLI, …).
+        `${cli} mcp remove ${name} >/dev/null 2>&1 || true`,
+    ]).join('\n');
+    return [`"\${SHELL:-bash}" -lic ${shQuote(body)}`];
 };
 /**
  * The bash script the remote runs for the interactive session. Mutagen already
@@ -111,38 +252,51 @@ export const buildRemoteScript = (ctx) => {
     const devtoolsSetup = ctx.devtools
         ? claudeDevtoolsAddScript(ctx.devtools.remote, `Configured chrome-devtools MCP for this workspace (browser via 127.0.0.1:${ctx.devtools.remote}).`)
         : [];
+    const rpcSetup = ctx.rpc
+        ? claudeRpcAddScript(ctx.rpc.ports.remote, `Configured local-shell MCP for this workspace (runs ${ctx.rpc.shell} commands on the calling machine via 127.0.0.1:${ctx.rpc.ports.remote}).`)
+        : [];
     return [
         'set -u',
         `DIR=${dir}`,
         // Mutagen creates the sync root, but ensure it exists so `cd` never races it.
         'mkdir -p "$DIR" || { echo "ERROR: could not create $DIR" >&2; exit 1; }',
         'cd "$DIR" || { echo "ERROR: could not enter $DIR" >&2; exit 1; }',
-        // Register the MCP from inside $DIR: `claude mcp add` local scope keys off cwd.
+        // Register the MCPs from inside $DIR: `claude mcp add` local scope keys off cwd.
         ...devtoolsSetup,
+        ...rpcSetup,
         'echo "Workspace ready at $DIR — files sync in the background (exit to stop syncing)."',
         // eslint-disable-next-line no-template-curly-in-string -- shell parameter expansion, not a JS template
         '"${SHELL:-bash}" -l',
     ].join('\n');
 };
-/** Run the remote-side teardown over a fresh ssh connection. */
+/**
+ * Run the remote-side teardown over a fresh ssh connection. Forces a remote PTY
+ * with `-tt`: the MCP-remove step runs under an *interactive* login shell
+ * (`$SHELL -lic`, so `claude2` aliases in rc files resolve — see
+ * `claudeMcpRemoveScript`), and an interactive bash without a PTY prints
+ * "cannot set terminal process group / no job control in this shell". `-tt`
+ * forces allocation even when this cleanup runs without a local TTY, mirroring
+ * the `-t` the interactive session ssh uses.
+ */
 export const runRemoteCleanup = (target, remoteDir, opts = {}) => new Promise((resolve, reject) => {
-    const child = spawn('ssh', [target, buildCleanupScript(remoteDir, opts)], { stdio: 'inherit' });
+    const child = spawn('ssh', ['-tt', target, buildCleanupScript(remoteDir, opts)], { stdio: 'inherit' });
     child.once('error', reject);
     child.once('close', (code) => resolve(code ?? 0));
 });
 /**
  * The remote-side teardown script. Runs from inside the workspace dir so the
  * `claude` CLI's local scope resolves to the right project. The chrome-devtools
- * MCP entry is stripped only when `removeDevtoolsMcp` is set — i.e. when the
- * workspace registered one via --devtools; without it we never touch the user's
- * MCP config. The synced files themselves are left in place — they are a real
- * copy, not a mount — unless `deleteRemoteDir` is set, in which case the
- * workspace dir is removed after any MCP config is stripped.
+ * and local-shell MCP entries are stripped only when their flags are set — i.e.
+ * when the workspace registered them via --devtools / --rpc; without them we
+ * never touch the user's MCP config. The synced files themselves are left in
+ * place — they are a real copy, not a mount — unless `deleteRemoteDir` is set,
+ * in which case the workspace dir is removed after any MCP config is stripped.
  */
 export const buildCleanupScript = (remoteDir, opts = {}) => [
     `DIR=${shQuote(remoteDir)}`,
     'cd "$DIR" 2>/dev/null || { echo "Nothing to clean up: $DIR is gone." >&2; exit 0; }',
-    ...(opts.removeDevtoolsMcp ? claudeDevtoolsRemoveScript() : []),
+    ...(opts.removeDevtoolsMcp ? claudeMcpRemoveScript(DEVTOOLS_MCP_NAME) : []),
+    ...(opts.removeRpcMcp ? claudeMcpRemoveScript(RPC_MCP_NAME) : []),
     // Remove the workspace dir last: cd out first so we don't rm the cwd out from
     // under the shell, then delete it. Only when explicitly requested.
     ...(opts.deleteRemoteDir
@@ -168,7 +322,9 @@ export const hasMutagen = () => {
  * winner. When a `source` is given, it becomes the Mutagen alpha endpoint and
  * the mode switches to two-way-resolved (alpha always wins conflicts), so
  * `--source remote` puts the server first and `--source local` puts this
- * machine first. Labels let `workspace cleanup` find and terminate orphans.
+ * machine first. Labels let `workspace --cleanup` find and terminate orphans.
+ * `ctx.ignores` (from --ignore-vcs) excludes gitignored paths from the sync so
+ * each side keeps its own build artifacts and platform-specific binaries.
  */
 export const buildMutagenCreateArgs = (ctx, target) => {
     const local = ctx.localCwd;
@@ -184,6 +340,7 @@ export const buildMutagenCreateArgs = (ctx, target) => {
         '--label=managed-by=fnd-workspace',
         `--label=dir=${slugify(ctx.localDirName)}`,
         `--sync-mode=${syncMode}`,
+        ...(ctx.ignores ?? []).map((p) => `--ignore=${p}`),
         alpha,
         beta,
     ];