parallelsandbox-mcp 0.1.0 → 0.2.1

package/index.mjs

@@ -3,9 +3,10 @@
 // Every tool call is forwarded to https://mcp.parallelsandbox.com/mcp with the API key, except sandbox_sync,
 // which tars the local directory here and uploads it through POST /v1/boxes/{id}/sync.
 
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { existsSync, statSync } from "node:fs";
 import { resolve } from "node:path";
+import { Readable, Transform } from "node:stream";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -27,8 +28,11 @@ if (!API_KEY) {
 }
 
 const remote = new Client({ name: "parallelsandbox-mcp", version: "0.1.0" });
+// 同一個 headers 物件每次請求都會被讀到，所以握手拿到對方是誰之後直接塞進去。
+// 沒有這個，control 只知道「某個 API key 開了箱子」，人在 app 裡看不出是 Claude 還是 Codex 在用。
+const remoteHeaders = { Authorization: `Bearer ${API_KEY}` };
 const transport = new StreamableHTTPClientTransport(new URL(MCP_URL), {
-  requestInit: { headers: { Authorization: `Bearer ${API_KEY}` } },
+  requestInit: { headers: remoteHeaders },
 });
 
 async function connectRemote() {
@@ -40,7 +44,19 @@ function textResult(text, isError = false) {
   return { content: [{ type: "text", text }], isError };
 }
 
-// sandbox_sync runs here: tar the local directory and upload it to the box through control.
+// gitFileList 問 repo 自己：追蹤中的檔案加上沒被 .gitignore 忽略的新檔，NUL 分隔。
+// 這比固定黑名單準得多——開發者早就在 .gitignore 宣告過什麼是產物。實測 CubeLV 的 renderer：
+// 黑名單口徑 4,434 MB（ios/DerivedData、ios/App/build、android/.gradle、dist-web-public 全都跟著上傳），
+// git 口徑 18 MB。不是 git 工作區就回 null，退回黑名單。
+function gitFileList(src) {
+  const inRepo = spawnSync("git", ["-C", src, "rev-parse", "--is-inside-work-tree"], { encoding: "utf8" });
+  if (inRepo.status !== 0 || inRepo.stdout.trim() !== "true") return null;
+  const ls = spawnSync("git", ["-C", src, "ls-files", "-co", "--exclude-standard", "-z"], { maxBuffer: 512 * 1024 * 1024 });
+  if (ls.status !== 0) return null;
+  return ls.stdout;
+}
+
+// sandbox_sync runs here: tar the local directory and stream it to the box through control.
 async function sync(args) {
   const { id, localPath, dest } = args || {};
   if (!id || !localPath || !dest) {
@@ -50,25 +66,66 @@ async function sync(args) {
   if (!existsSync(src) || !statSync(src).isDirectory()) {
     return textResult(`local directory not found: ${src}`, true);
   }
-  const tar = spawnSync("tar", ["-czf", "-", "-C", src, ...SYNC_EXCLUDES.map((e) => `--exclude=${e}`), "."], { maxBuffer: 2 * 1024 * 1024 * 1024 });
-  if (tar.status !== 0) {
-    return textResult(`tar failed: ${tar.stderr?.toString() || tar.status}`, true);
+
+  const fileList = gitFileList(src);
+  const mode = fileList ? "git" : "excludes";
+  // 串流上傳，不把整包 tar 讀進記憶體：真實專案很容易超過幾 GB，buffer 起來會直接 OOM。
+  // COPYFILE_DISABLE=1：macOS 的 bsdtar 預設把每個檔的擴充屬性另存成 AppleDouble 成員（._foo），
+  // 在 Mac 上列檔會自己合回去所以看不出來，到 Linux 箱子裡就是一堆真的垃圾檔。
+  // 實測同步 CubeLV：4,160 個成員裡 2,063 個是這種，*.json 之類的 glob 會掃到二進位檔。
+  const tarEnv = { ...process.env, COPYFILE_DISABLE: "1" };
+  const tar = fileList
+    ? spawn("tar", ["-czf", "-", "-C", src, "--null", "-T", "-"], { env: tarEnv })
+    : spawn("tar", ["-czf", "-", "-C", src, ...SYNC_EXCLUDES.map((e) => `--exclude=${e}`), "."], { env: tarEnv });
+  if (fileList) {
+    tar.stdin.on("error", () => {});
+    tar.stdin.end(fileList);
   }
-  const res = await fetch(`${API_URL}/v1/boxes/${encodeURIComponent(id)}/sync?dest=${encodeURIComponent(dest)}`, {
-    method: "POST",
-    headers: { Authorization: `Bearer ${API_KEY}`, "Content-Type": "application/gzip" },
-    body: tar.stdout,
+  let uploaded = 0;
+  const counter = new Transform({
+    transform(chunk, _enc, cb) {
+      uploaded += chunk.length;
+      cb(null, chunk);
+    },
   });
-  const body = await res.text();
-  if (!res.ok) {
+  let tarErr = "";
+  tar.stderr.on("data", (d) => {
+    if (tarErr.length < 4096) tarErr += d.toString();
+  });
+  const exited = new Promise((res) => tar.on("close", res));
+
+  let response;
+  try {
+    response = await fetch(`${API_URL}/v1/boxes/${encodeURIComponent(id)}/sync?dest=${encodeURIComponent(dest)}`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${API_KEY}`, "Content-Type": "application/gzip" },
+      body: Readable.toWeb(tar.stdout.pipe(counter)),
+      duplex: "half",
+    });
+  } catch (err) {
+    tar.kill("SIGKILL");
+    return textResult(`sync failed while uploading: ${err?.message || err}${tarErr ? ` (tar: ${tarErr.trim()})` : ""}`, true);
+  }
+  const code = await exited;
+  const body = await response.text();
+  if (code !== 0) {
+    return textResult(`tar failed (exit ${code}): ${tarErr.trim() || "no output"}`, true);
+  }
+  if (!response.ok) {
     let message = body;
     try {
       message = JSON.parse(body).error || body;
     } catch {}
-    return textResult(`sync failed (HTTP ${res.status}): ${message}`, true);
+    return textResult(`sync failed (HTTP ${response.status}): ${message}`, true);
   }
-  const mb = (tar.stdout.length / 1024 / 1024).toFixed(1);
-  return textResult(JSON.stringify({ ok: true, dest, uploadedMB: Number(mb), excluded: SYNC_EXCLUDES }, null, 2));
+  const mb = Number((uploaded / 1024 / 1024).toFixed(1));
+  const how = mode === "git" ? "git tracked + untracked files, honouring .gitignore" : `denylist: ${SYNC_EXCLUDES.join(", ")}`;
+  // uploadedMB 對小專案永遠是 0，看起來像什麼都沒傳；bytes 與檔數才看得出成功。
+  const out = { ok: true, dest, uploadedBytes: uploaded, uploadedMB: mb, selected: how };
+  // fileList 是 git ls-files -z 的原始 bytes（不是字串：檔名不一定是合法 UTF-8，轉字串會壞掉），
+  // 所以檔數用數 NUL 分隔符算，不要用 split。
+  if (fileList) out.files = fileList.reduce((n, b) => (b === 0 ? n + 1 : n), 0);
+  return textResult(JSON.stringify(out, null, 2));
 }
 
 const server = new Server({ name: "parallelsandbox", version: "0.1.0" }, { capabilities: { tools: {} } });
@@ -78,7 +135,16 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
   return { tools };
 });
 
+// tellRemoteWhoIsCalling：把呼叫端 initialize 時報的名字轉給 control（X-Psbx-Client）。
+// 報不出來就不帶，control 那邊就不顯示，不猜。
+function tellRemoteWhoIsCalling() {
+  const who = server.getClientVersion?.();
+  if (!who?.name) return;
+  remoteHeaders["X-Psbx-Client"] = who.version ? `${who.name}/${who.version}` : who.name;
+}
+
 server.setRequestHandler(CallToolRequestSchema, async (req) => {
+  tellRemoteWhoIsCalling();
   const { name, arguments: args } = req.params;
   if (name === "sandbox_sync") {
     return sync(args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "parallelsandbox-mcp",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "stdio adapter for the ParallelSandbox MCP server: runs locally so sandbox_sync can upload your working directory",
   "type": "module",
   "bin": {