Default EXCLUDE_PATTERNS in mcpb pack is too broad

[risc12]

Describe the bug

The default EXCLUDE_PATTERNS in mcpb pack include *.map and node_modules/.bin, both of which match real runtime code in some npm packages and silently exclude it from the packed .mcpb.

The result is a bundle that installs but crashes at module-load time.

Specifically:

• *.map matches any path ending in .map — including directories. Packages like es-iterator-helpers have directories named Iterator.prototype.map/ and Iterator.prototype.flatMap/ containing real .js files. These directories get excluded entirely, while sibling directories (Iterator.prototype.filter/, Iterator.prototype.find/, etc.) are kept.
• node_modules/.bin excludes all CLI shims. Some packages call existsSync(node_modules/.bin/) at module-load time (e.g. @salesforce/code-analyzer-retirejs-engine calls findCommand('retire') in its executor.js top-level) and throw if the file is missing.

To Reproduce
1. Create a Node MCP server that depends (transitively) on @salesforce/mcp (which pulls in both es-iterator-helpers and @salesforce/code-analyzer-retirejs-engine).
2. npm install
3. npx @anthropic-ai/mcpb pack
4. Install the resulting .mcpb in Claude Desktop and try to start the server.

Expected behavior

• *.map should only match sourcemap files (e.g. *.js.map, *.css.map), not arbitrary paths ending in .map.
• node_modules/.bin should not be excluded by default — many packages depend on its presence at module-load time.
• More generally: when a default ignore pattern matches a directory, the tool should not silently drop the directory's contents from the runtime bundle. At minimum, the docs should call out that defaults can shadow real package contents, and .mcpbignore negation patterns (!path) should reliably override defaults.

Logs
Server-side stderr at startup (captured to a file because Claude Desktop's wrapper drops child stderr):

    FATAL during import: Error: Cannot find module '.../node_modules/@salesforce/mcp/node_modules/es-iterator-helpers/Iterator.prototype.map/index.js'
        at createEsmNotFoundErr (node:internal/modules/cjs/loader:1520:15)
        at finalizeEsmResolution (node:internal/modules/cjs/loader:1509:9)
        ...

The packed .mcpb reports ignored (.mcpbignore) files: 22194 for a server that should only need a few hundred test/doc files excluded which is the surface symptom that something's off.

Confirmed by listing the archive:

    $ unzip -l my-server.mcpb | grep "Iterator.prototype.flatMap/" | wc -l
    5
    $ unzip -l my-server.mcpb | grep "Iterator.prototype.map/" | wc -l
    0

Additional context

• mcpb version: 2.1.2 (npx @anthropic-ai/mcpb@latest at time of writing).
• Default patterns live in dist/node/files.js (EXCLUDE_PATTERNS), applied via the ignore npm package alongside user-supplied .mcpbignore patterns in buildIgnoreChecker.
• Workarounds I'm using locally:
  a. Custom .mcpbignore with explicit negations: !/Iterator.prototype.map, !/Iterator.prototype.map/, !/node_modules/.bin, !/node_modules/.bin/. Even with negations,
  the gitignore-style traversal doesn't always recurse into a previously-excluded directory, so this is finicky and depends on internal pattern ordering.
  b. A postinstall script that dereferences .bin/* symlinks into real files (Claude Desktop strips symlinks when copying unpacked extensions, separate but related issue).
• Suggested fixes, ordered by impact:
  a. Tighten *.map → *.js.map, *.cjs.map, *.mjs.map, *.css.map, *.ts.map. This alone fixes es-iterator-helpers and any other package with .map-suffixed directories.
  b. Remove node_modules/.bin from defaults. It's almost always needed at runtime; users who don't want it can add it to their own .mcpbignore.
  c. Surface a warning when a default pattern matches a directory containing .js/.cjs/.mjs files — these are very likely false positives.
  d. Document the default exclude list and .mcpbignore semantics (especially negation behavior) in the README.