bare-agent 0.16.1 → 0.16.2

package/bareagent.context.md

@@ -1,7 +1,7 @@
 # bareagent — Integration Guide
 
 > For AI assistants and developers wiring bareagent into a project.
-> v0.16.1 | Node.js >= 18 | one required dep (`bareguard ^0.4.2`) | Apache 2.0
+> v0.16.2 | Node.js >= 18 | one required dep (`bareguard ^0.4.2`) | Apache 2.0
 >
 > Full human guide with composition examples, design philosophy, and recipes: [Usage Guide](docs/02-features/usage-guide.md)
 
@@ -257,7 +257,9 @@ $HOME/IDE configs — NOT the project-cwd `./.mcp.json`** (v0.16.1): a checked-i
 config in an untrusted repo would otherwise auto-spawn arbitrary commands. To
 include the project config, pass `createMCPBridge({ includeProjectConfig: true })`,
 or a `confirmServer` hook (which implies it, since the hook vets every command).
-Explicitly-passed `configPaths` are honored verbatim. Pass `confirmServer(name,
+Explicitly-passed `configPaths` are honored verbatim. So you're not left guessing,
+discovery logs a one-line hint (v0.16.2) when a `./.mcp.json` is present but skipped —
+naming the opt-in — rather than silently ignoring it. Pass `confirmServer(name,
 def) => boolean` to approve each server **before its command is spawned** (return
 `false` to skip it; a throw fails closed). When no `confirmServer` is set, the
 bridge still trusts all *discovered* servers and prints a one-time warning naming

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bare-agent",
-  "version": "0.16.1",
+  "version": "0.16.2",
   "files": [
     "index.js",
     "index.d.ts",

package/src/mcp-bridge.js

@@ -89,7 +89,17 @@ function discoverServers(configPaths, { includeProjectConfig = false } = {}) {
     paths = TRUSTED_CONFIG_PATHS.map(fn => fn());
     // Project config kept at highest precedence (front) when explicitly opted in — preserves the
     // historical "project overrides home" ordering for callers that want it.
-    if (includeProjectConfig) paths.unshift(PROJECT_CONFIG_PATH());
+    if (includeProjectConfig) {
+      paths.unshift(PROJECT_CONFIG_PATH());
+    } else if (existsSync(PROJECT_CONFIG_PATH())) {
+      // Don't fail silently: a present-but-skipped project config is the common legitimate case
+      // (your own repo). Say so, and point at the opt-in — otherwise the servers just never appear
+      // and there's no on-screen reason why.
+      console.warn(
+        `[MCP Bridge] found ./.mcp.json but did not load it (untrusted-cwd default since v0.16.1). ` +
+        `Pass { includeProjectConfig: true } or a confirmServer hook to enable project-local servers.`,
+      );
+    }
   }
   /** @type {Map<string, ServerDef>} */
   const servers = new Map();