docbrain-mcp 1.6.0 → 1.6.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docbrain-mcp",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "DocBrain MCP server — query your documentation from Claude Code, Cursor, and any MCP-compatible editor",
   "homepage": "https://github.com/docbrain-ai/docbrain",
   "repository": {

package/run.js

@@ -7,10 +7,34 @@ const path = require("path");
 
 const binary = path.join(__dirname, "bin", "docbrain-mcp");
 
+// Node acts on these options itself, even after this script's path and even where they read as
+// another flag's value: it reads the named file (and runs NODE_OPTIONS from it) or a config file
+// before any line here runs. Versions differ: run here, Node 20.20 and 22.23 act on the env-file
+// options before a "--", 22.23 and 26 also on the config-file options even after "--" (and 22.23
+// on --experimental-default-config-file by prefix), and Node 16 on none; Node's source shows
+// 20.6-22.6 matching --env-file by prefix without stopping at "--". So any argument that starts
+// with one of them is refused, wherever it is (--env-file-if-exists starts with --env-file). This wrapper cannot undo what Node did, but it
+// never starts DocBrain with one of them (#603): the file DocBrain reads is named with
+// --docbrain-env, which Node ignores. Nothing typed is echoed: a value may be a key.
+const NODE_READS = ["--env-file", "--experimental-config-file", "--experimental-default-config-file"];
+
+function nodeReads(args) {
+  return args.some((arg) => NODE_READS.some((flag) => arg.startsWith(flag)));
+}
+
+if (nodeReads(process.argv.slice(2))) {
+  console.error(
+    "docbrain-mcp: refusing to start: Node reads --env-file and its config-file options itself. " +
+      "Name DocBrain's file with --docbrain-env instead."
+  );
+  process.exit(2);
+}
+
 // npm 12 turned lifecycle scripts off by default, so the postinstall hook that
 // fetches this binary may never have run — and `npx -y docbrain-mcp@latest`,
-// which is how the MCP setup instructions tell people to launch this, goes
-// through exactly that path. Fetching on first use covers it.
+// which older setup instructions used to launch this, goes through exactly
+// that path. (The docs now say to start the installed command: npx reads the
+// open project's .npmrc, #603.) Fetching on first use covers it.
 //
 // Deliberately synchronous, before the spawn below. This runs once, at startup,
 // before any MCP traffic exists to delay; doing it asynchronously would mean