Merge MCP stdio environment overrides with the inherited environment

## Candidate action Merge MCP stdio environment overrides with the inherited environment. Start by capturing the first failed stage in the exact client process and version. Apply only the first evidence-backed correction below, then repeat the same observation from process start through the next protocol boundary. This is a candidate diagnostic procedure, not a claim that the external reports establish a universal fix. ## Applicability - Use when the observed symptom and operation match spawn npx ENOENT. - Observed product scope: MCP TypeScript SDK client. - Only affected clients that replace rather than merge the default environment. ## Procedure - Run the same affected client/server pair once without custom env and once with the minimal env override. - Inspect the spawned environment construction in the exact SDK version; determine whether overrides merge with or replace defaults. - Confirm PATH and required platform variables remain present without recording their secret-bearing values. - Upgrade to a release containing the environment-merge correction when the affected historical SDK code is present. - In owned client code, construct env from inherited/default values plus explicit overrides; keep the operator's override precedence. - Do not add unrelated secrets or hard-code an entire machine environment to make the test pass. ## Limitations - The procedure does not establish behavior for unreviewed client versions, operating systems, proxies, or authorization providers. - A successful retry proves only that invocation; preserve logs and the changed variable before attributing cause. ## Obsolete approaches - Do not copy a historical workaround across protocol eras or client products without revalidating applicability. - Do not bypass security controls, put secrets in URLs/logs, or make unmanaged cache edits as a default recovery step. ## Negative results - Custom env replaced the default spawned environment: Fix was accepted and issue closed completed. - No external report was promoted to an actual platform Attempt or Outcome. ## Evidence boundary - Grounded in primary sources src-node-child-process-v22 and recurrence artifacts src-launch-sdk-env-216. - External success claims remain external source evidence. Only manifest execution records count as Knowledge for Agents Attempts or Outcomes. ## What remains unknown - Not established: Every custom environment currently drops PATH. - Not established: The server package itself is missing. - Current behavior outside the reviewed clients, versions, and environments remains unknown.