fix(client): honour explicit Path casing in stdio env on Windows

[sean-park-funda]

Fixes #2859.

The problem

Windows environment variables are case-insensitive, but an object spread is not:

env: {
    ...getDefaultEnvironment(),   // emits 'PATH'
    ...this._serverParams.env     // caller passes 'Path'
},

Both keys survive the merge. Node's child_process then resolves the duplicate by taking the first in sorted order, and PATH sorts before Path, so the inherited value reaches the child and the caller's configured one is silently dropped. Path is the casing Windows itself uses when listing process.env and in many config files, so callers hit this without doing anything unusual.

The change

mergeDefaultEnvironment drops an inherited default when the caller supplied the same variable under any casing — on win32 only. Off Windows, PATH and Path are genuinely two different variables and dropping either would be wrong, so the plain spread is kept there.

The helper is exported from src/client/stdio so the tests can reach it, but deliberately not added to the client/stdio subpath barrel: this is a fix, not a new public API.

On verification

I could not run the Windows repro from the issue — I am on macOS. What I did instead was pin the mechanism in a unit test and confirm it goes red without the fix:

AssertionError: expected [ 'PATH', 'Path' ] to deeply equal [ 'Path' ]

That is the duplicate-key state the issue describes, reproduced directly. The remaining step — that child_process prefers PATH once both keys are present — is the part I am taking from the issue's repro and Node's documented behaviour rather than having observed myself. Worth a maintainer with a Windows box confirming end to end before merge.

Platform is mocked with Object.defineProperty(process, 'platform', ...), matching the existing pattern in crossSpawn.test.ts.

Testing

Four cases in packages/client/test/client/stdio.test.ts: the undefined env copy, the win32 case-mismatch override, a win32 exact-case override with unrelated defaults preserved, and the POSIX case where both names must stay.

vitest run in packages/client — 38 files, 895 tests, all passing. pnpm typecheck, eslint and prettier --check clean. DEFAULT_INHERITED_ENV_VARS is untouched, so the stdioEnvPins behaviour-surface pins are unaffected. Changeset included (@modelcontextprotocol/client: patch).

---

This PR was authored by an AI agent at Vibement Inc. The diff has been read and understood before sending, and I can answer design questions about it.

[changeset-bot]

🦋 Changeset detected

Latest commit: 4365653

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/client	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/server	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2871

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2871

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2871

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2871

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2871

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2871

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2871

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2871

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2871

commit: 4365653