[arunim2405]

Problem

npx @stackguardian/mcp-wizard on Node 16 prints a few EBADENGINE warnings and starts normally. The browser sign-in, which is the default flow, then ends with fetch is not defined, after the user has already approved access in the browser.

Root cause

engines: { node: ">=18" } has been in package.json since the initial commit, but npm only warns about it (unless engine-strict is set), so nothing stops the CLI from running. exchangeCode in src/sg/oauth.ts defaults fetchImpl to the global fetch, which Node 16 does not have without a flag. That default is only evaluated when the token exchange runs, which is after the browser step.

Fix

• New npm bin src/cli.ts: checks process.versions.node and exits 1 with a clear message below Node 18, then dynamically imports src/index.ts.
• The check sits in a separate entry because esbuild inlines local modules below external imports, so a check imported at the top of index.ts would still run after commander, chalk and the others load.
• src/index.ts and the upstream files are unchanged. The standalone executable still builds from src/index.ts.
• CHANGELOG.md entry and version bump to 1.3.1, per AGENTS.md.

Message on Node 16:

add-sg-mcp needs Node.js 18 or later, and this is Node.js 16.20.2.
Upgrade Node.js, or install the standalone executable, which does not need Node.js:

  # macOS and Linux
  curl -fsSL https://dl.stackguardian.io/add-sg-mcp/install.sh | sh

  # Windows (PowerShell)
  irm https://dl.stackguardian.io/add-sg-mcp/install.ps1 | iex

More: https://github.com/StackGuardian/stackguardian-mcp#install

The install commands are the same one-liners as the README's Install section; a test fails if the two drift apart.

Behaviour change to check

--token installs happen to work on Node 16 today, because that path never calls fetch. This PR stops them too, along with status and list-agents. That matches engines and the bug thread, but it is a deliberate choice.

Tests

Check	Result
tests/sg-node-version.test.ts (new)	Failed before the fix (module missing), 5/5 pass after
bun run typecheck	Pass
bun run build	Pass
bun run test:unit	Pass, no failures
bun run test (unit + e2e)	1 failure: sg-login-tty "login in a terminal goes on to pick agents and install" times out locally. It times out the same way on untouched main (66070a0), so it is not caused by this change.
bun run fallow -- --summary	Repo-wide findings as before; none mention the new files

npm pack tarball run through npx on real Node binaries, with a throwaway HOME. Sign-in used a local stub broker, so no real token endpoint was involved:

Node	--version / status	Browser sign-in	--token install
16.20.2	Clear error, exit 1	Clear error before any browser step	Clear error, exit 1
18.20.8	OK	Token exchanged, credentials saved	OK, 6 skills
20.20.2	OK	Token exchanged, credentials saved	OK, 6 skills
22.23.4	OK	Token exchanged, credentials saved	OK, 6 skills

Not tested: Node 12/14 (no arm64 builds and no Rosetta on the test machine), Node 18.0–18.19, Node 24 and 26, and Linux/Windows.

Links

• RCA: https://app.notion.com/p/40b47be1d50a811cbd2efb88acc7a604
• Slack thread: https://stackguardian.slack.com/archives/C063KKVP5AP/p1793545489006529

🤖 Generated with Claude Code

[arunim2405]

🤖 AI review (GPT-6.1)

Verdict: looks good

stackguardian-mcp#28 — fix: refuse Node.js older than 18 before the CLI starts

No findings on head 12f923cf74f6e81991ab2e6245c86caf796766fa.

The npm entry point checks the runtime before dynamically importing the CLI. The packed build preserves that ordering and prints both standalone installation commands. Rejecting API-key installs and informational commands on older Node versions matches the declared >=18 requirement. Standalone binaries retain their existing entry point.

Tests

• Build, typecheck and all 18 unit-test files passed.
• Tested the npm tarball on Node 14.21.3 and 16.19.1 with dependencies absent: default invocation, login, version, status, agent listing and API-key installation all exited 1 with both install commands and no configuration writes.
• On Node 18.20.4, 20.19.6 and 22.16.0, version/help/status/list-agents and API-key installation passed; bundled skills installed successfully.
• Current CI and standalone smoke checks are green. Full e2e suite and browser OAuth were not rerun locally.
• Coverage gap: committed tests validate the helper and package wiring, but do not exercise early rejection through the built npm entry. That behavior was verified manually during this review.

_{Automated review generated from the StackGuardian PR-review automation. Comments only; it does not approve or block. Reply here if a finding is wrong.}