fix(mcp-builder): accumulate repeated -e/--env and -H/--header values - #1896

Closes #1895

The change

One file, two lines — skills/mcp-builder/scripts/evaluation.py lines 329 and 333:

-    stdio_group.add_argument("-e", "--env", nargs="+", help="Environment variables in KEY=VALUE format (stdio only)")
+    stdio_group.add_argument("-e", "--env", action="extend", nargs="+", help="Environment variables in KEY=VALUE format (stdio only)")
-    remote_group.add_argument("-H", "--header", nargs="+", dest="headers", help="HTTP headers in 'Key: Value' format (sse/http only)")
+    remote_group.add_argument("-H", "--header", action="extend", nargs="+", dest="headers", help="HTTP headers in 'Key: Value' format (sse/http only)")

nargs="+" with the default store action rebinds args.env / args.headers on
every occurrence, so repeating the flag discards everything before the last
occurrence. reference/evaluation.md tells users to repeat both flags
(:440-446 for -e, :454-459 for -H), and nothing reports the loss —
parse_env_vars() / parse_headers() only warn about malformed values, and
API_KEY=abc123 is well-formed.

Red / green, measured

Both runs use the same script and the same case table; the "red" file is
git show origin/main:skills/mcp-builder/scripts/evaluation.py extracted explicitly
(so it is not affected by the working tree). Only anthropic and connections are
stubbed — this box has no ANTHROPIC_API_KEY and neither dependency installed, so
the observable output is the argument set main() hands to create_connection().
origin/main's blob and the branch differ on exactly lines 329 and 333, verified by
line-by-line comparison.

CASE 1: two -e, as reference/evaluation.md:440-446 tells you to write it
  RED_main      env={'DEBUG': 'true'}                      <- API_KEY lost
  GREEN_branch  env={'API_KEY': 'abc123', 'DEBUG': 'true'}
CASE 2: two -H, as reference/evaluation.md:454-459 tells you to write it
  RED_main      headers={'X-Custom-Header': 'value'}        <- Authorization lost
  GREEN_branch  headers={'Authorization': 'Bearer token123', 'X-Custom-Header': 'value'}
CASE 3: REGRESSION - one -e carrying two values
  RED_main      env={'API_KEY': 'abc123', 'DEBUG': 'true'}
  GREEN_branch  env={'API_KEY': 'abc123', 'DEBUG': 'true'}   identical
CASE 4: MIXED - one -e with two values plus a second -e
  RED_main      env={'C': '3'}                              <- 2 of 3 lost
  GREEN_branch  env={'A': '1', 'B': '2', 'C': '3'}
CASE 5: REGRESSION - neither -e nor -H given
  RED_main      env=None headers=None
  GREEN_branch  env=None headers=None                        identical

Cases 1, 2 and 4 are the defect; 3 and 5 are the two shapes that already worked,
re-run to show extend adds rather than changes them. default=None is safe with
extend (case 5): argparse's _copy_items turns None into [] before extending,
and main() guards with if args.env / if args.headers.

$ python -m py_compile skills/mcp-builder/scripts/evaluation.py     # branch
py_compile OK
$ python -m py_compile evaluation_main.py                           # origin/main bytes
py_compile OK

action="extend" needs Python 3.8+; this module already requires 3.10+ (-> str | None at line 79, list[str]/dict[str, str] at 275/290), so it adds no floor.

Scope

-a/--args (line 328) has the same declaration and the same overwrite behaviour, but
no documented usage repeats -a, so it is left untouched here rather than changed on
speculation. It is named in #1895.

Also recorded in #1895 and deliberately not part of this diff: 4 of the 6
python scripts/evaluation.py ... lines in reference/evaluation.md exit with
error: the following arguments are required: eval_file before reaching this code,
because the last nargs="+" option eats the trailing positional. The minimal repair
there is prose (move the operand, or add --), so it is disclosed rather than
bundled. That is why the cases above put the XML file first — it is the shape that
parses on both main and the branch, so the comparison isolates this change.

Duplicates

24 open PRs touch this file (#657 #747 #1321 #1377 #1386 #1397 #1588 #1602 #1674
#1676 #1683 #1690 #1720 #1724 #1780 #1837–#1845); all 24 were re-confirmed open and
all 24 patches re-downloaded before filing. Grepping added/removed lines for the two
options and the two parse helpers, only #747 rewrites these declarations, and it is a
pure line-wrap reformat that keeps nargs="+" and adds no action= — the overwrite
survives it. No PR touches parse_headers() or parse_env_vars().