fix: intercept stdout writes to prevent JSON-RPC corruption in stdio mode (#673)

* fix: intercept process.stdout.write to prevent JSON-RPC corruption in stdio mode (#628, #627, #567)

Console method suppression alone was insufficient — native modules, n8n packages,
and third-party code can call process.stdout.write() directly, leaking debug output
(refCount, dbPath, clientVersion, protocolVersion, etc.) into the MCP JSON-RPC stream.

Added stdout write interceptor that only allows JSON-RPC messages through (objects
containing "jsonrpc" field). All other writes are redirected to stderr. This fixes
the flood of "Unexpected token is not valid JSON" warnings on every new Claude
Desktop chat.

Conceived by Romuald Członkowski - https://www.aiadvisors.pl/en

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: add Docker Hub login to fix buildx bootstrap rate limiting

GitHub-hosted runners hit Docker Hub anonymous pull limits when
setup-buildx-action pulls moby/buildkit. Add docker/login-action
for Docker Hub before setup-buildx-action in all 4 workflows:
docker-build.yml, docker-build-fast.yml, docker-build-n8n.yml, release.yml.

Uses DOCKERHUB_USERNAME and DOCKERHUB_TOKEN repository secrets.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/mcp/stdio-wrapper.ts

@@ -39,6 +39,25 @@ console.clear = () => {};
 console.count = () => {};
 console.countReset = () => {};
 
+// CRITICAL: Intercept process.stdout.write to prevent non-JSON-RPC output (#628, #627, #567)
+// Console suppression alone is insufficient — native modules (better-sqlite3), n8n packages,
+// and third-party code can call process.stdout.write() directly, corrupting the JSON-RPC stream.
+// Only allow writes that look like JSON-RPC messages; redirect everything else to stderr.
+const originalStdoutWrite = process.stdout.write.bind(process.stdout);
+const stderrWrite = process.stderr.write.bind(process.stderr);
+
+process.stdout.write = function (chunk: any, encodingOrCallback?: any, callback?: any): boolean {
+  const str = typeof chunk === 'string' ? chunk : chunk.toString();
+  // JSON-RPC messages are JSON objects with "jsonrpc" field — let those through
+  // The MCP SDK sends one JSON object per write call
+  const trimmed = str.trimStart();
+  if (trimmed.startsWith('{') && trimmed.includes('"jsonrpc"')) {
+    return originalStdoutWrite(chunk, encodingOrCallback, callback);
+  }
+  // Redirect everything else to stderr so it doesn't corrupt the protocol
+  return stderrWrite(chunk, encodingOrCallback, callback);
+} as typeof process.stdout.write;
+
 // Import and run the server AFTER suppressing output
 import { N8NDocumentationMCPServer } from './server';