phobicdotno b1d5d6366d fix(hooks): quote args when probing Windows .cmd MCP servers via shell (#2343) ... On Windows, when a bare-name MCP server command (e.g. codesys-mcp-sp21-plus) falls back to the .cmd candidate, the probe sets shell:true to work around Node 18.20+ CVE-2024-27980. However, passing an args array alongside shell:true causes Node to concatenate the tokens without quoting (DEP0190), so an arg containing a space (e.g. --codesys-path "C:\Program Files\...") is re-split by cmd.exe at every space boundary. The child process receives a truncated path, fails to launch, and the probe declares the server unavailable, falsely blocking every MCP tool call to that server. Fix: add a quoteWin() helper that double-quotes any token containing whitespace or cmd metacharacters. In the useShell branch, build a single properly-quoted command line string and pass it as the sole argument to spawn() with no separate args array. The else branch (shell:false, all non-.cmd commands) is unchanged. Regression test added: on Windows, creates a .cmd shim that echoes its first positional argument to stderr, probes it with a space-containing path arg, and asserts the probe succeeds and the arg was not split at the space boundary. Co-authored-by: Karstein Phobic Nyvold Kvistad <karstein.kvistad@maritimerobotics.com>		2026-06-29 15:54:52 -07:00
..
auto-tmux-dev.js	fix: consolidate bash hooks without fork storms	2026-04-14 21:23:57 -07:00
bash-hook-dispatcher.js	fix(hooks): stop pre/post Bash dispatcher from echoing the input event (#2240)	2026-06-15 13:48:46 -04:00
block-no-verify.js	fix: close block-no-verify bypass holes	2026-05-12 22:28:12 -04:00
check-console-log.js	fix: stability batch — hook stdin truncation, Codex exa TOML, Stop hook JSON, GateGuard repetition (#2227)	2026-06-11 00:31:33 -04:00
check-hook-enabled.js	feat: deliver v1.8.0 harness reliability and parity updates	2026-03-04 14:48:06 -08:00
config-protection.js	fix: integrate recent hook and docs PRs (#1905)	2026-05-14 21:37:28 -04:00
cost-tracker.js	fix: stability batch — hook stdin truncation, Codex exa TOML, Stop hook JSON, GateGuard repetition (#2227)	2026-06-11 00:31:33 -04:00
cursor-session-env.js	feat: Cursor-independent ECC memory via ECC_AGENT_DATA_HOME (#2066)	2026-06-07 13:27:00 +08:00
design-quality-check.js	feat: add web frontend rules and design quality hook	2026-04-02 17:33:17 -07:00
desktop-notify.js	fix: stability batch — hook stdin truncation, Codex exa TOML, Stop hook JSON, GateGuard repetition (#2227)	2026-06-11 00:31:33 -04:00
doc-file-warning.js	fix: surface warn-only PreToolUse hooks (#2084)	2026-05-28 07:45:46 -04:00
ecc-context-monitor.js	fix(context-monitor): make cost warnings informational, not commands (#2091)	2026-06-07 13:26:48 +08:00
ecc-metrics-bridge.js	fix(hooks): stop false loop warnings and repeated identical context warnings (#2121)	2026-06-07 13:26:30 +08:00
ecc-statusline.js	chore: update statusline ANSI color palette	2026-05-15 23:18:01 -04:00
evaluate-session.js	Fix stdin overflow bug in hook scripts - truncate chunks to stay within MAX_STDIN limit	2026-02-18 07:40:12 +00:00
gateguard-fact-force.js	fix(security): gateguard classifier bypasses (GHSA-4v57) + Windows CI + claw ReDoS	2026-06-18 20:02:30 -04:00
governance-capture.js	fix: fold session manager blockers into one candidate	2026-03-24 23:08:27 -04:00
insaits-security-monitor.py	test: cover hook bootstrap and InsAIts monitor	2026-04-29 17:45:22 -04:00
insaits-security-wrapper.js	fix: fail open on insaits monitor errors	2026-04-29 18:03:33 -04:00
mcp-health-check.js	fix(hooks): quote args when probing Windows .cmd MCP servers via shell (#2343)	2026-06-29 15:54:52 -07:00
observe-runner.js	fix: route continuous learning observe hooks through node	2026-04-29 21:28:59 -04:00
plugin-hook-bootstrap.js	fix: make plugin hooks run on Node 21+ and green the suite under modern Node (#2184)	2026-06-07 16:05:28 +08:00
post-bash-build-complete.js	fix: consolidate bash hooks without fork storms	2026-04-14 21:23:57 -07:00
post-bash-command-log.js	fix: consolidate bash hooks without fork storms	2026-04-14 21:23:57 -07:00
post-bash-dispatcher.js	fix: consolidate bash hooks without fork storms	2026-04-14 21:23:57 -07:00
post-bash-pr-created.js	fix: consolidate bash hooks without fork storms	2026-04-14 21:23:57 -07:00
post-edit-accumulator.js	perf(hooks): batch format+typecheck at Stop instead of per Edit (#746)	2026-03-31 14:12:12 -07:00
post-edit-console-warn.js	Merge branch 'affaan-m:main' into main	2026-02-18 18:33:04 +05:30
post-edit-format.js	fix: port Windows hook safety fixes (#1719)	2026-05-11 03:56:51 -04:00
post-edit-typecheck.js	Fix stdin overflow bug in hook scripts - truncate chunks to stay within MAX_STDIN limit	2026-02-18 07:40:12 +00:00
pre-bash-commit-quality.js	fix: run pre-bash linters through windows wrappers	2026-04-29 18:59:10 -04:00
pre-bash-dev-server-block.js	fix(dev-server-block): stop blocking dev-<suffix> scripts (#2179)	2026-06-07 13:25:39 +08:00
pre-bash-dispatcher.js	fix: consolidate bash hooks without fork storms	2026-04-14 21:23:57 -07:00
pre-bash-git-push-reminder.js	fix: surface warn-only PreToolUse hooks (#2084)	2026-05-28 07:45:46 -04:00
pre-bash-tmux-reminder.js	fix: surface warn-only PreToolUse hooks (#2084)	2026-05-28 07:45:46 -04:00
pre-compact.js	fix: nullish coalescing in evaluate-session config, narrow pre-compact glob, add 11 tests	2026-02-13 02:42:01 -08:00
pre-write-doc-warn.js	feat: deliver v1.8.0 harness reliability and parity updates	2026-03-04 14:48:06 -08:00
pretooluse-visible-output.js	fix: surface warn-only PreToolUse hooks (#2084)	2026-05-28 07:45:46 -04:00
quality-gate.js	refactor: deduplicate config lists and unify resolveFormatterBin branches	2026-03-11 10:45:28 +09:00
run-with-flags-shell.sh	fix(hooks): pass phase argument from hook ID to observe.sh (#1042)	2026-03-31 14:05:16 -07:00
run-with-flags.js	docs+chore: add README Security section; fix lint regressions on main	2026-06-16 02:08:14 -04:00
session-activity-tracker.js	Merge pull request #1384 from KeWang0622/fix/lint-md028-eqeqeq	2026-04-12 23:03:19 -07:00
session-end-marker.js	fix: clean up observer sessions on lifecycle end	2026-04-02 18:02:29 -07:00
session-end.js	fix(session-end): preserve $-sequences in user messages when rewriting summary (#2180)	2026-06-07 13:25:36 +08:00
session-start-bootstrap.js	fix: salvage remaining stale queue fixes (#1754)	2026-05-11 16:41:08 -04:00
session-start.js	fix(session-start): support ECC_SESSION_RETENTION_DAYS opt-out + document env var (#2151) (#2163)	2026-06-07 13:01:33 +08:00
stop-format-typecheck.js	fix: stability batch — hook stdin truncation, Codex exa TOML, Stop hook JSON, GateGuard repetition (#2227)	2026-06-11 00:31:33 -04:00
suggest-compact.js	fix: context-size /compact trigger, Codex marketplace plugin path, live README badges (#2237)	2026-06-11 16:21:53 -04:00