mirror of
https://github.com/Jeuners/ECC.git
synced 2026-09-09 15:02:30 +02:00
b1d5d6366d
On Windows, when a bare-name MCP server command (e.g. codesys-mcp-sp21-plus) falls back to the .cmd candidate, the probe sets shell:true to work around Node 18.20+ CVE-2024-27980. However, passing an args array alongside shell:true causes Node to concatenate the tokens without quoting (DEP0190), so an arg containing a space (e.g. --codesys-path "C:\Program Files\...") is re-split by cmd.exe at every space boundary. The child process receives a truncated path, fails to launch, and the probe declares the server unavailable, falsely blocking every MCP tool call to that server. Fix: add a quoteWin() helper that double-quotes any token containing whitespace or cmd metacharacters. In the useShell branch, build a single properly-quoted command line string and pass it as the sole argument to spawn() with no separate args array. The else branch (shell:false, all non-.cmd commands) is unchanged. Regression test added: on Windows, creates a .cmd shim that echoes its first positional argument to stderr, probes it with a space-containing path arg, and asserts the probe succeeds and the arg was not split at the space boundary. Co-authored-by: Karstein Phobic Nyvold Kvistad <karstein.kvistad@maritimerobotics.com> |
||
|---|---|---|
| .. | ||
| auto-tmux-dev.test.js | ||
| bash-hook-dispatcher.test.js | ||
| block-no-verify.test.js | ||
| check-hook-enabled.test.js | ||
| config-protection.test.js | ||
| continuous-learning-observe-runner.test.js | ||
| cost-tracker.test.js | ||
| cursor-block-no-verify.test.js | ||
| design-quality-check.test.js | ||
| detect-project-worktree.test.js | ||
| doc-file-warning.test.js | ||
| ecc-context-monitor.test.js | ||
| ecc-metrics-bridge.test.js | ||
| ecc-statusline.test.js | ||
| evaluate-session.test.js | ||
| gateguard-fact-force.test.js | ||
| governance-capture.test.js | ||
| hook-flags.test.js | ||
| hooks.test.js | ||
| insaits-security-monitor.test.js | ||
| insaits-security-wrapper.test.js | ||
| mcp-health-check.test.js | ||
| migrate-homunculus-home-escape.test.js | ||
| observe-entrypoint-allowlist.test.js | ||
| observe-subdirectory-detection.test.js | ||
| observer-memory.test.js | ||
| plugin-hook-bootstrap.test.js | ||
| post-bash-hooks.test.js | ||
| pre-bash-commit-quality.test.js | ||
| pre-bash-dev-server-block.test.js | ||
| pre-bash-reminders.test.js | ||
| quality-gate.test.js | ||
| run-with-flags-truncation.test.js | ||
| session-activity-tracker.test.js | ||
| session-end.test.js | ||
| stop-format-typecheck.test.js | ||
| stop-hooks-stdout.test.js | ||
| suggest-compact.test.js | ||
| test_insaits_security_monitor.py | ||