@qverisai/cli 0.6.0 → 0.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qverisai/cli",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "QVeris CLI for agent capability discovery, inspection, calling, and audit",
   "type": "module",
   "bin": {

package/src/commands/mcp.mjs

@@ -355,7 +355,8 @@ function stdioSpecFromServer(target, server) {
 
 function listMcpTools(spec, timeoutMs) {
   return new Promise((resolve, reject) => {
-    const child = spawn(spec.command, spec.args || [], mcpSpawnOptions(spec.env));
+    const childSpec = mcpSpawnCommand(spec);
+    const child = spawn(childSpec.command, childSpec.args, mcpSpawnOptions(spec.env));
     let stderr = "";
     let settled = false;
     let timer;
@@ -443,14 +444,76 @@ export function resolveProbeTimeoutMs(timeout) {
   return Math.max(1000, usableSeconds * 1000);
 }
 
-export function mcpSpawnOptions(env = {}, os = platform()) {
+export function mcpSpawnOptions(env = {}, _os = platform()) {
   return {
     env: { ...process.env, ...(env || {}) },
     stdio: ["pipe", "pipe", "pipe"],
-    shell: os === "win32",
+    shell: false,
   };
 }
 
+export function mcpSpawnCommand(spec, os = platform()) {
+  const args = spec.args || [];
+  if (os !== "win32" || isWindowsExecutable(spec.command)) {
+    return { command: spec.command, args };
+  }
+
+  return {
+    command: process.env.ComSpec || "cmd.exe",
+    args: ["/d", "/s", "/c", wrapWindowsCommandLine([spec.command, ...args])],
+  };
+}
+
+function isWindowsExecutable(command) {
+  return /\.(?:exe|com)$/i.test(command);
+}
+
+function isWindowsBatchCommand(command) {
+  const name = String(command).split(/[\\/]/).pop() || "";
+  return (
+    /\.(?:cmd|bat)$/i.test(name) ||
+    /^(?:corepack|npm|npx|pnpm|yarn)$/i.test(name)
+  );
+}
+
+function wrapWindowsCommandLine(parts) {
+  const escapePercent = isWindowsBatchCommand(parts[0]);
+  const commandLine = parts
+    .map((part) => quoteWindowsCommandArgument(part, escapePercent))
+    .join(" ");
+  return `"${commandLine}"`;
+}
+
+function quoteWindowsCommandArgument(value, escapePercent = false) {
+  const raw = String(value);
+  if (/[\0\r\n]/.test(raw)) {
+    throw new Error("MCP command arguments cannot contain CR, LF, or NUL characters.");
+  }
+  const text = escapePercent ? raw.replaceAll("%", "%%") : raw;
+  let quoted = "\"";
+  let backslashes = 0;
+
+  for (const char of text) {
+    if (char === "\\") {
+      backslashes += 1;
+      continue;
+    }
+    if (char === "\"") {
+      quoted += "\\".repeat(backslashes * 2 + 1);
+      quoted += char;
+      backslashes = 0;
+      continue;
+    }
+    quoted += "\\".repeat(backslashes);
+    backslashes = 0;
+    quoted += char;
+  }
+
+  quoted += "\\".repeat(backslashes * 2);
+  quoted += "\"";
+  return quoted;
+}
+
 function extractServer(target, config) {
   if (target === "cursor" || target === "claude-desktop") return config?.mcpServers?.qveris;
   if (target === "opencode") return config?.mcp?.qveris;

package/src/output/formatter.mjs

@@ -23,7 +23,7 @@ export function formatDiscoverResult(result) {
     const toolId = t.tool_id ?? "";
     const desc = stringifyDesc(t.description);
     const provider = t.provider_name ?? "";
-    const categories = Array.isArray(t.categories) ? t.categories.join(", ") : "";
+    const categories = formatCategories(t.categories);
     const region = t.region ?? "global";
     const stats = t.stats ?? {};
 
@@ -92,7 +92,7 @@ export function formatInspectResult(tools) {
     const desc = stringifyDesc(t.description);
     const provider = t.provider_name ?? "";
     const providerDesc = stringifyDesc(t.provider_description);
-    const categories = Array.isArray(t.categories) ? t.categories.join(", ") : "";
+    const categories = formatCategories(t.categories);
     const region = t.region ?? "global";
     const docsUrl = t.docs_url ?? "";
     const stats = t.stats ?? {};
@@ -290,6 +290,27 @@ function formatSchema(schema, indent = "", depth = 0) {
   return lines.join("\n");
 }
 
+/** Categories may be strings or objects like {slug, name, description}. */
+function formatCategories(categories) {
+  if (!Array.isArray(categories)) return "";
+  const seen = new Set();
+  const names = [];
+  for (const c of categories) {
+    let label = "";
+    if (typeof c === "string") label = c;
+    else if (c && typeof c === "object") {
+      label = stringifyDesc(c.name) || (typeof c.slug === "string" ? c.slug : "");
+    }
+    label = label.trim();
+    if (!label) continue;
+    const key = label.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    names.push(label);
+  }
+  return names.join(", ");
+}
+
 /** Handle description that may be a string, i18n object {en: "...", zh: "..."}, or other. */
 function stringifyDesc(desc) {
   if (!desc) return "";