vibe-gate-mcp 0.1.6 → 0.1.7

package/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.7] - 2026-09-24
+
+### Fixed
+
+- Detect and launch Windows `.cmd` and `.bat` CLI shims through `cmd.exe` while keeping native executables on the direct spawn path.
+
+### Tests
+
+- Cover Windows `PATHEXT` shim resolution and safely quoted batch-shim invocation.
+
 ## [0.1.6] - 2026-09-24
 
 ### Added

package/dist/index.mjs

@@ -2477,6 +2477,42 @@ function createOpenCodeProvider(apiKey, model, plan = OPENCODE_PLANS.ZEN) {
 	} };
 }
 //#endregion
+//#region src/llm/cli-command.ts
+/** Platform-specific executable lookup and process invocation for local CLIs. */
+const WINDOWS_EXECUTABLE_EXTENSIONS = /* @__PURE__ */ new Set([
+	".COM",
+	".EXE",
+	".BAT",
+	".CMD"
+]);
+const WINDOWS_BATCH_EXTENSIONS = /* @__PURE__ */ new Set([".BAT", ".CMD"]);
+function executableExtensions(command, isWindows, pathExt = process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD") {
+	if (!isWindows || extname(command)) return [""];
+	return pathExt.split(";").filter((extension) => WINDOWS_EXECUTABLE_EXTENSIONS.has(extension.toUpperCase()));
+}
+function quoteCmdToken(value) {
+	if (/[%"\0\r\n]/.test(value)) throw new Error("Windows CLI arguments cannot contain percent signs, quotes, or line breaks.");
+	return `"${value}"`;
+}
+function buildCliSpawnTarget(command, args, platform = process.platform, comspec = process.env.ComSpec ?? process.env.COMSPEC ?? "cmd.exe") {
+	const extension = extname(command).toUpperCase();
+	if (platform !== "win32" || !WINDOWS_BATCH_EXTENSIONS.has(extension)) return {
+		command,
+		args
+	};
+	return {
+		command: comspec,
+		args: [
+			"/d",
+			"/s",
+			"/v:off",
+			"/c",
+			`"${[command, ...args].map(quoteCmdToken).join(" ")}"`
+		],
+		windowsVerbatimArguments: true
+	};
+}
+//#endregion
 //#region src/llm/cli.ts
 /**
 * Local authenticated CLI providers. These CLIs receive the complete review
@@ -2520,11 +2556,13 @@ function sanitizeStderr(stderr) {
 }
 function runCli({ command, args, cwd, input, timeoutMs, label, env, keepCredentialEnvKeys }) {
 	return new Promise((resolve, reject) => {
-		const child = spawn(command, args, {
+		const target = buildCliSpawnTarget(command, args);
+		const child = spawn(target.command, target.args, {
 			cwd,
 			env: createChildEnv(env, keepCredentialEnvKeys),
 			shell: false,
 			windowsHide: true,
+			...target.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {},
 			stdio: [
 				"pipe",
 				"pipe",
@@ -3030,10 +3068,6 @@ function commandSearchBases(command) {
 	if (isAbsolute(command) || command.includes("/") || command.includes("\\")) return [resolve(command)];
 	return (process.env.PATH ?? process.env.Path ?? "").split(delimiter).filter(Boolean).map((dir) => join(dir, command));
 }
-function executableExtensions(command, isWindows) {
-	if (!isWindows || extname(command)) return [""];
-	return (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter((extension) => [".COM", ".EXE"].includes(extension.toUpperCase()));
-}
 function canExecute(path, isWindows) {
 	try {
 		accessSync(path, isWindows ? constants.F_OK : constants.X_OK);

package/docs/CLI_PROVIDERS.md

@@ -8,6 +8,8 @@ The CLI is installed locally, but its model request still goes to the provider.
 
 When `CRITIC_PROVIDER` is empty or unset, Vibe-Gate checks local CLI executables in this order: Codex (`codex`), Claude Code (`claude`), Cursor Agent (`agent`, then legacy `cursor-agent`), and OpenCode CLI (`opencode`). OpenCode CLI is considered only with a `provider/model` `CRITIC_MODEL`, and that model format moves it to the front of the default order. Configured `*_CLI_PATH` values are checked before default PATH names, using the same provider order. The first tool response reports the selected CLI in `providerNotice`. Detection checks whether the executable is available; it does not verify that the CLI is signed in. If the selected CLI needs login, Vibe-Gate returns its error and does not switch to another account or service. If no local CLI is found, Vibe-Gate retains its OpenAI default and requires `OPENAI_API_KEY`. Set `CRITIC_PROVIDER` to select a provider explicitly.
 
+On Windows, discovery follows `PATHEXT` for `.COM`, `.EXE`, `.BAT`, and `.CMD` files. Batch shims (`.bat` and `.cmd`) run through `cmd.exe`; native executables run directly.
+
 | `CRITIC_PROVIDER` | Command                                   | Sign in                                        | Model selection                                    |
 | ----------------- | ----------------------------------------- | ---------------------------------------------- | -------------------------------------------------- |
 | `codex-cli`       | `codex`                                   | `codex login`                                  | Optional `CRITIC_MODEL`                            |

package/docs/TROUBLESHOOTING.md

@@ -16,7 +16,7 @@
 
 ### Local CLI not found or not authenticated
 
-**Cause:** IDE-launched MCP servers may have a shorter `PATH` than an interactive terminal, or the CLI may not have an account session for this OS user.
+**Cause:** IDE-launched MCP servers may have a shorter `PATH` than an interactive terminal, or the CLI may not have an account session for this OS user. On Windows, the CLI shim may be a `.cmd` or `.bat` file listed in `PATHEXT`.
 
 **Fix:** Run the CLI's login flow in a terminal as the same user running the IDE, then set its matching `*_CLI_PATH` to the absolute executable path if needed. For Cursor, `cursor-agent` remains the `CRITIC_PROVIDER` value, while the current executable is `agent`; `cursor-agent` is only a legacy fallback. For Claude Code, `claude auth login` defaults to Claude subscription sign-in; `--console` selects API billing. See [CLI_PROVIDERS.md](CLI_PROVIDERS.md) for provider-specific setup.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibe-gate-mcp",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "type": "module",
   "description": "Adversarial Quality Gate MCP for vibe-coding: IDE AI vs Critic AI, human decides on deadlock",
   "license": "MIT",