vibe-gate-mcp 0.1.6 → 0.1.8

package/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.8] - 2026-09-24
+
+### Fixed
+
+- Resolve explicitly selected CLI names through Windows `PATH` and `PATHEXT` before spawning, including Cursor's `agent.cmd` and legacy `cursor-agent.cmd` shims.
+- Launch Windows `.cmd` and `.bat` shims through `cmd.exe` while keeping native executables on the direct spawn path.
+
+### Tests
+
+- Cover Windows `PATHEXT` resolution for explicit `agent` and `cursor-agent` commands and safely quoted batch-shim invocation.
+
+## [0.1.7] - 2026-09-24
+
+### Fixed
+
+- Detect and launch Windows `.cmd` and `.bat` CLI shims through `cmd.exe` while keeping native executables on the direct spawn path.
+
+### Tests
+
+- Cover Windows `PATHEXT` shim resolution and safely quoted batch-shim invocation.
+
 ## [0.1.6] - 2026-09-24
 
 ### Added

package/dist/index.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { basename, delimiter, dirname, extname, isAbsolute, join, normalize, relative, resolve } from "node:path";
+import * as path from "node:path";
+import { basename, dirname, extname, isAbsolute, join, normalize, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { config } from "dotenv";
 import { accessSync, constants, existsSync, readFileSync } from "node:fs";
@@ -2477,6 +2478,65 @@ function createOpenCodeProvider(apiKey, model, plan = OPENCODE_PLANS.ZEN) {
 	} };
 }
 //#endregion
+//#region src/llm/cli-command.ts
+/** Platform-specific executable lookup and process invocation for local CLIs. */
+const WINDOWS_EXECUTABLE_EXTENSIONS = /* @__PURE__ */ new Set([
+	".COM",
+	".EXE",
+	".BAT",
+	".CMD"
+]);
+const WINDOWS_BATCH_EXTENSIONS = /* @__PURE__ */ new Set([".BAT", ".CMD"]);
+function executableExtensions(command, isWindows, pathExt = process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD") {
+	const commandExtension = isWindows ? path.win32.extname(command) : extname(command);
+	if (!isWindows || commandExtension) return [""];
+	return pathExt.split(";").filter((extension) => WINDOWS_EXECUTABLE_EXTENSIONS.has(extension.toUpperCase()));
+}
+function executableCandidates(command, options = {}) {
+	const isWindows = (options.platform ?? process.platform) === "win32";
+	const pathApi = isWindows ? path.win32 : path;
+	const hasDirectory = pathApi.isAbsolute(command) || command.includes("/") || command.includes("\\");
+	const pathValue = options.pathValue ?? process.env.PATH ?? process.env.Path ?? "";
+	const pathDelimiter = isWindows ? ";" : path.delimiter;
+	const bases = hasDirectory ? [pathApi.resolve(command)] : pathValue.split(pathDelimiter).filter(Boolean).map((directory) => pathApi.join(directory, command));
+	const extensions = executableExtensions(command, isWindows, options.pathExt);
+	return bases.flatMap((base) => extensions.map((extension) => extension ? `${base}${extension}` : base));
+}
+function findExecutable(command, options = {}) {
+	const isWindows = (options.platform ?? process.platform) === "win32";
+	const canAccess = options.canAccess ?? ((candidate, windows) => {
+		try {
+			accessSync(candidate, windows ? constants.F_OK : constants.X_OK);
+			return true;
+		} catch {
+			return false;
+		}
+	});
+	for (const candidate of executableCandidates(command, options)) if (canAccess(candidate, isWindows)) return candidate;
+}
+function quoteCmdToken(value) {
+	if (/[%"\0\r\n]/.test(value)) throw new Error("Windows CLI arguments cannot contain percent signs, quotes, or line breaks.");
+	return `"${value}"`;
+}
+function buildCliSpawnTarget(command, args, platform = process.platform, comspec = process.env.ComSpec ?? process.env.COMSPEC ?? "cmd.exe") {
+	const extension = extname(command).toUpperCase();
+	if (platform !== "win32" || !WINDOWS_BATCH_EXTENSIONS.has(extension)) return {
+		command,
+		args
+	};
+	return {
+		command: comspec,
+		args: [
+			"/d",
+			"/s",
+			"/v:off",
+			"/c",
+			`"${[command, ...args].map(quoteCmdToken).join(" ")}"`
+		],
+		windowsVerbatimArguments: true
+	};
+}
+//#endregion
 //#region src/llm/cli.ts
 /**
 * Local authenticated CLI providers. These CLIs receive the complete review
@@ -2520,11 +2580,14 @@ function sanitizeStderr(stderr) {
 }
 function runCli({ command, args, cwd, input, timeoutMs, label, env, keepCredentialEnvKeys }) {
 	return new Promise((resolve, reject) => {
-		const child = spawn(command, args, {
+		const childEnv = createChildEnv(env, keepCredentialEnvKeys);
+		const target = buildCliSpawnTarget(findExecutable(command, { pathValue: childEnv.PATH ?? childEnv.Path }) ?? command, args);
+		const child = spawn(target.command, target.args, {
 			cwd,
-			env: createChildEnv(env, keepCredentialEnvKeys),
+			env: childEnv,
 			shell: false,
 			windowsHide: true,
+			...target.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {},
 			stdio: [
 				"pipe",
 				"pipe",
@@ -3003,9 +3066,6 @@ function createOpenCodeCliProvider(command, model, timeoutMs) {
 }
 //#endregion
 //#region src/llm/index.ts
-/**
-* LLM provider factory and local CLI auto-detection.
-*/
 const AUTO_DETECT_CLI_ORDER = [
 	PROVIDERS.CODEX_CLI,
 	PROVIDERS.CLAUDE_CODE,
@@ -3026,31 +3086,6 @@ function commandCandidates(id, config) {
 	if (id === PROVIDERS.CURSOR_AGENT) return [CLI_DEFAULT_COMMANDS[id], CURSOR_AGENT_LEGACY_COMMAND];
 	return [CLI_DEFAULT_COMMANDS[id]];
 }
-function commandSearchBases(command) {
-	if (isAbsolute(command) || command.includes("/") || command.includes("\\")) return [resolve(command)];
-	return (process.env.PATH ?? process.env.Path ?? "").split(delimiter).filter(Boolean).map((dir) => join(dir, command));
-}
-function executableExtensions(command, isWindows) {
-	if (!isWindows || extname(command)) return [""];
-	return (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter((extension) => [".COM", ".EXE"].includes(extension.toUpperCase()));
-}
-function canExecute(path, isWindows) {
-	try {
-		accessSync(path, isWindows ? constants.F_OK : constants.X_OK);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function findExecutable(command) {
-	const isWindows = process.platform === "win32";
-	const bases = commandSearchBases(command);
-	const extensions = executableExtensions(command, isWindows);
-	for (const base of bases) for (const extension of extensions) {
-		const candidate = extension ? `${base}${extension}` : base;
-		if (canExecute(candidate, isWindows)) return candidate;
-	}
-}
 function hasOpenCodeModel(config) {
 	const model = config.criticModel;
 	const separator = model?.indexOf("/") ?? -1;

package/docs/CLI_PROVIDERS.md

@@ -8,6 +8,8 @@ The CLI is installed locally, but its model request still goes to the provider.
 
 When `CRITIC_PROVIDER` is empty or unset, Vibe-Gate checks local CLI executables in this order: Codex (`codex`), Claude Code (`claude`), Cursor Agent (`agent`, then legacy `cursor-agent`), and OpenCode CLI (`opencode`). OpenCode CLI is considered only with a `provider/model` `CRITIC_MODEL`, and that model format moves it to the front of the default order. Configured `*_CLI_PATH` values are checked before default PATH names, using the same provider order. The first tool response reports the selected CLI in `providerNotice`. Detection checks whether the executable is available; it does not verify that the CLI is signed in. If the selected CLI needs login, Vibe-Gate returns its error and does not switch to another account or service. If no local CLI is found, Vibe-Gate retains its OpenAI default and requires `OPENAI_API_KEY`. Set `CRITIC_PROVIDER` to select a provider explicitly.
 
+On Windows, command names are resolved through `PATH` and `PATHEXT` for `.COM`, `.EXE`, `.BAT`, and `.CMD` files whether `CRITIC_PROVIDER` is automatic or explicitly set. Batch shims (`.bat` and `.cmd`) run through `cmd.exe`; native executables run directly.
+
 | `CRITIC_PROVIDER` | Command                                   | Sign in                                        | Model selection                                    |
 | ----------------- | ----------------------------------------- | ---------------------------------------------- | -------------------------------------------------- |
 | `codex-cli`       | `codex`                                   | `codex login`                                  | Optional `CRITIC_MODEL`                            |

package/docs/TROUBLESHOOTING.md

@@ -16,7 +16,7 @@
 
 ### Local CLI not found or not authenticated
 
-**Cause:** IDE-launched MCP servers may have a shorter `PATH` than an interactive terminal, or the CLI may not have an account session for this OS user.
+**Cause:** IDE-launched MCP servers may have a shorter `PATH` than an interactive terminal, or the CLI may not have an account session for this OS user. On Windows, the CLI shim may be a `.cmd` or `.bat` file listed in `PATHEXT`.
 
 **Fix:** Run the CLI's login flow in a terminal as the same user running the IDE, then set its matching `*_CLI_PATH` to the absolute executable path if needed. For Cursor, `cursor-agent` remains the `CRITIC_PROVIDER` value, while the current executable is `agent`; `cursor-agent` is only a legacy fallback. For Claude Code, `claude auth login` defaults to Claude subscription sign-in; `--console` selects API billing. See [CLI_PROVIDERS.md](CLI_PROVIDERS.md) for provider-specific setup.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibe-gate-mcp",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "type": "module",
   "description": "Adversarial Quality Gate MCP for vibe-coding: IDE AI vs Critic AI, human decides on deadlock",
   "license": "MIT",