vibe-gate-mcp 0.1.7 → 0.1.8

package/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.8] - 2026-09-24
+
+### Fixed
+
+- Resolve explicitly selected CLI names through Windows `PATH` and `PATHEXT` before spawning, including Cursor's `agent.cmd` and legacy `cursor-agent.cmd` shims.
+- Launch Windows `.cmd` and `.bat` shims through `cmd.exe` while keeping native executables on the direct spawn path.
+
+### Tests
+
+- Cover Windows `PATHEXT` resolution for explicit `agent` and `cursor-agent` commands and safely quoted batch-shim invocation.
+
 ## [0.1.7] - 2026-09-24
 
 ### Fixed

package/dist/index.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { basename, delimiter, dirname, extname, isAbsolute, join, normalize, relative, resolve } from "node:path";
+import * as path from "node:path";
+import { basename, dirname, extname, isAbsolute, join, normalize, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { config } from "dotenv";
 import { accessSync, constants, existsSync, readFileSync } from "node:fs";
@@ -2487,9 +2488,32 @@ const WINDOWS_EXECUTABLE_EXTENSIONS = /* @__PURE__ */ new Set([
 ]);
 const WINDOWS_BATCH_EXTENSIONS = /* @__PURE__ */ new Set([".BAT", ".CMD"]);
 function executableExtensions(command, isWindows, pathExt = process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD") {
-	if (!isWindows || extname(command)) return [""];
+	const commandExtension = isWindows ? path.win32.extname(command) : extname(command);
+	if (!isWindows || commandExtension) return [""];
 	return pathExt.split(";").filter((extension) => WINDOWS_EXECUTABLE_EXTENSIONS.has(extension.toUpperCase()));
 }
+function executableCandidates(command, options = {}) {
+	const isWindows = (options.platform ?? process.platform) === "win32";
+	const pathApi = isWindows ? path.win32 : path;
+	const hasDirectory = pathApi.isAbsolute(command) || command.includes("/") || command.includes("\\");
+	const pathValue = options.pathValue ?? process.env.PATH ?? process.env.Path ?? "";
+	const pathDelimiter = isWindows ? ";" : path.delimiter;
+	const bases = hasDirectory ? [pathApi.resolve(command)] : pathValue.split(pathDelimiter).filter(Boolean).map((directory) => pathApi.join(directory, command));
+	const extensions = executableExtensions(command, isWindows, options.pathExt);
+	return bases.flatMap((base) => extensions.map((extension) => extension ? `${base}${extension}` : base));
+}
+function findExecutable(command, options = {}) {
+	const isWindows = (options.platform ?? process.platform) === "win32";
+	const canAccess = options.canAccess ?? ((candidate, windows) => {
+		try {
+			accessSync(candidate, windows ? constants.F_OK : constants.X_OK);
+			return true;
+		} catch {
+			return false;
+		}
+	});
+	for (const candidate of executableCandidates(command, options)) if (canAccess(candidate, isWindows)) return candidate;
+}
 function quoteCmdToken(value) {
 	if (/[%"\0\r\n]/.test(value)) throw new Error("Windows CLI arguments cannot contain percent signs, quotes, or line breaks.");
 	return `"${value}"`;
@@ -2556,10 +2580,11 @@ function sanitizeStderr(stderr) {
 }
 function runCli({ command, args, cwd, input, timeoutMs, label, env, keepCredentialEnvKeys }) {
 	return new Promise((resolve, reject) => {
-		const target = buildCliSpawnTarget(command, args);
+		const childEnv = createChildEnv(env, keepCredentialEnvKeys);
+		const target = buildCliSpawnTarget(findExecutable(command, { pathValue: childEnv.PATH ?? childEnv.Path }) ?? command, args);
 		const child = spawn(target.command, target.args, {
 			cwd,
-			env: createChildEnv(env, keepCredentialEnvKeys),
+			env: childEnv,
 			shell: false,
 			windowsHide: true,
 			...target.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {},
@@ -3041,9 +3066,6 @@ function createOpenCodeCliProvider(command, model, timeoutMs) {
 }
 //#endregion
 //#region src/llm/index.ts
-/**
-* LLM provider factory and local CLI auto-detection.
-*/
 const AUTO_DETECT_CLI_ORDER = [
 	PROVIDERS.CODEX_CLI,
 	PROVIDERS.CLAUDE_CODE,
@@ -3064,27 +3086,6 @@ function commandCandidates(id, config) {
 	if (id === PROVIDERS.CURSOR_AGENT) return [CLI_DEFAULT_COMMANDS[id], CURSOR_AGENT_LEGACY_COMMAND];
 	return [CLI_DEFAULT_COMMANDS[id]];
 }
-function commandSearchBases(command) {
-	if (isAbsolute(command) || command.includes("/") || command.includes("\\")) return [resolve(command)];
-	return (process.env.PATH ?? process.env.Path ?? "").split(delimiter).filter(Boolean).map((dir) => join(dir, command));
-}
-function canExecute(path, isWindows) {
-	try {
-		accessSync(path, isWindows ? constants.F_OK : constants.X_OK);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function findExecutable(command) {
-	const isWindows = process.platform === "win32";
-	const bases = commandSearchBases(command);
-	const extensions = executableExtensions(command, isWindows);
-	for (const base of bases) for (const extension of extensions) {
-		const candidate = extension ? `${base}${extension}` : base;
-		if (canExecute(candidate, isWindows)) return candidate;
-	}
-}
 function hasOpenCodeModel(config) {
 	const model = config.criticModel;
 	const separator = model?.indexOf("/") ?? -1;

package/docs/CLI_PROVIDERS.md

@@ -8,7 +8,7 @@ The CLI is installed locally, but its model request still goes to the provider.
 
 When `CRITIC_PROVIDER` is empty or unset, Vibe-Gate checks local CLI executables in this order: Codex (`codex`), Claude Code (`claude`), Cursor Agent (`agent`, then legacy `cursor-agent`), and OpenCode CLI (`opencode`). OpenCode CLI is considered only with a `provider/model` `CRITIC_MODEL`, and that model format moves it to the front of the default order. Configured `*_CLI_PATH` values are checked before default PATH names, using the same provider order. The first tool response reports the selected CLI in `providerNotice`. Detection checks whether the executable is available; it does not verify that the CLI is signed in. If the selected CLI needs login, Vibe-Gate returns its error and does not switch to another account or service. If no local CLI is found, Vibe-Gate retains its OpenAI default and requires `OPENAI_API_KEY`. Set `CRITIC_PROVIDER` to select a provider explicitly.
 
-On Windows, discovery follows `PATHEXT` for `.COM`, `.EXE`, `.BAT`, and `.CMD` files. Batch shims (`.bat` and `.cmd`) run through `cmd.exe`; native executables run directly.
+On Windows, command names are resolved through `PATH` and `PATHEXT` for `.COM`, `.EXE`, `.BAT`, and `.CMD` files whether `CRITIC_PROVIDER` is automatic or explicitly set. Batch shims (`.bat` and `.cmd`) run through `cmd.exe`; native executables run directly.
 
 | `CRITIC_PROVIDER` | Command                                   | Sign in                                        | Model selection                                    |
 | ----------------- | ----------------------------------------- | ---------------------------------------------- | -------------------------------------------------- |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibe-gate-mcp",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "type": "module",
   "description": "Adversarial Quality Gate MCP for vibe-coding: IDE AI vs Critic AI, human decides on deadlock",
   "license": "MIT",