viviscape-mcp 2.0.0 → 2.0.1

package/dist/auth/auth-service.js

@@ -134,11 +134,21 @@ function respond(res, status, contentType, body) {
     res.end(buf);
 }
 function openBrowser(url, log) {
-    const [cmd, args] = process.platform === 'win32' ? ['cmd', ['/c', 'start', '', url]] :
+    // Windows: `cmd /c start` treats an unquoted `&` as a command separator, and
+    // Node only quotes args containing spaces or quotes -- so the login URL was cut
+    // at the first `&` and the page loaded with no `state` (the server answers 400
+    // "invalid state"). Quote the URL ourselves and pass the line to cmd verbatim.
+    const win = process.platform === 'win32';
+    const [cmd, args] = win ? ['cmd.exe', ['/c', 'start', '""', `"${url}"`]] :
         process.platform === 'darwin' ? ['open', [url]] :
             ['xdg-open', [url]];
     try {
-        const child = spawn(cmd, args, { detached: true, stdio: 'ignore', windowsHide: true });
+        const child = spawn(cmd, args, {
+            detached: true,
+            stdio: 'ignore',
+            windowsHide: true,
+            windowsVerbatimArguments: win,
+        });
         child.on('error', () => log('Could not open the browser automatically. Open the URL above manually.'));
         child.unref();
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viviscape-mcp",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "MCP server for the ViviScape API — CRM, projects, companies, notes, and insights, authenticated as the signed-in ViviScape user",
   "type": "module",
   "main": "dist/index.js",