fix(cli,mcp): harden MCP probe and call params

Author: sheep-cloud12138

packages/cli/src/commands/mcp.mjs

@@ -355,7 +355,8 @@ function stdioSpecFromServer(target, server) {
 
 function listMcpTools(spec, timeoutMs) {
   return new Promise((resolve, reject) => {
-    const child = spawn(spec.command, spec.args || [], mcpSpawnOptions(spec.env));
+    const childSpec = mcpSpawnCommand(spec);
+    const child = spawn(childSpec.command, childSpec.args, mcpSpawnOptions(spec.env));
     let stderr = "";
     let settled = false;
     let timer;
@@ -447,10 +448,33 @@ export function mcpSpawnOptions(env = {}, os = platform()) {
   return {
     env: { ...process.env, ...(env || {}) },
     stdio: ["pipe", "pipe", "pipe"],
-    shell: os === "win32",
+    shell: false,
   };
 }
 
+export function mcpSpawnCommand(spec, os = platform()) {
+  const args = spec.args || [];
+  if (os !== "win32" || isWindowsExecutable(spec.command)) {
+    return { command: spec.command, args };
+  }
+
+  return {
+    command: process.env.ComSpec || "cmd.exe",
+    args: ["/d", "/s", "/c", wrapWindowsCommandLine([spec.command, ...args])],
+  };
+}
+
+function isWindowsExecutable(command) {
+  return /\.(?:exe|com)$/i.test(command);
+}
+
+function wrapWindowsCommandLine(parts) {
+  const commandLine = parts
+    .map((part) => shellQuoteForPlatform(part, "win32"))
+    .join(" ");
+  return `"${commandLine}"`;
+}
+
 function extractServer(target, config) {
   if (target === "cursor" || target === "claude-desktop") return config?.mcpServers?.qveris;
   if (target === "opencode") return config?.mcp?.qveris;

packages/cli/test/mcp.test.mjs

@@ -8,6 +8,7 @@ import test from "node:test";
 
 import {
   extractEnvAssignmentValue,
+  mcpSpawnCommand,
   mcpSpawnOptions,
   resolveProbeTimeoutMs,
   shellQuoteForPlatform,
@@ -58,16 +59,47 @@ test("mcp configure enforces owner-only permissions on existing config files", (
   }
 });
 
-test("mcp live probe enables shell execution on Windows only", () => {
+test("mcp live probe disables shell execution for spawn options", () => {
   const windowsOptions = mcpSpawnOptions({ QVERIS_API_KEY: "sk-test" }, "win32");
-  assert.equal(windowsOptions.shell, true);
+  assert.equal(windowsOptions.shell, false);
   assert.equal(windowsOptions.env.QVERIS_API_KEY, "sk-test");
   assert.deepEqual(windowsOptions.stdio, ["pipe", "pipe", "pipe"]);
 
   const posixOptions = mcpSpawnOptions({}, "darwin");
   assert.equal(posixOptions.shell, false);
 });
 
+test("mcp live probe runs Windows executables directly", () => {
+  const spec = mcpSpawnCommand(
+    {
+      command: "C:\\Program Files\\nodejs\\node.exe",
+      args: ["fake server.mjs", "--package=@qverisai/mcp"],
+    },
+    "win32",
+  );
+
+  assert.equal(spec.command, "C:\\Program Files\\nodejs\\node.exe");
+  assert.deepEqual(spec.args, ["fake server.mjs", "--package=@qverisai/mcp"]);
+});
+
+test("mcp live probe wraps Windows command shims through cmd.exe without shell option", () => {
+  const spec = mcpSpawnCommand(
+    {
+      command: "npx",
+      args: ["fake server.mjs", "--package=@qverisai/mcp"],
+    },
+    "win32",
+  );
+
+  assert.equal(spec.command.endsWith("cmd.exe"), true);
+  assert.deepEqual(spec.args, [
+    "/d",
+    "/s",
+    "/c",
+    "\"\"npx\" \"fake server.mjs\" \"--package=@qverisai/mcp\"\"",
+  ]);
+});
+
 test("mcp command quoting follows the target shell platform", () => {
   assert.equal(shellQuoteForPlatform("L'Ondon", "darwin"), `'L'\\''Ondon'`);
   assert.equal(shellQuoteForPlatform('say "hi"', "win32"), `"say ""hi"""`);

packages/mcp/src/api/client.test.ts

@@ -99,19 +99,31 @@ describe('QverisClient', () => {
     });
 
     it('should throw ApiError on non-OK response', async () => {
-      fetchMock.mockResolvedValueOnce({
-        ok: false,
-        status: 401,
-        statusText: 'Unauthorized',
-        json: async () => ({ message: 'Invalid API key' }),
-      });
-
-      await expect(client.searchTools({ query: 'test' })).rejects.toEqual({
-        status: 401,
-        message: 'Invalid API key',
-        details: { message: 'Invalid API key' },
-      });
-    });
+      fetchMock.mockResolvedValueOnce({
+        ok: false,
+        status: 401,
+        statusText: 'Unauthorized',
+        headers: new Headers({ 'x-request-id': 'req-401' }),
+        json: async () => ({ message: 'Invalid API key' }),
+      });
+
+      await expect(client.searchTools({ query: 'test' })).rejects.toMatchObject({
+        status: 401,
+        message: 'Invalid API key',
+        details: { message: 'Invalid API key' },
+        observability: {
+          source: 'qveris_api',
+          operation: 'discover',
+          method: 'POST',
+          endpoint: '/search',
+          url: 'https://qveris.ai/api/v1/search',
+          timeout_ms: 30000,
+          http_status: 401,
+          request_id: 'req-401',
+          error_type: 'http_error',
+        },
+      });
+    });
 
     it('should handle non-JSON error response', async () => {
       fetchMock.mockResolvedValueOnce({
@@ -123,12 +135,39 @@ describe('QverisClient', () => {
         },
       });
 
-      await expect(client.searchTools({ query: 'test' })).rejects.toEqual({
-        status: 500,
-        message: 'Internal Server Error',
-        details: undefined,
-      });
-    });
+      await expect(client.searchTools({ query: 'test' })).rejects.toMatchObject({
+        status: 500,
+        message: 'Internal Server Error',
+        observability: {
+          operation: 'discover',
+          endpoint: '/search',
+          http_status: 500,
+          error_type: 'http_error',
+        },
+      });
+    });
+
+    it('should convert fetch network failures to observable ApiError', async () => {
+      fetchMock.mockRejectedValueOnce(
+        new Error('fetch failed', { cause: new Error('ECONNRESET') })
+      );
+
+      await expect(client.searchTools({ query: 'test' })).rejects.toMatchObject({
+        status: 0,
+        message: 'fetch failed',
+        cause: 'ECONNRESET',
+        observability: {
+          source: 'qveris_api',
+          operation: 'discover',
+          method: 'POST',
+          endpoint: '/search',
+          url: 'https://qveris.ai/api/v1/search',
+          timeout_ms: 30000,
+          http_status: 0,
+          error_type: 'network_error',
+        },
+      });
+    });
   });
 
   describe('getToolsByIds', () => {
@@ -235,21 +274,27 @@ describe('QverisClient', () => {
     });
 
     it('should throw ApiError on non-OK response', async () => {
-      fetchMock.mockResolvedValueOnce({
-        ok: false,
-        status: 400,
-        statusText: 'Bad Request',
-        json: async () => ({ message: 'Invalid tool_ids' }),
-      });
-
-      await expect(
-        client.getToolsByIds({ tool_ids: [] })
-      ).rejects.toEqual({
-        status: 400,
-        message: 'Invalid tool_ids',
-        details: { message: 'Invalid tool_ids' },
-      });
-    });
+      fetchMock.mockResolvedValueOnce({
+        ok: false,
+        status: 400,
+        statusText: 'Bad Request',
+        json: async () => ({ message: 'Invalid tool_ids' }),
+      });
+
+      await expect(
+        client.getToolsByIds({ tool_ids: [] })
+      ).rejects.toMatchObject({
+        status: 400,
+        message: 'Invalid tool_ids',
+        details: { message: 'Invalid tool_ids' },
+        observability: {
+          operation: 'inspect',
+          endpoint: '/tools/by-ids',
+          http_status: 400,
+          error_type: 'http_error',
+        },
+      });
+    });
 
     it('should handle non-JSON error response', async () => {
       fetchMock.mockResolvedValueOnce({
@@ -261,14 +306,19 @@ describe('QverisClient', () => {
         },
       });
 
-      await expect(
-        client.getToolsByIds({ tool_ids: ['tool-1'] })
-      ).rejects.toEqual({
-        status: 500,
-        message: 'Internal Server Error',
-        details: undefined,
-      });
-    });
+      await expect(
+        client.getToolsByIds({ tool_ids: ['tool-1'] })
+      ).rejects.toMatchObject({
+        status: 500,
+        message: 'Internal Server Error',
+        observability: {
+          operation: 'inspect',
+          endpoint: '/tools/by-ids',
+          http_status: 500,
+          error_type: 'http_error',
+        },
+      });
+    });
   });
 
   describe('executeTool', () => {