fix(cli,mcp): harden MCP probe and observability

Author: sheep-cloud12138

packages/cli/src/commands/mcp.mjs

@@ -444,7 +444,7 @@ export function resolveProbeTimeoutMs(timeout) {
   return Math.max(1000, usableSeconds * 1000);
 }
 
-export function mcpSpawnOptions(env = {}, os = platform()) {
+export function mcpSpawnOptions(env = {}, _os = platform()) {
   return {
     env: { ...process.env, ...(env || {}) },
     stdio: ["pipe", "pipe", "pipe"],
@@ -470,11 +470,37 @@ function isWindowsExecutable(command) {
 
 function wrapWindowsCommandLine(parts) {
   const commandLine = parts
-    .map((part) => shellQuoteForPlatform(part, "win32"))
+    .map((part) => quoteWindowsCommandArgument(part))
     .join(" ");
   return `"${commandLine}"`;
 }
 
+function quoteWindowsCommandArgument(value) {
+  const text = String(value).replaceAll("%", "%%");
+  let quoted = "\"";
+  let backslashes = 0;
+
+  for (const char of text) {
+    if (char === "\\") {
+      backslashes += 1;
+      continue;
+    }
+    if (char === "\"") {
+      quoted += "\\".repeat(backslashes * 2 + 1);
+      quoted += char;
+      backslashes = 0;
+      continue;
+    }
+    quoted += "\\".repeat(backslashes);
+    backslashes = 0;
+    quoted += char;
+  }
+
+  quoted += "\\".repeat(backslashes * 2);
+  quoted += "\"";
+  return quoted;
+}
+
 function extractServer(target, config) {
   if (target === "cursor" || target === "claude-desktop") return config?.mcpServers?.qveris;
   if (target === "opencode") return config?.mcp?.qveris;

packages/cli/test/mcp.test.mjs

@@ -100,6 +100,29 @@ test("mcp live probe wraps Windows command shims through cmd.exe without shell o
   ]);
 });
 
+test("mcp live probe safely quotes Windows command shim arguments", () => {
+  const spec = mcpSpawnCommand(
+    {
+      command: "C:\\Tools\\npm shim\\npx.cmd",
+      args: [
+        "--name=foo\"bar",
+        "C:\\temp\\tail\\",
+        "100% ready",
+        "safe&literal",
+      ],
+    },
+    "win32",
+  );
+
+  assert.equal(spec.command.endsWith("cmd.exe"), true);
+  assert.deepEqual(spec.args, [
+    "/d",
+    "/s",
+    "/c",
+    "\"\"C:\\Tools\\npm shim\\npx.cmd\" \"--name=foo\\\"bar\" \"C:\\temp\\tail\\\\\" \"100%% ready\" \"safe&literal\"\"",
+  ]);
+});
+
 test("mcp command quoting follows the target shell platform", () => {
   assert.equal(shellQuoteForPlatform("L'Ondon", "darwin"), `'L'\\''Ondon'`);
   assert.equal(shellQuoteForPlatform('say "hi"', "win32"), `"say ""hi"""`);

packages/mcp/src/api/client.test.ts

@@ -99,19 +99,19 @@ describe('QverisClient', () => {
     });
 
     it('should throw ApiError on non-OK response', async () => {
-      fetchMock.mockResolvedValueOnce({
-        ok: false,
-        status: 401,
-        statusText: 'Unauthorized',
-        json: async () => ({ message: 'Invalid API key' }),
-      });
-
-      await expect(client.searchTools({ query: 'test' })).rejects.toEqual({
-        status: 401,
-        message: 'Invalid API key',
-        details: { message: 'Invalid API key' },
-      });
-    });
+      fetchMock.mockResolvedValueOnce({
+        ok: false,
+        status: 401,
+        statusText: 'Unauthorized',
+        json: async () => ({ message: 'Invalid API key' }),
+      });
+
+      await expect(client.searchTools({ query: 'test' })).rejects.toMatchObject({
+        status: 401,
+        message: 'Invalid API key',
+        details: { message: 'Invalid API key' },
+      });
+    });
 
     it('should handle non-JSON error response', async () => {
       fetchMock.mockResolvedValueOnce({
@@ -123,12 +123,29 @@ describe('QverisClient', () => {
         },
       });
 
-      await expect(client.searchTools({ query: 'test' })).rejects.toEqual({
-        status: 500,
-        message: 'Internal Server Error',
-        details: undefined,
-      });
-    });
+      await expect(client.searchTools({ query: 'test' })).rejects.toMatchObject({
+        status: 500,
+        message: 'Internal Server Error',
+      });
+    });
+
+    it('should convert fetch network failures to observable ApiError', async () => {
+      fetchMock.mockRejectedValueOnce(
+        new Error('fetch failed', { cause: new Error('ECONNRESET') })
+      );
+
+      await expect(client.searchTools({ query: 'test' })).rejects.toMatchObject({
+        status: 0,
+        message: 'fetch failed',
+        cause: 'ECONNRESET',
+        observability: {
+          operation: 'discover',
+          endpoint: '/search',
+          http_status: 0,
+          error_type: 'network_error',
+        },
+      });
+    });
   });
 
   describe('getToolsByIds', () => {
@@ -242,14 +259,14 @@ describe('QverisClient', () => {
         json: async () => ({ message: 'Invalid tool_ids' }),
       });
 
-      await expect(
-        client.getToolsByIds({ tool_ids: [] })
-      ).rejects.toEqual({
-        status: 400,
-        message: 'Invalid tool_ids',
-        details: { message: 'Invalid tool_ids' },
-      });
-    });
+      await expect(
+        client.getToolsByIds({ tool_ids: [] })
+      ).rejects.toMatchObject({
+        status: 400,
+        message: 'Invalid tool_ids',
+        details: { message: 'Invalid tool_ids' },
+      });
+    });
 
     it('should handle non-JSON error response', async () => {
       fetchMock.mockResolvedValueOnce({
@@ -261,14 +278,13 @@ describe('QverisClient', () => {
         },
       });
 
-      await expect(
-        client.getToolsByIds({ tool_ids: ['tool-1'] })
-      ).rejects.toEqual({
-        status: 500,
-        message: 'Internal Server Error',
-        details: undefined,
-      });
-    });
+      await expect(
+        client.getToolsByIds({ tool_ids: ['tool-1'] })
+      ).rejects.toMatchObject({
+        status: 500,
+        message: 'Internal Server Error',
+      });
+    });
   });
 
   describe('executeTool', () => {