Core tests fail on Adobe ColdFusion: `MID()` called with invalid number of arguments in `McpCommandInjectionSpec.cfc`

[zainforbjs]

Describe the bug
When running the Wheels core test suite on Adobe ColdFusion, the tests fail with the following error:

Parameter validation error for the MID function.
The function takes 3 parameters.

The error occurs in:
/vendor/wheels/tests/specs/security/McpCommandInjectionSpec.cfc: line 117

This indicates that Mid() is being called with an unsupported number of arguments. Adobe ColdFusion requires exactly three parameters: Mid(string, start, count).

To Reproduce
Steps to reproduce the behavior:

1. Run the Wheels core test suite on Adobe ColdFusion.
2. Observe the test failure.
3. Review the stack trace pointing to:
   /vendor/wheels/tests/specs/security/McpCommandInjectionSpec.cfc: line 117

Expected behavior
The core tests should run successfully on Adobe ColdFusion without function argument validation errors.

Screenshots

Desktop:

• OS: Any
• CFML Engine: Adobe Coldfusion

[wheels-bot]

Wheels Bot — Triage

Classified as bug.

Suspected layer

cli — see .ai/wheels/cli/ for canonical patterns. Note the actual fix lives in test code (vendor/wheels/tests/specs/security/McpCommandInjectionSpec.cfc), but the spec is exercising the MCP/CLI command-injection security surface. The cross-engine angle is documented in .ai/wheels/cross-engine-compatibility.md and CLAUDE.md § "Known cross-engine gotchas".

Fix sketch

Adobe ColdFusion requires mid(string, start, count) with exactly three arguments; Lucee/BoxLang accept two and default count to the remainder of the string. The spec uses mid(command, 7) in four places (lines 105, 117, 133, 150) to strip the leading wheels prefix. Replace each call with an Adobe-safe equivalent — either mid(command, 7, len(command)) or, more idiomatically, right(command, len(command) - 6). Single-file change, no framework code touched, no behavior change on Lucee/BoxLang. After the fix, re-run the Adobe CF 2023/2025 cells of compat-matrix.yml (or tools/test-matrix.sh adobe2023 sqlite) to confirm the security spec compiles and the full suite no longer crashes.

Confidence: medium

Auto-downgraded from high per the cross-engine rule — the defect is a Lucee-vs-Adobe mid() arity mismatch, exactly the class of issue the rule guards. The fix itself is mechanical, but the downgrade keeps a human in the loop for the cross-engine verification.

<!-- wheels-bot:triage:2613 -->
<!-- wheels-bot:triage-class:bug -->

[bpamiri]

Wheels Bot — Fix proposed

Draft PR: #2617

Spec: vendor/wheels/tests/specs/security/McpCommandInjectionSpec.cfc — four existing mid(s, 7) call sites switched to the Adobe-safe 3-arg form, plus a new explicit regression guard (strips wheels prefix using Adobe-safe 3-arg mid()).
Implementation: vendor/wheels/public/mcp/McpServer.cfc:1284 — the same 2-arg mid() bug existed in the production MCP command executor (the spec was indirectly auditing this code path), so the fix is applied there too.

Verified locally on both engines:

• Lucee 7 + SQLite: 174/174 security specs pass
• Adobe CF 2023 + SQLite: 174/174 security specs pass (was 0 pass / bundle crash before the fix)

A human review is required before merge. Reviewer A and Reviewer B will weigh in shortly. Doc updates (MDX guides, .ai/wheels/cross-engine-compatibility.md, CLAUDE.md) are handled separately by bot-update-docs.yml.