fix(server): preserve Windows path backslashes when parsing stdio args - #1613
fix(server): preserve Windows path backslashes when parsing stdio args#1613Mordris wants to merge 1 commit into
Conversation
shell-quote treats `\` as its escape character, so parsing the args string on Windows stripped every backslash from paths like C:\Users\name\app.jar and the resulting file could not be found. Parse with cmd.exe's escape character `^` on win32 instead. Other platforms are unchanged. Fixes modelcontextprotocol#853
|
Closing: v1 is deprecated. Thank you for this contribution, and apologies for the long wait for a response. v1 will receive security fixes only. We reviewed every open v1 PR for security impact before closing — see the backlog triage in #1819 — and a small number were retained for a final If the underlying problem still exists in v2, we'd genuinely like to know. Please open an issue describing it against v2. Note that we accept external contributions as issues rather than pull requests — maintainers handle design and implementation through a prompt-driven workflow. See Thanks again for taking the time to contribute to the Inspector. |
cliffhall
added
the
closed-v1-deprecated
2 participants
Summary
On Windows, launching a server whose arguments contain a path like
C:\Users\name\app.jarfails because the proxy strips the backslashes whiletokenizing the args string. shell-quote uses
\as its escape character bydefault, which is right for POSIX shells but wrong for Windows paths. This
change passes
{ escape: "^" }(cmd.exe's escape character) to shell-quote onwin32 only. One call site in
server/src/index.ts, no new files ordependencies.
Type of Change
Changes Made
createTransportinserver/src/index.tsnow callsshellParseArgswith aparse option that sets the escape character to
^whenprocess.platform === "win32". On every other platform the options argumentis
undefined, which shell-quote treats exactly like the old two-argumentcall.
Related Issues
Fixes #853
Testing
Test Results and/or Instructions
Reproduced on Windows 10 with the flow from the issue:
node client/bin/start.js node C:\path\to\script.js, then Connect in the UI.Before the fix the server log shows
STDIO transport: ... args=C:Userspathtoscript.jsand the spawn cannot findthe file. With the fix the same steps log the path intact and the script
actually runs.
Other inputs I checked on Windows: a quoted path with spaces
(
"C:\Program Files\My App\server.jar"), a UNC path(
\\server\share\tool.jar), quoted values with spaces(
--name="hello world"), plain flag-style args, and a trailing backslash(
--dir C:\Users\test\ --flag), which previously also merged the twofollowing tokens into one argument. Non-Windows parsing is untouched.
One behavior note: on Windows a bare
^is now consumed as an escapecharacter, same as in cmd.exe. Quoting it (
"foo^bar") keeps it literal.Checklist
npm run prettier-fix)Breaking Changes
None.