Repository navigation
Conversation
On Windows, VS Code's command line is code.cmd and npm installs Claude Code as claude.cmd. Node's spawn without a shell skips .cmd files on PATH and refuses to start them, so `dcd mcp install vscode` and `dcd mcp install claude-code` said the command wasn't on PATH. Find the command on PATH with PATHEXT ourselves. Run an .exe directly, and a .cmd or .bat through cmd.exe with each argument escaped for both of cmd's parse passes, so the --add-mcp JSON arrives unchanged. Fixes #281 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. 🤖 Generated with Claude Code |
A line break ends cmd's command line, so caret escaping can't protect an argument that holds one. No argument we pass can contain one today, but refuse it rather than rely on that. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
finalerock44
approved these changes
Nov 2, 2026
finalerock44
left a comment
finalerock44
left a comment
Contributor
There was a problem hiding this comment.
tested on windows 10; working as intended @riglar
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #281.
Problem
On Windows,
dcd mcp install vscodeanddcd mcp install claude-codesaycode/claudeisn't on PATH, even when it is.VS Code's command line on Windows is
code.cmd, and npm installs Claude Code asclaude.cmd.runToolcalledspawnSyncwithout a shell. Node then searches PATH only for.comand.exe, so it getsENOENT. Recent Node versions also refuse to start a.cmdwithout a shell (CVE-2024-27980).Fix
New
src/utils/tool-spawn.ts, used byrunTool:.exeis run directly..cmd/.batis run ascmd.exe /d /s /c "..."withwindowsVerbatimArguments. Each argument is quoted for the program's own parser, then each cmd special character is caret-escaped twice: once for thecmd /cline, and once for the batch file's%*, which cmd parses again.undefined, so the existing "isn't on PATH" message still shows.We start
cmd.exeourselves, so this doesn't depend on how Node or Bun resolve.cmdfiles. The npm install and the standalone binary should behave the same.Tests
test/unit/tool-spawn.test.tscovers the PATH search and the spawn shape. It also models cmd's two parse passes andCommandLineToArgvW, and checks that arguments come through unchanged. That includes the--add-mcpJSON with spaces and(x86)in its paths, and arguments with&,|,%,^, quotes and trailing backslashes. The model treats an unescaped&,|,<or>as an error, and the test fails if the second escape pass is removed.Not yet verified
dcd mcp install vscodeanddcd mcp install claude-code, with an npm install.windowsVerbatimArguments.🤖 Generated with Claude Code