Skip to content

fix(scripts): double backslashes before a quote in win-shell-args - #5143

Merged
cliffhall merged 1 commit into
v2/mainfrom
v2/fix/5111-win-shell-args-backslash
Oct 13, 2026
Merged

cliffhall merged 1 commit into
v2/mainfrom
v2/fix/5111-win-shell-args-backslash

Conversation

@cliffhall

Copy link
Copy Markdown
Member

Closes #5111

Description

quoteWinArg (scripts/lib/win-shell-args.mjs) wrapped an argument in "…" and doubled inner quotes, but left backslashes alone. Under the Windows CRT argument rules, backslashes are literal except before a ", where 2n backslashes yield n and leave the quote special. So C:\a b\ was quoted as "C:\a b\", whose final \" reads as an escaped quote rather than the closing one, and the child received a different argument with the rest of the command line swallowed into it. Backslashes before an embedded quote had the same problem.

Now any run of backslashes that ends up in front of a quote is doubled: one before an embedded ", and a trailing run, which the closing quote follows. The embedded " itself stays doubled as "" rather than written \", because "" keeps cmd.exe's own quote tracking in step, while \" would flip it and expose any metacharacter after it.

Server Details

None (repository-wide): dev tooling only. The callers are verify-skills-cli.mjs, claude-cli.mjs, gate-lease.mjs and interface-diff.mjs, and only on Windows. Nothing published uses it.

Motivation and Context

Found by Copilot on the v1.0.0 merge PR #5090; tracked in #5111.

How Has This Been Tested?

No client-observable surface, so this carries a targeted probe instead of client evidence:

  • New tests in scripts/lib/win-shell-args.test.mjs: a trailing backslash (single and double), backslashes before an embedded quote, backslashes not followed by a quote left alone, and a round trip of every case through a reference MSVCRT (2008+) parser, so the expectations are checked against what the child actually receives rather than against a hand-written string.
  • Before/after: the same test file run against v2/main's win-shell-args.mjs fails 3 of 11 (the trailing-backslash, embedded-quote and round-trip tests); against this branch, all 11 pass.
  • npm run local:gate: exit 0.

Breaking Changes

None.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature
  • Breaking change
  • Documentation update

Checklist

  • I have read the MCP Protocol Documentation (not applicable: no protocol surface touched)
  • My changes follow MCP security best practices (not applicable: dev tooling only)
  • I have updated the server's README accordingly (not applicable: no server changed)
  • I have added a changeset (npm run changeset) if this changes what a TypeScript server publishes (not applicable: nothing published changes)
  • I have tested this with an LLM client (not applicable: no client-observable surface; see the targeted probe above)
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling (not applicable: no new failure modes; the % refusal is unchanged)
  • I have documented all environment variables and configuration options (not applicable: none added)

🤖 Generated with Claude Code

An argument ending in a backslash was quoted as "...\\", which the CRT
parser reads as an escaped quote, swallowing the rest of the command line.
Backslash runs before an embedded quote or the closing quote are now doubled,
with tests including a round trip through a reference CRT parser.

Closes #5111

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: cliffhall <cliff@futurescale.com>
@cliffhall cliffhall added the v2 label Oct 13, 2026
@changeset-bot

changeset-bot Bot commented Oct 13, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: fd55745

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@cliffhall
cliffhall requested a balanced review from Copilot October 13, 2026 04:51
@github-actions

Copy link
Copy Markdown
Contributor

everything: MCP interface diff

Base: d7f76a6e20cc (Merge pull request #5141 from modelcontextprotocol/v2/chore/5091-workflow-token-permissions)
Head: the build in this checkout, at b21543d2e95b (Merge fd55745 into d7f76a6)

✅ No interface changes detected.

Tools Prompts Resources Resource templates
Base 22 4 7 3
Head 22 4 7 3

Updated by this run for fd55745f663d25622ed1478ae199f8e145bc15d1.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The focused fix satisfies #5111 and is supported by comprehensive regression tests.

0 open findings

What changed in this PR

Fixes Windows shell argument quoting so backslashes preceding quotes survive CRT parsing correctly.

Changes:

  • Doubles backslash runs before embedded and closing quotes.
  • Adds targeted expectations and CRT round-trip regression tests.
File Description
scripts/​lib/​win-shell-args.mjs Corrects Windows argument escaping.
scripts/​lib/​win-shell-args.test.mjs Covers trailing backslashes, embedded quotes, and round trips.

🧠 Review effort: Balanced


💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

@cliffhall

Copy link
Copy Markdown
Member Author

Copilot round 1: clean (0 findings, approval recommended). Loop stopped on the first clean round; nothing pushed after the review.

@cliffhall
cliffhall merged commit 59abda2 into v2/main Oct 13, 2026
33 checks passed
@cliffhall
cliffhall deleted the v2/fix/5111-win-shell-args-backslash branch October 13, 2026 05:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

scripts: win-shell-args mis-quotes an argument that ends in a backslash

2 participants