MiniMax-AI
diff --git a/‎plugins/antianqi/tool-map/scripts/scan.mjs‎
Lines changed: 35 additions & 2 deletions b/‎plugins/antianqi/tool-map/scripts/scan.mjs‎
Lines changed: 35 additions & 2 deletions
diff --git a/‎test/hosted-plugins.test.mjs‎
Lines changed: 11 additions & 1 deletion b/‎test/hosted-plugins.test.mjs‎
Lines changed: 11 additions & 1 deletion
diff --git a/‎test/tool-map.test.mjs‎
Lines changed: 83 additions & 0 deletions b/‎test/tool-map.test.mjs‎
Lines changed: 83 additions & 0 deletions
@@ -362,20 +362,52 @@ async function probeVersion(cmd) {
   // R4-3/R4-4 tests are smoke tests for the PATH+extension lookup,
   // not bug-replication tests. The R4-2 unit test IS a real
   // bug-replication test for the resolveProgram change itself.
+  //
+  // Round-8 finding: with `shell: true`, Node passes the program
+  // string to cmd.exe verbatim. A resolved path that contains a
+  // space (typical of the well-known `<install dir with space>`
+  // shim that wraps a Node-style tool) MUST be double-quoted,
+  // otherwise cmd.exe splits the command at the space and the
+  // failure is silently swallowed by the surrounding try/catch.
+  // See Node's child_process docs on "Spawning .bat and .cmd files
+  // on Windows" for the requirement.
   const resolved = resolveProgram(cmd[0]);
   const program = resolved || cmd[0];
+  const useShell = shouldUseShell(cmd[0]);
+  const execTarget = quoteForShell(program, { isShell: useShell });
   try {
-    const { stdout } = await execFileP(program, cmd.slice(1), {
+    const { stdout } = await execFileP(execTarget, cmd.slice(1), {
       timeout: 5000,
       windowsHide: true,
-      shell: shouldUseShell(cmd[0]),
+      shell: useShell,
     });
     const first = (stdout || '').split(/\r?\n/)[0].trim();
     if (first) return first;
   } catch { /* timeout, missing, or non-zero exit - all OK */ }
   return null;
 }
 
+// Quote a program path for the shell that execFile will use.
+//
+// - POSIX (`shell: true`): shell is /bin/sh, no quoting needed (POSIX
+//   probe names are bare names without spaces).
+// - Windows + `shell: true` (the .cmd/.bat case): cmd.exe parses the
+//   program string verbatim, so a path with a space or a `"` must be
+//   wrapped in `"..."` and any embedded `"` escaped as `\"`. Otherwise
+//   cmd.exe splits at the first space and reports an error that the
+//   surrounding try/catch in probeVersion silently swallows.
+// - Windows + `shell: false` (the .exe case): Node hands argv to
+//   CreateProcessW directly; quoting is the kernel's job, not ours.
+//   No string munging is needed.
+//
+// The function is pure and exported via internal scope so a unit
+// test can pin the contract without spawning a process.
+function quoteForShell(program, { isShell }) {
+  if (!isShell) return program;          // POSIX or Windows .exe
+  if (!/[\s"]/u.test(program)) return program; // already bare, no quoting needed
+  return `"${program.replace(/"/gu, '\\"')}"`;
+}
+
 // --- File walker ---
 const NPM_BIN_HINT = /minimax-code[\\\/]|openclaw[\\\/]|minimax[\\\/]bin|node_modules[\\\/]|\.Codex[\\\/]|\.claude[\\\/]|[\\\/]npm[\\\/]|tauri[\\\/]/i;
 function isToolFile(name, size, dirLower, stat) {
@@ -652,6 +684,7 @@ export {
   isToolFile, classify, walk,
   renderMarkdown, renderSummary,
   resolveProgram, shellForFile, shouldUseShell,
+  quoteForShell,
   probeVersion,
 };
 
 
@@ -36,7 +36,17 @@ test('contributor can scaffold a hosted Skill plugin with one command', async (c
   assert.match(readme, /# Hello World/u);
   assert.match(license, /Apache License/u);
   assert.match(skill, /^---\nname: hello-world\n/mu);
-  assert.match(stdout, /plugins\/alice\/hello-world/u);
+  // Cross-platform: `create-plugin.mjs:45` prints `path.relative(cwd, dest)`,
+  // which is platform-native (`\` on Windows, `/` on POSIX). A POSIX-only
+  // regex would fail on Windows CI. Round-8 fix (amszuidas on PR #5):
+  // accept either separator by testing the path with `path.join` and
+  // string `.includes`. The plugin itself is at the same workspace-relative
+  // location on every platform; only the printed separator changes.
+  const expectedScaffoldPath = path.join('plugins', 'alice', 'hello-world');
+  assert.ok(
+    stdout.includes(expectedScaffoldPath),
+    `stdout should mention ${JSON.stringify(expectedScaffoldPath)} (got: ${JSON.stringify(stdout)})`,
+  );
 });
 
 test('hosted Plugin is valid when its package and contribution docs are complete', async (context) => {
 
@@ -1015,3 +1015,86 @@ test('XDG_DATA_HOME is honoured when PLUGIN_DATA is unset', () => {
     rmSync(xdg, { recursive: true, force: true });
   }
 });
+
+// --- quoteForShell (round-8, PR #5 amszuidas) -------------------------------
+// amszuidas round-8 (PR #5, 2026-09-07T03:17:11Z): on Windows, when
+// `shouldUseShell` is true (the .cmd / .bat branch), execFile passes the
+// program string to cmd.exe verbatim. A path that contains a space
+// (e.g. `C:\Program Files\nodejs\npm.cmd`) is therefore split at the
+// first space; the failure is silently swallowed by probeVersion's
+// try/catch and the tool is reported with no version. The fix is
+// `quoteForShell`: wrap the path in `"..."` and escape any embedded
+// `"` so cmd.exe treats the whole path as the command. These four
+// tests pin the contract on a pure function so a future regression
+// (e.g. a refactor that drops the helper, or a copy-paste that
+// forgets the escape) breaks CI on every platform without needing a
+// Windows runner.
+
+test('quoteForShell is a no-op when the program has no spaces or quotes', async () => {
+  const scanUrl = pathToFileURL(SCAN).href;
+  const { quoteForShell } = await import(scanUrl);
+  // Bare-name POSIX probe: even with `isShell: true`, no quoting needed.
+  assert.equal(quoteForShell('node', { isShell: true }), 'node');
+  // Windows .exe case: `isShell: false` means Node hands argv to
+  // CreateProcessW directly, where the kernel handles quoting.
+  assert.equal(quoteForShell('node', { isShell: false }), 'node');
+  // A POSIX path with no spaces: same result, no quoting.
+  assert.equal(
+    quoteForShell('/usr/local/bin/node', { isShell: true }),
+    '/usr/local/bin/node',
+  );
+});
+
+test('quoteForShell double-quotes a path with a space when shell is true', async () => {
+  const scanUrl = pathToFileURL(SCAN).href;
+  const { quoteForShell } = await import(scanUrl);
+  // The motivating case: `C:\Program Files\nodejs\npm.cmd`.
+  // Without quoting, cmd.exe sees `C:\Program` as the command and
+  // `Files\nodejs\npm.cmd --version` as args, and fails. With
+  // quoting, the whole path is the command.
+  assert.equal(
+    quoteForShell('C:\\Program Files\\nodejs\\npm.cmd', { isShell: true }),
+    '"C:\\Program Files\\nodejs\\npm.cmd"',
+  );
+  // A POSIX path with a space (rare but possible: e.g. `/opt/Some
+  // Tool/node`) gets the same treatment, because /bin/sh also
+  // splits on whitespace.
+  assert.equal(
+    quoteForShell('/opt/Some Tool/node', { isShell: true }),
+    '"/opt/Some Tool/node"',
+  );
+});
+
+test('quoteForShell escapes embedded double quotes in the program path', async () => {
+  // Defensive: a path with a literal `"` in it (legacy Windows
+  // volumes) must be escaped so the surrounding `"..."` is not
+  // terminated prematurely. Without the escape, cmd.exe would see
+  // `"C:\path\with` followed by `quote.cmd" --version` and parse
+  // it as: command=`"C:\path\with`, arg=`quote.cmd" --version`,
+  // which fails. The fix uses the standard `\"` escape inside a
+  // `"..."` quoted string.
+  const scanUrl = pathToFileURL(SCAN).href;
+  const { quoteForShell } = await import(scanUrl);
+  assert.equal(
+    quoteForShell('C:\\path\\with"quote.cmd', { isShell: true }),
+    '"C:\\path\\with\\"quote.cmd"',
+  );
+});
+
+test('quoteForShell leaves the program untouched when shell is false', async () => {
+  // Windows .exe / Linux binary case: shell: false, Node hands argv
+  // to CreateProcessW / execve directly. The kernel handles argv
+  // quoting; our function must not mangle the path with `"..."`.
+  // (The .cmd branch never reaches this case because shouldUseShell
+  // is true for .cmd / .bat. This test pins the no-op for .exe.)
+  const scanUrl = pathToFileURL(SCAN).href;
+  const { quoteForShell } = await import(scanUrl);
+  assert.equal(
+    quoteForShell('C:\\Program Files\\nodejs\\node.exe', { isShell: false }),
+    'C:\\Program Files\\nodejs\\node.exe',
+  );
+  assert.equal(
+    quoteForShell('/usr/bin/node', { isShell: false }),
+    '/usr/bin/node',
+  );
+});