fix(mcp-server): use platform default shell for execShell to support …

[Lohith2005]

…Windows

[Copilot]

Pull request overview

Updates execShell in the MCP server toolkit to use the platform-appropriate default shell so shell execution works on Windows (instead of hard-coding /bin/sh).

Changes:

• Detect Windows at runtime and route execShell through cmd.exe-style invocation.
• Add node:process import to support platform/env access for shell selection.

Suppressed comments (2)

apps/mcp-server/src/tools/kit.ts:143

• On Windows, selecting the shell from COMSPEC/ComSpec makes the actual executable depend on the server environment rather than the policy-screened command line. That can undermine the allowlist/denylist intent (e.g., a safe-looking git … command could still be executed by a replaced COMSPEC program). Also, invoking cmd.exe without /d can run AutoRun commands from the registry, which is undesirable in a sandboxed tool runner.

Prefer invoking cmd.exe directly and disable AutoRun via /d (and /s for standard cmd parsing).

  const isWin = process.platform === 'win32';
  const shell = isWin ? process.env.COMSPEC || process.env.ComSpec || 'cmd.exe' : '/bin/sh';
  const shellArgs = isWin ? ['/c', screened] : ['-c', screened];
  return execFile(shell, shellArgs, options);

apps/mcp-server/src/tools/kit.ts:143

• This change introduces OS-dependent behavior (cmd.exe vs /bin/sh) but there are no unit tests exercising execShell’s platform selection and argument construction. Adding a small test would prevent regressions (e.g., accidentally using the wrong flags on Windows).

  const isWin = process.platform === 'win32';
  const shell = isWin ? process.env.COMSPEC || process.env.ComSpec || 'cmd.exe' : '/bin/sh';
  const shellArgs = isWin ? ['/c', screened] : ['-c', screened];
  return execFile(shell, shellArgs, options);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.