From 39b56af47bfe43cb45de592ce2ae89f893519417 Mon Sep 17 00:00:00 2001
From: Mohamed Boudra <boudra.moha@gmail.com>
Date: Sun, 12 Apr 2026 21:43:28 +0700
Subject: [PATCH] Fix Windows MCP config mangling by bypassing cmd.exe shell
 for Claude spawn

On Windows, spawnProcess defaults to shell: true which routes through cmd.exe.
The SDK passes --mcp-config with inline JSON containing double quotes that
cmd.exe strips, producing an invalid string that Claude Code interprets as a
file path (e.g. D:\xFlow{mcpServers:{paseo:{type:http,url:http:\...}).
---
 packages/server/src/server/agent/providers/claude-agent.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/packages/server/src/server/agent/providers/claude-agent.ts b/packages/server/src/server/agent/providers/claude-agent.ts
index 5f56c7e7f..935583581 100644
--- a/packages/server/src/server/agent/providers/claude-agent.ts
+++ b/packages/server/src/server/agent/providers/claude-agent.ts
@@ -224,6 +224,10 @@ function applyRuntimeSettingsToClaudeOptions(
         },
         signal: spawnOptions.signal,
         stdio: ["pipe", "pipe", "pipe"],
+        // Bypass cmd.exe on Windows: the SDK passes --mcp-config with inline JSON
+        // containing double quotes, which cmd.exe mangles (strips quotes, breaks parsing).
+        // The command is always a resolved binary path, so shell routing is unnecessary.
+        shell: false,
       });
       if (typeof options.stderr === "function") {
         child.stderr?.on("data", (chunk: Buffer | string) => {