fix(cli): quote the cmd.exe command path with real quotes on Windows

src/__tests__/commands/setup-windows-spawn.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, it } from 'vitest';
+import {
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'fs';
+import os from 'os';
+import path from 'path';
+import { runClientCommand } from '../../commands/setup';
+
+// Spawns a real cmd.exe, unlike setup.test.ts which mocks child_process.
+describe.runIf(process.platform === 'win32')(
+  'runClientCommand on Windows (real cmd.exe)',
+  () => {
+    it('launches a .cmd shim under a path with spaces and parentheses and passes argv through exactly', () => {
+      const root = mkdtempSync(path.join(os.tmpdir(), 'firecrawl-spawn-'));
+      const bin = path.join(root, 'Program Files (x86)', 'nodejs');
+      const outFile = path.join(root, 'argv.json');
+      try {
+        mkdirSync(bin, { recursive: true });
+        writeFileSync(
+          path.join(bin, 'record-argv.js'),
+          'require("fs").writeFileSync(process.env.ARGV_OUT, JSON.stringify(process.argv.slice(2)));\n'
+        );
+        writeFileSync(
+          path.join(bin, 'record-argv.cmd'),
+          '@echo off\r\nnode "%~dp0record-argv.js" %*\r\n'
+        );
+        const args = [
+          '--name',
+          'firecrawl',
+          'https://mcp.firecrawl.dev/v2/mcp?a=1&b=2',
+          'Authorization: Bearer ${FIRECRAWL_API_KEY}',
+        ];
+
+        runClientCommand(path.join(bin, 'record-argv.cmd'), args, {
+          stdio: 'pipe',
+          env: { ...process.env, ARGV_OUT: outFile },
+        });
+
+        expect(JSON.parse(readFileSync(outFile, 'utf8'))).toEqual(args);
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    });
+  }
+);

src/__tests__/commands/setup.test.ts

@@ -886,7 +886,11 @@ describe('handleSetupCommand', () => {
       expect(command).toBe('cmd.exe');
       expect(passthruArgs.slice(0, 3)).toEqual(['/d', '/s', '/c']);
       expect(opts?.windowsVerbatimArguments).toBe(true);
-      expect(passthruArgs[3]).toContain(`^\"${path.join(bin, 'npx.CMD')}^\"`);
+      // cmd.exe parses the command token itself, so its quotes must stay real
+      // quotes: a caret-escaped ^" is a literal character there, and the path
+      // would split at the space in "Program Files".
+      expect(passthruArgs[3]).toContain(`""${path.join(bin, 'npx.CMD')}" `);
+      expect(passthruArgs[3]).not.toContain(`^\"${path.join(bin, 'npx.CMD')}`);
       expect(passthruArgs[3]).toContain('add-mcp@1.14.0');
       expect(passthruArgs[3]).toContain(
         '^"Authorization: Bearer ${FIRECRAWL_API_KEY}^"'

src/commands/setup.ts

@@ -115,6 +115,19 @@ function escapeCmdArg(arg: string): string {
   return quoted.replace(CMD_META_CHARS, '^$1');
 }
 
+/** Quote the program path that cmd.exe itself resolves. Unlike arguments, this
+ * token is parsed by cmd.exe, where a caret-escaped ^" is a literal character
+ * rather than a quote, so escaping it would split paths such as
+ * `C:\Program Files\nodejs\npx.cmd` at the space. Windows paths cannot contain
+ * `"`, so plain quotes are unambiguous here. */
+function quoteCmdCommand(command: string): string {
+  rejectCommandControlCharacters(command, 'Command');
+  if (command.includes('"')) {
+    throw new Error('Command path contains an unsupported quote character.');
+  }
+  return `"${command}"`;
+}
+
 function windowsPathExtensions(env: NodeJS.ProcessEnv): string[] {
   const configured = env.PATHEXT ?? '.COM;.EXE;.BAT;.CMD';
   return configured
@@ -168,7 +181,7 @@ function resolveWindowsCommand(
  * On every other platform we spawn the binary directly with no shell, exactly as
  * `execFileSync` did before.
  */
-function runClientCommand(
+export function runClientCommand(
   command: string,
   args: string[],
   options: Parameters<typeof execFileSync>[2]
@@ -189,7 +202,7 @@ function runClientCommand(
     return;
   }
 
-  const line = [escapeCmdArg(resolved), ...args.map(escapeCmdArg)].join(' ');
+  const line = [quoteCmdCommand(resolved), ...args.map(escapeCmdArg)].join(' ');
   const comspec = env.ComSpec ?? env.COMSPEC ?? 'cmd.exe';
   const windowsOptions = {
     ...options,