Repository navigation
Conversation
provisionBuiltinPlugin() skipped win32 entirely and ensureStepPageReady() refused to install without a healthy executable, so the built-in steppage plugin could never set up steppage-mcp on Windows and every launch reported "automatic installation is currently supported on macOS and Linux" (stepfun-ai#219). Windows cannot run the POSIX installer script, so install the published bundle directly: download steppage-mcp.mjs, write a steppage-mcp.cmd wrapper next to it under ~/.local/bin, and verify the result. Executable probes run through `cmd /d /c` on Windows so both bare PATHEXT lookups and explicit .cmd files resolve on every Node runtime. The lock, Node.js >= 20 check, credential handling and failure reporting stay shared with the POSIX path; only the download-and-execute step is platform-specific. The Windows failure hint points at `step mcp prepare` instead of the POSIX-only `curl | sh` pipeline.
On Windows, `cmd` searches the current working directory before PATH, so probing the bare `steppage-mcp` name could execute a project-controlled `steppage-mcp.cmd`. Windows candidates are now resolved to absolute files from absolute PATH entries only (`.cmd`, `.exe`, `.bat`), followed by the managed `~/.local/bin/steppage-mcp.cmd` wrapper; relative PATH entries, including `.`, are skipped. The bundle URL is now derived from STEPCODE_STEPPAGE_INSTALLER_URL with URL parsing, so a mirror's credentials, query parameters, percent-encoding and fragment are preserved when switching to `latest/steppage-mcp.mjs`. Tests cover absolute-only Windows probes, a PATH that contains the working directory, and mirror URL preservation.
Native Windows validation showed the generated `steppage-mcp.cmd` wrapper invoked a bare `node`, which `cmd` resolves from the working directory before PATH: a project-controlled `node.cmd` ran in its place. Windows now resolves `node.exe` from absolute PATH entries only, runs the Node.js >= 20 check with that absolute path, and writes the same path into the wrapper. Setup fails closed when no such `node.exe` exists. `process.execPath` is not used because in the standalone binary it is Step itself. Mirror URLs could also carry a password or token into the final error text on both the Windows and POSIX paths, either from a curl failure or from the manual install hint. The complete message is now redacted: URL userinfo, token-like query or fragment parameters, and secret-named environment values. Detail is redacted before truncation so a cut cannot strip the scheme that marks a URL. The missing-executable hint in the MCP startup message uses the same redaction. Tests cover node.exe resolution that skips relative entries and the working directory, the runtime check and wrapper sharing one absolute path, failing closed without node.exe, and credential-free failure text for Windows, Linux and the MCP startup hint.
Resolve Windows provisioning executables from absolute PATH entries and probe wrappers by basename from their own directory. Redact quoted mirror URLs and use the native preparation hint on Windows.
li-xiu-qi
marked this pull request as ready for review
October 26, 2026 07:47
li-xiu-qi
requested review from
MelodyVAR,
Uking-xxx,
ZouR-Ma and
liuedcson
as code owners
October 26, 2026 07:47
Contributor
|
@li-xiu-qi thank you for opening this from our branch and for the extra hardening commit on top of our three commits — that matches what we wanted for the Windows path. CI looks green on our side of the story too. Maintainers: this closes the Windows provisioning gap from #219 (already |
Contributor
|
Follow-up after local re-check of head
No further code changes from our side. Please associate #219 when reviewing. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #304
Refs #219
Problem
#219 identified the missing automatic StepPage provisioning path on Windows. The candidate implementation adds that path, but bare
cmdandcurl.execan still resolve through the working directory, and the wrapper health probe can still pass special path text throughcmdparsing. URL forms containing single quotes can bypass redaction, while Windows ENOENT guidance still points to POSIXcurl | sh.This PR retains Hylouis233's three original commits and adds focused hardening plus native Windows acceptance coverage.
Changes
Windows provisioning installs the published StepPage bundle and writes
~/.local/bin/steppage-mcp.cmd. It resolvesnode.exe,cmd.exe, andcurl.exeonly from absolute PATH entries. Missingcmd.exeorcurl.exefails before any download begins.The health probe sets cwd to the wrapper directory and invokes the wrapper by a fixed basename through an absolute
cmd.exe. Spaces,&, and%in that directory stay out of thecmdcommand line.Error reporting redacts userinfo and sensitive query/fragment values in both raw and shell-escaped URLs, and also redacts environment-variable values. Windows ENOENT now points users to
step mcp prepare. Documentation and regression tests are updated with the implementation.Behavior and compatibility
On Windows,
step mcp preparecan automatically install StepPage and reuse a healthy installation. Custom commands, disabled configurations, and explicit uninstall behavior are unchanged. StepPage still requires Node >=20.The POSIX installation flow is unchanged apart from broader redaction. Step itself does not gain a separate Node dependency.
Validation
Final HEAD is
e37e8d44ac5cc1a290e0599466237968e781f6a5.The focused regression command is
Against unfixed
d77b1efe, the final tests report 5 failed / 29 passed. With the fix, the two focused test files pass 34/34.From
packages/coding-agent, the related four-file command ispnpm exec vitest --run test/steppage-provision-windows.test.ts src/step/mcp.test.ts test/step-plugins.test.ts src/step/mcp-startup.test.tsThe candidate reports 86 passed / 3 failed / 1 skipped, while unmodified
d77b1efereports 82 passed / 3 failed / 1 skipped. Both runs fail the same three tests:uses the Step namespace for default storageandwithholds project plugin resources unless the project is trustedintest/step-plugins.test.ts, anda plugin stdio server runs from the plugin root unless it names an absolute cwdinsrc/step/mcp-startup.test.ts.On native Windows with Node v24.21.0, repository-root
pnpm run checkpasses../test.shstops at the pre-existing Windows failureinstall.sh persists inherited PATH and preserves malformed user blocksinscripts/release-bundle.test.mjs. It does not reach the workspace packages.The isolated
pnpm -r --no-bail --if-present testworkspace run is not green on either tree. It contains 5,062 coding-agent tests on the candidate and 5,058 on unmodifiedd77b1efe, with 266 skipped in both. After normalizing duration suffixes in test names, there are 0 candidate-only failures and 7 baseline-only failures. The same five packages have pre-existing Windows failures in both runs.From
packages/coding-agent, this command uses the repository entry points to builddist/step-bin.exesuccessfully.bun build --compile --no-compile-autoload-bunfig --env=STEPCODE_BUILD_* ../../apps/cli/src/bun/stepcode.ts ./src/utils/image-resize-worker.ts ./src/step/usage/activity-worker.ts ./src/core/session-index/session-index-worker.ts --outfile dist/step-binThe old binary reports the StepPage version-check failure with isolated HOME
native&%PATH%probe. The new binary installs successfully when HOME contains spaces,&, and%PATH%, withnode.cmd,cmd.exe, andcurl.exedecoys in cwd. The wrapper returns1.0.0, MCP initialize reports serversteppageversion0.0.1, andtools/listreturns 13 tools.git diff --checkpasses, and the final diff contains 6 target files.Limitations
None known.