Make MCP Mix invocation portable on Windows

[bobaikato]

Finding

The released Ota v1.6.27 matrix showed the MCP harness passing on Ubuntu and macOS but failing on Windows. Two Windows-specific process boundaries were involved:

• the smoke fixture created only a Unix-style mix executable and used the Unix : PATH delimiter;
• Node's shell-free process launch could not execute the Windows mix.cmd command shim.

Original evidence:
https://github.com/bobaikato/pythiaLabs/actions/runs/33517820099/job/99894708547

Fix

• create a Windows-discoverable mix.cmd fixture alongside the Unix stub;
• prepend its directory with Node's platform-native path.delimiter;
• resolve the fixed mix command through the Windows command shell only on Windows, while preserving shell-free process launch on Unix.

The command and arguments remain fixed; no caller-controlled shell input is introduced.

Validation

• node --check integrations/mcp/smoke.mjs
• node integrations/mcp/smoke.mjs: all assertions passed locally
• final Windows artifact: verify-mcp-smoke=0
• exact combined repair matrix: https://github.com/bobaikato/pythiaLabs/actions/runs/33540883165

The same Windows artifact also retained passing workflow MCP output and the non-credentialed conformance lanes. Existing Elixir-format and Prettier deviations remain separate and unchanged.

Scope

Only integrations/mcp/smoke.mjs and integrations/mcp/server.mjs change. There are no dependency, Ota-contract, workflow, formatting, or unrelated refactoring changes.

This draft is separate from Ota adoption PR #264 and implies no merge approval or endorsement.

[coderabbitai]

Warning

Review limit reached

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: e1a99828-d76f-4b50-835d-fca9b785bad0

📥 Commits

Reviewing files that changed from the base of the PR and between 17df877 and 70d4a98.

📒 Files selected for processing (2)

• integrations/mcp/server.mjs
• integrations/mcp/smoke.mjs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[safal207]

Exact-head review: 70d4a98a4801884b1c75df0166154e2d6d28853b.

The portability change is bounded to Windows command-shim resolution plus path.delimiter for PATH construction. I specifically checked the shell boundary: the caller-controlled input_json is still written to child stdin; it is not interpolated into the shell command. The executable and argument remain fixed as mix pythia.eval_json at this head.

Advisory status: HOLD, not PASS. The source-level boundary is acceptable, but CI/Security/MCP are still action_required and therefore not run. Exact-head Windows execution remains the required proof.

[safal207]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.