Windows: stdio MCP servers fail with "spawn npx ENOENT" (v2 engine regression)

Summary

On Windows, stdio MCP servers whose command is a batch shim (npx, uvx, …) fail to start with spawn npx ENOENT on the v2 engine (default since 0.33.0). The v1 engine does not have this problem because it delegates spawning to the official MCP SDK, which internally uses cross-spawn.

Environment

• Windows 11, Kimi Code CLI 0.38.0 (v2 engine, the default)
• Node v24.18.0 via nvm4w
• User-level ~/.kimi-code/mcp.json following the official docs:

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": ["-y", "@playwright/mcp@latest"]
    }
  }
}

Steps to reproduce

1. On Windows, configure any stdio MCP server with command: "npx" as above.
2. Start Kimi Code.
3. The server never comes up; the log shows:

ERROR mcp server unavailable  server=playwright status=failed reason="spawn npx ENOENT"

Root cause

npx on Windows is a batch file (npx.cmd). node:child_process.spawn without shell: true goes through CreateProcess, which cannot execute batch files and does not consult PATHEXT → ENOENT. (Node ≥ 20.12 tightened batch-file spawning further after CVE-2024-27980.) This is not a Node version issue — it reproduces on Node v24.18.0.

Engine comparison (verified on main @ f4dc9ba, identical in 0.38.0):

• v1 works: packages/agent-core/src/mcp/client-stdio.ts:65 uses the official StdioClientTransport from @modelcontextprotocol/sdk (1.29). The SDK spawns via cross-spawn, which resolves .cmd via PATHEXT and launches batch files through cmd.exe with proper escaping — the standard post-CVE-2024-27980 approach.
• v2 fails: packages/agent-core-v2/src/mcpCore/client-stdio.ts:188 implements its own RuntimeStdioTransport over IHostProcess → HostProcessService.spawn (packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts:174), which calls raw node:child_process.spawn with shell unset → .cmd commands can never start on Windows.

Since 0.33.0 defaults to v2, this is a v2 regression relative to v1. Other clients (e.g. Claude Code) handle .cmd resolution internally; Kimi Code v2 does not.

Suggested fix

• Minimal: in the v2 stdio transport, spawn via cross-spawn (already in the dependency tree via the MCP SDK), or resolve .cmd/.bat via PATHEXT and launch through cmd.exe with correct argument escaping.
• Broader: swap node:child_process.spawn for cross-spawn inside HostProcessService so every local spawn (MCP, rg, git context, external hooks, workspace fs) benefits uniformly on Windows. Larger blast radius — needs regression testing.
• Avoid shell: true as the fix (argument-escaping / injection surface).

Secondary items

1. mcp.json is only loaded at session start; edits don't hot-apply. Note that a full exit is not required — /reload or /new picks up the changes (this is what the TUI hint already says, apps/kimi-code/src/tui/commands/plugins.ts:164). A config file watcher, or a hint when the file changes, would still help discoverability.
2. Failure-reason visibility is already addressed in 0.38.0: /mcp renders an error: … line (including the captured stderr tail) for failed servers (apps/kimi-code/src/tui/components/messages/mcp-status-panel.ts:139-145).

Workarounds (verified by the reporter)

Bypass npx — install globally and point command at node.exe with the absolute entry path:

npm i -g @playwright/mcp

{
  "mcpServers": {
    "playwright": {
      "command": "C:\\nvm4w\\nodejs\\node.exe",
      "args": ["C:\\nvm4w\\nodejs\\node_modules\\@playwright\\mcp\\cli.js", "…其他参数"],
      "startupTimeoutMs": 120000
    }
  }
}

Or wrap with cmd /c: "command": "cmd", "args": ["/c", "npx", "-y", "@playwright/mcp@latest", ...]. Restart (or /reload) to apply.

Original report

Forwarded user feedback (Chinese original):

【反馈】Windows 下配置 Playwright MCP 一直不生效，排查结论 + 临时解法
环境：Windows 11 + Kimi Code CLI + nvm4w（Node v24.18.0），按官方文档在用户级 ~/.kimi-code/mcp.json 配置 playwright server。
踩了三个坑：

1. 配置只在会话启动时加载。改完 mcp.json 当前会话不会生效，必须完全退出重开（文档有写，但容易忽略，建议加载失败时在 TUI 里给个提示）。
2. Windows 下 spawn npx ENOENT（核心问题）。日志里报错：ERROR mcp server unavailable server=playwright status=failed reason="spawn npx ENOENT"。原因：npx 本体是批处理 npx.cmd，Node 的 spawn() 不带 shell: true 时走 CreateProcess，执行不了批处理、也不会按 PATHEXT 补后缀。这不是 Node 版本问题（我用 v24.18.0 照样复现），Node 20.12+ 因 CVE-2024-27980 对批处理 spawn 更严格了。Claude Code 等客户端在 Windows 上内部处理了 .cmd 的情况，建议 Kimi Code 也跟进：Windows 下 spawn MCP server 时加 shell: true 或自行解析 .cmd。
3. 排查入口不方便。最后是自己翻 ~/.kimi-code/logs/kimi-code.log 才看到报错，如果 /mcp 能直接显示失败原因会好很多。
   临时解法（已验证可用）：绕过 npx，全局安装后用绝对路径直指 node + 入口文件，或者用 cmd /c 包装。改完重启 Kimi Code 生效。

Start with packages/agent-core-v2/src/mcpCore/client-stdio.ts:188 and trace its IHostProcess call into packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts:174. Compare this path with packages/agent-core/src/mcp/client-stdio.ts:65, then reproduce the npx configuration on Windows. Done means a v2 stdio MCP server using a batch shim starts successfully without weakening argument safety, with regression coverage for the affected behavior.