fix(cmd): update quoting behavior for cmd /c to preserve percent-encoded characters

Author: qcq01083097

README.zh.md

@@ -36,7 +36,7 @@ _专为 AI Agent 打造，每个命令均可作为结构化工具调用。_
 
 <p align="center">
   <a href="https://cloud.video.taobao.com/vod/dS2F4huqbw5Nfe5L3wwb3grz2q2DNYD3retq8dU-iHo.mp4">
-    <img src="https://img.alicdn.com/imgextra/i1/O1CN01Q5052k232Hd36NodG_!!6000000007197-0-tps-2940-1656.jpg" alt="点击播放演示视频" width="720" />
+    <img src="https://img.alicdn.com/imgextra/i4/O1CN01YRqEiQMN7tJ2b87U_!!6000000004549-0-videocover-1280-744.jpg" alt="点击播放演示视频" width="720" />
   </a>
 </p>
 

packages/bailian-kb-dsh/src/console-login.ts

@@ -161,13 +161,14 @@ async function extractCredentials(
 }
 
 /**
- * Quote a value for `cmd.exe`. `%` is doubled because cmd expands variables even
- * inside quotes; embedded `"` becomes `""`.
+ * Quote a value for `cmd /c`. An embedded `"` is written as `""`.
+ * Do not double `%`: that substitution only happens inside batch files, and
+ * `cmd /c` would otherwise open a target that still contains `%%`.
  * Keep in sync with `buildOpenInvocation` in
  * `packages/commands/src/commands/shared/local-server.ts`.
  */
 function quoteForCmd(value: string): string {
-  return `"${value.replaceAll("%", "%%").replaceAll('"', '""')}"`;
+  return `"${value.replaceAll('"', '""')}"`;
 }
 
 /**

packages/bailian-kb-dsh/tests/console-login.test.ts

@@ -79,4 +79,11 @@ describe("buildOpenInvocation", () => {
     expect(invocation.windowsVerbatimArguments).toBe(true);
     expect(command.slice(1, -1)).toBe(`start "" "${url}"`);
   });
+
+  it("leaves percent-encoded characters unchanged for cmd /c", () => {
+    const url = "https://example.com/a%20b";
+    const command = buildOpenInvocation(url, "win32").args.at(-1) ?? "";
+    expect(command).toContain("%20");
+    expect(command).not.toContain("%%");
+  });
 });

packages/commands/src/commands/shared/local-server.ts

@@ -30,11 +30,15 @@ export interface OpenInvocation {
 }
 
 /**
- * Quote a value for `cmd.exe`. `%` is doubled because cmd expands variables even
- * inside quotes; embedded `"` becomes `""`.
+ * Quote a value for `cmd /c`. An embedded `"` is written as `""`, which cmd
+ * reads as one literal quote.
+ *
+ * Do not double `%`. `%%` → `%` is a batch-file rule and does not apply when
+ * Node starts `cmd /c` directly. Doubling would make `start` open a different
+ * target (`%20` would stay `%20` with two percent signs).
  */
 function quoteForCmd(value: string): string {
-  return `"${value.replaceAll("%", "%%").replaceAll('"', '""')}"`;
+  return `"${value.replaceAll('"', '""')}"`;
 }
 
 /**

packages/commands/tests/local-server-open.test.ts

@@ -14,6 +14,18 @@ function commandExecutedByCmd(args: string[]): string {
   return remainder.slice(1, -1);
 }
 
+/**
+ * Target `start` receives after cmd quote parsing: one outer quote pair is
+ * removed, and each `""` inside it is one literal `"`. `%` is not rewritten.
+ */
+function targetReceivedByStart(executed: string): string {
+  const prefix = 'start "" ';
+  if (!executed.startsWith(prefix)) throw new Error("not a start command");
+  const quoted = executed.slice(prefix.length);
+  if (!quoted.startsWith('"') || !quoted.endsWith('"')) throw new Error("target not quoted");
+  return quoted.slice(1, -1).replaceAll('""', '"');
+}
+
 /** Split on `&` that is not inside double quotes, the way `cmd.exe` does. */
 function splitUnquotedAmpersand(command: string): string[] {
   const parts: string[] = [];
@@ -45,13 +57,15 @@ test("win32 打开带 & 的登录 URL 时，needapikey 留在同一条 start 命
   const executed = commandExecutedByCmd(invocation.args);
   expect(executed).toBe(`start "" "${LOGIN_URL}"`);
   expect(splitUnquotedAmpersand(executed)).toEqual([executed]);
-  expect(executed).toContain("&needapikey=true");
+  expect(targetReceivedByStart(executed)).toBe(LOGIN_URL);
 });
 
-test("win32 转义 cmd 会展开的 % 和引号", () => {
-  const invocation = buildOpenInvocation('https://example.com/a%20b?"q"', "win32");
-  const executed = commandExecutedByCmd(invocation.args);
-  expect(executed).toBe('start "" "https://example.com/a%%20b?""q"""');
+test("win32 传给 start 的目标保持原样，% 不会被写成 %%", () => {
+  const target = 'https://example.com/a%20b?"q"&x=1';
+  const executed = commandExecutedByCmd(buildOpenInvocation(target, "win32").args);
+  expect(executed).not.toContain("%%");
+  expect(targetReceivedByStart(executed)).toBe(target);
+  expect(splitUnquotedAmpersand(executed)).toEqual([executed]);
 });
 
 test("darwin / linux 直接把目标交给系统打开命令", () => {