fix: support Windows paths and npm launchers

Adds Windows-safe TOML path serialization, resolved npm launcher execution, and regression coverage.

Validated by the complete Forgejo matrix and the green external GitHub Windows gate.

Author: dev-bot-capacium

src/capacium/adapters/mcp_config_patcher.py

@@ -236,7 +236,10 @@ def _write_toml_simple(f, data: dict, prefix: str = "") -> None:
             elif isinstance(value, (int, float)):
                 f.write(f"{key} = {value}\n")
             else:
-                f.write(f'{key} = "{value}"\n')
+                # JSON string quoting is also valid TOML basic-string quoting
+                # and correctly escapes Windows backslashes, quotes, and
+                # control characters.
+                f.write(f"{key} = {json.dumps(str(value), ensure_ascii=False)}\n")
 
     @staticmethod
     def enrich_mcp_meta_for_git(

src/capacium/commands/install.py

@@ -2139,10 +2139,10 @@ def _install_npm_dependencies(package_dir: Path, cap_name: str) -> bool:
 
     has_lock = (runtime_dir / "package-lock.json").exists()
     if has_lock:
-        cmd = ["npm", "ci", "--production"]
+        cmd = [npm_path, "ci", "--production"]
         print(f"  Running npm ci in {runtime_dir}...")
     else:
-        cmd = ["npm", "install", "--production"]
+        cmd = [npm_path, "install", "--production"]
         print(f"  Running npm install in {runtime_dir}...")
 
     try:

tests/test_install.py

@@ -1,4 +1,5 @@
 import subprocess
+from unittest.mock import patch
 
 
 class TestResolveSource:
@@ -340,6 +341,28 @@ def test_install_accepts_cwd_with_capability(self, tmp_home, tmp_path, capsys, m
         assert "Use --source" in out
 
 
+class TestInstallNpmDependencies:
+    def test_uses_resolved_npm_executable(self, tmp_path):
+        from capacium.commands.install import _install_npm_dependencies
+
+        (tmp_path / "package.json").write_text('{"name": "test-server"}')
+        npm_executable = r"C:\Program Files\nodejs\npm.cmd"
+        completed = subprocess.CompletedProcess(
+            [npm_executable, "install", "--production"],
+            0,
+            stdout="installed",
+            stderr="",
+        )
+
+        with patch("shutil.which", return_value=npm_executable), patch(
+            "capacium.commands.install.subprocess.run",
+            return_value=completed,
+        ) as run:
+            assert _install_npm_dependencies(tmp_path, "test-server") is True
+
+        assert run.call_args.args[0][0] == npm_executable
+
+
 class TestFetchRemoteTags:
     def test_fetch_tags_from_local_bare(self, tmp_path):
         remote = tmp_path / "remote.git"

tests/test_mcp_adapters.py

@@ -4,6 +4,7 @@
 Ensures no data destruction on patch/unpatch operations.
 """
 import json
+from io import StringIO
 from unittest.mock import patch
 
 import pytest
@@ -74,6 +75,30 @@ def test_json_roundtrip_preserves_data(self, tmp_path):
         assert roundtripped == original
 
 
+class TestMcpConfigPatcherToml:
+    def test_simple_writer_escapes_windows_paths(self):
+        from capacium.utils.toml_compat import tomllib
+
+        output = StringIO()
+        windows_path = r"C:\Users\runneradmin\.capacium\packages\server.py"
+        McpConfigPatcher._write_toml_simple(
+            output,
+            {
+                "mcp_servers": {
+                    "test-server": {
+                        "command": windows_path,
+                        "args": [windows_path, '--label="Windows"'],
+                    }
+                }
+            },
+        )
+
+        parsed = tomllib.loads(output.getvalue())
+        entry = parsed["mcp_servers"]["test-server"]
+        assert entry["command"] == windows_path
+        assert entry["args"] == [windows_path, '--label="Windows"']
+
+
 class TestBuildMcpEntry:
     def test_stdio_with_explicit_command(self, tmp_path):
         entry = McpConfigPatcher.build_mcp_entry(