fix(cli,mcp): harden MCP probe and call params

[sheep-cloud12138]

Summary

• avoid Node 24 DEP0190 warnings during CLI MCP live probes on Windows
• keep MCP call params aligned with the published object schema
• reject string, null, and array params_to_tool inputs with tests

Tests

• packages/cli: npm test
• packages/mcp: npm test
• packages/mcp: npm run typecheck
• packages/mcp: npm run build

[Copilot]

Pull request overview

This PR hardens MCP handling by aligning params_to_tool with the published object schema and adjusting CLI MCP live probes on Windows to avoid Node 24 shell/args deprecation warnings.

Changes:

• Reject non-object MCP params_to_tool values instead of parsing legacy JSON strings.
• Add public interface and unit coverage for invalid MCP call params.
• Change CLI probe spawning to use shell: false and wrap Windows command shims through cmd.exe.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
packages/mcp/src/tools/execute.ts	Enforces object-only params_to_tool before calling the API client.
packages/mcp/src/tools/execute.test.ts	Updates execute-tool tests for object params and rejection of non-object values.
packages/mcp/src/index.ts	Allows invalid non-undefined params to reach schema-aligned validation.
packages/mcp/src/index.test.ts	Adds integration coverage for rejecting string call params.
packages/cli/src/commands/mcp.mjs	Changes MCP live probe spawn behavior and adds Windows command wrapping.
packages/cli/test/mcp.test.mjs	Updates spawn option expectations and adds Windows command wrapping tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[gemini-code-assist]

Code Review

This pull request refactors MCP command spawning on Windows by disabling shell execution and manually wrapping command shims through cmd.exe. It also updates the MCP tool execution to require params_to_tool to be a JSON object directly, removing legacy JSON string parsing. Feedback was provided warning that manually spawning cmd.exe with shell: false on Windows is highly prone to quote-stripping issues and execution failures, suggesting instead to use shell: true for command shims or to pass the /s switch.

[ax2]

Auto-approved: Gemini code review passed with no high-priority or security issues.