fix: preserve Windows cmd start URL quoting (#794) (thanks @roshanasingh4)

src/commands/onboard-helpers.test.ts

@@ -27,9 +27,13 @@ describe("openUrl", () => {
     expect(ok).toBe(true);
 
     expect(mocks.runCommandWithTimeout).toHaveBeenCalledTimes(1);
-    const argv = mocks.runCommandWithTimeout.mock.calls[0]?.[0];
-    expect(argv?.slice(0, 4)).toEqual(["cmd", "/c", "start", ""]);
+    const [argv, options] = mocks.runCommandWithTimeout.mock.calls[0] ?? [];
+    expect(argv?.slice(0, 4)).toEqual(["cmd", "/c", "start", '""']);
     expect(argv?.at(-1)).toBe(`"${url}"`);
+    expect(options).toMatchObject({
+      timeoutMs: 5_000,
+      windowsVerbatimArguments: true,
+    });
   });
 });
 

src/commands/onboard-helpers.ts

@@ -232,9 +232,22 @@ function resolveSshTargetHint(): string {
 export async function openUrl(url: string): Promise<boolean> {
   const resolved = await resolveBrowserOpenCommand();
   if (!resolved.argv) return false;
-  const command = [...resolved.argv, resolved.quoteUrl ? `"${url}"` : url];
+  const quoteUrl = resolved.quoteUrl === true;
+  const command = [...resolved.argv];
+  if (quoteUrl) {
+    if (command.at(-1) === "") {
+      // Preserve the empty title token for `start` when using verbatim args.
+      command[command.length - 1] = '""';
+    }
+    command.push(`"${url}"`);
+  } else {
+    command.push(url);
+  }
   try {
-    await runCommandWithTimeout(command, { timeoutMs: 5_000 });
+    await runCommandWithTimeout(command, {
+      timeoutMs: 5_000,
+      windowsVerbatimArguments: quoteUrl,
+    });
     return true;
   } catch {
     // ignore; we still print the URL for manual open