Fix: quote URLs when opening browser on Windows

src/commands/onboard-helpers.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { openUrl, resolveBrowserOpenCommand } from "./onboard-helpers.js";
+
+const mocks = vi.hoisted(() => ({
+  runCommandWithTimeout: vi.fn(async () => ({
+    stdout: "",
+    stderr: "",
+    code: 0,
+    signal: null,
+    killed: false,
+  })),
+}));
+
+vi.mock("../process/exec.js", () => ({
+  runCommandWithTimeout: mocks.runCommandWithTimeout,
+}));
+
+describe("openUrl", () => {
+  it("quotes URLs on win32 so '&' is not treated as cmd separator", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("win32");
+
+    const url =
+      "https://accounts.google.com/o/oauth2/v2/auth?client_id=abc&response_type=code&redirect_uri=http%3A%2F%2Flocalhost";
+
+    const ok = await openUrl(url);
+    expect(ok).toBe(true);
+
+    expect(mocks.runCommandWithTimeout).toHaveBeenCalledTimes(1);
+    const argv = mocks.runCommandWithTimeout.mock.calls[0]?.[0];
+    expect(argv?.slice(0, 4)).toEqual(["cmd", "/c", "start", ""]);
+    expect(argv?.at(-1)).toBe(`"${url}"`);
+  });
+});
+
+describe("resolveBrowserOpenCommand", () => {
+  it("marks win32 commands as quoteUrl=true", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("win32");
+    const resolved = await resolveBrowserOpenCommand();
+    expect(resolved.argv).toEqual(["cmd", "/c", "start", ""]);
+    expect(resolved.quoteUrl).toBe(true);
+  });
+});

src/commands/onboard-helpers.ts

@@ -134,9 +134,14 @@ type BrowserOpenCommand = {
   argv: string[] | null;
   reason?: string;
   command?: string;
+  /**
+   * Whether the URL must be wrapped in quotes when appended to argv.
+   * Needed for Windows `cmd /c start` where `&` splits commands.
+   */
+  quoteUrl?: boolean;
 };
 
-async function resolveBrowserOpenCommand(): Promise<BrowserOpenCommand> {
+export async function resolveBrowserOpenCommand(): Promise<BrowserOpenCommand> {
   const platform = process.platform;
   const hasDisplay = Boolean(
     process.env.DISPLAY || process.env.WAYLAND_DISPLAY,
@@ -151,7 +156,11 @@ async function resolveBrowserOpenCommand(): Promise<BrowserOpenCommand> {
   }
 
   if (platform === "win32") {
-    return { argv: ["cmd", "/c", "start", ""], command: "cmd" };
+    return {
+      argv: ["cmd", "/c", "start", ""],
+      command: "cmd",
+      quoteUrl: true,
+    };
   }
 
   if (platform === "darwin") {
@@ -223,7 +232,7 @@ function resolveSshTargetHint(): string {
 export async function openUrl(url: string): Promise<boolean> {
   const resolved = await resolveBrowserOpenCommand();
   if (!resolved.argv) return false;
-  const command = [...resolved.argv, url];
+  const command = [...resolved.argv, resolved.quoteUrl ? `"${url}"` : url];
   try {
     await runCommandWithTimeout(command, { timeoutMs: 5_000 });
     return true;