Fix: quote URLs when opening browser on Windows

src/commands/onboard-helpers.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { openUrl, resolveBrowserOpenCommand } from "./onboard-helpers.js";
+
+const mocks = vi.hoisted(() => ({
+  runCommandWithTimeout: vi.fn(async () => ({
+    stdout: "",
+    stderr: "",
+    code: 0,
+    signal: null,
+    killed: false,
+  })),
+}));
+
+vi.mock("../process/exec.js", () => ({
+  runCommandWithTimeout: mocks.runCommandWithTimeout,
+}));
+
+describe("openUrl", () => {
+  it("quotes URLs on win32 so '&' is not treated as cmd separator", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("win32");
+
+    const url =
+      "https://accounts.google.com/o/oauth2/v2/auth?client_id=abc&response_type=code&redirect_uri=http%3A%2F%2Flocalhost";
+
+    const ok = await openUrl(url);
+    expect(ok).toBe(true);
+
+    expect(mocks.runCommandWithTimeout).toHaveBeenCalledTimes(1);
+    const argv = mocks.runCommandWithTimeout.mock.calls[0]?.[0];
+    expect(argv?.slice(0, 4)).toEqual(["cmd", "/c", "start", ""]);
+    expect(argv?.at(-1)).toBe(`"${url}"`);
+  });
+});
+
+describe("resolveBrowserOpenCommand", () => {
+  it("marks win32 commands as quoteUrl=true", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("win32");
+    const resolved = await resolveBrowserOpenCommand();
+    expect(resolved.argv).toEqual(["cmd", "/c", "start", ""]);
+    expect(resolved.quoteUrl).toBe(true);
+  });
+});