[helpcodeai]

Summary

amcp login on Windows opened the browser with cmd /c start "" <url>. cmd reads the URL as a command line, so it stopped at the first & of the login URL (callback=…&state=…&scope=…) and tried to run the rest as commands. The browser got a URL without state, so login failed, and the rest of the URL went to cmd. Code scanning alert #658 found it.

Changes

• The CLI now opens the URL on Windows with rundll32 url.dll,FileProtocolHandler <url>. The URL is passed as a single argument, and no shell parses it.
• The command choice is a small exported function, browserCommand(platform, url), so it can be tested on every OS.
• CLI version 0.1.3.

Type

• Bug fix

Testing

• Added/updated unit tests
• packages/cli: npm test passes 22, skips 2 (fish is not installed), fails 0. The new test checks that a URL containing & reaches Windows unchanged as one argument.
• I could not test this on a Windows machine.

Checklist

• My code follows the existing code style
• I have tested my changes locally
• I have updated documentation (if applicable): not needed
• All existing tests pass (npm test, CLI package)
• This PR has a descriptive title

Related Issues

Fixes code scanning alert #658.

Deployment: CLI only. Nothing changes on Cloud or self-hosted servers.