@moxxy/plugin-oauth 0.37.1 → 0.37.2

package/dist/open-browser.d.ts

@@ -2,8 +2,7 @@
  * Open a URL in the user's default browser. Platform-specific:
  *   macOS  → `open <url>`
  *   Linux  → `xdg-open <url>`
- *   Win32  → `cmd /c start "" "<url>"` (the URL DOUBLE-QUOTED + args passed
- *           verbatim — see {@link browserOpenCommand})
+ *   Win32  → `explorer.exe <url>`
  *
  * Returns once the helper process is spawned — it does NOT wait for the
  * browser itself, since the user's flow continues asynchronously via
@@ -13,20 +12,16 @@
 export declare function openInBrowser(url: string): Promise<void>;
 /**
  * Resolve the platform's "open this URL in the default browser" command.
- * Exported + `platform`-parameterized so the Windows quoting can be unit-tested
+ * Exported + `platform`-parameterized so each platform can be unit-tested
  * without actually spawning a browser.
  *
- * Windows is the tricky one: `&` (and `|`, `<`, `>`, `^`) in a URL are cmd.exe
- * command separators. `cmd /c start "" http://a?x=1&y=2` truncates the URL at
- * the first `&`, so an OAuth authorize URL loses redirect_uri / code_challenge /
- * state and the provider rejects the request ("authorization error"). Wrapping
- * the URL in double quotes makes cmd treat it as one literal token; passing the
- * args verbatim (`windowsVerbatimArguments`) stops Node from re-quoting and
- * undoing that. The empty `""` is the required `start` window-title placeholder.
+ * Windows deliberately launches Explorer directly rather than interpolating a
+ * library-provided OAuth URL into `cmd.exe /c start`. `spawn` passes the URL as
+ * one argv entry, so `&`, `|`, `<`, `>` and `^` remain URL data rather than
+ * shell metacharacters.
  */
 export declare function browserOpenCommand(url: string, platform?: NodeJS.Platform): {
     cmd: string;
     args: string[];
-    verbatim?: boolean;
 };
 //# sourceMappingURL=open-browser.d.ts.map

package/dist/open-browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open-browser.d.ts","sourceRoot":"","sources":["../src/open-browser.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwC9D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAWrD"}
+{"version":3,"file":"open-browser.d.ts","sourceRoot":"","sources":["../src/open-browser.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqC9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAWjC"}

package/dist/open-browser.js

@@ -3,8 +3,7 @@ import { spawn } from 'node:child_process';
  * Open a URL in the user's default browser. Platform-specific:
  *   macOS  → `open <url>`
  *   Linux  → `xdg-open <url>`
- *   Win32  → `cmd /c start "" "<url>"` (the URL DOUBLE-QUOTED + args passed
- *           verbatim — see {@link browserOpenCommand})
+ *   Win32  → `explorer.exe <url>`
  *
  * Returns once the helper process is spawned — it does NOT wait for the
  * browser itself, since the user's flow continues asynchronously via
@@ -12,14 +11,11 @@ import { spawn } from 'node:child_process';
  * so the caller can print it for the user to paste manually.
  */
 export async function openInBrowser(url) {
-    const { cmd, args, verbatim } = browserOpenCommand(url);
+    const { cmd, args } = browserOpenCommand(url);
     await new Promise((resolve, reject) => {
         const child = spawn(cmd, args, {
             stdio: 'ignore',
             detached: true,
-            // Windows only: keep cmd.exe from re-quoting our already-quoted URL,
-            // which would otherwise break the `&` escaping (see below).
-            ...(verbatim ? { windowsVerbatimArguments: true } : {}),
         });
         // Settle exactly once. An early spawn `error` rejects AND clears the pending
         // 50ms timer (else it would fire a stray resolve later and hold a live timer
@@ -56,26 +52,23 @@ export async function openInBrowser(url) {
 }
 /**
  * Resolve the platform's "open this URL in the default browser" command.
- * Exported + `platform`-parameterized so the Windows quoting can be unit-tested
+ * Exported + `platform`-parameterized so each platform can be unit-tested
  * without actually spawning a browser.
  *
- * Windows is the tricky one: `&` (and `|`, `<`, `>`, `^`) in a URL are cmd.exe
- * command separators. `cmd /c start "" http://a?x=1&y=2` truncates the URL at
- * the first `&`, so an OAuth authorize URL loses redirect_uri / code_challenge /
- * state and the provider rejects the request ("authorization error"). Wrapping
- * the URL in double quotes makes cmd treat it as one literal token; passing the
- * args verbatim (`windowsVerbatimArguments`) stops Node from re-quoting and
- * undoing that. The empty `""` is the required `start` window-title placeholder.
+ * Windows deliberately launches Explorer directly rather than interpolating a
+ * library-provided OAuth URL into `cmd.exe /c start`. `spawn` passes the URL as
+ * one argv entry, so `&`, `|`, `<`, `>` and `^` remain URL data rather than
+ * shell metacharacters.
  */
 export function browserOpenCommand(url, platform = process.platform) {
+    const parsed = new URL(url);
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        throw new Error(`refusing to open non-http OAuth URL: ${parsed.protocol}`);
+    }
     if (platform === 'darwin')
         return { cmd: 'open', args: [url] };
     if (platform === 'win32') {
-        return {
-            cmd: process.env.ComSpec || 'cmd.exe',
-            args: ['/c', 'start', '""', `"${url}"`],
-            verbatim: true,
-        };
+        return { cmd: 'explorer.exe', args: [url] };
     }
     // Linux + everything else assumes a Freedesktop-compliant `xdg-open`.
     return { cmd: 'xdg-open', args: [url] };

package/dist/open-browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"open-browser.js","sourceRoot":"","sources":["../src/open-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,IAAI;YACd,qEAAqE;YACrE,4DAA4D;YAC5D,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,6BAA6B;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE;YACnC,IAAI,OAAO;gBAAE,OAAO,CAAC,gDAAgD;YACrE,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,qEAAqE;QACrE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,6EAA6E;QAC7E,8EAA8E;QAC9E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3B,+DAA+D;QAC/D,uCAAuC;QACvC,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,iEAAiE;QACjE,6DAA6D;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAW,EACX,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/D,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS;YACrC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,GAAG,CAAC;YACvC,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"open-browser.js","sourceRoot":"","sources":["../src/open-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,6BAA6B;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE;YACnC,IAAI,OAAO;gBAAE,OAAO,CAAC,gDAAgD;YACrE,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,qEAAqE;QACrE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,6EAA6E;QAC7E,8EAA8E;QAC9E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3B,+DAA+D;QAC/D,uCAAuC;QACvC,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,iEAAiE;QACjE,6DAA6D;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAW,EACX,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/D,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9C,CAAC;IACD,sEAAsE;IACtE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moxxy/plugin-oauth",
-  "version": "0.37.1",
+  "version": "0.37.2",
   "description": "Generic OAuth 2.0 + PKCE client. Loopback callback server, vault-backed token storage, refresh helpers. Bundled skills for Google Workspace + arbitrary providers.",
   "keywords": [
     "moxxy",
@@ -54,15 +54,15 @@
   },
   "dependencies": {
     "zod": "^3.25.76",
-    "@moxxy/plugin-vault": "0.37.1",
-    "@moxxy/sdk": "0.37.1"
+    "@moxxy/sdk": "0.37.2",
+    "@moxxy/plugin-vault": "0.37.2"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",
     "typescript": "^5.7.3",
     "vitest": "^3.2.6",
-    "@moxxy/vitest-preset": "0.0.0",
-    "@moxxy/tsconfig": "0.0.0"
+    "@moxxy/tsconfig": "0.0.0",
+    "@moxxy/vitest-preset": "0.0.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",

package/src/open-browser.test.ts

@@ -1,8 +1,8 @@
 import { describe, expect, it } from 'vitest';
 import { browserOpenCommand } from './open-browser';
 
-// A realistic OAuth authorize URL: many `&`-separated params, which cmd.exe
-// treats as command separators unless the whole URL is quoted.
+// A realistic OAuth authorize URL with shell metacharacters that must remain a
+// single argv value on every platform.
 const AUTH_URL =
   'https://auth.openai.com/oauth/authorize?client_id=app_x&redirect_uri=http%3A%2F%2Flocalhost%3A1455%2Fauth%2Fcallback&response_type=code&scope=openid+profile&code_challenge=abc123&state=deadbeef';
 
@@ -15,16 +15,16 @@ describe('browserOpenCommand', () => {
     expect(browserOpenCommand(AUTH_URL, 'linux')).toEqual({ cmd: 'xdg-open', args: [AUTH_URL] });
   });
 
-  it('Windows DOUBLE-QUOTES the URL so cmd.exe does not split it on `&`', () => {
-    const { cmd, args, verbatim } = browserOpenCommand(AUTH_URL, 'win32');
-    expect(cmd).toMatch(/cmd(\.exe)?$/i);
-    expect(verbatim).toBe(true);
-    expect(args.slice(0, 3)).toEqual(['/c', 'start', '""']);
-    // The whole URL — every `&` included — is inside one double-quoted token.
-    expect(args[3]).toBe(`"${AUTH_URL}"`);
-    // Sanity: the quoted arg still contains all the params after the first `&`.
-    expect(args[3]).toContain('redirect_uri');
-    expect(args[3]).toContain('code_challenge');
-    expect(args[3]).toContain('state=deadbeef');
+  it('Windows bypasses the shell and passes the complete URL to Explorer', () => {
+    expect(browserOpenCommand(AUTH_URL, 'win32')).toEqual({
+      cmd: 'explorer.exe',
+      args: [AUTH_URL],
+    });
+  });
+
+  it('rejects non-web schemes and switch-shaped input before spawning', () => {
+    expect(() => browserOpenCommand('file:///tmp/token', 'win32')).toThrow('non-http');
+    expect(() => browserOpenCommand('javascript:alert(1)', 'win32')).toThrow('non-http');
+    expect(() => browserOpenCommand('/select,C:\\secrets', 'win32')).toThrow();
   });
 });

package/src/open-browser.ts

@@ -4,8 +4,7 @@ import { spawn } from 'node:child_process';
  * Open a URL in the user's default browser. Platform-specific:
  *   macOS  → `open <url>`
  *   Linux  → `xdg-open <url>`
- *   Win32  → `cmd /c start "" "<url>"` (the URL DOUBLE-QUOTED + args passed
- *           verbatim — see {@link browserOpenCommand})
+ *   Win32  → `explorer.exe <url>`
  *
  * Returns once the helper process is spawned — it does NOT wait for the
  * browser itself, since the user's flow continues asynchronously via
@@ -13,14 +12,11 @@ import { spawn } from 'node:child_process';
  * so the caller can print it for the user to paste manually.
  */
 export async function openInBrowser(url: string): Promise<void> {
-  const { cmd, args, verbatim } = browserOpenCommand(url);
+  const { cmd, args } = browserOpenCommand(url);
   await new Promise<void>((resolve, reject) => {
     const child = spawn(cmd, args, {
       stdio: 'ignore',
       detached: true,
-      // Windows only: keep cmd.exe from re-quoting our already-quoted URL,
-      // which would otherwise break the `&` escaping (see below).
-      ...(verbatim ? { windowsVerbatimArguments: true } : {}),
     });
     // Settle exactly once. An early spawn `error` rejects AND clears the pending
     // 50ms timer (else it would fire a stray resolve later and hold a live timer
@@ -56,28 +52,25 @@ export async function openInBrowser(url: string): Promise<void> {
 
 /**
  * Resolve the platform's "open this URL in the default browser" command.
- * Exported + `platform`-parameterized so the Windows quoting can be unit-tested
+ * Exported + `platform`-parameterized so each platform can be unit-tested
  * without actually spawning a browser.
  *
- * Windows is the tricky one: `&` (and `|`, `<`, `>`, `^`) in a URL are cmd.exe
- * command separators. `cmd /c start "" http://a?x=1&y=2` truncates the URL at
- * the first `&`, so an OAuth authorize URL loses redirect_uri / code_challenge /
- * state and the provider rejects the request ("authorization error"). Wrapping
- * the URL in double quotes makes cmd treat it as one literal token; passing the
- * args verbatim (`windowsVerbatimArguments`) stops Node from re-quoting and
- * undoing that. The empty `""` is the required `start` window-title placeholder.
+ * Windows deliberately launches Explorer directly rather than interpolating a
+ * library-provided OAuth URL into `cmd.exe /c start`. `spawn` passes the URL as
+ * one argv entry, so `&`, `|`, `<`, `>` and `^` remain URL data rather than
+ * shell metacharacters.
  */
 export function browserOpenCommand(
   url: string,
   platform: NodeJS.Platform = process.platform,
-): { cmd: string; args: string[]; verbatim?: boolean } {
+): { cmd: string; args: string[] } {
+  const parsed = new URL(url);
+  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+    throw new Error(`refusing to open non-http OAuth URL: ${parsed.protocol}`);
+  }
   if (platform === 'darwin') return { cmd: 'open', args: [url] };
   if (platform === 'win32') {
-    return {
-      cmd: process.env.ComSpec || 'cmd.exe',
-      args: ['/c', 'start', '""', `"${url}"`],
-      verbatim: true,
-    };
+    return { cmd: 'explorer.exe', args: [url] };
   }
   // Linux + everything else assumes a Freedesktop-compliant `xdg-open`.
   return { cmd: 'xdg-open', args: [url] };