pub fn open_browser(url: &str)Expand description
Open url in the user’s default browser.
On Windows this shells out via cmd /C start. cmd.exe re-parses its
trailing argument as a batch command line, where &, |, ^, <, >
are operators outside of quotes — an OAuth authorize URL is full of
unencoded & between query params, so passing it bare truncates the URL
at the first & and silently drops every parameter after it (client_id,
redirect_uri, scope, …). Wrapping the URL in its own quoted argument via
raw_arg keeps cmd.exe in quoted mode for the whole string, so those
characters are never seen as operators. raw_arg (not arg) is required
here: Command::arg would apply MSVCRT-style quote escaping, which
cmd.exe’s simpler quote-toggle parser does not understand and would
re-break out of the quoted region.
The spawned browser is a long-lived third-party process, so it gets the
strict policy (sanitize_external_std_command), not the pane keep-set:
xdg-open chains to whatever the desktop has registered, which can be a
file manager or terminal from which another AgentMux build is launched —
invariant I7, and the mechanism behind
docs/retro/retro-env-inheritance-instance-isolation-breach-2026-09-17.md
§2.2. On Linux the inherited values are also readable by any same-uid
process via /proc/PID/environ for as long as the browser lives.