fix(login): open the browser on Windows without mangling the auth URL

rundll32 url.dll,FileProtocolHandler strips/percent-encodes a URL's query
string on Windows (the ? becomes %3F), so `memcode login` opened
  /api/cli/auth?port=&state=
as
  /api/cli/auth%3Fport=...
which 404s. This was Windows-only; macOS/Linux (open/xdg-open) pass the URL
verbatim. Switch to `cmd /c start`, caret-escaping & so cmd doesn't treat it
as a command separator and drop &state=. Factored into windowsBrowserCmd with
a behavioral test asserting both query params survive and the ? is never
re-encoded (final sign-off still wants a real Windows run).

Also point DefaultWebAppURL at www.memcode.ai directly to skip the apex->www
308 hop on this load-bearing flow.

Author: timothyerwin

internal/authflow/authflow.go

@@ -29,8 +29,11 @@ import (
 // this default lets login work even when the callback doesn't include it.
 const DefaultGatewayURL = provider.DefaultAPIURL
 
-// DefaultWebAppURL is where the browser opens to authenticate.
-const DefaultWebAppURL = "https://memcode.ai"
+// DefaultWebAppURL is where the browser opens to authenticate. Use the www
+// host directly: the apex (memcode.ai) 308-redirects to www, and that extra
+// cross-host hop on the /api/cli/auth?port=&state= URL is needless churn on a
+// load-bearing flow. Point straight at the canonical host.
+const DefaultWebAppURL = "https://www.memcode.ai"
 
 // Result is a successful login: the minted org key and the gateway to use it
 // against.
@@ -279,7 +282,8 @@ func openBrowser(url string) error {
 	case "darwin":
 		return exec.Command("open", url).Start()
 	case "windows":
-		return exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start()
+		prog, args := windowsBrowserCmd(url)
+		return exec.Command(prog, args...).Start()
 	default: // linux, *bsd
 		for _, cmd := range []string{"xdg-open", "wslview", "gio"} {
 			if _, err := exec.LookPath(cmd); err == nil {
@@ -290,6 +294,27 @@ func openBrowser(url string) error {
 	}
 }
 
+// windowsBrowserCmd builds the argv that opens url in the default browser on
+// Windows. It is split out from openBrowser so the shell quoting — the part
+// that actually broke — is unit-testable off a Windows host.
+//
+// It deliberately does NOT use `rundll32 url.dll,FileProtocolHandler`: that
+// strips/percent-encodes the query string (the ? became %3F), so
+//
+//	/api/cli/auth?port=&state=
+//
+// reached the browser as /api/cli/auth%3Fport=… and 404'd — the Windows-only
+// login failure. `cmd /c start` preserves the URL verbatim, with two caveats:
+//   - & is a cmd command separator, so every & is caret-escaped (^&); cmd
+//     collapses ^& back to a literal & before the browser sees it. (Go does not
+//     quote this arg — no spaces — so the caret survives to cmd unquoted, which
+//     is exactly where it must be to take effect.)
+//   - the empty "" is start's title argument, so a URL that ever ends up quoted
+//     is not mistaken for the window title.
+func windowsBrowserCmd(url string) (string, []string) {
+	return "cmd", []string{"/c", "start", "", strings.ReplaceAll(url, "&", "^&")}
+}
+
 // SetGlobalEnv writes key=value pairs into the global env file
 // (~/.config/memcode/.env), replacing any existing lines for those keys and
 // leaving everything else intact. The wizard uses it to persist a credential

internal/authflow/browser_test.go

@@ -0,0 +1,47 @@
+package authflow
+
+import (
+	"strings"
+	"testing"
+)
+
+// The Windows-only login failure was `rundll32 url.dll,FileProtocolHandler`
+// mangling the auth URL's ? into %3F. windowsBrowserCmd replaced it with
+// `cmd /c start`, which reintroduces a different hazard: cmd treats & as a
+// command separator, so the &state= half of the query can be lost. This test
+// verifies the argv is built so BOTH query params survive and the ? is never
+// re-encoded. (OS-level `start` behavior still needs a real Windows box; this
+// pins the quoting logic that we can reason about deterministically.)
+func TestWindowsBrowserCmdPreservesFullQuery(t *testing.T) {
+	const url = "https://www.memcode.ai/api/cli/auth?port=54321&state=abc123"
+
+	prog, args := windowsBrowserCmd(url)
+
+	if prog != "cmd" {
+		t.Fatalf("prog = %q, want cmd", prog)
+	}
+	if len(args) != 4 || args[0] != "/c" || args[1] != "start" || args[2] != "" {
+		t.Fatalf("args = %v, want [/c start \"\" <url>]", args)
+	}
+
+	got := args[3] // the URL argument as cmd will receive it on the command line
+
+	if strings.Contains(got, "%3F") {
+		t.Fatalf("the ? was percent-encoded to %%3F (the original bug): %q", got)
+	}
+	if !strings.Contains(got, "/api/cli/auth?port=") {
+		t.Fatalf("the ? was not preserved literally: %q", got)
+	}
+
+	// Every & must be caret-escaped, or cmd reads it as a command separator and
+	// drops everything after it (losing &state=).
+	if strings.Contains(strings.ReplaceAll(got, "^&", ""), "&") {
+		t.Fatalf("found an unescaped & — cmd would truncate the URL there: %q", got)
+	}
+
+	// cmd collapses ^& back to & before launching the browser. Simulate that and
+	// assert we recover the EXACT original URL — including &state=abc123.
+	if recovered := strings.ReplaceAll(got, "^&", "&"); recovered != url {
+		t.Fatalf("browser would receive %q, want %q", recovered, url)
+	}
+}