diff --git a/.claude/skills/ms-todo/scripts/lib/graph.mjs b/.claude/skills/ms-todo/scripts/lib/graph.mjs
index 9208d41..a6f60fc 100644
--- a/.claude/skills/ms-todo/scripts/lib/graph.mjs
+++ b/.claude/skills/ms-todo/scripts/lib/graph.mjs
@@ -620,14 +620,23 @@ function startRedirectServer(expectedState, timeoutMs, listenPort = 0) {
 
 /** Best-effort open of a URL in the system browser (macOS / Windows / Linux). */
 function openBrowser(url) {
-  const cmd =
-    process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   try {
-    const child = spawn(cmd, process.platform === "win32" ? ["", url] : [url], {
-      stdio: "ignore",
-      detached: true,
-      shell: process.platform === "win32",
-    });
+    let child;
+    if (process.platform === "win32") {
+      // Never route the URL through cmd.exe (`start`): cmd splits unquoted
+      // commands at "&", which truncates the authorize URL after the first
+      // query parameter (the user then sees AADSTS900144: missing 'scope').
+      // rundll32 opens the default browser with the URL as a plain argument.
+      child = spawn("rundll32", ["url.dll,FileProtocolHandler", url], {
+        stdio: "ignore",
+        detached: true,
+      });
+    } else {
+      child = spawn(process.platform === "darwin" ? "open" : "xdg-open", [url], {
+        stdio: "ignore",
+        detached: true,
+      });
+    }
     child.on("error", () => {}); // ignore; the CLI also prints the URL as a fallback
     child.unref();
   } catch {
diff --git a/mcp-extension/manifest.json b/mcp-extension/manifest.json
index c9e4a92..77474b1 100644
--- a/mcp-extension/manifest.json
+++ b/mcp-extension/manifest.json
@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "ms-todo",
   "display_name": "Microsoft To Do",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Read and write your Microsoft To Do tasks, lists, and subtasks from Claude.",
   "long_description": "Connects Claude to Microsoft To Do via the Microsoft Graph API. You sign in once as yourself (a browser window opens); the connection then reads and writes your task lists, tasks, and checklist items. Each user's sign-in is private to their own machine.",
   "author": {
diff --git a/mcp-extension/package-lock.json b/mcp-extension/package-lock.json
index 39cece8..85b4c43 100644
--- a/mcp-extension/package-lock.json
+++ b/mcp-extension/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "ms-todo-mcp-extension",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "ms-todo-mcp-extension",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.12.0",
         "zod": "^3.23.8"
diff --git a/mcp-extension/package.json b/mcp-extension/package.json
index 7eedcff..da090a3 100644
--- a/mcp-extension/package.json
+++ b/mcp-extension/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ms-todo-mcp-extension",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "private": true,
   "type": "module",
   "description": "Microsoft To Do MCP server, packaged as a Claude Desktop .mcpb extension",
diff --git a/mcp-extension/server/index.mjs b/mcp-extension/server/index.mjs
index cc9411c..045262e 100644
--- a/mcp-extension/server/index.mjs
+++ b/mcp-extension/server/index.mjs
@@ -108,7 +108,7 @@ const TASK_WRITE_FIELDS = {
 
 // ---- server ---------------------------------------------------------------
 
-const server = new McpServer({ name: "ms-todo", version: "1.0.0" });
+const server = new McpServer({ name: "ms-todo", version: "1.0.1" });
 
 // --- auth ---
 server.registerTool(