Fix Windows sign-in: don't launch the browser through cmd.exe (v1.0.1)

cmd's `start` splits unquoted commands at "&", truncating the OAuth authorize
URL after the first query parameter — Windows users hit AADSTS900144 (missing
'scope'). Launch via rundll32 url.dll,FileProtocolHandler instead, which takes
the URL as a plain argument with no shell parsing.

Same fix as claude-msplanner b07a241, applied to the canonical skill copy and
synced into the extension bundle.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.claude/skills/ms-todo/scripts/lib/graph.mjs

@@ -620,14 +620,23 @@ function startRedirectServer(expectedState, timeoutMs, listenPort = 0) {
 
 /** Best-effort open of a URL in the system browser (macOS / Windows / Linux). */
 function openBrowser(url) {
-  const cmd =
-    process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   try {
-    const child = spawn(cmd, process.platform === "win32" ? ["", url] : [url], {
+    let child;
+    if (process.platform === "win32") {
+      // Never route the URL through cmd.exe (`start`): cmd splits unquoted
+      // commands at "&", which truncates the authorize URL after the first
+      // query parameter (the user then sees AADSTS900144: missing 'scope').
+      // rundll32 opens the default browser with the URL as a plain argument.
+      child = spawn("rundll32", ["url.dll,FileProtocolHandler", url], {
         stdio: "ignore",
         detached: true,
-      shell: process.platform === "win32",
       });
+    } else {
+      child = spawn(process.platform === "darwin" ? "open" : "xdg-open", [url], {
+        stdio: "ignore",
+        detached: true,
+      });
+    }
     child.on("error", () => {}); // ignore; the CLI also prints the URL as a fallback
     child.unref();
   } catch {

mcp-extension/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "ms-todo",
   "display_name": "Microsoft To Do",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Read and write your Microsoft To Do tasks, lists, and subtasks from Claude.",
   "long_description": "Connects Claude to Microsoft To Do via the Microsoft Graph API. You sign in once as yourself (a browser window opens); the connection then reads and writes your task lists, tasks, and checklist items. Each user's sign-in is private to their own machine.",
   "author": {

mcp-extension/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "ms-todo-mcp-extension",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "ms-todo-mcp-extension",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.12.0",
         "zod": "^3.23.8"

mcp-extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ms-todo-mcp-extension",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "private": true,
   "type": "module",
   "description": "Microsoft To Do MCP server, packaged as a Claude Desktop .mcpb extension",

mcp-extension/server/index.mjs

@@ -108,7 +108,7 @@ const TASK_WRITE_FIELDS = {
 
 // ---- server ---------------------------------------------------------------
 
-const server = new McpServer({ name: "ms-todo", version: "1.0.0" });
+const server = new McpServer({ name: "ms-todo", version: "1.0.1" });
 
 // --- auth ---
 server.registerTool(