[seonghobae]

Verified successor scope

This Draft successor preserves the complete valid auth-flow delta from predecessor #737 after its shared writer advanced from repaired head 8ab9607371900c7c7e33b4ee47b78cd91e3c25d9 to 2e52b79573e594792653c8c4fb73e600a70bf21b and restored the unsafe cmd.exe /c start implementation, the old test, and generated .jules/sentinel.md.

Preserved contract

• parse the API-provided browser target with WHATWG URL;
• allow only http: and https:;
• pass normalized parsedUrl.href to every platform launcher;
• on Windows, call rundll32.exe url.dll,FileProtocolHandler <url> directly, with no command shell, hand-written metacharacter escaping, or windowsVerbatimArguments;
• keep invalid/malformed URL and platform argv regressions;
• restore the canonical security journal blob;
• retain every predecessor and repair commit in ordinary ancestry; no Force Push or destructive rebase.

Lifecycle

• exact head: 8ab9607371900c7c7e33b4ee47b78cd91e3c25d9
• base: developmental
• status: Draft / successor
• predecessor fix(auth): launch validated browser URLs without a shell #737 remains open Draft as provenance until this successor is independently verified and integrated.

Exact-head gates

• CI 36934334387: GREEN
• Semgrep 36934334261: GREEN
• Security 36934334207 / Trivy job 110611031620: RED
• CodeQL PR 36934334209: skipped; skipped is not passing evidence
• Trivy found 7 dependency findings in pnpm-lock.yaml (baseline-browser-mapping, browserslist, deepmerge-ts, Next.js, Sharp). Canonical dependency-security owner is chore(deps): isolate scanner-driven web dependency remediation #615 exact dec7aabf934fe655f3844814518da80472a56c59; do not copy package/lock changes into this auth leaf.

Require repaired exact-head Security, non-skipped required CodeQL, zero unresolved valid review findings, and qualifying independent approval. Prior predecessor checks do not transfer.