ci: test window injection

[alfondotnet]

Test plan

• Wait for windows-openurl-repro on this PR
• Job logs show PASS: local marker created
• Cloudflare / alfon.net shows a GET with query g<run_id> matching the job summary

---

Note

Low Risk
Adds isolated CI and a repro binary only; it does not change the CLI’s production browser-opening path.

Overview
Adds a Windows-only CI repro for the v0.1.2 OpenURL sink (exec.Command("cmd", "/c", "start", "", url)), separate from today’s ShellExecuteW opener in internal/tui.

A new workflow windows-openurl-repro runs on windows-latest when the workflow or scripts/repro_windows_openurl/** changes (or via workflow_dispatch). It runs go run ./scripts/repro_windows_openurl, which crafts a customer-ID-shaped URL whose & segments run echo to a local marker file and curl to http://alfon.net?g<GITHUB_RUN_ID>. The job fails unless both artifacts appear, proving cmd.exe parsed the injection. A follow-up step always writes the lookup URL and run_id to the job summary for log correlation.

^{Reviewed by Cursor Bugbot for commit 818b0c8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Repro job can hang indefinitely
  • Added 30-second context timeout to cmd.Run() and 5-minute timeout-minutes to workflow job to prevent indefinite hangs.

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 818b0c8. Configure here.}

[cursor]

Repro job can hang indefinitely

Medium Severity

The 15-second deadline only starts after cmd.Run() returns, so it never bounds the injected commands. In cmd.exe, & runs commands sequentially, and the first one is start of an https URL. If that start blocks on the runner’s browser, or if the follow-on curl hangs talking to alfon.net (no --max-time), echo and the marker check never run and the job can sit until the default runner timeout. The workflow also has no timeout-minutes.

Additional Locations (1)

• .github/workflows/windows-openurl-repro.yml#L21-L23

 

^{Reviewed by Cursor Bugbot for commit 818b0c8. Configure here.}