fix(browser): catch malformed URL TypeError and map to exit 5 VALIDATION_ERROR

[sandman-sh]

Closes #276

Summary

Fixes un-guarded new URL(url) call in openInBrowser (src/lib/browser.ts) so malformed URLs return a clean CLI VALIDATION_ERROR (exit code 5) instead of crashing with an unhandled Node.js TypeError.

Problem

When openInBrowser(url) receives a malformed or unparseable URL string (e.g. "not a url"), new URL(url) throws a raw Node.js TypeError: Invalid URL.
Because this call was not wrapped in a try/catch block:

• The process crashed with an unhandled exception (exit code 1) and printed a raw V8 stack trace.
• Non-HTTP schemes like file:// already threw VALIDATION_ERROR (exit 5), creating an inconsistent error contract for bad inputs.

Solution

Wrap new URL(url) in a try/catch block in openInBrowser:

try {
  parsed = new URL(url);
} catch {
  throw localValidationError('url', 'must be a valid http(s) URL', undefined, 'field');
}

Test Coverage

Updated src/lib/browser.test.ts to assert that malformed URL inputs throw ApiError with exitCode = 5. All unit tests pass.

[github-actions]

✅ This PR is linked to an issue assigned to @sandman-sh — thanks! The needs-issue label has been removed.

[coderabbitai]

Walkthrough

openInBrowser now converts malformed URLs into ApiError validation failures, while tests verify the error code and that command execution is not invoked.

Changes

Browser URL validation

Layer / File(s)	Summary
URL validation and error handling src/lib/browser.ts, src/lib/browser.test.ts	Malformed URLs are converted to localValidationError with exit code 5, and tests verify that the injected exec callback is not called.

Estimated code review effort: 2 (Simple) | ~5 minutes

Suggested reviewers: ruili-testsprite

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: malformed browser URLs are now caught and mapped to validation exit code 5.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}