Module browser 

URL opening with a scheme allowlist and input hygiene.

All URL-opening in RTB and in scaffolded tools must route through open_url; calling open::that, webbrowser::open, or xdg-open/rundll32 directly is forbidden (CLAUDE.md §URL Opening). The helper enforces a scheme allowlist, a length bound, and control-character rejection before handing the URL to the OS handler, and never interpolates it into a shell.

Callers constructing mailto: URLs from user-influenced data must urlencoding::encode every parameter value first — this helper rejects raw control characters but does not itself encode query values.

See docs/development/specs/2026-06-26-rtb-cli-browser-open-url.md.

Enums

BrowserError

Error returned when a URL is rejected by the guardrails or the OS handler fails to launch.

Constants

ALLOWED_SCHEMES

Non-configurable scheme allowlist.

MAX_URL_LEN

Maximum accepted URL length, in bytes.

Functions

open_url

Validate url against the allowlist + hygiene rules, then open it with the OS handler.