fix: stop double-encoding CLI login redirect URL

[dallen4]

Problem

deadrop login failed before the Clerk sign-in ticket ever reached the CLI.

cli/actions/login.ts wrapped an already percent-encoded URL in encodeURI, so %3A became %253A. Next peeled one encoding layer, leaving new URL(redirectUrl) on the callback page a still-encoded string that threw Invalid URL. The redirect never fired, and the manual workaround (hand-editing the address bar) blew past the 25s ticket TTL, surfacing as This ticket is invalid from Clerk.

Changes

• cli: drop the redundant encodeURI in login.ts; URL.toString() is already encoded (root cause).
• worker: widen sign-in token TTL 25s -> 60s to avoid spurious expiries.
• web: harden getTokenAndRedirect to fail loudly on a bad token or invalid redirect URL instead of silently redirecting with token=undefined.

Testing

• Ran pnpm test locally: 176 tests pass. The one failing suite (cli/tests/unit/cache.spec.ts) is a pre-existing environment gap (@napi-rs/keyring not installed) unrelated to this change.
• Manual login flow verification pending against a deployed worker (TTL bump requires deploy).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
deadrop	Ready	Preview, Comment	Jul 14, 2026 5:02am