feat(browse): open Depot web destinations

[WitoDelnat]

This PR adds a very simple command to go from CLI to browser:

• depot browse -> https://depot.dev (unauthenticated)
• depot browse -> https://depot.dev/orgs/org-id
• depot browse workflows -> https://depot.dev/orgs/org-id/workflows
• depot browse workflows/some-id -> https://depot.dev/orgs/org-id/workflows/some-id
• depot browse registry -> https://depot.dev/orgs/org-id/registry
• depot browse some-id -> https://depot.dev/orgs/org-id/{workflows,projects/builds,github-actions}/some-id (whichever matches).

A bit gimmick, but might be useful when you've started with downloading the CLI through brew or have been using stripe projects, etc.

---

Summary

Users and agents can now open any organization-scoped Depot destination from the CLI while relying on the app's existing information architecture. The help leads with Depot CI and Container Builds, then GitHub Action Runners, and includes commands for discovering workflow, build, and job IDs.

Container Builds get two conveniences: builds aliases to projects, and builds/<build-id> resolves the canonical project build URL through the API. Complete URLs and API-returned build URLs are constrained to https://depot.dev; --no-browser makes resolution inspectable and script-friendly.

An unrecognized single-segment path is treated as an entity ID. Numeric IDs open GitHub Actions jobs directly; other IDs are checked concurrently against builds, Depot CI workflows, and Depot CI jobs. A unique match opens its canonical page, while ambiguity fails with explicit paths rather than guessing.

Fixes DEP-5420.

Validation

• go test ./...
• golangci-lint run --timeout 5m --new-from-rev origin/main — 0 issues
• Rendered depot browse --help and smoke-tested workflows, builds, a complete URL, and a bare GitHub Actions job ID with --no-browser

Post-deploy monitoring & validation

This is a local CLI-only change with no server rollout. After release, watch CLI/support reports for systematic browser-open or build-lookup failures; revert the release change if generated Depot URLs do not resolve correctly.

---

---

Note

Medium Risk
New API-backed URL resolution and a shared Windows browser-launch change affect login and browse; mitigations include depot.dev-only URL checks and explicit ambiguity handling.

Overview
Adds depot browse to resolve Depot web URLs and open them in the default browser (or print them with --no-browser / --org). Relative paths map under the current org; full URLs must be https://depot.dev; builds aliases to projects; builds/<id> resolves the canonical build page via the API.

Bare single-segment IDs trigger concurrent lookups (build, Depot CI workflow/job, numeric GitHub Actions job), with ambiguity and not-found errors instead of guessing. API-returned build URLs are restricted to depot.dev, and relative paths reject .. segments.

OpenURL is exported from pkg/api with a testable browserCommand helper; Windows opening switches from cmd /c start to rundll32 url.dll,FileProtocolHandler (also used during device login). The root command registers browse; tests cover resolution, lookups, and registration.

^{Reviewed by Cursor Bugbot for commit 6d7034c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[linear-code]

DEP-5420

[cursor]

Stale comment

Did not approve: Cursor Bugbot did not reach a terminal state within the 8-minute polling window. Cursor Security Agent passed with no findings. Assigned reviewers for human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Did not approve: Cursor Bugbot did not reach a terminal state within the 8-minute polling window. Cursor Security Agent passed with no findings. Human reviewers are already assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Did not approve: Cursor Bugbot finished with status skipping and reported 3 unresolved findings on the latest commit. Cursor Security Agent passed with no findings. Human reviewers are already assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Did not approve: Cursor Bugbot did not reach a terminal state within the 8-minute polling window. Cursor Security Agent passed with no findings. Human reviewers are already assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6d7034c. Configure here.}

[cursor]

Did not approve: Cursor Bugbot finished with status skipping and reported 1 unresolved finding on the latest commit. Cursor Security Agent passed with no findings. Human reviewers are already assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}