Markdown links with multiple & query params broken - & encoded as &

[ericchansen]

Description

Markdown links containing URLs with multiple & query parameters don't work when clicked in the Copilot CLI terminal. The browser receives a corrupted URL where & characters appear to be HTML-encoded as &, breaking query string parsing.

This affects any URL with more than one query parameter, but is most noticeable with Microsoft Dynamics 365 deep links which have 5+ parameters.

Repro Steps

1. Create an MCP tool that returns markdown containing a link:
   [Open Record](https://example.com/page?param1=value1&param2=value2&param3=value3)
2. The Copilot CLI renders the link as clickable text
3. Click the link in the terminal

Expected Behavior

Browser opens: https://example.com/page?param1=value1&param2=value2&param3=value3

All three query parameters are parsed correctly.

Actual Behavior

Browser receives a URL where & is encoded as &:
https://example.com/page?param1=value1&param2=value2&param3=value3

The browser only sees param1 as a valid parameter. param2 and param3 are lost because & is treated as part of the previous parameter's value.

Evidence

When an MCP tool returns a Dynamics 365 URL like:
https://microsoftsales.crm.dynamics.com/main.aspx?appid=fe0c3504-3700-e911-a849-000d3a10b7cc&forceUCI=1&pagetype=entityrecord&etn=opportunity&id=32441284-...

Clicking it in the terminal navigates to the Dynamics fallback/home page instead of the specific record, because Dynamics receives malformed query parameters and falls back to its default view.

The same URL opened via Start-Process (PowerShell) or pasted directly into the browser address bar works correctly.

Environment

• Copilot CLI (Prerelease) via WinGet on Windows 11
• Windows Terminal
• Microsoft Edge