[BUG] OAuth redirect_uri contains space causing authorization failure

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Bug Description

When Claude Code initiates OAuth authorization flow, the redirect_uri parameter in the authorization URL contains a space, causing the authorization to fail.

## Observed Behavior

The authorization URL generated contains:
redirect_uri=http://localhost:61484/call back

When URL-decoded, this becomes http://localhost:61484/call back (note the space between "call" and "back").

## Expected Behavior

The redirect_uri should be:
redirect_uri=http://localhost:61484/callback

(i.e., callback as one word, no space)

## Full Failing URL Example

https://xxx.com/connect/authorize?response_type=code&client_id=xxxxeU8Mn7sP7g&code_challenge=xxxwXoyQk8rjCqgk_2_Gt-MjlSCojYk&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A61484%2Fcall back&state=aQ-wKTs0fpVl5PJR0JOZKRLx5gO14vPENbek1WIc9gU&scope=zscope&resource=https%3A%2F%2Fxxx-mcp.cvnacorp-dev.com%2Fmcp

## Impact

• OAuth authorization flow fails completely
• Users cannot authenticate to MCP servers requiring OAuth/DCR

## Environment

• MCP Server: Custom MCP Server with DCR support
• Auth Server: OpenID Connect compliant authorization server
• Flow: Authorization Code with PKCE

## Steps to Reproduce

1. Configure an MCP server that requires OAuth authentication with DCR
2. Attempt to connect via Claude Code
3. Observe the authorization URL generated contains "call back" instead of "callback"

What Should Happen?

The redirect_uri parameter should be properly URL-encoded before being included in the authorization URL.
The space in the path should be encoded as %20:

Error Messages/Logs

Steps to Reproduce

1. Configure an MCP server with OAuth/DCR authentication in Claude Code settings
2. Start Claude Code and trigger a connection to the MCP server
3. When the OAuth authorization flow initiates, observe the browser URL
4. Notice the redirect_uri parameter contains an unencoded space: call back instead of call%20back or callback
5. Authorization fails due to malformed URL

Claude Model

Sonnet (default)

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

v2.1.2

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_