Fix contained OpenBao login handoff

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

tests/test_proxy.py

@@ -391,6 +391,42 @@ def test_attended_login_unexpected_output_is_contained_revoked_and_cleaned(
     assert not (tmp_path / ".warden-attended-login").exists()
 
 
+def test_attended_login_contained_success_output_never_escapes(monkeypatch, tmp_path, capsys):
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    sentinel = "hvs.NONPRODUCTION_CONTAINED_LOGIN"
+    child_ran = False
+
+    def fake_run(argv, **kw):
+        nonlocal child_ran
+        helper = Path(kw["env"]["HOME"]) / ".vault-token"
+        if argv[:2] == ["bao", "login"]:
+            helper.write_text(sentinel)
+            helper.chmod(0o600)
+            return subprocess.CompletedProcess(
+                argv,
+                0,
+                stdout=json.dumps({"auth": {"client_token": sentinel}}).encode(),
+                stderr=b"",
+            )
+        if argv == ["reviewed-child"]:
+            child_ran = True
+            return subprocess.CompletedProcess(argv, 0, stdout=b"", stderr=b"")
+        if argv[:3] == ["bao", "token", "revoke"]:
+            return subprocess.CompletedProcess(argv, 0, stdout=b"", stderr=b"")
+        raise AssertionError(argv)
+
+    monkeypatch.setattr("warden.proxy.subprocess.run", fake_run)
+    assert proxy_attended_login_exec(
+        ResolvedFetch(argv=["bao", "login", "-no-print"]),
+        child_argv=["reviewed-child"],
+    ) == 0
+    captured = capsys.readouterr()
+    assert child_ran is True
+    assert sentinel not in captured.out
+    assert sentinel not in captured.err
+    assert not (tmp_path / ".warden-attended-login").exists()
+
+
 def test_real_catalog_login_entry_is_login_lane():
     from warden.routing import load_catalog
     e = load_catalog(_repo_catalog()).get("key-cape-oidc-login")