fix: contain attended login diagnostics and OpenBao recovery

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684

src/warden/proxy.py

@@ -41,7 +41,7 @@ from typing import List, Optional
 from warden.routing.models import RouteEntry
 
 _PLACEHOLDER = re.compile(r"<[^>]+>")
-_OPENBAO_TOKEN = re.compile(rb"\b(?:hvs|hvb|hvr)\.[A-Za-z0-9_-]{8,}\b")
+_OPENBAO_TOKEN = re.compile(rb"\b(?:hvs|hvb|hvr|s)\.[A-Za-z0-9_-]{8,}\b")
 _ATTENDED_LOGIN_ROOT = ".warden-attended-login"
 _TOKEN_HELPER_NAME = ".vault-token"
 
@@ -544,7 +544,7 @@ def proxy_attended_login_exec(
 
     login_argv = list(resolved.argv)
     if not any(arg == "-format" or arg.startswith("-format=") for arg in login_argv):
-        login_argv.append("-format=json")
+        login_argv.insert(2, "-format=json")
 
     try:
         try:
@@ -569,9 +569,27 @@ def proxy_attended_login_exec(
                 "" if output_allowed
                 else " (login client produced non-allowlisted output)"
             )
+            # Fixed categories and booleans only; captured bytes stay discarded.
+            if login.returncode != 0:
+                if b"timed out waiting for response from provider" in login_output:
+                    category = "callback_timeout"
+                elif b"Error handling callback" in login_output:
+                    category = "callback_error"
+                elif b"Error authenticating:" in login_output:
+                    category = "authentication_error"
+                else:
+                    category = "unknown_client_failure"
+            elif not helper_valid:
+                category = "helper_persistence_missing"
+            else:
+                category = "output_shape_rejected"
             raise AttendedLoginError(
                 "attended login failed closed before command handoff"
-                f"{reason}; any possible issued session was contained and {status}",
+                f"{reason}; category={category}, client_exit={login.returncode}, "
+                f"helper_present={helper_valid}, "
+                f"stdout_allowed={_login_stdout_allowed(_stream_bytes(login.stdout))}, "
+                f"stderr_allowed={_login_stderr_allowed(_stream_bytes(login.stderr))}; "
+                f"any possible issued session was contained and {status}",
                 exit_code=10, outcome="login_failed",
             )