fix: contain attended login diagnostics and OpenBao recovery

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684

tests/test_proxy.py

@@ -446,7 +446,7 @@ def test_attended_login_persistence_failure_revokes_and_cleans(monkeypatch, tmp_
             child_argv=["should-not-run"],
         )
     assert calls == [
-        ["bao", "login", "-no-print", "-format=json"],
+        ["bao", "login", "-format=json", "-no-print"],
         ["bao", "token", "revoke", "-self"],
     ]
     assert not (tmp_path / ".warden-attended-login").exists()
@@ -716,7 +716,7 @@ def test_attended_login_non_allowlisted_output_direct_raises_value_free(
     assert (exc.value.exit_code, exc.value.outcome) == (10, "login_failed")
     assert _LOGIN_SENTINEL not in str(exc.value)
     assert calls == [
-        ["bao", "login", "-no-print", "-format=json"],
+        ["bao", "login", "-format=json", "-no-print"],
         ["bao", "token", "revoke", "-self"],
     ]
 
@@ -948,3 +948,49 @@ def test_access_agent_high_risk_fingerprint_allowed(tmp_path, monkeypatch):
     )
     assert r.exit_code == 0, r.output
     assert "should-not-appear" not in r.output
+
+
+def test_attended_json_format_precedes_auth_data(monkeypatch, tmp_path):
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    calls = []
+    def run(argv, **kwargs):
+        calls.append(argv)
+        return subprocess.CompletedProcess(argv, 1, b"", b"")
+    monkeypatch.setattr("warden.proxy.subprocess.run", run)
+    with pytest.raises(AttendedLoginError):
+        proxy_attended_login_exec(
+            ResolvedFetch(argv=["bao", "login", "-no-print", "-method=oidc", "role=platform-admin"]),
+            child_argv=["must-not-run"],
+        )
+    assert calls[0].index("-format=json") < calls[0].index("role=platform-admin")
+
+
+@pytest.mark.parametrize("shape", ["s", "hvs", "hvb", "hvr"])
+def test_contained_recovery_supports_openbao_token_shapes(monkeypatch, shape):
+    from warden.proxy import _revoke_contained
+    calls = []
+    sentinel = shape + ".FAKE_RECOVERY_SENTINEL_12345678"
+    def run(argv, **kwargs):
+        calls.append((argv, dict(kwargs["env"])))
+        return subprocess.CompletedProcess(argv, 1 if len(calls) == 1 else 0, b"", b"")
+    monkeypatch.setattr("warden.proxy.subprocess.run", run)
+    assert _revoke_contained("bao", env={}, possible_output=sentinel.encode())
+    assert calls[1][1]["BAO_TOKEN"] == sentinel
+    assert all(sentinel not in " ".join(argv) for argv, _ in calls)
+
+
+@pytest.mark.parametrize("prefix,category", [
+    ("timed out waiting for response from provider", "callback_timeout"),
+    ("Error handling callback", "callback_error"),
+    ("Error authenticating:", "authentication_error"),
+    ("unrecognized backend error", "unknown_client_failure"),
+])
+def test_attended_failure_is_fixed_category_without_client_bytes(monkeypatch, tmp_path, prefix, category):
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    sentinel = "SECRET_CLIENT_OUTPUT_SENTINEL"
+    def run(argv, **kwargs):
+        return subprocess.CompletedProcess(argv, 1, b"", (prefix + " " + sentinel).encode())
+    monkeypatch.setattr("warden.proxy.subprocess.run", run)
+    with pytest.raises(AttendedLoginError, match="category=" + category) as exc:
+        proxy_attended_login_exec(ResolvedFetch(argv=["bao", "login", "-no-print"]), child_argv=["must-not-run"])
+    assert sentinel not in str(exc.value)