Restore contained attended browser launch on WSL without xdg-utils

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

scripts/openbao-attended-exec.py

@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+"""Keep Warden containment; supply a scoped browser launcher when WSL lacks one."""
+import os
+from pathlib import Path
+import shutil
+import sys
+
+
+def main():
+    args=sys.argv[1:]
+    if args and args[0]=='--': args=args[1:]
+    if not args: raise SystemExit('A reviewed silent owner command is required')
+    env=os.environ.copy()
+    if not any(shutil.which(x) for x in ('xdg-open','x-www-browser','www-browser')):
+        if not Path('/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe').is_file():
+            raise SystemExit('No supported attended browser launcher is available')
+        env['PATH']=str(Path(__file__).resolve().parent/'operator-browser')+os.pathsep+env.get('PATH','')
+    os.execvpe('warden',['warden','access','openbao-platform-admin-login','--exec','--',*args],env)
+if __name__=='__main__': main()