Restore contained attended browser launch on WSL without xdg-utils

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

scripts/operator-browser/xdg-open

@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+"""Contained WSL launcher, limited to the approved OpenBao OIDC callback."""
+import subprocess
+import sys
+from urllib.parse import urlsplit, parse_qs
+
+
+def allowed(url):
+    try:
+        u=urlsplit(url); q=parse_qs(u.query)
+        return (u.scheme=='https' and u.hostname=='kc.coulomb.social'
+            and u.port in (None,443) and u.username is None and u.password is None
+            and not u.fragment and not any(c in url for c in '\r\n\x00')
+            and q.get('redirect_uri') in (['http://localhost:8250/oidc/callback'],['http://127.0.0.1:8250/oidc/callback']))
+    except ValueError: return False
+
+
+def main():
+    if len(sys.argv)!=2 or not allowed(sys.argv[1]): return 1
+    try:
+        r=subprocess.run(['/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe',
+            '-NoProfile','-NonInteractive','-Command',
+            '$ErrorActionPreference="Stop"; $u=[Console]::In.ReadLine(); Start-Process -FilePath $u'],
+            input=(sys.argv[1]+'\n').encode(),stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=20)
+        return int(r.returncode!=0)
+    except Exception: return 1
+if __name__=='__main__': raise SystemExit(main())