Intercept the WSL OpenBao browser launch.

OpenBao opens the login with cmd.exe /c start, so the xdg-open launcher
never ran. The attended PATH now supplies cmd.exe for that one allowlisted
URL and opens it in the empty Playwright Chromium profile.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd

scripts/operator-browser/cmd.exe

@@ -0,0 +1,31 @@
+#!/usr/bin/env python3
+"""Intercept OpenBao's WSL browser launch.
+
+hashicorp/cap opens a WSL login with `cmd.exe /c start <url>`. That reaches
+the Windows default browser. This command sits ahead of the real cmd.exe on
+the attended-login PATH and opens the allowlisted URL in Playwright Chromium.
+"""
+import os
+import runpy
+import sys
+from pathlib import Path
+
+
+REAL_CMD = "/mnt/c/Windows/System32/cmd.exe"
+launcher = runpy.run_path(str(Path(__file__).resolve().with_name("xdg-open")))
+
+
+def main():
+    kind, url = launcher["classify_cmd"](sys.argv[1:])
+    if kind == "open":
+        launcher["stamp"]("called")
+        return launcher["open_url"](url)
+    if kind == "reject":
+        launcher["stamp"]("called")
+        launcher["stamp"]("rejected")
+        return 1
+    os.execv(REAL_CMD, [REAL_CMD, *sys.argv[1:]])
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())