test: guard OAuth setup-token stays interactive + marker exemption

Regression tests for the salvage follow-up: the interactive 'claude
setup-token' login must keep inherited stdin, and the guard's inline
'noqa: subprocess-stdin' marker must exempt a call.

tests/tools/test_subprocess_stdin_guard.py

@@ -5,11 +5,21 @@ It runs as part of the test suite so CI catches regressions when new
 subprocess calls are added without stdin=subprocess.DEVNULL.
 """
 
+import importlib.util
 import subprocess
 import sys
 from pathlib import Path
 
-SCRIPT = Path(__file__).resolve().parents[2] / "scripts" / "check_subprocess_stdin.py"
+REPO_ROOT = Path(__file__).resolve().parents[2]
+SCRIPT = REPO_ROOT / "scripts" / "check_subprocess_stdin.py"
+
+
+def _load_guard():
+    spec = importlib.util.spec_from_file_location("_stdin_guard", SCRIPT)
+    assert spec is not None and spec.loader is not None
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
 
 
 def test_all_tui_subprocess_calls_have_stdin():
@@ -23,3 +33,38 @@ def test_all_tui_subprocess_calls_have_stdin():
     assert result.returncode == 0, (
         f"subprocess stdin= check failed:\n{result.stdout}\n{result.stderr}"
     )
+
+
+def test_oauth_setup_token_keeps_inherited_stdin():
+    """The interactive 'claude setup-token' login must NOT be muzzled.
+
+    Forcing stdin=subprocess.DEVNULL here would feed the OAuth prompt EOF and
+    break interactive token setup. A blanket DEVNULL sweep over TUI-context
+    subprocess calls must leave this one inheriting stdin. Regression guard for
+    the over-application caught while salvaging the stdin-EOF fix.
+    """
+    src = (REPO_ROOT / "agent" / "anthropic_adapter.py").read_text()
+    assert 'subprocess.run([claude_path, "setup-token"])' in src, (
+        "interactive setup-token call changed shape; re-verify it still "
+        "inherits stdin (no stdin=subprocess.DEVNULL)"
+    )
+    assert 'subprocess.run([claude_path, "setup-token"], stdin' not in src, (
+        "setup-token must inherit stdin so the user can complete the OAuth "
+        "login prompt; do not add stdin=subprocess.DEVNULL"
+    )
+
+
+def test_inline_noqa_marker_exempts_a_call():
+    """The guard honors an inline 'noqa: subprocess-stdin' exemption marker."""
+    guard = _load_guard()
+    flagged = guard.find_subprocess_calls(
+        "import subprocess\nsubprocess.run(['ls'])\n", "x.py"
+    )
+    assert len(flagged) == 1, "unmarked missing-stdin call should be flagged"
+
+    exempt = guard.find_subprocess_calls(
+        "import subprocess\nsubprocess.run(['ls'])  # noqa: subprocess-stdin\n",
+        "x.py",
+    )
+    assert exempt == [], "inline marker should exempt the call"
+