diff --git a/CHANGELOG.md b/CHANGELOG.md
index d4f9e68b9..24cc6c4af 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,33 @@
 # Changelog
 
+## 1.0.12 — 2026-10-23
+
+The stable release of logging in to FailproofAI Cloud from `config` in your browser. Everything below in the `1.0.12-beta.*` sections ships here too.
+
+### Features
+
+- **Every agent on the machine knows FailproofAI.** `config` adds a small `failproofai` skill to each agent it finds (and any you tick), in that agent's own skills folder: Claude Code, Codex, Copilot, Cursor, OpenCode, Pi, every Hermes and OpenClaw profile, droid, Devin, Antigravity and Goose. It points the agent at the FailproofAI skills on GitHub, which it reads when a FailproofAI task comes up, so what it reads is always the current version with nothing to update. Each folder was checked against the agent itself. A `failproofai` skill you installed yourself (for example with `npx skills add FailproofAI/skills`) is left as it is, and Codex, which would list one in `~/.agents/skills` beside its own copy, is left to that one. `failproofai uninstall` removes only the ones `config` wrote (#920)
+
+### Fixes
+
+- `config` on a machine with no saved connection, whose browser login was approved but whose key could not be claimed, no longer says "This machine keeps its previous connection." and reports cloud mode with no key on disk; it finishes set up as open source (#920)
+- `config`, logging in again on a connected machine where the new key is created but can't be used, says the machine keeps its previous connection (which it does: nothing was written) instead of finishing as if it were open source (#920)
+- `config` on a machine whose saved key was refused, when logging in again creates no key, says the kept connection's key no longer works and to run `config` again, instead of reporting the old connection as if it were fine (#920)
+- `config` no longer sends the saved key to a saved cloud address it would refuse if typed (plain `http://` to another host) when checking that key (#920)
+- `config`'s browser login takes an expired or refused link off the screen when it prints a new one, so only the live link can be opened; and a cloud that answers the login route with a web page is treated as one without browser login (paste a key) instead of an error (#920)
+- `config` saves the org a browser login was approved into even when the follow-up check of the new key can't reach the server, instead of leaving the saved org empty or stale; and its completion event reports whether the machine actually connected, not whether it set out to (#920)
+
 ## 1.0.12-beta.0 — 2026-10-22
 
+### Features
+
+- **Log in to FailproofAI Cloud from `config`.** On a machine that is not connected (or whose saved key is refused), the connect step now starts a browser login straight away; Tab opens the other options: paste an API key, or use open source. Logging in opens a link — or prints it over SSH or with no display, to open on any device — where you sign up or sign in, pick or create an org, and authorize the machine; the terminal notices on its own and shows who approved it and for which org. The machine's key is created only when setup finishes, after the daemon is installed, so a run you abandon leaves no key behind. A machine that is already connected with a working key gets a menu with "keep" first, so re-running setup never opens a browser by itself. Needs a FailproofAI Cloud with browser login; an older one says so and pasting a key still works (#920)
+
+### Fixes
+
+- `config`'s cloud login prints what the server sends — org, approver, key name, errors, the link — without terminal control or bidi characters, keeps the server's poll interval and expiry to a sane range, checks a saved cloud address like a typed one, and names the key to revoke if one was created but could not be used (#920)
+- `config` asks for your sudo password again before installing the daemon, or refreshing its service definition, when the one given at the start expired while you were answering (5 minutes on macOS by default), instead of failing after everything else was done (#920)
+
 ### Dependencies
 
 - Combine the open Dependabot PRs (#921, #922, #923) into one: `certifi` 2026.7.22 → 2026.10.19 (GHSA-6q48-6c7w-9gw2) in `fp-cloud-cli` and the Python SDK's test lockfile, and `vite` 8.3.0 → 8.3.4 in the TypeScript SDK's dev lockfile. The Supply Chain gate scans every lockfile, so none of the three could pass on its own (#926)
diff --git a/Cargo.lock b/Cargo.lock
index a8cbb1178..c16256b72 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -298,7 +298,7 @@ dependencies = [
 
 [[package]]
 name = "failproofaid"
-version = "1.0.12-beta.0"
+version = "1.0.12"
 dependencies = [
  "fpai-collect",
  "fpai-ipc",
@@ -361,7 +361,7 @@ dependencies = [
 
 [[package]]
 name = "fpai-collect"
-version = "1.0.12-beta.0"
+version = "1.0.12"
 dependencies = [
  "axum",
  "getrandom 0.4.3",
@@ -382,7 +382,7 @@ dependencies = [
 
 [[package]]
 name = "fpai-ipc"
-version = "1.0.12-beta.0"
+version = "1.0.12"
 dependencies = [
  "libc",
  "proptest",
diff --git a/Cargo.toml b/Cargo.toml
index 62a65a004..beff85f1b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ resolver = "3"
 members = ["crates/*"]
 
 [workspace.package]
-version = "1.0.12-beta.0"
+version = "1.0.12"
 edition = "2024"
 license-file = "LICENSE"
 repository = "https://github.com/FailproofAI/failproofai"
diff --git a/__tests__/e2e/layout/README.md b/__tests__/e2e/layout/README.md
index 8ec809f6b..ddb2c2d01 100644
--- a/__tests__/e2e/layout/README.md
+++ b/__tests__/e2e/layout/README.md
@@ -9,6 +9,7 @@ not depend on — so they are invoked deliberately.
 | `layout-reset.sh` | nothing | fresh/stale/future layout detection, reset semantics, OSS silence, hook warn-don't-delete-don't-deny |
 | `cloud-collector.sh` | an AgentEye stack | real connect against a live server, daemon + collector writing layout-2 paths, decisions reaching ClickHouse, disconnect back to OSS |
 | `systemd-service.sh` | Docker | REAL `systemctl enable --now` as root in a privileged container: service lifecycle, fail-closed, self-heal, reinstall |
+| `cli-login.sh` | an AgentEye stack (dashboard + mailpit + its Postgres), Docker, `bun run build` + the release daemon | `config`'s browser login through a real pty in a systemd container: approve, re-login, deny + retry, abandon after approval (no key minted), esc, expiry, revoked saved key, older server, and the person-side refusals (Origin, form posts, no session, start rate limit) |
 
 `systemd-service.sh` exists because the service half cannot be tested on a
 developer machine without a password prompt, and a container gives real systemd
@@ -31,6 +32,11 @@ Two things it caught that a mock could not:
 bash __tests__/e2e/layout/layout-reset.sh
 bash __tests__/e2e/layout/systemd-service.sh
 
+# cli-login.sh drives the real wizard against a running AgentEye; point it at
+# that stack's dashboard, mailpit API and Postgres container.
+DASH=http://localhost:3000 MAILPIT=http://localhost:8026 PG_CONTAINER=agenteye-postgres-1 \
+  bash __tests__/e2e/layout/cli-login.sh
+
 # cloud-collector.sh expects the stack on the remapped ports (18080/18123) so it
 # can run alongside an existing project rather than displacing it:
 docker compose -p aefpai -f docker-compose.yml -f ports.yml up -d
diff --git a/__tests__/e2e/layout/cli-login-driver.py b/__tests__/e2e/layout/cli-login-driver.py
new file mode 100755
index 000000000..45a465918
--- /dev/null
+++ b/__tests__/e2e/layout/cli-login-driver.py
@@ -0,0 +1,102 @@
+#!/usr/bin/env python3
+"""Drive `failproofai config` through a real pseudo-terminal, screen by screen.
+
+Used by cli-login.sh, inside the systemd container, as the unprivileged user.
+The wizard only offers browser login to a real terminal, so a pty is the only
+honest way to test it end to end.
+
+Usage: cli-login-driver.py <script> <transcript-file> <url-file> -- <command...>
+
+<script> is a comma-separated list of steps, each `wait:<text>` (block until
+the screen shows <text>), `key:<name>` (enter, down, up, esc, ctrl-c, tab),
+`url` (wait for the authorize link and write it to <url-file>), or
+`sleep:<seconds>`. Exit status is the command's own, or 124 on a timeout.
+"""
+import os
+import pty
+import re
+import select
+import sys
+import time
+
+KEYS = {
+    "enter": b"\r",
+    "down": b"\x1b[B",
+    "up": b"\x1b[A",
+    "esc": b"\x1b",
+    "ctrl-c": b"\x03",
+    "tab": b"\t",
+}
+ANSI = re.compile(rb"\x1b\[[0-9;?]*[A-Za-z]|\x1b[78]")
+LINK = re.compile(r"https?://\S+/cli/authorize\?r=[0-9a-f]{64}")
+STEP_TIMEOUT = float(os.environ.get("DRIVER_STEP_TIMEOUT", "60"))
+
+
+def main() -> int:
+    script, transcript_path, url_path = sys.argv[1], sys.argv[2], sys.argv[3]
+    cmd = sys.argv[sys.argv.index("--") + 1 :]
+    pid, fd = pty.fork()
+    if pid == 0:
+        os.environ["COLUMNS"] = "100"
+        os.execvp(cmd[0], cmd)
+
+    screen = b""
+    seen_from = 0  # `wait` only matches text that arrived after the last match
+
+    def pump(timeout: float) -> bool:
+        nonlocal screen
+        r, _, _ = select.select([fd], [], [], timeout)
+        if not r:
+            return True
+        try:
+            chunk = os.read(fd, 65536)
+        except OSError:
+            return False
+        if not chunk:
+            return False
+        screen += chunk
+        with open(transcript_path, "ab") as f:
+            f.write(chunk)
+        return True
+
+    def plain() -> str:
+        return ANSI.sub(b"", screen).decode("utf-8", "replace")
+
+    for step in [s for s in script.split(",") if s]:
+        kind, _, arg = step.partition(":")
+        deadline = time.time() + STEP_TIMEOUT
+        if kind == "wait":
+            while arg not in plain()[seen_from:]:
+                if time.time() > deadline or not pump(0.2):
+                    print(f"driver: timed out waiting for {arg!r}", file=sys.stderr)
+                    return 124
+            seen_from = plain().index(arg, seen_from) + len(arg)
+        elif kind == "url":
+            while not LINK.search(plain()[seen_from:]):
+                if time.time() > deadline or not pump(0.2):
+                    print("driver: no authorize link appeared", file=sys.stderr)
+                    return 124
+            m = LINK.search(plain()[seen_from:])
+            seen_from += m.end()
+            with open(url_path, "w") as f:
+                f.write(m.group(0))
+        elif kind == "key":
+            time.sleep(0.3)  # let the screen settle so the key lands on it
+            os.write(fd, KEYS[arg])
+        elif kind == "sleep":
+            end = time.time() + float(arg)
+            while time.time() < end:
+                pump(0.2)
+
+    # Drain until the command exits.
+    deadline = time.time() + STEP_TIMEOUT * 2
+    while pump(0.2):
+        if time.time() > deadline:
+            print("driver: command did not exit", file=sys.stderr)
+            return 124
+    _, status = os.waitpid(pid, 0)
+    return os.waitstatus_to_exitcode(status)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/__tests__/e2e/layout/cli-login.sh b/__tests__/e2e/layout/cli-login.sh
new file mode 100755
index 000000000..418b7850b
--- /dev/null
+++ b/__tests__/e2e/layout/cli-login.sh
@@ -0,0 +1,284 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# `failproofai config` → "Log in to FailproofAI Cloud", end to end, for real.
+#
+# The real wizard runs in a real pseudo-terminal (cli-login-driver.py) inside a
+# systemd container, as an unprivileged user, and installs a real daemon. A
+# person's half — signing in, approving, denying — happens through the real
+# AgentEye dashboard API, with the sign-in code read out of mailpit. Then it
+# checks what landed: the machine's key, the daemon checking in with it, and
+# what the server recorded. Nothing is mocked.
+#
+# Needs, all local:
+#   - an AgentEye stack: dashboard on $DASH, mailpit API on $MAILPIT, and its
+#     Postgres reachable through `docker exec $PG_CONTAINER psql`
+#   - this repo built: `bun run build` (dist/) and
+#     `cargo build --release --bin failproofaid`
+#   - Docker. The container uses the HOST network, because the CLI only sends
+#     a key over plain http to loopback, so it must see the dashboard there.
+#
+# Not part of `bun run test:e2e`: like the other harnesses here, it is run
+# deliberately (see README.md in this directory).
+#
+#   DASH=http://localhost:3000 MAILPIT=http://localhost:8026 \
+#     PG_CONTAINER=agenteye-postgres-1 bash __tests__/e2e/layout/cli-login.sh
+# ─────────────────────────────────────────────────────────────────────────────
+set -uo pipefail
+
+R="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+DASH=${DASH:-http://localhost:3000}
+MAILPIT=${MAILPIT:-http://localhost:8026}
+PG_CONTAINER=${PG_CONTAINER:-agenteye-postgres-1}
+C=${C:-fpai-e2e-login}
+KEEP=${KEEP:-0}  # 1 = leave the container up afterwards, for poking at
+STAMP=$(date +%s)
+OUT=$(mktemp -d)
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  \033[32mPASS\033[0m %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  \033[31mFAIL\033[0m %s\n       %s\n' "$1" "${2:-}"; }
+has()   { if printf '%s' "$2" | grep -qF -- "$3"; then ok "$1"; else bad "$1" "missing [$3] in: $(printf '%s' "$2" | tr '\n' ' ' | tail -c 400)"; fi; }
+hasnt() { if printf '%s' "$2" | grep -qF -- "$3"; then bad "$1" "unexpected [$3]"; else ok "$1"; fi; }
+eq()    { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1" "want [$3] got [$2]"; fi; }
+head1() { printf '\n\033[1m── %s\033[0m\n' "$1"; }
+jqp() { python3 -c "import sys,json;d=json.load(sys.stdin);print(eval('d'+sys.argv[1]))" "$1" 2>/dev/null; }
+sql() { docker exec "$PG_CONTAINER" psql -U postgres -d agenteye -tAc "$1"; }
+dex() { docker exec "$C" bash -lc "$1"; }
+
+cleanup() {
+  [ "$KEEP" = 1 ] || docker rm -f "$C" >/dev/null 2>&1
+  rm -rf "$OUT"
+}
+trap cleanup EXIT
+
+# ── A person, through the dashboard ──────────────────────────────────────────
+
+# Sign <email> in through the real email-code flow and print its session.
+sign_in() {
+  local email=$1 id code
+  curl -s -X DELETE "$MAILPIT/api/v1/search?query=to:$email" >/dev/null || true
+  curl -s -X POST "$DASH/api/auth/otp/request" -H 'content-type: application/json' -d "{\"email\":\"$email\"}" >/dev/null
+  for _ in $(seq 1 40); do
+    id=$(curl -s "$MAILPIT/api/v1/search?query=to:$email&limit=1" | jqp '["messages"][0]["ID"]')
+    [ -n "$id" ] && break
+    sleep 0.5
+  done
+  code=$(curl -s "$MAILPIT/api/v1/message/$id" | python3 -c 'import sys,json,re;print(re.search(r"\b(\d{6})\b",json.load(sys.stdin)["Text"]).group(1))')
+  curl -s -D - -o /dev/null -X POST "$DASH/api/auth/otp/verify" -H 'content-type: application/json' \
+    -d "{\"email\":\"$email\",\"code\":\"$code\"}" | tr -d '\r' | sed -n 's/^[Ss]et-[Cc]ookie: ae_session=\([^;]*\).*/\1/p'
+}
+
+person() { # <session> <action> <json> -> body; status in $OUT/status
+  curl -s -o "$OUT/body" -w '%{http_code}' -X POST "$DASH/api/auth/cli/$2" -b "ae_session=$1" \
+    -H "origin: $DASH" -H 'content-type: application/json' -d "$3" > "$OUT/status"
+  cat "$OUT/body"
+}
+
+link_token() { python3 -c 'import sys,urllib.parse as u;print(u.parse_qs(u.urlparse(sys.argv[1]).query)["r"][0])' "$1"; }
+
+# ── The machine, through a real terminal ─────────────────────────────────────
+
+# Run `failproofai config` under the pty driver in the background.
+# <name> <script> [extra env...]; transcript -> $OUT/<name>.log, rc -> $OUT/<name>.rc
+run_config() {
+  local name=$1 script=$2; shift 2
+  dex "rm -f /tmp/$name.log /tmp/$name.url"
+  ( docker exec -u dev -w /home/dev "$C" env HOME=/home/dev \
+      FAILPROOFAI_CLOUD_URL="$DASH" \
+      FAILPROOFAI_DAEMON_BINARY=/repo/target/release/failproofaid \
+      FAILPROOFAI_TELEMETRY_DISABLED=1 FAILPROOFAI_NO_AUTO_AUDIT=1 NO_COLOR=1 "$@" \
+      python3 /repo/__tests__/e2e/layout/cli-login-driver.py "$script" "/tmp/$name.log" "/tmp/$name.url" \
+      -- failproofai config ; echo $? > "$OUT/$name.rc" ) &
+}
+
+wait_url() { # <name> -> the authorize link the CLI printed
+  local u=""
+  for _ in $(seq 1 120); do
+    u=$(dex "cat /tmp/$1.url 2>/dev/null")
+    [ -n "$u" ] && { dex "rm -f /tmp/$1.url"; echo "$u"; return; }
+    sleep 0.5
+  done
+}
+
+wait_done() { # <name> -> transcript
+  for _ in $(seq 1 240); do [ -f "$OUT/$1.rc" ] && break; sleep 0.5; done
+  dex "cat /tmp/$1.log 2>/dev/null" | sed 's/\x1b\[[0-9;?]*[A-Za-z]//g'
+}
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 0 — preconditions"
+curl -s -m 5 -o /dev/null "$DASH/login" && ok "dashboard is up on $DASH" || bad "dashboard is up" "$DASH/login"
+curl -s -m 5 -o /dev/null "$MAILPIT/api/v1/messages" && ok "mailpit is up on $MAILPIT" || bad "mailpit is up" "$MAILPIT"
+[ -n "$(sql 'select 1' 2>/dev/null)" ] && ok "Postgres reachable via $PG_CONTAINER" || bad "Postgres reachable" "$PG_CONTAINER"
+[ -f "$R/dist/cli.mjs" ] && ok "CLI built" || bad "CLI built" "run: bun run build"
+[ -x "$R/target/release/failproofaid" ] && ok "daemon built" || bad "daemon built" "run: cargo build --release --bin failproofaid"
+[ "$FAIL" = 0 ] || { echo "preconditions failed"; exit 1; }
+
+if ! docker ps --format '{{.Names}}' | grep -qx "$C"; then
+  docker run -d --name "$C" --privileged --cgroupns=host --network=host \
+    -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run --tmpfs /run/lock \
+    -v "$R":/repo:ro jrei/systemd-ubuntu:24.04 >/dev/null
+  until docker exec "$C" systemctl is-system-running 2>/dev/null | grep -qE 'running|degraded'; do sleep 1; done
+  dex 'export DEBIAN_FRONTEND=noninteractive; apt-get update -qq >/dev/null; apt-get install -y -qq sudo curl ca-certificates python3 >/dev/null 2>&1
+       curl -fsSL https://deb.nodesource.com/setup_22.x -o /tmp/n.sh && bash /tmp/n.sh >/dev/null 2>&1 && apt-get install -y -qq nodejs >/dev/null 2>&1
+       id dev >/dev/null 2>&1 || useradd -m -s /bin/bash dev
+       echo "dev ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/dev && chmod 440 /etc/sudoers.d/dev'
+fi
+# Claude Code "installed": detection is a binary on PATH, and a detected agent
+# is what the agents screen opens ticked — so Enter there is the final OK.
+dex 'printf "#!/bin/sh\nexit 0\n" > /usr/local/bin/claude && chmod +x /usr/local/bin/claude'
+# `failproofai` on PATH, as `npm i -g` would put it: hook install writes that
+# command into each agent's settings and refuses to run without it.
+dex 'ln -sf /repo/dist/cli.mjs /usr/local/bin/failproofai' 
+# A fresh machine every run: no daemon, no failproofai home.
+dex 'systemctl disable --now failproofaid@dev.service >/dev/null 2>&1; rm -f /etc/systemd/system/failproofaid@dev.service; systemctl daemon-reload; rm -rf /home/dev/.failproofai /home/dev/.claude'
+eq "container up, with systemd" "$(dex 'systemctl is-system-running' | tr -d '\r')" "running"
+# The label setup sends is the hostname (`--machine-label` alone RENAMES a
+# connected machine, so it is not a setup option here).
+LABEL=$(dex hostname | tr -d '\r')
+
+EMAIL="ada-$STAMP@example.test"
+SLUG="e2e-$STAMP"
+SESSION=$(sign_in "$EMAIL")
+[ -n "$SESSION" ] && ok "approver signed in through the email code" || bad "approver signed in" "no session"
+ORG_ID=$(curl -s -X POST "$DASH/api/orgs" -b "ae_session=$SESSION" -H 'content-type: application/json' \
+  -d "{\"slug\":\"$SLUG\",\"name\":\"E2E Co\"}" | jqp '["id"]')
+[ -n "$ORG_ID" ] && ok "approver created org $SLUG" || bad "approver created an org" "no id"
+USER_ID=$(sql "select id from users where email = '$EMAIL'")
+keys_in_org() { sql "select count(*) from api_keys where org_id = '$ORG_ID' and created_via = 'cli_login'"; }
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 1 — a fresh machine starts the login by itself, and setup finishes on its own"
+run_config fresh "wait:CONNECT TO CLOUD,url,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
+URL=$(wait_url fresh)
+has "the CLI printed the authorize link" "$URL" "$DASH/cli/authorize?r="
+LINK=$(link_token "$URL")
+PAGE=$(person "$SESSION" lookup "{\"link_token\":\"$LINK\"}")
+eq "the page sees a pending request" "$(echo "$PAGE" | jqp '["status"]')" "pending"
+eq "…for this machine" "$(echo "$PAGE" | jqp '["machine"]["label"]')" "$LABEL"
+eq "nothing is minted before approval" "$(keys_in_org)" "0"
+person "$SESSION" approve "{\"link_token\":\"$LINK\",\"org_id\":\"$ORG_ID\"}" >/dev/null
+eq "approve answered 200" "$(cat "$OUT/status")" "200"
+T=$(wait_done fresh)
+eq "config exited 0" "$(cat "$OUT/fresh.rc")" "0"
+has "no display here, so it printed the link to open anywhere" "$T" "Open this link in any browser to connect $LABEL"
+hasnt "no menu before the login on a fresh machine" "$T" "Paste an API key"
+has "tab is offered as the way to the other options" "$T" "tab more options"
+has "the CLI shows who approved it, and where" "$T" "Logged in as $EMAIL · E2E Co ($SLUG)"
+has "the daemon installed" "$T" "failproofaid installed and running"
+has "the cloud connection was written" "$T" "Connected as"
+eq "exactly one key minted, at the end of setup" "$(keys_in_org)" "1"
+eq "attributed to the approver" "$(sql "select created_by_user_id from api_keys where org_id = '$ORG_ID' and created_via = 'cli_login'")" "$USER_ID"
+eq "the request is spent" "$(sql "select status from cli_login_requests where link_token_hash = encode(sha256('$LINK'::bytea), 'hex')")" "claimed"
+eq "daemon running under systemd" "$(dex 'systemctl is-active failproofaid@dev' | tr -d '\r')" "active"
+KEY=$(dex "python3 -c 'import json;d=json.load(open(\"/home/dev/.failproofai/credentials.json\"));print(d[\"cloud\"][\"token\"])'" | tr -d '\r')
+WHO=$(curl -s "$DASH/v1/auth/introspect" -H "authorization: Bearer $KEY")
+eq "the machine's key works, in the approved org" "$(echo "$WHO" | jqp '["org_slug"]')" "$SLUG"
+has "…with jev, which the approver holds" "$WHO" "jev:evaluate"
+for _ in $(seq 1 30); do
+  [ "$(sql "select count(*) from enforcement_machines where org_id = '$ORG_ID'")" = 1 ] && break; sleep 1
+done
+eq "the daemon checked in with that key" "$(sql "select count(*) from enforcement_machines where org_id = '$ORG_ID'")" "1"
+hasnt "the key never appears in the terminal" "$T" "$KEY"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 2 — a connected machine is offered 'keep' first; logging in again makes a new key"
+run_config relogin "wait:Keep current connection,key:down,key:enter,url,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
+LINK=$(link_token "$(wait_url relogin)")
+person "$SESSION" approve "{\"link_token\":\"$LINK\",\"org_id\":\"$ORG_ID\"}" >/dev/null
+T=$(wait_done relogin)
+eq "config exited 0" "$(cat "$OUT/relogin.rc")" "0"
+has "the menu named the saved key" "$T" "key ****"
+has "it says the old key still works" "$T" "Your previous key for this machine still works"
+eq "a second key, the first one still live" "$(sql "select count(*) from api_keys where org_id = '$ORG_ID' and created_via = 'cli_login' and revoked_at is null")" "2"
+has "the second key carries a suffix, not a clash" "$(sql "select string_agg(name, ',' order by name) from api_keys where org_id = '$ORG_ID' and created_via = 'cli_login'")" "-2"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 3 — not authorized in the browser, retried from the terminal"
+run_config deny "wait:Keep current connection,key:down,key:enter,url,wait:Not authorized in the browser.,key:enter,url,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
+LINK1=$(link_token "$(wait_url deny)")
+person "$SESSION" deny "{\"link_token\":\"$LINK1\"}" >/dev/null
+eq "deny answered 200" "$(cat "$OUT/status")" "200"
+LINK2=$(link_token "$(wait_url deny)")
+[ "$LINK1" != "$LINK2" ] && ok "enter fetched a NEW link" || bad "enter fetched a new link" "same token"
+person "$SESSION" approve "{\"link_token\":\"$LINK2\",\"org_id\":\"$ORG_ID\"}" >/dev/null
+T=$(wait_done deny)
+eq "config exited 0" "$(cat "$OUT/deny.rc")" "0"
+eq "the denied request stays denied" "$(sql "select status from cli_login_requests where link_token_hash = encode(sha256('$LINK1'::bytea), 'hex')")" "denied"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 4 — approved, then the run is abandoned: no key is minted"
+BEFORE=$(keys_in_org)
+run_config abandon "wait:Keep current connection,key:down,key:enter,url,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:ctrl-c"
+LINK=$(link_token "$(wait_url abandon)")
+person "$SESSION" approve "{\"link_token\":\"$LINK\",\"org_id\":\"$ORG_ID\"}" >/dev/null
+T=$(wait_done abandon)
+eq "no key minted for an approval nobody claimed" "$(keys_in_org)" "$BEFORE"
+eq "the request is approved, never claimed" "$(sql "select status from cli_login_requests where link_token_hash = encode(sha256('$LINK'::bytea), 'hex')")" "approved"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 5 — tab leaves the login for the options without touching anything"
+BEFORE=$(keys_in_org)
+run_config esc "wait:Keep current connection,key:down,key:enter,url,key:tab,wait:Keep current connection,key:enter,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
+LINK=$(link_token "$(wait_url esc)")
+T=$(wait_done esc)
+eq "config exited 0 after keeping the connection" "$(cat "$OUT/esc.rc")" "0"
+eq "no key minted" "$(keys_in_org)" "$BEFORE"
+eq "the abandoned link is still just pending" "$(sql "select status from cli_login_requests where link_token_hash = encode(sha256('$LINK'::bytea), 'hex')")" "pending"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 6 — a link that expires offers a fresh one"
+run_config expire "wait:Keep current connection,key:down,key:enter,url,wait:That link expired.,key:enter,url,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
+LINK1=$(link_token "$(wait_url expire)")
+sql "update cli_login_requests set expires_at = now() - interval '1 second' where link_token_hash = encode(sha256('$LINK1'::bytea), 'hex')" >/dev/null
+LINK2=$(link_token "$(wait_url expire)")
+person "$SESSION" approve "{\"link_token\":\"$LINK2\",\"org_id\":\"$ORG_ID\"}" >/dev/null
+T=$(wait_done expire)
+eq "config exited 0 on the fresh link" "$(cat "$OUT/expire.rc")" "0"
+person "$SESSION" approve "{\"link_token\":\"$LINK1\",\"org_id\":\"$ORG_ID\"}" >/dev/null
+eq "the expired link can no longer be approved" "$(cat "$OUT/status")" "410"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 7 — a saved key that was revoked: logging in again starts by itself"
+# Revoke every live CLI key, so whichever one this machine holds is dead.
+for id in $(curl -s "$DASH/api/keys" -b "ae_session=$SESSION" -H "x-agenteye-org: $SLUG" | python3 -c '
+import sys,json
+for k in json.load(sys.stdin):
+    if k.get("created_via")=="cli_login" and not k.get("revoked_at"): print(k["id"])'); do
+  curl -s -o /dev/null -X POST "$DASH/api/keys/$id/disable" -b "ae_session=$SESSION" -H "x-agenteye-org: $SLUG" \
+    -H "origin: $DASH" -H 'content-type: application/json' -d '{}'
+done
+sleep 2
+run_config revoked "wait:saved key no longer works,url,key:ctrl-c"
+T=$(wait_done revoked)
+has "a refused saved key starts the login by itself, and says why" "$T" "Your saved key no longer works:"
+has "…logging in again" "$T" "Logging in again."
+has "…with a fresh link" "$T" "/cli/authorize?r="
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 8 — a cloud without browser login says so, and offers the rest"
+run_config old "wait:doesn't support logging in from here yet,wait:Paste an API key,key:ctrl-c" \
+  FAILPROOFAI_CLOUD_URL=http://localhost:28080
+T=$(wait_done old)
+has "an older server is reported, and the key route stays open" "$T" "doesn't support logging in from here yet. Paste an API key instead."
+hasnt "…and login is not offered again" "$T" "Log in again"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 9 — the person side refuses what it must"
+EVIL=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/approve" -b "ae_session=$SESSION" \
+  -H 'origin: https://evil.example' -H 'content-type: application/json' -d "{\"link_token\":\"x\",\"org_id\":\"$ORG_ID\"}")
+eq "a cross-site approve is refused" "$EVIL" "403"
+FORM=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/approve" -b "ae_session=$SESSION" \
+  -H "origin: $DASH" -H 'content-type: application/x-www-form-urlencoded' -d 'link_token=x')
+eq "a form-encoded approve is refused" "$FORM" "403"
+NOSESS=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/approve" -H "origin: $DASH" \
+  -H 'content-type: application/json' -d '{}')
+eq "no session, no approve" "$NOSESS" "401"
+for _ in $(seq 1 12); do
+  LAST=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/start" -H 'x-forwarded-for: 198.51.100.7' \
+    -H 'content-type: application/json' -d '{"machine_label":"flood"}')
+done
+eq "starts from one address are rate-limited" "$LAST" "429"
+
+printf '\n\033[1m%d passed, %d failed\033[0m\n' "$PASS" "$FAIL"
+[ "$FAIL" = 0 ]
diff --git a/__tests__/hooks/agent-skill.test.ts b/__tests__/hooks/agent-skill.test.ts
new file mode 100644
index 000000000..0e13b26bc
--- /dev/null
+++ b/__tests__/hooks/agent-skill.test.ts
@@ -0,0 +1,193 @@
+// @vitest-environment node
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, relative } from "node:path";
+import {
+  AGENT_SKILL_MARKER,
+  AGENT_SKILL_MD,
+  AGENT_SKILL_NAME,
+  agentSkillRoots,
+  installAgentSkill,
+  installedAgentSkillDirs,
+  removeAgentSkill,
+} from "../../src/hooks/agent-skill";
+import { INTEGRATION_TYPES } from "../../src/hooks/types";
+
+// Every variable that moves an agent's folder, so a developer's own exports
+// can never point a test at their real agents.
+const ENV = [
+  "HOME", "FAILPROOFAI_HOME", "XDG_CONFIG_HOME", "CLAUDE_CONFIG_DIR", "CODEX_HOME", "COPILOT_HOME",
+  "PI_CODING_AGENT_DIR", "HERMES_HOME", "OPENCLAW_HOME", "OPENCLAW_STATE_DIR", "OPENCLAW_CONFIG_PATH",
+  "FACTORY_HOME_OVERRIDE", "GOOSE_PATH_ROOT",
+];
+let saved: Record<string, string | undefined>;
+let home: string;
+beforeEach(() => {
+  saved = Object.fromEntries(ENV.map((k) => [k, process.env[k]]));
+  for (const k of ENV) delete process.env[k];
+  home = mkdtempSync(join(tmpdir(), "fpai-skill-"));
+  process.env.HOME = home;
+  process.env.FAILPROOFAI_HOME = join(home, ".failproofai");
+});
+afterEach(() => {
+  for (const k of ENV) {
+    if (saved[k] === undefined) delete process.env[k];
+    else process.env[k] = saved[k];
+  }
+  rmSync(home, { recursive: true, force: true });
+});
+
+const rel = (paths: string[]) => paths.map((p) => relative(home, p));
+const skillFile = (root: string) => join(root, AGENT_SKILL_NAME, "SKILL.md");
+
+describe("agentSkillRoots", () => {
+  it("is each agent's own user folder, as verified against each CLI", () => {
+    expect(Object.fromEntries(INTEGRATION_TYPES.map((id) => [id, rel(agentSkillRoots(id))]))).toEqual({
+      claude: [".claude/skills"],
+      codex: [".codex/skills"],
+      copilot: [".copilot/skills"],
+      cursor: [".cursor/skills"],
+      opencode: [".config/opencode/skills"],
+      pi: [".pi/agent/skills"],
+      hermes: [".hermes/skills"],
+      openclaw: [".openclaw/skills"],
+      factory: [".factory/skills"],
+      devin: [".config/devin/skills"],
+      antigravity: [".gemini/config/skills"],
+      goose: [".config/goose/skills"],
+    });
+  });
+
+  it("follows each agent's own override", () => {
+    const at = (name: string) => join(home, "moved", name);
+    Object.assign(process.env, {
+      CLAUDE_CONFIG_DIR: at("claude"), CODEX_HOME: at("codex"), COPILOT_HOME: at("copilot"),
+      XDG_CONFIG_HOME: at("xdg"), PI_CODING_AGENT_DIR: at("pi"), FACTORY_HOME_OVERRIDE: at("factory"),
+    });
+    expect(rel(["claude", "codex", "copilot", "opencode", "pi", "factory", "devin", "goose"].flatMap((id) =>
+      agentSkillRoots(id as never)))).toEqual([
+      "moved/claude/skills", "moved/codex/skills", "moved/copilot/skills", "moved/xdg/opencode/skills",
+      "moved/pi/skills", "moved/factory/.factory/skills", "moved/xdg/devin/skills", "moved/xdg/goose/skills",
+    ]);
+    process.env.GOOSE_PATH_ROOT = at("goose");
+    expect(rel(agentSkillRoots("goose"))).toEqual(["moved/goose/config/skills"]);
+  });
+
+  it("covers every Hermes and OpenClaw profile, since each reads only its own", () => {
+    mkdirSync(join(home, ".hermes", "profiles", "work"), { recursive: true });
+    mkdirSync(join(home, ".openclaw-work"), { recursive: true });
+    writeFileSync(join(home, ".openclaw-work", "openclaw.json"), "{}");
+    expect(rel(agentSkillRoots("hermes"))).toEqual([".hermes/skills", ".hermes/profiles/work/skills"]);
+    expect(rel(agentSkillRoots("openclaw"))).toEqual([".openclaw/skills", ".openclaw-work/skills"]);
+  });
+
+  it("never uses the shared ~/.agents/skills", () => {
+    const all = INTEGRATION_TYPES.flatMap((id) => rel(agentSkillRoots(id)));
+    expect(all.filter((p) => p.startsWith(".agents"))).toEqual([]);
+  });
+});
+
+describe("the skill file", () => {
+  const front = /^---\nname: (.+)\ndescription: (.+)\n---\n/.exec(AGENT_SKILL_MD);
+
+  it("names the folder it sits in, with a description every agent shows enough of", () => {
+    expect(front?.[1]).toBe(AGENT_SKILL_NAME);
+    const description = front![2]!;
+    // Copilot drops a skill over 1024; droid shows the model 200, Hermes 57.
+    expect(description.length).toBeLessThanOrEqual(200);
+    expect(description.slice(0, 57)).toMatch(/^FailproofAI hooks, policies/);
+  });
+
+  it("points at the umbrella skill and its siblings online", () => {
+    const base = "https://raw.githubusercontent.com/FailproofAI/skills/main/skills";
+    for (const name of ["failproofai", "failproofai-policy-author", "failproofai-policy-publish", "fp-cloud-cli", "failproofai-sdk", "failproofai-eval-brainstorm"]) {
+      expect(AGENT_SKILL_MD).toContain(`${base}/${name}/SKILL.md`);
+    }
+  });
+});
+
+describe("installAgentSkill", () => {
+  it("writes the skill and its marker into each agent's folder", () => {
+    expect(installAgentSkill(["claude", "goose"])).toEqual(["claude", "goose"]);
+    for (const id of ["claude", "goose"] as const) {
+      const [root] = agentSkillRoots(id);
+      expect(readFileSync(skillFile(root!), "utf8")).toBe(AGENT_SKILL_MD);
+      expect(existsSync(join(root!, AGENT_SKILL_NAME, AGENT_SKILL_MARKER))).toBe(true);
+    }
+    expect(existsSync(join(home, ".codex"))).toBe(false);
+  });
+
+  it("rewrites its own folder, and never touches a failproofai skill someone else put there", () => {
+    const [claude] = agentSkillRoots("claude");
+    const [codex] = agentSkillRoots("codex");
+    installAgentSkill(["claude"]);
+    writeFileSync(skillFile(claude!), "old");
+    mkdirSync(join(codex!, AGENT_SKILL_NAME), { recursive: true });
+    writeFileSync(skillFile(codex!), "the full skill, from npx skills");
+
+    expect(installAgentSkill(["claude", "codex"])).toEqual(["claude"]);
+    expect(readFileSync(skillFile(claude!), "utf8")).toBe(AGENT_SKILL_MD);
+    expect(readFileSync(skillFile(codex!), "utf8")).toBe("the full skill, from npx skills");
+  });
+
+  it("leaves Codex to a failproofai skill in ~/.agents/skills, which Codex would list beside ours", () => {
+    const npx = join(home, ".agents", "skills", AGENT_SKILL_NAME);
+    mkdirSync(npx, { recursive: true });
+    writeFileSync(join(npx, "SKILL.md"), "the full skill, from npx skills -g");
+    process.env.CODEX_HOME = join(home, "moved-codex"); // ~/.agents stays under HOME regardless
+
+    expect(installAgentSkill(["codex", "claude"])).toEqual(["claude"]);
+    expect(existsSync(join(home, "moved-codex", "skills", AGENT_SKILL_NAME))).toBe(false);
+    expect(readFileSync(join(npx, "SKILL.md"), "utf8")).toBe("the full skill, from npx skills -g");
+  });
+
+  it("takes back its own Codex copy once ~/.agents/skills has one", () => {
+    const [codex] = agentSkillRoots("codex");
+    installAgentSkill(["codex"]);
+    expect(existsSync(skillFile(codex!))).toBe(true);
+    mkdirSync(join(home, ".agents", "skills", AGENT_SKILL_NAME), { recursive: true });
+
+    expect(installAgentSkill(["codex"])).toEqual([]);
+    expect(existsSync(join(codex!, AGENT_SKILL_NAME))).toBe(false);
+  });
+
+  it("carries on when its old Codex copy can't be taken back", () => {
+    const [codex] = agentSkillRoots("codex");
+    installAgentSkill(["codex"]);
+    mkdirSync(join(home, ".agents", "skills", AGENT_SKILL_NAME), { recursive: true });
+    chmodSync(codex!, 0o555); // the copy inside can't be deleted (except by root)
+    try {
+      expect(() => installAgentSkill(["codex", "claude"])).not.toThrow();
+      expect(existsSync(skillFile(agentSkillRoots("claude")[0]!))).toBe(true);
+    } finally {
+      chmodSync(codex!, 0o755);
+    }
+  });
+
+  it("skips a folder it cannot write without failing the rest", () => {
+    writeFileSync(join(home, ".codex"), "a file where the folder would go");
+    expect(installAgentSkill(["codex", "claude"])).toEqual(["claude"]);
+  });
+
+  it("writes every Hermes profile", () => {
+    mkdirSync(join(home, ".hermes", "profiles", "work"), { recursive: true });
+    installAgentSkill(["hermes"]);
+    for (const root of agentSkillRoots("hermes")) expect(existsSync(skillFile(root))).toBe(true);
+  });
+});
+
+describe("removeAgentSkill", () => {
+  it("removes only the folders failproofai wrote", () => {
+    installAgentSkill(["claude", "cursor"]);
+    const [codex] = agentSkillRoots("codex");
+    mkdirSync(join(codex!, AGENT_SKILL_NAME), { recursive: true });
+    writeFileSync(skillFile(codex!), "someone else's");
+
+    expect(rel(installedAgentSkillDirs())).toEqual([".claude/skills/failproofai", ".cursor/skills/failproofai"]);
+    expect(rel(removeAgentSkill())).toEqual([".claude/skills/failproofai", ".cursor/skills/failproofai"]);
+    expect(installedAgentSkillDirs()).toEqual([]);
+    expect(existsSync(join(home, ".claude", "skills"))).toBe(true);
+    expect(readFileSync(skillFile(codex!), "utf8")).toBe("someone else's");
+  });
+});
diff --git a/__tests__/hooks/browser-login-prompt.test.ts b/__tests__/hooks/browser-login-prompt.test.ts
new file mode 100644
index 000000000..a0b0a4f3d
--- /dev/null
+++ b/__tests__/hooks/browser-login-prompt.test.ts
@@ -0,0 +1,233 @@
+import { describe, it, expect, vi } from "vitest";
+import { PassThrough } from "node:stream";
+import {
+  BACK,
+  promptBrowserLogin,
+  type BrowserLoginOptions,
+  type BrowserLoginPoll,
+  type BrowserLoginStart,
+  type TTYIn,
+  type TTYOut,
+  slowedDown,
+} from "../../src/hooks/tui";
+
+// Driven through a real PassThrough so Node's own keypress parser runs, like
+// cloud-key-prompt.test.ts.
+function terminal(columns = 80) {
+  const written: string[] = [];
+  const stdout = {
+    isTTY: true,
+    columns,
+    write: (chunk: string) => {
+      written.push(String(chunk));
+      return true;
+    },
+  } as unknown as TTYOut;
+  const stdin = new PassThrough() as unknown as TTYIn & PassThrough;
+  (stdin as unknown as { isTTY: boolean }).isTTY = true;
+  (stdin as unknown as { setRawMode: (on: boolean) => void }).setRawMode = () => {};
+  const plain = () => written.join("").replace(/\x1b\[[0-9;?]*[A-Za-z]/g, "");
+  return { stdin, stdout, plain, raw: () => written.join(""), type: (s: string) => stdin.write(s) };
+}
+
+const tick = (ms = 0) => new Promise((r) => setTimeout(r, ms));
+const until = async (cond: () => boolean, ms = 2000) => {
+  const end = Date.now() + ms;
+  while (!cond()) {
+    if (Date.now() > end) throw new Error("condition not met in time");
+    await tick(5);
+  }
+};
+
+const LINK = `https://app.befailproof.ai/cli/authorize?r=${"a".repeat(64)}`;
+// A tiny interval keeps polling fast; the widget takes the server's number.
+const started = (url = LINK): BrowserLoginStart => ({ ok: true, url, expiresIn: 600, interval: 0.01 });
+
+function ask(
+  t: ReturnType<typeof terminal>,
+  polls: BrowserLoginPoll<string>[],
+  extra: Partial<BrowserLoginOptions<string>> = {},
+) {
+  const start = vi.fn(async (): Promise<BrowserLoginStart> => started());
+  const queue = [...polls];
+  const poll = vi.fn(async (): Promise<BrowserLoginPoll<string>> => queue.shift() ?? { state: "pending" });
+  const open = vi.fn(() => true);
+  const pending = promptBrowserLogin<string>({
+    message: "Connect to cloud",
+    meta: "app.befailproof.ai",
+    machineLabel: "sidd-laptop",
+    start,
+    poll,
+    open,
+    collapsed: (v) => ["CONNECT TO CLOUD", `logged in: ${v}`],
+    stdin: t.stdin,
+    stdout: t.stdout,
+    ...extra,
+  });
+  return { pending, start: (extra.start as typeof start) ?? start, poll: (extra.poll as typeof poll) ?? poll, open: (extra.open as typeof open) ?? open };
+}
+
+describe("promptBrowserLogin", () => {
+  it("prints the whole link above the live region, even when it is wider than the terminal", async () => {
+    const t = terminal(40);
+    const { pending, open } = ask(t, [{ state: "approved", value: "acme" }]);
+    expect(await pending).toEqual({ value: "acme" });
+    expect(open).toHaveBeenCalledWith(LINK);
+    const out = t.plain();
+    expect(out).toContain("CONNECT TO CLOUD  app.befailproof.ai");
+    expect(out).toContain(LINK);
+    expect(out).toContain("Opening your browser to connect sidd-laptop.");
+    expect(out).toContain("logged in: acme");
+  });
+
+  it("says to open the link anywhere when it cannot open a browser here", async () => {
+    const t = terminal();
+    const { pending } = ask(t, [{ state: "approved", value: "x" }], { open: vi.fn(() => false) });
+    await pending;
+    expect(t.plain()).toContain("Open this link in any browser to connect sidd-laptop:");
+  });
+
+  it("keeps polling while pending, then resolves the approval", async () => {
+    const t = terminal();
+    const { pending, poll } = ask(t, [{ state: "pending" }, { state: "pending" }, { state: "approved", value: "acme" }]);
+    expect(await pending).toEqual({ value: "acme" });
+    expect(poll).toHaveBeenCalledTimes(3);
+    expect(t.plain()).toContain("Waiting for you to authorize in the browser");
+  });
+
+  it("leaves for the other options on tab or esc, cancels on ctrl-c, and stops polling", async () => {
+    for (const [key, want] of [
+      ["\t", BACK],
+      ["\u001b", BACK],
+      ["\u0003", null],
+    ] as const) {
+      const t = terminal();
+      const { pending, poll } = ask(t, []);
+      await until(() => t.plain().includes("Waiting for you"));
+      t.type(key);
+      expect(await pending).toBe(want);
+      const calls = poll.mock.calls.length;
+      await tick(60);
+      expect(poll.mock.calls.length).toBe(calls);
+    }
+  });
+
+  it("offers a new link on enter once one expires", async () => {
+    const t = terminal();
+    const urls = [LINK, `${LINK}-second`];
+    const start = vi.fn(async (): Promise<BrowserLoginStart> => started(urls.shift()));
+    const { pending } = ask(t, [{ state: "expired" }, { state: "approved", value: "after-retry" }], { start });
+    await until(() => t.plain().includes("That link expired."));
+    expect(t.plain()).toContain("enter new link");
+    t.type("\r");
+    expect(await pending).toEqual({ value: "after-retry" });
+    expect(start).toHaveBeenCalledTimes(2);
+    expect(t.plain()).toContain(`${LINK}-second`);
+  });
+
+  it("takes the dead link off the screen when a retry prints a new one", async () => {
+    const t = terminal(40);
+    const urls = [LINK, `${LINK}-second`];
+    const start = vi.fn(async (): Promise<BrowserLoginStart> => started(urls.shift()));
+    const { pending } = ask(t, [{ state: "expired" }, { state: "approved", value: "v" }], { start, open: vi.fn(() => false) });
+    await until(() => t.plain().includes("That link expired."));
+    const before = t.raw().length;
+    t.type("\r");
+    expect(await pending).toEqual({ value: "v" });
+    const ups = t.raw().slice(before).match(/\x1b\[(\d+)A/g) ?? [];
+    // The first repaint after enter climbs over the old heading 1 + "Open this
+    // link…" 2 + link 3 + blank 1, and the 3-row expired region.
+    expect(Number(ups[0]!.slice(2, -1))).toBe(10);
+  });
+
+  it("calls a link expired by its own clock without waiting for the server to say so", async () => {
+    const t = terminal();
+    let clock = 1_000_000;
+    const { pending } = ask(t, [], { now: () => clock });
+    await until(() => t.plain().includes("Waiting for you"));
+    clock += 11 * 60 * 1000;
+    await until(() => t.plain().includes("That link expired."));
+    t.type("\u001b");
+    expect(await pending).toBe(BACK);
+  });
+
+  it("lets a refusal in the browser be retried", async () => {
+    const t = terminal();
+    const { pending, start } = ask(t, [{ state: "denied" }, { state: "approved", value: "second-go" }]);
+    await until(() => t.plain().includes("Not authorized in the browser."));
+    t.type("\r");
+    expect(await pending).toEqual({ value: "second-go" });
+    expect(start).toHaveBeenCalledTimes(2);
+  });
+
+  it("leaves at once for what cannot work, like an older server, without retrying", async () => {
+    const t = terminal();
+    const start = vi.fn(
+      async (): Promise<BrowserLoginStart> => ({ ok: false, retryable: false, line: "this server doesn't support it" }),
+    );
+    const { pending, poll } = ask(t, [], { start });
+    expect(await pending).toBe(BACK);
+    expect(start).toHaveBeenCalledTimes(1);
+    expect(poll).not.toHaveBeenCalled();
+  });
+
+  it("shows tab as the way to the other options while waiting", async () => {
+    const t = terminal();
+    const { pending } = ask(t, []);
+    await until(() => t.plain().includes("Waiting for you"));
+    expect(t.plain()).toContain("tab more options");
+    t.type("\t");
+    await pending;
+  });
+
+  it("counts what to erase at the width when leaving, after a resize", async () => {
+    const t = terminal(40);
+    const { pending } = ask(t, [], { open: vi.fn(() => false) });
+    await until(() => t.plain().includes("Waiting for you"));
+    // Widened meanwhile: a reflowing terminal now shows the link on one row.
+    (t.stdout as unknown as { columns: number }).columns = 200;
+    t.type("\t");
+    expect(await pending).toBe(BACK);
+    const ups = t.raw().match(/\x1b\[(\d+)A/g) ?? [];
+    // Heading, "Open this link…", link, blank — one row each now — and the 3-row region.
+    expect(Number(ups.at(-1)!.slice(2, -1))).toBe(7);
+  });
+
+  it("slows down when asked, and never speeds up", () => {
+    expect(slowedDown(2)).toBe(4);
+    expect(slowedDown(9)).toBe(10);
+    expect(slowedDown(15)).toBe(15);
+  });
+
+  it("takes the printed link with it when leaving, wrapped rows included", async () => {
+    // 40 columns: the 107-character link wraps onto three rows.
+    const t = terminal(40);
+    const { pending } = ask(t, [], { open: vi.fn(() => false) });
+    await until(() => t.plain().includes("Waiting for you"));
+    t.type("\t");
+    expect(await pending).toBe(BACK);
+    const ups = t.raw().match(/\x1b\[(\d+)A/g) ?? [];
+    const last = Number(ups.at(-1)!.slice(2, -1));
+    // Heading 1 + "Open this link…" 2 + link 3 + blank 1, and the 3-row waiting region.
+    expect(last).toBe(10);
+  });
+
+  it("keeps going through a dropped connection, and says so", async () => {
+    const t = terminal();
+    const { pending } = ask(t, [
+      { state: "unreachable", line: "offline" },
+      { state: "pending" },
+      { state: "approved", value: "back-online" },
+    ]);
+    expect(await pending).toEqual({ value: "back-online" });
+    expect(t.plain()).toContain("Can't reach the server right now (offline) — still trying.");
+  });
+
+  it("answers null without a terminal instead of hanging on a pipe", async () => {
+    const t = terminal();
+    (t.stdin as unknown as { isTTY: boolean }).isTTY = false;
+    const { pending, start } = ask(t, []);
+    expect(await pending).toBeNull();
+    expect(start).not.toHaveBeenCalled();
+  });
+});
diff --git a/__tests__/hooks/cloud-login.test.ts b/__tests__/hooks/cloud-login.test.ts
new file mode 100644
index 000000000..972956760
--- /dev/null
+++ b/__tests__/hooks/cloud-login.test.ts
@@ -0,0 +1,254 @@
+import { describe, it, expect, vi } from "vitest";
+import {
+  claimLogin,
+  displayText,
+  isOpenableUrl,
+  LOGIN_CLAIM_PATH,
+  LOGIN_POLL_PATH,
+  LOGIN_START_PATH,
+  machineOs,
+  pollLogin,
+  startLogin,
+} from "../../src/hooks/cloud-login";
+import { canOpenBrowser } from "../../src/audit/open-browser";
+
+const ORIGIN = "https://app.befailproof.ai";
+const MACHINE = { label: "box", os: "linux", cliVersion: "1.0.12" };
+
+/** A fetch answering one status and body, recording what it was asked. */
+function fetchOf(status: number, body: unknown, headers: Record<string, string> = {}) {
+  return vi.fn(async (_url: string | URL | Request, _init?: RequestInit) =>
+    new Response(typeof body === "string" ? body : JSON.stringify(body), { status, headers }),
+  );
+}
+
+describe("startLogin", () => {
+  it("returns the link and the poll secret, and sends the machine", async () => {
+    const f = fetchOf(201, {
+      verification_url: `${ORIGIN}/cli/authorize?r=abc`,
+      poll_secret: "secret",
+      expires_in: 600,
+      interval: 2,
+    });
+    const r = await startLogin(ORIGIN + "/", MACHINE, f as unknown as typeof fetch);
+    expect(r).toEqual({
+      kind: "ok",
+      verificationUrl: `${ORIGIN}/cli/authorize?r=abc`,
+      pollSecret: "secret",
+      expiresIn: 600,
+      interval: 2,
+    });
+    const [url, init] = f.mock.calls[0]!;
+    expect(url).toBe(`${ORIGIN}${LOGIN_START_PATH}`);
+    expect(init?.redirect).toBe("manual");
+    expect(JSON.parse(String(init?.body))).toEqual({ machine_label: "box", machine_os: "linux", cli_version: "1.0.12" });
+  });
+
+  it("calls an older cloud unsupported, whether it 404s or redirects to a login page", async () => {
+    expect(await startLogin(ORIGIN, MACHINE, fetchOf(404, "") as unknown as typeof fetch)).toEqual({ kind: "unsupported" });
+    expect(
+      await startLogin(ORIGIN, MACHINE, fetchOf(307, "", { location: "/login" }) as unknown as typeof fetch),
+    ).toEqual({ kind: "unsupported" });
+    // A 201 that is not this API.
+    expect(await startLogin(ORIGIN, MACHINE, fetchOf(201, { hello: "world" }) as unknown as typeof fetch)).toEqual({
+      kind: "unsupported",
+    });
+    // The web app serving its login page in the route's place.
+    expect(
+      await startLogin(ORIGIN, MACHINE, fetchOf(200, "<!doctype html><title>sign in</title>", { "content-type": "text/html" }) as unknown as typeof fetch),
+    ).toEqual({ kind: "unsupported" });
+  });
+
+  it("never hands a non-http link to the browser opener", async () => {
+    for (const verification_url of ["javascript:alert(1)", "file:///etc/passwd", "not a url"]) {
+      const f = fetchOf(201, { verification_url, poll_secret: "s", expires_in: 600, interval: 2 });
+      expect(await startLogin(ORIGIN, MACHINE, f as unknown as typeof fetch)).toEqual({ kind: "unsupported" });
+    }
+    expect(isOpenableUrl("https://x.test/a")).toBe(true);
+    expect(isOpenableUrl("http://localhost:3000/a")).toBe(true);
+    expect(isOpenableUrl("ftp://x.test")).toBe(false);
+  });
+
+  it("tells a rate limit, a refusal and an outage apart", async () => {
+    expect((await startLogin(ORIGIN, MACHINE, fetchOf(429, {}) as unknown as typeof fetch)).kind).toBe("refused");
+    expect(
+      await startLogin(ORIGIN, MACHINE, fetchOf(422, { error: "machine_label_required" }) as unknown as typeof fetch),
+    ).toEqual({ kind: "refused", reason: "machine_label_required" });
+    expect(await startLogin(ORIGIN, MACHINE, fetchOf(502, "<html>") as unknown as typeof fetch)).toEqual({
+      kind: "unreachable",
+      reason: "the server answered 502",
+    });
+    const down = vi.fn(async () => {
+      throw new TypeError("fetch failed");
+    });
+    expect(await startLogin(ORIGIN, MACHINE, down as unknown as typeof fetch)).toEqual({
+      kind: "unreachable",
+      reason: "fetch failed",
+    });
+  });
+});
+
+describe("pollLogin", () => {
+  it("reads every state the server can answer", async () => {
+    const poll = (body: unknown, status = 200) => pollLogin(ORIGIN, "s", fetchOf(status, body) as unknown as typeof fetch);
+    expect(await poll({ status: "pending", interval: 2 })).toEqual({ kind: "pending", interval: 2 });
+    expect(await poll({ status: "slow_down", interval: 2 })).toEqual({ kind: "slow_down" });
+    expect(await poll({ status: "denied" })).toEqual({ kind: "denied" });
+    expect(await poll({ status: "expired" })).toEqual({ kind: "expired" });
+    expect(await poll({ status: "claimed" })).toEqual({ kind: "claimed" });
+    expect(await poll({ status: "unknown" }, 404)).toEqual({ kind: "unknown" });
+    expect(
+      await poll({
+        status: "approved",
+        org: { id: "o1", slug: "acme", name: "Acme" },
+        approved_by: "ada@acme.test",
+        key_name: "failproofai · box",
+        permissions: ["events:add", "policies:pull", 7],
+      }),
+    ).toEqual({
+      kind: "approved",
+      org: { id: "o1", slug: "acme", name: "Acme" },
+      approvedBy: "ada@acme.test",
+      keyName: "failproofai · box",
+      permissions: ["events:add", "policies:pull"],
+    });
+    expect((await poll("<html>", 500)).kind).toBe("unreachable");
+  });
+
+  it("posts the poll secret, and only that", async () => {
+    const f = fetchOf(200, { status: "pending" });
+    await pollLogin(ORIGIN, "the-secret", f as unknown as typeof fetch);
+    const [url, init] = f.mock.calls[0]!;
+    expect(url).toBe(`${ORIGIN}${LOGIN_POLL_PATH}`);
+    expect(JSON.parse(String(init?.body))).toEqual({ poll_secret: "the-secret" });
+  });
+});
+
+describe("claimLogin", () => {
+  it("returns the key once minted", async () => {
+    const f = fetchOf(201, {
+      api_key: "k".repeat(64),
+      key_id: "kid",
+      key_name: "failproofai · box",
+      permissions: ["events:add"],
+      org: { slug: "acme", name: "Acme" },
+      approved_by: "ada@acme.test",
+    });
+    const r = await claimLogin(ORIGIN, "s", f as unknown as typeof fetch);
+    expect(r).toMatchObject({ kind: "ok", key: "k".repeat(64), keyName: "failproofai · box", approvedBy: "ada@acme.test" });
+    expect(f.mock.calls[0]![0]).toBe(`${ORIGIN}${LOGIN_CLAIM_PATH}`);
+  });
+
+  it("names why a key could not be created", async () => {
+    const claim = (status: number, body: unknown) => claimLogin(ORIGIN, "s", fetchOf(status, body) as unknown as typeof fetch);
+    expect(await claim(410, { error: "not_actionable", status: "expired" })).toEqual({ kind: "expired" });
+    expect(await claim(403, { error: "approval_revoked" })).toEqual({ kind: "revoked" });
+    expect(await claim(409, { error: "not_actionable", status: "claimed" })).toEqual({
+      kind: "refused",
+      reason: "the login request is claimed",
+    });
+    expect((await claim(503, "")).kind).toBe("unreachable");
+    expect(await claim(201, { key_id: "no secret" })).toEqual({ kind: "refused", reason: "the server answered without a key" });
+  });
+});
+
+describe("what the server says, as the terminal prints it", () => {
+  const ESCAPES = "\u001b]0;pwned\u0007\u001b[2J\u001b[31mEvil\u001b[0m\u202eCo\u200b";
+
+  it("strips controls, bidi overrides and zero-width characters", () => {
+    expect(displayText(ESCAPES)).toBe("]0;pwned[2J[31mEvil[0mCo");
+    expect(displayText("\u0007\u202e ")).toBeUndefined();
+    expect(displayText(42)).toBeUndefined();
+  });
+
+  it("never passes an org, approver or key name through raw", async () => {
+    const approved = await pollLogin(
+      ORIGIN,
+      "s",
+      fetchOf(200, {
+        status: "approved",
+        org: { id: "o1", slug: "evil\u001b[2J", name: ESCAPES },
+        approved_by: "x@y.test\u001b]52;c;Zm9v\u0007",
+        key_name: "failproofai \u00b7 box\u202e",
+        permissions: ["events:add\u001b[1m"],
+      }) as unknown as typeof fetch,
+    );
+    expect(JSON.stringify(approved)).not.toMatch(/[\u0000-\u001f\u202e\u200b]/);
+    expect(approved).toMatchObject({
+      org: { slug: "evil[2J", name: "]0;pwned[2J[31mEvil[0mCo" },
+      approvedBy: "x@y.test]52;c;Zm9v",
+      keyName: "failproofai \u00b7 box",
+      permissions: ["events:add[1m"],
+    });
+
+    const claimed = await claimLogin(
+      ORIGIN,
+      "s",
+      fetchOf(201, { api_key: "k".repeat(64), org: { name: ESCAPES }, approved_by: "\u001b[2Ja@b.c" }) as unknown as typeof fetch,
+    );
+    expect(JSON.stringify({ ...claimed, key: undefined })).not.toMatch(/[\u0000-\u001f\u202e\u200b]/);
+
+    const refused = await startLogin(ORIGIN, MACHINE, fetchOf(400, { error: "nope\u001b[2J" }) as unknown as typeof fetch);
+    expect(refused).toEqual({ kind: "refused", reason: "nope[2J" });
+  });
+
+  it("prints the link as the URL parser serialises it, controls encoded", async () => {
+    const r = await startLogin(
+      ORIGIN,
+      MACHINE,
+      fetchOf(201, {
+        verification_url: `${ORIGIN}/cli/authorize?r=abc\u001b]52;c;x\u0007&x=\u202e`,
+        poll_secret: "s",
+      }) as unknown as typeof fetch,
+    );
+    expect(r.kind).toBe("ok");
+    const url = (r as { verificationUrl: string }).verificationUrl;
+    expect(url).not.toMatch(/[\u0000-\u001f\u007f-\uffff]/);
+    expect(url).toContain("%1B");
+  });
+
+  it("keeps the server's poll interval and expiry to a range it can live with", async () => {
+    const huge = await startLogin(
+      ORIGIN,
+      MACHINE,
+      fetchOf(201, { verification_url: `${ORIGIN}/cli/authorize?r=a`, poll_secret: "s", expires_in: 1e12, interval: 3e9 }) as unknown as typeof fetch,
+    );
+    expect(huge).toMatchObject({ expiresIn: 3600, interval: 30 });
+    const tiny = await startLogin(
+      ORIGIN,
+      MACHINE,
+      fetchOf(201, { verification_url: `${ORIGIN}/cli/authorize?r=a`, poll_secret: "s", expires_in: 1, interval: 0.001 }) as unknown as typeof fetch,
+    );
+    expect(tiny).toMatchObject({ expiresIn: 30, interval: 1 });
+    const pending = await pollLogin(ORIGIN, "s", fetchOf(200, { status: "pending", interval: 3e9 }) as unknown as typeof fetch);
+    expect(pending).toEqual({ kind: "pending", interval: 30 });
+  });
+});
+
+describe("machineOs", () => {
+  it("names the OS the way the page shows it", () => {
+    expect(machineOs("darwin")).toBe("macOS");
+    expect(machineOs("linux")).toBe("linux");
+    expect(machineOs("win32")).toBe("windows");
+  });
+});
+
+// Next's types make NODE_ENV required on ProcessEnv; these are plain maps.
+const env = (vars: Record<string, string>) => vars as unknown as NodeJS.ProcessEnv;
+
+describe("canOpenBrowser", () => {
+  it("is false over SSH, whatever the display says", () => {
+    for (const key of ["SSH_CONNECTION", "SSH_CLIENT", "SSH_TTY"]) {
+      expect(canOpenBrowser(env({ [key]: "1", DISPLAY: ":0" }), "linux")).toBe(false);
+      expect(canOpenBrowser(env({ [key]: "1" }), "darwin")).toBe(false);
+    }
+  });
+  it("is false on a Linux box with no display at all", () => {
+    expect(canOpenBrowser(env({}), "linux")).toBe(false);
+    expect(canOpenBrowser(env({ DISPLAY: ":0" }), "linux")).toBe(true);
+    expect(canOpenBrowser(env({ WAYLAND_DISPLAY: "wayland-0" }), "linux")).toBe(true);
+  });
+  it("is true on a Mac at its own keyboard", () => {
+    expect(canOpenBrowser(env({}), "darwin")).toBe(true);
+  });
+});
diff --git a/__tests__/hooks/cloud-reconnect.test.ts b/__tests__/hooks/cloud-reconnect.test.ts
index b0ef5951b..e1425aa24 100644
--- a/__tests__/hooks/cloud-reconnect.test.ts
+++ b/__tests__/hooks/cloud-reconnect.test.ts
@@ -53,6 +53,20 @@ function connect(permissions: string[] | null, over: Partial<ConnectInput> = {})
   });
 }
 
+describe("the org a key reports into", () => {
+  it("is taken from the caller when introspect can't answer", async () => {
+    const result = await connect(null, { org: { id: "B", slug: "beta", name: "Beta" } });
+    expect(readCredentials().org).toMatchObject({ id: "B", slug: "beta", name: "Beta" });
+    expect(result.org).toEqual({ id: "B", slug: "beta", name: "Beta" });
+    expect(result.changes?.join("\n")).toContain("Switched from A to Beta");
+  });
+
+  it("is introspect's answer when there is one", async () => {
+    await connect(["events:add", "policies:pull"], { org: { id: "B", name: "Beta" } });
+    expect(readCredentials().org?.id).toBe("A");
+  });
+});
+
 describe("replacement credentials", () => {
   it("collector-only removes previous policy and Jev keys and active policies", async () => {
     mkdirSync(cloudPoliciesDir(), { recursive: true });
diff --git a/__tests__/hooks/configure-wizard.test.ts b/__tests__/hooks/configure-wizard.test.ts
index 5dad990dc..a883664b3 100644
--- a/__tests__/hooks/configure-wizard.test.ts
+++ b/__tests__/hooks/configure-wizard.test.ts
@@ -16,8 +16,19 @@ vi.mock("../../src/hooks/tui", async (importOriginal) => {
     multiSelect: vi.fn(),
     promptText: vi.fn(),
     promptCloudKey: vi.fn(),
+    promptBrowserLogin: vi.fn(),
   };
 });
+// The browser login's HTTP calls, and the opener — no test may ever start a
+// real browser or reach a real cloud.
+vi.mock("../../src/hooks/cloud-login", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../../src/hooks/cloud-login")>();
+  return { ...actual, startLogin: vi.fn(), pollLogin: vi.fn(), claimLogin: vi.fn() };
+});
+vi.mock("../../src/audit/open-browser", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../../src/audit/open-browser")>();
+  return { ...actual, openUrl: vi.fn(), canOpenBrowser: vi.fn(() => true) };
+});
 vi.mock("../../src/hooks/manager", () => ({
   installHooks: vi.fn(async () => {}),
   notEnforcingReason: vi.fn(() => "no-policies"),
@@ -90,22 +101,31 @@ vi.mock("../../src/hooks/integrations", async (importOriginal) => {
   const actual = await importOriginal<typeof import("../../src/hooks/integrations")>();
   return { ...actual, detectInstalledClis: vi.fn(() => ["claude"]) };
 });
+// Agents' skill folders can sit outside HOME (CLAUDE_CONFIG_DIR, XDG_CONFIG_HOME…),
+// so no wizard test writes one; agent-skill.test.ts covers the writing.
+vi.mock("../../src/hooks/agent-skill", () => ({ installAgentSkill: vi.fn((ids: string[]) => ids) }));
 
 import {
+  BACK,
   multiSelect,
   selectOne,
+  promptBrowserLogin,
   promptCloudKey,
   OPEN_SOURCE,
   paint,
   screenKit,
   type CloudKeyAnswer,
+  type BrowserLoginOptions,
   type CloudKeyPromptOptions,
   type MultiSelectOptions,
+  type SelectOneOptions,
   type OpenSource,
   type TTYIn,
   type TTYOut,
 } from "../../src/hooks/tui";
 import { connectToCloud } from "../../src/hooks/cloud-connection";
+import { claimLogin, pollLogin, startLogin } from "../../src/hooks/cloud-login";
+import { canOpenBrowser, openUrl } from "../../src/audit/open-browser";
 import * as otelCli from "../../src/hooks/otel-cli";
 import { validateIngestKey, writeIngestCredential, writeCollectorSettings } from "../../src/hooks/collector-config";
 import { introspectKey } from "../../src/hooks/cloud-introspect";
@@ -148,6 +168,7 @@ import { trackHookEvent } from "../../src/hooks/hook-telemetry";
 import { configFile as fpConfigFile, credentialsFile, launcherMarker } from "../../src/hooks/fp-home";
 import { readConfig as readFpConfig, updateConfig } from "../../src/hooks/fp-config";
 import { backfillRequestPath } from "../../src/hooks/backfill-request";
+import { installAgentSkill } from "../../src/hooks/agent-skill";
 
 it("savedConnection flags split keys instead of treating either as the saved connection", () => {
   mkdirSync(dirname(credentialsFile()), { recursive: true });
@@ -170,15 +191,41 @@ const printed = (stdout: TTYOut): string =>
   vi.mocked(stdout.write).mock.calls.map((c) => String(c[0])).join("").replace(/\x1b\[[0-9;?]*[A-Za-z]|\x1b[78]/g, "");
 
 /**
- * Queue answers for a run BY NAME. Two prompts are left: the cloud-key field
- * and the agents picker. Without an answer queued, the cloud step takes Tab
- * (open source) and the picker takes Enter on whatever it opened with.
+ * The CONNECT menu's next answer, or `undefined` for its default. The default is
+ * what Tab used to mean on the old single key field: open source on a fresh
+ * machine, leave the saved connection alone on a connected one.
+ */
+type ConnectPick = "login" | "key" | "oss" | "keep";
+let connectPick: ConnectPick | null | undefined;
+
+/**
+ * Queue answers for a run BY NAME. The prompts left are the CONNECT step and
+ * the agents picker. `cloud` is still phrased as the key field's answer —
+ * Tab, a typed key, the saved key, or Esc — and is routed through the CONNECT
+ * menu the way a person would reach it. On a machine with no working
+ * connection the browser login starts by itself first; unless a test says
+ * otherwise the person presses Tab there, which opens that menu. Without an
+ * answer queued, the cloud step takes the menu's default and the picker takes
+ * Enter on whatever it opened with.
  */
 function drive(answers: { cloud?: CloudKeyAnswer | OpenSource | null; agents?: IntegrationType[] | null }) {
-  if ("cloud" in answers) vi.mocked(promptCloudKey).mockResolvedValueOnce(answers.cloud as never);
+  if ("cloud" in answers) {
+    const cloud = answers.cloud;
+    if (cloud === null || cloud === undefined) connectPick = null;
+    else if (cloud === OPEN_SOURCE) connectPick = undefined;
+    else if (cloud.kind === "saved") connectPick = "keep";
+    else {
+      connectPick = "key";
+      vi.mocked(promptCloudKey).mockResolvedValueOnce(cloud as never);
+    }
+  }
   if ("agents" in answers) vi.mocked(multiSelect).mockResolvedValueOnce(answers.agents as never);
 }
 const cloudOpts = (): CloudKeyPromptOptions => vi.mocked(promptCloudKey).mock.calls[0]![0];
+/** The CONNECT menu as last drawn. */
+const connectMenu = () =>
+  vi.mocked(selectOne).mock.calls.map((c) => c[0] as unknown as SelectOneOptions<string>).filter((o) => o.message === "Connect to cloud").at(-1)!;
+const menuValues = () => connectMenu().choices.map((c) => c.value);
 const agentOpts = (): MultiSelectOptions<IntegrationType> =>
   vi.mocked(multiSelect).mock.calls[0]![0] as unknown as MultiSelectOptions<IntegrationType>;
 
@@ -218,6 +265,8 @@ beforeEach(() => {
   rmSync(launcherMarker(fileHome), { force: true });
   delete process.env.FAILPROOFAI_CLOUD_URL;
   vi.mocked(promptCloudKey).mockReset().mockResolvedValue(OPEN_SOURCE);
+  // Tab at the login that starts by itself: on to the menu.
+  vi.mocked(promptBrowserLogin).mockReset().mockResolvedValue(BACK as never);
   vi.mocked(multiSelect)
     .mockReset()
     .mockImplementation(async (opts) => opts.choices.filter((c) => c.checked).map((c) => c.value) as never);
@@ -225,6 +274,7 @@ beforeEach(() => {
   vi.mocked(runPostSetupAudit).mockClear();
   vi.mocked(trackHookEvent).mockClear();
   vi.mocked(detectInstalledClis).mockReset().mockReturnValue(["claude"]);
+  vi.mocked(installAgentSkill).mockReset().mockImplementation((ids) => [...ids]);
   vi.mocked(notEnforcingReason).mockReset().mockReturnValue("no-policies");
   vi.mocked(enforcingPolicyCount).mockReset().mockReturnValue({ count: 0, custom: false });
   vi.mocked(connectToCloud)
@@ -232,7 +282,20 @@ beforeEach(() => {
     .mockResolvedValue({ policy: { ok: true, policyCount: 2, deployment: 7 }, ingest: { ok: true }, anyConfigured: true });
   vi.mocked(validateIngestKey).mockReset().mockResolvedValue({ ok: true });
   vi.mocked(introspectKey).mockReset().mockResolvedValue({ kind: "unsupported" });
-  vi.mocked(selectOne).mockReset().mockResolvedValue(false);
+  connectPick = undefined;
+  // The CONNECT menu is answered from `connectPick`; every other selectOne
+  // keeps the old default.
+  vi.mocked(selectOne)
+    .mockReset()
+    .mockImplementation((async (opts: { message: string; choices: { value: unknown }[] }) => {
+      if (opts.message !== "Connect to cloud") return false;
+      if (connectPick !== undefined) {
+        const pick = connectPick;
+        connectPick = undefined;
+        return pick;
+      }
+      return opts.choices.some((c) => c.value === "keep") ? "keep" : "oss";
+    }) as never);
   // Healthy and already running is the default: the DAEMON step is one line
   // and needs no password. Daemon tests override these.
   vi.mocked(isDaemonSupportedPlatform).mockReset().mockReturnValue(true);
@@ -387,6 +450,13 @@ describe("cloud helpers", () => {
     expect(resolveCloudUrl("http://localhost:9911", undefined)).toMatchObject({ url: "http://localhost:9911", source: "--url" });
   });
 
+  it("checks a saved endpoint like a typed one: no plain http to a remote host", () => {
+    const r = resolveCloudUrl(undefined, "http://cloud.example.com");
+    expect(r.ok).toBe(false);
+    if (!r.ok) expect(r.message).toContain('the saved cloud address "http://cloud.example.com" cannot be used');
+    expect(resolveCloudUrl(undefined, "http://localhost:8080")).toEqual({ ok: true, url: "http://localhost:8080" });
+  });
+
   it("refuses an unusable override instead of falling back to hosted", () => {
     const r = resolveCloudUrl("http://cloud.example.com", undefined);
     expect(r.ok).toBe(false);
@@ -401,16 +471,23 @@ describe("cloud helpers", () => {
 
   it("accepts half a key with a note, and refuses one that can do neither", async () => {
     vi.mocked(introspectKey).mockResolvedValueOnce({ kind: "ok", identity: { permissions: ["events:add"] } });
-    expect(await checkCloudKey("u", "k")).toMatchObject({ ok: true, note: expect.stringContaining("policies:pull") });
+    expect(await checkCloudKey("https://x.example.com", "k")).toMatchObject({ ok: true, note: expect.stringContaining("policies:pull") });
     vi.mocked(introspectKey).mockResolvedValueOnce({ kind: "ok", identity: { permissions: ["jev:evaluate"] } });
-    expect(await checkCloudKey("u", "k")).toEqual({ ok: false, refused: true, reason: "it is missing the events:add permission" });
+    expect(await checkCloudKey("https://x.example.com", "k")).toEqual({ ok: false, refused: true, reason: "it is missing the events:add permission" });
   });
 
   it("tells a refusal from not being able to ask", async () => {
     vi.mocked(introspectKey).mockResolvedValueOnce({ kind: "rejected" });
-    expect(await checkCloudKey("u", "k")).toMatchObject({ ok: false, refused: true });
+    expect(await checkCloudKey("https://x.example.com", "k")).toMatchObject({ ok: false, refused: true });
     vi.mocked(introspectKey).mockResolvedValueOnce({ kind: "unreachable", reason: "ENOTFOUND" });
-    expect(await checkCloudKey("u", "k")).toEqual({ ok: false, refused: false, reason: "ENOTFOUND" });
+    expect(await checkCloudKey("https://x.example.com", "k")).toEqual({ ok: false, refused: false, reason: "ENOTFOUND" });
+  });
+
+  it("never sends a key to an address it would refuse as typed", async () => {
+    const r = await checkCloudKey("http://cloud.example.com", "k");
+    expect(r).toMatchObject({ ok: false, refused: false });
+    expect(introspectKey).not.toHaveBeenCalled();
+    expect(validateIngestKey).not.toHaveBeenCalled();
   });
 
   it("falls back to the ingest probe on a server too old for introspect", async () => {
@@ -418,7 +495,7 @@ describe("cloud helpers", () => {
     expect(await checkCloudKey("https://x.example.com", "k")).toMatchObject({ ok: false, refused: true });
     expect(vi.mocked(validateIngestKey).mock.calls[0]![0]).toEqual({ url: "https://x.example.com/v1/events", key: "k" });
     vi.mocked(validateIngestKey).mockResolvedValueOnce({ ok: false, reason: "could not reach the server (fetch failed)" });
-    expect(await checkCloudKey("u", "k")).toMatchObject({ ok: false, refused: false });
+    expect(await checkCloudKey("https://x.example.com", "k")).toMatchObject({ ok: false, refused: false });
   });
 
   it("collapses the CONNECT step to what was checked, never what was written", () => {
@@ -602,11 +679,12 @@ describe("removeUserScopeHooks", () => {
 // ── The run ──────────────────────────────────────────────────────────────────
 
 describe("runConfigureWizard", () => {
-  it("asks two things — the key, then the agents — and installs at user scope", async () => {
+  it("asks two things — how to connect, then the agents — and installs at user scope", async () => {
     const result = await runConfigureWizard(ttyIO());
 
     expect(result.applied).toBe(true);
-    expect(promptCloudKey).toHaveBeenCalledTimes(1);
+    expect(selectOne).toHaveBeenCalledTimes(1);
+    expect(connectMenu().message).toBe("Connect to cloud");
     expect(multiSelect).toHaveBeenCalledTimes(1);
     expect(agentOpts().message).toBe("Which agents should failproofai trace?");
     expect(installHooks).toHaveBeenCalledTimes(1);
@@ -617,6 +695,16 @@ describe("runConfigureWizard", () => {
     expect(call[8]).toEqual({ replace: true, quiet: true });
   });
 
+  it("adds the failproofai skill to every detected agent, and any ticked, traced or not", async () => {
+    vi.mocked(detectInstalledClis).mockReturnValue(["claude", "goose"]);
+    drive({ agents: ["goose", "codex"] });
+    const io = ttyIO();
+    await runConfigureWizard(io);
+    expect(installAgentSkill).toHaveBeenCalledWith(["claude", "codex", "goose"]);
+    // Silent: the summary is about enforcement and the connection.
+    expect(printed(io.stdout)).not.toContain("skill");
+  });
+
   it("saves the selection, and what it saw", async () => {
     vi.mocked(detectInstalledClis).mockReturnValue(["claude", "goose"]);
     drive({ agents: ["goose"] });
@@ -761,10 +849,21 @@ describe("headless runs", () => {
 });
 
 describe("connect step", () => {
-  it("draws the field with the host, and the saved key when there is one", async () => {
+  it("offers login first on a fresh machine, with the host in the heading", async () => {
+    await runConfigureWizard(ttyIO());
+    expect(connectMenu()).toMatchObject({ message: "Connect to cloud", meta: "app.befailproof.ai" });
+    expect(menuValues()).toEqual(["login", "key", "oss"]);
+    expect(connectMenu().choices[0]).toMatchObject({ label: "Log in to FailproofAI Cloud" });
+    expect(connectMenu().choices[0].hint).toContain("recommended");
+  });
+
+  it("opens the key field with tab as the way back, and no saved key in it", async () => {
+    connectPick = "key";
     await runConfigureWizard(ttyIO());
-    expect(cloudOpts()).toMatchObject({ message: "Connect to cloud", meta: "app.befailproof.ai", tabHint: "use open source instead" });
+    expect(cloudOpts()).toMatchObject({ message: "Connect to cloud", meta: "app.befailproof.ai", tabHint: "go back" });
     expect(cloudOpts().saved).toBeUndefined();
+    // Tab went back to the menu, which then took open source.
+    expect(vi.mocked(selectOne).mock.calls.filter((c) => (c[0] as { message: string }).message === "Connect to cloud")).toHaveLength(2);
   });
 
   it("connects a typed key at apply, with transcripts on", async () => {
@@ -792,7 +891,8 @@ describe("connect step", () => {
         const result = await runConfigureWizard(mode === "unattended" ? headlessIO() : ttyIO(),
           mode === "token" ? { token: "a-real-looking-key" } : mode === "oss" ? { oss: true } : {});
         expect(result.applied).toBe(true);
-        expect(selectOne).not.toHaveBeenCalled();
+        // The CONNECT menu is the only single-choice question setup asks.
+        expect(vi.mocked(selectOne).mock.calls.filter((c) => (c[0] as { message: string }).message !== "Connect to cloud")).toHaveLength(0);
         expect(enable).not.toHaveBeenCalled();
       } finally {
         enable.mockRestore();
@@ -802,6 +902,7 @@ describe("connect step", () => {
 
   it("checks a typed key without writing it, and reports a refusal", async () => {
     vi.mocked(validateIngestKey).mockResolvedValue({ ok: false, reason: "the server rejected that key (401)" });
+    connectPick = "key";
     await runConfigureWizard(ttyIO());
     expect(await cloudOpts().check("bad-key-123")).toEqual({
       ok: false,
@@ -814,30 +915,48 @@ describe("connect step", () => {
     writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
     drive({ cloud: { kind: "saved", verified: true } });
     const result = await runConfigureWizard(ttyIO());
-    expect(cloudOpts().saved?.masked).toBe("****3f2a");
-    expect(cloudOpts().tabHint).toBe("skip");
+    expect(menuValues()).toEqual(["keep", "login", "key"]);
+    expect(connectMenu().choices[0].hint).toContain("****3f2a");
+    expect(connectMenu().choices[1].label).toBe("Log in again");
+    expect(promptCloudKey).not.toHaveBeenCalled();
     expect(connectToCloud).not.toHaveBeenCalled();
     expect(result.mode).toBe("cloud");
     expect(readFpConfig().mode).toBe("cloud");
   });
 
-  it("checks the saved key in the background and says what it found", async () => {
+  it("checks the saved key first, and orders the menu by what it found", async () => {
     writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
+
+    // Works: keeping it is the default.
     await runConfigureWizard(ttyIO());
-    expect(await cloudOpts().saved!.check()).toEqual({ ok: true, line: "Your saved key works: ****3f2a" });
+    expect(menuValues()).toEqual(["keep", "login", "key"]);
+    expect(connectMenu().choices[0].hint).toContain("key ****3f2a");
+
+    // Refused: logging in again is the default, and says why.
     vi.mocked(validateIngestKey).mockResolvedValueOnce({ ok: false, reason: "the server rejected that key (401)" });
-    expect(await cloudOpts().saved!.check()).toEqual({ ok: false, line: "Your saved key no longer works: the server rejected that key (401)" });
+    connectPick = "keep";
+    await runConfigureWizard(ttyIO());
+    expect(menuValues()).toEqual(["login", "key", "keep"]);
+    expect(connectMenu().choices[0].hint).toBe("recommended · your saved key no longer works");
+    expect(connectMenu().choices[2].hint).toBe("its key no longer works");
+
+    // Offline: still keep first — a dropped connection is not a broken key.
     vi.mocked(validateIngestKey).mockResolvedValueOnce({ ok: false, reason: "could not reach the server (offline)" });
-    expect(await cloudOpts().saved!.check()).toMatchObject({ ok: false, usable: true });
+    await runConfigureWizard(ttyIO());
+    expect(menuValues()).toEqual(["keep", "login", "key"]);
+    expect(connectMenu().choices[0].hint).toBe("its key couldn't be checked just now");
   });
 
-  it("tab never disconnects a connected machine (decision D4)", async () => {
+  it("never disconnects a connected machine from this step (decision D4)", async () => {
     writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
-    const io = ttyIO();
-    const result = await runConfigureWizard(io);
+    vi.mocked(validateIngestKey).mockResolvedValueOnce({ ok: false, reason: "the server rejected that key (401)" });
+    const result = await runConfigureWizard(ttyIO());
+    // No "use open source" on a connected machine: `--disconnect` is the one way.
+    expect(menuValues()).not.toContain("oss");
     expect(result.mode).toBe("cloud");
     expect(connectToCloud).not.toHaveBeenCalled();
-    const collapsed = cloudOpts().collapsed!(OPEN_SOURCE).map((l) => l.replace(/\x1b\[[0-9;]*m/g, ""));
+    // Keeping a key that no longer works says so instead of claiming a connection.
+    const collapsed = connectMenu().collapsed!("keep").map((l) => l.replace(/\x1b\[[0-9;]*m/g, ""));
     expect(collapsed[1]).toBe("✓ Not connecting. The connection to app.befailproof.ai is unchanged.");
   });
 
@@ -859,9 +978,9 @@ describe("connect step", () => {
   it("refuses an unusable FAILPROOFAI_CLOUD_URL instead of falling back to hosted", async () => {
     process.env.FAILPROOFAI_CLOUD_URL = "http://cloud.example.com";
     const io = ttyIO();
-    drive({ cloud: OPEN_SOURCE });
+    connectPick = "key";
     const result = await runConfigureWizard(io);
-    // Said above the field, which stays open: a typed key is refused there,
+    // Said above the menu, which stays open: a typed key is refused there,
     // without anything being sent anywhere.
     expect(printed(io.stdout)).toContain('FAILPROOFAI_CLOUD_URL is set to "http://cloud.example.com", which cannot be used');
     const verdict = await cloudOpts().check!("a-real-looking-key");
@@ -1003,9 +1122,15 @@ describe("daemon step", () => {
     vi.mocked(daemonServiceStatus).mockReturnValue("not-installed");
     const order: string[] = [];
     vi.mocked(primeElevation).mockImplementation(() => (order.push("sudo"), true));
-    vi.mocked(promptCloudKey).mockImplementation(async () => (order.push("key"), OPEN_SOURCE));
+    const menu = vi.mocked(selectOne).getMockImplementation()!;
+    vi.mocked(selectOne).mockImplementation((async (opts: { message: string }) => {
+      if (opts.message === "Connect to cloud") order.push("connect");
+      return menu(opts as never);
+    }) as never);
     await runConfigureWizard(ttyIO());
-    expect(order).toEqual(["sudo", "key"]);
+    // The sudo prompt first, then the CONNECT menu. (canElevate is mocked
+    // true, so apply does not need to ask again.)
+    expect(order).toEqual(["sudo", "connect"]);
   });
 
   it("stops before writing anything when sudo cannot be had", async () => {
@@ -1298,3 +1423,370 @@ describe("first-run redirect", () => {
     expect(await maybeFirstRunConfigure(ttyIO())).toBe(false);
   });
 });
+
+describe("browser login", () => {
+  const approval = {
+    kind: "login" as const,
+    pollSecret: "poll-secret-1",
+    org: { id: "o1", slug: "acme", name: "Acme" },
+    approvedBy: "ada@acme.test",
+    keyName: "failproofai · box",
+    permissions: ["events:add", "policies:pull"],
+  };
+  const loginOpts = (): BrowserLoginOptions<typeof approval> =>
+    vi.mocked(promptBrowserLogin).mock.calls.at(-1)![0] as unknown as BrowserLoginOptions<typeof approval>;
+
+  beforeEach(() => {
+    vi.mocked(promptBrowserLogin).mockReset().mockResolvedValue({ value: approval } as never);
+    vi.mocked(startLogin).mockReset();
+    vi.mocked(pollLogin).mockReset();
+    vi.mocked(claimLogin)
+      .mockReset()
+      .mockResolvedValue({ kind: "ok", key: "minted-key", org: approval.org, permissions: approval.permissions, approvedBy: approval.approvedBy });
+    vi.mocked(openUrl).mockReset();
+    vi.mocked(canOpenBrowser).mockReset().mockReturnValue(true);
+  });
+
+  it("logs in, then claims the key at apply and connects with it", async () => {
+    connectPick = "login";
+    const io = ttyIO();
+    const result = await runConfigureWizard(io);
+    expect(result).toMatchObject({ applied: true, connected: true });
+    expect(claimLogin).toHaveBeenCalledWith("https://app.befailproof.ai", "poll-secret-1");
+    expect(vi.mocked(connectToCloud).mock.calls[0]![0]).toMatchObject({
+      url: "https://app.befailproof.ai",
+      token: "minted-key",
+      sessions: true,
+    });
+    // The screen collapses to who approved it and where — drawn by the login
+    // prompt, mocked here, so read from the lines it was handed.
+    const collapsed = loginOpts()
+      .collapsed(approval)
+      .map((l) => l.replace(/\x1b\[[0-9;]*m/g, ""));
+    expect(collapsed[1]).toBe("✓ Logged in as ada@acme.test · Acme (acme) on app.befailproof.ai");
+    expect(printed(io.stdout)).not.toContain("minted-key");
+  });
+
+  it("claims only after the daemon is in, so a failed install mints nothing", async () => {
+    vi.mocked(daemonServiceStatus).mockReturnValue("not-installed");
+    const order: string[] = [];
+    vi.mocked(installDaemonService).mockImplementation(async () => (order.push("install"), { installed: true }));
+    vi.mocked(claimLogin).mockImplementation(async () => {
+      order.push("claim");
+      return { kind: "ok", key: "minted-key", org: approval.org, permissions: [] };
+    });
+    connectPick = "login";
+    await runConfigureWizard(ttyIO());
+    expect(order).toEqual(["install", "claim"]);
+
+    vi.mocked(claimLogin).mockClear();
+    vi.mocked(installDaemonService).mockResolvedValue({ installed: false, reason: "systemd said no" });
+    connectPick = "login";
+    const failed = await runConfigureWizard(ttyIO());
+    expect(failed).toMatchObject({ applied: false, abort: "daemon_failed" });
+    expect(claimLogin).not.toHaveBeenCalled();
+  });
+
+  const connectMenus = () =>
+    vi.mocked(selectOne).mock.calls.filter((c) => (c[0] as { message: string }).message === "Connect to cloud");
+
+  it("starts the login by itself on a fresh machine, with no menu first", async () => {
+    const result = await runConfigureWizard(ttyIO());
+    expect(promptBrowserLogin).toHaveBeenCalledTimes(1);
+    expect(connectMenus()).toHaveLength(0);
+    expect(claimLogin).toHaveBeenCalledTimes(1);
+    expect(result).toMatchObject({ applied: true, connected: true });
+  });
+
+  it("opens the other options on tab at the login, and claims nothing", async () => {
+    vi.mocked(promptBrowserLogin).mockResolvedValueOnce(BACK as never);
+    connectPick = "oss";
+    const result = await runConfigureWizard(ttyIO());
+    expect(connectMenus()).toHaveLength(1);
+    expect(menuValues()).toEqual(["login", "key", "oss"]);
+    expect(result).toMatchObject({ applied: true, mode: "oss" });
+    expect(claimLogin).not.toHaveBeenCalled();
+  });
+
+  it("never starts a browser by itself on a machine connected with a working key", async () => {
+    writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
+    connectPick = "keep";
+    await runConfigureWizard(ttyIO());
+    expect(promptBrowserLogin).not.toHaveBeenCalled();
+    expect(menuValues()).toEqual(["keep", "login", "key"]);
+  });
+
+  it("starts the login by itself when the saved key is refused, and says why", async () => {
+    writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
+    vi.mocked(validateIngestKey).mockResolvedValueOnce({ ok: false, reason: "the server rejected that key (401)" });
+    const io = ttyIO();
+    await runConfigureWizard(io);
+    expect(promptBrowserLogin).toHaveBeenCalledTimes(1);
+    expect(connectMenus()).toHaveLength(0);
+    expect(printed(io.stdout)).toContain("Your saved key no longer works: the server rejected that key (401). Logging in again.");
+  });
+
+  it("drops an older cloud straight into the options, without login, and says why", async () => {
+    // As the screen does: a start that cannot work here leaves at once.
+    vi.mocked(promptBrowserLogin).mockImplementationOnce((async (opts: BrowserLoginOptions<unknown>) => {
+      const r = await opts.start();
+      return r.ok ? { value: approval } : BACK;
+    }) as never);
+    vi.mocked(startLogin).mockResolvedValueOnce({ kind: "unsupported" });
+    connectPick = "oss";
+    const io = ttyIO();
+    await runConfigureWizard(io);
+    expect(menuValues()).toEqual(["key", "oss"]);
+    expect(printed(io.stdout)).toContain("doesn't support logging in from here yet. Paste an API key instead.");
+  });
+
+  it("cancels the whole run on ctrl-c, writing nothing", async () => {
+    vi.mocked(promptBrowserLogin).mockResolvedValueOnce(null as never);
+    connectPick = "login";
+    const result = await runConfigureWizard(ttyIO());
+    expect(result).toEqual({ applied: false, abort: "cancelled" });
+    expect(claimLogin).not.toHaveBeenCalled();
+    expect(installHooks).not.toHaveBeenCalled();
+  });
+
+  it("finishes the rest of setup when the key can't be created, and says why", async () => {
+    vi.mocked(claimLogin).mockResolvedValue({ kind: "expired" });
+    connectPick = "login";
+    const io = ttyIO();
+    const result = await runConfigureWizard(io);
+    // A fresh machine: nothing to keep, so it is not reported as connected.
+    expect(result).toMatchObject({ applied: true, connected: false, mode: "oss" });
+    expect(connectToCloud).not.toHaveBeenCalled();
+    expect(installHooks).toHaveBeenCalledTimes(1);
+    expect(printed(io.stdout)).toContain("The login took too long to finish, so no key was created.");
+    expect(printed(io.stdout)).not.toContain("keeps its previous connection");
+    // The completion event reports what happened, not what was planned.
+    const props = vi.mocked(trackHookEvent).mock.calls.find((call) => call[1] === "configure_applied")![2];
+    expect(props).toMatchObject({ connected: false, mode: "oss" });
+  });
+
+  it("does not send the saved key to a saved address it would refuse as typed", async () => {
+    writeIngestCredential({ url: "http://cloud.example.com/v1/events", key: "saved-key-3f2a" });
+    connectPick = "keep";
+    await runConfigureWizard(ttyIO());
+    expect(introspectKey).not.toHaveBeenCalled();
+    expect(validateIngestKey).not.toHaveBeenCalled();
+  });
+
+  it("saves the org the login was approved into", async () => {
+    vi.mocked(claimLogin).mockResolvedValueOnce({
+      kind: "ok",
+      key: "k".repeat(64),
+      keyName: "failproofai · box",
+      org: { id: "o-1", slug: "acme", name: "Acme" },
+      permissions: ["events:add", "policies:pull"],
+    } as never);
+    connectPick = "login";
+    await runConfigureWizard(ttyIO());
+    expect(vi.mocked(connectToCloud).mock.calls[0]![0]).toMatchObject({ org: { id: "o-1", slug: "acme", name: "Acme" } });
+  });
+
+  it("says the old key still works after logging in again on a connected machine", async () => {
+    writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
+    connectPick = "login";
+    const io = ttyIO();
+    await runConfigureWizard(io);
+    expect(connectMenu().choices.find((c) => c.value === "login")?.label).toBe("Log in again");
+    expect(printed(io.stdout)).toContain("Your previous key for this machine still works until you revoke it");
+  });
+
+  it("asks for sudo again at apply when it expired during the login", async () => {
+    vi.mocked(daemonServiceStatus).mockReturnValue("not-installed");
+    vi.mocked(primeElevation).mockClear().mockReturnValue(true);
+    // Root at the start; gone by apply.
+    vi.mocked(canElevate).mockReturnValue(false);
+    connectPick = "login";
+    const io = ttyIO();
+    const result = await runConfigureWizard(io);
+    expect(primeElevation).toHaveBeenCalledTimes(2);
+    expect(printed(io.stdout)).toContain("Your sudo session expired while you were away.");
+    expect(result.applied).toBe(true);
+
+    // And when that second ask fails, nothing is claimed and nothing installed.
+    vi.mocked(claimLogin).mockClear();
+    vi.mocked(installDaemonService).mockClear();
+    vi.mocked(primeElevation).mockReset().mockReturnValueOnce(true).mockReturnValueOnce(false);
+    connectPick = "login";
+    const stopped = await runConfigureWizard(ttyIO());
+    expect(stopped).toEqual({ applied: false, abort: "needs_root" });
+    expect(installDaemonService).not.toHaveBeenCalled();
+    expect(claimLogin).not.toHaveBeenCalled();
+    vi.mocked(canElevate).mockReturnValue(true);
+  });
+
+  it("asks for sudo again before refreshing a stale unit, and carries on without it", async () => {
+    vi.mocked(daemonServiceNeedsUpgrade).mockReturnValue(true);
+    vi.mocked(primeElevation).mockClear().mockReturnValue(true);
+    // Root at the start; gone by apply.
+    vi.mocked(canElevate).mockReturnValue(false);
+    connectPick = "login";
+    const io = ttyIO();
+    const result = await runConfigureWizard(io);
+    expect(primeElevation).toHaveBeenCalledTimes(2);
+    expect(printed(io.stdout)).toContain("Refreshing failproofaid's service definition needs root again.");
+    expect(ensureDaemonServiceCurrent).toHaveBeenCalledTimes(1);
+    expect(result.applied).toBe(true);
+
+    // A second ask that fails costs the refresh, never the setup.
+    vi.mocked(ensureDaemonServiceCurrent).mockClear();
+    vi.mocked(primeElevation).mockReset().mockReturnValueOnce(true).mockReturnValueOnce(false);
+    connectPick = "login";
+    const io2 = ttyIO();
+    const carried = await runConfigureWizard(io2);
+    expect(carried.applied).toBe(true);
+    expect(ensureDaemonServiceCurrent).not.toHaveBeenCalled();
+    expect(claimLogin).toHaveBeenCalled();
+    expect(printed(io2.stdout)).toContain("Scheduled audits stay off until it is refreshed.");
+    vi.mocked(canElevate).mockReturnValue(true);
+  });
+
+  it("names the key to revoke when it was created but could not be put to use", async () => {
+    vi.mocked(claimLogin).mockResolvedValueOnce({
+      kind: "ok",
+      key: "k".repeat(64),
+      keyName: "failproofai · box",
+      org: { slug: "acme", name: "Acme" },
+      permissions: ["events:add", "policies:pull"],
+    } as never);
+    vi.mocked(connectToCloud).mockResolvedValueOnce({
+      policy: { ok: false, reason: "refused" },
+      ingest: { ok: false, reason: "refused" },
+      anyConfigured: false,
+    } as never);
+    const io = ttyIO();
+    await runConfigureWizard(io);
+    expect(printed(io.stdout)).toContain('The key "failproofai · box" was created but isn\'t in use here; revoke it');
+  });
+
+  it("keeps reporting the previous connection when logging in again creates no key", async () => {
+    writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
+    connectPick = "login";
+    vi.mocked(claimLogin).mockResolvedValueOnce({ kind: "expired" } as never);
+    const io = ttyIO();
+    const result = await runConfigureWizard(io);
+    // As "keep current connection" reports it: nothing new written, still cloud.
+    expect(result).toMatchObject({ applied: true, mode: "cloud" });
+    expect(printed(io.stdout)).toContain("This machine keeps its previous connection.");
+    expect(printed(io.stdout)).not.toContain("no longer works");
+  });
+
+  it("keeps reporting the previous connection when the new key is created but can't be used", async () => {
+    writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
+    connectPick = "login";
+    vi.mocked(claimLogin).mockResolvedValueOnce({
+      kind: "ok",
+      key: "k".repeat(64),
+      keyName: "failproofai · box",
+      org: { slug: "acme", name: "Acme" },
+      permissions: ["events:add", "policies:pull"],
+    } as never);
+    // Refused on both streams: connectToCloud writes nothing, so the saved key stays.
+    vi.mocked(connectToCloud).mockResolvedValueOnce({
+      policy: { ok: false, reason: "refused" },
+      ingest: { ok: false, reason: "refused" },
+      anyConfigured: false,
+    } as never);
+    const io = ttyIO();
+    const result = await runConfigureWizard(io);
+    expect(result).toMatchObject({ applied: true, connected: false, mode: "cloud" });
+    expect(printed(io.stdout)).toContain("This machine keeps its previous connection.");
+    expect(printed(io.stdout)).toContain('The key "failproofai · box" was created but isn\'t in use here; revoke it');
+    const props = vi.mocked(trackHookEvent).mock.calls.find((call) => call[1] === "configure_applied")![2];
+    expect(props).toMatchObject({ connected: false, mode: "cloud" });
+  });
+
+  it("does not report a refused saved key as a working connection when the new login creates no key", async () => {
+    writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
+    vi.mocked(validateIngestKey).mockResolvedValueOnce({ ok: false, reason: "the server rejected that key (401)" });
+    vi.mocked(claimLogin).mockResolvedValueOnce({ kind: "expired" } as never);
+    const io = ttyIO();
+    const result = await runConfigureWizard(io);
+    // Still on disk and still cloud (decision D4), but said for what it is.
+    expect(result).toMatchObject({ applied: true, mode: "cloud" });
+    expect(printed(io.stdout)).toContain(
+      "This machine keeps its previous connection, but its key no longer works. Run failproofai config again to log in.",
+    );
+    expect(printed(io.stdout)).not.toContain("keeps its previous connection.");
+  });
+
+  it("starts with this machine's name and OS, and maps an older cloud to the key route", async () => {
+    connectPick = "login";
+    await runConfigureWizard(ttyIO(), { machineLabel: "build-box-7" });
+    const opts = loginOpts();
+    expect(opts.machineLabel).toBe("build-box-7");
+
+    vi.mocked(startLogin).mockResolvedValueOnce({
+      kind: "ok",
+      verificationUrl: "https://app.befailproof.ai/cli/authorize?r=abc",
+      pollSecret: "s1",
+      expiresIn: 600,
+      interval: 2,
+    });
+    expect(await opts.start()).toEqual({
+      ok: true,
+      url: "https://app.befailproof.ai/cli/authorize?r=abc",
+      expiresIn: 600,
+      interval: 2,
+    });
+    expect(vi.mocked(startLogin).mock.calls[0]![1]).toMatchObject({ label: "build-box-7" });
+
+    vi.mocked(startLogin).mockResolvedValueOnce({ kind: "unsupported" });
+    expect(await opts.start()).toMatchObject({ ok: false, retryable: false });
+    vi.mocked(startLogin).mockResolvedValueOnce({ kind: "unreachable", reason: "offline" });
+    expect(await opts.start()).toMatchObject({ ok: false, retryable: true });
+  });
+
+  it("polls with the secret from the latest link, and treats a used or unknown link as expired", async () => {
+    connectPick = "login";
+    await runConfigureWizard(ttyIO());
+    const opts = loginOpts();
+    vi.mocked(startLogin).mockResolvedValueOnce({
+      kind: "ok", verificationUrl: "https://x.test/cli/authorize?r=1", pollSecret: "first", expiresIn: 600, interval: 2,
+    });
+    await opts.start();
+    vi.mocked(startLogin).mockResolvedValueOnce({
+      kind: "ok", verificationUrl: "https://x.test/cli/authorize?r=2", pollSecret: "second", expiresIn: 600, interval: 2,
+    });
+    await opts.start();
+    vi.mocked(pollLogin).mockResolvedValueOnce({ kind: "pending", interval: 3 });
+    expect(await opts.poll()).toEqual({ state: "pending", interval: 3 });
+    expect(vi.mocked(pollLogin).mock.calls[0]![1]).toBe("second");
+
+    for (const kind of ["claimed", "unknown", "expired"] as const) {
+      vi.mocked(pollLogin).mockResolvedValueOnce({ kind });
+      expect(await opts.poll()).toEqual({ state: "expired" });
+    }
+    vi.mocked(pollLogin).mockResolvedValueOnce({ kind: "denied" });
+    expect(await opts.poll()).toEqual({ state: "denied" });
+    vi.mocked(pollLogin).mockResolvedValueOnce({
+      kind: "approved", org: { slug: "acme", name: "Acme" }, approvedBy: "ada@acme.test", permissions: ["events:add"],
+    });
+    expect(await opts.poll()).toMatchObject({
+      state: "approved",
+      value: { kind: "login", pollSecret: "second", approvedBy: "ada@acme.test" },
+    });
+  });
+
+  it("prints the link instead of opening a browser over SSH or with no display", async () => {
+    connectPick = "login";
+    await runConfigureWizard(ttyIO());
+    vi.mocked(canOpenBrowser).mockReturnValue(false);
+    expect(loginOpts().open("https://x.test/cli/authorize?r=1")).toBe(false);
+    expect(openUrl).not.toHaveBeenCalled();
+    vi.mocked(canOpenBrowser).mockReturnValue(true);
+    expect(loginOpts().open("https://x.test/cli/authorize?r=1")).toBe(true);
+    expect(openUrl).toHaveBeenCalledWith("https://x.test/cli/authorize?r=1");
+  });
+
+  it("never offers login to a run with no terminal", async () => {
+    const result = await runConfigureWizard(headlessIO());
+    expect(result.applied).toBe(true);
+    expect(promptBrowserLogin).not.toHaveBeenCalled();
+    expect(claimLogin).not.toHaveBeenCalled();
+  });
+});
diff --git a/__tests__/hooks/uninstall-cli.test.ts b/__tests__/hooks/uninstall-cli.test.ts
index 98a11fb84..897ded16b 100644
--- a/__tests__/hooks/uninstall-cli.test.ts
+++ b/__tests__/hooks/uninstall-cli.test.ts
@@ -24,6 +24,7 @@ let servicePath: string;
 let serviceExists = true;
 let configured = true;
 let installedClis: string[] = ["claude", "codex"];
+let skillDirs: string[] = [];
 
 vi.mock("../../src/hooks/manager", () => ({
   removeHooks: vi.fn(async () => {
@@ -31,6 +32,16 @@ vi.mock("../../src/hooks/manager", () => ({
   }),
 }));
 
+vi.mock("../../src/hooks/agent-skill", () => ({
+  installedAgentSkillDirs: () => skillDirs,
+  removeAgentSkill: vi.fn(() => {
+    calls.push("removeAgentSkill");
+    const removed = skillDirs;
+    skillDirs = [];
+    return removed;
+  }),
+}));
+
 vi.mock("../../src/hooks/daemon-service", () => ({
   isDaemonSupportedPlatform: () => true,
   daemonServiceFilePath: () => servicePath,
@@ -78,6 +89,7 @@ beforeEach(() => {
   serviceExists = true;
   configured = true;
   installedClis = ["claude", "codex"];
+  skillDirs = [];
 });
 
 afterEach(() => {
@@ -118,6 +130,31 @@ describe("hooks/uninstall-cli", () => {
     expect(res.lines.join("\n")).toMatch(/would deny every tool call/);
   });
 
+  it("removes the failproofai skill config wrote, after daemonConfigured comes down", async () => {
+    skillDirs = ["/h/.claude/skills/failproofai", "/h/.codex/skills/failproofai"];
+    const { runUninstallCommand } = await import("../../src/hooks/uninstall-cli");
+    const plan = await runUninstallCommand({ dryRun: true });
+    expect(plan.lines.join("\n")).toContain("the failproofai skill from 2 agent folders");
+    expect(calls).not.toContain("removeAgentSkill");
+
+    const res = await runUninstallCommand({ yes: true });
+    expect(res.exitCode).toBe(0);
+    expect(calls.indexOf("setDaemonConfigured(false)")).toBeLessThan(calls.indexOf("removeAgentSkill"));
+    expect(res.lines.join("\n")).toContain("Removed the failproofai skill from 2 agent folders.");
+  });
+
+  it("has something to uninstall when only the skill is left", async () => {
+    installedClis = [];
+    configured = false;
+    serviceExists = false;
+    rmSync(servicePath, { force: true });
+    skillDirs = ["/h/.claude/skills/failproofai"];
+    const { runUninstallCommand } = await import("../../src/hooks/uninstall-cli");
+    const res = await runUninstallCommand({ yes: true });
+    expect(res.lines.join("\n")).not.toContain("Nothing to uninstall");
+    expect(calls).toContain("removeAgentSkill");
+  });
+
   it("refuses without --yes when there is no way to confirm", async () => {
     // A prompt that cannot be answered must never read as consent to delete a
     // root-owned service — this is the CI / piped-stdin path.
diff --git a/docs/reference/failproof-cli.mdx b/docs/reference/failproof-cli.mdx
index fc30731e0..efa063820 100644
--- a/docs/reference/failproof-cli.mdx
+++ b/docs/reference/failproof-cli.mdx
@@ -25,7 +25,9 @@ failproofai policies add FailproofAI/policies
 failproofai config --status
 ```
 
-`failproofai config` is the whole of setup: it installs the `failproofaid` service (root once, via `sudo -n` — never an interactive password prompt), wires hooks into every agent CLI it finds, and connects to Cloud when a key is available. With no terminal — CI, a container, an agent driving it — it applies rather than asking, and exits 1 if anything it was asked to do did not happen.
+`failproofai config` is the whole of setup: it installs the `failproofaid` service (root once — in a terminal it asks for your sudo password, and asks again if that expired before setup finished; with no terminal it uses `sudo -n` and never prompts), wires hooks into every agent CLI it finds, and connects to Cloud. With no terminal — CI, a container, an agent driving it — it applies rather than asking, and exits 1 if anything it was asked to do did not happen.
+
+In a terminal, the **Connect to cloud** step on a machine that is not connected yet starts **logging in to FailproofAI Cloud** straight away; press Tab for the other options, **Paste an API key** or **Use open source**. Logging in opens a link — or prints it over SSH or with no display, to open on any device — where you sign up or sign in, pick or create an org, and authorize the machine; the terminal picks up the approval by itself and shows who approved it and for which org. The key is minted only when setup finishes, after the daemon is installed. On a machine that is already connected with a working key, the step is a menu with **Keep current connection** first, so re-running setup never opens a browser by itself; a saved key that no longer works starts logging in again straight away, and says why. Logging in again makes a new key and leaves the old one working until you revoke it. A Cloud from before browser login says so and offers the other options.
 
 It chooses **no** policies. That is the second command's job, and without it a freshly configured machine enforces nothing but the always-on guard.
 
@@ -39,7 +41,7 @@ Run `failproofai` without arguments to open the local policy dashboard.
 
 | Command | Outcome |
 | --- | --- |
-| `failproofai config` | Set the machine up: agents, daemon, and Cloud when a key is present |
+| `failproofai config` | Set the machine up: agents, daemon, and Cloud — log in through the browser, paste a key, or stay open source. Every agent on the machine also gets a small `failproofai` skill that points it at the [FailproofAI skills](https://github.com/FailproofAI/skills) online |
 | `failproofai config --token <key>` | Set up and connect in one pass, asking nothing. A key that carries `jev:evaluate` also turns on [Jev through FailproofAI Cloud](/reference/jev-cloud) in observe mode, unless a `jev.json` already exists or `--no-transcripts` is given |
 | `failproofai config --connect <url>` | Enrol a machine that is **already** set up — no daemon, no hooks |
 | `failproofai config --status` | Show connection, daemon, delivery, and pause state |
@@ -73,7 +75,7 @@ Run `failproofai` without arguments to open the local policy dashboard.
 | `failproofai config --resume` | Resume one paused local session; add `--all` to clear all pauses |
 | `failproofai update` | Finish package migrations and update the daemon |
 | `failproofai migrate --dry-run` | Preview or run pending home-layout migrations |
-| `failproofai uninstall` | Remove hooks and the daemon before removing the package |
+| `failproofai uninstall` | Remove hooks, the `failproofai` skill and the daemon before removing the package |
 | `failproofai --version` | Print the installed package version |
 | `failproofai --help` | Show commands and global usage |
 
@@ -183,5 +185,5 @@ npm rm -g failproofai
 Run `failproofai <command> --help` for version-specific details.
 
 <Warning>
-  Run `failproofai uninstall` before `npm rm -g failproofai`; npm does not remove installed agent hooks or the daemon service.
+  Run `failproofai uninstall` before `npm rm -g failproofai`; npm does not remove installed agent hooks, the `failproofai` skill or the daemon service.
 </Warning>
diff --git a/docs/start/quickstart.mdx b/docs/start/quickstart.mdx
index c22af8ac1..86ab4af1a 100644
--- a/docs/start/quickstart.mdx
+++ b/docs/start/quickstart.mdx
@@ -26,26 +26,31 @@ This quickstart gets one machine reporting sessions, runs an audit, and deploys
     </Steps>
   </Tab>
   <Tab title="Manual setup">
-    ## Before you start
-
-1. Open the [Failproof AI dashboard](https://app.befailproof.ai) and create an account or sign in with your work email.
-2. Go to **Administration → Keys** and create a key with `events:add` and `policies:pull`. If you plan to use [Jev through FailproofAI Cloud](/reference/jev-cloud), choose the **machine** preset, which also grants `jev:evaluate`.
-3. Copy the one-time secret, then read it into a shell on the target machine. `read -s` takes it at a prompt that does not echo, so it never appears in a command:
-
-```bash
-read -rs FAILPROOFAI_KEY && export FAILPROOFAI_KEY
-```
-
     ## Install
 
 <Steps>
   <Step title="Install and connect Failproof AI">
     ```bash
     npm install -g failproofai
-    FAILPROOFAI_CLOUD_TOKEN="$FAILPROOFAI_KEY" failproofai config
+    failproofai config
     ```
 
-    That one command is the whole of setup: it installs the local daemon (root once), wires hooks into every agent CLI it finds, and connects this machine to Cloud. Passing the key through the environment rather than `--token` keeps it out of `ps`, where every user on the machine can read a command's arguments. It does not keep it out of shell history — reading it with `read -s` is what does that. In CI, inject it as a masked secret and keep shell tracing (`set -x`) off, or the trace prints it.
+    That one command is the whole of setup: it installs the local daemon (root once), wires hooks into every agent CLI it finds, and connects this machine to Cloud.
+
+    At **Connect to cloud**, setup starts logging you in to FailproofAI Cloud straight away (press Tab for the other options: paste an API key, or use open source). It opens a link in your browser (over SSH, or on a machine with no display, it prints the link so you can open it on any device). Sign up or sign in, confirm the org — or create one right there — and click **Authorize**. The key's name and permissions are set for you. You do not need an account beforehand.
+
+    The terminal notices on its own and shows who approved it and for which org. Confirm the agents to trace, and setup finishes. The machine's key is created only at that point, after the daemon is installed, so a run you abandon leaves no key behind; it appears under **Administration → Keys** marked **cli login**, where you can revoke it.
+
+    <Accordion title="No browser or terminal at hand? Use a key (CI, containers, provisioning scripts)">
+      In the [Failproof AI dashboard](https://app.befailproof.ai), go to **Administration → Keys** and create a key with `events:add` and `policies:pull`. If you plan to use [Jev through FailproofAI Cloud](/reference/jev-cloud), choose the **machine** preset, which also grants `jev:evaluate`. Copy the one-time secret and read it into a shell on the target machine — `read -s` takes it at a prompt that does not echo:
+
+      ```bash
+      read -rs FAILPROOFAI_KEY && export FAILPROOFAI_KEY
+      FAILPROOFAI_CLOUD_TOKEN="$FAILPROOFAI_KEY" failproofai config
+      ```
+
+      Passing the key through the environment rather than `--token` keeps it out of `ps`, where every user on the machine can read a command's arguments. It does not keep it out of shell history — reading it with `read -s` is what does that. In CI, inject it as a masked secret and keep shell tracing (`set -x`) off, or the trace prints it. In an interactive run you can also pick **Paste an API key** at **Connect to cloud** instead.
+    </Accordion>
 
     Session transcripts are sent by default. Add `--no-transcripts` to report hook activity and policy decisions without transcript content.
 
diff --git a/hermes-plugin/plugin.yaml b/hermes-plugin/plugin.yaml
index d8b942dc9..ae909148f 100644
--- a/hermes-plugin/plugin.yaml
+++ b/hermes-plugin/plugin.yaml
@@ -1,5 +1,5 @@
 name: failproofai
-version: 1.0.12-beta.0
+version: 1.0.12
 description: Real-time FailproofAI policy enforcement for Hermes
 manifest_version: 2
 api_version: 1
diff --git a/package.json b/package.json
index cc344e8b2..789652f04 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.12-beta.0",
+  "version": "1.0.12",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
diff --git a/src/audit/open-browser.ts b/src/audit/open-browser.ts
index d5945c206..e00cb98ae 100644
--- a/src/audit/open-browser.ts
+++ b/src/audit/open-browser.ts
@@ -13,8 +13,26 @@ import { spawn } from "node:child_process";
 const POLL_INTERVAL_MS = 150;
 const POLL_TIMEOUT_MS = 30_000;
 
+/**
+ * Whether opening a browser here can put a page in front of the person.
+ *
+ * False over SSH — `xdg-open` would start a browser on the REMOTE machine, or
+ * fail, while the person is looking at their own screen — and on a Linux box
+ * with no display at all (a container, a server). Callers then print the link,
+ * which works from any device. A guess, not a promise: a false positive costs a
+ * browser that does not appear next to a link that is printed anyway.
+ */
+export function canOpenBrowser(
+  env: NodeJS.ProcessEnv = process.env,
+  platform: NodeJS.Platform = process.platform,
+): boolean {
+  if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY) return false;
+  if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY) return false;
+  return true;
+}
+
 /** Open a URL with the platform's default handler. Never throws. */
-function openUrl(url: string): void {
+export function openUrl(url: string): void {
   let cmd: string;
   let args: string[];
   if (process.platform === "darwin") {
diff --git a/src/hooks/agent-skill.ts b/src/hooks/agent-skill.ts
new file mode 100644
index 000000000..5a0fe3ef6
--- /dev/null
+++ b/src/hooks/agent-skill.ts
@@ -0,0 +1,193 @@
+/**
+ * The `failproofai` skill: one small SKILL.md that `failproofai config` puts in
+ * every agent this machine has, in that agent's own user-scope skills folder.
+ *
+ * It carries no instructions of its own. It points the agent at the umbrella
+ * skill in the public FailproofAI/skills repository, which the agent reads when
+ * a FailproofAI task comes up, along with whichever focused sibling skill and
+ * `references/*.md` file the task needs. So the content is never stale on
+ * disk: changing that repository changes what every machine reads next, with
+ * no release and no re-run of setup.
+ *
+ * Every folder below was verified on 2026-10-23 against the real CLI (versions
+ * in each comment), by planting a probe skill in each candidate folder and
+ * reading what the CLI listed, or what it sent to a mock model server.
+ *
+ * Never `~/.agents/skills`, although many agents read it: Claude Code does not
+ * read it at all, Codex lists a skill found there and in `~/.codex/skills`
+ * twice, Copilot stops reading it once `COPILOT_HOME` is set, and in OpenClaw it
+ * outranks OpenClaw's own folder. Each agent's own folder works on its own.
+ *
+ * The frontmatter is shaped by the strictest of them: `name` equals the folder
+ * name (Claude Code, Cursor and Devin go by the folder, the rest by `name`, and
+ * Antigravity shows a skill without one as "SKILL"); Copilot drops a skill whose
+ * description is over 1024 characters, droid shows the model the first 200, and
+ * Hermes the first 57 — so the description is short and leads with what it is
+ * for.
+ */
+import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { listHermesProfiles } from "../../lib/hermes-profiles";
+import { listOpenClawProfiles } from "../../lib/openclaw-profiles";
+import { hookLogWarn } from "./hook-logger";
+import { writeConfigFileAtomic } from "./safe-config-write";
+import { INTEGRATION_TYPES, type IntegrationType } from "./types";
+
+export const AGENT_SKILL_NAME = "failproofai";
+
+/**
+ * Sits beside SKILL.md in a folder failproofai wrote. A `failproofai` folder
+ * without it belongs to someone else — most often the full skill installed with
+ * `npx skills add FailproofAI/skills` — and is never overwritten or removed.
+ */
+export const AGENT_SKILL_MARKER = ".failproofai-managed";
+
+const SKILLS_RAW = "https://raw.githubusercontent.com/FailproofAI/skills/main/skills";
+
+export const AGENT_SKILL_MD = `---
+name: ${AGENT_SKILL_NAME}
+description: FailproofAI hooks, policies, daemon, Cloud, the fp CLI and the SDK. Use for any question about setting up, running or fixing FailproofAI.
+---
+
+# FailproofAI
+
+This skill is a pointer. Before acting on anything FailproofAI, read the full skill, which is kept current online (use your web fetch tool, or \`curl -fsSL <url>\`):
+
+${SKILLS_RAW}/${AGENT_SKILL_NAME}/SKILL.md
+
+Files it names by a relative path, such as \`references/cli.md\`, are in that same folder: ${SKILLS_RAW}/${AGENT_SKILL_NAME}/<path>
+
+For focused work, read the matching skill too. Each has the same layout, with its own \`references/\` beside it.
+
+- Writing or testing a policy: ${SKILLS_RAW}/failproofai-policy-author/SKILL.md
+- Publishing a policy pack: ${SKILLS_RAW}/failproofai-policy-publish/SKILL.md
+- FailproofAI Cloud and the \`fp\` CLI: ${SKILLS_RAW}/fp-cloud-cli/SKILL.md
+- Adding the SDK to an agent, or running an evaluator: ${SKILLS_RAW}/failproofai-sdk/SKILL.md
+- Planning evaluations: ${SKILLS_RAW}/failproofai-eval-brainstorm/SKILL.md
+`;
+
+/** An agent's own override for where it keeps its files, else the default. */
+function envDir(name: string, fallback: string): string {
+  const value = (process.env[name] ?? "").trim();
+  return value ? resolve(value) : fallback;
+}
+
+/**
+ * The skills folders `id` reads at user scope — one, except for Hermes and
+ * OpenClaw, where every profile reads only its own.
+ */
+export function agentSkillRoots(id: IntegrationType): string[] {
+  const home = homedir();
+  const config = envDir("XDG_CONFIG_HOME", join(home, ".config"));
+  switch (id) {
+    // 2.1.309. CLAUDE_CONFIG_DIR replaces ~/.claude rather than adding to it.
+    case "claude":
+      return [join(envDir("CLAUDE_CONFIG_DIR", join(home, ".claude")), "skills")];
+    // 0.164.0. Its own skill installer writes here too.
+    case "codex":
+      return [join(envDir("CODEX_HOME", join(home, ".codex")), "skills")];
+    // 1.0.103.
+    case "copilot":
+      return [join(envDir("COPILOT_HOME", join(home, ".copilot")), "skills")];
+    // 2026.10.22. Always under HOME: CURSOR_CONFIG_DIR does not move it.
+    case "cursor":
+      return [join(home, ".cursor", "skills")];
+    // 1.19.4.
+    case "opencode":
+      return [join(config, "opencode", "skills")];
+    // 1.4.0 and 0.73.1. Not the pi-extension package: a `skills/` folder there
+    // makes Pi stop loading the package's index.ts, and with it enforcement.
+    case "pi":
+      return [join(envDir("PI_CODING_AGENT_DIR", join(home, ".pi", "agent")), "skills")];
+    // 0.21.3. A profile reads its own skills/ and no other profile's.
+    case "hermes":
+      return listHermesProfiles().map((p) => join(p.home, "skills"));
+    // 2026.9.2. The same profile homes its hooks are installed into.
+    case "openclaw":
+      return listOpenClawProfiles().map((p) => join(p.home, "skills"));
+    // 0.248.0. FACTORY_HOME_OVERRIDE stands in for HOME.
+    case "factory":
+      return [join(envDir("FACTORY_HOME_OVERRIDE", home), ".factory", "skills")];
+    // 3000.11.205.
+    case "devin":
+      return [join(config, "devin", "skills")];
+    // 1.4.6. The documented user folder, beside the hooks.json we write; not
+    // ~/.gemini/antigravity/skills, which it does not read.
+    case "antigravity":
+      return [join(home, ".gemini", "config", "skills")];
+    // 1.55.0. GOOSE_PATH_ROOT moves Goose's whole config tree.
+    case "goose": {
+      const root = (process.env.GOOSE_PATH_ROOT ?? "").trim();
+      return [root ? join(resolve(root), "config", "skills") : join(config, "goose", "skills")];
+    }
+  }
+}
+
+/**
+ * Whether `id` already has a `failproofai` skill from a folder it also reads,
+ * and would list ours beside it rather than pick one. Only Codex: it reads
+ * `~/.agents/skills` (always under HOME, whatever CODEX_HOME says) as well as
+ * its own folder and lists a name found in both twice (0.164.0) — and that is
+ * where `npx skills add FailproofAI/skills -g` puts the full skill for it.
+ */
+function listedTwice(id: IntegrationType): boolean {
+  return id === "codex" && existsSync(join(homedir(), ".agents", "skills", AGENT_SKILL_NAME));
+}
+
+/**
+ * Write the skill for each agent in `ids`. Never fails setup: an agent whose
+ * folder cannot be written is logged and skipped. Returns the agents it was
+ * written for.
+ */
+export function installAgentSkill(ids: readonly IntegrationType[]): IntegrationType[] {
+  const installed: IntegrationType[] = [];
+  for (const id of ids) {
+    let wrote = false;
+    const covered = listedTwice(id);
+    for (const root of agentSkillRoots(id)) {
+      const dir = join(root, AGENT_SKILL_NAME);
+      const ours = existsSync(join(dir, AGENT_SKILL_MARKER));
+      // Covered already: a copy of ours from an earlier run is now the duplicate.
+      if (covered) {
+        if (ours) removeSkillDir(dir);
+        continue;
+      }
+      if (existsSync(dir) && !ours) continue;
+      try {
+        // Marker first: a run interrupted before it would leave a folder every
+        // later run takes for someone else's and skips.
+        mkdirSync(dir, { recursive: true });
+        writeConfigFileAtomic(join(dir, AGENT_SKILL_MARKER), "", { backup: false, symlinks: "replace" });
+        writeConfigFileAtomic(join(dir, "SKILL.md"), AGENT_SKILL_MD, { backup: false, symlinks: "replace" });
+        wrote = true;
+      } catch (err) {
+        hookLogWarn(`the failproofai skill was not written to ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    if (wrote) installed.push(id);
+  }
+  return installed;
+}
+
+/** Every skill folder failproofai wrote, for any agent. */
+export function installedAgentSkillDirs(): string[] {
+  const dirs = INTEGRATION_TYPES.flatMap((id) => agentSkillRoots(id).map((root) => join(root, AGENT_SKILL_NAME)));
+  return [...new Set(dirs)].filter((dir) => existsSync(join(dir, AGENT_SKILL_MARKER)));
+}
+
+/** Remove one skill folder; never throws, so neither setup nor uninstall stops on it. */
+function removeSkillDir(dir: string): boolean {
+  try {
+    rmSync(dir, { recursive: true, force: true });
+    return true;
+  } catch (err) {
+    hookLogWarn(`the failproofai skill was not removed from ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+    return false;
+  }
+}
+
+/** Remove every skill folder failproofai wrote. Returns the folders removed. */
+export function removeAgentSkill(): string[] {
+  return installedAgentSkillDirs().filter(removeSkillDir);
+}
diff --git a/src/hooks/cloud-connection.ts b/src/hooks/cloud-connection.ts
index 2ae37590f..64d540beb 100644
--- a/src/hooks/cloud-connection.ts
+++ b/src/hooks/cloud-connection.ts
@@ -141,6 +141,10 @@ export interface ConnectInput {
    */
   sessions?: boolean;
   environment?: string;
+  /** The org the key is already known to report into — a browser login's
+   *  claim names it. Used only when introspect gives no answer (unreachable
+   *  just then, or an older server), so the saved org is not left stale. */
+  org?: { id?: string; slug?: string; name?: string };
   /** Injected by tests so nothing reaches the network. */
   verifyPolicy?: typeof verifyCloudCredentials;
   verifyIngest?: typeof validateIngestKey;
@@ -162,7 +166,8 @@ export interface ConnectOutcome {
    * server has no introspect endpoint to say whether the key carries it.
    */
   jev?: JevConnectOutcome;
-  /** Which organisation the key belongs to. Absent on a pre-introspect server. */
+  /** Which organisation the key belongs to. Absent when neither introspect nor
+   *  the caller (`ConnectInput.org`) named one. */
   org?: { id?: string; slug?: string; name?: string };
   /** True when at least one capability was configured. */
   anyConfigured: boolean;
@@ -264,6 +269,7 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
   // CLI ships independently of whatever server a customer runs, so a good key
   // on an older deployment must still connect.
   const known = identity.kind === "ok" ? identity.identity : null;
+  const org = known ? { id: known.orgId, slug: known.orgSlug, name: known.orgName } : input.org;
 
   // Skip a probe the key provably cannot pass. This is not an optimisation: a
   // permission failure surfaces from `/events` as a 403 whose message reads
@@ -294,9 +300,7 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
       : { ok: false, reason: policyResult.reason },
     ingest: ingestResult.ok ? { ok: true } : { ok: false, reason: ingestResult.reason },
     anyConfigured: false,
-    org: known
-      ? { id: known.orgId, slug: known.orgSlug, name: known.orgName }
-      : undefined,
+    org,
   };
 
   outcome.anyConfigured = policyResult.ok || ingestResult.ok;
@@ -317,8 +321,8 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
     prev.jev ? { token: prev.jev.key, url: prev.jev.url } : undefined,
   ].some((slot) => slot && (slot.token !== input.token || !sameOrigin(slot.url)));
   const orgSwitch = hadConnection && (
-    (prev.org?.id && known?.orgId && prev.org.id !== known.orgId) ||
-    ((!prev.org?.id || !known?.orgId) && keyChanged) ||
+    (prev.org?.id && org?.id && prev.org.id !== org.id) ||
+    ((!prev.org?.id || !org?.id) && keyChanged) ||
     (previousPolicy && !sameOrigin(previousPolicy.url)) ||
     (prev.ingest && !sameOrigin(prev.ingest.url))
   );
@@ -329,7 +333,7 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
   if (orgSwitch) {
     rmSync(backfillRequestPath(), { force: true });
     const oldOrg = prev.org?.name ?? prev.org?.slug ?? prev.org?.id ?? "the previous org";
-    const newOrg = known?.orgName ?? known?.orgSlug ?? known?.orgId ?? "the new org";
+    const newOrg = org?.name ?? org?.slug ?? org?.id ?? "the new org";
     changes.push(`Switched from ${oldOrg} to ${newOrg}. Nothing recorded before now will be sent to ${newOrg}; ${oldOrg}'s cloud policies stop within ~30 s.`);
     // Remove local references, not the daemon's policy-floor state (#899).
     clearActiveCloudManagedPolicies();
@@ -362,8 +366,8 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
     if (prev.jev) changes.push(`Removed the previous Jev key ${maskToken(prev.jev.key)}: this key's ${PERMISSION_JEV} permission was not verified.`);
   }
   const since = boundary === undefined ? {} : { since: boundary };
-  if (known) {
-    next.org = { id: known.orgId, slug: known.orgSlug, name: known.orgName, ...since };
+  if (org) {
+    next.org = { ...org, ...since };
   } else {
     const { since: _drop, ...kept } = orgSwitch ? {} : (prev.org ?? {});
     next.org = { ...kept, ...since };
@@ -373,7 +377,7 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
   // a flush served before the daemon sees the new key retries these batches
   // with the key that was refused, re-parking them as definitive refusals.
   if (ingestResult.ok && prev.ingest && prev.ingest.key !== input.token) {
-    recoverCredentialRefusals(Boolean(prev.org?.id && prev.org.id === known?.orgId && sameOrigin(prev.ingest.url)), prev.org?.id);
+    recoverCredentialRefusals(Boolean(prev.org?.id && prev.org.id === org?.id && sameOrigin(prev.ingest.url)), prev.org?.id);
   }
   // Legacy JSON override remains supported; the consolidated file above is
   // published once, never as a mixture of previous and replacement slots.
diff --git a/src/hooks/cloud-introspect.ts b/src/hooks/cloud-introspect.ts
index 39a673824..e7cd92c34 100644
--- a/src/hooks/cloud-introspect.ts
+++ b/src/hooks/cloud-introspect.ts
@@ -33,6 +33,8 @@
  * second.
  */
 
+import { displayText } from "./cloud-login";
+
 /** The path introspect is served on, appended to the cloud origin. */
 export const INTROSPECT_PATH = "/v1/auth/introspect";
 
@@ -126,8 +128,9 @@ export async function introspectKey(
     identity: {
       keyId: typeof b.key_id === "string" ? b.key_id : undefined,
       orgId: typeof b.org_id === "string" ? b.org_id : undefined,
-      orgSlug: typeof b.org_slug === "string" ? b.org_slug : undefined,
-      orgName: typeof b.org_name === "string" ? b.org_name : undefined,
+      // Printed in "Connected as …": text only, never terminal controls.
+      orgSlug: displayText(b.org_slug),
+      orgName: displayText(b.org_name),
       permissions: b.permissions.filter((p): p is string => typeof p === "string"),
       expiresAt: typeof b.expires_at === "string" ? b.expires_at : null,
       otelIngest: typeof b.otel_ingest === "boolean" ? b.otel_ingest : undefined,
diff --git a/src/hooks/cloud-login.ts b/src/hooks/cloud-login.ts
new file mode 100644
index 000000000..a3f388bfe
--- /dev/null
+++ b/src/hooks/cloud-login.ts
@@ -0,0 +1,248 @@
+/**
+ * The CLI half of "Log in to FailproofAI Cloud" — `failproofai config`'s
+ * browser login.
+ *
+ * The CLI asks the dashboard for a link, a person approves it in a browser
+ * (signing up, signing in, picking or creating an org on the way), and the CLI
+ * — polling with a secret only it holds — sees the approval and, once setup has
+ * finished, claims a freshly minted machine key. The server side is
+ * `server/src/routes/cli_login.rs` in AgentEye; the relay is the dashboard's
+ * `/api/auth/cli/*`.
+ *
+ * Three calls, each with an injectable `fetch` so tests never reach the network:
+ *   start → { verificationUrl, pollSecret, expiresIn, interval }
+ *   poll  → pending / slow_down / approved (org + who) / denied / expired / …
+ *   claim → the key, exactly once. Called at APPLY, after the daemon installs:
+ *           an approval that is never claimed leaves no key behind.
+ *
+ * Every call refuses to follow a redirect, for the reason `introspectKey` gives:
+ * a dashboard that does not know a path can answer with a login page, and a 200
+ * from that must never read as success.
+ */
+
+export const LOGIN_START_PATH = "/api/auth/cli/start";
+export const LOGIN_POLL_PATH = "/api/auth/cli/poll";
+export const LOGIN_CLAIM_PATH = "/api/auth/cli/claim";
+
+const TIMEOUT_MS = 10_000;
+
+export interface LoginOrg {
+  id?: string;
+  slug?: string;
+  name?: string;
+}
+
+export type StartResult =
+  | { kind: "ok"; verificationUrl: string; pollSecret: string; expiresIn: number; interval: number }
+  /** This cloud predates browser login. Pasting a key still works. */
+  | { kind: "unsupported" }
+  | { kind: "refused"; reason: string }
+  | { kind: "unreachable"; reason: string };
+
+export type PollResult =
+  | { kind: "pending"; interval?: number }
+  | { kind: "slow_down" }
+  | { kind: "approved"; org: LoginOrg; approvedBy?: string; keyName?: string; permissions: string[] }
+  | { kind: "denied" }
+  | { kind: "expired" }
+  | { kind: "claimed" }
+  /** The server no longer knows this request (swept, or never existed). */
+  | { kind: "unknown" }
+  | { kind: "unreachable"; reason: string };
+
+export type ClaimResult =
+  | {
+      kind: "ok";
+      key: string;
+      keyId?: string;
+      keyName?: string;
+      org: LoginOrg;
+      permissions: string[];
+      approvedBy?: string;
+    }
+  | { kind: "expired" }
+  /** The person who approved can no longer grant this key. */
+  | { kind: "revoked" }
+  | { kind: "refused"; reason: string }
+  | { kind: "unreachable"; reason: string };
+
+type Fetch = typeof fetch;
+
+async function postJson(
+  origin: string,
+  path: string,
+  body: unknown,
+  fetchImpl: Fetch,
+): Promise<{ status: number; json: Record<string, unknown> | null } | { error: string }> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const res = await fetchImpl(`${origin.replace(/\/+$/, "")}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      redirect: "manual",
+      signal: controller.signal,
+    });
+    let json: Record<string, unknown> | null = null;
+    try {
+      const parsed: unknown = await res.json();
+      json = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? (parsed as Record<string, unknown>) : null;
+    } catch {
+      json = null;
+    }
+    return { status: res.status, json };
+  } catch (err) {
+    // Deliberately not the URL: setup is often run while screen-sharing.
+    return { error: err instanceof Error ? (err.name === "AbortError" ? "timed out" : err.message) : String(err) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+const str = (v: unknown): string | undefined => (typeof v === "string" && v.length > 0 ? v : undefined);
+
+// Controls (a terminal executes them: clear the screen, retitle the window,
+// write the clipboard), bidi overrides and isolates, and zero-width formatting.
+const INVISIBLE = /[\u0000-\u001f\u007f-\u009f\u061c\u180e\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff]/g;
+
+/**
+ * A server-supplied string made safe to print. Org names are chosen by whoever
+ * created the org and the CLI prints the one it was approved into — the line
+ * that is meant to show who approved what — so none of it may reach the
+ * terminal as anything but text.
+ */
+export function displayText(v: unknown, max = 200): string | undefined {
+  if (typeof v !== "string") return undefined;
+  const t = v.replace(INVISIBLE, "").trim().slice(0, max);
+  return t.length > 0 ? t : undefined;
+}
+
+function org(v: unknown): LoginOrg {
+  const o = v && typeof v === "object" ? (v as Record<string, unknown>) : {};
+  return { id: str(o.id), slug: displayText(o.slug), name: displayText(o.name) };
+}
+
+function permissions(v: unknown): string[] {
+  return Array.isArray(v) ? v.map((p) => displayText(p, 64)).filter((p): p is string => p !== undefined) : [];
+}
+
+/** A server's number, kept to a range this client can live with: a huge poll
+ *  interval overflows `setTimeout` into a 1 ms storm, a tiny one polls flat out. */
+const within = (v: unknown, lo: number, hi: number, fallback: number): number =>
+  typeof v === "number" && Number.isFinite(v) && v > 0 ? Math.min(hi, Math.max(lo, v)) : fallback;
+
+/**
+ * Only an http(s) link is ever handed to the browser opener. The URL comes from
+ * the server, and `xdg-open` / `open` will happily act on any scheme they know.
+ */
+export function isOpenableUrl(raw: string): boolean {
+  try {
+    const u = new URL(raw);
+    return u.protocol === "https:" || u.protocol === "http:";
+  } catch {
+    return false;
+  }
+}
+
+/** What the browser page should call this machine and its OS. */
+export function machineOs(platform: NodeJS.Platform = process.platform): string {
+  return platform === "darwin" ? "macOS" : platform === "win32" ? "windows" : platform;
+}
+
+export async function startLogin(
+  origin: string,
+  machine: { label: string; os: string; cliVersion: string },
+  fetchImpl: Fetch = fetch,
+): Promise<StartResult> {
+  const r = await postJson(
+    origin,
+    LOGIN_START_PATH,
+    { machine_label: machine.label, machine_os: machine.os, cli_version: machine.cliVersion },
+    fetchImpl,
+  );
+  if ("error" in r) return { kind: "unreachable", reason: r.error };
+  // No such route, the web app redirecting an unknown path, or serving a page
+  // (200, not JSON) in its place: a cloud from before this feature. Not an
+  // error — the key prompt still connects it.
+  if (r.status === 404 || (r.status >= 300 && r.status < 400) || (r.status === 200 && !r.json)) {
+    return { kind: "unsupported" };
+  }
+  if (r.status === 429) return { kind: "refused", reason: "too many login attempts from here — wait a minute" };
+  if (r.status !== 201 || !r.json) {
+    return r.status >= 500
+      ? { kind: "unreachable", reason: `the server answered ${r.status}` }
+      : { kind: "refused", reason: displayText(r.json?.error, 120) ?? `the server answered ${r.status}` };
+  }
+  const verificationUrl = str(r.json.verification_url);
+  const pollSecret = str(r.json.poll_secret);
+  if (!verificationUrl || !pollSecret || !isOpenableUrl(verificationUrl)) {
+    // A 201 without the fields is something other than this API.
+    return { kind: "unsupported" };
+  }
+  return {
+    kind: "ok",
+    // Re-serialised, never the raw string: it is printed, and the parser
+    // percent-encodes every control and non-ASCII character in it.
+    verificationUrl: new URL(verificationUrl).href,
+    pollSecret,
+    expiresIn: within(r.json.expires_in, 30, 3600, 600),
+    interval: within(r.json.interval, 1, 30, 2),
+  };
+}
+
+export async function pollLogin(origin: string, pollSecret: string, fetchImpl: Fetch = fetch): Promise<PollResult> {
+  const r = await postJson(origin, LOGIN_POLL_PATH, { poll_secret: pollSecret }, fetchImpl);
+  if ("error" in r) return { kind: "unreachable", reason: r.error };
+  if (r.status === 404) return { kind: "unknown" };
+  if (r.status !== 200 || !r.json) return { kind: "unreachable", reason: `the server answered ${r.status}` };
+  const j = r.json;
+  switch (j.status) {
+    case "pending":
+      return { kind: "pending", interval: typeof j.interval === "number" ? within(j.interval, 1, 30, 2) : undefined };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "approved":
+      return {
+        kind: "approved",
+        org: org(j.org),
+        approvedBy: displayText(j.approved_by),
+        keyName: displayText(j.key_name),
+        permissions: permissions(j.permissions),
+      };
+    case "denied":
+      return { kind: "denied" };
+    case "expired":
+      return { kind: "expired" };
+    case "claimed":
+      return { kind: "claimed" };
+    default:
+      return { kind: "unknown" };
+  }
+}
+
+export async function claimLogin(origin: string, pollSecret: string, fetchImpl: Fetch = fetch): Promise<ClaimResult> {
+  const r = await postJson(origin, LOGIN_CLAIM_PATH, { poll_secret: pollSecret }, fetchImpl);
+  if ("error" in r) return { kind: "unreachable", reason: r.error };
+  const j = r.json ?? {};
+  if (r.status === 201) {
+    const key = str(j.api_key);
+    if (!key) return { kind: "refused", reason: "the server answered without a key" };
+    return {
+      kind: "ok",
+      key,
+      keyId: str(j.key_id),
+      keyName: displayText(j.key_name),
+      org: org(j.org),
+      permissions: permissions(j.permissions),
+      approvedBy: displayText(j.approved_by),
+    };
+  }
+  if (r.status === 410) return { kind: "expired" };
+  if (r.status === 403 && j.error === "approval_revoked") return { kind: "revoked" };
+  if (r.status >= 500) return { kind: "unreachable", reason: `the server answered ${r.status}` };
+  return {
+    kind: "refused",
+    reason: displayText(j.status, 40) ? `the login request is ${displayText(j.status, 40)}` : `the server answered ${r.status}`,
+  };
+}
diff --git a/src/hooks/configure-wizard.ts b/src/hooks/configure-wizard.ts
index e62a21c99..5c01de189 100644
--- a/src/hooks/configure-wizard.ts
+++ b/src/hooks/configure-wizard.ts
@@ -30,20 +30,26 @@ import { dirname, resolve, sep } from "node:path";
 import { CORE_SOURCE } from "./pack-store";
 
 import {
+  BACK,
   collapseAfter,
   colorsEnabled,
   multiSelect,
   OPEN_SOURCE,
   optsFor,
   paint,
+  promptBrowserLogin,
   promptCloudKey,
   screenKit,
+  selectOne,
   type CloudKeyAnswer,
   type MultiChoice,
   type OpenSource,
+  type SelectChoice,
   type TTYIn,
   type TTYOut,
 } from "./tui";
+import { claimLogin, machineOs, pollLogin, startLogin, type LoginOrg } from "./cloud-login";
+import { canOpenBrowser, openUrl } from "../audit/open-browser";
 import {
   DEFAULT_INGEST_URL,
   readIngestCredential,
@@ -56,6 +62,7 @@ import {
 } from "./integrations";
 import { INTEGRATION_TYPES, type IntegrationType, type HookScope } from "./types";
 import { enforcingPolicyCount, installHooks, notEnforcingReason } from "./manager";
+import { installAgentSkill } from "./agent-skill";
 import {
   CODEX_UNTRUSTED_NOTICE,
   codexHookTrust,
@@ -998,6 +1005,195 @@ export async function runConfigureWizard(
       stdout,
     });
 
+  // A key typed after picking "Paste an API key" from the menu. Same field as
+  // above minus the saved key, which the menu already offered as "keep"; Tab is
+  // the way back to the menu, so it never means open source here.
+  const askKey = (): Promise<CloudKeyAnswer | OpenSource | null> =>
+    promptCloudKey({
+      message: "Connect to cloud",
+      meta: source ? `${host}  ·  from ${source}` : host,
+      tabHint: "go back",
+      emptyError: "Paste a key, or press tab to go back.",
+      check: async (key) => {
+        if (!url) return { ok: false, line: badUrl ?? "No usable endpoint." };
+        const r = await checkCloudKey(url, key);
+        if (r.ok) {
+          typedOrg = r.org;
+          return { ok: true, line: r.note };
+        }
+        return { ok: false, line: r.refused ? `That key was refused: ${r.reason}.` : `Couldn't check the key: ${r.reason}.` };
+      },
+      collapsed: (answer) => (answer === OPEN_SOURCE ? [] : [...cloudLines(planFor(answer)), ""]),
+      stdin,
+      stdout,
+    });
+
+  // The browser login. Resolves the approval, BACK for the menu of other
+  // options (Tab / Esc, or a cloud that cannot do this), or null when the person
+  // cancelled the whole run.
+  type Approval = Extract<CloudPlan, { kind: "login" }>;
+  // Set once the cloud says it has no browser login; the menu then drops it.
+  let loginUnsupported = false;
+  const askLogin = (endpoint: string): Promise<{ value: Approval } | typeof BACK | null> => {
+    let pollSecret = "";
+    return promptBrowserLogin<Approval>({
+      message: "Connect to cloud",
+      meta: source ? `${host}  ·  from ${source}` : host,
+      machineLabel,
+      start: async () => {
+        const r = await startLogin(endpoint, { label: machineLabel, os: machineOs(), cliVersion });
+        if (r.kind === "ok") {
+          pollSecret = r.pollSecret;
+          void emit("configure_cloud_login", { step: "started" });
+          return { ok: true, url: r.verificationUrl, expiresIn: r.expiresIn, interval: r.interval };
+        }
+        if (r.kind === "unsupported") {
+          void emit("configure_cloud_login", { step: "unsupported" });
+          loginUnsupported = true;
+          return { ok: false, retryable: false, line: `${host} doesn't support logging in from here yet.` };
+        }
+        return {
+          ok: false,
+          retryable: true,
+          line: r.kind === "refused" ? `Couldn't start the login: ${r.reason}.` : `Couldn't reach ${host}: ${r.reason}.`,
+        };
+      },
+      poll: async () => {
+        const p = await pollLogin(endpoint, pollSecret);
+        switch (p.kind) {
+          case "approved":
+            void emit("configure_cloud_login", { step: "approved" });
+            return {
+              state: "approved",
+              value: {
+                kind: "login",
+                pollSecret,
+                org: p.org,
+                approvedBy: p.approvedBy,
+                keyName: p.keyName,
+                permissions: p.permissions,
+              },
+            };
+          case "pending":
+            return { state: "pending", interval: p.interval };
+          case "slow_down":
+            return { state: "slow_down" };
+          case "denied":
+            void emit("configure_cloud_login", { step: "denied" });
+            return { state: "denied" };
+          case "unreachable":
+            return { state: "unreachable", line: p.reason };
+          // Expired, already claimed, or swept: in every case this link is done.
+          default:
+            return { state: "expired" };
+        }
+      },
+      open: (link) => {
+        if (!canOpenBrowser()) return false;
+        openUrl(link);
+        return true;
+      },
+      collapsed: (plan) => [...cloudLines(plan), ""],
+      stdin,
+      stdout,
+    });
+  };
+
+  // Whether the saved key was refused when the CONNECT step checked it — still
+  // true at the end of the run if a login there created no key.
+  let savedRefused = false;
+
+  // The interactive CONNECT step. A machine with no connection, or whose saved
+  // key is refused, starts the browser login straight away — Tab or Esc there
+  // opens the other options. A machine that is connected with a working key gets
+  // the menu, "keep" first, so re-running config never opens a browser by itself.
+  const chooseConnection = async (): Promise<CloudPlan | null> => {
+    const verdict =
+      saved && !saved.splitKeys
+        ? await transient("Checking your saved key…", () => checkCloudKey(saved.url, saved.token))
+        : null;
+    const savedBroken = verdict !== null && !verdict.ok && verdict.refused;
+    savedRefused = savedBroken;
+    const keptPlan: CloudPlan =
+      verdict && verdict.ok
+        ? { kind: "kept", how: "saved", verified: true }
+        : verdict && !verdict.refused
+          ? { kind: "kept", how: "saved", verified: false }
+          : { kind: "kept", how: "skip", verified: false };
+    const keepHint = !saved
+      ? ""
+      : saved.splitKeys
+        ? "leave both keys as they are"
+        : verdict?.ok
+          ? `${verdict.org ?? saved.org ?? hostOf(saved.url)} · key ${maskToken(saved.token)}`
+          : savedBroken
+            ? "its key no longer works"
+            : "its key couldn't be checked just now";
+
+    type Pick = "login" | "key" | "oss" | "keep";
+    const login: SelectChoice<Pick> = {
+      label: saved ? "Log in again" : "Log in to FailproofAI Cloud",
+      value: "login",
+      hint: savedBroken
+        ? "recommended · your saved key no longer works"
+        : saved
+          ? "opens your browser and makes a new key"
+          : "recommended · opens your browser",
+    };
+    const key: SelectChoice<Pick> = { label: "Paste an API key", value: "key", hint: "one you already have" };
+    const oss: SelectChoice<Pick> = { label: "Use open source", value: "oss", hint: "skip the cloud" };
+    const keep: SelectChoice<Pick> = { label: "Keep current connection", value: "keep", hint: keepHint };
+    // No initial-cursor option on selectOne: the default is whatever is first.
+    const choices = !saved ? [login, key, oss] : savedBroken ? [login, key, keep] : [keep, login, key];
+    const leftLogin = (result: Awaited<ReturnType<typeof askLogin>>): CloudPlan | null | typeof BACK => {
+      if (result === null || result === BACK) {
+        if (result === BACK && loginUnsupported) {
+          write([kit.caution(`${host} doesn't support logging in from here yet. Paste an API key instead.`), ""]);
+        }
+        return result;
+      }
+      return result.value;
+    };
+
+    if (url && (!saved || savedBroken)) {
+      if (savedBroken && verdict && !verdict.ok) {
+        write([kit.caution(`Your saved key no longer works: ${verdict.reason}. Logging in again.`)]);
+      }
+      void emit("configure_cloud_choice", { choice: "login", connected: Boolean(saved), auto: true });
+      const first = leftLogin(await askLogin(url));
+      if (first !== BACK) return first;
+    }
+
+    for (;;) {
+      const pick = await selectOne<Pick>({
+        message: "Connect to cloud",
+        meta: source ? `${host}  ·  from ${source}` : host,
+        choices: loginUnsupported ? choices.filter((c) => c.value !== "login") : choices,
+        collapsed: (p) =>
+          p === "keep" ? [...cloudLines(keptPlan), ""] : p === "oss" ? [...cloudLines({ kind: "oss" }), ""] : [],
+        stdin,
+        stdout,
+      });
+      if (pick === null) return null;
+      void emit("configure_cloud_choice", { choice: pick, connected: Boolean(saved) });
+      if (pick === "keep") return keptPlan;
+      if (pick === "oss") return { kind: "oss" };
+      if (pick === "key") {
+        const answer = await askKey();
+        if (answer === null) return null;
+        if (answer === OPEN_SOURCE) continue;
+        return planFor(answer);
+      }
+      if (!url) {
+        write([kit.fail(badUrl ?? "No usable endpoint."), ""]);
+        continue;
+      }
+      const result = leftLogin(await askLogin(url));
+      if (result === BACK) continue;
+      return result;
+    }
+  };
+
   let cloud: CloudPlan;
   if (answers.oss) {
     cloud = saved ? { kind: "kept", how: "skip", verified: false } : { kind: "oss" };
@@ -1032,11 +1228,12 @@ export async function runConfigureWizard(
     cloud = saved ? { kind: "kept", how: "skip", verified: false } : { kind: "oss" };
     write([...cloudLines(cloud), ""]);
   } else {
-    // Said above the field, which stays usable for Tab and a saved key.
+    // Said above the menu, which stays usable for keeping a saved key and for
+    // open source, neither of which sends anything anywhere.
     if (badUrl) write([kit.fail(badUrl)]);
-    const answer = await askCloud();
-    if (answer === null) return cancel();
-    cloud = planFor(answer);
+    const chosen = await chooseConnection();
+    if (chosen === null) return cancel();
+    cloud = chosen;
   }
 
   // ── AGENTS ──────────────────────────────────────────────────────────────────
@@ -1049,8 +1246,10 @@ export async function runConfigureWizard(
   // Whether the daemon will be collecting once this run ends: a key is already
   // on disk, or this run writes one. Removal copy and the backfill request both
   // depend on it.
-  const collectingAfter = cloud.kind === "connect" || readIngestCredential() !== null;
-  const sessionsOn = cloud.kind === "connect" ? answers.noTranscripts !== true : fp.collector.sessions === true;
+  // A browser login connects exactly like a pasted key, one step later.
+  const connecting = cloud.kind === "connect" || cloud.kind === "login";
+  const collectingAfter = connecting || readIngestCredential() !== null;
+  const sessionsOn = connecting ? answers.noTranscripts !== true : fp.collector.sessions === true;
 
   let selected: IntegrationType[];
   if (answers.agents && answers.agents.length > 0) {
@@ -1105,6 +1304,37 @@ export async function runConfigureWizard(
   //  5. The connection last.
   const done: string[] = [];
   let daemonInstalled = daemonAlreadyRunning;
+  // The `sudo -v` at the top cached root for sudo's timeout — five minutes by
+  // default on macOS, fifteen on most Linux. A browser login, or simply a slow
+  // agents screen, can outlast it, and the install below runs `sudo -n`, which
+  // would then fail AFTER the person did everything else. Ask once more instead.
+  // The stale-unit refresh runs `sudo -n` too, so it is asked for the same way —
+  // but, as at the top, losing root there costs the scheduled audit, not setup.
+  // Unattended runs never primed anything, so there is nothing to have expired.
+  if ((daemonWanted || daemonUnitStale) && !unattended) {
+    let stillRoot = false;
+    try {
+      stillRoot = canElevate();
+    } catch {
+      stillRoot = false;
+    }
+    if (!stillRoot && daemonWanted) {
+      if (!elevate("Your sudo session expired while you were away. Installing failproofaid needs root again.")) {
+        write([
+          kit.fail("Couldn't get root, so setup stopped before changing anything."),
+          `  Re-run once you can use sudo:  ${kit.cmd("failproofai config")}`,
+        ]);
+        void emit("configure_aborted", { reason: "needs_root" });
+        return { applied: false, abort: "needs_root" };
+      }
+    } else if (
+      !stillRoot &&
+      !elevate("Your sudo session expired while you were away. Refreshing failproofaid's service definition needs root again.")
+    ) {
+      done.push(kit.caution("No root, so its service definition stays as it is. Scheduled audits stay off until it is refreshed."));
+      daemonUnitStale = false;
+    }
+  }
   if (daemonWanted) {
     // A unit that is running but cannot answer is torn down before it is
     // rebuilt: it holds the singleton flock the replacement needs, so
@@ -1214,24 +1444,6 @@ export async function runConfigureWizard(
     pruneOldDaemonBinaries();
   }
 
-  const connectedAfterPlan = cloud.kind === "connect" || cloud.kind === "kept";
-  // Telemetry runs concurrently with the rest of apply (never rejects,
-  // 5s-bounded) and is awaited before returning. `cli` carries the selected
-  // agent ids, as it always has (and as hooks_installed does): a fixed list of
-  // product ids, never user content. The agents_* fields add counts only.
-  const applied = emit("configure_applied", {
-    target: "user",
-    scopes: ["user"],
-    cli: selected,
-    cli_count: selected.length,
-    policy_count: (readScopedHooksConfig("user", cwd).enabledPolicies ?? []).length,
-    connected: cloud.kind === "connect",
-    mode: connectedAfterPlan ? "cloud" : "oss",
-    agents_selected: selected.length,
-    agents_detected: plan.detected.size,
-    agents_changed: added.length + removed.length > 0,
-  });
-
   // Hooks, at user scope, for the chosen agents. Whatever policies are enabled
   // there are carried through untouched: `replace: true` would otherwise switch
   // off policies the user had turned on, and setup must never reduce
@@ -1259,6 +1471,11 @@ export async function runConfigureWizard(
     cwd,
   );
 
+  // The failproofai skill, in every agent this machine has and any ticked
+  // without being detected — traced or not, an agent asked about FailproofAI
+  // should know it. A pointer to the skill online (see agent-skill.ts).
+  installAgentSkill(INTEGRATION_TYPES.filter((id) => plan.detected.has(id) || selected.includes(id)));
+
   // Agents traced again start fresh (see `requestFreshStart`). Only on a
   // rerun: its baseline is the selection the daemon actually filtered on. With
   // no saved list (upgrade, first) the daemon was collecting every agent, so an
@@ -1273,8 +1490,38 @@ export async function runConfigureWizard(
   // a key on disk doing nothing. `connectToCloud` re-verifies each capability
   // and writes only what works.
   let connected = false;
-  if (cloud.kind === "connect" && url) {
-    const token = cloud.token;
+  // A browser login has an approval, not a key: claim it NOW, with the daemon
+  // in, so a run that stopped earlier left nothing minted anywhere. The claim
+  // is single-use — the server mints the key and hands it over exactly once.
+  let token: string | null = cloud.kind === "connect" ? cloud.token : null;
+  let orgLabel: string | undefined = cloud.kind === "connect" ? cloud.org : undefined;
+  let mintedName: string | undefined;
+  let claimedOrg: LoginOrg | undefined;
+  if (cloud.kind === "login" && url) {
+    const claimed = await transient("Creating this machine's key…", () => claimLogin(url, cloud.pollSecret));
+    void emit("configure_cloud_login", { step: "claimed", ok: claimed.kind === "ok", reason: claimed.kind });
+    if (claimed.kind === "ok") {
+      token = claimed.key;
+      orgLabel = loginOrgLabel(claimed.org);
+      mintedName = claimed.keyName;
+      claimedOrg = claimed.org;
+    } else {
+      hookLogWarn(`cloud login could not be completed: ${claimed.kind}`);
+      done.push(
+        kit.caution(
+          claimed.kind === "expired"
+            ? "The login took too long to finish, so no key was created. Everything else was applied."
+            : claimed.kind === "revoked"
+              ? "Whoever approved the login can no longer create keys in that org, so no key was created."
+              : claimed.kind === "unreachable"
+                ? `Couldn't reach ${host} to create the key (${claimed.reason}); everything else was applied.`
+                : `The key couldn't be created: ${claimed.reason}. Everything else was applied.`,
+          "failproofai config",
+        ),
+      );
+    }
+  }
+  if (token && url) {
     try {
       const outcome = await transient("Connecting…", () =>
         connectToCloud({
@@ -1284,11 +1531,18 @@ export async function runConfigureWizard(
           machineLabel,
           // Both streams unless the run said `--no-transcripts`.
           sessions: answers.noTranscripts !== true,
+          // The org the login was approved into, for when introspect can't say.
+          org: claimedOrg,
         }),
       );
       connected = outcome.anyConfigured;
       done.push(...(outcome.changes ?? []));
-      done.push(...connectDoneLines(kit, outcome, host, cloud.org));
+      done.push(...connectDoneLines(kit, outcome, host, orgLabel));
+      // Logging in again makes a NEW key; the one this machine held keeps
+      // working until someone revokes it. Said here, where it is still useful.
+      if (cloud.kind === "login" && saved && connected) {
+        done.push(`  Your previous key for this machine still works until you revoke it on ${host}'s keys page.`);
+      }
       if (outcome.ingest.ok && answers.noTranscripts === true) {
         done.push("  Decisions only: session transcripts are not sent (--no-transcripts).");
       }
@@ -1298,13 +1552,49 @@ export async function runConfigureWizard(
       hookLogWarn(`cloud connection was not written: ${err instanceof Error ? err.message : String(err)}`);
       done.push(kit.caution("Couldn't connect; everything else was applied.", "failproofai config"));
     }
+    // The claim spent the approval and the key exists, but nothing here uses
+    // it: say which one, so it can be revoked rather than left live.
+    if (cloud.kind === "login" && !connected) {
+      done.push(`  The key ${mintedName ? `"${mintedName}" ` : ""}was created but isn't in use here; revoke it on ${host}'s keys page.`);
+    }
   } else if (cloud.kind === "kept" && cloud.how === "saved" && fp.mode !== "cloud") {
     // A home migrated from layout 1 carries keys but no mode, and would read
     // as open source everywhere that asks.
     updateConfig({ mode: "cloud" });
   }
 
-  await applied;
+  // Logging in again on a connected machine, with nothing connected at the end
+  // of it — no key, or a key `connectToCloud` could not use, which writes
+  // nothing — changed nothing about the connection: the previous one is still
+  // there (never removed from this step, decision D4) — but not as if it worked
+  // when its key was refused.
+  const keptOld = cloud.kind === "login" && !connected && Boolean(saved);
+  if (keptOld) {
+    done.push(
+      savedRefused
+        ? "  This machine keeps its previous connection, but its key no longer works. Run failproofai config again to log in."
+        : "  This machine keeps its previous connection.",
+    );
+  }
+  const cloudAfter = connected || cloud.kind === "kept" || keptOld;
+
+  // Sent once the connection's outcome is known — a login whose claim then
+  // failed must not count as connected. Never rejects, 5s-bounded. `cli`
+  // carries the selected agent ids, as it always has (and as hooks_installed
+  // does): a fixed list of product ids, never user content. The agents_*
+  // fields add counts only.
+  await emit("configure_applied", {
+    target: "user",
+    scopes: ["user"],
+    cli: selected,
+    cli_count: selected.length,
+    policy_count: policies.length,
+    connected,
+    mode: cloudAfter ? "cloud" : "oss",
+    agents_selected: selected.length,
+    agents_detected: plan.detected.size,
+    agents_changed: added.length + removed.length > 0,
+  });
   // Only now — a completed apply — is the launcher considered "seen", so
   // first-run onboarding stops offering itself on every command.
   markLauncherSeen();
@@ -1321,7 +1611,7 @@ export async function runConfigureWizard(
       done,
       cwd,
       agents: selected.length,
-      connected: connected || cloud.kind === "kept",
+      connected: cloudAfter,
       codexTrust,
     }),
   );
@@ -1334,7 +1624,7 @@ export async function runConfigureWizard(
     policies,
     daemonInstalled,
     connected,
-    mode: connected || cloud.kind === "kept" ? "cloud" : "oss",
+    mode: cloudAfter ? "cloud" : "oss",
     agents: { selected, added, removed },
   };
 }
@@ -1345,7 +1635,19 @@ export async function runConfigureWizard(
 type CloudPlan =
   | { kind: "oss" }
   | { kind: "kept"; how: "skip" | "saved"; verified: boolean }
-  | { kind: "connect"; token: string; org?: string; note?: string };
+  | { kind: "connect"; token: string; org?: string; note?: string }
+  /**
+   * Approved in the browser, not yet claimed. The key does not exist until
+   * apply claims it — after the daemon is in — so a run that stops before then
+   * leaves no key behind anywhere.
+   */
+  | { kind: "login"; pollSecret: string; org: LoginOrg; approvedBy?: string; keyName?: string; permissions: string[] };
+
+/** "Acme (acme)", or whichever half the server sent. */
+function loginOrgLabel(org: LoginOrg): string {
+  if (org.name && org.slug) return `${org.name} (${org.slug})`;
+  return org.name ?? org.slug ?? "your org";
+}
 
 /**
  * The connection already on this machine, from either credential: the policy
@@ -1394,7 +1696,15 @@ export function resolveCloudUrl(
   const env = process.env.FAILPROOFAI_CLOUD_URL?.trim();
   const fromFlag = flag?.trim();
   const override = fromFlag || env;
-  if (!override) return { ok: true, url: existing ?? cloudBaseFor(DEFAULT_INGEST_URL) };
+  if (!override) {
+    if (!existing) return { ok: true, url: cloudBaseFor(DEFAULT_INGEST_URL) };
+    // Checked like a typed one: login sends its secret and receives a key here
+    // before anything else would, and the file it came from can be edited.
+    const saved = validateCloudUrl(existing);
+    return saved.ok
+      ? { ok: true, url: existing }
+      : { ok: false, message: `the saved cloud address "${existing}" cannot be used: ${saved.reason}` };
+  }
   const source = fromFlag && fromFlag !== env ? "--url" : "FAILPROOFAI_CLOUD_URL";
   const validated = validateCloudUrl(cloudBaseFor(override));
   if (!validated.ok) {
@@ -1430,6 +1740,11 @@ export async function checkCloudKey(
   url: string,
   key: string,
 ): Promise<{ ok: true; org?: string; note?: string } | { ok: false; refused: boolean; reason: string }> {
+  // Checked here rather than trusted: a saved address comes from a file that
+  // can be edited, and an http one to another host would carry the key in
+  // the clear. Not a verdict on the key, so not `refused`.
+  const target = validateCloudUrl(url);
+  if (!target.ok) return { ok: false, refused: false, reason: `the address ${url} can't be used: ${target.reason}` };
   const identity = await introspectKey(url, key);
   if (identity.kind === "rejected") return { ok: false, refused: true, reason: "the server did not accept it" };
   if (identity.kind === "unreachable") return { ok: false, refused: false, reason: identity.reason };
@@ -1477,6 +1792,15 @@ export function cloudCollapsedLines(
         kit.ok(plan.org ? `Key accepted for ${plan.org} on ${at.host}` : `Key accepted by ${at.host}`),
         ...(plan.note ? [kit.caution(plan.note)] : []),
       ];
+    case "login":
+      // Who approved it is said out loud: a link someone else approved into
+      // THEIR org would otherwise connect this machine there unnoticed.
+      return [
+        head,
+        kit.ok(
+          `Logged in${plan.approvedBy ? ` as ${plan.approvedBy}` : ""} · ${loginOrgLabel(plan.org)} on ${at.host}`,
+        ),
+      ];
   }
 }
 
diff --git a/src/hooks/tui.ts b/src/hooks/tui.ts
index e65c24600..7c7071927 100644
--- a/src/hooks/tui.ts
+++ b/src/hooks/tui.ts
@@ -1348,6 +1348,286 @@ export function promptCloudKey(opts: CloudKeyPromptOptions): Promise<CloudKeyAns
   });
 }
 
+/** What starting a browser login produced. */
+export type BrowserLoginStart =
+  | { ok: true; url: string; expiresIn: number; interval: number }
+  /** `retryable` is false when trying again cannot help — an older server. The
+   *  screen then leaves at once (`BACK`), so `line` is for the caller to show. */
+  | { ok: false; line: string; retryable: boolean };
+
+/** One "approved yet?" answer. */
+export type BrowserLoginPoll<T> =
+  | { state: "pending"; interval?: number }
+  | { state: "slow_down" }
+  | { state: "approved"; value: T }
+  | { state: "denied" }
+  | { state: "expired" }
+  /** Could not ask. Polling goes on: a dropped connection is not a refusal. */
+  | { state: "unreachable"; line: string };
+
+export interface BrowserLoginOptions<T> {
+  /** The heading, e.g. "Connect to cloud". */
+  message: string;
+  /** Grey text after the heading: the host the login goes to. */
+  meta?: string;
+  /** What is being connected, as the link and the browser page will name it. */
+  machineLabel: string;
+  start: () => Promise<BrowserLoginStart>;
+  poll: () => Promise<BrowserLoginPoll<T>>;
+  /** Try to open the link; false means "print it, do not open" (SSH, no display). */
+  open: (url: string) => boolean;
+  /** The lines the screen collapses to once approved. */
+  collapsed: (value: T) => string[];
+  stdin?: TTYIn;
+  stdout?: TTYOut;
+  /** Injectable clock, for tests. */
+  now?: () => number;
+}
+
+/** The poll interval after a `slow_down`: two seconds slower, up to 10 — and
+ *  never faster, so a server already asking for more than 10 keeps its number. */
+export function slowedDown(interval: number): number {
+  return Math.max(interval, Math.min(10, interval + 2));
+}
+
+/**
+ * Wait for a person to finish logging in, in a browser.
+ *
+ * Gets a link, opens it (or prints it where a browser cannot be opened — the
+ * link works from any device, so an SSH session needs nothing else), then polls
+ * until the request is approved, refused or expired. Nothing is typed here: the
+ * account side happens entirely in the browser.
+ *
+ * Resolves `{ value }` once approved, `BACK` on Tab or Esc (the caller's menu
+ * of other options is the way on), or `null` on Ctrl-C. An expired or refused
+ * link offers a fresh one on Enter rather than ending the screen. A start that
+ * cannot work here (`retryable: false`) resolves `BACK` straight away: there is
+ * nothing to retry, so the caller says why above its options.
+ *
+ * The link is printed ABOVE the live region, not inside it: the region is
+ * repainted and cut to the terminal width, and a link that is cut cannot be
+ * clicked or copied. Leaving with `BACK` erases it again, wrapped rows
+ * included: a link nobody is polling any more must not sit above the menu
+ * looking live.
+ */
+export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ value: T } | Back | null> {
+  const stdin: TTYIn = opts.stdin ?? process.stdin;
+  const stdout: TTYOut = opts.stdout ?? process.stdout;
+  if (!stdin.isTTY || !stdout.isTTY) return Promise.resolve(null);
+
+  const now = opts.now ?? Date.now;
+  const c = paint(colorsEnabled(stdout));
+  const kit = screenKit({ cols: stdout.columns || 80, color: colorsEnabled(stdout) });
+  const spinnerFrames = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏";
+  const region: Region = { lastCount: 0 };
+
+  type Phase = "starting" | "waiting" | "expired" | "denied" | "failed";
+  let phase: Phase = "starting";
+  let failLine = "";
+  let cautionLine = "";
+  let expiresAt = 0;
+  let interval = 2;
+  let frame = 0;
+  let settled = false;
+  let headingShown = false;
+  // Lines printed above the region (heading + links), so BACK can take them
+  // away too. Counted in rows at the width when leaving, not when printed: a
+  // terminal that was resized meanwhile has re-wrapped them.
+  const above: string[] = [];
+  let pollTimer: ReturnType<typeof setTimeout> | null = null;
+  let spinTimer: ReturnType<typeof setInterval> | null = null;
+  // Bumped on every new link, so a poll answer for an abandoned link is ignored.
+  let attempt = 0;
+
+  const countdown = (): string => {
+    const left = Math.max(0, Math.ceil((expiresAt - now()) / 1000));
+    return `${Math.floor(left / 60)}:${String(left % 60).padStart(2, "0")}`;
+  };
+
+  const build = (): string[] => {
+    const spin = c.ink3(spinnerFrames[frame % spinnerFrames.length]);
+    switch (phase) {
+      case "starting":
+        return [`${INDENT}${spin} Getting a link…`];
+      case "waiting":
+        return [
+          `${INDENT}${spin} Waiting for you to authorize in the browser  ${c.ink3(`· expires in ${countdown()}`)}`,
+          ...(cautionLine ? [kit.caution(cautionLine)] : []),
+          "",
+          kit.keys(["tab more options", "ctrl-c cancel"]),
+        ];
+      case "expired":
+        return [kit.fail("That link expired."), "", kit.keys(["enter new link", "tab more options"])];
+      case "denied":
+        return [kit.fail("Not authorized in the browser."), "", kit.keys(["enter try again", "tab more options"])];
+      case "failed":
+        return [kit.fail(failLine), "", kit.keys(["enter try again", "tab more options"])];
+    }
+  };
+
+  const draw = (): void => {
+    if (settled) return;
+    // Until a link has been printed above (which carries the heading), the
+    // heading lives in the region — so it shows while starting, and above a
+    // failure to start.
+    repaint(stdout, region, headingShown ? build() : [promptHeading(c, opts.message, opts.meta), ...build()]);
+  };
+
+  /** Write lines above the live region, where nothing repaints or cuts them. */
+  const printAbove = (lines: string[]): void => {
+    const clear = region.lastCount > 0 ? `${ESC}[${region.lastCount}A${ESC}[J` : "";
+    stdout.write(`${clear}${lines.join("\n")}\n`);
+    region.lastCount = 0;
+    above.push(...lines);
+  };
+
+  /** Fold what was printed above into the region, so the next repaint erases
+   *  it too — the heading goes with it and returns to the region. */
+  const forgetAbove = (): void => {
+    const cols = stdout.columns || 80;
+    for (const line of above) region.lastCount += Math.max(1, Math.ceil(visibleWidth(line) / cols));
+    above.length = 0;
+    headingShown = false;
+  };
+
+  const clearPoll = (): void => {
+    if (pollTimer) clearTimeout(pollTimer);
+    pollTimer = null;
+  };
+
+  const restoreTerminal = (): void => showCursor(stdout);
+
+  return new Promise((resolve) => {
+    const wasRaw = stdin.isRaw;
+
+    const finish = (answer: { value: T } | Back | null): void => {
+      if (settled) return;
+      clearPoll();
+      if (spinTimer) clearInterval(spinTimer);
+      stdin.removeListener("keypress", onKey);
+      stdin.setRawMode?.(wasRaw ?? false);
+      stdin.pause();
+      process.removeListener("exit", restoreTerminal);
+      // Leaving for the menu takes the printed link with it.
+      if (answer === BACK) forgetAbove();
+      const lines =
+        answer === null
+          ? [c.ink3("cancelled")]
+          : answer === BACK
+            ? []
+            : opts.collapsed(answer.value);
+      repaint(stdout, region, lines, { cut: false });
+      settled = true;
+      restoreTerminal();
+      resolve(answer);
+    };
+
+    const schedulePoll = (forAttempt: number): void => {
+      clearPoll();
+      pollTimer = setTimeout(() => void pollOnce(forAttempt), interval * 1000);
+    };
+
+    const pollOnce = async (forAttempt: number): Promise<void> => {
+      let answer: BrowserLoginPoll<T>;
+      try {
+        answer = await opts.poll();
+      } catch (err) {
+        answer = { state: "unreachable", line: err instanceof Error ? err.message : String(err) };
+      }
+      if (settled || forAttempt !== attempt) return;
+      switch (answer.state) {
+        case "approved":
+          return finish({ value: answer.value });
+        case "denied":
+          phase = "denied";
+          return draw();
+        case "expired":
+          phase = "expired";
+          return draw();
+        case "slow_down":
+          interval = slowedDown(interval);
+          break;
+        case "unreachable":
+          cautionLine = `Can't reach the server right now (${answer.line}) — still trying.`;
+          break;
+        case "pending":
+          cautionLine = "";
+          if (answer.interval && answer.interval > 0) interval = answer.interval;
+          break;
+      }
+      // The server is the authority on expiry, but a link that is past it by
+      // our own clock too is not worth another round trip.
+      if (now() > expiresAt + interval * 1000) {
+        phase = "expired";
+        return draw();
+      }
+      draw();
+      schedulePoll(forAttempt);
+    };
+
+    const begin = async (): Promise<void> => {
+      const mine = ++attempt;
+      clearPoll();
+      cautionLine = "";
+      phase = "starting";
+      // A retry: the expired or refused link is dead, so it leaves the screen
+      // rather than sit above the new one, where it could still be opened.
+      forgetAbove();
+      draw();
+      let started: BrowserLoginStart;
+      try {
+        started = await opts.start();
+      } catch (err) {
+        started = { ok: false, line: err instanceof Error ? err.message : String(err), retryable: true };
+      }
+      if (settled || mine !== attempt) return;
+      if (!started.ok) {
+        if (!started.retryable) return finish(BACK);
+        phase = "failed";
+        failLine = started.line;
+        return draw();
+      }
+      expiresAt = now() + started.expiresIn * 1000;
+      interval = started.interval > 0 ? started.interval : 2;
+      const opened = opts.open(started.url);
+      printAbove([
+        ...(headingShown ? [] : [promptHeading(c, opts.message, opts.meta)]),
+        opened
+          ? `${INDENT}Opening your browser to connect ${opts.machineLabel}. If it doesn't open, use this link:`
+          : `${INDENT}Open this link in any browser to connect ${opts.machineLabel}:`,
+        `${INDENT}${c.bold(started.url)}`,
+        "",
+      ]);
+      headingShown = true;
+      phase = "waiting";
+      draw();
+      schedulePoll(mine);
+    };
+
+    function onKey(_str: string | undefined, key: readline.Key): void {
+      if (!key || settled) return;
+      if (key.ctrl && (key.name === "c" || key.name === "d")) return finish(null);
+      if (key.name === "escape" || key.name === "tab") return finish(BACK);
+      if ((key.name === "return" || key.name === "enter") && phase !== "waiting" && phase !== "starting") {
+        void begin();
+      }
+    }
+
+    process.once("exit", restoreTerminal);
+    readline.emitKeypressEvents(stdin);
+    stdin.setRawMode?.(true);
+    stdin.resume();
+    hideCursor(stdout);
+    stdin.on("keypress", onKey);
+    spinTimer = setInterval(() => {
+      frame++;
+      if (phase === "waiting" || phase === "starting") draw();
+    }, 120);
+    spinTimer.unref?.();
+    void begin();
+  });
+}
+
 // ── the kit ──────────────────────────────────────────────────────────────────
 /**
  * The block builders every PRINTED surface is assembled from.
diff --git a/src/hooks/uninstall-cli.ts b/src/hooks/uninstall-cli.ts
index 8d610026b..2296fdd8b 100644
--- a/src/hooks/uninstall-cli.ts
+++ b/src/hooks/uninstall-cli.ts
@@ -47,6 +47,7 @@ import {
 import { listInstallableIds, getIntegration } from "./integrations";
 import type { IntegrationType } from "./types";
 import { removeHooks } from "./manager";
+import { installedAgentSkillDirs, removeAgentSkill } from "./agent-skill";
 import { CODEX_MANAGED_BEGIN, CODEX_MANAGED_END, codexSystemConfigPath, codexSystemHooksPresent } from "./codex-system-hooks";
 import { optsFor, screenKit, type RenderOpts } from "./tui";
 
@@ -110,6 +111,8 @@ export interface UninstallResult {
 /** Everything this machine has that uninstalling would remove. */
 interface Leftovers {
   clis: IntegrationType[];
+  /** The failproofai skill folders `config` wrote into agents. */
+  skillDirs: string[];
   /** failproofai's block in Codex's system config, which only root can remove. */
   codexSystemPath: string | null;
   servicePath: string | null;
@@ -149,6 +152,7 @@ function survey(cwd?: string): Leftovers {
   const servicePath = isDaemonSupportedPlatform() ? daemonServiceFilePath() : null;
   return {
     clis,
+    skillDirs: installedAgentSkillDirs(),
     codexSystemPath: codexSystemHooksPresent() ? codexSystemConfigPath() : null,
     servicePath,
     serviceInstalled: !!servicePath && existsSync(servicePath),
@@ -166,7 +170,7 @@ export async function runUninstallCommand(opts: UninstallOptions = {}): Promise<
   const lines: string[] = [];
 
   const nothingToDo =
-    found.clis.length === 0 && !found.serviceInstalled && !found.daemonConfigured &&
+    found.clis.length === 0 && found.skillDirs.length === 0 && !found.serviceInstalled && !found.daemonConfigured &&
     !(opts.purge && found.homeExists);
   if (nothingToDo) {
     return {
@@ -191,6 +195,7 @@ export async function runUninstallCommand(opts: UninstallOptions = {}): Promise<
   const purging = Boolean(opts.purge && found.homeExists);
   const removals: string[] = [];
   if (found.clis.length > 0) removals.push(`failproofai's hooks from ${many(found.clis.length, "agent")}`);
+  if (found.skillDirs.length > 0) removals.push(`the failproofai skill from ${many(found.skillDirs.length, "agent folder")}`);
   if (found.serviceInstalled) removals.push("the failproofaid service (needs sudo)");
   if (purging) removals.push(home);
   const releasesDaemon = found.daemonConfigured && !found.serviceInstalled;
@@ -321,6 +326,12 @@ export async function runUninstallCommand(opts: UninstallOptions = {}): Promise<
     }
   }
 
+  if (found.skillDirs.length > 0) {
+    const left = found.skillDirs.length - removeAgentSkill().length;
+    if (left === 0) lines.push(kit.ok(`Removed the failproofai skill from ${many(found.skillDirs.length, "agent folder")}.`));
+    else failures.push(`Could not remove the failproofai skill from ${many(left, "agent folder")}:\n${installedAgentSkillDirs().join("\n")}`);
+  }
+
   if (found.serviceInstalled) {
     // Every run that gets here agreed to the whole plan, and the plan names the
     // service: `--yes` is yes to the plan, an interactive yes is the same answer