From 96ee8d73023c3619cf761722f6ddddede12fe783 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Tue, 20 Oct 2026 15:31:50 +0530
Subject: [PATCH 01/14] [failproofai-config-account-login] Log in to
 FailproofAI Cloud from `failproofai config`

The CONNECT step opens with a menu: log in through the browser (default),
paste an API key, or use open source. Logging in opens a link (or prints
it over SSH / with no display) where a person signs up or in, picks or
creates an org and authorizes the machine; the CLI polls with a secret
only it holds and shows who approved it, for which org. The key is
claimed at APPLY, after the daemon installs, so an abandoned run mints
nothing. A connected machine is offered "keep" first, or "log in again"
first when its saved key no longer works.

- src/hooks/cloud-login.ts: start / poll / claim against
  /api/auth/cli/*, injectable fetch, no redirects followed, only http(s)
  links ever handed to the opener; older clouds read as unsupported
- tui promptBrowserLogin: link printed above the live region (never cut),
  esc back, ctrl-c cancel, expiry/deny offer a new link, keeps polling
  through a dropped connection
- configure-wizard: Connect menu, claim at apply, re-login note, sudo
  re-asked at apply when the cache expired during the login
- open-browser: canOpenBrowser (false over SSH / no display), openUrl
  exported
- e2e harness __tests__/e2e/layout/cli-login.sh + pty driver
- docs: quickstart and CLI reference lead with the login

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                                 |   8 +
 __tests__/e2e/layout/README.md               |   6 +
 __tests__/e2e/layout/cli-login-driver.py     | 102 ++++++
 __tests__/e2e/layout/cli-login.sh            | 280 +++++++++++++++
 __tests__/hooks/browser-login-prompt.test.ts | 180 ++++++++++
 __tests__/hooks/cloud-login.test.ts          | 176 ++++++++++
 __tests__/hooks/configure-wizard.test.ts     | 343 +++++++++++++++++--
 docs/reference/failproof-cli.mdx             |   6 +-
 docs/start/quickstart.mdx                    |  29 +-
 src/audit/open-browser.ts                    |  20 +-
 src/hooks/cloud-login.ts                     | 223 ++++++++++++
 src/hooks/configure-wizard.ts                | 273 ++++++++++++++-
 src/hooks/tui.ts                             | 252 ++++++++++++++
 13 files changed, 1847 insertions(+), 51 deletions(-)
 create mode 100755 __tests__/e2e/layout/cli-login-driver.py
 create mode 100755 __tests__/e2e/layout/cli-login.sh
 create mode 100644 __tests__/hooks/browser-login-prompt.test.ts
 create mode 100644 __tests__/hooks/cloud-login.test.ts
 create mode 100644 src/hooks/cloud-login.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d4f9e68b9..a93bc905b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 ## 1.0.12-beta.0 — 2026-10-22
 
+### Features
+
+- **Log in to FailproofAI Cloud from `config`.** The connect step now opens with a menu: log in through the browser (the default), paste an API key, or use open source. Logging in opens a link — or prints it over SSH or with no display, to open on any device — where you sign up or sign in, pick or create an org, and authorize the machine; the terminal notices on its own and shows who approved it and for which org. The machine's key is created only when setup finishes, after the daemon is installed, so a run you abandon leaves no key behind. A machine that is already connected is offered "keep" first, or "log in again" first when its saved key no longer works. Needs a FailproofAI Cloud with browser login; an older one says so and pasting a key still works (#TBD)
+
+### Fixes
+
+- `config` asks for your sudo password again before installing the daemon when the one given at the start expired while you were answering (5 minutes on macOS by default), instead of failing after everything else was done (#TBD)
+
 ### Dependencies
 
 - Combine the open Dependabot PRs (#921, #922, #923) into one: `certifi` 2026.7.22 → 2026.10.19 (GHSA-6q48-6c7w-9gw2) in `fp-cloud-cli` and the Python SDK's test lockfile, and `vite` 8.3.0 → 8.3.4 in the TypeScript SDK's dev lockfile. The Supply Chain gate scans every lockfile, so none of the three could pass on its own (#926)
diff --git a/__tests__/e2e/layout/README.md b/__tests__/e2e/layout/README.md
index 8ec809f6b..ddb2c2d01 100644
--- a/__tests__/e2e/layout/README.md
+++ b/__tests__/e2e/layout/README.md
@@ -9,6 +9,7 @@ not depend on — so they are invoked deliberately.
 | `layout-reset.sh` | nothing | fresh/stale/future layout detection, reset semantics, OSS silence, hook warn-don't-delete-don't-deny |
 | `cloud-collector.sh` | an AgentEye stack | real connect against a live server, daemon + collector writing layout-2 paths, decisions reaching ClickHouse, disconnect back to OSS |
 | `systemd-service.sh` | Docker | REAL `systemctl enable --now` as root in a privileged container: service lifecycle, fail-closed, self-heal, reinstall |
+| `cli-login.sh` | an AgentEye stack (dashboard + mailpit + its Postgres), Docker, `bun run build` + the release daemon | `config`'s browser login through a real pty in a systemd container: approve, re-login, deny + retry, abandon after approval (no key minted), esc, expiry, revoked saved key, older server, and the person-side refusals (Origin, form posts, no session, start rate limit) |
 
 `systemd-service.sh` exists because the service half cannot be tested on a
 developer machine without a password prompt, and a container gives real systemd
@@ -31,6 +32,11 @@ Two things it caught that a mock could not:
 bash __tests__/e2e/layout/layout-reset.sh
 bash __tests__/e2e/layout/systemd-service.sh
 
+# cli-login.sh drives the real wizard against a running AgentEye; point it at
+# that stack's dashboard, mailpit API and Postgres container.
+DASH=http://localhost:3000 MAILPIT=http://localhost:8026 PG_CONTAINER=agenteye-postgres-1 \
+  bash __tests__/e2e/layout/cli-login.sh
+
 # cloud-collector.sh expects the stack on the remapped ports (18080/18123) so it
 # can run alongside an existing project rather than displacing it:
 docker compose -p aefpai -f docker-compose.yml -f ports.yml up -d
diff --git a/__tests__/e2e/layout/cli-login-driver.py b/__tests__/e2e/layout/cli-login-driver.py
new file mode 100755
index 000000000..45a465918
--- /dev/null
+++ b/__tests__/e2e/layout/cli-login-driver.py
@@ -0,0 +1,102 @@
+#!/usr/bin/env python3
+"""Drive `failproofai config` through a real pseudo-terminal, screen by screen.
+
+Used by cli-login.sh, inside the systemd container, as the unprivileged user.
+The wizard only offers browser login to a real terminal, so a pty is the only
+honest way to test it end to end.
+
+Usage: cli-login-driver.py <script> <transcript-file> <url-file> -- <command...>
+
+<script> is a comma-separated list of steps, each `wait:<text>` (block until
+the screen shows <text>), `key:<name>` (enter, down, up, esc, ctrl-c, tab),
+`url` (wait for the authorize link and write it to <url-file>), or
+`sleep:<seconds>`. Exit status is the command's own, or 124 on a timeout.
+"""
+import os
+import pty
+import re
+import select
+import sys
+import time
+
+KEYS = {
+    "enter": b"\r",
+    "down": b"\x1b[B",
+    "up": b"\x1b[A",
+    "esc": b"\x1b",
+    "ctrl-c": b"\x03",
+    "tab": b"\t",
+}
+ANSI = re.compile(rb"\x1b\[[0-9;?]*[A-Za-z]|\x1b[78]")
+LINK = re.compile(r"https?://\S+/cli/authorize\?r=[0-9a-f]{64}")
+STEP_TIMEOUT = float(os.environ.get("DRIVER_STEP_TIMEOUT", "60"))
+
+
+def main() -> int:
+    script, transcript_path, url_path = sys.argv[1], sys.argv[2], sys.argv[3]
+    cmd = sys.argv[sys.argv.index("--") + 1 :]
+    pid, fd = pty.fork()
+    if pid == 0:
+        os.environ["COLUMNS"] = "100"
+        os.execvp(cmd[0], cmd)
+
+    screen = b""
+    seen_from = 0  # `wait` only matches text that arrived after the last match
+
+    def pump(timeout: float) -> bool:
+        nonlocal screen
+        r, _, _ = select.select([fd], [], [], timeout)
+        if not r:
+            return True
+        try:
+            chunk = os.read(fd, 65536)
+        except OSError:
+            return False
+        if not chunk:
+            return False
+        screen += chunk
+        with open(transcript_path, "ab") as f:
+            f.write(chunk)
+        return True
+
+    def plain() -> str:
+        return ANSI.sub(b"", screen).decode("utf-8", "replace")
+
+    for step in [s for s in script.split(",") if s]:
+        kind, _, arg = step.partition(":")
+        deadline = time.time() + STEP_TIMEOUT
+        if kind == "wait":
+            while arg not in plain()[seen_from:]:
+                if time.time() > deadline or not pump(0.2):
+                    print(f"driver: timed out waiting for {arg!r}", file=sys.stderr)
+                    return 124
+            seen_from = plain().index(arg, seen_from) + len(arg)
+        elif kind == "url":
+            while not LINK.search(plain()[seen_from:]):
+                if time.time() > deadline or not pump(0.2):
+                    print("driver: no authorize link appeared", file=sys.stderr)
+                    return 124
+            m = LINK.search(plain()[seen_from:])
+            seen_from += m.end()
+            with open(url_path, "w") as f:
+                f.write(m.group(0))
+        elif kind == "key":
+            time.sleep(0.3)  # let the screen settle so the key lands on it
+            os.write(fd, KEYS[arg])
+        elif kind == "sleep":
+            end = time.time() + float(arg)
+            while time.time() < end:
+                pump(0.2)
+
+    # Drain until the command exits.
+    deadline = time.time() + STEP_TIMEOUT * 2
+    while pump(0.2):
+        if time.time() > deadline:
+            print("driver: command did not exit", file=sys.stderr)
+            return 124
+    _, status = os.waitpid(pid, 0)
+    return os.waitstatus_to_exitcode(status)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/__tests__/e2e/layout/cli-login.sh b/__tests__/e2e/layout/cli-login.sh
new file mode 100755
index 000000000..6dbbb74db
--- /dev/null
+++ b/__tests__/e2e/layout/cli-login.sh
@@ -0,0 +1,280 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# `failproofai config` → "Log in to FailproofAI Cloud", end to end, for real.
+#
+# The real wizard runs in a real pseudo-terminal (cli-login-driver.py) inside a
+# systemd container, as an unprivileged user, and installs a real daemon. A
+# person's half — signing in, approving, denying — happens through the real
+# AgentEye dashboard API, with the sign-in code read out of mailpit. Then it
+# checks what landed: the machine's key, the daemon checking in with it, and
+# what the server recorded. Nothing is mocked.
+#
+# Needs, all local:
+#   - an AgentEye stack: dashboard on $DASH, mailpit API on $MAILPIT, and its
+#     Postgres reachable through `docker exec $PG_CONTAINER psql`
+#   - this repo built: `bun run build` (dist/) and
+#     `cargo build --release --bin failproofaid`
+#   - Docker. The container uses the HOST network, because the CLI only sends
+#     a key over plain http to loopback, so it must see the dashboard there.
+#
+# Not part of `bun run test:e2e`: like the other harnesses here, it is run
+# deliberately (see README.md in this directory).
+#
+#   DASH=http://localhost:3000 MAILPIT=http://localhost:8026 \
+#     PG_CONTAINER=agenteye-postgres-1 bash __tests__/e2e/layout/cli-login.sh
+# ─────────────────────────────────────────────────────────────────────────────
+set -uo pipefail
+
+R="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+DASH=${DASH:-http://localhost:3000}
+MAILPIT=${MAILPIT:-http://localhost:8026}
+PG_CONTAINER=${PG_CONTAINER:-agenteye-postgres-1}
+C=${C:-fpai-e2e-login}
+KEEP=${KEEP:-0}  # 1 = leave the container up afterwards, for poking at
+STAMP=$(date +%s)
+OUT=$(mktemp -d)
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  \033[32mPASS\033[0m %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  \033[31mFAIL\033[0m %s\n       %s\n' "$1" "${2:-}"; }
+has()   { if printf '%s' "$2" | grep -qF -- "$3"; then ok "$1"; else bad "$1" "missing [$3] in: $(printf '%s' "$2" | tr '\n' ' ' | tail -c 400)"; fi; }
+hasnt() { if printf '%s' "$2" | grep -qF -- "$3"; then bad "$1" "unexpected [$3]"; else ok "$1"; fi; }
+eq()    { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1" "want [$3] got [$2]"; fi; }
+head1() { printf '\n\033[1m── %s\033[0m\n' "$1"; }
+jqp() { python3 -c "import sys,json;d=json.load(sys.stdin);print(eval('d'+sys.argv[1]))" "$1" 2>/dev/null; }
+sql() { docker exec "$PG_CONTAINER" psql -U postgres -d agenteye -tAc "$1"; }
+dex() { docker exec "$C" bash -lc "$1"; }
+
+cleanup() {
+  [ "$KEEP" = 1 ] || docker rm -f "$C" >/dev/null 2>&1
+  rm -rf "$OUT"
+}
+trap cleanup EXIT
+
+# ── A person, through the dashboard ──────────────────────────────────────────
+
+# Sign <email> in through the real email-code flow and print its session.
+sign_in() {
+  local email=$1 id code
+  curl -s -X DELETE "$MAILPIT/api/v1/search?query=to:$email" >/dev/null || true
+  curl -s -X POST "$DASH/api/auth/otp/request" -H 'content-type: application/json' -d "{\"email\":\"$email\"}" >/dev/null
+  for _ in $(seq 1 40); do
+    id=$(curl -s "$MAILPIT/api/v1/search?query=to:$email&limit=1" | jqp '["messages"][0]["ID"]')
+    [ -n "$id" ] && break
+    sleep 0.5
+  done
+  code=$(curl -s "$MAILPIT/api/v1/message/$id" | python3 -c 'import sys,json,re;print(re.search(r"\b(\d{6})\b",json.load(sys.stdin)["Text"]).group(1))')
+  curl -s -D - -o /dev/null -X POST "$DASH/api/auth/otp/verify" -H 'content-type: application/json' \
+    -d "{\"email\":\"$email\",\"code\":\"$code\"}" | tr -d '\r' | sed -n 's/^[Ss]et-[Cc]ookie: ae_session=\([^;]*\).*/\1/p'
+}
+
+person() { # <session> <action> <json> -> body; status in $OUT/status
+  curl -s -o "$OUT/body" -w '%{http_code}' -X POST "$DASH/api/auth/cli/$2" -b "ae_session=$1" \
+    -H "origin: $DASH" -H 'content-type: application/json' -d "$3" > "$OUT/status"
+  cat "$OUT/body"
+}
+
+link_token() { python3 -c 'import sys,urllib.parse as u;print(u.parse_qs(u.urlparse(sys.argv[1]).query)["r"][0])' "$1"; }
+
+# ── The machine, through a real terminal ─────────────────────────────────────
+
+# Run `failproofai config` under the pty driver in the background.
+# <name> <script> [extra env...]; transcript -> $OUT/<name>.log, rc -> $OUT/<name>.rc
+run_config() {
+  local name=$1 script=$2; shift 2
+  dex "rm -f /tmp/$name.log /tmp/$name.url"
+  ( docker exec -u dev -w /home/dev "$C" env HOME=/home/dev \
+      FAILPROOFAI_CLOUD_URL="$DASH" \
+      FAILPROOFAI_DAEMON_BINARY=/repo/target/release/failproofaid \
+      FAILPROOFAI_TELEMETRY_DISABLED=1 FAILPROOFAI_NO_AUTO_AUDIT=1 NO_COLOR=1 "$@" \
+      python3 /repo/__tests__/e2e/layout/cli-login-driver.py "$script" "/tmp/$name.log" "/tmp/$name.url" \
+      -- failproofai config ; echo $? > "$OUT/$name.rc" ) &
+}
+
+wait_url() { # <name> -> the authorize link the CLI printed
+  local u=""
+  for _ in $(seq 1 120); do
+    u=$(dex "cat /tmp/$1.url 2>/dev/null")
+    [ -n "$u" ] && { dex "rm -f /tmp/$1.url"; echo "$u"; return; }
+    sleep 0.5
+  done
+}
+
+wait_done() { # <name> -> transcript
+  for _ in $(seq 1 240); do [ -f "$OUT/$1.rc" ] && break; sleep 0.5; done
+  dex "cat /tmp/$1.log 2>/dev/null" | sed 's/\x1b\[[0-9;?]*[A-Za-z]//g'
+}
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 0 — preconditions"
+curl -s -m 5 -o /dev/null "$DASH/login" && ok "dashboard is up on $DASH" || bad "dashboard is up" "$DASH/login"
+curl -s -m 5 -o /dev/null "$MAILPIT/api/v1/messages" && ok "mailpit is up on $MAILPIT" || bad "mailpit is up" "$MAILPIT"
+[ -n "$(sql 'select 1' 2>/dev/null)" ] && ok "Postgres reachable via $PG_CONTAINER" || bad "Postgres reachable" "$PG_CONTAINER"
+[ -f "$R/dist/cli.mjs" ] && ok "CLI built" || bad "CLI built" "run: bun run build"
+[ -x "$R/target/release/failproofaid" ] && ok "daemon built" || bad "daemon built" "run: cargo build --release --bin failproofaid"
+[ "$FAIL" = 0 ] || { echo "preconditions failed"; exit 1; }
+
+if ! docker ps --format '{{.Names}}' | grep -qx "$C"; then
+  docker run -d --name "$C" --privileged --cgroupns=host --network=host \
+    -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run --tmpfs /run/lock \
+    -v "$R":/repo:ro jrei/systemd-ubuntu:24.04 >/dev/null
+  until docker exec "$C" systemctl is-system-running 2>/dev/null | grep -qE 'running|degraded'; do sleep 1; done
+  dex 'export DEBIAN_FRONTEND=noninteractive; apt-get update -qq >/dev/null; apt-get install -y -qq sudo curl ca-certificates python3 >/dev/null 2>&1
+       curl -fsSL https://deb.nodesource.com/setup_22.x -o /tmp/n.sh && bash /tmp/n.sh >/dev/null 2>&1 && apt-get install -y -qq nodejs >/dev/null 2>&1
+       id dev >/dev/null 2>&1 || useradd -m -s /bin/bash dev
+       echo "dev ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/dev && chmod 440 /etc/sudoers.d/dev'
+fi
+# Claude Code "installed": detection is a binary on PATH, and a detected agent
+# is what the agents screen opens ticked — so Enter there is the final OK.
+dex 'printf "#!/bin/sh\nexit 0\n" > /usr/local/bin/claude && chmod +x /usr/local/bin/claude'
+# `failproofai` on PATH, as `npm i -g` would put it: hook install writes that
+# command into each agent's settings and refuses to run without it.
+dex 'ln -sf /repo/dist/cli.mjs /usr/local/bin/failproofai' 
+# A fresh machine every run: no daemon, no failproofai home.
+dex 'systemctl disable --now failproofaid@dev.service >/dev/null 2>&1; rm -f /etc/systemd/system/failproofaid@dev.service; systemctl daemon-reload; rm -rf /home/dev/.failproofai /home/dev/.claude'
+eq "container up, with systemd" "$(dex 'systemctl is-system-running' | tr -d '\r')" "running"
+# The label setup sends is the hostname (`--machine-label` alone RENAMES a
+# connected machine, so it is not a setup option here).
+LABEL=$(dex hostname | tr -d '\r')
+
+EMAIL="ada-$STAMP@example.test"
+SLUG="e2e-$STAMP"
+SESSION=$(sign_in "$EMAIL")
+[ -n "$SESSION" ] && ok "approver signed in through the email code" || bad "approver signed in" "no session"
+ORG_ID=$(curl -s -X POST "$DASH/api/orgs" -b "ae_session=$SESSION" -H 'content-type: application/json' \
+  -d "{\"slug\":\"$SLUG\",\"name\":\"E2E Co\"}" | jqp '["id"]')
+[ -n "$ORG_ID" ] && ok "approver created org $SLUG" || bad "approver created an org" "no id"
+USER_ID=$(sql "select id from users where email = '$EMAIL'")
+keys_in_org() { sql "select count(*) from api_keys where org_id = '$ORG_ID' and created_via = 'cli_login'"; }
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 1 — a fresh machine logs in, and setup finishes on its own"
+run_config fresh "wait:CONNECT TO CLOUD,wait:Log in to FailproofAI Cloud,key:enter,url,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
+URL=$(wait_url fresh)
+has "the CLI printed the authorize link" "$URL" "$DASH/cli/authorize?r="
+LINK=$(link_token "$URL")
+PAGE=$(person "$SESSION" lookup "{\"link_token\":\"$LINK\"}")
+eq "the page sees a pending request" "$(echo "$PAGE" | jqp '["status"]')" "pending"
+eq "…for this machine" "$(echo "$PAGE" | jqp '["machine"]["label"]')" "$LABEL"
+eq "nothing is minted before approval" "$(keys_in_org)" "0"
+person "$SESSION" approve "{\"link_token\":\"$LINK\",\"org_id\":\"$ORG_ID\",\"jev\":true}" >/dev/null
+eq "approve answered 200" "$(cat "$OUT/status")" "200"
+T=$(wait_done fresh)
+eq "config exited 0" "$(cat "$OUT/fresh.rc")" "0"
+has "no display here, so it printed the link to open anywhere" "$T" "Open this link in any browser to connect $LABEL"
+has "the CLI shows who approved it, and where" "$T" "Logged in as $EMAIL · E2E Co ($SLUG)"
+has "the daemon installed" "$T" "failproofaid installed and running"
+has "the cloud connection was written" "$T" "Connected as"
+eq "exactly one key minted, at the end of setup" "$(keys_in_org)" "1"
+eq "attributed to the approver" "$(sql "select created_by_user_id from api_keys where org_id = '$ORG_ID' and created_via = 'cli_login'")" "$USER_ID"
+eq "the request is spent" "$(sql "select status from cli_login_requests where link_token_hash = encode(sha256('$LINK'::bytea), 'hex')")" "claimed"
+eq "daemon running under systemd" "$(dex 'systemctl is-active failproofaid@dev' | tr -d '\r')" "active"
+KEY=$(dex "python3 -c 'import json;d=json.load(open(\"/home/dev/.failproofai/credentials.json\"));print(d[\"cloud\"][\"token\"])'" | tr -d '\r')
+WHO=$(curl -s "$DASH/v1/auth/introspect" -H "authorization: Bearer $KEY")
+eq "the machine's key works, in the approved org" "$(echo "$WHO" | jqp '["org_slug"]')" "$SLUG"
+has "…with jev, as approved" "$WHO" "jev:evaluate"
+for _ in $(seq 1 30); do
+  [ "$(sql "select count(*) from enforcement_machines where org_id = '$ORG_ID'")" = 1 ] && break; sleep 1
+done
+eq "the daemon checked in with that key" "$(sql "select count(*) from enforcement_machines where org_id = '$ORG_ID'")" "1"
+hasnt "the key never appears in the terminal" "$T" "$KEY"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 2 — a connected machine is offered 'keep' first; logging in again makes a new key"
+run_config relogin "wait:Keep current connection,key:down,key:enter,url,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
+LINK=$(link_token "$(wait_url relogin)")
+person "$SESSION" approve "{\"link_token\":\"$LINK\",\"org_id\":\"$ORG_ID\"}" >/dev/null
+T=$(wait_done relogin)
+eq "config exited 0" "$(cat "$OUT/relogin.rc")" "0"
+has "the menu named the saved key" "$T" "key ****"
+has "it says the old key still works" "$T" "Your previous key for this machine still works"
+eq "a second key, the first one still live" "$(sql "select count(*) from api_keys where org_id = '$ORG_ID' and created_via = 'cli_login' and revoked_at is null")" "2"
+has "the second key carries a suffix, not a clash" "$(sql "select string_agg(name, ',' order by name) from api_keys where org_id = '$ORG_ID' and created_via = 'cli_login'")" "-2"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 3 — cancelled in the browser, retried from the terminal"
+run_config deny "wait:Keep current connection,key:down,key:enter,url,wait:The request was cancelled in the browser.,key:enter,url,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
+LINK1=$(link_token "$(wait_url deny)")
+person "$SESSION" deny "{\"link_token\":\"$LINK1\"}" >/dev/null
+eq "deny answered 200" "$(cat "$OUT/status")" "200"
+LINK2=$(link_token "$(wait_url deny)")
+[ "$LINK1" != "$LINK2" ] && ok "enter fetched a NEW link" || bad "enter fetched a new link" "same token"
+person "$SESSION" approve "{\"link_token\":\"$LINK2\",\"org_id\":\"$ORG_ID\"}" >/dev/null
+T=$(wait_done deny)
+eq "config exited 0" "$(cat "$OUT/deny.rc")" "0"
+eq "the denied request stays denied" "$(sql "select status from cli_login_requests where link_token_hash = encode(sha256('$LINK1'::bytea), 'hex')")" "denied"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 4 — approved, then the run is abandoned: no key is minted"
+BEFORE=$(keys_in_org)
+run_config abandon "wait:Keep current connection,key:down,key:enter,url,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:ctrl-c"
+LINK=$(link_token "$(wait_url abandon)")
+person "$SESSION" approve "{\"link_token\":\"$LINK\",\"org_id\":\"$ORG_ID\"}" >/dev/null
+T=$(wait_done abandon)
+eq "no key minted for an approval nobody claimed" "$(keys_in_org)" "$BEFORE"
+eq "the request is approved, never claimed" "$(sql "select status from cli_login_requests where link_token_hash = encode(sha256('$LINK'::bytea), 'hex')")" "approved"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 5 — esc goes back to the menu without touching anything"
+BEFORE=$(keys_in_org)
+run_config esc "wait:Keep current connection,key:down,key:enter,url,key:esc,wait:Keep current connection,key:enter,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
+LINK=$(link_token "$(wait_url esc)")
+T=$(wait_done esc)
+eq "config exited 0 after keeping the connection" "$(cat "$OUT/esc.rc")" "0"
+eq "no key minted" "$(keys_in_org)" "$BEFORE"
+eq "the abandoned link is still just pending" "$(sql "select status from cli_login_requests where link_token_hash = encode(sha256('$LINK'::bytea), 'hex')")" "pending"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 6 — a link that expires offers a fresh one"
+run_config expire "wait:Keep current connection,key:down,key:enter,url,wait:That link expired.,key:enter,url,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
+LINK1=$(link_token "$(wait_url expire)")
+sql "update cli_login_requests set expires_at = now() - interval '1 second' where link_token_hash = encode(sha256('$LINK1'::bytea), 'hex')" >/dev/null
+LINK2=$(link_token "$(wait_url expire)")
+person "$SESSION" approve "{\"link_token\":\"$LINK2\",\"org_id\":\"$ORG_ID\"}" >/dev/null
+T=$(wait_done expire)
+eq "config exited 0 on the fresh link" "$(cat "$OUT/expire.rc")" "0"
+person "$SESSION" approve "{\"link_token\":\"$LINK1\",\"org_id\":\"$ORG_ID\"}" >/dev/null
+eq "the expired link can no longer be approved" "$(cat "$OUT/status")" "410"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 7 — a saved key that was revoked: logging in again comes first"
+# Revoke every live CLI key, so whichever one this machine holds is dead.
+for id in $(curl -s "$DASH/api/keys" -b "ae_session=$SESSION" -H "x-agenteye-org: $SLUG" | python3 -c '
+import sys,json
+for k in json.load(sys.stdin):
+    if k.get("created_via")=="cli_login" and not k.get("revoked_at"): print(k["id"])'); do
+  curl -s -o /dev/null -X POST "$DASH/api/keys/$id/disable" -b "ae_session=$SESSION" -H "x-agenteye-org: $SLUG" \
+    -H "origin: $DASH" -H 'content-type: application/json' -d '{}'
+done
+sleep 2
+run_config revoked "wait:your saved key no longer works,key:ctrl-c"
+T=$(wait_done revoked)
+has "the menu leads with logging in again, and says why" "$T" "Log in again"
+has "…because the saved key no longer works" "$T" "recommended · your saved key no longer works"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 8 — a cloud without browser login says so"
+run_config old "wait:CONNECT TO CLOUD,key:enter,wait:doesn't support logging in from here yet,key:esc,wait:CONNECT TO CLOUD,key:ctrl-c" \
+  FAILPROOFAI_CLOUD_URL=http://localhost:28080
+T=$(wait_done old)
+has "an older server is reported, and the key route stays open" "$T" "doesn't support logging in from here yet"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 9 — the person side refuses what it must"
+EVIL=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/approve" -b "ae_session=$SESSION" \
+  -H 'origin: https://evil.example' -H 'content-type: application/json' -d "{\"link_token\":\"x\",\"org_id\":\"$ORG_ID\"}")
+eq "a cross-site approve is refused" "$EVIL" "403"
+FORM=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/approve" -b "ae_session=$SESSION" \
+  -H "origin: $DASH" -H 'content-type: application/x-www-form-urlencoded' -d 'link_token=x')
+eq "a form-encoded approve is refused" "$FORM" "403"
+NOSESS=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/approve" -H "origin: $DASH" \
+  -H 'content-type: application/json' -d '{}')
+eq "no session, no approve" "$NOSESS" "401"
+for _ in $(seq 1 12); do
+  LAST=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/start" -H 'x-forwarded-for: 198.51.100.7' \
+    -H 'content-type: application/json' -d '{"machine_label":"flood"}')
+done
+eq "starts from one address are rate-limited" "$LAST" "429"
+
+printf '\n\033[1m%d passed, %d failed\033[0m\n' "$PASS" "$FAIL"
+[ "$FAIL" = 0 ]
diff --git a/__tests__/hooks/browser-login-prompt.test.ts b/__tests__/hooks/browser-login-prompt.test.ts
new file mode 100644
index 000000000..e3004c8fe
--- /dev/null
+++ b/__tests__/hooks/browser-login-prompt.test.ts
@@ -0,0 +1,180 @@
+import { describe, it, expect, vi } from "vitest";
+import { PassThrough } from "node:stream";
+import {
+  BACK,
+  promptBrowserLogin,
+  type BrowserLoginOptions,
+  type BrowserLoginPoll,
+  type BrowserLoginStart,
+  type TTYIn,
+  type TTYOut,
+} from "../../src/hooks/tui";
+
+// Driven through a real PassThrough so Node's own keypress parser runs, like
+// cloud-key-prompt.test.ts.
+function terminal(columns = 80) {
+  const written: string[] = [];
+  const stdout = {
+    isTTY: true,
+    columns,
+    write: (chunk: string) => {
+      written.push(String(chunk));
+      return true;
+    },
+  } as unknown as TTYOut;
+  const stdin = new PassThrough() as unknown as TTYIn & PassThrough;
+  (stdin as unknown as { isTTY: boolean }).isTTY = true;
+  (stdin as unknown as { setRawMode: (on: boolean) => void }).setRawMode = () => {};
+  const plain = () => written.join("").replace(/\x1b\[[0-9;?]*[A-Za-z]/g, "");
+  return { stdin, stdout, plain, type: (s: string) => stdin.write(s) };
+}
+
+const tick = (ms = 0) => new Promise((r) => setTimeout(r, ms));
+const until = async (cond: () => boolean, ms = 2000) => {
+  const end = Date.now() + ms;
+  while (!cond()) {
+    if (Date.now() > end) throw new Error("condition not met in time");
+    await tick(5);
+  }
+};
+
+const LINK = `https://app.befailproof.ai/cli/authorize?r=${"a".repeat(64)}`;
+// A tiny interval keeps polling fast; the widget takes the server's number.
+const started = (url = LINK): BrowserLoginStart => ({ ok: true, url, expiresIn: 600, interval: 0.01 });
+
+function ask(
+  t: ReturnType<typeof terminal>,
+  polls: BrowserLoginPoll<string>[],
+  extra: Partial<BrowserLoginOptions<string>> = {},
+) {
+  const start = vi.fn(async (): Promise<BrowserLoginStart> => started());
+  const queue = [...polls];
+  const poll = vi.fn(async (): Promise<BrowserLoginPoll<string>> => queue.shift() ?? { state: "pending" });
+  const open = vi.fn(() => true);
+  const pending = promptBrowserLogin<string>({
+    message: "Connect to cloud",
+    meta: "app.befailproof.ai",
+    machineLabel: "sidd-laptop",
+    start,
+    poll,
+    open,
+    collapsed: (v) => ["CONNECT TO CLOUD", `logged in: ${v}`],
+    stdin: t.stdin,
+    stdout: t.stdout,
+    ...extra,
+  });
+  return { pending, start: (extra.start as typeof start) ?? start, poll: (extra.poll as typeof poll) ?? poll, open: (extra.open as typeof open) ?? open };
+}
+
+describe("promptBrowserLogin", () => {
+  it("prints the whole link above the live region, even when it is wider than the terminal", async () => {
+    const t = terminal(40);
+    const { pending, open } = ask(t, [{ state: "approved", value: "acme" }]);
+    expect(await pending).toEqual({ value: "acme" });
+    expect(open).toHaveBeenCalledWith(LINK);
+    const out = t.plain();
+    expect(out).toContain("CONNECT TO CLOUD  app.befailproof.ai");
+    expect(out).toContain(LINK);
+    expect(out).toContain("Opening your browser to connect sidd-laptop.");
+    expect(out).toContain("logged in: acme");
+  });
+
+  it("says to open the link anywhere when it cannot open a browser here", async () => {
+    const t = terminal();
+    const { pending } = ask(t, [{ state: "approved", value: "x" }], { open: vi.fn(() => false) });
+    await pending;
+    expect(t.plain()).toContain("Open this link in any browser to connect sidd-laptop:");
+  });
+
+  it("keeps polling while pending, then resolves the approval", async () => {
+    const t = terminal();
+    const { pending, poll } = ask(t, [{ state: "pending" }, { state: "pending" }, { state: "approved", value: "acme" }]);
+    expect(await pending).toEqual({ value: "acme" });
+    expect(poll).toHaveBeenCalledTimes(3);
+    expect(t.plain()).toContain("Waiting for you to authorize in the browser");
+  });
+
+  it("goes back on esc and cancels on ctrl-c, and stops polling either way", async () => {
+    for (const [key, want] of [
+      ["\u001b", BACK],
+      ["\u0003", null],
+    ] as const) {
+      const t = terminal();
+      const { pending, poll } = ask(t, []);
+      await until(() => t.plain().includes("Waiting for you"));
+      t.type(key);
+      expect(await pending).toBe(want);
+      const calls = poll.mock.calls.length;
+      await tick(60);
+      expect(poll.mock.calls.length).toBe(calls);
+    }
+  });
+
+  it("offers a new link on enter once one expires", async () => {
+    const t = terminal();
+    const urls = [LINK, `${LINK}-second`];
+    const start = vi.fn(async (): Promise<BrowserLoginStart> => started(urls.shift()));
+    const { pending } = ask(t, [{ state: "expired" }, { state: "approved", value: "after-retry" }], { start });
+    await until(() => t.plain().includes("That link expired."));
+    expect(t.plain()).toContain("enter new link");
+    t.type("\r");
+    expect(await pending).toEqual({ value: "after-retry" });
+    expect(start).toHaveBeenCalledTimes(2);
+    expect(t.plain()).toContain(`${LINK}-second`);
+  });
+
+  it("calls a link expired by its own clock without waiting for the server to say so", async () => {
+    const t = terminal();
+    let clock = 1_000_000;
+    const { pending } = ask(t, [], { now: () => clock });
+    await until(() => t.plain().includes("Waiting for you"));
+    clock += 11 * 60 * 1000;
+    await until(() => t.plain().includes("That link expired."));
+    t.type("\u001b");
+    expect(await pending).toBe(BACK);
+  });
+
+  it("lets a refusal in the browser be retried", async () => {
+    const t = terminal();
+    const { pending, start } = ask(t, [{ state: "denied" }, { state: "approved", value: "second-go" }]);
+    await until(() => t.plain().includes("The request was cancelled in the browser."));
+    t.type("\r");
+    expect(await pending).toEqual({ value: "second-go" });
+    expect(start).toHaveBeenCalledTimes(2);
+  });
+
+  it("does not retry what cannot work, like an older server", async () => {
+    const t = terminal();
+    const start = vi.fn(
+      async (): Promise<BrowserLoginStart> => ({ ok: false, retryable: false, line: "this server doesn't support it" }),
+    );
+    const { pending, poll } = ask(t, [], { start });
+    await until(() => t.plain().includes("this server doesn't support it"));
+    expect(t.plain()).toContain("CONNECT TO CLOUD");
+    t.type("\r");
+    await tick(30);
+    expect(start).toHaveBeenCalledTimes(1);
+    expect(poll).not.toHaveBeenCalled();
+    t.type("\u001b");
+    expect(await pending).toBe(BACK);
+  });
+
+  it("keeps going through a dropped connection, and says so", async () => {
+    const t = terminal();
+    const { pending } = ask(t, [
+      { state: "unreachable", line: "offline" },
+      { state: "pending" },
+      { state: "approved", value: "back-online" },
+    ]);
+    expect(await pending).toEqual({ value: "back-online" });
+    expect(t.plain()).toContain("Can't reach the server right now (offline) — still trying.");
+  });
+
+  it("answers null without a terminal instead of hanging on a pipe", async () => {
+    const t = terminal();
+    (t.stdin as unknown as { isTTY: boolean }).isTTY = false;
+    const { pending, start } = ask(t, []);
+    expect(await pending).toBeNull();
+    expect(start).not.toHaveBeenCalled();
+  });
+});
diff --git a/__tests__/hooks/cloud-login.test.ts b/__tests__/hooks/cloud-login.test.ts
new file mode 100644
index 000000000..973a242c4
--- /dev/null
+++ b/__tests__/hooks/cloud-login.test.ts
@@ -0,0 +1,176 @@
+import { describe, it, expect, vi } from "vitest";
+import {
+  claimLogin,
+  isOpenableUrl,
+  LOGIN_CLAIM_PATH,
+  LOGIN_POLL_PATH,
+  LOGIN_START_PATH,
+  machineOs,
+  pollLogin,
+  startLogin,
+} from "../../src/hooks/cloud-login";
+import { canOpenBrowser } from "../../src/audit/open-browser";
+
+const ORIGIN = "https://app.befailproof.ai";
+const MACHINE = { label: "box", os: "linux", cliVersion: "1.0.12" };
+
+/** A fetch answering one status and body, recording what it was asked. */
+function fetchOf(status: number, body: unknown, headers: Record<string, string> = {}) {
+  return vi.fn(async (_url: string | URL | Request, _init?: RequestInit) =>
+    new Response(typeof body === "string" ? body : JSON.stringify(body), { status, headers }),
+  );
+}
+
+describe("startLogin", () => {
+  it("returns the link and the poll secret, and sends the machine", async () => {
+    const f = fetchOf(201, {
+      verification_url: `${ORIGIN}/cli/authorize?r=abc`,
+      poll_secret: "secret",
+      expires_in: 600,
+      interval: 2,
+    });
+    const r = await startLogin(ORIGIN + "/", MACHINE, f as unknown as typeof fetch);
+    expect(r).toEqual({
+      kind: "ok",
+      verificationUrl: `${ORIGIN}/cli/authorize?r=abc`,
+      pollSecret: "secret",
+      expiresIn: 600,
+      interval: 2,
+    });
+    const [url, init] = f.mock.calls[0]!;
+    expect(url).toBe(`${ORIGIN}${LOGIN_START_PATH}`);
+    expect(init?.redirect).toBe("manual");
+    expect(JSON.parse(String(init?.body))).toEqual({ machine_label: "box", machine_os: "linux", cli_version: "1.0.12" });
+  });
+
+  it("calls an older cloud unsupported, whether it 404s or redirects to a login page", async () => {
+    expect(await startLogin(ORIGIN, MACHINE, fetchOf(404, "") as unknown as typeof fetch)).toEqual({ kind: "unsupported" });
+    expect(
+      await startLogin(ORIGIN, MACHINE, fetchOf(307, "", { location: "/login" }) as unknown as typeof fetch),
+    ).toEqual({ kind: "unsupported" });
+    // A 201 that is not this API.
+    expect(await startLogin(ORIGIN, MACHINE, fetchOf(201, { hello: "world" }) as unknown as typeof fetch)).toEqual({
+      kind: "unsupported",
+    });
+  });
+
+  it("never hands a non-http link to the browser opener", async () => {
+    for (const verification_url of ["javascript:alert(1)", "file:///etc/passwd", "not a url"]) {
+      const f = fetchOf(201, { verification_url, poll_secret: "s", expires_in: 600, interval: 2 });
+      expect(await startLogin(ORIGIN, MACHINE, f as unknown as typeof fetch)).toEqual({ kind: "unsupported" });
+    }
+    expect(isOpenableUrl("https://x.test/a")).toBe(true);
+    expect(isOpenableUrl("http://localhost:3000/a")).toBe(true);
+    expect(isOpenableUrl("ftp://x.test")).toBe(false);
+  });
+
+  it("tells a rate limit, a refusal and an outage apart", async () => {
+    expect((await startLogin(ORIGIN, MACHINE, fetchOf(429, {}) as unknown as typeof fetch)).kind).toBe("refused");
+    expect(
+      await startLogin(ORIGIN, MACHINE, fetchOf(422, { error: "machine_label_required" }) as unknown as typeof fetch),
+    ).toEqual({ kind: "refused", reason: "machine_label_required" });
+    expect(await startLogin(ORIGIN, MACHINE, fetchOf(502, "<html>") as unknown as typeof fetch)).toEqual({
+      kind: "unreachable",
+      reason: "the server answered 502",
+    });
+    const down = vi.fn(async () => {
+      throw new TypeError("fetch failed");
+    });
+    expect(await startLogin(ORIGIN, MACHINE, down as unknown as typeof fetch)).toEqual({
+      kind: "unreachable",
+      reason: "fetch failed",
+    });
+  });
+});
+
+describe("pollLogin", () => {
+  it("reads every state the server can answer", async () => {
+    const poll = (body: unknown, status = 200) => pollLogin(ORIGIN, "s", fetchOf(status, body) as unknown as typeof fetch);
+    expect(await poll({ status: "pending", interval: 2 })).toEqual({ kind: "pending", interval: 2 });
+    expect(await poll({ status: "slow_down", interval: 2 })).toEqual({ kind: "slow_down" });
+    expect(await poll({ status: "denied" })).toEqual({ kind: "denied" });
+    expect(await poll({ status: "expired" })).toEqual({ kind: "expired" });
+    expect(await poll({ status: "claimed" })).toEqual({ kind: "claimed" });
+    expect(await poll({ status: "unknown" }, 404)).toEqual({ kind: "unknown" });
+    expect(
+      await poll({
+        status: "approved",
+        org: { id: "o1", slug: "acme", name: "Acme" },
+        approved_by: "ada@acme.test",
+        key_name: "failproofai · box",
+        permissions: ["events:add", "policies:pull", 7],
+      }),
+    ).toEqual({
+      kind: "approved",
+      org: { id: "o1", slug: "acme", name: "Acme" },
+      approvedBy: "ada@acme.test",
+      keyName: "failproofai · box",
+      permissions: ["events:add", "policies:pull"],
+    });
+    expect((await poll("<html>", 500)).kind).toBe("unreachable");
+  });
+
+  it("posts the poll secret, and only that", async () => {
+    const f = fetchOf(200, { status: "pending" });
+    await pollLogin(ORIGIN, "the-secret", f as unknown as typeof fetch);
+    const [url, init] = f.mock.calls[0]!;
+    expect(url).toBe(`${ORIGIN}${LOGIN_POLL_PATH}`);
+    expect(JSON.parse(String(init?.body))).toEqual({ poll_secret: "the-secret" });
+  });
+});
+
+describe("claimLogin", () => {
+  it("returns the key once minted", async () => {
+    const f = fetchOf(201, {
+      api_key: "k".repeat(64),
+      key_id: "kid",
+      key_name: "failproofai · box",
+      permissions: ["events:add"],
+      org: { slug: "acme", name: "Acme" },
+      approved_by: "ada@acme.test",
+    });
+    const r = await claimLogin(ORIGIN, "s", f as unknown as typeof fetch);
+    expect(r).toMatchObject({ kind: "ok", key: "k".repeat(64), keyName: "failproofai · box", approvedBy: "ada@acme.test" });
+    expect(f.mock.calls[0]![0]).toBe(`${ORIGIN}${LOGIN_CLAIM_PATH}`);
+  });
+
+  it("names why a key could not be created", async () => {
+    const claim = (status: number, body: unknown) => claimLogin(ORIGIN, "s", fetchOf(status, body) as unknown as typeof fetch);
+    expect(await claim(410, { error: "not_actionable", status: "expired" })).toEqual({ kind: "expired" });
+    expect(await claim(403, { error: "approval_revoked" })).toEqual({ kind: "revoked" });
+    expect(await claim(409, { error: "not_actionable", status: "claimed" })).toEqual({
+      kind: "refused",
+      reason: "the login request is claimed",
+    });
+    expect((await claim(503, "")).kind).toBe("unreachable");
+    expect(await claim(201, { key_id: "no secret" })).toEqual({ kind: "refused", reason: "the server answered without a key" });
+  });
+});
+
+describe("machineOs", () => {
+  it("names the OS the way the page shows it", () => {
+    expect(machineOs("darwin")).toBe("macOS");
+    expect(machineOs("linux")).toBe("linux");
+    expect(machineOs("win32")).toBe("windows");
+  });
+});
+
+// Next's types make NODE_ENV required on ProcessEnv; these are plain maps.
+const env = (vars: Record<string, string>) => vars as unknown as NodeJS.ProcessEnv;
+
+describe("canOpenBrowser", () => {
+  it("is false over SSH, whatever the display says", () => {
+    for (const key of ["SSH_CONNECTION", "SSH_CLIENT", "SSH_TTY"]) {
+      expect(canOpenBrowser(env({ [key]: "1", DISPLAY: ":0" }), "linux")).toBe(false);
+      expect(canOpenBrowser(env({ [key]: "1" }), "darwin")).toBe(false);
+    }
+  });
+  it("is false on a Linux box with no display at all", () => {
+    expect(canOpenBrowser(env({}), "linux")).toBe(false);
+    expect(canOpenBrowser(env({ DISPLAY: ":0" }), "linux")).toBe(true);
+    expect(canOpenBrowser(env({ WAYLAND_DISPLAY: "wayland-0" }), "linux")).toBe(true);
+  });
+  it("is true on a Mac at its own keyboard", () => {
+    expect(canOpenBrowser(env({}), "darwin")).toBe(true);
+  });
+});
diff --git a/__tests__/hooks/configure-wizard.test.ts b/__tests__/hooks/configure-wizard.test.ts
index 5dad990dc..0cd544de0 100644
--- a/__tests__/hooks/configure-wizard.test.ts
+++ b/__tests__/hooks/configure-wizard.test.ts
@@ -16,8 +16,19 @@ vi.mock("../../src/hooks/tui", async (importOriginal) => {
     multiSelect: vi.fn(),
     promptText: vi.fn(),
     promptCloudKey: vi.fn(),
+    promptBrowserLogin: vi.fn(),
   };
 });
+// The browser login's HTTP calls, and the opener — no test may ever start a
+// real browser or reach a real cloud.
+vi.mock("../../src/hooks/cloud-login", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../../src/hooks/cloud-login")>();
+  return { ...actual, startLogin: vi.fn(), pollLogin: vi.fn(), claimLogin: vi.fn() };
+});
+vi.mock("../../src/audit/open-browser", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../../src/audit/open-browser")>();
+  return { ...actual, openUrl: vi.fn(), canOpenBrowser: vi.fn(() => true) };
+});
 vi.mock("../../src/hooks/manager", () => ({
   installHooks: vi.fn(async () => {}),
   notEnforcingReason: vi.fn(() => "no-policies"),
@@ -92,20 +103,26 @@ vi.mock("../../src/hooks/integrations", async (importOriginal) => {
 });
 
 import {
+  BACK,
   multiSelect,
   selectOne,
+  promptBrowserLogin,
   promptCloudKey,
   OPEN_SOURCE,
   paint,
   screenKit,
   type CloudKeyAnswer,
+  type BrowserLoginOptions,
   type CloudKeyPromptOptions,
   type MultiSelectOptions,
+  type SelectOneOptions,
   type OpenSource,
   type TTYIn,
   type TTYOut,
 } from "../../src/hooks/tui";
 import { connectToCloud } from "../../src/hooks/cloud-connection";
+import { claimLogin, pollLogin, startLogin } from "../../src/hooks/cloud-login";
+import { canOpenBrowser, openUrl } from "../../src/audit/open-browser";
 import * as otelCli from "../../src/hooks/otel-cli";
 import { validateIngestKey, writeIngestCredential, writeCollectorSettings } from "../../src/hooks/collector-config";
 import { introspectKey } from "../../src/hooks/cloud-introspect";
@@ -170,15 +187,39 @@ const printed = (stdout: TTYOut): string =>
   vi.mocked(stdout.write).mock.calls.map((c) => String(c[0])).join("").replace(/\x1b\[[0-9;?]*[A-Za-z]|\x1b[78]/g, "");
 
 /**
- * Queue answers for a run BY NAME. Two prompts are left: the cloud-key field
- * and the agents picker. Without an answer queued, the cloud step takes Tab
- * (open source) and the picker takes Enter on whatever it opened with.
+ * The CONNECT menu's next answer, or `undefined` for its default. The default is
+ * what Tab used to mean on the old single key field: open source on a fresh
+ * machine, leave the saved connection alone on a connected one.
+ */
+type ConnectPick = "login" | "key" | "oss" | "keep";
+let connectPick: ConnectPick | null | undefined;
+
+/**
+ * Queue answers for a run BY NAME. The prompts left are the CONNECT step and
+ * the agents picker. `cloud` is still phrased as the key field's answer —
+ * Tab, a typed key, the saved key, or Esc — and is routed through the CONNECT
+ * menu the way a person would reach it. Without an answer queued, the cloud
+ * step takes the menu's default and the picker takes Enter on whatever it
+ * opened with.
  */
 function drive(answers: { cloud?: CloudKeyAnswer | OpenSource | null; agents?: IntegrationType[] | null }) {
-  if ("cloud" in answers) vi.mocked(promptCloudKey).mockResolvedValueOnce(answers.cloud as never);
+  if ("cloud" in answers) {
+    const cloud = answers.cloud;
+    if (cloud === null || cloud === undefined) connectPick = null;
+    else if (cloud === OPEN_SOURCE) connectPick = undefined;
+    else if (cloud.kind === "saved") connectPick = "keep";
+    else {
+      connectPick = "key";
+      vi.mocked(promptCloudKey).mockResolvedValueOnce(cloud as never);
+    }
+  }
   if ("agents" in answers) vi.mocked(multiSelect).mockResolvedValueOnce(answers.agents as never);
 }
 const cloudOpts = (): CloudKeyPromptOptions => vi.mocked(promptCloudKey).mock.calls[0]![0];
+/** The CONNECT menu as last drawn. */
+const connectMenu = () =>
+  vi.mocked(selectOne).mock.calls.map((c) => c[0] as unknown as SelectOneOptions<string>).filter((o) => o.message === "Connect to cloud").at(-1)!;
+const menuValues = () => connectMenu().choices.map((c) => c.value);
 const agentOpts = (): MultiSelectOptions<IntegrationType> =>
   vi.mocked(multiSelect).mock.calls[0]![0] as unknown as MultiSelectOptions<IntegrationType>;
 
@@ -232,7 +273,20 @@ beforeEach(() => {
     .mockResolvedValue({ policy: { ok: true, policyCount: 2, deployment: 7 }, ingest: { ok: true }, anyConfigured: true });
   vi.mocked(validateIngestKey).mockReset().mockResolvedValue({ ok: true });
   vi.mocked(introspectKey).mockReset().mockResolvedValue({ kind: "unsupported" });
-  vi.mocked(selectOne).mockReset().mockResolvedValue(false);
+  connectPick = undefined;
+  // The CONNECT menu is answered from `connectPick`; every other selectOne
+  // keeps the old default.
+  vi.mocked(selectOne)
+    .mockReset()
+    .mockImplementation((async (opts: { message: string; choices: { value: unknown }[] }) => {
+      if (opts.message !== "Connect to cloud") return false;
+      if (connectPick !== undefined) {
+        const pick = connectPick;
+        connectPick = undefined;
+        return pick;
+      }
+      return opts.choices.some((c) => c.value === "keep") ? "keep" : "oss";
+    }) as never);
   // Healthy and already running is the default: the DAEMON step is one line
   // and needs no password. Daemon tests override these.
   vi.mocked(isDaemonSupportedPlatform).mockReset().mockReturnValue(true);
@@ -602,11 +656,12 @@ describe("removeUserScopeHooks", () => {
 // ── The run ──────────────────────────────────────────────────────────────────
 
 describe("runConfigureWizard", () => {
-  it("asks two things — the key, then the agents — and installs at user scope", async () => {
+  it("asks two things — how to connect, then the agents — and installs at user scope", async () => {
     const result = await runConfigureWizard(ttyIO());
 
     expect(result.applied).toBe(true);
-    expect(promptCloudKey).toHaveBeenCalledTimes(1);
+    expect(selectOne).toHaveBeenCalledTimes(1);
+    expect(connectMenu().message).toBe("Connect to cloud");
     expect(multiSelect).toHaveBeenCalledTimes(1);
     expect(agentOpts().message).toBe("Which agents should failproofai trace?");
     expect(installHooks).toHaveBeenCalledTimes(1);
@@ -761,10 +816,21 @@ describe("headless runs", () => {
 });
 
 describe("connect step", () => {
-  it("draws the field with the host, and the saved key when there is one", async () => {
+  it("offers login first on a fresh machine, with the host in the heading", async () => {
+    await runConfigureWizard(ttyIO());
+    expect(connectMenu()).toMatchObject({ message: "Connect to cloud", meta: "app.befailproof.ai" });
+    expect(menuValues()).toEqual(["login", "key", "oss"]);
+    expect(connectMenu().choices[0]).toMatchObject({ label: "Log in to FailproofAI Cloud" });
+    expect(connectMenu().choices[0].hint).toContain("recommended");
+  });
+
+  it("opens the key field with tab as the way back, and no saved key in it", async () => {
+    connectPick = "key";
     await runConfigureWizard(ttyIO());
-    expect(cloudOpts()).toMatchObject({ message: "Connect to cloud", meta: "app.befailproof.ai", tabHint: "use open source instead" });
+    expect(cloudOpts()).toMatchObject({ message: "Connect to cloud", meta: "app.befailproof.ai", tabHint: "go back" });
     expect(cloudOpts().saved).toBeUndefined();
+    // Tab went back to the menu, which then took open source.
+    expect(vi.mocked(selectOne).mock.calls.filter((c) => (c[0] as { message: string }).message === "Connect to cloud")).toHaveLength(2);
   });
 
   it("connects a typed key at apply, with transcripts on", async () => {
@@ -792,7 +858,8 @@ describe("connect step", () => {
         const result = await runConfigureWizard(mode === "unattended" ? headlessIO() : ttyIO(),
           mode === "token" ? { token: "a-real-looking-key" } : mode === "oss" ? { oss: true } : {});
         expect(result.applied).toBe(true);
-        expect(selectOne).not.toHaveBeenCalled();
+        // The CONNECT menu is the only single-choice question setup asks.
+        expect(vi.mocked(selectOne).mock.calls.filter((c) => (c[0] as { message: string }).message !== "Connect to cloud")).toHaveLength(0);
         expect(enable).not.toHaveBeenCalled();
       } finally {
         enable.mockRestore();
@@ -802,6 +869,7 @@ describe("connect step", () => {
 
   it("checks a typed key without writing it, and reports a refusal", async () => {
     vi.mocked(validateIngestKey).mockResolvedValue({ ok: false, reason: "the server rejected that key (401)" });
+    connectPick = "key";
     await runConfigureWizard(ttyIO());
     expect(await cloudOpts().check("bad-key-123")).toEqual({
       ok: false,
@@ -814,30 +882,48 @@ describe("connect step", () => {
     writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
     drive({ cloud: { kind: "saved", verified: true } });
     const result = await runConfigureWizard(ttyIO());
-    expect(cloudOpts().saved?.masked).toBe("****3f2a");
-    expect(cloudOpts().tabHint).toBe("skip");
+    expect(menuValues()).toEqual(["keep", "login", "key"]);
+    expect(connectMenu().choices[0].hint).toContain("****3f2a");
+    expect(connectMenu().choices[1].label).toBe("Log in again");
+    expect(promptCloudKey).not.toHaveBeenCalled();
     expect(connectToCloud).not.toHaveBeenCalled();
     expect(result.mode).toBe("cloud");
     expect(readFpConfig().mode).toBe("cloud");
   });
 
-  it("checks the saved key in the background and says what it found", async () => {
+  it("checks the saved key first, and orders the menu by what it found", async () => {
     writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
+
+    // Works: keeping it is the default.
     await runConfigureWizard(ttyIO());
-    expect(await cloudOpts().saved!.check()).toEqual({ ok: true, line: "Your saved key works: ****3f2a" });
+    expect(menuValues()).toEqual(["keep", "login", "key"]);
+    expect(connectMenu().choices[0].hint).toContain("key ****3f2a");
+
+    // Refused: logging in again is the default, and says why.
     vi.mocked(validateIngestKey).mockResolvedValueOnce({ ok: false, reason: "the server rejected that key (401)" });
-    expect(await cloudOpts().saved!.check()).toEqual({ ok: false, line: "Your saved key no longer works: the server rejected that key (401)" });
+    connectPick = "keep";
+    await runConfigureWizard(ttyIO());
+    expect(menuValues()).toEqual(["login", "key", "keep"]);
+    expect(connectMenu().choices[0].hint).toBe("recommended · your saved key no longer works");
+    expect(connectMenu().choices[2].hint).toBe("its key no longer works");
+
+    // Offline: still keep first — a dropped connection is not a broken key.
     vi.mocked(validateIngestKey).mockResolvedValueOnce({ ok: false, reason: "could not reach the server (offline)" });
-    expect(await cloudOpts().saved!.check()).toMatchObject({ ok: false, usable: true });
+    await runConfigureWizard(ttyIO());
+    expect(menuValues()).toEqual(["keep", "login", "key"]);
+    expect(connectMenu().choices[0].hint).toBe("its key couldn't be checked just now");
   });
 
-  it("tab never disconnects a connected machine (decision D4)", async () => {
+  it("never disconnects a connected machine from this step (decision D4)", async () => {
     writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
-    const io = ttyIO();
-    const result = await runConfigureWizard(io);
+    vi.mocked(validateIngestKey).mockResolvedValueOnce({ ok: false, reason: "the server rejected that key (401)" });
+    const result = await runConfigureWizard(ttyIO());
+    // No "use open source" on a connected machine: `--disconnect` is the one way.
+    expect(menuValues()).not.toContain("oss");
     expect(result.mode).toBe("cloud");
     expect(connectToCloud).not.toHaveBeenCalled();
-    const collapsed = cloudOpts().collapsed!(OPEN_SOURCE).map((l) => l.replace(/\x1b\[[0-9;]*m/g, ""));
+    // Keeping a key that no longer works says so instead of claiming a connection.
+    const collapsed = connectMenu().collapsed!("keep").map((l) => l.replace(/\x1b\[[0-9;]*m/g, ""));
     expect(collapsed[1]).toBe("✓ Not connecting. The connection to app.befailproof.ai is unchanged.");
   });
 
@@ -859,9 +945,9 @@ describe("connect step", () => {
   it("refuses an unusable FAILPROOFAI_CLOUD_URL instead of falling back to hosted", async () => {
     process.env.FAILPROOFAI_CLOUD_URL = "http://cloud.example.com";
     const io = ttyIO();
-    drive({ cloud: OPEN_SOURCE });
+    connectPick = "key";
     const result = await runConfigureWizard(io);
-    // Said above the field, which stays open: a typed key is refused there,
+    // Said above the menu, which stays open: a typed key is refused there,
     // without anything being sent anywhere.
     expect(printed(io.stdout)).toContain('FAILPROOFAI_CLOUD_URL is set to "http://cloud.example.com", which cannot be used');
     const verdict = await cloudOpts().check!("a-real-looking-key");
@@ -1003,9 +1089,15 @@ describe("daemon step", () => {
     vi.mocked(daemonServiceStatus).mockReturnValue("not-installed");
     const order: string[] = [];
     vi.mocked(primeElevation).mockImplementation(() => (order.push("sudo"), true));
-    vi.mocked(promptCloudKey).mockImplementation(async () => (order.push("key"), OPEN_SOURCE));
+    const menu = vi.mocked(selectOne).getMockImplementation()!;
+    vi.mocked(selectOne).mockImplementation((async (opts: { message: string }) => {
+      if (opts.message === "Connect to cloud") order.push("connect");
+      return menu(opts as never);
+    }) as never);
     await runConfigureWizard(ttyIO());
-    expect(order).toEqual(["sudo", "key"]);
+    // The sudo prompt first, then the CONNECT menu. (canElevate is mocked
+    // true, so apply does not need to ask again.)
+    expect(order).toEqual(["sudo", "connect"]);
   });
 
   it("stops before writing anything when sudo cannot be had", async () => {
@@ -1298,3 +1390,206 @@ describe("first-run redirect", () => {
     expect(await maybeFirstRunConfigure(ttyIO())).toBe(false);
   });
 });
+
+describe("browser login", () => {
+  const approval = {
+    kind: "login" as const,
+    pollSecret: "poll-secret-1",
+    org: { id: "o1", slug: "acme", name: "Acme" },
+    approvedBy: "ada@acme.test",
+    keyName: "failproofai · box",
+    permissions: ["events:add", "policies:pull"],
+  };
+  const loginOpts = (): BrowserLoginOptions<typeof approval> =>
+    vi.mocked(promptBrowserLogin).mock.calls.at(-1)![0] as unknown as BrowserLoginOptions<typeof approval>;
+
+  beforeEach(() => {
+    vi.mocked(promptBrowserLogin).mockReset().mockResolvedValue({ value: approval } as never);
+    vi.mocked(startLogin).mockReset();
+    vi.mocked(pollLogin).mockReset();
+    vi.mocked(claimLogin)
+      .mockReset()
+      .mockResolvedValue({ kind: "ok", key: "minted-key", org: approval.org, permissions: approval.permissions, approvedBy: approval.approvedBy });
+    vi.mocked(openUrl).mockReset();
+    vi.mocked(canOpenBrowser).mockReset().mockReturnValue(true);
+  });
+
+  it("logs in, then claims the key at apply and connects with it", async () => {
+    connectPick = "login";
+    const io = ttyIO();
+    const result = await runConfigureWizard(io);
+    expect(result).toMatchObject({ applied: true, connected: true });
+    expect(claimLogin).toHaveBeenCalledWith("https://app.befailproof.ai", "poll-secret-1");
+    expect(vi.mocked(connectToCloud).mock.calls[0]![0]).toMatchObject({
+      url: "https://app.befailproof.ai",
+      token: "minted-key",
+      sessions: true,
+    });
+    // The screen collapses to who approved it and where — drawn by the login
+    // prompt, mocked here, so read from the lines it was handed.
+    const collapsed = loginOpts()
+      .collapsed(approval)
+      .map((l) => l.replace(/\x1b\[[0-9;]*m/g, ""));
+    expect(collapsed[1]).toBe("✓ Logged in as ada@acme.test · Acme (acme) on app.befailproof.ai");
+    expect(printed(io.stdout)).not.toContain("minted-key");
+  });
+
+  it("claims only after the daemon is in, so a failed install mints nothing", async () => {
+    vi.mocked(daemonServiceStatus).mockReturnValue("not-installed");
+    const order: string[] = [];
+    vi.mocked(installDaemonService).mockImplementation(async () => (order.push("install"), { installed: true }));
+    vi.mocked(claimLogin).mockImplementation(async () => {
+      order.push("claim");
+      return { kind: "ok", key: "minted-key", org: approval.org, permissions: [] };
+    });
+    connectPick = "login";
+    await runConfigureWizard(ttyIO());
+    expect(order).toEqual(["install", "claim"]);
+
+    vi.mocked(claimLogin).mockClear();
+    vi.mocked(installDaemonService).mockResolvedValue({ installed: false, reason: "systemd said no" });
+    connectPick = "login";
+    const failed = await runConfigureWizard(ttyIO());
+    expect(failed).toMatchObject({ applied: false, abort: "daemon_failed" });
+    expect(claimLogin).not.toHaveBeenCalled();
+  });
+
+  it("goes back to the menu on esc, and claims nothing", async () => {
+    vi.mocked(promptBrowserLogin).mockResolvedValueOnce(BACK as never);
+    connectPick = "login";
+    const result = await runConfigureWizard(ttyIO());
+    // Back at the menu, its default (open source) finished the run.
+    expect(vi.mocked(selectOne).mock.calls.filter((c) => (c[0] as { message: string }).message === "Connect to cloud")).toHaveLength(2);
+    expect(result).toMatchObject({ applied: true, mode: "oss" });
+    expect(claimLogin).not.toHaveBeenCalled();
+  });
+
+  it("cancels the whole run on ctrl-c, writing nothing", async () => {
+    vi.mocked(promptBrowserLogin).mockResolvedValueOnce(null as never);
+    connectPick = "login";
+    const result = await runConfigureWizard(ttyIO());
+    expect(result).toEqual({ applied: false, abort: "cancelled" });
+    expect(claimLogin).not.toHaveBeenCalled();
+    expect(installHooks).not.toHaveBeenCalled();
+  });
+
+  it("finishes the rest of setup when the key can't be created, and says why", async () => {
+    vi.mocked(claimLogin).mockResolvedValue({ kind: "expired" });
+    connectPick = "login";
+    const io = ttyIO();
+    const result = await runConfigureWizard(io);
+    expect(result).toMatchObject({ applied: true, connected: false });
+    expect(connectToCloud).not.toHaveBeenCalled();
+    expect(installHooks).toHaveBeenCalledTimes(1);
+    expect(printed(io.stdout)).toContain("The login took too long to finish, so no key was created.");
+  });
+
+  it("says the old key still works after logging in again on a connected machine", async () => {
+    writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
+    connectPick = "login";
+    const io = ttyIO();
+    await runConfigureWizard(io);
+    expect(connectMenu().choices.find((c) => c.value === "login")?.label).toBe("Log in again");
+    expect(printed(io.stdout)).toContain("Your previous key for this machine still works until you revoke it");
+  });
+
+  it("asks for sudo again at apply when it expired during the login", async () => {
+    vi.mocked(daemonServiceStatus).mockReturnValue("not-installed");
+    vi.mocked(primeElevation).mockClear().mockReturnValue(true);
+    // Root at the start; gone by apply.
+    vi.mocked(canElevate).mockReturnValue(false);
+    connectPick = "login";
+    const io = ttyIO();
+    const result = await runConfigureWizard(io);
+    expect(primeElevation).toHaveBeenCalledTimes(2);
+    expect(printed(io.stdout)).toContain("Your sudo session expired while you were away.");
+    expect(result.applied).toBe(true);
+
+    // And when that second ask fails, nothing is claimed and nothing installed.
+    vi.mocked(claimLogin).mockClear();
+    vi.mocked(installDaemonService).mockClear();
+    vi.mocked(primeElevation).mockReset().mockReturnValueOnce(true).mockReturnValueOnce(false);
+    connectPick = "login";
+    const stopped = await runConfigureWizard(ttyIO());
+    expect(stopped).toEqual({ applied: false, abort: "needs_root" });
+    expect(installDaemonService).not.toHaveBeenCalled();
+    expect(claimLogin).not.toHaveBeenCalled();
+    vi.mocked(canElevate).mockReturnValue(true);
+  });
+
+  it("starts with this machine's name and OS, and maps an older cloud to the key route", async () => {
+    connectPick = "login";
+    await runConfigureWizard(ttyIO(), { machineLabel: "build-box-7" });
+    const opts = loginOpts();
+    expect(opts.machineLabel).toBe("build-box-7");
+
+    vi.mocked(startLogin).mockResolvedValueOnce({
+      kind: "ok",
+      verificationUrl: "https://app.befailproof.ai/cli/authorize?r=abc",
+      pollSecret: "s1",
+      expiresIn: 600,
+      interval: 2,
+    });
+    expect(await opts.start()).toEqual({
+      ok: true,
+      url: "https://app.befailproof.ai/cli/authorize?r=abc",
+      expiresIn: 600,
+      interval: 2,
+    });
+    expect(vi.mocked(startLogin).mock.calls[0]![1]).toMatchObject({ label: "build-box-7" });
+
+    vi.mocked(startLogin).mockResolvedValueOnce({ kind: "unsupported" });
+    expect(await opts.start()).toMatchObject({ ok: false, retryable: false });
+    vi.mocked(startLogin).mockResolvedValueOnce({ kind: "unreachable", reason: "offline" });
+    expect(await opts.start()).toMatchObject({ ok: false, retryable: true });
+  });
+
+  it("polls with the secret from the latest link, and treats a used or unknown link as expired", async () => {
+    connectPick = "login";
+    await runConfigureWizard(ttyIO());
+    const opts = loginOpts();
+    vi.mocked(startLogin).mockResolvedValueOnce({
+      kind: "ok", verificationUrl: "https://x.test/cli/authorize?r=1", pollSecret: "first", expiresIn: 600, interval: 2,
+    });
+    await opts.start();
+    vi.mocked(startLogin).mockResolvedValueOnce({
+      kind: "ok", verificationUrl: "https://x.test/cli/authorize?r=2", pollSecret: "second", expiresIn: 600, interval: 2,
+    });
+    await opts.start();
+    vi.mocked(pollLogin).mockResolvedValueOnce({ kind: "pending", interval: 3 });
+    expect(await opts.poll()).toEqual({ state: "pending", interval: 3 });
+    expect(vi.mocked(pollLogin).mock.calls[0]![1]).toBe("second");
+
+    for (const kind of ["claimed", "unknown", "expired"] as const) {
+      vi.mocked(pollLogin).mockResolvedValueOnce({ kind });
+      expect(await opts.poll()).toEqual({ state: "expired" });
+    }
+    vi.mocked(pollLogin).mockResolvedValueOnce({ kind: "denied" });
+    expect(await opts.poll()).toEqual({ state: "denied" });
+    vi.mocked(pollLogin).mockResolvedValueOnce({
+      kind: "approved", org: { slug: "acme", name: "Acme" }, approvedBy: "ada@acme.test", permissions: ["events:add"],
+    });
+    expect(await opts.poll()).toMatchObject({
+      state: "approved",
+      value: { kind: "login", pollSecret: "second", approvedBy: "ada@acme.test" },
+    });
+  });
+
+  it("prints the link instead of opening a browser over SSH or with no display", async () => {
+    connectPick = "login";
+    await runConfigureWizard(ttyIO());
+    vi.mocked(canOpenBrowser).mockReturnValue(false);
+    expect(loginOpts().open("https://x.test/cli/authorize?r=1")).toBe(false);
+    expect(openUrl).not.toHaveBeenCalled();
+    vi.mocked(canOpenBrowser).mockReturnValue(true);
+    expect(loginOpts().open("https://x.test/cli/authorize?r=1")).toBe(true);
+    expect(openUrl).toHaveBeenCalledWith("https://x.test/cli/authorize?r=1");
+  });
+
+  it("never offers login to a run with no terminal", async () => {
+    const result = await runConfigureWizard(headlessIO());
+    expect(result.applied).toBe(true);
+    expect(promptBrowserLogin).not.toHaveBeenCalled();
+    expect(claimLogin).not.toHaveBeenCalled();
+  });
+});
diff --git a/docs/reference/failproof-cli.mdx b/docs/reference/failproof-cli.mdx
index fc30731e0..f9476a21c 100644
--- a/docs/reference/failproof-cli.mdx
+++ b/docs/reference/failproof-cli.mdx
@@ -25,7 +25,9 @@ failproofai policies add FailproofAI/policies
 failproofai config --status
 ```
 
-`failproofai config` is the whole of setup: it installs the `failproofaid` service (root once, via `sudo -n` — never an interactive password prompt), wires hooks into every agent CLI it finds, and connects to Cloud when a key is available. With no terminal — CI, a container, an agent driving it — it applies rather than asking, and exits 1 if anything it was asked to do did not happen.
+`failproofai config` is the whole of setup: it installs the `failproofaid` service (root once, via `sudo -n` — never an interactive password prompt), wires hooks into every agent CLI it finds, and connects to Cloud. With no terminal — CI, a container, an agent driving it — it applies rather than asking, and exits 1 if anything it was asked to do did not happen.
+
+In a terminal, the **Connect to cloud** step offers **Log in to FailproofAI Cloud** (the default), **Paste an API key**, or **Use open source**. Logging in opens a link — or prints it over SSH or with no display, to open on any device — where you sign up or sign in, pick or create an org, and authorize the machine; the terminal picks up the approval by itself and shows who approved it and for which org. The key is minted only when setup finishes, after the daemon is installed. On a machine that is already connected, **Keep current connection** comes first, unless its saved key no longer works, in which case **Log in again** does; logging in again makes a new key and leaves the old one working until you revoke it. A Cloud from before browser login says so, and pasting a key still works.
 
 It chooses **no** policies. That is the second command's job, and without it a freshly configured machine enforces nothing but the always-on guard.
 
@@ -39,7 +41,7 @@ Run `failproofai` without arguments to open the local policy dashboard.
 
 | Command | Outcome |
 | --- | --- |
-| `failproofai config` | Set the machine up: agents, daemon, and Cloud when a key is present |
+| `failproofai config` | Set the machine up: agents, daemon, and Cloud — log in through the browser, paste a key, or stay open source |
 | `failproofai config --token <key>` | Set up and connect in one pass, asking nothing. A key that carries `jev:evaluate` also turns on [Jev through FailproofAI Cloud](/reference/jev-cloud) in observe mode, unless a `jev.json` already exists or `--no-transcripts` is given |
 | `failproofai config --connect <url>` | Enrol a machine that is **already** set up — no daemon, no hooks |
 | `failproofai config --status` | Show connection, daemon, delivery, and pause state |
diff --git a/docs/start/quickstart.mdx b/docs/start/quickstart.mdx
index c22af8ac1..df875754e 100644
--- a/docs/start/quickstart.mdx
+++ b/docs/start/quickstart.mdx
@@ -26,26 +26,31 @@ This quickstart gets one machine reporting sessions, runs an audit, and deploys
     </Steps>
   </Tab>
   <Tab title="Manual setup">
-    ## Before you start
-
-1. Open the [Failproof AI dashboard](https://app.befailproof.ai) and create an account or sign in with your work email.
-2. Go to **Administration → Keys** and create a key with `events:add` and `policies:pull`. If you plan to use [Jev through FailproofAI Cloud](/reference/jev-cloud), choose the **machine** preset, which also grants `jev:evaluate`.
-3. Copy the one-time secret, then read it into a shell on the target machine. `read -s` takes it at a prompt that does not echo, so it never appears in a command:
-
-```bash
-read -rs FAILPROOFAI_KEY && export FAILPROOFAI_KEY
-```
-
     ## Install
 
 <Steps>
   <Step title="Install and connect Failproof AI">
     ```bash
     npm install -g failproofai
-    FAILPROOFAI_CLOUD_TOKEN="$FAILPROOFAI_KEY" failproofai config
+    failproofai config
     ```
 
-    That one command is the whole of setup: it installs the local daemon (root once), wires hooks into every agent CLI it finds, and connects this machine to Cloud. Passing the key through the environment rather than `--token` keeps it out of `ps`, where every user on the machine can read a command's arguments. It does not keep it out of shell history — reading it with `read -s` is what does that. In CI, inject it as a masked secret and keep shell tracing (`set -x`) off, or the trace prints it.
+    That one command is the whole of setup: it installs the local daemon (root once), wires hooks into every agent CLI it finds, and connects this machine to Cloud.
+
+    At **Connect to cloud**, choose **Log in to FailproofAI Cloud** — the default. Setup opens a link in your browser (over SSH, or on a machine with no display, it prints the link so you can open it on any device). Sign up or sign in, pick an org — or create one right there — check the key's name and permissions, and click **Authorize**. You do not need an account beforehand.
+
+    The terminal notices on its own and shows who approved it and for which org. Confirm the agents to trace, and setup finishes. The machine's key is created only at that point, after the daemon is installed, so a run you abandon leaves no key behind; it appears under **Administration → Keys** marked **cli login**, where you can revoke it.
+
+    <Accordion title="No browser or terminal at hand? Use a key (CI, containers, provisioning scripts)">
+      In the [Failproof AI dashboard](https://app.befailproof.ai), go to **Administration → Keys** and create a key with `events:add` and `policies:pull`. If you plan to use [Jev through FailproofAI Cloud](/reference/jev-cloud), choose the **machine** preset, which also grants `jev:evaluate`. Copy the one-time secret and read it into a shell on the target machine — `read -s` takes it at a prompt that does not echo:
+
+      ```bash
+      read -rs FAILPROOFAI_KEY && export FAILPROOFAI_KEY
+      FAILPROOFAI_CLOUD_TOKEN="$FAILPROOFAI_KEY" failproofai config
+      ```
+
+      Passing the key through the environment rather than `--token` keeps it out of `ps`, where every user on the machine can read a command's arguments. It does not keep it out of shell history — reading it with `read -s` is what does that. In CI, inject it as a masked secret and keep shell tracing (`set -x`) off, or the trace prints it. In an interactive run you can also pick **Paste an API key** at **Connect to cloud** instead.
+    </Accordion>
 
     Session transcripts are sent by default. Add `--no-transcripts` to report hook activity and policy decisions without transcript content.
 
diff --git a/src/audit/open-browser.ts b/src/audit/open-browser.ts
index d5945c206..e00cb98ae 100644
--- a/src/audit/open-browser.ts
+++ b/src/audit/open-browser.ts
@@ -13,8 +13,26 @@ import { spawn } from "node:child_process";
 const POLL_INTERVAL_MS = 150;
 const POLL_TIMEOUT_MS = 30_000;
 
+/**
+ * Whether opening a browser here can put a page in front of the person.
+ *
+ * False over SSH — `xdg-open` would start a browser on the REMOTE machine, or
+ * fail, while the person is looking at their own screen — and on a Linux box
+ * with no display at all (a container, a server). Callers then print the link,
+ * which works from any device. A guess, not a promise: a false positive costs a
+ * browser that does not appear next to a link that is printed anyway.
+ */
+export function canOpenBrowser(
+  env: NodeJS.ProcessEnv = process.env,
+  platform: NodeJS.Platform = process.platform,
+): boolean {
+  if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY) return false;
+  if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY) return false;
+  return true;
+}
+
 /** Open a URL with the platform's default handler. Never throws. */
-function openUrl(url: string): void {
+export function openUrl(url: string): void {
   let cmd: string;
   let args: string[];
   if (process.platform === "darwin") {
diff --git a/src/hooks/cloud-login.ts b/src/hooks/cloud-login.ts
new file mode 100644
index 000000000..f3c656f79
--- /dev/null
+++ b/src/hooks/cloud-login.ts
@@ -0,0 +1,223 @@
+/**
+ * The CLI half of "Log in to FailproofAI Cloud" — `failproofai config`'s
+ * browser login.
+ *
+ * The CLI asks the dashboard for a link, a person approves it in a browser
+ * (signing up, signing in, picking or creating an org on the way), and the CLI
+ * — polling with a secret only it holds — sees the approval and, once setup has
+ * finished, claims a freshly minted machine key. The server side is
+ * `server/src/routes/cli_login.rs` in AgentEye; the relay is the dashboard's
+ * `/api/auth/cli/*`.
+ *
+ * Three calls, each with an injectable `fetch` so tests never reach the network:
+ *   start → { verificationUrl, pollSecret, expiresIn, interval }
+ *   poll  → pending / slow_down / approved (org + who) / denied / expired / …
+ *   claim → the key, exactly once. Called at APPLY, after the daemon installs:
+ *           an approval that is never claimed leaves no key behind.
+ *
+ * Every call refuses to follow a redirect, for the reason `introspectKey` gives:
+ * a dashboard that does not know a path can answer with a login page, and a 200
+ * from that must never read as success.
+ */
+
+export const LOGIN_START_PATH = "/api/auth/cli/start";
+export const LOGIN_POLL_PATH = "/api/auth/cli/poll";
+export const LOGIN_CLAIM_PATH = "/api/auth/cli/claim";
+
+const TIMEOUT_MS = 10_000;
+
+export interface LoginOrg {
+  id?: string;
+  slug?: string;
+  name?: string;
+}
+
+export type StartResult =
+  | { kind: "ok"; verificationUrl: string; pollSecret: string; expiresIn: number; interval: number }
+  /** This cloud predates browser login. Pasting a key still works. */
+  | { kind: "unsupported" }
+  | { kind: "refused"; reason: string }
+  | { kind: "unreachable"; reason: string };
+
+export type PollResult =
+  | { kind: "pending"; interval?: number }
+  | { kind: "slow_down" }
+  | { kind: "approved"; org: LoginOrg; approvedBy?: string; keyName?: string; permissions: string[] }
+  | { kind: "denied" }
+  | { kind: "expired" }
+  | { kind: "claimed" }
+  /** The server no longer knows this request (swept, or never existed). */
+  | { kind: "unknown" }
+  | { kind: "unreachable"; reason: string };
+
+export type ClaimResult =
+  | {
+      kind: "ok";
+      key: string;
+      keyId?: string;
+      keyName?: string;
+      org: LoginOrg;
+      permissions: string[];
+      approvedBy?: string;
+    }
+  | { kind: "expired" }
+  /** The person who approved can no longer grant this key. */
+  | { kind: "revoked" }
+  | { kind: "refused"; reason: string }
+  | { kind: "unreachable"; reason: string };
+
+type Fetch = typeof fetch;
+
+async function postJson(
+  origin: string,
+  path: string,
+  body: unknown,
+  fetchImpl: Fetch,
+): Promise<{ status: number; json: Record<string, unknown> | null } | { error: string }> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const res = await fetchImpl(`${origin.replace(/\/+$/, "")}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      redirect: "manual",
+      signal: controller.signal,
+    });
+    let json: Record<string, unknown> | null = null;
+    try {
+      const parsed: unknown = await res.json();
+      json = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? (parsed as Record<string, unknown>) : null;
+    } catch {
+      json = null;
+    }
+    return { status: res.status, json };
+  } catch (err) {
+    // Deliberately not the URL: setup is often run while screen-sharing.
+    return { error: err instanceof Error ? (err.name === "AbortError" ? "timed out" : err.message) : String(err) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+const str = (v: unknown): string | undefined => (typeof v === "string" && v.length > 0 ? v : undefined);
+
+function org(v: unknown): LoginOrg {
+  const o = v && typeof v === "object" ? (v as Record<string, unknown>) : {};
+  return { id: str(o.id), slug: str(o.slug), name: str(o.name) };
+}
+
+function permissions(v: unknown): string[] {
+  return Array.isArray(v) ? v.filter((p): p is string => typeof p === "string") : [];
+}
+
+/**
+ * Only an http(s) link is ever handed to the browser opener. The URL comes from
+ * the server, and `xdg-open` / `open` will happily act on any scheme they know.
+ */
+export function isOpenableUrl(raw: string): boolean {
+  try {
+    const u = new URL(raw);
+    return u.protocol === "https:" || u.protocol === "http:";
+  } catch {
+    return false;
+  }
+}
+
+/** What the browser page should call this machine and its OS. */
+export function machineOs(platform: NodeJS.Platform = process.platform): string {
+  return platform === "darwin" ? "macOS" : platform === "win32" ? "windows" : platform;
+}
+
+export async function startLogin(
+  origin: string,
+  machine: { label: string; os: string; cliVersion: string },
+  fetchImpl: Fetch = fetch,
+): Promise<StartResult> {
+  const r = await postJson(
+    origin,
+    LOGIN_START_PATH,
+    { machine_label: machine.label, machine_os: machine.os, cli_version: machine.cliVersion },
+    fetchImpl,
+  );
+  if ("error" in r) return { kind: "unreachable", reason: r.error };
+  // No such route, or the web app redirecting an unknown path: a cloud from
+  // before this feature. Not an error — the key prompt still connects it.
+  if (r.status === 404 || (r.status >= 300 && r.status < 400)) return { kind: "unsupported" };
+  if (r.status === 429) return { kind: "refused", reason: "too many login attempts from here — wait a minute" };
+  if (r.status !== 201 || !r.json) {
+    return r.status >= 500
+      ? { kind: "unreachable", reason: `the server answered ${r.status}` }
+      : { kind: "refused", reason: str(r.json?.error) ?? `the server answered ${r.status}` };
+  }
+  const verificationUrl = str(r.json.verification_url);
+  const pollSecret = str(r.json.poll_secret);
+  if (!verificationUrl || !pollSecret || !isOpenableUrl(verificationUrl)) {
+    // A 201 without the fields is something other than this API.
+    return { kind: "unsupported" };
+  }
+  const n = (v: unknown, d: number) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : d);
+  return {
+    kind: "ok",
+    verificationUrl,
+    pollSecret,
+    expiresIn: n(r.json.expires_in, 600),
+    interval: n(r.json.interval, 2),
+  };
+}
+
+export async function pollLogin(origin: string, pollSecret: string, fetchImpl: Fetch = fetch): Promise<PollResult> {
+  const r = await postJson(origin, LOGIN_POLL_PATH, { poll_secret: pollSecret }, fetchImpl);
+  if ("error" in r) return { kind: "unreachable", reason: r.error };
+  if (r.status === 404) return { kind: "unknown" };
+  if (r.status !== 200 || !r.json) return { kind: "unreachable", reason: `the server answered ${r.status}` };
+  const j = r.json;
+  switch (j.status) {
+    case "pending":
+      return { kind: "pending", interval: typeof j.interval === "number" ? j.interval : undefined };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "approved":
+      return {
+        kind: "approved",
+        org: org(j.org),
+        approvedBy: str(j.approved_by),
+        keyName: str(j.key_name),
+        permissions: permissions(j.permissions),
+      };
+    case "denied":
+      return { kind: "denied" };
+    case "expired":
+      return { kind: "expired" };
+    case "claimed":
+      return { kind: "claimed" };
+    default:
+      return { kind: "unknown" };
+  }
+}
+
+export async function claimLogin(origin: string, pollSecret: string, fetchImpl: Fetch = fetch): Promise<ClaimResult> {
+  const r = await postJson(origin, LOGIN_CLAIM_PATH, { poll_secret: pollSecret }, fetchImpl);
+  if ("error" in r) return { kind: "unreachable", reason: r.error };
+  const j = r.json ?? {};
+  if (r.status === 201) {
+    const key = str(j.api_key);
+    if (!key) return { kind: "refused", reason: "the server answered without a key" };
+    return {
+      kind: "ok",
+      key,
+      keyId: str(j.key_id),
+      keyName: str(j.key_name),
+      org: org(j.org),
+      permissions: permissions(j.permissions),
+      approvedBy: str(j.approved_by),
+    };
+  }
+  if (r.status === 410) return { kind: "expired" };
+  if (r.status === 403 && j.error === "approval_revoked") return { kind: "revoked" };
+  if (r.status >= 500) return { kind: "unreachable", reason: `the server answered ${r.status}` };
+  return {
+    kind: "refused",
+    reason: str(j.status) ? `the login request is ${String(j.status)}` : `the server answered ${r.status}`,
+  };
+}
diff --git a/src/hooks/configure-wizard.ts b/src/hooks/configure-wizard.ts
index e62a21c99..432869177 100644
--- a/src/hooks/configure-wizard.ts
+++ b/src/hooks/configure-wizard.ts
@@ -30,20 +30,26 @@ import { dirname, resolve, sep } from "node:path";
 import { CORE_SOURCE } from "./pack-store";
 
 import {
+  BACK,
   collapseAfter,
   colorsEnabled,
   multiSelect,
   OPEN_SOURCE,
   optsFor,
   paint,
+  promptBrowserLogin,
   promptCloudKey,
   screenKit,
+  selectOne,
   type CloudKeyAnswer,
   type MultiChoice,
   type OpenSource,
+  type SelectChoice,
   type TTYIn,
   type TTYOut,
 } from "./tui";
+import { claimLogin, machineOs, pollLogin, startLogin, type LoginOrg } from "./cloud-login";
+import { canOpenBrowser, openUrl } from "../audit/open-browser";
 import {
   DEFAULT_INGEST_URL,
   readIngestCredential,
@@ -998,6 +1004,173 @@ export async function runConfigureWizard(
       stdout,
     });
 
+  // A key typed after picking "Paste an API key" from the menu. Same field as
+  // above minus the saved key, which the menu already offered as "keep"; Tab is
+  // the way back to the menu, so it never means open source here.
+  const askKey = (): Promise<CloudKeyAnswer | OpenSource | null> =>
+    promptCloudKey({
+      message: "Connect to cloud",
+      meta: source ? `${host}  ·  from ${source}` : host,
+      tabHint: "go back",
+      emptyError: "Paste a key, or press tab to go back.",
+      check: async (key) => {
+        if (!url) return { ok: false, line: badUrl ?? "No usable endpoint." };
+        const r = await checkCloudKey(url, key);
+        if (r.ok) {
+          typedOrg = r.org;
+          return { ok: true, line: r.note };
+        }
+        return { ok: false, line: r.refused ? `That key was refused: ${r.reason}.` : `Couldn't check the key: ${r.reason}.` };
+      },
+      collapsed: (answer) => (answer === OPEN_SOURCE ? [] : [...cloudLines(planFor(answer)), ""]),
+      stdin,
+      stdout,
+    });
+
+  // The browser login. Resolves the approval, BACK to return to the menu, or
+  // null when the person cancelled the whole run.
+  type Approval = Extract<CloudPlan, { kind: "login" }>;
+  const askLogin = (endpoint: string): Promise<{ value: Approval } | typeof BACK | null> => {
+    let pollSecret = "";
+    return promptBrowserLogin<Approval>({
+      message: "Connect to cloud",
+      meta: source ? `${host}  ·  from ${source}` : host,
+      machineLabel,
+      start: async () => {
+        const r = await startLogin(endpoint, { label: machineLabel, os: machineOs(), cliVersion });
+        if (r.kind === "ok") {
+          pollSecret = r.pollSecret;
+          void emit("configure_cloud_login", { step: "started" });
+          return { ok: true, url: r.verificationUrl, expiresIn: r.expiresIn, interval: r.interval };
+        }
+        if (r.kind === "unsupported") {
+          void emit("configure_cloud_login", { step: "unsupported" });
+          return {
+            ok: false,
+            retryable: false,
+            line: `${host} doesn't support logging in from here yet. Press esc and paste an API key instead.`,
+          };
+        }
+        return {
+          ok: false,
+          retryable: true,
+          line: r.kind === "refused" ? `Couldn't start the login: ${r.reason}.` : `Couldn't reach ${host}: ${r.reason}.`,
+        };
+      },
+      poll: async () => {
+        const p = await pollLogin(endpoint, pollSecret);
+        switch (p.kind) {
+          case "approved":
+            void emit("configure_cloud_login", { step: "approved" });
+            return {
+              state: "approved",
+              value: {
+                kind: "login",
+                pollSecret,
+                org: p.org,
+                approvedBy: p.approvedBy,
+                keyName: p.keyName,
+                permissions: p.permissions,
+              },
+            };
+          case "pending":
+            return { state: "pending", interval: p.interval };
+          case "slow_down":
+            return { state: "slow_down" };
+          case "denied":
+            void emit("configure_cloud_login", { step: "denied" });
+            return { state: "denied" };
+          case "unreachable":
+            return { state: "unreachable", line: p.reason };
+          // Expired, already claimed, or swept: in every case this link is done.
+          default:
+            return { state: "expired" };
+        }
+      },
+      open: (link) => {
+        if (!canOpenBrowser()) return false;
+        openUrl(link);
+        return true;
+      },
+      collapsed: (plan) => [...cloudLines(plan), ""],
+      stdin,
+      stdout,
+    });
+  };
+
+  // The interactive CONNECT step. Log in through the browser, paste a key, or —
+  // with no connection yet — use open source. A machine that is already
+  // connected is offered "keep" first, unless its key no longer works, in which
+  // case logging in again comes first and says why.
+  const chooseConnection = async (): Promise<CloudPlan | null> => {
+    const verdict =
+      saved && !saved.splitKeys
+        ? await transient("Checking your saved key…", () => checkCloudKey(saved.url, saved.token))
+        : null;
+    const savedBroken = verdict !== null && !verdict.ok && verdict.refused;
+    const keptPlan: CloudPlan =
+      verdict && verdict.ok
+        ? { kind: "kept", how: "saved", verified: true }
+        : verdict && !verdict.refused
+          ? { kind: "kept", how: "saved", verified: false }
+          : { kind: "kept", how: "skip", verified: false };
+    const keepHint = !saved
+      ? ""
+      : saved.splitKeys
+        ? "leave both keys as they are"
+        : verdict?.ok
+          ? `${verdict.org ?? saved.org ?? hostOf(saved.url)} · key ${maskToken(saved.token)}`
+          : savedBroken
+            ? "its key no longer works"
+            : "its key couldn't be checked just now";
+
+    type Pick = "login" | "key" | "oss" | "keep";
+    const login: SelectChoice<Pick> = {
+      label: saved ? "Log in again" : "Log in to FailproofAI Cloud",
+      value: "login",
+      hint: savedBroken
+        ? "recommended · your saved key no longer works"
+        : saved
+          ? "opens your browser and makes a new key"
+          : "recommended · opens your browser",
+    };
+    const key: SelectChoice<Pick> = { label: "Paste an API key", value: "key", hint: "one you already have" };
+    const oss: SelectChoice<Pick> = { label: "Use open source", value: "oss", hint: "skip the cloud" };
+    const keep: SelectChoice<Pick> = { label: "Keep current connection", value: "keep", hint: keepHint };
+    // No initial-cursor option on selectOne: the default is whatever is first.
+    const choices = !saved ? [login, key, oss] : savedBroken ? [login, key, keep] : [keep, login, key];
+
+    for (;;) {
+      const pick = await selectOne<Pick>({
+        message: "Connect to cloud",
+        meta: source ? `${host}  ·  from ${source}` : host,
+        choices,
+        collapsed: (p) =>
+          p === "keep" ? [...cloudLines(keptPlan), ""] : p === "oss" ? [...cloudLines({ kind: "oss" }), ""] : [],
+        stdin,
+        stdout,
+      });
+      if (pick === null) return null;
+      void emit("configure_cloud_choice", { choice: pick, connected: Boolean(saved) });
+      if (pick === "keep") return keptPlan;
+      if (pick === "oss") return { kind: "oss" };
+      if (pick === "key") {
+        const answer = await askKey();
+        if (answer === null) return null;
+        if (answer === OPEN_SOURCE) continue;
+        return planFor(answer);
+      }
+      if (!url) {
+        write([kit.fail(badUrl ?? "No usable endpoint."), ""]);
+        continue;
+      }
+      const result = await askLogin(url);
+      if (result === null) return null;
+      if (result === BACK) continue;
+      return result.value;
+    }
+  };
+
   let cloud: CloudPlan;
   if (answers.oss) {
     cloud = saved ? { kind: "kept", how: "skip", verified: false } : { kind: "oss" };
@@ -1032,11 +1205,12 @@ export async function runConfigureWizard(
     cloud = saved ? { kind: "kept", how: "skip", verified: false } : { kind: "oss" };
     write([...cloudLines(cloud), ""]);
   } else {
-    // Said above the field, which stays usable for Tab and a saved key.
+    // Said above the menu, which stays usable for keeping a saved key and for
+    // open source, neither of which sends anything anywhere.
     if (badUrl) write([kit.fail(badUrl)]);
-    const answer = await askCloud();
-    if (answer === null) return cancel();
-    cloud = planFor(answer);
+    const chosen = await chooseConnection();
+    if (chosen === null) return cancel();
+    cloud = chosen;
   }
 
   // ── AGENTS ──────────────────────────────────────────────────────────────────
@@ -1049,8 +1223,10 @@ export async function runConfigureWizard(
   // Whether the daemon will be collecting once this run ends: a key is already
   // on disk, or this run writes one. Removal copy and the backfill request both
   // depend on it.
-  const collectingAfter = cloud.kind === "connect" || readIngestCredential() !== null;
-  const sessionsOn = cloud.kind === "connect" ? answers.noTranscripts !== true : fp.collector.sessions === true;
+  // A browser login connects exactly like a pasted key, one step later.
+  const connecting = cloud.kind === "connect" || cloud.kind === "login";
+  const collectingAfter = connecting || readIngestCredential() !== null;
+  const sessionsOn = connecting ? answers.noTranscripts !== true : fp.collector.sessions === true;
 
   let selected: IntegrationType[];
   if (answers.agents && answers.agents.length > 0) {
@@ -1105,6 +1281,27 @@ export async function runConfigureWizard(
   //  5. The connection last.
   const done: string[] = [];
   let daemonInstalled = daemonAlreadyRunning;
+  // The `sudo -v` at the top cached root for sudo's timeout — five minutes by
+  // default on macOS, fifteen on most Linux. A browser login, or simply a slow
+  // agents screen, can outlast it, and the install below runs `sudo -n`, which
+  // would then fail AFTER the person did everything else. Ask once more instead.
+  // Unattended runs never primed anything, so there is nothing to have expired.
+  if (daemonWanted && !unattended) {
+    let stillRoot = false;
+    try {
+      stillRoot = canElevate();
+    } catch {
+      stillRoot = false;
+    }
+    if (!stillRoot && !elevate("Your sudo session expired while you were away. Installing failproofaid needs root again.")) {
+      write([
+        kit.fail("Couldn't get root, so setup stopped before changing anything."),
+        `  Re-run once you can use sudo:  ${kit.cmd("failproofai config")}`,
+      ]);
+      void emit("configure_aborted", { reason: "needs_root" });
+      return { applied: false, abort: "needs_root" };
+    }
+  }
   if (daemonWanted) {
     // A unit that is running but cannot answer is torn down before it is
     // rebuilt: it holds the singleton flock the replacement needs, so
@@ -1214,7 +1411,7 @@ export async function runConfigureWizard(
     pruneOldDaemonBinaries();
   }
 
-  const connectedAfterPlan = cloud.kind === "connect" || cloud.kind === "kept";
+  const connectedAfterPlan = connecting || cloud.kind === "kept";
   // Telemetry runs concurrently with the rest of apply (never rejects,
   // 5s-bounded) and is awaited before returning. `cli` carries the selected
   // agent ids, as it always has (and as hooks_installed does): a fixed list of
@@ -1225,7 +1422,7 @@ export async function runConfigureWizard(
     cli: selected,
     cli_count: selected.length,
     policy_count: (readScopedHooksConfig("user", cwd).enabledPolicies ?? []).length,
-    connected: cloud.kind === "connect",
+    connected: connecting,
     mode: connectedAfterPlan ? "cloud" : "oss",
     agents_selected: selected.length,
     agents_detected: plan.detected.size,
@@ -1273,8 +1470,34 @@ export async function runConfigureWizard(
   // a key on disk doing nothing. `connectToCloud` re-verifies each capability
   // and writes only what works.
   let connected = false;
-  if (cloud.kind === "connect" && url) {
-    const token = cloud.token;
+  // A browser login has an approval, not a key: claim it NOW, with the daemon
+  // in, so a run that stopped earlier left nothing minted anywhere. The claim
+  // is single-use — the server mints the key and hands it over exactly once.
+  let token: string | null = cloud.kind === "connect" ? cloud.token : null;
+  let orgLabel: string | undefined = cloud.kind === "connect" ? cloud.org : undefined;
+  if (cloud.kind === "login" && url) {
+    const claimed = await transient("Creating this machine's key…", () => claimLogin(url, cloud.pollSecret));
+    void emit("configure_cloud_login", { step: "claimed", ok: claimed.kind === "ok", reason: claimed.kind });
+    if (claimed.kind === "ok") {
+      token = claimed.key;
+      orgLabel = loginOrgLabel(claimed.org);
+    } else {
+      hookLogWarn(`cloud login could not be completed: ${claimed.kind}`);
+      done.push(
+        kit.caution(
+          claimed.kind === "expired"
+            ? "The login took too long to finish, so no key was created. Everything else was applied."
+            : claimed.kind === "revoked"
+              ? "Whoever approved the login can no longer create keys in that org, so no key was created."
+              : claimed.kind === "unreachable"
+                ? `Couldn't reach ${host} to create the key (${claimed.reason}); everything else was applied.`
+                : `The key couldn't be created: ${claimed.reason}. Everything else was applied.`,
+          "failproofai config",
+        ),
+      );
+    }
+  }
+  if (token && url) {
     try {
       const outcome = await transient("Connecting…", () =>
         connectToCloud({
@@ -1288,7 +1511,12 @@ export async function runConfigureWizard(
       );
       connected = outcome.anyConfigured;
       done.push(...(outcome.changes ?? []));
-      done.push(...connectDoneLines(kit, outcome, host, cloud.org));
+      done.push(...connectDoneLines(kit, outcome, host, orgLabel));
+      // Logging in again makes a NEW key; the one this machine held keeps
+      // working until someone revokes it. Said here, where it is still useful.
+      if (cloud.kind === "login" && saved && connected) {
+        done.push(`  Your previous key for this machine still works until you revoke it on ${host}'s keys page.`);
+      }
       if (outcome.ingest.ok && answers.noTranscripts === true) {
         done.push("  Decisions only: session transcripts are not sent (--no-transcripts).");
       }
@@ -1345,7 +1573,19 @@ export async function runConfigureWizard(
 type CloudPlan =
   | { kind: "oss" }
   | { kind: "kept"; how: "skip" | "saved"; verified: boolean }
-  | { kind: "connect"; token: string; org?: string; note?: string };
+  | { kind: "connect"; token: string; org?: string; note?: string }
+  /**
+   * Approved in the browser, not yet claimed. The key does not exist until
+   * apply claims it — after the daemon is in — so a run that stops before then
+   * leaves no key behind anywhere.
+   */
+  | { kind: "login"; pollSecret: string; org: LoginOrg; approvedBy?: string; keyName?: string; permissions: string[] };
+
+/** "Acme (acme)", or whichever half the server sent. */
+function loginOrgLabel(org: LoginOrg): string {
+  if (org.name && org.slug) return `${org.name} (${org.slug})`;
+  return org.name ?? org.slug ?? "your org";
+}
 
 /**
  * The connection already on this machine, from either credential: the policy
@@ -1477,6 +1717,15 @@ export function cloudCollapsedLines(
         kit.ok(plan.org ? `Key accepted for ${plan.org} on ${at.host}` : `Key accepted by ${at.host}`),
         ...(plan.note ? [kit.caution(plan.note)] : []),
       ];
+    case "login":
+      // Who approved it is said out loud: a link someone else approved into
+      // THEIR org would otherwise connect this machine there unnoticed.
+      return [
+        head,
+        kit.ok(
+          `Logged in${plan.approvedBy ? ` as ${plan.approvedBy}` : ""} · ${loginOrgLabel(plan.org)} on ${at.host}`,
+        ),
+      ];
   }
 }
 
diff --git a/src/hooks/tui.ts b/src/hooks/tui.ts
index e65c24600..d2b60f87c 100644
--- a/src/hooks/tui.ts
+++ b/src/hooks/tui.ts
@@ -1348,6 +1348,258 @@ export function promptCloudKey(opts: CloudKeyPromptOptions): Promise<CloudKeyAns
   });
 }
 
+/** What starting a browser login produced. */
+export type BrowserLoginStart =
+  | { ok: true; url: string; expiresIn: number; interval: number }
+  /** `retryable` is false when trying again cannot help — an older server. */
+  | { ok: false; line: string; retryable: boolean };
+
+/** One "approved yet?" answer. */
+export type BrowserLoginPoll<T> =
+  | { state: "pending"; interval?: number }
+  | { state: "slow_down" }
+  | { state: "approved"; value: T }
+  | { state: "denied" }
+  | { state: "expired" }
+  /** Could not ask. Polling goes on: a dropped connection is not a refusal. */
+  | { state: "unreachable"; line: string };
+
+export interface BrowserLoginOptions<T> {
+  /** The heading, e.g. "Connect to cloud". */
+  message: string;
+  /** Grey text after the heading: the host the login goes to. */
+  meta?: string;
+  /** What is being connected, as the link and the browser page will name it. */
+  machineLabel: string;
+  start: () => Promise<BrowserLoginStart>;
+  poll: () => Promise<BrowserLoginPoll<T>>;
+  /** Try to open the link; false means "print it, do not open" (SSH, no display). */
+  open: (url: string) => boolean;
+  /** The lines the screen collapses to once approved. */
+  collapsed: (value: T) => string[];
+  stdin?: TTYIn;
+  stdout?: TTYOut;
+  /** Injectable clock, for tests. */
+  now?: () => number;
+}
+
+/**
+ * Wait for a person to finish logging in, in a browser.
+ *
+ * Gets a link, opens it (or prints it where a browser cannot be opened — the
+ * link works from any device, so an SSH session needs nothing else), then polls
+ * until the request is approved, refused or expired. Nothing is typed here: the
+ * account side happens entirely in the browser.
+ *
+ * Resolves `{ value }` once approved, `BACK` on Esc (the caller's menu is the
+ * way back out), or `null` on Ctrl-C. An expired or refused link offers a fresh
+ * one on Enter rather than ending the screen.
+ *
+ * The link is printed ABOVE the live region, not inside it: the region is
+ * repainted and cut to the terminal width, and a link that is cut cannot be
+ * clicked or copied.
+ */
+export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ value: T } | Back | null> {
+  const stdin: TTYIn = opts.stdin ?? process.stdin;
+  const stdout: TTYOut = opts.stdout ?? process.stdout;
+  if (!stdin.isTTY || !stdout.isTTY) return Promise.resolve(null);
+
+  const now = opts.now ?? Date.now;
+  const c = paint(colorsEnabled(stdout));
+  const kit = screenKit({ cols: stdout.columns || 80, color: colorsEnabled(stdout) });
+  const spinnerFrames = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏";
+  const region: Region = { lastCount: 0 };
+
+  type Phase = "starting" | "waiting" | "expired" | "denied" | "failed";
+  let phase: Phase = "starting";
+  let failLine = "";
+  let retryable = true;
+  let cautionLine = "";
+  let expiresAt = 0;
+  let interval = 2;
+  let frame = 0;
+  let settled = false;
+  let headingShown = false;
+  let pollTimer: ReturnType<typeof setTimeout> | null = null;
+  let spinTimer: ReturnType<typeof setInterval> | null = null;
+  // Bumped on every new link, so a poll answer for an abandoned link is ignored.
+  let attempt = 0;
+
+  const countdown = (): string => {
+    const left = Math.max(0, Math.ceil((expiresAt - now()) / 1000));
+    return `${Math.floor(left / 60)}:${String(left % 60).padStart(2, "0")}`;
+  };
+
+  const build = (): string[] => {
+    const spin = c.ink3(spinnerFrames[frame % spinnerFrames.length]);
+    switch (phase) {
+      case "starting":
+        return [`${INDENT}${spin} Getting a link…`];
+      case "waiting":
+        return [
+          `${INDENT}${spin} Waiting for you to authorize in the browser  ${c.ink3(`· expires in ${countdown()}`)}`,
+          ...(cautionLine ? [kit.caution(cautionLine)] : []),
+          "",
+          kit.keys(["esc back", "ctrl-c cancel"]),
+        ];
+      case "expired":
+        return [kit.fail("That link expired."), "", kit.keys(["enter new link", "esc back"])];
+      case "denied":
+        return [kit.fail("The request was cancelled in the browser."), "", kit.keys(["enter try again", "esc back"])];
+      case "failed":
+        return [kit.fail(failLine), "", kit.keys(retryable ? ["enter try again", "esc back"] : ["esc back"])];
+    }
+  };
+
+  const draw = (): void => {
+    if (settled) return;
+    // Until a link has been printed above (which carries the heading), the
+    // heading lives in the region — so it shows while starting, and above a
+    // failure to start.
+    repaint(stdout, region, headingShown ? build() : [promptHeading(c, opts.message, opts.meta), ...build()]);
+  };
+
+  /** Write lines above the live region, where nothing repaints or cuts them. */
+  const printAbove = (lines: string[]): void => {
+    const clear = region.lastCount > 0 ? `${ESC}[${region.lastCount}A${ESC}[J` : "";
+    stdout.write(`${clear}${lines.join("\n")}\n`);
+    region.lastCount = 0;
+  };
+
+  const clearPoll = (): void => {
+    if (pollTimer) clearTimeout(pollTimer);
+    pollTimer = null;
+  };
+
+  const restoreTerminal = (): void => showCursor(stdout);
+
+  return new Promise((resolve) => {
+    const wasRaw = stdin.isRaw;
+
+    const finish = (answer: { value: T } | Back | null): void => {
+      if (settled) return;
+      clearPoll();
+      if (spinTimer) clearInterval(spinTimer);
+      stdin.removeListener("keypress", onKey);
+      stdin.setRawMode?.(wasRaw ?? false);
+      stdin.pause();
+      process.removeListener("exit", restoreTerminal);
+      const lines =
+        answer === null
+          ? [c.ink3("cancelled")]
+          : answer === BACK
+            ? []
+            : opts.collapsed(answer.value);
+      repaint(stdout, region, lines, { cut: false });
+      settled = true;
+      restoreTerminal();
+      resolve(answer);
+    };
+
+    const schedulePoll = (forAttempt: number): void => {
+      clearPoll();
+      pollTimer = setTimeout(() => void pollOnce(forAttempt), interval * 1000);
+    };
+
+    const pollOnce = async (forAttempt: number): Promise<void> => {
+      let answer: BrowserLoginPoll<T>;
+      try {
+        answer = await opts.poll();
+      } catch (err) {
+        answer = { state: "unreachable", line: err instanceof Error ? err.message : String(err) };
+      }
+      if (settled || forAttempt !== attempt) return;
+      switch (answer.state) {
+        case "approved":
+          return finish({ value: answer.value });
+        case "denied":
+          phase = "denied";
+          return draw();
+        case "expired":
+          phase = "expired";
+          return draw();
+        case "slow_down":
+          interval = Math.min(10, interval + 2);
+          break;
+        case "unreachable":
+          cautionLine = `Can't reach the server right now (${answer.line}) — still trying.`;
+          break;
+        case "pending":
+          cautionLine = "";
+          if (answer.interval && answer.interval > 0) interval = answer.interval;
+          break;
+      }
+      // The server is the authority on expiry, but a link that is past it by
+      // our own clock too is not worth another round trip.
+      if (now() > expiresAt + interval * 1000) {
+        phase = "expired";
+        return draw();
+      }
+      draw();
+      schedulePoll(forAttempt);
+    };
+
+    const begin = async (): Promise<void> => {
+      const mine = ++attempt;
+      clearPoll();
+      cautionLine = "";
+      phase = "starting";
+      draw();
+      let started: BrowserLoginStart;
+      try {
+        started = await opts.start();
+      } catch (err) {
+        started = { ok: false, line: err instanceof Error ? err.message : String(err), retryable: true };
+      }
+      if (settled || mine !== attempt) return;
+      if (!started.ok) {
+        phase = "failed";
+        failLine = started.line;
+        retryable = started.retryable;
+        return draw();
+      }
+      expiresAt = now() + started.expiresIn * 1000;
+      interval = started.interval > 0 ? started.interval : 2;
+      const opened = opts.open(started.url);
+      printAbove([
+        ...(headingShown ? [] : [promptHeading(c, opts.message, opts.meta)]),
+        opened
+          ? `${INDENT}Opening your browser to connect ${opts.machineLabel}. If it doesn't open, use this link:`
+          : `${INDENT}Open this link in any browser to connect ${opts.machineLabel}:`,
+        `${INDENT}${c.bold(started.url)}`,
+        "",
+      ]);
+      headingShown = true;
+      phase = "waiting";
+      draw();
+      schedulePoll(mine);
+    };
+
+    function onKey(_str: string | undefined, key: readline.Key): void {
+      if (!key || settled) return;
+      if (key.ctrl && (key.name === "c" || key.name === "d")) return finish(null);
+      if (key.name === "escape") return finish(BACK);
+      if ((key.name === "return" || key.name === "enter") && phase !== "waiting" && phase !== "starting") {
+        if (phase === "failed" && !retryable) return;
+        void begin();
+      }
+    }
+
+    process.once("exit", restoreTerminal);
+    readline.emitKeypressEvents(stdin);
+    stdin.setRawMode?.(true);
+    stdin.resume();
+    hideCursor(stdout);
+    stdin.on("keypress", onKey);
+    spinTimer = setInterval(() => {
+      frame++;
+      if (phase === "waiting" || phase === "starting") draw();
+    }, 120);
+    spinTimer.unref?.();
+    void begin();
+  });
+}
+
 // ── the kit ──────────────────────────────────────────────────────────────────
 /**
  * The block builders every PRINTED surface is assembled from.

From 984c3e1d5045684c8a7c66e2ee818f6739a96079 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Tue, 20 Oct 2026 15:33:24 +0530
Subject: [PATCH 02/14] Changelog: PR number for CLI login (#920)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a93bc905b..111c19a19 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,11 +4,11 @@
 
 ### Features
 
-- **Log in to FailproofAI Cloud from `config`.** The connect step now opens with a menu: log in through the browser (the default), paste an API key, or use open source. Logging in opens a link — or prints it over SSH or with no display, to open on any device — where you sign up or sign in, pick or create an org, and authorize the machine; the terminal notices on its own and shows who approved it and for which org. The machine's key is created only when setup finishes, after the daemon is installed, so a run you abandon leaves no key behind. A machine that is already connected is offered "keep" first, or "log in again" first when its saved key no longer works. Needs a FailproofAI Cloud with browser login; an older one says so and pasting a key still works (#TBD)
+- **Log in to FailproofAI Cloud from `config`.** The connect step now opens with a menu: log in through the browser (the default), paste an API key, or use open source. Logging in opens a link — or prints it over SSH or with no display, to open on any device — where you sign up or sign in, pick or create an org, and authorize the machine; the terminal notices on its own and shows who approved it and for which org. The machine's key is created only when setup finishes, after the daemon is installed, so a run you abandon leaves no key behind. A machine that is already connected is offered "keep" first, or "log in again" first when its saved key no longer works. Needs a FailproofAI Cloud with browser login; an older one says so and pasting a key still works (#920)
 
 ### Fixes
 
-- `config` asks for your sudo password again before installing the daemon when the one given at the start expired while you were answering (5 minutes on macOS by default), instead of failing after everything else was done (#TBD)
+- `config` asks for your sudo password again before installing the daemon when the one given at the start expired while you were answering (5 minutes on macOS by default), instead of failing after everything else was done (#920)
 
 ### Dependencies
 

From 4f057ad69f487dc31f5ce1d9de980ad9efaeb642 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Thu, 22 Oct 2026 16:09:02 +0530
Subject: [PATCH 03/14] [config-account-login] Match the simpler authorize
 page; re-ask sudo before a unit refresh

- The terminal now says "Not authorized in the browser." when the person picks
  [ don't authorize ] on the page (was "The request was cancelled in the
  browser."), matching the page's vocabulary; the e2e harness waits for it.
- The quickstart no longer asks people to check the key's name and
  permissions: the page stopped showing them, the server sets both.
- The e2e harness approves without a `jev` flag, exactly as the page does now,
  and still asserts the key gets jev:evaluate because the approver holds it.
- CodeRabbit: the sudo re-ask before apply also covers refreshing a stale
  service definition; failing it there costs the scheduled audit (caution),
  never the setup. The reference doc no longer says setup "never" prompts for
  a password: a terminal run does, and asks again if it expired.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                                 |  2 +-
 __tests__/e2e/layout/cli-login.sh            |  8 +++---
 __tests__/hooks/browser-login-prompt.test.ts |  2 +-
 __tests__/hooks/configure-wizard.test.ts     | 26 ++++++++++++++++++++
 docs/reference/failproof-cli.mdx             |  2 +-
 docs/start/quickstart.mdx                    |  2 +-
 src/hooks/configure-wizard.ts                | 26 ++++++++++++++------
 src/hooks/tui.ts                             |  2 +-
 8 files changed, 53 insertions(+), 17 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 111c19a19..1081db20c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,7 @@
 
 ### Fixes
 
-- `config` asks for your sudo password again before installing the daemon when the one given at the start expired while you were answering (5 minutes on macOS by default), instead of failing after everything else was done (#920)
+- `config` asks for your sudo password again before installing the daemon, or refreshing its service definition, when the one given at the start expired while you were answering (5 minutes on macOS by default), instead of failing after everything else was done (#920)
 
 ### Dependencies
 
diff --git a/__tests__/e2e/layout/cli-login.sh b/__tests__/e2e/layout/cli-login.sh
index 6dbbb74db..ed63e6aa6 100755
--- a/__tests__/e2e/layout/cli-login.sh
+++ b/__tests__/e2e/layout/cli-login.sh
@@ -157,7 +157,7 @@ PAGE=$(person "$SESSION" lookup "{\"link_token\":\"$LINK\"}")
 eq "the page sees a pending request" "$(echo "$PAGE" | jqp '["status"]')" "pending"
 eq "…for this machine" "$(echo "$PAGE" | jqp '["machine"]["label"]')" "$LABEL"
 eq "nothing is minted before approval" "$(keys_in_org)" "0"
-person "$SESSION" approve "{\"link_token\":\"$LINK\",\"org_id\":\"$ORG_ID\",\"jev\":true}" >/dev/null
+person "$SESSION" approve "{\"link_token\":\"$LINK\",\"org_id\":\"$ORG_ID\"}" >/dev/null
 eq "approve answered 200" "$(cat "$OUT/status")" "200"
 T=$(wait_done fresh)
 eq "config exited 0" "$(cat "$OUT/fresh.rc")" "0"
@@ -172,7 +172,7 @@ eq "daemon running under systemd" "$(dex 'systemctl is-active failproofaid@dev'
 KEY=$(dex "python3 -c 'import json;d=json.load(open(\"/home/dev/.failproofai/credentials.json\"));print(d[\"cloud\"][\"token\"])'" | tr -d '\r')
 WHO=$(curl -s "$DASH/v1/auth/introspect" -H "authorization: Bearer $KEY")
 eq "the machine's key works, in the approved org" "$(echo "$WHO" | jqp '["org_slug"]')" "$SLUG"
-has "…with jev, as approved" "$WHO" "jev:evaluate"
+has "…with jev, which the approver holds" "$WHO" "jev:evaluate"
 for _ in $(seq 1 30); do
   [ "$(sql "select count(*) from enforcement_machines where org_id = '$ORG_ID'")" = 1 ] && break; sleep 1
 done
@@ -192,8 +192,8 @@ eq "a second key, the first one still live" "$(sql "select count(*) from api_key
 has "the second key carries a suffix, not a clash" "$(sql "select string_agg(name, ',' order by name) from api_keys where org_id = '$ORG_ID' and created_via = 'cli_login'")" "-2"
 
 # ═════════════════════════════════════════════════════════════════════════════
-head1 "PHASE 3 — cancelled in the browser, retried from the terminal"
-run_config deny "wait:Keep current connection,key:down,key:enter,url,wait:The request was cancelled in the browser.,key:enter,url,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
+head1 "PHASE 3 — not authorized in the browser, retried from the terminal"
+run_config deny "wait:Keep current connection,key:down,key:enter,url,wait:Not authorized in the browser.,key:enter,url,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
 LINK1=$(link_token "$(wait_url deny)")
 person "$SESSION" deny "{\"link_token\":\"$LINK1\"}" >/dev/null
 eq "deny answered 200" "$(cat "$OUT/status")" "200"
diff --git a/__tests__/hooks/browser-login-prompt.test.ts b/__tests__/hooks/browser-login-prompt.test.ts
index e3004c8fe..adbaf4f73 100644
--- a/__tests__/hooks/browser-login-prompt.test.ts
+++ b/__tests__/hooks/browser-login-prompt.test.ts
@@ -137,7 +137,7 @@ describe("promptBrowserLogin", () => {
   it("lets a refusal in the browser be retried", async () => {
     const t = terminal();
     const { pending, start } = ask(t, [{ state: "denied" }, { state: "approved", value: "second-go" }]);
-    await until(() => t.plain().includes("The request was cancelled in the browser."));
+    await until(() => t.plain().includes("Not authorized in the browser."));
     t.type("\r");
     expect(await pending).toEqual({ value: "second-go" });
     expect(start).toHaveBeenCalledTimes(2);
diff --git a/__tests__/hooks/configure-wizard.test.ts b/__tests__/hooks/configure-wizard.test.ts
index 0cd544de0..def6190e5 100644
--- a/__tests__/hooks/configure-wizard.test.ts
+++ b/__tests__/hooks/configure-wizard.test.ts
@@ -1517,6 +1517,32 @@ describe("browser login", () => {
     vi.mocked(canElevate).mockReturnValue(true);
   });
 
+  it("asks for sudo again before refreshing a stale unit, and carries on without it", async () => {
+    vi.mocked(daemonServiceNeedsUpgrade).mockReturnValue(true);
+    vi.mocked(primeElevation).mockClear().mockReturnValue(true);
+    // Root at the start; gone by apply.
+    vi.mocked(canElevate).mockReturnValue(false);
+    connectPick = "login";
+    const io = ttyIO();
+    const result = await runConfigureWizard(io);
+    expect(primeElevation).toHaveBeenCalledTimes(2);
+    expect(printed(io.stdout)).toContain("Refreshing failproofaid's service definition needs root again.");
+    expect(ensureDaemonServiceCurrent).toHaveBeenCalledTimes(1);
+    expect(result.applied).toBe(true);
+
+    // A second ask that fails costs the refresh, never the setup.
+    vi.mocked(ensureDaemonServiceCurrent).mockClear();
+    vi.mocked(primeElevation).mockReset().mockReturnValueOnce(true).mockReturnValueOnce(false);
+    connectPick = "login";
+    const io2 = ttyIO();
+    const carried = await runConfigureWizard(io2);
+    expect(carried.applied).toBe(true);
+    expect(ensureDaemonServiceCurrent).not.toHaveBeenCalled();
+    expect(claimLogin).toHaveBeenCalled();
+    expect(printed(io2.stdout)).toContain("Scheduled audits stay off until it is refreshed.");
+    vi.mocked(canElevate).mockReturnValue(true);
+  });
+
   it("starts with this machine's name and OS, and maps an older cloud to the key route", async () => {
     connectPick = "login";
     await runConfigureWizard(ttyIO(), { machineLabel: "build-box-7" });
diff --git a/docs/reference/failproof-cli.mdx b/docs/reference/failproof-cli.mdx
index f9476a21c..24dc7b3fa 100644
--- a/docs/reference/failproof-cli.mdx
+++ b/docs/reference/failproof-cli.mdx
@@ -25,7 +25,7 @@ failproofai policies add FailproofAI/policies
 failproofai config --status
 ```
 
-`failproofai config` is the whole of setup: it installs the `failproofaid` service (root once, via `sudo -n` — never an interactive password prompt), wires hooks into every agent CLI it finds, and connects to Cloud. With no terminal — CI, a container, an agent driving it — it applies rather than asking, and exits 1 if anything it was asked to do did not happen.
+`failproofai config` is the whole of setup: it installs the `failproofaid` service (root once — in a terminal it asks for your sudo password, and asks again if that expired before setup finished; with no terminal it uses `sudo -n` and never prompts), wires hooks into every agent CLI it finds, and connects to Cloud. With no terminal — CI, a container, an agent driving it — it applies rather than asking, and exits 1 if anything it was asked to do did not happen.
 
 In a terminal, the **Connect to cloud** step offers **Log in to FailproofAI Cloud** (the default), **Paste an API key**, or **Use open source**. Logging in opens a link — or prints it over SSH or with no display, to open on any device — where you sign up or sign in, pick or create an org, and authorize the machine; the terminal picks up the approval by itself and shows who approved it and for which org. The key is minted only when setup finishes, after the daemon is installed. On a machine that is already connected, **Keep current connection** comes first, unless its saved key no longer works, in which case **Log in again** does; logging in again makes a new key and leaves the old one working until you revoke it. A Cloud from before browser login says so, and pasting a key still works.
 
diff --git a/docs/start/quickstart.mdx b/docs/start/quickstart.mdx
index df875754e..1612848b9 100644
--- a/docs/start/quickstart.mdx
+++ b/docs/start/quickstart.mdx
@@ -37,7 +37,7 @@ This quickstart gets one machine reporting sessions, runs an audit, and deploys
 
     That one command is the whole of setup: it installs the local daemon (root once), wires hooks into every agent CLI it finds, and connects this machine to Cloud.
 
-    At **Connect to cloud**, choose **Log in to FailproofAI Cloud** — the default. Setup opens a link in your browser (over SSH, or on a machine with no display, it prints the link so you can open it on any device). Sign up or sign in, pick an org — or create one right there — check the key's name and permissions, and click **Authorize**. You do not need an account beforehand.
+    At **Connect to cloud**, choose **Log in to FailproofAI Cloud** — the default. Setup opens a link in your browser (over SSH, or on a machine with no display, it prints the link so you can open it on any device). Sign up or sign in, confirm the org — or create one right there — and click **Authorize**. The key's name and permissions are set for you. You do not need an account beforehand.
 
     The terminal notices on its own and shows who approved it and for which org. Confirm the agents to trace, and setup finishes. The machine's key is created only at that point, after the daemon is installed, so a run you abandon leaves no key behind; it appears under **Administration → Keys** marked **cli login**, where you can revoke it.
 
diff --git a/src/hooks/configure-wizard.ts b/src/hooks/configure-wizard.ts
index 432869177..5685b00fa 100644
--- a/src/hooks/configure-wizard.ts
+++ b/src/hooks/configure-wizard.ts
@@ -1285,21 +1285,31 @@ export async function runConfigureWizard(
   // default on macOS, fifteen on most Linux. A browser login, or simply a slow
   // agents screen, can outlast it, and the install below runs `sudo -n`, which
   // would then fail AFTER the person did everything else. Ask once more instead.
+  // The stale-unit refresh runs `sudo -n` too, so it is asked for the same way —
+  // but, as at the top, losing root there costs the scheduled audit, not setup.
   // Unattended runs never primed anything, so there is nothing to have expired.
-  if (daemonWanted && !unattended) {
+  if ((daemonWanted || daemonUnitStale) && !unattended) {
     let stillRoot = false;
     try {
       stillRoot = canElevate();
     } catch {
       stillRoot = false;
     }
-    if (!stillRoot && !elevate("Your sudo session expired while you were away. Installing failproofaid needs root again.")) {
-      write([
-        kit.fail("Couldn't get root, so setup stopped before changing anything."),
-        `  Re-run once you can use sudo:  ${kit.cmd("failproofai config")}`,
-      ]);
-      void emit("configure_aborted", { reason: "needs_root" });
-      return { applied: false, abort: "needs_root" };
+    if (!stillRoot && daemonWanted) {
+      if (!elevate("Your sudo session expired while you were away. Installing failproofaid needs root again.")) {
+        write([
+          kit.fail("Couldn't get root, so setup stopped before changing anything."),
+          `  Re-run once you can use sudo:  ${kit.cmd("failproofai config")}`,
+        ]);
+        void emit("configure_aborted", { reason: "needs_root" });
+        return { applied: false, abort: "needs_root" };
+      }
+    } else if (
+      !stillRoot &&
+      !elevate("Your sudo session expired while you were away. Refreshing failproofaid's service definition needs root again.")
+    ) {
+      done.push(kit.caution("No root, so its service definition stays as it is. Scheduled audits stay off until it is refreshed."));
+      daemonUnitStale = false;
     }
   }
   if (daemonWanted) {
diff --git a/src/hooks/tui.ts b/src/hooks/tui.ts
index d2b60f87c..60e6adc3f 100644
--- a/src/hooks/tui.ts
+++ b/src/hooks/tui.ts
@@ -1445,7 +1445,7 @@ export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ v
       case "expired":
         return [kit.fail("That link expired."), "", kit.keys(["enter new link", "esc back"])];
       case "denied":
-        return [kit.fail("The request was cancelled in the browser."), "", kit.keys(["enter try again", "esc back"])];
+        return [kit.fail("Not authorized in the browser."), "", kit.keys(["enter try again", "esc back"])];
       case "failed":
         return [kit.fail(failLine), "", kit.keys(retryable ? ["enter try again", "esc back"] : ["esc back"])];
     }

From a42e75f54e6df30f16439b4c179b9ffe75a50f58 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Thu, 22 Oct 2026 19:20:23 +0530
Subject: [PATCH 04/14] [config-account-login] Start the login by itself;
 harden what the server sends
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Connect to cloud on a machine with no connection (or a refused saved key)
now starts the browser login straight away — link generated, browser opened
or link printed, countdown running. Tab or Esc there opens the other
options; Ctrl-C cancels. A machine connected with a working key still gets
the menu, keep first, so re-running config never opens a browser. An older
cloud drops straight into the options without the login entry. Leaving the
waiting screen erases the link it printed (rows counted at the current
width), so no dead link sits above the menu.

Deep-scan fixes:
- Everything the server sends is printed as text only: org name and slug,
  approver, key name, errors (controls, bidi overrides and zero-width
  characters stripped — an org named with escape codes cleared the screen
  and retitled the terminal mid-setup), and the link as the URL parser
  serialises it. Same for the introspect path's "Connected as".
- The server's poll interval and expiry are clamped (an interval past 2^31
  ms made setTimeout fire every millisecond); slow_down never speeds up.
- A saved cloud address is validated like a typed one.
- A key that was created but could not be put to use is named, so it can
  be revoked; a "log in again" that created no key reports the previous
  connection, not open source.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                                 |  3 +-
 __tests__/e2e/layout/cli-login.sh            | 26 +++---
 __tests__/hooks/browser-login-prompt.test.ts | 54 +++++++++--
 __tests__/hooks/cloud-login.test.ts          | 74 +++++++++++++++
 __tests__/hooks/configure-wizard.test.ts     | 97 ++++++++++++++++++--
 docs/reference/failproof-cli.mdx             |  2 +-
 docs/start/quickstart.mdx                    |  2 +-
 src/hooks/cloud-introspect.ts                |  7 +-
 src/hooks/cloud-login.ts                     | 48 +++++++---
 src/hooks/configure-wizard.ts                | 73 +++++++++++----
 src/hooks/tui.ts                             | 47 +++++++---
 11 files changed, 357 insertions(+), 76 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1081db20c..e0396d226 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,10 +4,11 @@
 
 ### Features
 
-- **Log in to FailproofAI Cloud from `config`.** The connect step now opens with a menu: log in through the browser (the default), paste an API key, or use open source. Logging in opens a link — or prints it over SSH or with no display, to open on any device — where you sign up or sign in, pick or create an org, and authorize the machine; the terminal notices on its own and shows who approved it and for which org. The machine's key is created only when setup finishes, after the daemon is installed, so a run you abandon leaves no key behind. A machine that is already connected is offered "keep" first, or "log in again" first when its saved key no longer works. Needs a FailproofAI Cloud with browser login; an older one says so and pasting a key still works (#920)
+- **Log in to FailproofAI Cloud from `config`.** On a machine that is not connected (or whose saved key is refused), the connect step now starts a browser login straight away; Tab opens the other options: paste an API key, or use open source. Logging in opens a link — or prints it over SSH or with no display, to open on any device — where you sign up or sign in, pick or create an org, and authorize the machine; the terminal notices on its own and shows who approved it and for which org. The machine's key is created only when setup finishes, after the daemon is installed, so a run you abandon leaves no key behind. A machine that is already connected with a working key gets a menu with "keep" first, so re-running setup never opens a browser by itself. Needs a FailproofAI Cloud with browser login; an older one says so and pasting a key still works (#920)
 
 ### Fixes
 
+- `config`'s cloud login prints what the server sends — org, approver, key name, errors, the link — without terminal control or bidi characters, keeps the server's poll interval and expiry to a sane range, checks a saved cloud address like a typed one, and names the key to revoke if one was created but could not be used (#920)
 - `config` asks for your sudo password again before installing the daemon, or refreshing its service definition, when the one given at the start expired while you were answering (5 minutes on macOS by default), instead of failing after everything else was done (#920)
 
 ### Dependencies
diff --git a/__tests__/e2e/layout/cli-login.sh b/__tests__/e2e/layout/cli-login.sh
index ed63e6aa6..418b7850b 100755
--- a/__tests__/e2e/layout/cli-login.sh
+++ b/__tests__/e2e/layout/cli-login.sh
@@ -148,8 +148,8 @@ USER_ID=$(sql "select id from users where email = '$EMAIL'")
 keys_in_org() { sql "select count(*) from api_keys where org_id = '$ORG_ID' and created_via = 'cli_login'"; }
 
 # ═════════════════════════════════════════════════════════════════════════════
-head1 "PHASE 1 — a fresh machine logs in, and setup finishes on its own"
-run_config fresh "wait:CONNECT TO CLOUD,wait:Log in to FailproofAI Cloud,key:enter,url,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
+head1 "PHASE 1 — a fresh machine starts the login by itself, and setup finishes on its own"
+run_config fresh "wait:CONNECT TO CLOUD,url,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
 URL=$(wait_url fresh)
 has "the CLI printed the authorize link" "$URL" "$DASH/cli/authorize?r="
 LINK=$(link_token "$URL")
@@ -162,6 +162,8 @@ eq "approve answered 200" "$(cat "$OUT/status")" "200"
 T=$(wait_done fresh)
 eq "config exited 0" "$(cat "$OUT/fresh.rc")" "0"
 has "no display here, so it printed the link to open anywhere" "$T" "Open this link in any browser to connect $LABEL"
+hasnt "no menu before the login on a fresh machine" "$T" "Paste an API key"
+has "tab is offered as the way to the other options" "$T" "tab more options"
 has "the CLI shows who approved it, and where" "$T" "Logged in as $EMAIL · E2E Co ($SLUG)"
 has "the daemon installed" "$T" "failproofaid installed and running"
 has "the cloud connection was written" "$T" "Connected as"
@@ -215,9 +217,9 @@ eq "no key minted for an approval nobody claimed" "$(keys_in_org)" "$BEFORE"
 eq "the request is approved, never claimed" "$(sql "select status from cli_login_requests where link_token_hash = encode(sha256('$LINK'::bytea), 'hex')")" "approved"
 
 # ═════════════════════════════════════════════════════════════════════════════
-head1 "PHASE 5 — esc goes back to the menu without touching anything"
+head1 "PHASE 5 — tab leaves the login for the options without touching anything"
 BEFORE=$(keys_in_org)
-run_config esc "wait:Keep current connection,key:down,key:enter,url,key:esc,wait:Keep current connection,key:enter,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
+run_config esc "wait:Keep current connection,key:down,key:enter,url,key:tab,wait:Keep current connection,key:enter,wait:WHICH AGENTS SHOULD FAILPROOFAI TRACE?,key:enter"
 LINK=$(link_token "$(wait_url esc)")
 T=$(wait_done esc)
 eq "config exited 0 after keeping the connection" "$(cat "$OUT/esc.rc")" "0"
@@ -237,7 +239,7 @@ person "$SESSION" approve "{\"link_token\":\"$LINK1\",\"org_id\":\"$ORG_ID\"}" >
 eq "the expired link can no longer be approved" "$(cat "$OUT/status")" "410"
 
 # ═════════════════════════════════════════════════════════════════════════════
-head1 "PHASE 7 — a saved key that was revoked: logging in again comes first"
+head1 "PHASE 7 — a saved key that was revoked: logging in again starts by itself"
 # Revoke every live CLI key, so whichever one this machine holds is dead.
 for id in $(curl -s "$DASH/api/keys" -b "ae_session=$SESSION" -H "x-agenteye-org: $SLUG" | python3 -c '
 import sys,json
@@ -247,17 +249,19 @@ for k in json.load(sys.stdin):
     -H "origin: $DASH" -H 'content-type: application/json' -d '{}'
 done
 sleep 2
-run_config revoked "wait:your saved key no longer works,key:ctrl-c"
+run_config revoked "wait:saved key no longer works,url,key:ctrl-c"
 T=$(wait_done revoked)
-has "the menu leads with logging in again, and says why" "$T" "Log in again"
-has "…because the saved key no longer works" "$T" "recommended · your saved key no longer works"
+has "a refused saved key starts the login by itself, and says why" "$T" "Your saved key no longer works:"
+has "…logging in again" "$T" "Logging in again."
+has "…with a fresh link" "$T" "/cli/authorize?r="
 
 # ═════════════════════════════════════════════════════════════════════════════
-head1 "PHASE 8 — a cloud without browser login says so"
-run_config old "wait:CONNECT TO CLOUD,key:enter,wait:doesn't support logging in from here yet,key:esc,wait:CONNECT TO CLOUD,key:ctrl-c" \
+head1 "PHASE 8 — a cloud without browser login says so, and offers the rest"
+run_config old "wait:doesn't support logging in from here yet,wait:Paste an API key,key:ctrl-c" \
   FAILPROOFAI_CLOUD_URL=http://localhost:28080
 T=$(wait_done old)
-has "an older server is reported, and the key route stays open" "$T" "doesn't support logging in from here yet"
+has "an older server is reported, and the key route stays open" "$T" "doesn't support logging in from here yet. Paste an API key instead."
+hasnt "…and login is not offered again" "$T" "Log in again"
 
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 9 — the person side refuses what it must"
diff --git a/__tests__/hooks/browser-login-prompt.test.ts b/__tests__/hooks/browser-login-prompt.test.ts
index adbaf4f73..55151d275 100644
--- a/__tests__/hooks/browser-login-prompt.test.ts
+++ b/__tests__/hooks/browser-login-prompt.test.ts
@@ -8,6 +8,7 @@ import {
   type BrowserLoginStart,
   type TTYIn,
   type TTYOut,
+  slowedDown,
 } from "../../src/hooks/tui";
 
 // Driven through a real PassThrough so Node's own keypress parser runs, like
@@ -26,7 +27,7 @@ function terminal(columns = 80) {
   (stdin as unknown as { isTTY: boolean }).isTTY = true;
   (stdin as unknown as { setRawMode: (on: boolean) => void }).setRawMode = () => {};
   const plain = () => written.join("").replace(/\x1b\[[0-9;?]*[A-Za-z]/g, "");
-  return { stdin, stdout, plain, type: (s: string) => stdin.write(s) };
+  return { stdin, stdout, plain, raw: () => written.join(""), type: (s: string) => stdin.write(s) };
 }
 
 const tick = (ms = 0) => new Promise((r) => setTimeout(r, ms));
@@ -94,8 +95,9 @@ describe("promptBrowserLogin", () => {
     expect(t.plain()).toContain("Waiting for you to authorize in the browser");
   });
 
-  it("goes back on esc and cancels on ctrl-c, and stops polling either way", async () => {
+  it("leaves for the other options on tab or esc, cancels on ctrl-c, and stops polling", async () => {
     for (const [key, want] of [
+      ["\t", BACK],
       ["\u001b", BACK],
       ["\u0003", null],
     ] as const) {
@@ -143,20 +145,56 @@ describe("promptBrowserLogin", () => {
     expect(start).toHaveBeenCalledTimes(2);
   });
 
-  it("does not retry what cannot work, like an older server", async () => {
+  it("leaves at once for what cannot work, like an older server, without retrying", async () => {
     const t = terminal();
     const start = vi.fn(
       async (): Promise<BrowserLoginStart> => ({ ok: false, retryable: false, line: "this server doesn't support it" }),
     );
     const { pending, poll } = ask(t, [], { start });
-    await until(() => t.plain().includes("this server doesn't support it"));
-    expect(t.plain()).toContain("CONNECT TO CLOUD");
-    t.type("\r");
-    await tick(30);
+    expect(await pending).toBe(BACK);
     expect(start).toHaveBeenCalledTimes(1);
     expect(poll).not.toHaveBeenCalled();
-    t.type("\u001b");
+  });
+
+  it("shows tab as the way to the other options while waiting", async () => {
+    const t = terminal();
+    const { pending } = ask(t, []);
+    await until(() => t.plain().includes("Waiting for you"));
+    expect(t.plain()).toContain("tab more options");
+    t.type("\t");
+    await pending;
+  });
+
+  it("counts what to erase at the width when leaving, after a resize", async () => {
+    const t = terminal(40);
+    const { pending } = ask(t, [], { open: vi.fn(() => false) });
+    await until(() => t.plain().includes("Waiting for you"));
+    // Widened meanwhile: a reflowing terminal now shows the link on one row.
+    (t.stdout as unknown as { columns: number }).columns = 200;
+    t.type("\t");
+    expect(await pending).toBe(BACK);
+    const ups = t.raw().match(/\x1b\[(\d+)A/g) ?? [];
+    // Heading, "Open this link…", link, blank — one row each now — and the 3-row region.
+    expect(Number(ups.at(-1)!.slice(2, -1))).toBe(7);
+  });
+
+  it("slows down when asked, and never speeds up", () => {
+    expect(slowedDown(2)).toBe(4);
+    expect(slowedDown(9)).toBe(10);
+    expect(slowedDown(15)).toBe(15);
+  });
+
+  it("takes the printed link with it when leaving, wrapped rows included", async () => {
+    // 40 columns: the 107-character link wraps onto three rows.
+    const t = terminal(40);
+    const { pending } = ask(t, [], { open: vi.fn(() => false) });
+    await until(() => t.plain().includes("Waiting for you"));
+    t.type("\t");
     expect(await pending).toBe(BACK);
+    const ups = t.raw().match(/\x1b\[(\d+)A/g) ?? [];
+    const last = Number(ups.at(-1)!.slice(2, -1));
+    // Heading 1 + "Open this link…" 2 + link 3 + blank 1, and the 3-row waiting region.
+    expect(last).toBe(10);
   });
 
   it("keeps going through a dropped connection, and says so", async () => {
diff --git a/__tests__/hooks/cloud-login.test.ts b/__tests__/hooks/cloud-login.test.ts
index 973a242c4..b3fe34964 100644
--- a/__tests__/hooks/cloud-login.test.ts
+++ b/__tests__/hooks/cloud-login.test.ts
@@ -1,6 +1,7 @@
 import { describe, it, expect, vi } from "vitest";
 import {
   claimLogin,
+  displayText,
   isOpenableUrl,
   LOGIN_CLAIM_PATH,
   LOGIN_POLL_PATH,
@@ -147,6 +148,79 @@ describe("claimLogin", () => {
   });
 });
 
+describe("what the server says, as the terminal prints it", () => {
+  const ESCAPES = "\u001b]0;pwned\u0007\u001b[2J\u001b[31mEvil\u001b[0m\u202eCo\u200b";
+
+  it("strips controls, bidi overrides and zero-width characters", () => {
+    expect(displayText(ESCAPES)).toBe("]0;pwned[2J[31mEvil[0mCo");
+    expect(displayText("\u0007\u202e ")).toBeUndefined();
+    expect(displayText(42)).toBeUndefined();
+  });
+
+  it("never passes an org, approver or key name through raw", async () => {
+    const approved = await pollLogin(
+      ORIGIN,
+      "s",
+      fetchOf(200, {
+        status: "approved",
+        org: { id: "o1", slug: "evil\u001b[2J", name: ESCAPES },
+        approved_by: "x@y.test\u001b]52;c;Zm9v\u0007",
+        key_name: "failproofai \u00b7 box\u202e",
+        permissions: ["events:add\u001b[1m"],
+      }) as unknown as typeof fetch,
+    );
+    expect(JSON.stringify(approved)).not.toMatch(/[\u0000-\u001f\u202e\u200b]/);
+    expect(approved).toMatchObject({
+      org: { slug: "evil[2J", name: "]0;pwned[2J[31mEvil[0mCo" },
+      approvedBy: "x@y.test]52;c;Zm9v",
+      keyName: "failproofai \u00b7 box",
+      permissions: ["events:add[1m"],
+    });
+
+    const claimed = await claimLogin(
+      ORIGIN,
+      "s",
+      fetchOf(201, { api_key: "k".repeat(64), org: { name: ESCAPES }, approved_by: "\u001b[2Ja@b.c" }) as unknown as typeof fetch,
+    );
+    expect(JSON.stringify({ ...claimed, key: undefined })).not.toMatch(/[\u0000-\u001f\u202e\u200b]/);
+
+    const refused = await startLogin(ORIGIN, MACHINE, fetchOf(400, { error: "nope\u001b[2J" }) as unknown as typeof fetch);
+    expect(refused).toEqual({ kind: "refused", reason: "nope[2J" });
+  });
+
+  it("prints the link as the URL parser serialises it, controls encoded", async () => {
+    const r = await startLogin(
+      ORIGIN,
+      MACHINE,
+      fetchOf(201, {
+        verification_url: `${ORIGIN}/cli/authorize?r=abc\u001b]52;c;x\u0007&x=\u202e`,
+        poll_secret: "s",
+      }) as unknown as typeof fetch,
+    );
+    expect(r.kind).toBe("ok");
+    const url = (r as { verificationUrl: string }).verificationUrl;
+    expect(url).not.toMatch(/[\u0000-\u001f\u007f-\uffff]/);
+    expect(url).toContain("%1B");
+  });
+
+  it("keeps the server's poll interval and expiry to a range it can live with", async () => {
+    const huge = await startLogin(
+      ORIGIN,
+      MACHINE,
+      fetchOf(201, { verification_url: `${ORIGIN}/cli/authorize?r=a`, poll_secret: "s", expires_in: 1e12, interval: 3e9 }) as unknown as typeof fetch,
+    );
+    expect(huge).toMatchObject({ expiresIn: 3600, interval: 30 });
+    const tiny = await startLogin(
+      ORIGIN,
+      MACHINE,
+      fetchOf(201, { verification_url: `${ORIGIN}/cli/authorize?r=a`, poll_secret: "s", expires_in: 1, interval: 0.001 }) as unknown as typeof fetch,
+    );
+    expect(tiny).toMatchObject({ expiresIn: 30, interval: 1 });
+    const pending = await pollLogin(ORIGIN, "s", fetchOf(200, { status: "pending", interval: 3e9 }) as unknown as typeof fetch);
+    expect(pending).toEqual({ kind: "pending", interval: 30 });
+  });
+});
+
 describe("machineOs", () => {
   it("names the OS the way the page shows it", () => {
     expect(machineOs("darwin")).toBe("macOS");
diff --git a/__tests__/hooks/configure-wizard.test.ts b/__tests__/hooks/configure-wizard.test.ts
index def6190e5..e0cd61262 100644
--- a/__tests__/hooks/configure-wizard.test.ts
+++ b/__tests__/hooks/configure-wizard.test.ts
@@ -198,9 +198,11 @@ let connectPick: ConnectPick | null | undefined;
  * Queue answers for a run BY NAME. The prompts left are the CONNECT step and
  * the agents picker. `cloud` is still phrased as the key field's answer —
  * Tab, a typed key, the saved key, or Esc — and is routed through the CONNECT
- * menu the way a person would reach it. Without an answer queued, the cloud
- * step takes the menu's default and the picker takes Enter on whatever it
- * opened with.
+ * menu the way a person would reach it. On a machine with no working
+ * connection the browser login starts by itself first; unless a test says
+ * otherwise the person presses Tab there, which opens that menu. Without an
+ * answer queued, the cloud step takes the menu's default and the picker takes
+ * Enter on whatever it opened with.
  */
 function drive(answers: { cloud?: CloudKeyAnswer | OpenSource | null; agents?: IntegrationType[] | null }) {
   if ("cloud" in answers) {
@@ -259,6 +261,8 @@ beforeEach(() => {
   rmSync(launcherMarker(fileHome), { force: true });
   delete process.env.FAILPROOFAI_CLOUD_URL;
   vi.mocked(promptCloudKey).mockReset().mockResolvedValue(OPEN_SOURCE);
+  // Tab at the login that starts by itself: on to the menu.
+  vi.mocked(promptBrowserLogin).mockReset().mockResolvedValue(BACK as never);
   vi.mocked(multiSelect)
     .mockReset()
     .mockImplementation(async (opts) => opts.choices.filter((c) => c.checked).map((c) => c.value) as never);
@@ -441,6 +445,13 @@ describe("cloud helpers", () => {
     expect(resolveCloudUrl("http://localhost:9911", undefined)).toMatchObject({ url: "http://localhost:9911", source: "--url" });
   });
 
+  it("checks a saved endpoint like a typed one: no plain http to a remote host", () => {
+    const r = resolveCloudUrl(undefined, "http://cloud.example.com");
+    expect(r.ok).toBe(false);
+    if (!r.ok) expect(r.message).toContain('the saved cloud address "http://cloud.example.com" cannot be used');
+    expect(resolveCloudUrl(undefined, "http://localhost:8080")).toEqual({ ok: true, url: "http://localhost:8080" });
+  });
+
   it("refuses an unusable override instead of falling back to hosted", () => {
     const r = resolveCloudUrl("http://cloud.example.com", undefined);
     expect(r.ok).toBe(false);
@@ -1454,16 +1465,59 @@ describe("browser login", () => {
     expect(claimLogin).not.toHaveBeenCalled();
   });
 
-  it("goes back to the menu on esc, and claims nothing", async () => {
+  const connectMenus = () =>
+    vi.mocked(selectOne).mock.calls.filter((c) => (c[0] as { message: string }).message === "Connect to cloud");
+
+  it("starts the login by itself on a fresh machine, with no menu first", async () => {
+    const result = await runConfigureWizard(ttyIO());
+    expect(promptBrowserLogin).toHaveBeenCalledTimes(1);
+    expect(connectMenus()).toHaveLength(0);
+    expect(claimLogin).toHaveBeenCalledTimes(1);
+    expect(result).toMatchObject({ applied: true, connected: true });
+  });
+
+  it("opens the other options on tab at the login, and claims nothing", async () => {
     vi.mocked(promptBrowserLogin).mockResolvedValueOnce(BACK as never);
-    connectPick = "login";
+    connectPick = "oss";
     const result = await runConfigureWizard(ttyIO());
-    // Back at the menu, its default (open source) finished the run.
-    expect(vi.mocked(selectOne).mock.calls.filter((c) => (c[0] as { message: string }).message === "Connect to cloud")).toHaveLength(2);
+    expect(connectMenus()).toHaveLength(1);
+    expect(menuValues()).toEqual(["login", "key", "oss"]);
     expect(result).toMatchObject({ applied: true, mode: "oss" });
     expect(claimLogin).not.toHaveBeenCalled();
   });
 
+  it("never starts a browser by itself on a machine connected with a working key", async () => {
+    writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
+    connectPick = "keep";
+    await runConfigureWizard(ttyIO());
+    expect(promptBrowserLogin).not.toHaveBeenCalled();
+    expect(menuValues()).toEqual(["keep", "login", "key"]);
+  });
+
+  it("starts the login by itself when the saved key is refused, and says why", async () => {
+    writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
+    vi.mocked(validateIngestKey).mockResolvedValueOnce({ ok: false, reason: "the server rejected that key (401)" });
+    const io = ttyIO();
+    await runConfigureWizard(io);
+    expect(promptBrowserLogin).toHaveBeenCalledTimes(1);
+    expect(connectMenus()).toHaveLength(0);
+    expect(printed(io.stdout)).toContain("Your saved key no longer works: the server rejected that key (401). Logging in again.");
+  });
+
+  it("drops an older cloud straight into the options, without login, and says why", async () => {
+    // As the screen does: a start that cannot work here leaves at once.
+    vi.mocked(promptBrowserLogin).mockImplementationOnce((async (opts: BrowserLoginOptions<unknown>) => {
+      const r = await opts.start();
+      return r.ok ? { value: approval } : BACK;
+    }) as never);
+    vi.mocked(startLogin).mockResolvedValueOnce({ kind: "unsupported" });
+    connectPick = "oss";
+    const io = ttyIO();
+    await runConfigureWizard(io);
+    expect(menuValues()).toEqual(["key", "oss"]);
+    expect(printed(io.stdout)).toContain("doesn't support logging in from here yet. Paste an API key instead.");
+  });
+
   it("cancels the whole run on ctrl-c, writing nothing", async () => {
     vi.mocked(promptBrowserLogin).mockResolvedValueOnce(null as never);
     connectPick = "login";
@@ -1543,6 +1597,35 @@ describe("browser login", () => {
     vi.mocked(canElevate).mockReturnValue(true);
   });
 
+  it("names the key to revoke when it was created but could not be put to use", async () => {
+    vi.mocked(claimLogin).mockResolvedValueOnce({
+      kind: "ok",
+      key: "k".repeat(64),
+      keyName: "failproofai · box",
+      org: { slug: "acme", name: "Acme" },
+      permissions: ["events:add", "policies:pull"],
+    } as never);
+    vi.mocked(connectToCloud).mockResolvedValueOnce({
+      policy: { ok: false, reason: "refused" },
+      ingest: { ok: false, reason: "refused" },
+      anyConfigured: false,
+    } as never);
+    const io = ttyIO();
+    await runConfigureWizard(io);
+    expect(printed(io.stdout)).toContain('The key "failproofai · box" was created but isn\'t in use here; revoke it');
+  });
+
+  it("keeps reporting the previous connection when logging in again creates no key", async () => {
+    writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
+    connectPick = "login";
+    vi.mocked(claimLogin).mockResolvedValueOnce({ kind: "expired" } as never);
+    const io = ttyIO();
+    const result = await runConfigureWizard(io);
+    // As "keep current connection" reports it: nothing new written, still cloud.
+    expect(result).toMatchObject({ applied: true, mode: "cloud" });
+    expect(printed(io.stdout)).toContain("This machine keeps its previous connection.");
+  });
+
   it("starts with this machine's name and OS, and maps an older cloud to the key route", async () => {
     connectPick = "login";
     await runConfigureWizard(ttyIO(), { machineLabel: "build-box-7" });
diff --git a/docs/reference/failproof-cli.mdx b/docs/reference/failproof-cli.mdx
index 24dc7b3fa..2444ec30e 100644
--- a/docs/reference/failproof-cli.mdx
+++ b/docs/reference/failproof-cli.mdx
@@ -27,7 +27,7 @@ failproofai config --status
 
 `failproofai config` is the whole of setup: it installs the `failproofaid` service (root once — in a terminal it asks for your sudo password, and asks again if that expired before setup finished; with no terminal it uses `sudo -n` and never prompts), wires hooks into every agent CLI it finds, and connects to Cloud. With no terminal — CI, a container, an agent driving it — it applies rather than asking, and exits 1 if anything it was asked to do did not happen.
 
-In a terminal, the **Connect to cloud** step offers **Log in to FailproofAI Cloud** (the default), **Paste an API key**, or **Use open source**. Logging in opens a link — or prints it over SSH or with no display, to open on any device — where you sign up or sign in, pick or create an org, and authorize the machine; the terminal picks up the approval by itself and shows who approved it and for which org. The key is minted only when setup finishes, after the daemon is installed. On a machine that is already connected, **Keep current connection** comes first, unless its saved key no longer works, in which case **Log in again** does; logging in again makes a new key and leaves the old one working until you revoke it. A Cloud from before browser login says so, and pasting a key still works.
+In a terminal, the **Connect to cloud** step on a machine that is not connected yet starts **logging in to FailproofAI Cloud** straight away; press Tab for the other options, **Paste an API key** or **Use open source**. Logging in opens a link — or prints it over SSH or with no display, to open on any device — where you sign up or sign in, pick or create an org, and authorize the machine; the terminal picks up the approval by itself and shows who approved it and for which org. The key is minted only when setup finishes, after the daemon is installed. On a machine that is already connected with a working key, the step is a menu with **Keep current connection** first, so re-running setup never opens a browser by itself; a saved key that no longer works starts logging in again straight away, and says why. Logging in again makes a new key and leaves the old one working until you revoke it. A Cloud from before browser login says so and offers the other options.
 
 It chooses **no** policies. That is the second command's job, and without it a freshly configured machine enforces nothing but the always-on guard.
 
diff --git a/docs/start/quickstart.mdx b/docs/start/quickstart.mdx
index 1612848b9..86ab4af1a 100644
--- a/docs/start/quickstart.mdx
+++ b/docs/start/quickstart.mdx
@@ -37,7 +37,7 @@ This quickstart gets one machine reporting sessions, runs an audit, and deploys
 
     That one command is the whole of setup: it installs the local daemon (root once), wires hooks into every agent CLI it finds, and connects this machine to Cloud.
 
-    At **Connect to cloud**, choose **Log in to FailproofAI Cloud** — the default. Setup opens a link in your browser (over SSH, or on a machine with no display, it prints the link so you can open it on any device). Sign up or sign in, confirm the org — or create one right there — and click **Authorize**. The key's name and permissions are set for you. You do not need an account beforehand.
+    At **Connect to cloud**, setup starts logging you in to FailproofAI Cloud straight away (press Tab for the other options: paste an API key, or use open source). It opens a link in your browser (over SSH, or on a machine with no display, it prints the link so you can open it on any device). Sign up or sign in, confirm the org — or create one right there — and click **Authorize**. The key's name and permissions are set for you. You do not need an account beforehand.
 
     The terminal notices on its own and shows who approved it and for which org. Confirm the agents to trace, and setup finishes. The machine's key is created only at that point, after the daemon is installed, so a run you abandon leaves no key behind; it appears under **Administration → Keys** marked **cli login**, where you can revoke it.
 
diff --git a/src/hooks/cloud-introspect.ts b/src/hooks/cloud-introspect.ts
index 39a673824..e7cd92c34 100644
--- a/src/hooks/cloud-introspect.ts
+++ b/src/hooks/cloud-introspect.ts
@@ -33,6 +33,8 @@
  * second.
  */
 
+import { displayText } from "./cloud-login";
+
 /** The path introspect is served on, appended to the cloud origin. */
 export const INTROSPECT_PATH = "/v1/auth/introspect";
 
@@ -126,8 +128,9 @@ export async function introspectKey(
     identity: {
       keyId: typeof b.key_id === "string" ? b.key_id : undefined,
       orgId: typeof b.org_id === "string" ? b.org_id : undefined,
-      orgSlug: typeof b.org_slug === "string" ? b.org_slug : undefined,
-      orgName: typeof b.org_name === "string" ? b.org_name : undefined,
+      // Printed in "Connected as …": text only, never terminal controls.
+      orgSlug: displayText(b.org_slug),
+      orgName: displayText(b.org_name),
       permissions: b.permissions.filter((p): p is string => typeof p === "string"),
       expiresAt: typeof b.expires_at === "string" ? b.expires_at : null,
       otelIngest: typeof b.otel_ingest === "boolean" ? b.otel_ingest : undefined,
diff --git a/src/hooks/cloud-login.ts b/src/hooks/cloud-login.ts
index f3c656f79..16ba14199 100644
--- a/src/hooks/cloud-login.ts
+++ b/src/hooks/cloud-login.ts
@@ -102,15 +102,36 @@ async function postJson(
 
 const str = (v: unknown): string | undefined => (typeof v === "string" && v.length > 0 ? v : undefined);
 
+// Controls (a terminal executes them: clear the screen, retitle the window,
+// write the clipboard), bidi overrides and isolates, and zero-width formatting.
+const INVISIBLE = /[\u0000-\u001f\u007f-\u009f\u061c\u180e\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff]/g;
+
+/**
+ * A server-supplied string made safe to print. Org names are chosen by whoever
+ * created the org and the CLI prints the one it was approved into — the line
+ * that is meant to show who approved what — so none of it may reach the
+ * terminal as anything but text.
+ */
+export function displayText(v: unknown, max = 200): string | undefined {
+  if (typeof v !== "string") return undefined;
+  const t = v.replace(INVISIBLE, "").trim().slice(0, max);
+  return t.length > 0 ? t : undefined;
+}
+
 function org(v: unknown): LoginOrg {
   const o = v && typeof v === "object" ? (v as Record<string, unknown>) : {};
-  return { id: str(o.id), slug: str(o.slug), name: str(o.name) };
+  return { id: str(o.id), slug: displayText(o.slug), name: displayText(o.name) };
 }
 
 function permissions(v: unknown): string[] {
-  return Array.isArray(v) ? v.filter((p): p is string => typeof p === "string") : [];
+  return Array.isArray(v) ? v.map((p) => displayText(p, 64)).filter((p): p is string => p !== undefined) : [];
 }
 
+/** A server's number, kept to a range this client can live with: a huge poll
+ *  interval overflows `setTimeout` into a 1 ms storm, a tiny one polls flat out. */
+const within = (v: unknown, lo: number, hi: number, fallback: number): number =>
+  typeof v === "number" && Number.isFinite(v) && v > 0 ? Math.min(hi, Math.max(lo, v)) : fallback;
+
 /**
  * Only an http(s) link is ever handed to the browser opener. The URL comes from
  * the server, and `xdg-open` / `open` will happily act on any scheme they know.
@@ -148,7 +169,7 @@ export async function startLogin(
   if (r.status !== 201 || !r.json) {
     return r.status >= 500
       ? { kind: "unreachable", reason: `the server answered ${r.status}` }
-      : { kind: "refused", reason: str(r.json?.error) ?? `the server answered ${r.status}` };
+      : { kind: "refused", reason: displayText(r.json?.error, 120) ?? `the server answered ${r.status}` };
   }
   const verificationUrl = str(r.json.verification_url);
   const pollSecret = str(r.json.poll_secret);
@@ -156,13 +177,14 @@ export async function startLogin(
     // A 201 without the fields is something other than this API.
     return { kind: "unsupported" };
   }
-  const n = (v: unknown, d: number) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : d);
   return {
     kind: "ok",
-    verificationUrl,
+    // Re-serialised, never the raw string: it is printed, and the parser
+    // percent-encodes every control and non-ASCII character in it.
+    verificationUrl: new URL(verificationUrl).href,
     pollSecret,
-    expiresIn: n(r.json.expires_in, 600),
-    interval: n(r.json.interval, 2),
+    expiresIn: within(r.json.expires_in, 30, 3600, 600),
+    interval: within(r.json.interval, 1, 30, 2),
   };
 }
 
@@ -174,15 +196,15 @@ export async function pollLogin(origin: string, pollSecret: string, fetchImpl: F
   const j = r.json;
   switch (j.status) {
     case "pending":
-      return { kind: "pending", interval: typeof j.interval === "number" ? j.interval : undefined };
+      return { kind: "pending", interval: typeof j.interval === "number" ? within(j.interval, 1, 30, 2) : undefined };
     case "slow_down":
       return { kind: "slow_down" };
     case "approved":
       return {
         kind: "approved",
         org: org(j.org),
-        approvedBy: str(j.approved_by),
-        keyName: str(j.key_name),
+        approvedBy: displayText(j.approved_by),
+        keyName: displayText(j.key_name),
         permissions: permissions(j.permissions),
       };
     case "denied":
@@ -207,10 +229,10 @@ export async function claimLogin(origin: string, pollSecret: string, fetchImpl:
       kind: "ok",
       key,
       keyId: str(j.key_id),
-      keyName: str(j.key_name),
+      keyName: displayText(j.key_name),
       org: org(j.org),
       permissions: permissions(j.permissions),
-      approvedBy: str(j.approved_by),
+      approvedBy: displayText(j.approved_by),
     };
   }
   if (r.status === 410) return { kind: "expired" };
@@ -218,6 +240,6 @@ export async function claimLogin(origin: string, pollSecret: string, fetchImpl:
   if (r.status >= 500) return { kind: "unreachable", reason: `the server answered ${r.status}` };
   return {
     kind: "refused",
-    reason: str(j.status) ? `the login request is ${String(j.status)}` : `the server answered ${r.status}`,
+    reason: displayText(j.status, 40) ? `the login request is ${displayText(j.status, 40)}` : `the server answered ${r.status}`,
   };
 }
diff --git a/src/hooks/configure-wizard.ts b/src/hooks/configure-wizard.ts
index 5685b00fa..2bc204f65 100644
--- a/src/hooks/configure-wizard.ts
+++ b/src/hooks/configure-wizard.ts
@@ -1027,9 +1027,12 @@ export async function runConfigureWizard(
       stdout,
     });
 
-  // The browser login. Resolves the approval, BACK to return to the menu, or
-  // null when the person cancelled the whole run.
+  // The browser login. Resolves the approval, BACK for the menu of other
+  // options (Tab / Esc, or a cloud that cannot do this), or null when the person
+  // cancelled the whole run.
   type Approval = Extract<CloudPlan, { kind: "login" }>;
+  // Set once the cloud says it has no browser login; the menu then drops it.
+  let loginUnsupported = false;
   const askLogin = (endpoint: string): Promise<{ value: Approval } | typeof BACK | null> => {
     let pollSecret = "";
     return promptBrowserLogin<Approval>({
@@ -1045,11 +1048,8 @@ export async function runConfigureWizard(
         }
         if (r.kind === "unsupported") {
           void emit("configure_cloud_login", { step: "unsupported" });
-          return {
-            ok: false,
-            retryable: false,
-            line: `${host} doesn't support logging in from here yet. Press esc and paste an API key instead.`,
-          };
+          loginUnsupported = true;
+          return { ok: false, retryable: false, line: `${host} doesn't support logging in from here yet.` };
         }
         return {
           ok: false,
@@ -1098,10 +1098,10 @@ export async function runConfigureWizard(
     });
   };
 
-  // The interactive CONNECT step. Log in through the browser, paste a key, or —
-  // with no connection yet — use open source. A machine that is already
-  // connected is offered "keep" first, unless its key no longer works, in which
-  // case logging in again comes first and says why.
+  // The interactive CONNECT step. A machine with no connection, or whose saved
+  // key is refused, starts the browser login straight away — Tab or Esc there
+  // opens the other options. A machine that is connected with a working key gets
+  // the menu, "keep" first, so re-running config never opens a browser by itself.
   const chooseConnection = async (): Promise<CloudPlan | null> => {
     const verdict =
       saved && !saved.splitKeys
@@ -1139,12 +1139,30 @@ export async function runConfigureWizard(
     const keep: SelectChoice<Pick> = { label: "Keep current connection", value: "keep", hint: keepHint };
     // No initial-cursor option on selectOne: the default is whatever is first.
     const choices = !saved ? [login, key, oss] : savedBroken ? [login, key, keep] : [keep, login, key];
+    const leftLogin = (result: Awaited<ReturnType<typeof askLogin>>): CloudPlan | null | typeof BACK => {
+      if (result === null || result === BACK) {
+        if (result === BACK && loginUnsupported) {
+          write([kit.caution(`${host} doesn't support logging in from here yet. Paste an API key instead.`), ""]);
+        }
+        return result;
+      }
+      return result.value;
+    };
+
+    if (url && (!saved || savedBroken)) {
+      if (savedBroken && verdict && !verdict.ok) {
+        write([kit.caution(`Your saved key no longer works: ${verdict.reason}. Logging in again.`)]);
+      }
+      void emit("configure_cloud_choice", { choice: "login", connected: Boolean(saved), auto: true });
+      const first = leftLogin(await askLogin(url));
+      if (first !== BACK) return first;
+    }
 
     for (;;) {
       const pick = await selectOne<Pick>({
         message: "Connect to cloud",
         meta: source ? `${host}  ·  from ${source}` : host,
-        choices,
+        choices: loginUnsupported ? choices.filter((c) => c.value !== "login") : choices,
         collapsed: (p) =>
           p === "keep" ? [...cloudLines(keptPlan), ""] : p === "oss" ? [...cloudLines({ kind: "oss" }), ""] : [],
         stdin,
@@ -1164,10 +1182,9 @@ export async function runConfigureWizard(
         write([kit.fail(badUrl ?? "No usable endpoint."), ""]);
         continue;
       }
-      const result = await askLogin(url);
-      if (result === null) return null;
+      const result = leftLogin(await askLogin(url));
       if (result === BACK) continue;
-      return result.value;
+      return result;
     }
   };
 
@@ -1485,12 +1502,14 @@ export async function runConfigureWizard(
   // is single-use — the server mints the key and hands it over exactly once.
   let token: string | null = cloud.kind === "connect" ? cloud.token : null;
   let orgLabel: string | undefined = cloud.kind === "connect" ? cloud.org : undefined;
+  let mintedName: string | undefined;
   if (cloud.kind === "login" && url) {
     const claimed = await transient("Creating this machine's key…", () => claimLogin(url, cloud.pollSecret));
     void emit("configure_cloud_login", { step: "claimed", ok: claimed.kind === "ok", reason: claimed.kind });
     if (claimed.kind === "ok") {
       token = claimed.key;
       orgLabel = loginOrgLabel(claimed.org);
+      mintedName = claimed.keyName;
     } else {
       hookLogWarn(`cloud login could not be completed: ${claimed.kind}`);
       done.push(
@@ -1536,12 +1555,22 @@ export async function runConfigureWizard(
       hookLogWarn(`cloud connection was not written: ${err instanceof Error ? err.message : String(err)}`);
       done.push(kit.caution("Couldn't connect; everything else was applied.", "failproofai config"));
     }
+    // The claim spent the approval and the key exists, but nothing here uses
+    // it: say which one, so it can be revoked rather than left live.
+    if (cloud.kind === "login" && !connected) {
+      done.push(`  The key ${mintedName ? `"${mintedName}" ` : ""}was created but isn't in use here; revoke it on ${host}'s keys page.`);
+    }
   } else if (cloud.kind === "kept" && cloud.how === "saved" && fp.mode !== "cloud") {
     // A home migrated from layout 1 carries keys but no mode, and would read
     // as open source everywhere that asks.
     updateConfig({ mode: "cloud" });
   }
 
+  // Logging in again on a connected machine, with no key at the end of it,
+  // changed nothing about the connection: the previous one is still there.
+  const keptOld = cloud.kind === "login" && !token && saved !== undefined;
+  if (keptOld) done.push("  This machine keeps its previous connection.");
+
   await applied;
   // Only now — a completed apply — is the launcher considered "seen", so
   // first-run onboarding stops offering itself on every command.
@@ -1559,7 +1588,7 @@ export async function runConfigureWizard(
       done,
       cwd,
       agents: selected.length,
-      connected: connected || cloud.kind === "kept",
+      connected: connected || cloud.kind === "kept" || keptOld,
       codexTrust,
     }),
   );
@@ -1572,7 +1601,7 @@ export async function runConfigureWizard(
     policies,
     daemonInstalled,
     connected,
-    mode: connected || cloud.kind === "kept" ? "cloud" : "oss",
+    mode: connected || cloud.kind === "kept" || keptOld ? "cloud" : "oss",
     agents: { selected, added, removed },
   };
 }
@@ -1644,7 +1673,15 @@ export function resolveCloudUrl(
   const env = process.env.FAILPROOFAI_CLOUD_URL?.trim();
   const fromFlag = flag?.trim();
   const override = fromFlag || env;
-  if (!override) return { ok: true, url: existing ?? cloudBaseFor(DEFAULT_INGEST_URL) };
+  if (!override) {
+    if (!existing) return { ok: true, url: cloudBaseFor(DEFAULT_INGEST_URL) };
+    // Checked like a typed one: login sends its secret and receives a key here
+    // before anything else would, and the file it came from can be edited.
+    const saved = validateCloudUrl(existing);
+    return saved.ok
+      ? { ok: true, url: existing }
+      : { ok: false, message: `the saved cloud address "${existing}" cannot be used: ${saved.reason}` };
+  }
   const source = fromFlag && fromFlag !== env ? "--url" : "FAILPROOFAI_CLOUD_URL";
   const validated = validateCloudUrl(cloudBaseFor(override));
   if (!validated.ok) {
diff --git a/src/hooks/tui.ts b/src/hooks/tui.ts
index 60e6adc3f..035d0bf94 100644
--- a/src/hooks/tui.ts
+++ b/src/hooks/tui.ts
@@ -1351,7 +1351,8 @@ export function promptCloudKey(opts: CloudKeyPromptOptions): Promise<CloudKeyAns
 /** What starting a browser login produced. */
 export type BrowserLoginStart =
   | { ok: true; url: string; expiresIn: number; interval: number }
-  /** `retryable` is false when trying again cannot help — an older server. */
+  /** `retryable` is false when trying again cannot help — an older server. The
+   *  screen then leaves at once (`BACK`), so `line` is for the caller to show. */
   | { ok: false; line: string; retryable: boolean };
 
 /** One "approved yet?" answer. */
@@ -1383,6 +1384,12 @@ export interface BrowserLoginOptions<T> {
   now?: () => number;
 }
 
+/** The poll interval after a `slow_down`: two seconds slower, up to 10 — and
+ *  never faster, so a server already asking for more than 10 keeps its number. */
+export function slowedDown(interval: number): number {
+  return Math.max(interval, Math.min(10, interval + 2));
+}
+
 /**
  * Wait for a person to finish logging in, in a browser.
  *
@@ -1391,13 +1398,17 @@ export interface BrowserLoginOptions<T> {
  * until the request is approved, refused or expired. Nothing is typed here: the
  * account side happens entirely in the browser.
  *
- * Resolves `{ value }` once approved, `BACK` on Esc (the caller's menu is the
- * way back out), or `null` on Ctrl-C. An expired or refused link offers a fresh
- * one on Enter rather than ending the screen.
+ * Resolves `{ value }` once approved, `BACK` on Tab or Esc (the caller's menu
+ * of other options is the way on), or `null` on Ctrl-C. An expired or refused
+ * link offers a fresh one on Enter rather than ending the screen. A start that
+ * cannot work here (`retryable: false`) resolves `BACK` straight away: there is
+ * nothing to retry, so the caller says why above its options.
  *
  * The link is printed ABOVE the live region, not inside it: the region is
  * repainted and cut to the terminal width, and a link that is cut cannot be
- * clicked or copied.
+ * clicked or copied. Leaving with `BACK` erases it again, wrapped rows
+ * included: a link nobody is polling any more must not sit above the menu
+ * looking live.
  */
 export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ value: T } | Back | null> {
   const stdin: TTYIn = opts.stdin ?? process.stdin;
@@ -1413,13 +1424,16 @@ export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ v
   type Phase = "starting" | "waiting" | "expired" | "denied" | "failed";
   let phase: Phase = "starting";
   let failLine = "";
-  let retryable = true;
   let cautionLine = "";
   let expiresAt = 0;
   let interval = 2;
   let frame = 0;
   let settled = false;
   let headingShown = false;
+  // Lines printed above the region (heading + links), so BACK can take them
+  // away too. Counted in rows at the width when leaving, not when printed: a
+  // terminal that was resized meanwhile has re-wrapped them.
+  const above: string[] = [];
   let pollTimer: ReturnType<typeof setTimeout> | null = null;
   let spinTimer: ReturnType<typeof setInterval> | null = null;
   // Bumped on every new link, so a poll answer for an abandoned link is ignored.
@@ -1440,14 +1454,14 @@ export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ v
           `${INDENT}${spin} Waiting for you to authorize in the browser  ${c.ink3(`· expires in ${countdown()}`)}`,
           ...(cautionLine ? [kit.caution(cautionLine)] : []),
           "",
-          kit.keys(["esc back", "ctrl-c cancel"]),
+          kit.keys(["tab more options", "ctrl-c cancel"]),
         ];
       case "expired":
-        return [kit.fail("That link expired."), "", kit.keys(["enter new link", "esc back"])];
+        return [kit.fail("That link expired."), "", kit.keys(["enter new link", "tab more options"])];
       case "denied":
-        return [kit.fail("Not authorized in the browser."), "", kit.keys(["enter try again", "esc back"])];
+        return [kit.fail("Not authorized in the browser."), "", kit.keys(["enter try again", "tab more options"])];
       case "failed":
-        return [kit.fail(failLine), "", kit.keys(retryable ? ["enter try again", "esc back"] : ["esc back"])];
+        return [kit.fail(failLine), "", kit.keys(["enter try again", "tab more options"])];
     }
   };
 
@@ -1464,6 +1478,7 @@ export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ v
     const clear = region.lastCount > 0 ? `${ESC}[${region.lastCount}A${ESC}[J` : "";
     stdout.write(`${clear}${lines.join("\n")}\n`);
     region.lastCount = 0;
+    above.push(...lines);
   };
 
   const clearPoll = (): void => {
@@ -1484,6 +1499,11 @@ export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ v
       stdin.setRawMode?.(wasRaw ?? false);
       stdin.pause();
       process.removeListener("exit", restoreTerminal);
+      // Leaving for the menu takes the printed link with it.
+      if (answer === BACK) {
+        const cols = stdout.columns || 80;
+        for (const line of above) region.lastCount += Math.max(1, Math.ceil(visibleWidth(line) / cols));
+      }
       const lines =
         answer === null
           ? [c.ink3("cancelled")]
@@ -1519,7 +1539,7 @@ export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ v
           phase = "expired";
           return draw();
         case "slow_down":
-          interval = Math.min(10, interval + 2);
+          interval = slowedDown(interval);
           break;
         case "unreachable":
           cautionLine = `Can't reach the server right now (${answer.line}) — still trying.`;
@@ -1553,9 +1573,9 @@ export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ v
       }
       if (settled || mine !== attempt) return;
       if (!started.ok) {
+        if (!started.retryable) return finish(BACK);
         phase = "failed";
         failLine = started.line;
-        retryable = started.retryable;
         return draw();
       }
       expiresAt = now() + started.expiresIn * 1000;
@@ -1578,9 +1598,8 @@ export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ v
     function onKey(_str: string | undefined, key: readline.Key): void {
       if (!key || settled) return;
       if (key.ctrl && (key.name === "c" || key.name === "d")) return finish(null);
-      if (key.name === "escape") return finish(BACK);
+      if (key.name === "escape" || key.name === "tab") return finish(BACK);
       if ((key.name === "return" || key.name === "enter") && phase !== "waiting" && phase !== "starting") {
-        if (phase === "failed" && !retryable) return;
         void begin();
       }
     }

From b7aaddd3a87413c9028dfb64bc42b5dd63889149 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Thu, 22 Oct 2026 20:20:11 +0530
Subject: [PATCH 05/14] [config-account-login] A failed claim on a fresh
 machine is not "kept"

savedConnection() returns null, not undefined, so `saved !== undefined` was
always true: a fresh machine whose login claim failed printed "This machine
keeps its previous connection." and reported mode "cloud" with no credential
on disk. Truthiness, like every other check of `saved` here. The fresh-machine
claim-failure test now asserts mode "oss" and the absence of that line
(CodeRabbit, PR #920).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 __tests__/hooks/configure-wizard.test.ts | 4 +++-
 src/hooks/configure-wizard.ts            | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/__tests__/hooks/configure-wizard.test.ts b/__tests__/hooks/configure-wizard.test.ts
index e0cd61262..afb9c8f39 100644
--- a/__tests__/hooks/configure-wizard.test.ts
+++ b/__tests__/hooks/configure-wizard.test.ts
@@ -1532,10 +1532,12 @@ describe("browser login", () => {
     connectPick = "login";
     const io = ttyIO();
     const result = await runConfigureWizard(io);
-    expect(result).toMatchObject({ applied: true, connected: false });
+    // A fresh machine: nothing to keep, so it is not reported as connected.
+    expect(result).toMatchObject({ applied: true, connected: false, mode: "oss" });
     expect(connectToCloud).not.toHaveBeenCalled();
     expect(installHooks).toHaveBeenCalledTimes(1);
     expect(printed(io.stdout)).toContain("The login took too long to finish, so no key was created.");
+    expect(printed(io.stdout)).not.toContain("keeps its previous connection");
   });
 
   it("says the old key still works after logging in again on a connected machine", async () => {
diff --git a/src/hooks/configure-wizard.ts b/src/hooks/configure-wizard.ts
index 2bc204f65..7a73de7b1 100644
--- a/src/hooks/configure-wizard.ts
+++ b/src/hooks/configure-wizard.ts
@@ -1568,7 +1568,7 @@ export async function runConfigureWizard(
 
   // Logging in again on a connected machine, with no key at the end of it,
   // changed nothing about the connection: the previous one is still there.
-  const keptOld = cloud.kind === "login" && !token && saved !== undefined;
+  const keptOld = cloud.kind === "login" && !token && Boolean(saved);
   if (keptOld) done.push("  This machine keeps its previous connection.");
 
   await applied;

From f391b144a36cbc9affb96d95677253f021e00a61 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Fri, 23 Oct 2026 12:24:25 +0530
Subject: [PATCH 06/14] [config-account-login] Release as 1.0.12-beta.1

1.0.12-beta.0 is already on npm (published from this branch on `next`, built
from a42e75f5), so publish preflight would refuse it from main. Move
package.json, the Cargo workspace (+ Cargo.lock) and the Hermes plugin
manifest to 1.0.12-beta.1, and give it its own changelog section with the one
change the published beta.0 lacks (b7aaddd3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md              | 6 ++++++
 Cargo.lock                | 6 +++---
 Cargo.toml                | 2 +-
 hermes-plugin/plugin.yaml | 2 +-
 package.json              | 2 +-
 5 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e0396d226..62d0accac 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.0.12-beta.1 — 2026-10-23
+
+### Fixes
+
+- `config` on a machine with no saved connection, whose browser login was approved but whose key could not be claimed, no longer says "This machine keeps its previous connection." and reports cloud mode with no key on disk; it finishes set up as open source (#920)
+
 ## 1.0.12-beta.0 — 2026-10-22
 
 ### Features
diff --git a/Cargo.lock b/Cargo.lock
index a8cbb1178..93795cd4e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -298,7 +298,7 @@ dependencies = [
 
 [[package]]
 name = "failproofaid"
-version = "1.0.12-beta.0"
+version = "1.0.12-beta.1"
 dependencies = [
  "fpai-collect",
  "fpai-ipc",
@@ -361,7 +361,7 @@ dependencies = [
 
 [[package]]
 name = "fpai-collect"
-version = "1.0.12-beta.0"
+version = "1.0.12-beta.1"
 dependencies = [
  "axum",
  "getrandom 0.4.3",
@@ -382,7 +382,7 @@ dependencies = [
 
 [[package]]
 name = "fpai-ipc"
-version = "1.0.12-beta.0"
+version = "1.0.12-beta.1"
 dependencies = [
  "libc",
  "proptest",
diff --git a/Cargo.toml b/Cargo.toml
index 62a65a004..db70e89ac 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ resolver = "3"
 members = ["crates/*"]
 
 [workspace.package]
-version = "1.0.12-beta.0"
+version = "1.0.12-beta.1"
 edition = "2024"
 license-file = "LICENSE"
 repository = "https://github.com/FailproofAI/failproofai"
diff --git a/hermes-plugin/plugin.yaml b/hermes-plugin/plugin.yaml
index d8b942dc9..a21cff101 100644
--- a/hermes-plugin/plugin.yaml
+++ b/hermes-plugin/plugin.yaml
@@ -1,5 +1,5 @@
 name: failproofai
-version: 1.0.12-beta.0
+version: 1.0.12-beta.1
 description: Real-time FailproofAI policy enforcement for Hermes
 manifest_version: 2
 api_version: 1
diff --git a/package.json b/package.json
index cc344e8b2..922f95093 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.12-beta.0",
+  "version": "1.0.12-beta.1",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",

From 1b362dc462836ffcb68fdf662675c62ed6856693 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Fri, 23 Oct 2026 12:27:18 +0530
Subject: [PATCH 07/14] [config-account-login] A refused saved key is not kept
 as if it worked

When the saved key was refused and the login that followed created no key,
the run ended with "This machine keeps its previous connection." The
connection is still kept (the CONNECT step never removes one, decision D4,
same as picking "keep" with a refused key), but the line now says its key no
longer works and to run config again. The verdict from the CONNECT step is
carried to the end as `savedRefused`. Regression test fails without the fix
(CodeRabbit, PR #920).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                             |  1 +
 __tests__/hooks/configure-wizard.test.ts | 15 +++++++++++++++
 src/hooks/configure-wizard.ts            | 17 +++++++++++++++--
 3 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 62d0accac..fa58d4254 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@
 ### Fixes
 
 - `config` on a machine with no saved connection, whose browser login was approved but whose key could not be claimed, no longer says "This machine keeps its previous connection." and reports cloud mode with no key on disk; it finishes set up as open source (#920)
+- `config` on a machine whose saved key was refused, when logging in again creates no key, says the kept connection's key no longer works and to run `config` again, instead of reporting the old connection as if it were fine (#920)
 
 ## 1.0.12-beta.0 — 2026-10-22
 
diff --git a/__tests__/hooks/configure-wizard.test.ts b/__tests__/hooks/configure-wizard.test.ts
index afb9c8f39..499c76291 100644
--- a/__tests__/hooks/configure-wizard.test.ts
+++ b/__tests__/hooks/configure-wizard.test.ts
@@ -1626,6 +1626,21 @@ describe("browser login", () => {
     // As "keep current connection" reports it: nothing new written, still cloud.
     expect(result).toMatchObject({ applied: true, mode: "cloud" });
     expect(printed(io.stdout)).toContain("This machine keeps its previous connection.");
+    expect(printed(io.stdout)).not.toContain("no longer works");
+  });
+
+  it("does not report a refused saved key as a working connection when the new login creates no key", async () => {
+    writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
+    vi.mocked(validateIngestKey).mockResolvedValueOnce({ ok: false, reason: "the server rejected that key (401)" });
+    vi.mocked(claimLogin).mockResolvedValueOnce({ kind: "expired" } as never);
+    const io = ttyIO();
+    const result = await runConfigureWizard(io);
+    // Still on disk and still cloud (decision D4), but said for what it is.
+    expect(result).toMatchObject({ applied: true, mode: "cloud" });
+    expect(printed(io.stdout)).toContain(
+      "This machine keeps its previous connection, but its key no longer works. Run failproofai config again to log in.",
+    );
+    expect(printed(io.stdout)).not.toContain("keeps its previous connection.");
   });
 
   it("starts with this machine's name and OS, and maps an older cloud to the key route", async () => {
diff --git a/src/hooks/configure-wizard.ts b/src/hooks/configure-wizard.ts
index 7a73de7b1..b1795127e 100644
--- a/src/hooks/configure-wizard.ts
+++ b/src/hooks/configure-wizard.ts
@@ -1098,6 +1098,10 @@ export async function runConfigureWizard(
     });
   };
 
+  // Whether the saved key was refused when the CONNECT step checked it — still
+  // true at the end of the run if a login there created no key.
+  let savedRefused = false;
+
   // The interactive CONNECT step. A machine with no connection, or whose saved
   // key is refused, starts the browser login straight away — Tab or Esc there
   // opens the other options. A machine that is connected with a working key gets
@@ -1108,6 +1112,7 @@ export async function runConfigureWizard(
         ? await transient("Checking your saved key…", () => checkCloudKey(saved.url, saved.token))
         : null;
     const savedBroken = verdict !== null && !verdict.ok && verdict.refused;
+    savedRefused = savedBroken;
     const keptPlan: CloudPlan =
       verdict && verdict.ok
         ? { kind: "kept", how: "saved", verified: true }
@@ -1567,9 +1572,17 @@ export async function runConfigureWizard(
   }
 
   // Logging in again on a connected machine, with no key at the end of it,
-  // changed nothing about the connection: the previous one is still there.
+  // changed nothing about the connection: the previous one is still there
+  // (never removed from this step, decision D4) — but not as if it worked when
+  // its key was refused.
   const keptOld = cloud.kind === "login" && !token && Boolean(saved);
-  if (keptOld) done.push("  This machine keeps its previous connection.");
+  if (keptOld) {
+    done.push(
+      savedRefused
+        ? "  This machine keeps its previous connection, but its key no longer works. Run failproofai config again to log in."
+        : "  This machine keeps its previous connection.",
+    );
+  }
 
   await applied;
   // Only now — a completed apply — is the launcher considered "seen", so

From 1755792d101e416895237140c2046b48203074a1 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Fri, 23 Oct 2026 12:51:30 +0530
Subject: [PATCH 08/14] [config-account-login] Close the remaining CodeRabbit /
 Hermes findings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- checkCloudKey validates the address before sending a key to it: a saved
  http:// address to another host no longer receives the saved key when
  config checks it (CodeRabbit, outside-diff, b7aaddd3). Five older tests
  used the placeholder address "u", which the guard now refuses; they use the
  valid https address their neighbours already use.
- configure_applied is sent after the cloud step with the final `connected`
  and mode, so a login whose claim failed is not counted as connected
  (CodeRabbit + Hermes F4).
- promptBrowserLogin: a retry erases the expired/refused link (and its
  heading) before printing the new one — `forgetAbove()`, shared with leaving
  on Tab/Esc (CodeRabbit + Hermes F3).
- startLogin: a 200 that is not JSON (the web app serving a page in the
  route's place) is `unsupported`, so the key prompt is offered (CodeRabbit).
- connectToCloud takes `org` from the caller when introspect gives none; the
  wizard passes the org from the login's claim, so the saved org is not left
  empty or stale (CodeRabbit).

Each new test fails without its fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                                 |  3 ++
 __tests__/hooks/browser-login-prompt.test.ts | 15 ++++++
 __tests__/hooks/cloud-login.test.ts          |  4 ++
 __tests__/hooks/cloud-reconnect.test.ts      | 14 ++++++
 __tests__/hooks/configure-wizard.test.ts     | 41 +++++++++++++--
 src/hooks/cloud-connection.ts                | 24 +++++----
 src/hooks/cloud-login.ts                     |  9 ++--
 src/hooks/configure-wizard.ts                | 52 +++++++++++---------
 src/hooks/tui.ts                             | 17 +++++--
 9 files changed, 135 insertions(+), 44 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fa58d4254..a3dd44024 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,9 @@
 
 - `config` on a machine with no saved connection, whose browser login was approved but whose key could not be claimed, no longer says "This machine keeps its previous connection." and reports cloud mode with no key on disk; it finishes set up as open source (#920)
 - `config` on a machine whose saved key was refused, when logging in again creates no key, says the kept connection's key no longer works and to run `config` again, instead of reporting the old connection as if it were fine (#920)
+- `config` no longer sends the saved key to a saved cloud address it would refuse if typed (plain `http://` to another host) when checking that key (#920)
+- `config`'s browser login takes an expired or refused link off the screen when it prints a new one, so only the live link can be opened; and a cloud that answers the login route with a web page is treated as one without browser login (paste a key) instead of an error (#920)
+- `config` saves the org a browser login was approved into even when the follow-up check of the new key can't reach the server, instead of leaving the saved org empty or stale; and its completion event reports whether the machine actually connected, not whether it set out to (#920)
 
 ## 1.0.12-beta.0 — 2026-10-22
 
diff --git a/__tests__/hooks/browser-login-prompt.test.ts b/__tests__/hooks/browser-login-prompt.test.ts
index 55151d275..a0b0a4f3d 100644
--- a/__tests__/hooks/browser-login-prompt.test.ts
+++ b/__tests__/hooks/browser-login-prompt.test.ts
@@ -125,6 +125,21 @@ describe("promptBrowserLogin", () => {
     expect(t.plain()).toContain(`${LINK}-second`);
   });
 
+  it("takes the dead link off the screen when a retry prints a new one", async () => {
+    const t = terminal(40);
+    const urls = [LINK, `${LINK}-second`];
+    const start = vi.fn(async (): Promise<BrowserLoginStart> => started(urls.shift()));
+    const { pending } = ask(t, [{ state: "expired" }, { state: "approved", value: "v" }], { start, open: vi.fn(() => false) });
+    await until(() => t.plain().includes("That link expired."));
+    const before = t.raw().length;
+    t.type("\r");
+    expect(await pending).toEqual({ value: "v" });
+    const ups = t.raw().slice(before).match(/\x1b\[(\d+)A/g) ?? [];
+    // The first repaint after enter climbs over the old heading 1 + "Open this
+    // link…" 2 + link 3 + blank 1, and the 3-row expired region.
+    expect(Number(ups[0]!.slice(2, -1))).toBe(10);
+  });
+
   it("calls a link expired by its own clock without waiting for the server to say so", async () => {
     const t = terminal();
     let clock = 1_000_000;
diff --git a/__tests__/hooks/cloud-login.test.ts b/__tests__/hooks/cloud-login.test.ts
index b3fe34964..972956760 100644
--- a/__tests__/hooks/cloud-login.test.ts
+++ b/__tests__/hooks/cloud-login.test.ts
@@ -53,6 +53,10 @@ describe("startLogin", () => {
     expect(await startLogin(ORIGIN, MACHINE, fetchOf(201, { hello: "world" }) as unknown as typeof fetch)).toEqual({
       kind: "unsupported",
     });
+    // The web app serving its login page in the route's place.
+    expect(
+      await startLogin(ORIGIN, MACHINE, fetchOf(200, "<!doctype html><title>sign in</title>", { "content-type": "text/html" }) as unknown as typeof fetch),
+    ).toEqual({ kind: "unsupported" });
   });
 
   it("never hands a non-http link to the browser opener", async () => {
diff --git a/__tests__/hooks/cloud-reconnect.test.ts b/__tests__/hooks/cloud-reconnect.test.ts
index b0ef5951b..e1425aa24 100644
--- a/__tests__/hooks/cloud-reconnect.test.ts
+++ b/__tests__/hooks/cloud-reconnect.test.ts
@@ -53,6 +53,20 @@ function connect(permissions: string[] | null, over: Partial<ConnectInput> = {})
   });
 }
 
+describe("the org a key reports into", () => {
+  it("is taken from the caller when introspect can't answer", async () => {
+    const result = await connect(null, { org: { id: "B", slug: "beta", name: "Beta" } });
+    expect(readCredentials().org).toMatchObject({ id: "B", slug: "beta", name: "Beta" });
+    expect(result.org).toEqual({ id: "B", slug: "beta", name: "Beta" });
+    expect(result.changes?.join("\n")).toContain("Switched from A to Beta");
+  });
+
+  it("is introspect's answer when there is one", async () => {
+    await connect(["events:add", "policies:pull"], { org: { id: "B", name: "Beta" } });
+    expect(readCredentials().org?.id).toBe("A");
+  });
+});
+
 describe("replacement credentials", () => {
   it("collector-only removes previous policy and Jev keys and active policies", async () => {
     mkdirSync(cloudPoliciesDir(), { recursive: true });
diff --git a/__tests__/hooks/configure-wizard.test.ts b/__tests__/hooks/configure-wizard.test.ts
index 499c76291..ceba31ec6 100644
--- a/__tests__/hooks/configure-wizard.test.ts
+++ b/__tests__/hooks/configure-wizard.test.ts
@@ -466,16 +466,23 @@ describe("cloud helpers", () => {
 
   it("accepts half a key with a note, and refuses one that can do neither", async () => {
     vi.mocked(introspectKey).mockResolvedValueOnce({ kind: "ok", identity: { permissions: ["events:add"] } });
-    expect(await checkCloudKey("u", "k")).toMatchObject({ ok: true, note: expect.stringContaining("policies:pull") });
+    expect(await checkCloudKey("https://x.example.com", "k")).toMatchObject({ ok: true, note: expect.stringContaining("policies:pull") });
     vi.mocked(introspectKey).mockResolvedValueOnce({ kind: "ok", identity: { permissions: ["jev:evaluate"] } });
-    expect(await checkCloudKey("u", "k")).toEqual({ ok: false, refused: true, reason: "it is missing the events:add permission" });
+    expect(await checkCloudKey("https://x.example.com", "k")).toEqual({ ok: false, refused: true, reason: "it is missing the events:add permission" });
   });
 
   it("tells a refusal from not being able to ask", async () => {
     vi.mocked(introspectKey).mockResolvedValueOnce({ kind: "rejected" });
-    expect(await checkCloudKey("u", "k")).toMatchObject({ ok: false, refused: true });
+    expect(await checkCloudKey("https://x.example.com", "k")).toMatchObject({ ok: false, refused: true });
     vi.mocked(introspectKey).mockResolvedValueOnce({ kind: "unreachable", reason: "ENOTFOUND" });
-    expect(await checkCloudKey("u", "k")).toEqual({ ok: false, refused: false, reason: "ENOTFOUND" });
+    expect(await checkCloudKey("https://x.example.com", "k")).toEqual({ ok: false, refused: false, reason: "ENOTFOUND" });
+  });
+
+  it("never sends a key to an address it would refuse as typed", async () => {
+    const r = await checkCloudKey("http://cloud.example.com", "k");
+    expect(r).toMatchObject({ ok: false, refused: false });
+    expect(introspectKey).not.toHaveBeenCalled();
+    expect(validateIngestKey).not.toHaveBeenCalled();
   });
 
   it("falls back to the ingest probe on a server too old for introspect", async () => {
@@ -483,7 +490,7 @@ describe("cloud helpers", () => {
     expect(await checkCloudKey("https://x.example.com", "k")).toMatchObject({ ok: false, refused: true });
     expect(vi.mocked(validateIngestKey).mock.calls[0]![0]).toEqual({ url: "https://x.example.com/v1/events", key: "k" });
     vi.mocked(validateIngestKey).mockResolvedValueOnce({ ok: false, reason: "could not reach the server (fetch failed)" });
-    expect(await checkCloudKey("u", "k")).toMatchObject({ ok: false, refused: false });
+    expect(await checkCloudKey("https://x.example.com", "k")).toMatchObject({ ok: false, refused: false });
   });
 
   it("collapses the CONNECT step to what was checked, never what was written", () => {
@@ -1538,6 +1545,30 @@ describe("browser login", () => {
     expect(installHooks).toHaveBeenCalledTimes(1);
     expect(printed(io.stdout)).toContain("The login took too long to finish, so no key was created.");
     expect(printed(io.stdout)).not.toContain("keeps its previous connection");
+    // The completion event reports what happened, not what was planned.
+    const props = vi.mocked(trackHookEvent).mock.calls.find((call) => call[1] === "configure_applied")![2];
+    expect(props).toMatchObject({ connected: false, mode: "oss" });
+  });
+
+  it("does not send the saved key to a saved address it would refuse as typed", async () => {
+    writeIngestCredential({ url: "http://cloud.example.com/v1/events", key: "saved-key-3f2a" });
+    connectPick = "keep";
+    await runConfigureWizard(ttyIO());
+    expect(introspectKey).not.toHaveBeenCalled();
+    expect(validateIngestKey).not.toHaveBeenCalled();
+  });
+
+  it("saves the org the login was approved into", async () => {
+    vi.mocked(claimLogin).mockResolvedValueOnce({
+      kind: "ok",
+      key: "k".repeat(64),
+      keyName: "failproofai · box",
+      org: { id: "o-1", slug: "acme", name: "Acme" },
+      permissions: ["events:add", "policies:pull"],
+    } as never);
+    connectPick = "login";
+    await runConfigureWizard(ttyIO());
+    expect(vi.mocked(connectToCloud).mock.calls[0]![0]).toMatchObject({ org: { id: "o-1", slug: "acme", name: "Acme" } });
   });
 
   it("says the old key still works after logging in again on a connected machine", async () => {
diff --git a/src/hooks/cloud-connection.ts b/src/hooks/cloud-connection.ts
index 2ae37590f..64d540beb 100644
--- a/src/hooks/cloud-connection.ts
+++ b/src/hooks/cloud-connection.ts
@@ -141,6 +141,10 @@ export interface ConnectInput {
    */
   sessions?: boolean;
   environment?: string;
+  /** The org the key is already known to report into — a browser login's
+   *  claim names it. Used only when introspect gives no answer (unreachable
+   *  just then, or an older server), so the saved org is not left stale. */
+  org?: { id?: string; slug?: string; name?: string };
   /** Injected by tests so nothing reaches the network. */
   verifyPolicy?: typeof verifyCloudCredentials;
   verifyIngest?: typeof validateIngestKey;
@@ -162,7 +166,8 @@ export interface ConnectOutcome {
    * server has no introspect endpoint to say whether the key carries it.
    */
   jev?: JevConnectOutcome;
-  /** Which organisation the key belongs to. Absent on a pre-introspect server. */
+  /** Which organisation the key belongs to. Absent when neither introspect nor
+   *  the caller (`ConnectInput.org`) named one. */
   org?: { id?: string; slug?: string; name?: string };
   /** True when at least one capability was configured. */
   anyConfigured: boolean;
@@ -264,6 +269,7 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
   // CLI ships independently of whatever server a customer runs, so a good key
   // on an older deployment must still connect.
   const known = identity.kind === "ok" ? identity.identity : null;
+  const org = known ? { id: known.orgId, slug: known.orgSlug, name: known.orgName } : input.org;
 
   // Skip a probe the key provably cannot pass. This is not an optimisation: a
   // permission failure surfaces from `/events` as a 403 whose message reads
@@ -294,9 +300,7 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
       : { ok: false, reason: policyResult.reason },
     ingest: ingestResult.ok ? { ok: true } : { ok: false, reason: ingestResult.reason },
     anyConfigured: false,
-    org: known
-      ? { id: known.orgId, slug: known.orgSlug, name: known.orgName }
-      : undefined,
+    org,
   };
 
   outcome.anyConfigured = policyResult.ok || ingestResult.ok;
@@ -317,8 +321,8 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
     prev.jev ? { token: prev.jev.key, url: prev.jev.url } : undefined,
   ].some((slot) => slot && (slot.token !== input.token || !sameOrigin(slot.url)));
   const orgSwitch = hadConnection && (
-    (prev.org?.id && known?.orgId && prev.org.id !== known.orgId) ||
-    ((!prev.org?.id || !known?.orgId) && keyChanged) ||
+    (prev.org?.id && org?.id && prev.org.id !== org.id) ||
+    ((!prev.org?.id || !org?.id) && keyChanged) ||
     (previousPolicy && !sameOrigin(previousPolicy.url)) ||
     (prev.ingest && !sameOrigin(prev.ingest.url))
   );
@@ -329,7 +333,7 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
   if (orgSwitch) {
     rmSync(backfillRequestPath(), { force: true });
     const oldOrg = prev.org?.name ?? prev.org?.slug ?? prev.org?.id ?? "the previous org";
-    const newOrg = known?.orgName ?? known?.orgSlug ?? known?.orgId ?? "the new org";
+    const newOrg = org?.name ?? org?.slug ?? org?.id ?? "the new org";
     changes.push(`Switched from ${oldOrg} to ${newOrg}. Nothing recorded before now will be sent to ${newOrg}; ${oldOrg}'s cloud policies stop within ~30 s.`);
     // Remove local references, not the daemon's policy-floor state (#899).
     clearActiveCloudManagedPolicies();
@@ -362,8 +366,8 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
     if (prev.jev) changes.push(`Removed the previous Jev key ${maskToken(prev.jev.key)}: this key's ${PERMISSION_JEV} permission was not verified.`);
   }
   const since = boundary === undefined ? {} : { since: boundary };
-  if (known) {
-    next.org = { id: known.orgId, slug: known.orgSlug, name: known.orgName, ...since };
+  if (org) {
+    next.org = { ...org, ...since };
   } else {
     const { since: _drop, ...kept } = orgSwitch ? {} : (prev.org ?? {});
     next.org = { ...kept, ...since };
@@ -373,7 +377,7 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
   // a flush served before the daemon sees the new key retries these batches
   // with the key that was refused, re-parking them as definitive refusals.
   if (ingestResult.ok && prev.ingest && prev.ingest.key !== input.token) {
-    recoverCredentialRefusals(Boolean(prev.org?.id && prev.org.id === known?.orgId && sameOrigin(prev.ingest.url)), prev.org?.id);
+    recoverCredentialRefusals(Boolean(prev.org?.id && prev.org.id === org?.id && sameOrigin(prev.ingest.url)), prev.org?.id);
   }
   // Legacy JSON override remains supported; the consolidated file above is
   // published once, never as a mixture of previous and replacement slots.
diff --git a/src/hooks/cloud-login.ts b/src/hooks/cloud-login.ts
index 16ba14199..a3f388bfe 100644
--- a/src/hooks/cloud-login.ts
+++ b/src/hooks/cloud-login.ts
@@ -162,9 +162,12 @@ export async function startLogin(
     fetchImpl,
   );
   if ("error" in r) return { kind: "unreachable", reason: r.error };
-  // No such route, or the web app redirecting an unknown path: a cloud from
-  // before this feature. Not an error — the key prompt still connects it.
-  if (r.status === 404 || (r.status >= 300 && r.status < 400)) return { kind: "unsupported" };
+  // No such route, the web app redirecting an unknown path, or serving a page
+  // (200, not JSON) in its place: a cloud from before this feature. Not an
+  // error — the key prompt still connects it.
+  if (r.status === 404 || (r.status >= 300 && r.status < 400) || (r.status === 200 && !r.json)) {
+    return { kind: "unsupported" };
+  }
   if (r.status === 429) return { kind: "refused", reason: "too many login attempts from here — wait a minute" };
   if (r.status !== 201 || !r.json) {
     return r.status >= 500
diff --git a/src/hooks/configure-wizard.ts b/src/hooks/configure-wizard.ts
index b1795127e..c81cd655a 100644
--- a/src/hooks/configure-wizard.ts
+++ b/src/hooks/configure-wizard.ts
@@ -1443,24 +1443,6 @@ export async function runConfigureWizard(
     pruneOldDaemonBinaries();
   }
 
-  const connectedAfterPlan = connecting || cloud.kind === "kept";
-  // Telemetry runs concurrently with the rest of apply (never rejects,
-  // 5s-bounded) and is awaited before returning. `cli` carries the selected
-  // agent ids, as it always has (and as hooks_installed does): a fixed list of
-  // product ids, never user content. The agents_* fields add counts only.
-  const applied = emit("configure_applied", {
-    target: "user",
-    scopes: ["user"],
-    cli: selected,
-    cli_count: selected.length,
-    policy_count: (readScopedHooksConfig("user", cwd).enabledPolicies ?? []).length,
-    connected: connecting,
-    mode: connectedAfterPlan ? "cloud" : "oss",
-    agents_selected: selected.length,
-    agents_detected: plan.detected.size,
-    agents_changed: added.length + removed.length > 0,
-  });
-
   // Hooks, at user scope, for the chosen agents. Whatever policies are enabled
   // there are carried through untouched: `replace: true` would otherwise switch
   // off policies the user had turned on, and setup must never reduce
@@ -1508,6 +1490,7 @@ export async function runConfigureWizard(
   let token: string | null = cloud.kind === "connect" ? cloud.token : null;
   let orgLabel: string | undefined = cloud.kind === "connect" ? cloud.org : undefined;
   let mintedName: string | undefined;
+  let claimedOrg: LoginOrg | undefined;
   if (cloud.kind === "login" && url) {
     const claimed = await transient("Creating this machine's key…", () => claimLogin(url, cloud.pollSecret));
     void emit("configure_cloud_login", { step: "claimed", ok: claimed.kind === "ok", reason: claimed.kind });
@@ -1515,6 +1498,7 @@ export async function runConfigureWizard(
       token = claimed.key;
       orgLabel = loginOrgLabel(claimed.org);
       mintedName = claimed.keyName;
+      claimedOrg = claimed.org;
     } else {
       hookLogWarn(`cloud login could not be completed: ${claimed.kind}`);
       done.push(
@@ -1541,6 +1525,8 @@ export async function runConfigureWizard(
           machineLabel,
           // Both streams unless the run said `--no-transcripts`.
           sessions: answers.noTranscripts !== true,
+          // The org the login was approved into, for when introspect can't say.
+          org: claimedOrg,
         }),
       );
       connected = outcome.anyConfigured;
@@ -1583,8 +1569,25 @@ export async function runConfigureWizard(
         : "  This machine keeps its previous connection.",
     );
   }
-
-  await applied;
+  const cloudAfter = connected || cloud.kind === "kept" || keptOld;
+
+  // Sent once the connection's outcome is known — a login whose claim then
+  // failed must not count as connected. Never rejects, 5s-bounded. `cli`
+  // carries the selected agent ids, as it always has (and as hooks_installed
+  // does): a fixed list of product ids, never user content. The agents_*
+  // fields add counts only.
+  await emit("configure_applied", {
+    target: "user",
+    scopes: ["user"],
+    cli: selected,
+    cli_count: selected.length,
+    policy_count: policies.length,
+    connected,
+    mode: cloudAfter ? "cloud" : "oss",
+    agents_selected: selected.length,
+    agents_detected: plan.detected.size,
+    agents_changed: added.length + removed.length > 0,
+  });
   // Only now — a completed apply — is the launcher considered "seen", so
   // first-run onboarding stops offering itself on every command.
   markLauncherSeen();
@@ -1601,7 +1604,7 @@ export async function runConfigureWizard(
       done,
       cwd,
       agents: selected.length,
-      connected: connected || cloud.kind === "kept" || keptOld,
+      connected: cloudAfter,
       codexTrust,
     }),
   );
@@ -1614,7 +1617,7 @@ export async function runConfigureWizard(
     policies,
     daemonInstalled,
     connected,
-    mode: connected || cloud.kind === "kept" || keptOld ? "cloud" : "oss",
+    mode: cloudAfter ? "cloud" : "oss",
     agents: { selected, added, removed },
   };
 }
@@ -1730,6 +1733,11 @@ export async function checkCloudKey(
   url: string,
   key: string,
 ): Promise<{ ok: true; org?: string; note?: string } | { ok: false; refused: boolean; reason: string }> {
+  // Checked here rather than trusted: a saved address comes from a file that
+  // can be edited, and an http one to another host would carry the key in
+  // the clear. Not a verdict on the key, so not `refused`.
+  const target = validateCloudUrl(url);
+  if (!target.ok) return { ok: false, refused: false, reason: `the address ${url} can't be used: ${target.reason}` };
   const identity = await introspectKey(url, key);
   if (identity.kind === "rejected") return { ok: false, refused: true, reason: "the server did not accept it" };
   if (identity.kind === "unreachable") return { ok: false, refused: false, reason: identity.reason };
diff --git a/src/hooks/tui.ts b/src/hooks/tui.ts
index 035d0bf94..7c7071927 100644
--- a/src/hooks/tui.ts
+++ b/src/hooks/tui.ts
@@ -1481,6 +1481,15 @@ export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ v
     above.push(...lines);
   };
 
+  /** Fold what was printed above into the region, so the next repaint erases
+   *  it too — the heading goes with it and returns to the region. */
+  const forgetAbove = (): void => {
+    const cols = stdout.columns || 80;
+    for (const line of above) region.lastCount += Math.max(1, Math.ceil(visibleWidth(line) / cols));
+    above.length = 0;
+    headingShown = false;
+  };
+
   const clearPoll = (): void => {
     if (pollTimer) clearTimeout(pollTimer);
     pollTimer = null;
@@ -1500,10 +1509,7 @@ export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ v
       stdin.pause();
       process.removeListener("exit", restoreTerminal);
       // Leaving for the menu takes the printed link with it.
-      if (answer === BACK) {
-        const cols = stdout.columns || 80;
-        for (const line of above) region.lastCount += Math.max(1, Math.ceil(visibleWidth(line) / cols));
-      }
+      if (answer === BACK) forgetAbove();
       const lines =
         answer === null
           ? [c.ink3("cancelled")]
@@ -1564,6 +1570,9 @@ export function promptBrowserLogin<T>(opts: BrowserLoginOptions<T>): Promise<{ v
       clearPoll();
       cautionLine = "";
       phase = "starting";
+      // A retry: the expired or refused link is dead, so it leaves the screen
+      // rather than sit above the new one, where it could still be opened.
+      forgetAbove();
       draw();
       let started: BrowserLoginStart;
       try {

From 77cc8bb229a9d91be95a0943a15904268c887521 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Fri, 23 Oct 2026 14:30:49 +0530
Subject: [PATCH 09/14] [config-account-login] Release as 1.0.12 (stable)

1.0.12-beta.1 was published to npm on `next` from another branch
(feat/cloud-jev-on-main) before this PR took that number, so publishing it
from main would be refused by preflight. Cut the stable release instead:
1.0.12 across package.json, Cargo.toml/Cargo.lock and hermes-plugin/plugin.yaml,
and the top changelog section becomes `## 1.0.12`, which the stable
release-notes check and the Discord announcement read along with every
`1.0.12-beta.*` section below it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md              | 4 +++-
 Cargo.lock                | 6 +++---
 Cargo.toml                | 2 +-
 hermes-plugin/plugin.yaml | 2 +-
 package.json              | 2 +-
 5 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a3dd44024..5cf7f04ca 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,8 @@
 # Changelog
 
-## 1.0.12-beta.1 — 2026-10-23
+## 1.0.12 — 2026-10-23
+
+The stable release of logging in to FailproofAI Cloud from `config` in your browser. Everything below in the `1.0.12-beta.*` sections ships here too.
 
 ### Fixes
 
diff --git a/Cargo.lock b/Cargo.lock
index 93795cd4e..c16256b72 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -298,7 +298,7 @@ dependencies = [
 
 [[package]]
 name = "failproofaid"
-version = "1.0.12-beta.1"
+version = "1.0.12"
 dependencies = [
  "fpai-collect",
  "fpai-ipc",
@@ -361,7 +361,7 @@ dependencies = [
 
 [[package]]
 name = "fpai-collect"
-version = "1.0.12-beta.1"
+version = "1.0.12"
 dependencies = [
  "axum",
  "getrandom 0.4.3",
@@ -382,7 +382,7 @@ dependencies = [
 
 [[package]]
 name = "fpai-ipc"
-version = "1.0.12-beta.1"
+version = "1.0.12"
 dependencies = [
  "libc",
  "proptest",
diff --git a/Cargo.toml b/Cargo.toml
index db70e89ac..beff85f1b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ resolver = "3"
 members = ["crates/*"]
 
 [workspace.package]
-version = "1.0.12-beta.1"
+version = "1.0.12"
 edition = "2024"
 license-file = "LICENSE"
 repository = "https://github.com/FailproofAI/failproofai"
diff --git a/hermes-plugin/plugin.yaml b/hermes-plugin/plugin.yaml
index a21cff101..ae909148f 100644
--- a/hermes-plugin/plugin.yaml
+++ b/hermes-plugin/plugin.yaml
@@ -1,5 +1,5 @@
 name: failproofai
-version: 1.0.12-beta.1
+version: 1.0.12
 description: Real-time FailproofAI policy enforcement for Hermes
 manifest_version: 2
 api_version: 1
diff --git a/package.json b/package.json
index 922f95093..789652f04 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.12-beta.1",
+  "version": "1.0.12",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",

From 03af168260ac885f40647989f4385a24f46034e8 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Fri, 23 Oct 2026 16:16:56 +0530
Subject: [PATCH 10/14] [config-account-login] Give every agent the failproofai
 skill

`config` now writes one small `failproofai/SKILL.md` into each agent it finds
(and any ticked), in that agent's own user-scope skills folder. The file is a
pointer: it sends the agent to the umbrella skill and its five siblings in the
public FailproofAI/skills repo, so the content is read live and never goes
stale on disk.

Every folder was verified against the real CLI in Docker (probe skills, the
CLI's own listing or a mock-model capture), then re-checked end to end with
this code for Claude Code, Codex, Copilot, OpenCode, OpenClaw, Devin and Goose:
- one folder per agent, following CLAUDE_CONFIG_DIR, CODEX_HOME, COPILOT_HOME,
  XDG_CONFIG_HOME, PI_CODING_AGENT_DIR, FACTORY_HOME_OVERRIDE and
  GOOSE_PATH_ROOT; every Hermes and OpenClaw profile gets its own copy;
- never the shared ~/.agents/skills (Claude ignores it, Codex lists dupes,
  Copilot drops it under COPILOT_HOME, OpenClaw lets it outrank its own);
- name = folder name, description under 200 chars and led by its subject
  (Copilot drops >1024, droid shows 200, Hermes 57).

A `.failproofai-managed` marker marks folders failproofai wrote: one without it
(e.g. `npx skills add FailproofAI/skills`) is never overwritten, and
`failproofai uninstall` removes only marked folders. A folder that can't be
written is logged and skipped; setup never fails on it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                             |   4 +
 __tests__/hooks/agent-skill.test.ts      | 159 +++++++++++++++++++++
 __tests__/hooks/configure-wizard.test.ts |  14 ++
 __tests__/hooks/uninstall-cli.test.ts    |  37 +++++
 docs/reference/failproof-cli.mdx         |   6 +-
 src/hooks/agent-skill.ts                 | 173 +++++++++++++++++++++++
 src/hooks/configure-wizard.ts            |   9 ++
 src/hooks/uninstall-cli.ts               |  13 +-
 8 files changed, 411 insertions(+), 4 deletions(-)
 create mode 100644 __tests__/hooks/agent-skill.test.ts
 create mode 100644 src/hooks/agent-skill.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5cf7f04ca..d1751bcf6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@
 
 The stable release of logging in to FailproofAI Cloud from `config` in your browser. Everything below in the `1.0.12-beta.*` sections ships here too.
 
+### Features
+
+- **Every agent on the machine knows FailproofAI.** `config` adds a small `failproofai` skill to each agent it finds (and any you tick), in that agent's own skills folder: Claude Code, Codex, Copilot, Cursor, OpenCode, Pi, every Hermes and OpenClaw profile, droid, Devin, Antigravity and Goose. It points the agent at the FailproofAI skills on GitHub, which it reads when a FailproofAI task comes up, so what it reads is always the current version with nothing to update. Each folder was checked against the agent itself. A `failproofai` skill you installed yourself (for example with `npx skills add FailproofAI/skills`) is left as it is, and `failproofai uninstall` removes only the ones `config` wrote (#920)
+
 ### Fixes
 
 - `config` on a machine with no saved connection, whose browser login was approved but whose key could not be claimed, no longer says "This machine keeps its previous connection." and reports cloud mode with no key on disk; it finishes set up as open source (#920)
diff --git a/__tests__/hooks/agent-skill.test.ts b/__tests__/hooks/agent-skill.test.ts
new file mode 100644
index 000000000..e24230763
--- /dev/null
+++ b/__tests__/hooks/agent-skill.test.ts
@@ -0,0 +1,159 @@
+// @vitest-environment node
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, relative } from "node:path";
+import {
+  AGENT_SKILL_MARKER,
+  AGENT_SKILL_MD,
+  AGENT_SKILL_NAME,
+  agentSkillRoots,
+  installAgentSkill,
+  installedAgentSkillDirs,
+  removeAgentSkill,
+} from "../../src/hooks/agent-skill";
+import { INTEGRATION_TYPES } from "../../src/hooks/types";
+
+// Every variable that moves an agent's folder, so a developer's own exports
+// can never point a test at their real agents.
+const ENV = [
+  "HOME", "FAILPROOFAI_HOME", "XDG_CONFIG_HOME", "CLAUDE_CONFIG_DIR", "CODEX_HOME", "COPILOT_HOME",
+  "PI_CODING_AGENT_DIR", "HERMES_HOME", "OPENCLAW_HOME", "OPENCLAW_STATE_DIR", "OPENCLAW_CONFIG_PATH",
+  "FACTORY_HOME_OVERRIDE", "GOOSE_PATH_ROOT",
+];
+let saved: Record<string, string | undefined>;
+let home: string;
+beforeEach(() => {
+  saved = Object.fromEntries(ENV.map((k) => [k, process.env[k]]));
+  for (const k of ENV) delete process.env[k];
+  home = mkdtempSync(join(tmpdir(), "fpai-skill-"));
+  process.env.HOME = home;
+  process.env.FAILPROOFAI_HOME = join(home, ".failproofai");
+});
+afterEach(() => {
+  for (const k of ENV) {
+    if (saved[k] === undefined) delete process.env[k];
+    else process.env[k] = saved[k];
+  }
+  rmSync(home, { recursive: true, force: true });
+});
+
+const rel = (paths: string[]) => paths.map((p) => relative(home, p));
+const skillFile = (root: string) => join(root, AGENT_SKILL_NAME, "SKILL.md");
+
+describe("agentSkillRoots", () => {
+  it("is each agent's own user folder, as verified against each CLI", () => {
+    expect(Object.fromEntries(INTEGRATION_TYPES.map((id) => [id, rel(agentSkillRoots(id))]))).toEqual({
+      claude: [".claude/skills"],
+      codex: [".codex/skills"],
+      copilot: [".copilot/skills"],
+      cursor: [".cursor/skills"],
+      opencode: [".config/opencode/skills"],
+      pi: [".pi/agent/skills"],
+      hermes: [".hermes/skills"],
+      openclaw: [".openclaw/skills"],
+      factory: [".factory/skills"],
+      devin: [".config/devin/skills"],
+      antigravity: [".gemini/config/skills"],
+      goose: [".config/goose/skills"],
+    });
+  });
+
+  it("follows each agent's own override", () => {
+    const at = (name: string) => join(home, "moved", name);
+    Object.assign(process.env, {
+      CLAUDE_CONFIG_DIR: at("claude"), CODEX_HOME: at("codex"), COPILOT_HOME: at("copilot"),
+      XDG_CONFIG_HOME: at("xdg"), PI_CODING_AGENT_DIR: at("pi"), FACTORY_HOME_OVERRIDE: at("factory"),
+    });
+    expect(rel(["claude", "codex", "copilot", "opencode", "pi", "factory", "devin", "goose"].flatMap((id) =>
+      agentSkillRoots(id as never)))).toEqual([
+      "moved/claude/skills", "moved/codex/skills", "moved/copilot/skills", "moved/xdg/opencode/skills",
+      "moved/pi/skills", "moved/factory/.factory/skills", "moved/xdg/devin/skills", "moved/xdg/goose/skills",
+    ]);
+    process.env.GOOSE_PATH_ROOT = at("goose");
+    expect(rel(agentSkillRoots("goose"))).toEqual(["moved/goose/config/skills"]);
+  });
+
+  it("covers every Hermes and OpenClaw profile, since each reads only its own", () => {
+    mkdirSync(join(home, ".hermes", "profiles", "work"), { recursive: true });
+    mkdirSync(join(home, ".openclaw-work"), { recursive: true });
+    writeFileSync(join(home, ".openclaw-work", "openclaw.json"), "{}");
+    expect(rel(agentSkillRoots("hermes"))).toEqual([".hermes/skills", ".hermes/profiles/work/skills"]);
+    expect(rel(agentSkillRoots("openclaw"))).toEqual([".openclaw/skills", ".openclaw-work/skills"]);
+  });
+
+  it("never uses the shared ~/.agents/skills", () => {
+    const all = INTEGRATION_TYPES.flatMap((id) => rel(agentSkillRoots(id)));
+    expect(all.filter((p) => p.startsWith(".agents"))).toEqual([]);
+  });
+});
+
+describe("the skill file", () => {
+  const front = /^---\nname: (.+)\ndescription: (.+)\n---\n/.exec(AGENT_SKILL_MD);
+
+  it("names the folder it sits in, with a description every agent shows enough of", () => {
+    expect(front?.[1]).toBe(AGENT_SKILL_NAME);
+    const description = front![2]!;
+    // Copilot drops a skill over 1024; droid shows the model 200, Hermes 57.
+    expect(description.length).toBeLessThanOrEqual(200);
+    expect(description.slice(0, 57)).toMatch(/^FailproofAI hooks, policies/);
+  });
+
+  it("points at the umbrella skill and its siblings online", () => {
+    const base = "https://raw.githubusercontent.com/FailproofAI/skills/main/skills";
+    for (const name of ["failproofai", "failproofai-policy-author", "failproofai-policy-publish", "fp-cloud-cli", "failproofai-sdk", "failproofai-eval-brainstorm"]) {
+      expect(AGENT_SKILL_MD).toContain(`${base}/${name}/SKILL.md`);
+    }
+  });
+});
+
+describe("installAgentSkill", () => {
+  it("writes the skill and its marker into each agent's folder", () => {
+    expect(installAgentSkill(["claude", "goose"])).toEqual(["claude", "goose"]);
+    for (const id of ["claude", "goose"] as const) {
+      const [root] = agentSkillRoots(id);
+      expect(readFileSync(skillFile(root!), "utf8")).toBe(AGENT_SKILL_MD);
+      expect(existsSync(join(root!, AGENT_SKILL_NAME, AGENT_SKILL_MARKER))).toBe(true);
+    }
+    expect(existsSync(join(home, ".codex"))).toBe(false);
+  });
+
+  it("rewrites its own folder, and never touches a failproofai skill someone else put there", () => {
+    const [claude] = agentSkillRoots("claude");
+    const [codex] = agentSkillRoots("codex");
+    installAgentSkill(["claude"]);
+    writeFileSync(skillFile(claude!), "old");
+    mkdirSync(join(codex!, AGENT_SKILL_NAME), { recursive: true });
+    writeFileSync(skillFile(codex!), "the full skill, from npx skills");
+
+    expect(installAgentSkill(["claude", "codex"])).toEqual(["claude"]);
+    expect(readFileSync(skillFile(claude!), "utf8")).toBe(AGENT_SKILL_MD);
+    expect(readFileSync(skillFile(codex!), "utf8")).toBe("the full skill, from npx skills");
+  });
+
+  it("skips a folder it cannot write without failing the rest", () => {
+    writeFileSync(join(home, ".codex"), "a file where the folder would go");
+    expect(installAgentSkill(["codex", "claude"])).toEqual(["claude"]);
+  });
+
+  it("writes every Hermes profile", () => {
+    mkdirSync(join(home, ".hermes", "profiles", "work"), { recursive: true });
+    installAgentSkill(["hermes"]);
+    for (const root of agentSkillRoots("hermes")) expect(existsSync(skillFile(root))).toBe(true);
+  });
+});
+
+describe("removeAgentSkill", () => {
+  it("removes only the folders failproofai wrote", () => {
+    installAgentSkill(["claude", "cursor"]);
+    const [codex] = agentSkillRoots("codex");
+    mkdirSync(join(codex!, AGENT_SKILL_NAME), { recursive: true });
+    writeFileSync(skillFile(codex!), "someone else's");
+
+    expect(rel(installedAgentSkillDirs())).toEqual([".claude/skills/failproofai", ".cursor/skills/failproofai"]);
+    expect(rel(removeAgentSkill())).toEqual([".claude/skills/failproofai", ".cursor/skills/failproofai"]);
+    expect(installedAgentSkillDirs()).toEqual([]);
+    expect(existsSync(join(home, ".claude", "skills"))).toBe(true);
+    expect(readFileSync(skillFile(codex!), "utf8")).toBe("someone else's");
+  });
+});
diff --git a/__tests__/hooks/configure-wizard.test.ts b/__tests__/hooks/configure-wizard.test.ts
index ceba31ec6..bd80a3993 100644
--- a/__tests__/hooks/configure-wizard.test.ts
+++ b/__tests__/hooks/configure-wizard.test.ts
@@ -101,6 +101,9 @@ vi.mock("../../src/hooks/integrations", async (importOriginal) => {
   const actual = await importOriginal<typeof import("../../src/hooks/integrations")>();
   return { ...actual, detectInstalledClis: vi.fn(() => ["claude"]) };
 });
+// Agents' skill folders can sit outside HOME (CLAUDE_CONFIG_DIR, XDG_CONFIG_HOME…),
+// so no wizard test writes one; agent-skill.test.ts covers the writing.
+vi.mock("../../src/hooks/agent-skill", () => ({ installAgentSkill: vi.fn((ids: string[]) => ids) }));
 
 import {
   BACK,
@@ -165,6 +168,7 @@ import { trackHookEvent } from "../../src/hooks/hook-telemetry";
 import { configFile as fpConfigFile, credentialsFile, launcherMarker } from "../../src/hooks/fp-home";
 import { readConfig as readFpConfig, updateConfig } from "../../src/hooks/fp-config";
 import { backfillRequestPath } from "../../src/hooks/backfill-request";
+import { installAgentSkill } from "../../src/hooks/agent-skill";
 
 it("savedConnection flags split keys instead of treating either as the saved connection", () => {
   mkdirSync(dirname(credentialsFile()), { recursive: true });
@@ -270,6 +274,7 @@ beforeEach(() => {
   vi.mocked(runPostSetupAudit).mockClear();
   vi.mocked(trackHookEvent).mockClear();
   vi.mocked(detectInstalledClis).mockReset().mockReturnValue(["claude"]);
+  vi.mocked(installAgentSkill).mockReset().mockImplementation((ids) => [...ids]);
   vi.mocked(notEnforcingReason).mockReset().mockReturnValue("no-policies");
   vi.mocked(enforcingPolicyCount).mockReset().mockReturnValue({ count: 0, custom: false });
   vi.mocked(connectToCloud)
@@ -690,6 +695,15 @@ describe("runConfigureWizard", () => {
     expect(call[8]).toEqual({ replace: true, quiet: true });
   });
 
+  it("adds the failproofai skill to every detected agent, and any ticked, traced or not", async () => {
+    vi.mocked(detectInstalledClis).mockReturnValue(["claude", "goose"]);
+    drive({ agents: ["goose", "codex"] });
+    const io = ttyIO();
+    await runConfigureWizard(io);
+    expect(installAgentSkill).toHaveBeenCalledWith(["claude", "codex", "goose"]);
+    expect(printed(io.stdout)).toContain("Added the failproofai skill to 3 agents.");
+  });
+
   it("saves the selection, and what it saw", async () => {
     vi.mocked(detectInstalledClis).mockReturnValue(["claude", "goose"]);
     drive({ agents: ["goose"] });
diff --git a/__tests__/hooks/uninstall-cli.test.ts b/__tests__/hooks/uninstall-cli.test.ts
index 98a11fb84..897ded16b 100644
--- a/__tests__/hooks/uninstall-cli.test.ts
+++ b/__tests__/hooks/uninstall-cli.test.ts
@@ -24,6 +24,7 @@ let servicePath: string;
 let serviceExists = true;
 let configured = true;
 let installedClis: string[] = ["claude", "codex"];
+let skillDirs: string[] = [];
 
 vi.mock("../../src/hooks/manager", () => ({
   removeHooks: vi.fn(async () => {
@@ -31,6 +32,16 @@ vi.mock("../../src/hooks/manager", () => ({
   }),
 }));
 
+vi.mock("../../src/hooks/agent-skill", () => ({
+  installedAgentSkillDirs: () => skillDirs,
+  removeAgentSkill: vi.fn(() => {
+    calls.push("removeAgentSkill");
+    const removed = skillDirs;
+    skillDirs = [];
+    return removed;
+  }),
+}));
+
 vi.mock("../../src/hooks/daemon-service", () => ({
   isDaemonSupportedPlatform: () => true,
   daemonServiceFilePath: () => servicePath,
@@ -78,6 +89,7 @@ beforeEach(() => {
   serviceExists = true;
   configured = true;
   installedClis = ["claude", "codex"];
+  skillDirs = [];
 });
 
 afterEach(() => {
@@ -118,6 +130,31 @@ describe("hooks/uninstall-cli", () => {
     expect(res.lines.join("\n")).toMatch(/would deny every tool call/);
   });
 
+  it("removes the failproofai skill config wrote, after daemonConfigured comes down", async () => {
+    skillDirs = ["/h/.claude/skills/failproofai", "/h/.codex/skills/failproofai"];
+    const { runUninstallCommand } = await import("../../src/hooks/uninstall-cli");
+    const plan = await runUninstallCommand({ dryRun: true });
+    expect(plan.lines.join("\n")).toContain("the failproofai skill from 2 agent folders");
+    expect(calls).not.toContain("removeAgentSkill");
+
+    const res = await runUninstallCommand({ yes: true });
+    expect(res.exitCode).toBe(0);
+    expect(calls.indexOf("setDaemonConfigured(false)")).toBeLessThan(calls.indexOf("removeAgentSkill"));
+    expect(res.lines.join("\n")).toContain("Removed the failproofai skill from 2 agent folders.");
+  });
+
+  it("has something to uninstall when only the skill is left", async () => {
+    installedClis = [];
+    configured = false;
+    serviceExists = false;
+    rmSync(servicePath, { force: true });
+    skillDirs = ["/h/.claude/skills/failproofai"];
+    const { runUninstallCommand } = await import("../../src/hooks/uninstall-cli");
+    const res = await runUninstallCommand({ yes: true });
+    expect(res.lines.join("\n")).not.toContain("Nothing to uninstall");
+    expect(calls).toContain("removeAgentSkill");
+  });
+
   it("refuses without --yes when there is no way to confirm", async () => {
     // A prompt that cannot be answered must never read as consent to delete a
     // root-owned service — this is the CI / piped-stdin path.
diff --git a/docs/reference/failproof-cli.mdx b/docs/reference/failproof-cli.mdx
index 2444ec30e..efa063820 100644
--- a/docs/reference/failproof-cli.mdx
+++ b/docs/reference/failproof-cli.mdx
@@ -41,7 +41,7 @@ Run `failproofai` without arguments to open the local policy dashboard.
 
 | Command | Outcome |
 | --- | --- |
-| `failproofai config` | Set the machine up: agents, daemon, and Cloud — log in through the browser, paste a key, or stay open source |
+| `failproofai config` | Set the machine up: agents, daemon, and Cloud — log in through the browser, paste a key, or stay open source. Every agent on the machine also gets a small `failproofai` skill that points it at the [FailproofAI skills](https://github.com/FailproofAI/skills) online |
 | `failproofai config --token <key>` | Set up and connect in one pass, asking nothing. A key that carries `jev:evaluate` also turns on [Jev through FailproofAI Cloud](/reference/jev-cloud) in observe mode, unless a `jev.json` already exists or `--no-transcripts` is given |
 | `failproofai config --connect <url>` | Enrol a machine that is **already** set up — no daemon, no hooks |
 | `failproofai config --status` | Show connection, daemon, delivery, and pause state |
@@ -75,7 +75,7 @@ Run `failproofai` without arguments to open the local policy dashboard.
 | `failproofai config --resume` | Resume one paused local session; add `--all` to clear all pauses |
 | `failproofai update` | Finish package migrations and update the daemon |
 | `failproofai migrate --dry-run` | Preview or run pending home-layout migrations |
-| `failproofai uninstall` | Remove hooks and the daemon before removing the package |
+| `failproofai uninstall` | Remove hooks, the `failproofai` skill and the daemon before removing the package |
 | `failproofai --version` | Print the installed package version |
 | `failproofai --help` | Show commands and global usage |
 
@@ -185,5 +185,5 @@ npm rm -g failproofai
 Run `failproofai <command> --help` for version-specific details.
 
 <Warning>
-  Run `failproofai uninstall` before `npm rm -g failproofai`; npm does not remove installed agent hooks or the daemon service.
+  Run `failproofai uninstall` before `npm rm -g failproofai`; npm does not remove installed agent hooks, the `failproofai` skill or the daemon service.
 </Warning>
diff --git a/src/hooks/agent-skill.ts b/src/hooks/agent-skill.ts
new file mode 100644
index 000000000..f58cb9206
--- /dev/null
+++ b/src/hooks/agent-skill.ts
@@ -0,0 +1,173 @@
+/**
+ * The `failproofai` skill: one small SKILL.md that `failproofai config` puts in
+ * every agent this machine has, in that agent's own user-scope skills folder.
+ *
+ * It carries no instructions of its own. It points the agent at the umbrella
+ * skill in the public FailproofAI/skills repository, which the agent reads when
+ * a FailproofAI task comes up, along with whichever focused sibling skill and
+ * `references/*.md` file the task needs. So the content is never stale on
+ * disk: changing that repository changes what every machine reads next, with
+ * no release and no re-run of setup.
+ *
+ * Every folder below was verified on 2026-10-23 against the real CLI (versions
+ * in each comment), by planting a probe skill in each candidate folder and
+ * reading what the CLI listed, or what it sent to a mock model server.
+ *
+ * Never `~/.agents/skills`, although many agents read it: Claude Code does not
+ * read it at all, Codex lists a skill found there and in `~/.codex/skills`
+ * twice, Copilot stops reading it once `COPILOT_HOME` is set, and in OpenClaw it
+ * outranks OpenClaw's own folder. Each agent's own folder works on its own.
+ *
+ * The frontmatter is shaped by the strictest of them: `name` equals the folder
+ * name (Claude Code, Cursor and Devin go by the folder, the rest by `name`, and
+ * Antigravity shows a skill without one as "SKILL"); Copilot drops a skill whose
+ * description is over 1024 characters, droid shows the model the first 200, and
+ * Hermes the first 57 — so the description is short and leads with what it is
+ * for.
+ */
+import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { listHermesProfiles } from "../../lib/hermes-profiles";
+import { listOpenClawProfiles } from "../../lib/openclaw-profiles";
+import { hookLogWarn } from "./hook-logger";
+import { writeConfigFileAtomic } from "./safe-config-write";
+import { INTEGRATION_TYPES, type IntegrationType } from "./types";
+
+export const AGENT_SKILL_NAME = "failproofai";
+
+/**
+ * Sits beside SKILL.md in a folder failproofai wrote. A `failproofai` folder
+ * without it belongs to someone else — most often the full skill installed with
+ * `npx skills add FailproofAI/skills` — and is never overwritten or removed.
+ */
+export const AGENT_SKILL_MARKER = ".failproofai-managed";
+
+const SKILLS_RAW = "https://raw.githubusercontent.com/FailproofAI/skills/main/skills";
+
+export const AGENT_SKILL_MD = `---
+name: ${AGENT_SKILL_NAME}
+description: FailproofAI hooks, policies, daemon, Cloud, the fp CLI and the SDK. Use for any question about setting up, running or fixing FailproofAI.
+---
+
+# FailproofAI
+
+This skill is a pointer. Before acting on anything FailproofAI, read the full skill, which is kept current online (use your web fetch tool, or \`curl -fsSL <url>\`):
+
+${SKILLS_RAW}/${AGENT_SKILL_NAME}/SKILL.md
+
+Files it names by a relative path, such as \`references/cli.md\`, are in that same folder: ${SKILLS_RAW}/${AGENT_SKILL_NAME}/<path>
+
+For focused work, read the matching skill too. Each has the same layout, with its own \`references/\` beside it.
+
+- Writing or testing a policy: ${SKILLS_RAW}/failproofai-policy-author/SKILL.md
+- Publishing a policy pack: ${SKILLS_RAW}/failproofai-policy-publish/SKILL.md
+- FailproofAI Cloud and the \`fp\` CLI: ${SKILLS_RAW}/fp-cloud-cli/SKILL.md
+- Adding the SDK to an agent, or running an evaluator: ${SKILLS_RAW}/failproofai-sdk/SKILL.md
+- Planning evaluations: ${SKILLS_RAW}/failproofai-eval-brainstorm/SKILL.md
+`;
+
+/** An agent's own override for where it keeps its files, else the default. */
+function envDir(name: string, fallback: string): string {
+  const value = (process.env[name] ?? "").trim();
+  return value ? resolve(value) : fallback;
+}
+
+/**
+ * The skills folders `id` reads at user scope — one, except for Hermes and
+ * OpenClaw, where every profile reads only its own.
+ */
+export function agentSkillRoots(id: IntegrationType): string[] {
+  const home = homedir();
+  const config = envDir("XDG_CONFIG_HOME", join(home, ".config"));
+  switch (id) {
+    // 2.1.309. CLAUDE_CONFIG_DIR replaces ~/.claude rather than adding to it.
+    case "claude":
+      return [join(envDir("CLAUDE_CONFIG_DIR", join(home, ".claude")), "skills")];
+    // 0.164.0. Its own skill installer writes here too.
+    case "codex":
+      return [join(envDir("CODEX_HOME", join(home, ".codex")), "skills")];
+    // 1.0.103.
+    case "copilot":
+      return [join(envDir("COPILOT_HOME", join(home, ".copilot")), "skills")];
+    // 2026.10.22. Always under HOME: CURSOR_CONFIG_DIR does not move it.
+    case "cursor":
+      return [join(home, ".cursor", "skills")];
+    // 1.19.4.
+    case "opencode":
+      return [join(config, "opencode", "skills")];
+    // 1.4.0 and 0.73.1. Not the pi-extension package: a `skills/` folder there
+    // makes Pi stop loading the package's index.ts, and with it enforcement.
+    case "pi":
+      return [join(envDir("PI_CODING_AGENT_DIR", join(home, ".pi", "agent")), "skills")];
+    // 0.21.3. A profile reads its own skills/ and no other profile's.
+    case "hermes":
+      return listHermesProfiles().map((p) => join(p.home, "skills"));
+    // 2026.9.2. The same profile homes its hooks are installed into.
+    case "openclaw":
+      return listOpenClawProfiles().map((p) => join(p.home, "skills"));
+    // 0.248.0. FACTORY_HOME_OVERRIDE stands in for HOME.
+    case "factory":
+      return [join(envDir("FACTORY_HOME_OVERRIDE", home), ".factory", "skills")];
+    // 3000.11.205.
+    case "devin":
+      return [join(config, "devin", "skills")];
+    // 1.4.6. The documented user folder, beside the hooks.json we write; not
+    // ~/.gemini/antigravity/skills, which it does not read.
+    case "antigravity":
+      return [join(home, ".gemini", "config", "skills")];
+    // 1.55.0. GOOSE_PATH_ROOT moves Goose's whole config tree.
+    case "goose": {
+      const root = (process.env.GOOSE_PATH_ROOT ?? "").trim();
+      return [root ? join(resolve(root), "config", "skills") : join(config, "goose", "skills")];
+    }
+  }
+}
+
+/**
+ * Write the skill for each agent in `ids`. Never fails setup: an agent whose
+ * folder cannot be written is logged and skipped. Returns the agents that have
+ * it now.
+ */
+export function installAgentSkill(ids: readonly IntegrationType[]): IntegrationType[] {
+  const installed: IntegrationType[] = [];
+  for (const id of ids) {
+    let wrote = false;
+    for (const root of agentSkillRoots(id)) {
+      const dir = join(root, AGENT_SKILL_NAME);
+      if (existsSync(dir) && !existsSync(join(dir, AGENT_SKILL_MARKER))) continue;
+      try {
+        // Marker first: a run interrupted before it would leave a folder every
+        // later run takes for someone else's and skips.
+        mkdirSync(dir, { recursive: true });
+        writeConfigFileAtomic(join(dir, AGENT_SKILL_MARKER), "", { backup: false, symlinks: "replace" });
+        writeConfigFileAtomic(join(dir, "SKILL.md"), AGENT_SKILL_MD, { backup: false, symlinks: "replace" });
+        wrote = true;
+      } catch (err) {
+        hookLogWarn(`the failproofai skill was not written to ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    if (wrote) installed.push(id);
+  }
+  return installed;
+}
+
+/** Every skill folder failproofai wrote, for any agent. */
+export function installedAgentSkillDirs(): string[] {
+  const dirs = INTEGRATION_TYPES.flatMap((id) => agentSkillRoots(id).map((root) => join(root, AGENT_SKILL_NAME)));
+  return [...new Set(dirs)].filter((dir) => existsSync(join(dir, AGENT_SKILL_MARKER)));
+}
+
+/** Remove every skill folder failproofai wrote. Returns the folders removed. */
+export function removeAgentSkill(): string[] {
+  const removed: string[] = [];
+  for (const dir of installedAgentSkillDirs()) {
+    try {
+      rmSync(dir, { recursive: true, force: true });
+      removed.push(dir);
+    } catch (err) {
+      hookLogWarn(`the failproofai skill was not removed from ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return removed;
+}
diff --git a/src/hooks/configure-wizard.ts b/src/hooks/configure-wizard.ts
index c81cd655a..ccd486f8e 100644
--- a/src/hooks/configure-wizard.ts
+++ b/src/hooks/configure-wizard.ts
@@ -62,6 +62,7 @@ import {
 } from "./integrations";
 import { INTEGRATION_TYPES, type IntegrationType, type HookScope } from "./types";
 import { enforcingPolicyCount, installHooks, notEnforcingReason } from "./manager";
+import { installAgentSkill } from "./agent-skill";
 import {
   CODEX_UNTRUSTED_NOTICE,
   codexHookTrust,
@@ -1470,6 +1471,14 @@ export async function runConfigureWizard(
     cwd,
   );
 
+  // The failproofai skill, in every agent this machine has and any ticked
+  // without being detected — traced or not, an agent asked about FailproofAI
+  // should know it. A pointer to the skill online (see agent-skill.ts).
+  const withSkill = installAgentSkill(INTEGRATION_TYPES.filter((id) => plan.detected.has(id) || selected.includes(id)));
+  if (withSkill.length > 0) {
+    done.push(kit.ok(`Added the failproofai skill to ${withSkill.length} ${withSkill.length === 1 ? "agent" : "agents"}.`));
+  }
+
   // Agents traced again start fresh (see `requestFreshStart`). Only on a
   // rerun: its baseline is the selection the daemon actually filtered on. With
   // no saved list (upgrade, first) the daemon was collecting every agent, so an
diff --git a/src/hooks/uninstall-cli.ts b/src/hooks/uninstall-cli.ts
index 8d610026b..2296fdd8b 100644
--- a/src/hooks/uninstall-cli.ts
+++ b/src/hooks/uninstall-cli.ts
@@ -47,6 +47,7 @@ import {
 import { listInstallableIds, getIntegration } from "./integrations";
 import type { IntegrationType } from "./types";
 import { removeHooks } from "./manager";
+import { installedAgentSkillDirs, removeAgentSkill } from "./agent-skill";
 import { CODEX_MANAGED_BEGIN, CODEX_MANAGED_END, codexSystemConfigPath, codexSystemHooksPresent } from "./codex-system-hooks";
 import { optsFor, screenKit, type RenderOpts } from "./tui";
 
@@ -110,6 +111,8 @@ export interface UninstallResult {
 /** Everything this machine has that uninstalling would remove. */
 interface Leftovers {
   clis: IntegrationType[];
+  /** The failproofai skill folders `config` wrote into agents. */
+  skillDirs: string[];
   /** failproofai's block in Codex's system config, which only root can remove. */
   codexSystemPath: string | null;
   servicePath: string | null;
@@ -149,6 +152,7 @@ function survey(cwd?: string): Leftovers {
   const servicePath = isDaemonSupportedPlatform() ? daemonServiceFilePath() : null;
   return {
     clis,
+    skillDirs: installedAgentSkillDirs(),
     codexSystemPath: codexSystemHooksPresent() ? codexSystemConfigPath() : null,
     servicePath,
     serviceInstalled: !!servicePath && existsSync(servicePath),
@@ -166,7 +170,7 @@ export async function runUninstallCommand(opts: UninstallOptions = {}): Promise<
   const lines: string[] = [];
 
   const nothingToDo =
-    found.clis.length === 0 && !found.serviceInstalled && !found.daemonConfigured &&
+    found.clis.length === 0 && found.skillDirs.length === 0 && !found.serviceInstalled && !found.daemonConfigured &&
     !(opts.purge && found.homeExists);
   if (nothingToDo) {
     return {
@@ -191,6 +195,7 @@ export async function runUninstallCommand(opts: UninstallOptions = {}): Promise<
   const purging = Boolean(opts.purge && found.homeExists);
   const removals: string[] = [];
   if (found.clis.length > 0) removals.push(`failproofai's hooks from ${many(found.clis.length, "agent")}`);
+  if (found.skillDirs.length > 0) removals.push(`the failproofai skill from ${many(found.skillDirs.length, "agent folder")}`);
   if (found.serviceInstalled) removals.push("the failproofaid service (needs sudo)");
   if (purging) removals.push(home);
   const releasesDaemon = found.daemonConfigured && !found.serviceInstalled;
@@ -321,6 +326,12 @@ export async function runUninstallCommand(opts: UninstallOptions = {}): Promise<
     }
   }
 
+  if (found.skillDirs.length > 0) {
+    const left = found.skillDirs.length - removeAgentSkill().length;
+    if (left === 0) lines.push(kit.ok(`Removed the failproofai skill from ${many(found.skillDirs.length, "agent folder")}.`));
+    else failures.push(`Could not remove the failproofai skill from ${many(left, "agent folder")}:\n${installedAgentSkillDirs().join("\n")}`);
+  }
+
   if (found.serviceInstalled) {
     // Every run that gets here agreed to the whole plan, and the plan names the
     // service: `--yes` is yes to the plan, an interactive yes is the same answer

From aaf04f0f141a5fbe6b679b80043539a3d61f0fdb Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Fri, 23 Oct 2026 16:33:27 +0530
Subject: [PATCH 11/14] [config-account-login] Add the failproofai skill
 silently

Drop the "Added the failproofai skill to N agents." line from config's
summary; the summary stays about enforcement and the connection.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 __tests__/hooks/configure-wizard.test.ts | 3 ++-
 src/hooks/configure-wizard.ts            | 5 +----
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/__tests__/hooks/configure-wizard.test.ts b/__tests__/hooks/configure-wizard.test.ts
index bd80a3993..f98c19eee 100644
--- a/__tests__/hooks/configure-wizard.test.ts
+++ b/__tests__/hooks/configure-wizard.test.ts
@@ -701,7 +701,8 @@ describe("runConfigureWizard", () => {
     const io = ttyIO();
     await runConfigureWizard(io);
     expect(installAgentSkill).toHaveBeenCalledWith(["claude", "codex", "goose"]);
-    expect(printed(io.stdout)).toContain("Added the failproofai skill to 3 agents.");
+    // Silent: the summary is about enforcement and the connection.
+    expect(printed(io.stdout)).not.toContain("skill");
   });
 
   it("saves the selection, and what it saw", async () => {
diff --git a/src/hooks/configure-wizard.ts b/src/hooks/configure-wizard.ts
index ccd486f8e..cc1166255 100644
--- a/src/hooks/configure-wizard.ts
+++ b/src/hooks/configure-wizard.ts
@@ -1474,10 +1474,7 @@ export async function runConfigureWizard(
   // The failproofai skill, in every agent this machine has and any ticked
   // without being detected — traced or not, an agent asked about FailproofAI
   // should know it. A pointer to the skill online (see agent-skill.ts).
-  const withSkill = installAgentSkill(INTEGRATION_TYPES.filter((id) => plan.detected.has(id) || selected.includes(id)));
-  if (withSkill.length > 0) {
-    done.push(kit.ok(`Added the failproofai skill to ${withSkill.length} ${withSkill.length === 1 ? "agent" : "agents"}.`));
-  }
+  installAgentSkill(INTEGRATION_TYPES.filter((id) => plan.detected.has(id) || selected.includes(id)));
 
   // Agents traced again start fresh (see `requestFreshStart`). Only on a
   // rerun: its baseline is the selection the daemon actually filtered on. With

From 57908a56534aac6ec4c4c702c00a1eb65e9524ec Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Fri, 23 Oct 2026 16:53:31 +0530
Subject: [PATCH 12/14] [config-account-login] Don't give Codex the failproofai
 skill twice

Codex reads ~/.agents/skills as well as its own ~/.codex/skills and lists a
name found in both twice (0.164.0). `npx skills add FailproofAI/skills -g`
puts the full skill in ~/.agents/skills for Codex, so a machine with that and
`failproofai config` showed Codex two `failproofai` skills.

When ~/.agents/skills/failproofai exists, config now leaves Codex to it: it
writes no Codex copy, and removes one it wrote on an earlier run. Checked in
Docker against real Codex: npx then config lists it once; config then npx
lists it twice until config runs again, which takes ours back.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                        |  2 +-
 __tests__/hooks/agent-skill.test.ts | 21 +++++++++++++++++++++
 src/hooks/agent-skill.ts            | 24 +++++++++++++++++++++---
 3 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1751bcf6..0d89a4d0b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@ The stable release of logging in to FailproofAI Cloud from `config` in your brow
 
 ### Features
 
-- **Every agent on the machine knows FailproofAI.** `config` adds a small `failproofai` skill to each agent it finds (and any you tick), in that agent's own skills folder: Claude Code, Codex, Copilot, Cursor, OpenCode, Pi, every Hermes and OpenClaw profile, droid, Devin, Antigravity and Goose. It points the agent at the FailproofAI skills on GitHub, which it reads when a FailproofAI task comes up, so what it reads is always the current version with nothing to update. Each folder was checked against the agent itself. A `failproofai` skill you installed yourself (for example with `npx skills add FailproofAI/skills`) is left as it is, and `failproofai uninstall` removes only the ones `config` wrote (#920)
+- **Every agent on the machine knows FailproofAI.** `config` adds a small `failproofai` skill to each agent it finds (and any you tick), in that agent's own skills folder: Claude Code, Codex, Copilot, Cursor, OpenCode, Pi, every Hermes and OpenClaw profile, droid, Devin, Antigravity and Goose. It points the agent at the FailproofAI skills on GitHub, which it reads when a FailproofAI task comes up, so what it reads is always the current version with nothing to update. Each folder was checked against the agent itself. A `failproofai` skill you installed yourself (for example with `npx skills add FailproofAI/skills`) is left as it is, and Codex, which would list one in `~/.agents/skills` beside its own copy, is left to that one. `failproofai uninstall` removes only the ones `config` wrote (#920)
 
 ### Fixes
 
diff --git a/__tests__/hooks/agent-skill.test.ts b/__tests__/hooks/agent-skill.test.ts
index e24230763..ee8d8ff58 100644
--- a/__tests__/hooks/agent-skill.test.ts
+++ b/__tests__/hooks/agent-skill.test.ts
@@ -131,6 +131,27 @@ describe("installAgentSkill", () => {
     expect(readFileSync(skillFile(codex!), "utf8")).toBe("the full skill, from npx skills");
   });
 
+  it("leaves Codex to a failproofai skill in ~/.agents/skills, which Codex would list beside ours", () => {
+    const npx = join(home, ".agents", "skills", AGENT_SKILL_NAME);
+    mkdirSync(npx, { recursive: true });
+    writeFileSync(join(npx, "SKILL.md"), "the full skill, from npx skills -g");
+    process.env.CODEX_HOME = join(home, "moved-codex"); // ~/.agents stays under HOME regardless
+
+    expect(installAgentSkill(["codex", "claude"])).toEqual(["claude"]);
+    expect(existsSync(join(home, "moved-codex", "skills", AGENT_SKILL_NAME))).toBe(false);
+    expect(readFileSync(join(npx, "SKILL.md"), "utf8")).toBe("the full skill, from npx skills -g");
+  });
+
+  it("takes back its own Codex copy once ~/.agents/skills has one", () => {
+    const [codex] = agentSkillRoots("codex");
+    installAgentSkill(["codex"]);
+    expect(existsSync(skillFile(codex!))).toBe(true);
+    mkdirSync(join(home, ".agents", "skills", AGENT_SKILL_NAME), { recursive: true });
+
+    expect(installAgentSkill(["codex"])).toEqual([]);
+    expect(existsSync(join(codex!, AGENT_SKILL_NAME))).toBe(false);
+  });
+
   it("skips a folder it cannot write without failing the rest", () => {
     writeFileSync(join(home, ".codex"), "a file where the folder would go");
     expect(installAgentSkill(["codex", "claude"])).toEqual(["claude"]);
diff --git a/src/hooks/agent-skill.ts b/src/hooks/agent-skill.ts
index f58cb9206..b2593167d 100644
--- a/src/hooks/agent-skill.ts
+++ b/src/hooks/agent-skill.ts
@@ -124,18 +124,36 @@ export function agentSkillRoots(id: IntegrationType): string[] {
   }
 }
 
+/**
+ * Whether `id` already has a `failproofai` skill from a folder it also reads,
+ * and would list ours beside it rather than pick one. Only Codex: it reads
+ * `~/.agents/skills` (always under HOME, whatever CODEX_HOME says) as well as
+ * its own folder and lists a name found in both twice (0.164.0) — and that is
+ * where `npx skills add FailproofAI/skills -g` puts the full skill for it.
+ */
+function listedTwice(id: IntegrationType): boolean {
+  return id === "codex" && existsSync(join(homedir(), ".agents", "skills", AGENT_SKILL_NAME));
+}
+
 /**
  * Write the skill for each agent in `ids`. Never fails setup: an agent whose
- * folder cannot be written is logged and skipped. Returns the agents that have
- * it now.
+ * folder cannot be written is logged and skipped. Returns the agents it was
+ * written for.
  */
 export function installAgentSkill(ids: readonly IntegrationType[]): IntegrationType[] {
   const installed: IntegrationType[] = [];
   for (const id of ids) {
     let wrote = false;
+    const covered = listedTwice(id);
     for (const root of agentSkillRoots(id)) {
       const dir = join(root, AGENT_SKILL_NAME);
-      if (existsSync(dir) && !existsSync(join(dir, AGENT_SKILL_MARKER))) continue;
+      const ours = existsSync(join(dir, AGENT_SKILL_MARKER));
+      // Covered already: a copy of ours from an earlier run is now the duplicate.
+      if (covered) {
+        if (ours) rmSync(dir, { recursive: true, force: true });
+        continue;
+      }
+      if (existsSync(dir) && !ours) continue;
       try {
         // Marker first: a run interrupted before it would leave a folder every
         // later run takes for someone else's and skips.

From 25770c9496e4b54964d960254b465390ae5287cc Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Fri, 23 Oct 2026 17:37:32 +0530
Subject: [PATCH 13/14] [config-account-login] Never stop setup on removing an
 old Codex skill copy

Taking back our Codex copy (when ~/.agents/skills already serves Codex) called
rmSync outside any try, so a folder that could not be removed would throw out
of installAgentSkill and fail `config`, breaking its never-fails-setup
contract. Route it, and uninstall's removal, through one removeSkillDir that
logs and carries on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 __tests__/hooks/agent-skill.test.ts | 15 ++++++++++++++-
 src/hooks/agent-skill.ts            | 24 +++++++++++++-----------
 2 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/__tests__/hooks/agent-skill.test.ts b/__tests__/hooks/agent-skill.test.ts
index ee8d8ff58..0e13b26bc 100644
--- a/__tests__/hooks/agent-skill.test.ts
+++ b/__tests__/hooks/agent-skill.test.ts
@@ -1,6 +1,6 @@
 // @vitest-environment node
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, relative } from "node:path";
 import {
@@ -152,6 +152,19 @@ describe("installAgentSkill", () => {
     expect(existsSync(join(codex!, AGENT_SKILL_NAME))).toBe(false);
   });
 
+  it("carries on when its old Codex copy can't be taken back", () => {
+    const [codex] = agentSkillRoots("codex");
+    installAgentSkill(["codex"]);
+    mkdirSync(join(home, ".agents", "skills", AGENT_SKILL_NAME), { recursive: true });
+    chmodSync(codex!, 0o555); // the copy inside can't be deleted (except by root)
+    try {
+      expect(() => installAgentSkill(["codex", "claude"])).not.toThrow();
+      expect(existsSync(skillFile(agentSkillRoots("claude")[0]!))).toBe(true);
+    } finally {
+      chmodSync(codex!, 0o755);
+    }
+  });
+
   it("skips a folder it cannot write without failing the rest", () => {
     writeFileSync(join(home, ".codex"), "a file where the folder would go");
     expect(installAgentSkill(["codex", "claude"])).toEqual(["claude"]);
diff --git a/src/hooks/agent-skill.ts b/src/hooks/agent-skill.ts
index b2593167d..5a0fe3ef6 100644
--- a/src/hooks/agent-skill.ts
+++ b/src/hooks/agent-skill.ts
@@ -150,7 +150,7 @@ export function installAgentSkill(ids: readonly IntegrationType[]): IntegrationT
       const ours = existsSync(join(dir, AGENT_SKILL_MARKER));
       // Covered already: a copy of ours from an earlier run is now the duplicate.
       if (covered) {
-        if (ours) rmSync(dir, { recursive: true, force: true });
+        if (ours) removeSkillDir(dir);
         continue;
       }
       if (existsSync(dir) && !ours) continue;
@@ -176,16 +176,18 @@ export function installedAgentSkillDirs(): string[] {
   return [...new Set(dirs)].filter((dir) => existsSync(join(dir, AGENT_SKILL_MARKER)));
 }
 
+/** Remove one skill folder; never throws, so neither setup nor uninstall stops on it. */
+function removeSkillDir(dir: string): boolean {
+  try {
+    rmSync(dir, { recursive: true, force: true });
+    return true;
+  } catch (err) {
+    hookLogWarn(`the failproofai skill was not removed from ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+    return false;
+  }
+}
+
 /** Remove every skill folder failproofai wrote. Returns the folders removed. */
 export function removeAgentSkill(): string[] {
-  const removed: string[] = [];
-  for (const dir of installedAgentSkillDirs()) {
-    try {
-      rmSync(dir, { recursive: true, force: true });
-      removed.push(dir);
-    } catch (err) {
-      hookLogWarn(`the failproofai skill was not removed from ${dir}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  return removed;
+  return installedAgentSkillDirs().filter(removeSkillDir);
 }

From e435882e205cf16ec3ec45a173d231e4e240077a Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Fri, 23 Oct 2026 17:54:25 +0530
Subject: [PATCH 14/14] [config-account-login] Report the kept connection when
 a new login's key can't be used

Logging in again on a connected machine, with the key claimed but refused
on both streams, made connectToCloud write nothing, so the previous
connection stayed on disk and working. `keptOld` tested `!token`, though, so
the summary and configure_applied reported the machine as open source.
Test `!connected` instead. A refused saved key still counts as kept (mode
cloud, decision D4), with its own message. (CodeRabbit)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                             |  1 +
 __tests__/hooks/configure-wizard.test.ts | 25 ++++++++++++++++++++++++
 src/hooks/configure-wizard.ts            | 11 ++++++-----
 3 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0d89a4d0b..24cc6c4af 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ The stable release of logging in to FailproofAI Cloud from `config` in your brow
 ### Fixes
 
 - `config` on a machine with no saved connection, whose browser login was approved but whose key could not be claimed, no longer says "This machine keeps its previous connection." and reports cloud mode with no key on disk; it finishes set up as open source (#920)
+- `config`, logging in again on a connected machine where the new key is created but can't be used, says the machine keeps its previous connection (which it does: nothing was written) instead of finishing as if it were open source (#920)
 - `config` on a machine whose saved key was refused, when logging in again creates no key, says the kept connection's key no longer works and to run `config` again, instead of reporting the old connection as if it were fine (#920)
 - `config` no longer sends the saved key to a saved cloud address it would refuse if typed (plain `http://` to another host) when checking that key (#920)
 - `config`'s browser login takes an expired or refused link off the screen when it prints a new one, so only the live link can be opened; and a cloud that answers the login route with a web page is treated as one without browser login (paste a key) instead of an error (#920)
diff --git a/__tests__/hooks/configure-wizard.test.ts b/__tests__/hooks/configure-wizard.test.ts
index f98c19eee..a883664b3 100644
--- a/__tests__/hooks/configure-wizard.test.ts
+++ b/__tests__/hooks/configure-wizard.test.ts
@@ -1675,6 +1675,31 @@ describe("browser login", () => {
     expect(printed(io.stdout)).not.toContain("no longer works");
   });
 
+  it("keeps reporting the previous connection when the new key is created but can't be used", async () => {
+    writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
+    connectPick = "login";
+    vi.mocked(claimLogin).mockResolvedValueOnce({
+      kind: "ok",
+      key: "k".repeat(64),
+      keyName: "failproofai · box",
+      org: { slug: "acme", name: "Acme" },
+      permissions: ["events:add", "policies:pull"],
+    } as never);
+    // Refused on both streams: connectToCloud writes nothing, so the saved key stays.
+    vi.mocked(connectToCloud).mockResolvedValueOnce({
+      policy: { ok: false, reason: "refused" },
+      ingest: { ok: false, reason: "refused" },
+      anyConfigured: false,
+    } as never);
+    const io = ttyIO();
+    const result = await runConfigureWizard(io);
+    expect(result).toMatchObject({ applied: true, connected: false, mode: "cloud" });
+    expect(printed(io.stdout)).toContain("This machine keeps its previous connection.");
+    expect(printed(io.stdout)).toContain('The key "failproofai · box" was created but isn\'t in use here; revoke it');
+    const props = vi.mocked(trackHookEvent).mock.calls.find((call) => call[1] === "configure_applied")![2];
+    expect(props).toMatchObject({ connected: false, mode: "cloud" });
+  });
+
   it("does not report a refused saved key as a working connection when the new login creates no key", async () => {
     writeIngestCredential({ url: "https://app.befailproof.ai/v1/events", key: "saved-key-3f2a" });
     vi.mocked(validateIngestKey).mockResolvedValueOnce({ ok: false, reason: "the server rejected that key (401)" });
diff --git a/src/hooks/configure-wizard.ts b/src/hooks/configure-wizard.ts
index cc1166255..5c01de189 100644
--- a/src/hooks/configure-wizard.ts
+++ b/src/hooks/configure-wizard.ts
@@ -1563,11 +1563,12 @@ export async function runConfigureWizard(
     updateConfig({ mode: "cloud" });
   }
 
-  // Logging in again on a connected machine, with no key at the end of it,
-  // changed nothing about the connection: the previous one is still there
-  // (never removed from this step, decision D4) — but not as if it worked when
-  // its key was refused.
-  const keptOld = cloud.kind === "login" && !token && Boolean(saved);
+  // Logging in again on a connected machine, with nothing connected at the end
+  // of it — no key, or a key `connectToCloud` could not use, which writes
+  // nothing — changed nothing about the connection: the previous one is still
+  // there (never removed from this step, decision D4) — but not as if it worked
+  // when its key was refused.
+  const keptOld = cloud.kind === "login" && !connected && Boolean(saved);
   if (keptOld) {
     done.push(
       savedRefused