diff --git a/CHANGELOG.md b/CHANGELOG.md
index d79aa292b..0837b30c4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 ## 1.0.14-beta.0 — 2026-11-02
 
+### Features
+
+- `fp login` can sign you in from a browser, as `failproofai config` does: on a terminal it starts on a link, Tab switches to a code by email, and either way you get your own session. New deliberate-run harness: `__tests__/e2e/layout/fp-login.sh`. (#981)
+
 ### Docs
 
 - Add public pages for the MCP server, the Slack app and product analytics, which the assistant and MCP server can now answer from (#982).
diff --git a/__tests__/e2e/layout/README.md b/__tests__/e2e/layout/README.md
index 360a7d180..0c95e1586 100644
--- a/__tests__/e2e/layout/README.md
+++ b/__tests__/e2e/layout/README.md
@@ -10,6 +10,7 @@ not depend on — so they are invoked deliberately.
 | `cloud-collector.sh` | an AgentEye stack | real connect against a live server, daemon + collector writing layout-2 paths, decisions reaching ClickHouse, disconnect back to OSS |
 | `systemd-service.sh` | Docker | REAL `systemctl enable --now` as root in a privileged container: service lifecycle, fail-closed, self-heal, reinstall |
 | `cli-login.sh` | an AgentEye stack (dashboard + mailpit + its Postgres), an older Cloud server without `/api/auth/cli/*` routes, Docker, `bun run build` + the release daemon | `config`'s browser login through a real pty in a systemd container: approve, re-login, deny + retry, abandon after approval (no key minted), esc, expiry, revoked saved key, older server, and the person-side refusals (Origin, form posts, no session, start rate limit) |
+| `fp-login.sh` | an AgentEye stack (dashboard + mailpit + its containers), `uv sync` in `fp-cloud-cli`; optionally a Cloud with `config`'s login but not `fp`'s, and a dashboard with `DASHBOARD_TRUSTED_INGRESS=1` | `fp login`'s browser flow through a real pty: approve, the org picker, the email code with tab, tab to the email and back, deny + retry, expiry, esc and ctrl-c, an approval nobody collects (no session), a dropped connection, opening the browser, Clouds without it (nothing minted), the network warning and when the email goes out, the person-side refusals, and no secret in any log |
 
 `systemd-service.sh` exists because the service half cannot be tested on a
 developer machine without a password prompt, and a container gives real systemd
@@ -38,6 +39,13 @@ bash __tests__/e2e/layout/systemd-service.sh
 DASH=http://localhost:3000 MAILPIT=http://localhost:8026 OLD_CLOUD=http://localhost:28080 PG_CONTAINER=agenteye-postgres-1 \
   bash __tests__/e2e/layout/cli-login.sh
 
+# fp-login.sh drives the real `fp` the same way. STACK is the compose project, which
+# names the containers it reads. Add CLOUD_1090 and PG_1090 to cover a Cloud from
+# before `fp`'s half of this, and TRUSTED_DASH for the different-network warning. It
+# stops and restarts the dashboard container once.
+DASH=http://127.0.0.1:3000 MAILPIT=http://127.0.0.1:8026 STACK=agenteye \
+  bash __tests__/e2e/layout/fp-login.sh
+
 # cloud-collector.sh expects the stack on the remapped ports (18080/18123) so it
 # can run alongside an existing project rather than displacing it:
 docker compose -p aefpai -f docker-compose.yml -f ports.yml up -d
diff --git a/__tests__/e2e/layout/cli-login-driver.py b/__tests__/e2e/layout/cli-login-driver.py
index 45a465918..e64f8c9f0 100755
--- a/__tests__/e2e/layout/cli-login-driver.py
+++ b/__tests__/e2e/layout/cli-login-driver.py
@@ -1,16 +1,18 @@
 #!/usr/bin/env python3
-"""Drive `failproofai config` through a real pseudo-terminal, screen by screen.
+"""Drive a login through a real pseudo-terminal, screen by screen.
 
-Used by cli-login.sh, inside the systemd container, as the unprivileged user.
-The wizard only offers browser login to a real terminal, so a pty is the only
-honest way to test it end to end.
+Used by cli-login.sh for `failproofai config` (inside the systemd container, as the
+unprivileged user) and by fp-login.sh for `fp login`. Both only offer browser login
+to a real terminal, so a pty is the only honest way to test it end to end.
 
 Usage: cli-login-driver.py <script> <transcript-file> <url-file> -- <command...>
 
 <script> is a comma-separated list of steps, each `wait:<text>` (block until
 the screen shows <text>), `key:<name>` (enter, down, up, esc, ctrl-c, tab),
-`url` (wait for the authorize link and write it to <url-file>), or
-`sleep:<seconds>`. Exit status is the command's own, or 124 on a timeout.
+`url` (wait for the authorize link and write it to <url-file>), `sleep:<seconds>`,
+`type:<text>`, or `typefile:<path>` (wait for that file, then type what it holds:
+for a value the script only learns later, like an emailed code). Exit status is
+the command's own, or 124 on a timeout.
 """
 import os
 import pty
@@ -83,6 +85,20 @@ def plain() -> str:
         elif kind == "key":
             time.sleep(0.3)  # let the screen settle so the key lands on it
             os.write(fd, KEYS[arg])
+        elif kind == "type":
+            time.sleep(0.3)
+            os.write(fd, arg.encode())
+        elif kind == "typefile":
+            # Not just "exists": the shell creates the file before it writes to it.
+            data = b""
+            while not data:
+                if os.path.exists(arg):
+                    with open(arg, "rb") as f:
+                        data = f.read().strip()
+                if not data and (time.time() > deadline or not pump(0.2)):
+                    print(f"driver: {arg} never appeared", file=sys.stderr)
+                    return 124
+            os.write(fd, data)
         elif kind == "sleep":
             end = time.time() + float(arg)
             while time.time() < end:
diff --git a/__tests__/e2e/layout/cli-login.sh b/__tests__/e2e/layout/cli-login.sh
index fd477fd35..f31657d2e 100755
--- a/__tests__/e2e/layout/cli-login.sh
+++ b/__tests__/e2e/layout/cli-login.sh
@@ -39,8 +39,10 @@ OUT=$(mktemp -d)
 PASS=0; FAIL=0
 ok()  { PASS=$((PASS+1)); printf '  \033[32mPASS\033[0m %s\n' "$1"; }
 bad() { FAIL=$((FAIL+1)); printf '  \033[31mFAIL\033[0m %s\n       %s\n' "$1" "${2:-}"; }
-has()   { if printf '%s' "$2" | grep -qF -- "$3"; then ok "$1"; else bad "$1" "missing [$3] in: $(printf '%s' "$2" | tr '\n' ' ' | tail -c 400)"; fi; }
-hasnt() { if printf '%s' "$2" | grep -qF -- "$3"; then bad "$1" "unexpected [$3]"; else ok "$1"; fi; }
+# Not `printf | grep -q`: on input bigger than a pipe buffer grep exits at the first match,
+# printf dies of SIGPIPE, and under pipefail a found string reads as a missing one.
+has()   { if [[ "$2" == *"$3"* ]]; then ok "$1"; else bad "$1" "missing [$3] in: $(printf '%s' "$2" | tr '\n' ' ' | tail -c 400)"; fi; }
+hasnt() { if [[ "$2" == *"$3"* ]]; then bad "$1" "unexpected [$3]"; else ok "$1"; fi; }
 eq()    { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1" "want [$3] got [$2]"; fi; }
 head1() { printf '\n\033[1m── %s\033[0m\n' "$1"; }
 jqp() { python3 -c "import sys,json;d=json.load(sys.stdin);print(eval('d'+sys.argv[1]))" "$1" 2>/dev/null; }
diff --git a/__tests__/e2e/layout/fp-login.sh b/__tests__/e2e/layout/fp-login.sh
new file mode 100755
index 000000000..a0dd55a93
--- /dev/null
+++ b/__tests__/e2e/layout/fp-login.sh
@@ -0,0 +1,720 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# `fp login` from a browser, end to end, for real.
+#
+# The real `fp` runs in a real pseudo-terminal (cli-login-driver.py). A person's
+# half — signing in, approving, denying — happens through the real AgentEye
+# dashboard API, with sign-in codes read out of mailpit. Then it checks what
+# landed: the saved session, that it works, what the server recorded, and which
+# emails went out. Nothing is mocked except a stand-in for a Cloud older than any
+# of this, which only has to answer 404.
+#
+# Needs, all local:
+#   - an AgentEye stack: dashboard on $DASH, mailpit API on $MAILPIT, and its
+#     containers reachable through `docker exec` / `docker logs`
+#   - fp-cloud-cli synced (`uv sync --locked --extra dev`), or FP=<path to fp>
+#   - optionally a Cloud with `failproofai config`'s login but not `fp`'s, on
+#     $CLOUD_1090 with its Postgres in $PG_1090. Skipped when unset.
+#   - optionally the same dashboard image with DASHBOARD_TRUSTED_INGRESS=1 on
+#     $TRUSTED_DASH, for the different-network warning. This script plays the ingress
+#     by setting the header itself. Skipped when unset.
+#
+# Not part of `bun run test:e2e`: like the other harnesses here, it is run
+# deliberately (see README.md in this directory). It stops and restarts the
+# dashboard container once, to test a dropped connection.
+#
+#   DASH=http://127.0.0.1:43000 MAILPIT=http://127.0.0.1:48026 \
+#     STACK=agenteye-fp-login bash __tests__/e2e/layout/fp-login.sh
+# ─────────────────────────────────────────────────────────────────────────────
+set -uo pipefail
+
+R="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+DASH=${DASH:-http://127.0.0.1:3000}
+MAILPIT=${MAILPIT:-http://127.0.0.1:8026}
+STACK=${STACK:-agenteye}
+PG_CONTAINER=${PG_CONTAINER:-$STACK-postgres-1}
+SERVER_CONTAINER=${SERVER_CONTAINER:-$STACK-server-1}
+DASH_CONTAINER=${DASH_CONTAINER:-$STACK-dashboard-1}
+REDIS_CONTAINER=${REDIS_CONTAINER:-$STACK-redis-1}
+FP=${FP:-$R/fp-cloud-cli/.venv/bin/fp}
+CLOUD_1090=${CLOUD_1090:-}
+PG_1090=${PG_1090:-}
+TRUSTED_DASH=${TRUSTED_DASH:-}
+PERSON_DASH=$DASH  # which dashboard a person's calls go to
+KEEP=${KEEP:-0}  # 1 = leave the temp dir behind, for reading transcripts
+STAMP=$(date +%s)
+OUT=$(mktemp -d)
+FP_DIR="$OUT/fp-home"
+STUB_PID=""
+HELD_PID=""
+DASH_STOPPED=0
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  \033[32mPASS\033[0m %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  \033[31mFAIL\033[0m %s\n       %s\n' "$1" "${2:-}"; }
+# Not `printf | grep -q`: on input bigger than a pipe buffer grep exits at the first match,
+# printf dies of SIGPIPE, and under pipefail a found string reads as a missing one.
+has()   { if [[ "$2" == *"$3"* ]]; then ok "$1"; else bad "$1" "missing [$3] in: $(printf '%s' "$2" | tr '\n' ' ' | tail -c 400)"; fi; }
+hasnt() { if [[ "$2" == *"$3"* ]]; then bad "$1" "unexpected [$3]"; else ok "$1"; fi; }
+eq()    { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1" "want [$3] got [$2]"; fi; }
+head1() { printf '\n\033[1m── %s\033[0m\n' "$1"; }
+jqp() { python3 -c "import sys,json;d=json.load(sys.stdin);print(eval('d'+sys.argv[1]))" "$1" 2>/dev/null; }
+sql() { docker exec "$PG_CONTAINER" psql -U postgres -d agenteye -tAc "$1"; }
+
+cleanup() {
+  [ -n "$STUB_PID" ] && kill "$STUB_PID" 2>/dev/null
+  [ -n "$HELD_PID" ] && kill "$HELD_PID" 2>/dev/null
+  # An interrupted run must not leave someone's stack without its dashboard.
+  [ "$DASH_STOPPED" = 1 ] && docker start "$DASH_CONTAINER" >/dev/null 2>&1
+  if [ "$KEEP" = 1 ]; then echo "kept: $OUT"; else rm -rf "$OUT"; fi
+}
+trap cleanup EXIT
+
+# ── A person, through the dashboard ──────────────────────────────────────────
+
+otp_code() { # <email> -> the code from the newest sign-in email
+  local email=$1 id="" _
+  for _ in $(seq 1 40); do
+    id=$(curl -s "$MAILPIT/api/v1/search?query=to:$email&limit=1" | jqp '["messages"][0]["ID"]')
+    [ -n "$id" ] && break
+    sleep 0.5
+  done
+  # The CLI's email spaces its digits out; the browser's does not.
+  curl -s "$MAILPIT/api/v1/message/$id" | python3 -c 'import sys,json,re;print(re.search(r"\b(\d(?: ?\d){5})\b",json.load(sys.stdin)["Text"]).group(1).replace(" ",""))'
+}
+
+# Starts are limited to 10 a minute per address, and with nothing in front of the
+# dashboard every local caller is one address. This script starts far more than that.
+unthrottle() {
+  docker exec "$REDIS_CONTAINER" sh -c "redis-cli --scan --pattern 'ratelimit:cli_login_start:*' | xargs -r redis-cli del; redis-cli --scan --pattern 'ratelimit:cli_login:decide:*' | xargs -r redis-cli del" >/dev/null
+}
+
+sign_in() { # <email> -> its session, through the real email-code flow
+  local email=$1 code
+  curl -s -X DELETE "$MAILPIT/api/v1/search?query=to:$email" >/dev/null || true
+  curl -s -X POST "$DASH/api/auth/otp/request" -H 'content-type: application/json' -d "{\"email\":\"$email\"}" >/dev/null
+  code=$(otp_code "$email")
+  curl -s -D - -o /dev/null -X POST "$DASH/api/auth/otp/verify" -H 'content-type: application/json' \
+    -d "{\"email\":\"$email\",\"code\":\"$code\"}" | tr -d '\r' | sed -n 's/^[Ss]et-[Cc]ookie: ae_session=\([^;]*\).*/\1/p'
+}
+
+person() { # <session> <action> <json> [address] -> body; status in $OUT/status
+  local xff=()
+  [ -n "${4:-}" ] && xff=(-H "x-forwarded-for: $4")
+  curl -s -o "$OUT/body" -w '%{http_code}' -X POST "$PERSON_DASH/api/auth/cli/$2" -b "ae_session=$1" \
+    "${xff[@]}" -H "origin: $PERSON_DASH" -H 'content-type: application/json' -d "$3" > "$OUT/status"
+  cat "$OUT/body"
+}
+
+new_org() { # <session> <slug>
+  curl -s -X POST "$DASH/api/orgs" -b "ae_session=$1" -H 'content-type: application/json' \
+    -d "{\"slug\":\"$2\",\"name\":\"$2\"}" | jqp '["id"]'
+}
+
+link_token() { python3 -c 'import sys,urllib.parse as u;print(u.parse_qs(u.urlparse(sys.argv[1]).query)["r"][0])' "$1"; }
+sessions_of() { sql "select count(*) from sessions where user_id = (select id from users where email = '$1')"; }
+request_status() { sql "select status from cli_login_requests where link_token_hash = encode(sha256('$1'::bytea), 'hex')"; }
+sign_in_mails() { # <email> -> how many sign-in alerts it received
+  curl -s -G "$MAILPIT/api/v1/search" --data-urlencode "query=to:$1 subject:\"new sign-in\"" | jqp '["messages_count"]'
+}
+wait_sign_in_mail() { for _ in $(seq 1 30); do [ "$(sign_in_mails "$1")" != 0 ] && return; sleep 0.5; done; }
+sign_in_mail_text() {
+  local id
+  id=$(curl -s -G "$MAILPIT/api/v1/search" --data-urlencode "query=to:$1 subject:\"new sign-in\"" | jqp '["messages"][0]["ID"]')
+  curl -s "$MAILPIT/api/v1/message/$id" | jqp '["Text"]'
+}
+
+# ── The terminal ─────────────────────────────────────────────────────────────
+
+# Run `fp` under the pty driver in the background. No display and an SSH marker by
+# default, so nothing here ever opens a browser on the machine running it.
+# <name> <script> <base-url> [env assignments...] -- <fp args...>
+run_fp() {
+  local name=$1 script=$2 base=$3; shift 3
+  local extra=()
+  while [ "$#" -gt 0 ] && [ "$1" != "--" ]; do extra+=("$1"); shift; done
+  shift
+  rm -f "$OUT/$name".*
+  unthrottle
+  ( env -u DISPLAY -u WAYLAND_DISPLAY -u SSH_CONNECTION -u SSH_CLIENT -u FP_TOKEN -u FP_API_KEY -u FP_ORG \
+      -u FP_DASHBOARD_URL -u FAILPROOFAI_HOME \
+      SSH_TTY=e2e TERM=xterm-256color NO_COLOR=1 FP_ANALYTICS_DISABLED=1 FP_HOME="$FP_DIR" "${extra[@]}" \
+      python3 "$R/__tests__/e2e/layout/cli-login-driver.py" "$script" "$OUT/$name.log" "$OUT/$name.url" \
+      -- "$FP" --base-url "$base" "$@" ; echo $? > "$OUT/$name.rc" ) 2>"$OUT/$name.err" &
+}
+
+wait_url() { # <name> -> the link fp printed
+  local _
+  for _ in $(seq 1 120); do
+    if [ -s "$OUT/$1.url" ]; then cat "$OUT/$1.url"; rm -f "$OUT/$1.url"; return; fi
+    sleep 0.25
+  done
+}
+
+wait_done() { # <name> -> transcript with the terminal codes taken out
+  local _
+  for _ in $(seq 1 480); do [ -f "$OUT/$1.rc" ] && break; sleep 0.25; done
+  transcript "$1"
+}
+transcript() { sed 's/\x1b\[[0-9;?]*[A-Za-z]//g' "$OUT/$1.log" 2>/dev/null | tr -d '\r'; }
+
+fp_plain() { # <base-url> <fp args...>, no terminal
+  local base=$1; shift
+  env -u FP_TOKEN -u FP_API_KEY -u FP_ORG -u FP_DASHBOARD_URL -u FAILPROOFAI_HOME \
+    NO_COLOR=1 FP_ANALYTICS_DISABLED=1 FP_HOME="$FP_DIR" "$FP" --base-url "$base" "$@"
+}
+
+saved() { python3 -c "import json;print(json.load(open('$FP_DIR/cli-auth.json')).get('$1') or '')" 2>/dev/null; }
+reset_fp() { rm -rf "$FP_DIR"; }
+
+EMAIL_STEP=wait:tab\ SSO
+TO_EMAIL=wait:waiting\ for\ you,key:tab,$EMAIL_STEP
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 0 — preconditions"
+curl -s -m 5 -o /dev/null "$DASH/login" && ok "dashboard is up on $DASH" || bad "dashboard is up" "$DASH/login"
+curl -s -m 5 -o /dev/null "$MAILPIT/api/v1/messages" && ok "mailpit is up on $MAILPIT" || bad "mailpit is up" "$MAILPIT"
+[ -n "$(sql 'select 1' 2>/dev/null)" ] && ok "Postgres reachable via $PG_CONTAINER" || bad "Postgres reachable" "$PG_CONTAINER"
+[ -x "$FP" ] && ok "fp is built" || bad "fp is built" "cd fp-cloud-cli && uv sync --locked --extra dev"
+[ "$FAIL" = 0 ] || { echo "preconditions failed"; exit 1; }
+
+ONE="fp-one-$STAMP@example.test"
+ONE_SESSION=$(sign_in "$ONE")
+[ -n "$(new_org "$ONE_SESSION" "fp-one-$STAMP")" ] && ok "a person with one org" || bad "a person with one org" "no org"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 1 — browser login: the link, the approval, and the terminal finishes alone"
+run_fp first "url" "$DASH" -- login
+URL=$(wait_url first)
+has "fp printed the authorize link" "$URL" "$DASH/cli/authorize?r="
+LINK=$(link_token "$URL")
+PAGE=$(person "$ONE_SESSION" lookup "{\"link_token\":\"$LINK\"}")
+eq "the page sees a pending request" "$(echo "$PAGE" | jqp '["status"]')" "pending"
+eq "…of the session kind" "$(echo "$PAGE" | jqp '["kind"]')" "session"
+eq "…for this machine" "$(echo "$PAGE" | jqp '["machine"]["label"]')" "$(hostname)"
+eq "…offering no org to pick" "$(echo "$PAGE" | jqp '["orgs"]')" "[]"
+BEFORE=$(sessions_of "$ONE")
+sleep 3
+eq "nothing is created while it waits" "$(sessions_of "$ONE")" "$BEFORE"
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+eq "approve answered 200" "$(cat "$OUT/status")" "200"
+T=$(wait_done first)
+eq "fp exited 0" "$(cat "$OUT/first.rc")" "0"
+has "it starts on the link, offering the email" "$T" "tab use email"
+hasnt "…without asking for an email first" "$T" "send a code"
+has "no display here, so it says the link works anywhere" "$T" "open this link on any device"
+has "it waited with a countdown" "$T" "waiting for you to authorize"
+has "it says it signed in" "$T" "signed in"
+has "…as the person who approved" "$T" "$ONE"
+# In the raw bytes: the window is 100 wide, the link wider, and nothing but the terminal may
+# wrap it. A line break from Rich would break it for a click or a copy, and so would writing it
+# again with the spinner, which clears a selection.
+LINE=$(grep -caP '^(\r|\x1b\[[0-9;?]*[A-Za-z])*( {2})?(\x1b\[[0-9;]*m)?https?://\S+/cli/authorize\?r=[0-9a-f]{64}(\x1b\[[0-9;]*m)?\r?$' "$OUT/first.log")
+eq "the link is one unbroken run on its own line, right under the box" "$LINE" "1"
+eq "…written once, not again with the spinner" "$(grep -ao 'cli/authorize?r=' "$OUT/first.log" | wc -l)" "1"
+eq "one more session on the server" "$(sessions_of "$ONE")" "$((BEFORE + 1))"
+eq "the request is spent" "$(request_status "$LINK")" "claimed"
+eq "no machine key came of it" "$(sql "select count(*) from api_keys where created_by_user_id = (select id from users where email = '$ONE')")" "0"
+TOKEN=$(saved session_token)
+[ -n "$TOKEN" ] && ok "the session was saved" || bad "the session was saved" "cli-auth.json"
+eq "saved owner-only" "$(stat -c '%a' "$FP_DIR/cli-auth.json")" "600"
+eq "saved the org it auto-picked" "$(saved org)" "fp-one-$STAMP"
+hasnt "the token never appears in the terminal" "$T" "$TOKEN"
+WHO=$(fp_plain "$DASH" --json whoami)
+eq "the saved session works" "$(echo "$WHO" | jqp '["email"]')" "$ONE"
+eq "…as a person, not a key" "$(echo "$WHO" | jqp '["auth_mode"]')" "session"
+ORGS=$(fp_plain "$DASH" --json orgs list 2>&1)
+has "a command an API key is refused works" "$ORGS" "fp-one-$STAMP"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 2 — signed in already: no asking; --force asks again"
+run_fp again "wait:$ONE" "$DASH" -- login
+T=$(wait_done again)
+eq "fp exited 0" "$(cat "$OUT/again.rc")" "0"
+hasnt "no asking someone already signed in" "$T" "tab use email"
+run_fp force "wait:waiting for you,key:esc" "$DASH" -- login --force
+T=$(wait_done force)
+eq "--force asks, and esc leaves it" "$(cat "$OUT/force.rc")" "0"
+has "…saying nothing changed" "$T" "cancelled"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 3 — several orgs: picked in the terminal, or by --org"
+TWO="fp-two-$STAMP@example.test"
+TWO_SESSION=$(sign_in "$TWO")
+new_org "$TWO_SESSION" "fp-a-$STAMP" >/dev/null
+new_org "$TWO_SESSION" "fp-b-$STAMP" >/dev/null
+reset_fp
+run_fp pick "url,wait:choose your org,key:down,key:enter" "$DASH" -- login
+LINK=$(link_token "$(wait_url pick)")
+person "$TWO_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+T=$(wait_done pick)
+eq "fp exited 0" "$(cat "$OUT/pick.rc")" "0"
+PICKED=$(saved org)
+[ "$PICKED" = "fp-a-$STAMP" ] || [ "$PICKED" = "fp-b-$STAMP" ] && ok "the org picked in the terminal was saved" || bad "the org was saved" "$PICKED"
+reset_fp
+run_fp flag "url" "$DASH" -- login --org "fp-b-$STAMP"
+LINK=$(link_token "$(wait_url flag)")
+person "$TWO_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+T=$(wait_done flag)
+eq "--org skips the picker" "$(saved org)" "fp-b-$STAMP"
+hasnt "…no picker shown" "$T" "choose your org"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 4 — the email code still works, with tab and with --email"
+reset_fp
+MAILED="fp-mail-$STAMP@example.test"
+curl -s -X DELETE "$MAILPIT/api/v1/search?query=to:$MAILED" >/dev/null || true
+rm -f "$OUT/code"
+run_fp menu_mail "$TO_EMAIL,type:$MAILED,key:enter,wait:enter the 6-digit code,typefile:$OUT/code,key:enter" "$DASH" -- login
+CODE=$(otp_code "$MAILED"); echo "$CODE" > "$OUT/code"
+T=$(wait_done menu_mail)
+eq "fp exited 0" "$(cat "$OUT/menu_mail.rc")" "0"
+eq "the emailed code signed in" "$(saved email)" "$MAILED"
+has "…after starting on the link" "$T" "/cli/authorize"
+eq "the email code path sends no sign-in alert" "$(sign_in_mails "$MAILED")" "0"
+reset_fp
+curl -s -X DELETE "$MAILPIT/api/v1/search?query=to:$MAILED" >/dev/null || true
+rm -f "$OUT/code"
+run_fp flag_mail "wait:enter the 6-digit code,typefile:$OUT/code,key:enter" "$DASH" -- login --email "$MAILED"
+CODE=$(otp_code "$MAILED"); echo "$CODE" > "$OUT/code"
+T=$(wait_done flag_mail)
+eq "--email signed in" "$(saved email)" "$MAILED"
+hasnt "--email skips the asking" "$T" "tab SSO"
+hasnt "…and never asks for a link" "$T" "/cli/authorize"
+reset_fp
+OUTPUT=$(env -u FP_TOKEN -u FP_API_KEY NO_COLOR=1 FP_ANALYTICS_DISABLED=1 FP_HOME="$FP_DIR" "$FP" --base-url "$DASH" login </dev/null 2>&1)
+hasnt "no terminal: no offer of a browser" "$OUTPUT" "tab SSO"
+hasnt "no terminal: no link" "$OUTPUT" "/cli/authorize"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 5 — not authorized: enter for a new link, tab back to the email, esc to leave"
+reset_fp
+run_fp deny "url,wait:not authorized,key:enter,url" "$DASH" -- login
+LINK1=$(link_token "$(wait_url deny)")
+person "$ONE_SESSION" deny "{\"link_token\":\"$LINK1\"}" >/dev/null
+eq "deny answered 200" "$(cat "$OUT/status")" "200"
+LINK2=$(link_token "$(wait_url deny)")
+[ -n "$LINK2" ] && [ "$LINK1" != "$LINK2" ] && ok "enter fetched a NEW link" || bad "enter fetched a new link" "$LINK2"
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK2\"}" >/dev/null
+T=$(wait_done deny)
+eq "fp exited 0 on the new link" "$(cat "$OUT/deny.rc")" "0"
+eq "signed in" "$(saved email)" "$ONE"
+eq "the denied request stays denied" "$(request_status "$LINK1")" "denied"
+reset_fp
+BEFORE=$(sessions_of "$ONE")
+run_fp back "url,wait:not authorized,key:tab,$EMAIL_STEP,key:esc" "$DASH" -- login
+LINK=$(link_token "$(wait_url back)")
+person "$ONE_SESSION" deny "{\"link_token\":\"$LINK\"}" >/dev/null
+T=$(wait_done back)
+eq "tab went back to the email, and esc left" "$(cat "$OUT/back.rc")" "0"
+has "…calmly" "$T" "cancelled"
+eq "…with nothing saved" "$(saved session_token)" ""
+reset_fp
+run_fp leave "url,wait:not authorized,key:esc" "$DASH" -- login
+LINK=$(link_token "$(wait_url leave)")
+person "$ONE_SESSION" deny "{\"link_token\":\"$LINK\"}" >/dev/null
+T=$(wait_done leave)
+eq "esc at not authorized leaves, like everywhere else" "$(cat "$OUT/leave.rc")" "0"
+has "…calmly" "$T" "cancelled"
+
+# Tab goes to the email and back, and it stays the same link: another each time would spend the
+# rate limit, leave rows behind, and open another browser tab.
+reset_fp
+ROWS=$(sql "select count(*) from cli_login_requests")
+run_fp toggle "url,$TO_EMAIL,type:half@,key:tab,url,wait:waiting for you,key:tab,wait:half@,key:tab,url,wait:waiting for you" "$DASH" -- login
+LINK=$(link_token "$(wait_url toggle)")
+until [ "$(grep -ao 'cli/authorize?r=' "$OUT/toggle.log" | wc -l)" = 3 ]; do sleep 0.1; done
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+T=$(wait_done toggle)
+eq "tab there and back still signs in" "$(cat "$OUT/toggle.rc")" "0"
+has "…what was typed came back" "$(transcript toggle | sed -n '/waiting for you/,$p')" "half@"
+eq "…the same link every time" "$(grep -aoP 'authorize\?r=\K[0-9a-f]{64}' "$OUT/toggle.log" | sort -u | wc -l)" "1"
+eq "…one request on the server" "$(sql "select count(*) from cli_login_requests")" "$((ROWS + 1))"
+eq "…signed in" "$(saved email)" "$ONE"
+
+# Approved while the person was back at the email: coming back finds it.
+reset_fp
+run_fp later "url,wait:waiting for you,key:tab,wait:send a code,sleep:4,key:tab" "$DASH" -- login
+LINK=$(link_token "$(wait_url later)")
+until transcript later | sed -n '/waiting for you/,$p' | grep -q 'send a code'; do sleep 0.1; done
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+sleep 1
+eq "an approval given at the email waits" "$(request_status "$LINK")" "approved"
+T=$(wait_done later)
+eq "…and coming back collects it" "$(cat "$OUT/later.rc")" "0"
+eq "…signed in" "$(saved email)" "$ONE"
+eq "…the request spent" "$(request_status "$LINK")" "claimed"
+
+# Left at the email with the approval unclaimed: nobody collects it, so it makes nothing.
+reset_fp
+BEFORE=$(sessions_of "$ONE")
+run_fp nocollect "url,wait:waiting for you,key:tab,wait:send a code,sleep:3,key:esc" "$DASH" -- login
+LINK=$(link_token "$(wait_url nocollect)")
+until transcript nocollect | sed -n '/waiting for you/,$p' | grep -q 'send a code'; do sleep 0.1; done
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+T=$(wait_done nocollect)
+eq "esc at the email with an approval waiting exits 0" "$(cat "$OUT/nocollect.rc")" "0"
+eq "…and no session is made" "$(sessions_of "$ONE")" "$BEFORE"
+eq "…nothing saved" "$(saved session_token)" ""
+eq "…and no session" "$(sessions_of "$ONE")" "$BEFORE"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 6 — a link that expires offers a fresh one"
+reset_fp
+run_fp expire "url,wait:that link expired,key:enter,url" "$DASH" -- login
+LINK1=$(link_token "$(wait_url expire)")
+sql "update cli_login_requests set expires_at = now() - interval '1 second' where link_token_hash = encode(sha256('$LINK1'::bytea), 'hex')" >/dev/null
+LINK2=$(link_token "$(wait_url expire)")
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK2\"}" >/dev/null
+T=$(wait_done expire)
+eq "fp exited 0 on the fresh link" "$(cat "$OUT/expire.rc")" "0"
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK1\"}" >/dev/null
+eq "the expired link can no longer be approved" "$(cat "$OUT/status")" "410"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 7 — leaving: esc, ctrl-c, and an approval nobody collects"
+reset_fp
+run_fp esc "url,wait:waiting for you,key:esc" "$DASH" -- login
+LINK=$(link_token "$(wait_url esc)")
+T=$(wait_done esc)
+eq "esc while waiting exits 0" "$(cat "$OUT/esc.rc")" "0"
+has "…calmly" "$T" "cancelled"
+eq "…with nothing saved" "$(saved session_token)" ""
+BEFORE=$(sessions_of "$ONE")
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+eq "the abandoned link can still be approved" "$(cat "$OUT/status")" "200"
+sleep 3
+eq "…but no session ever exists: nobody claimed it" "$(sessions_of "$ONE")" "$BEFORE"
+eq "…and it stays unclaimed" "$(request_status "$LINK")" "approved"
+run_fp ctrlc "url,wait:waiting for you,key:ctrl-c" "$DASH" -- login
+wait_url ctrlc >/dev/null
+T=$(wait_done ctrlc)
+eq "ctrl-c while waiting exits 0" "$(cat "$OUT/ctrlc.rc")" "0"
+has "…calmly" "$T" "cancelled"
+
+# A person who presses esc while a poll is in flight has said no, even if that poll comes
+# back approved. Only a stand-in can hold a poll open, so this one records every claim.
+python3 - "$OUT/held.port" "$OUT/held.claims" "$OUT/held.mode" "$OUT/held.starts" <<'PY' &
+import http.server, json, os, sys, time
+def mode():
+    return open(sys.argv[3]).read().strip() if os.path.exists(sys.argv[3]) else ""
+class H(http.server.BaseHTTPRequestHandler):
+    def reply(self, code, body):
+        data = json.dumps(body).encode()
+        self.send_response(code)
+        self.send_header("content-type", "application/json")
+        self.send_header("content-length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+    def do_GET(self):
+        self.reply(200, {"id": "u1", "email": "held@example.test", "is_instance_admin": False, "memberships": []})
+    def do_POST(self):
+        self.rfile.read(int(self.headers.get("content-length", 0)))
+        if self.path.endswith("/start"):
+            open(sys.argv[4], "a").write("start\n")
+            if mode() == "slow-start":
+                time.sleep(8)
+            self.reply(201, {"verification_url": f"http://{self.headers['host']}/cli/authorize?r=" + "a" * 64,
+                             "poll_secret": "p", "expires_in": 600, "interval": 1, "kind": "session"})
+        elif self.path.endswith("/poll"):
+            if mode() != "slow-claim":
+                time.sleep(4)
+            self.reply(200, {"status": "denied" if mode() == "denied" else "approved"})
+        elif self.path.endswith("/claim"):
+            open(sys.argv[2], "a").write("claim\n")
+            if mode() == "slow-claim":
+                time.sleep(8)
+            self.reply(201, {"session_token": "HELD-TOKEN", "expires_in_secs": 3600,
+                             "user": {"id": "u1", "email": "held@example.test"}})
+    def log_message(self, *a): pass
+s = http.server.ThreadingHTTPServer(("127.0.0.1", 0), H)
+open(sys.argv[1], "w").write(str(s.server_address[1]))
+s.serve_forever()
+PY
+HELD_PID=$!
+for _ in $(seq 1 40); do [ -s "$OUT/held.port" ] && break; sleep 0.1; done
+HELD="http://127.0.0.1:$(cat "$OUT/held.port")"
+reset_fp
+run_fp held "url,wait:waiting for you,sleep:2,key:esc" "$HELD" -- login
+wait_url held >/dev/null
+T=$(wait_done held)
+eq "esc during a poll that comes back approved exits 0" "$(cat "$OUT/held.rc")" "0"
+has "…calmly" "$T" "cancelled"
+eq "…with no claim" "$(cat "$OUT/held.claims" 2>/dev/null | wc -l)" "0"
+eq "…and nothing saved" "$(saved session_token)" ""
+reset_fp
+run_fp heldutf "url,wait:waiting for you,sleep:1,type:é,key:esc" "$HELD" -- login
+wait_url heldutf >/dev/null
+T=$(wait_done heldutf)
+has "esc after a non-ASCII key, same poll: calm too" "$T" "cancelled"
+eq "…with no claim" "$(cat "$OUT/held.claims" 2>/dev/null | wc -l)" "0"
+eq "…and nothing saved" "$(saved session_token)" ""
+reset_fp
+run_fp notheld "url" "$HELD" -- login
+wait_url notheld >/dev/null
+T=$(wait_done notheld)
+eq "the same poll with no key pressed does claim, so the stand-in is a fair test" "$(cat "$OUT/held.claims" 2>/dev/null | wc -l)" "1"
+
+# Enter pressed during a poll that comes back denied was pressed at a screen that's gone.
+reset_fp
+echo denied > "$OUT/held.mode"
+rm -f "$OUT/held.starts"
+run_fp heldenter "url,wait:waiting for you,sleep:1,key:enter,wait:not authorized,sleep:2,key:esc" "$HELD" -- login
+wait_url heldenter >/dev/null
+T=$(wait_done heldenter)
+eq "enter during a poll that comes back denied doesn't take a new link" "$(wc -l < "$OUT/held.starts")" "1"
+has "…the denial stays on screen until it's answered" "$T" "new link"
+eq "…and the person can still leave" "$(cat "$OUT/heldenter.rc")" "0"
+reset_fp
+rm -f "$OUT/held.starts"
+run_fp heldescdeny "url,wait:waiting for you,sleep:1,key:esc" "$HELD" -- login
+wait_url heldescdeny >/dev/null
+T=$(wait_done heldescdeny)
+eq "esc during a poll that comes back denied exits 0" "$(cat "$OUT/heldescdeny.rc")" "0"
+has "…calmly, as the screen promised" "$T" "cancelled"
+eq "…with one link" "$(wc -l < "$OUT/held.starts")" "1"
+
+# Ctrl-C at any request, not only during a poll.
+reset_fp
+echo slow-start > "$OUT/held.mode"
+run_fp heldstart "wait:asking for a link,sleep:1,key:ctrl-c" "$HELD" -- login
+T=$(wait_done heldstart)
+eq "ctrl-c while asking for a link exits 0" "$(cat "$OUT/heldstart.rc")" "0"
+has "…calmly" "$T" "cancelled"
+reset_fp
+echo slow-claim > "$OUT/held.mode"
+rm -f "$OUT/held.claims"
+run_fp heldclaim "url,wait:finishing sign-in,sleep:1,key:ctrl-c" "$HELD" -- login
+wait_url heldclaim >/dev/null
+T=$(wait_done heldclaim)
+eq "ctrl-c while finishing exits 0" "$(cat "$OUT/heldclaim.rc")" "0"
+has "…calmly" "$T" "cancelled"
+eq "…and saves nothing" "$(saved session_token)" ""
+kill "$HELD_PID" 2>/dev/null
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 8 — a dropped connection is not an answer"
+reset_fp
+run_fp drop "url,wait:waiting for you,wait:reconnecting,wait:waiting for you" "$DASH" -- login
+LINK=$(link_token "$(wait_url drop)")
+DASH_STOPPED=1
+docker stop -t 0 "$DASH_CONTAINER" >/dev/null
+sleep 5
+docker start "$DASH_CONTAINER" >/dev/null
+DASH_STOPPED=0
+for _ in $(seq 1 60); do curl -s -m 2 -o /dev/null "$DASH/login" && break; sleep 0.5; done
+ok "the dashboard went away and came back"
+# Only once it says it's waiting again, or the very next poll is the approval and it never does.
+for _ in $(seq 1 60); do
+  sed 's/\x1b\[[0-9;?]*[A-Za-z]//g' "$OUT/drop.log" | grep -a -E 'reconnecting|waiting for you' | tail -1 | grep -q 'waiting for you' && break
+  sleep 0.5
+done
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+T=$(wait_done drop)
+eq "fp finished on the same link" "$(cat "$OUT/drop.rc")" "0"
+has "…after saying it was reconnecting" "$T" "reconnecting"
+eq "…and signed in" "$(saved email)" "$ONE"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 9 — where a browser can open, it opens"
+reset_fp
+mkdir -p "$OUT/bin"
+printf '#!/bin/sh\necho "$@" > "%s/opened"\n' "$OUT" > "$OUT/bin/xdg-open"
+chmod +x "$OUT/bin/xdg-open"
+rm -f "$OUT/opened"
+run_fp opens "url,wait:waiting for you,key:esc" "$DASH" DISPLAY=:99 SSH_TTY= PATH="$OUT/bin:$PATH" -- login
+URL=$(wait_url opens)
+T=$(wait_done opens)
+for _ in $(seq 1 20); do [ -s "$OUT/opened" ] && break; sleep 0.25; done
+eq "the handler got exactly the link" "$(cat "$OUT/opened" 2>/dev/null)" "$URL"
+has "…and the link is on screen as well" "$T" "if nothing appears, open this link"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 10 — a Cloud without this: the email code takes over, and nothing is minted"
+python3 - "$OUT/stub.port" <<'PY' &
+import http.server, sys
+class H(http.server.BaseHTTPRequestHandler):
+    def _404(self):
+        self.send_response(404); self.send_header("content-length", "0"); self.end_headers()
+    do_GET = do_POST = _404
+    def log_message(self, *a): pass
+s = http.server.HTTPServer(("127.0.0.1", 0), H)
+open(sys.argv[1], "w").write(str(s.server_address[1]))
+s.serve_forever()
+PY
+STUB_PID=$!
+for _ in $(seq 1 40); do [ -s "$OUT/stub.port" ] && break; sleep 0.1; done
+reset_fp
+run_fp old404 "wait:no browser login,wait:send a code,key:esc" "http://127.0.0.1:$(cat "$OUT/stub.port")" -- login
+T=$(wait_done old404)
+eq "a Cloud with no such route falls through to the email step" "$(cat "$OUT/old404.rc")" "0"
+has "…saying why" "$T" "this Cloud has no browser login yet"
+if [ -n "$CLOUD_1090" ]; then
+  reset_fp
+  KEYS_BEFORE=$(docker exec "$PG_1090" psql -U postgres -d agenteye -tAc "select count(*) from api_keys where created_via = 'cli_login'")
+  STARTED_BEFORE=$(docker exec "$PG_1090" psql -U postgres -d agenteye -tAc "select count(*) from cli_login_requests")
+  run_fp old1090 "wait:no browser login,wait:send a code,key:esc" "$CLOUD_1090" -- login
+  T=$(wait_done old1090)
+  eq "a Cloud with only \`failproofai config\`'s login falls through too" "$(cat "$OUT/old1090.rc")" "0"
+  has "…saying why" "$T" "this Cloud has no browser login yet"
+  hasnt "…never offering its machine-key link" "$T" "/cli/authorize"
+  eq "…its request is left pending, for nobody" "$(docker exec "$PG_1090" psql -U postgres -d agenteye -tAc "select count(*) from cli_login_requests where status <> 'pending'")" "0"
+  eq "…one row, as the old route always makes" "$(docker exec "$PG_1090" psql -U postgres -d agenteye -tAc "select count(*) from cli_login_requests")" "$((STARTED_BEFORE + 1))"
+  eq "…and no key" "$(docker exec "$PG_1090" psql -U postgres -d agenteye -tAc "select count(*) from api_keys where created_via = 'cli_login'")" "$KEYS_BEFORE"
+else
+  printf '  \033[33mSKIP\033[0m a Cloud with only failproofai config'"'"'s login (set CLOUD_1090 and PG_1090)\n'
+fi
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 11 — no trusted ingress: no address is believed, and the email always goes out"
+api_start() { # <dashboard> <address> -> start response
+  unthrottle
+  curl -s -X POST "$1/api/auth/cli/start" -H "x-forwarded-for: $2" -H 'content-type: application/json' \
+    -d '{"machine_label":"e2e-box","machine_os":"linux","cli_version":"fp e2e","kind":"session"}'
+}
+api_claim() { curl -s -X POST "$1/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$2\"}"; }
+requester_of() { sql "select coalesce(requester_address, 'none') from cli_login_requests where link_token_hash = encode(sha256('$1'::bytea), 'hex')"; }
+
+# What a forger would do with nothing in front of the dashboard: write the victim's own
+# address on the request that starts the login.
+FORGED="fp-forged-$STAMP@example.test"
+FORGED_SESSION=$(sign_in "$FORGED")
+S=$(api_start "$DASH" 203.0.113.7)
+LINK=$(link_token "$(echo "$S" | jqp '["verification_url"]')")
+SECRET=$(echo "$S" | jqp '["poll_secret"]')
+eq "a forged address is not stored" "$(requester_of "$LINK")" "none"
+PAGE=$(person "$FORGED_SESSION" lookup "{\"link_token\":\"$LINK\"}" 203.0.113.7)
+eq "…and the page has nothing to compare" "$(echo "$PAGE" | jqp '["different_network"]')" "False"
+eq "…so it names no address" "$(echo "$PAGE" | jqp '["requester_address"]')" "None"
+person "$FORGED_SESSION" approve "{\"link_token\":\"$LINK\"}" 203.0.113.7 >/dev/null
+C=$(api_claim "$DASH" "$SECRET")
+has "the session is handed over" "$C" "session_token"
+CLAIMED_TOKEN=$(echo "$C" | jqp '["session_token"]')
+wait_sign_in_mail "$FORGED"
+eq "…and matching forged addresses can't silence the email" "$(sign_in_mails "$FORGED")" "1"
+M=$(sign_in_mail_text "$FORGED")
+has "…naming the machine" "$M" "fp-cloud-cli on e2e-box signed in"
+has "…and what that terminal now has" "$M" "in all your organizations"
+hasnt "…not claiming to know where it started" "$M" "started from"
+hasnt "…and carrying no secret" "$M" "$CLAIMED_TOKEN"
+
+# The real `fp`, same machine, on a deployment like this one.
+PLAIN="fp-plain-$STAMP@example.test"
+PLAIN_SESSION=$(sign_in "$PLAIN")
+reset_fp
+run_fp plainbox "url" "$DASH" -- login
+LINK=$(link_token "$(wait_url plainbox)")
+PAGE=$(person "$PLAIN_SESSION" lookup "{\"link_token\":\"$LINK\"}")
+eq "the real fp: no warning" "$(echo "$PAGE" | jqp '["different_network"]')" "False"
+person "$PLAIN_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+wait_done plainbox >/dev/null
+wait_sign_in_mail "$PLAIN"
+eq "…and the email goes out" "$(sign_in_mails "$PLAIN")" "1"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 11b — behind a trusted ingress: the warning, and an email only when it matters"
+if [ -n "$TRUSTED_DASH" ]; then
+  PERSON_DASH=$TRUSTED_DASH
+  AWAY="fp-away-$STAMP@example.test"
+  AWAY_SESSION=$(sign_in "$AWAY")
+  S=$(api_start "$TRUSTED_DASH" 203.0.113.17)
+  LINK=$(link_token "$(echo "$S" | jqp '["verification_url"]')")
+  SECRET=$(echo "$S" | jqp '["poll_secret"]')
+  eq "the address that started it is kept" "$(requester_of "$LINK")" "203.0.113.17"
+  PAGE=$(person "$AWAY_SESSION" lookup "{\"link_token\":\"$LINK\"}" 198.51.100.9)
+  eq "another network: the page warns" "$(echo "$PAGE" | jqp '["different_network"]')" "True"
+  eq "…and names the address" "$(echo "$PAGE" | jqp '["requester_address"]')" "203.0.113.17"
+  person "$AWAY_SESSION" approve "{\"link_token\":\"$LINK\",\"client_address\":\"203.0.113.17\"}" 198.51.100.9 >/dev/null
+  C=$(api_claim "$TRUSTED_DASH" "$SECRET")
+  has "…the session is still handed over: it warns, it doesn't block" "$C" "session_token"
+  wait_sign_in_mail "$AWAY"
+  eq "…one email, even though the page forged a matching address" "$(sign_in_mails "$AWAY")" "1"
+  has "…saying where the login started" "$(sign_in_mail_text "$AWAY")" "The login started from 203.0.113.17"
+
+  SAME="fp-same-$STAMP@example.test"
+  SAME_SESSION=$(sign_in "$SAME")
+  S=$(api_start "$TRUSTED_DASH" 203.0.113.18)
+  LINK=$(link_token "$(echo "$S" | jqp '["verification_url"]')")
+  SECRET=$(echo "$S" | jqp '["poll_secret"]')
+  PAGE=$(person "$SAME_SESSION" lookup "{\"link_token\":\"$LINK\"}" 203.0.113.18)
+  eq "the same network: no warning" "$(echo "$PAGE" | jqp '["different_network"]')" "False"
+  eq "…and no address" "$(echo "$PAGE" | jqp '["requester_address"]')" "None"
+  person "$SAME_SESSION" approve "{\"link_token\":\"$LINK\"}" 203.0.113.18 >/dev/null
+  api_claim "$TRUSTED_DASH" "$SECRET" >/dev/null
+  sleep 4
+  eq "…and no email" "$(sign_in_mails "$SAME")" "0"
+
+  # The real `fp`, approved from somewhere else: what a phished link looks like.
+  LOCAL="fp-local-$STAMP@example.test"
+  LOCAL_SESSION=$(sign_in "$LOCAL")
+  reset_fp
+  run_fp elsewhere "url" "$TRUSTED_DASH" -- login
+  LINK=$(link_token "$(wait_url elsewhere)")
+  PAGE=$(person "$LOCAL_SESSION" lookup "{\"link_token\":\"$LINK\"}" 198.51.100.50)
+  eq "the real fp, approved elsewhere: the page warns" "$(echo "$PAGE" | jqp '["different_network"]')" "True"
+  person "$LOCAL_SESSION" approve "{\"link_token\":\"$LINK\"}" 198.51.100.50 >/dev/null
+  T=$(wait_done elsewhere)
+  eq "…and fp still finishes: a warning, not a block" "$(cat "$OUT/elsewhere.rc")" "0"
+  wait_sign_in_mail "$LOCAL"
+  eq "…with one email" "$(sign_in_mails "$LOCAL")" "1"
+  has "…naming the machine" "$(sign_in_mail_text "$LOCAL")" "fp-cloud-cli on $(hostname) signed in"
+  PERSON_DASH=$DASH
+else
+  printf '  \033[33mSKIP\033[0m the different-network warning (set TRUSTED_DASH)\n'
+fi
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 12 — what must be refused"
+S=$(api_start "$DASH" 203.0.113.9)
+LINK=$(link_token "$(echo "$S" | jqp '["verification_url"]')")
+SECRET=$(echo "$S" | jqp '["poll_secret"]')
+BAD=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/start" -H 'x-forwarded-for: 203.0.113.10' -H 'content-type: application/json' -d '{"machine_label":"x","kind":"root"}')
+eq "an unknown kind is refused" "$BAD" "422"
+EVIL=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/approve" -b "ae_session=$ONE_SESSION" \
+  -H 'origin: https://evil.example' -H 'content-type: application/json' -d "{\"link_token\":\"$LINK\"}")
+eq "a cross-site approve is refused" "$EVIL" "403"
+FORM=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/approve" -b "ae_session=$ONE_SESSION" \
+  -H "origin: $DASH" -H 'content-type: application/x-www-form-urlencoded' -d "link_token=$LINK")
+eq "a form-encoded approve is refused" "$FORM" "403"
+NOSESS=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/approve" -H "origin: $DASH" \
+  -H 'content-type: application/json' -d "{\"link_token\":\"$LINK\"}")
+eq "no session, no approve" "$NOSESS" "401"
+EARLY=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$SECRET\"}")
+eq "no claim before approval" "$EARLY" "409"
+LINKCLAIM=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$LINK\"}")
+eq "the link cannot claim" "$LINKCLAIM" "404"
+# Sessions never slide. One that could approve its own replacement would never end.
+person "$CLAIMED_TOKEN" lookup "{\"link_token\":\"$LINK\"}" >/dev/null
+eq "a session claimed from a link can look at another link" "$(cat "$OUT/status")" "200"
+person "$CLAIMED_TOKEN" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+eq "…but can't approve it, or it would renew itself for ever" "$(cat "$OUT/status")" "403"
+eq "…which leaves that link pending" "$(request_status "$LINK")" "pending"
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+FIRST=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$SECRET\"}")
+SECOND=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$SECRET\"}")
+eq "the first claim works" "$FIRST" "201"
+eq "…and only the first" "$SECOND" "409"
+CACHE=$(curl -s -D - -o /dev/null -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$SECRET\"}" | tr -d '\r' | grep -i '^cache-control')
+has "a claim answer is never cacheable" "$CACHE" "no-store"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 13 — logout, and no secret in any log"
+reset_fp
+run_fp last "url" "$DASH" -- login
+LINK=$(link_token "$(wait_url last)")
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+wait_done last >/dev/null
+TOKEN=$(saved session_token)
+eq "signed in" "$(saved email)" "$ONE"
+fp_plain "$DASH" logout >/dev/null 2>&1
+eq "logout clears the saved session" "$(saved session_token)" ""
+eq "…and revokes it on the server" "$(sql "select revoked_at is not null from sessions where token_hash = encode(sha256('$TOKEN'::bytea), 'hex')")" "t"
+for c in "$SERVER_CONTAINER" "$DASH_CONTAINER"; do
+  L=$(docker logs "$c" 2>&1)
+  hasnt "$c logs no session token" "$L" "$TOKEN"
+  hasnt "$c logs no session token from the emails phase" "$L" "$CLAIMED_TOKEN"
+  hasnt "$c logs no poll secret" "$L" "$SECRET"
+done
+
+printf '\n\033[1m%s passed, %s failed\033[0m\n' "$PASS" "$FAIL"
+[ "$FAIL" = 0 ]
diff --git a/docs/reference/cloud-cli.mdx b/docs/reference/cloud-cli.mdx
index dd9fafcb5..058f288f9 100644
--- a/docs/reference/cloud-cli.mdx
+++ b/docs/reference/cloud-cli.mdx
@@ -163,17 +163,20 @@ unchanged when no artifact is returned.
 
 | Command | Purpose | Options |
 | --- | --- | --- |
-| `fp login` | Sign in with an emailed one-time code and select an organization. | `--email`, `-e`; `--org`; `--force` |
+| `fp login` | Sign in from a browser or with an emailed one-time code, and select an organization. `--email` goes straight to the code. | `--email`, `-e`; `--org`; `--force` |
 | `fp logout` | Revoke and remove the saved user session. | — |
 | `fp whoami` | Show the current identity, authentication mode, organization, and permissions. | — |
 | `fp version` | Show the installed CLI version. | — |
 | `fp help` | Show top-level command help. | — |
 
 ```bash
+fp login
 fp login --email you@example.com --org reliability-team
 fp whoami
 ```
 
+On a terminal, `fp login` starts on a link, to sign in with your browser or SSO, and opens it (over SSH or with no display it only shows it, and it works from any device); authorize it and the terminal finishes on its own. That terminal gets your access in all your organizations until the session expires, so only authorize a link you just asked for. If the login started on a different network, you get an email once the session exists, and the page warns you where the deployment can tell. Press **Tab** for a 6-digit code by email instead, and Tab again to go back. `--email`, `--json` and anything without a terminal use the code.
+
 ### Events
 
 ```text
diff --git a/fp-cloud-cli/CHANGELOG.md b/fp-cloud-cli/CHANGELOG.md
index e26e320a7..49c692ed2 100644
--- a/fp-cloud-cli/CHANGELOG.md
+++ b/fp-cloud-cli/CHANGELOG.md
@@ -2,10 +2,13 @@
 
 ## 0.0.3b0 — 2026-10-25
 
-Open for the next release. `0.0.2` published on 2026-10-25 and the `bump` job
-moved the version here automatically; nothing has landed against `0.0.3b0` yet.
-Add entries as changes merge — this section becomes the GitHub Release body when
-it ships.
+### Added
+
+- `fp login` can sign you in from a browser. On a terminal it starts on a link, to use your browser or SSO: it opens where a browser can (over SSH or with no display it only shows it, and it works from any device), and the terminal finishes on its own once you authorize it. Press Tab for a 6-digit code by email instead, and Tab again to go back. `--email`, `--json` and anything without a terminal keep the code as they always did. If there's no link to offer, as on a dashboard without browser login, it uses the code and never creates a key. Either way you get the same session, with the same lifetime. (#981)
+
+### Changed
+
+- Back to the earlier look: rounded panels, the purple `◆ fp` mark, lowercase panel titles and red error boxes. Ids stay whole, wrapping instead of being cut, and screens added since keep their plain tables. `--json`, exit codes and messages are unchanged. (#981)
 
 ## 0.0.2 — 2026-10-25
 
diff --git a/fp-cloud-cli/README.md b/fp-cloud-cli/README.md
index 107eef0df..d1cd00041 100644
--- a/fp-cloud-cli/README.md
+++ b/fp-cloud-cli/README.md
@@ -34,17 +34,24 @@ uv run fp --help
 
 ## Authentication
 
-The CLI talks to your dashboard (set `--base-url` or `FP_DASHBOARD_URL`) and logs in with
-an emailed one-time code:
+The CLI talks to your dashboard (set `--base-url` or `FP_DASHBOARD_URL`) and signs you in
+from a browser or with an emailed one-time code:
 
 ```bash
-fp login --email you@example.com
-# enter the 6-digit code; the session is stored in
+fp login                           # opens a link to authorize; press tab for a code by email instead
+fp login --email you@example.com   # straight to the code; also what scripts and pipes use
+# either way the session is stored in
 # ~/.failproofai/fpcli/cli-auth.json (mode 0600)
 fp whoami
 fp logout
 ```
 
+`fp` starts on a link, to sign in with your browser or SSO, and opens it (over SSH or with no
+display it only shows it, and it works from any device). Authorize it and the terminal finishes
+on its own. That terminal gets your access in all your orgs until the session expires, so only
+authorize a link you just asked for. Press **tab** for a code by email instead, and tab again to
+go back. If there's no link to offer, as on a dashboard without browser login, it uses the code.
+
 Sessions expire (24h by default); re-run `fp login` when prompted.
 
 ## Working across orgs (multi-tenant)
@@ -322,8 +329,8 @@ Unknown-route 404s exit 6 with “not available on this FailproofAI Cloud yet”
 Missing-record 404s also exit 6 but report that the record was not found.
 `plan` and `plan claim` require a signed-in person and deny API-key mode before
 HTTP with the standard `fp login` message.
-Human screens use the mint/pink wordmark, grey labels, open tables and full ids;
-existing JSON shapes are unchanged.
+Human screens use rounded panels, the purple `◆ fp` mark and full ids, which wrap
+rather than being cut; existing JSON shapes are unchanged.
 
 Human commands show summaries, tables and wrapped text rather than response
 objects. Use global `--json` for raw API results. For `sessions export` or
diff --git a/fp-cloud-cli/fp_cli/app.py b/fp-cloud-cli/fp_cli/app.py
index 7a438a9c7..2c5e71ae9 100644
--- a/fp-cloud-cli/fp_cli/app.py
+++ b/fp-cloud-cli/fp_cli/app.py
@@ -51,7 +51,7 @@
 
 **Getting started**
 
-* `fp --base-url https://cloud.example.com login` — email a one-time code, then paste it
+* `fp --base-url https://cloud.example.com login` — authorize from a browser, or use an emailed code
 * `fp whoami` — confirm who you are and your permissions
 * `fp --json sessions --since 24h` — run a query (results are newest-first)
 
@@ -132,12 +132,6 @@
 # function Typer calls for this; falls back silently if its internals change.
 try:  # pragma: no cover - exercised via real command output, not unit assertions
     import typer.rich_utils as _rich_utils
-    # Keep generated subcommand help on the same shared screen primitives.
-    _rich_utils.Panel = output.Panel
-    _rich_utils.Table = output.Table
-    _rich_utils.STYLE_OPTION = output.theme.PINK
-    _rich_utils.STYLE_COMMANDS_TABLE_FIRST_COLUMN = output.theme.PINK
-    _rich_utils.STYLE_OPTION_ENVVAR = output.theme.LABEL
 
     import re as _re
 
@@ -337,7 +331,7 @@ def main(
             "must be a positive number of seconds.", param_hint="--timeout"
         )
     cfg = cfgmod.load_config()
-    output.configure(no_color=no_color, quiet=quiet, json=json_output, context=ctx.invoked_subcommand or "Cloud")
+    output.configure(no_color=no_color, quiet=quiet, json=json_output)
     # Resolve the credential BEFORE telemetry starts: the distinct-id depends on it.
     # `get_parameter_source` is what separates a flag from its env var — the values
     # alone cannot, and the precedence rules differ between the two (see resolve_auth).
diff --git a/fp-cloud-cli/fp_cli/auth.py b/fp-cloud-cli/fp_cli/auth.py
index 41d78828f..3fe96e904 100644
--- a/fp-cloud-cli/fp_cli/auth.py
+++ b/fp-cloud-cli/fp_cli/auth.py
@@ -1,19 +1,35 @@
-"""Email-OTP device login against the dashboard.
+"""Signing in against the dashboard. Both ways end in the same session.
 
-Flow: ``/api/auth/otp/request`` (sends a code) then ``/api/auth/otp/verify``.
+Emailed code: ``/api/auth/otp/request`` (sends a code) then ``/api/auth/otp/verify``.
 The verify response carries the session token in the ``ae_session`` **Set-Cookie**
 header (not the JSON body), so we read it from ``response.cookies``.
+
+Browser: ``/api/auth/cli/start`` returns a link and a poll secret, a person approves
+the link while this polls ``/poll`` with the secret, then ``/claim`` creates the
+session and returns it, once. The token is in the JSON body there: nothing is setting a
+browser cookie. The other end is ``server/src/routes/cli_login.rs`` in AgentEye.
 """
 
 from __future__ import annotations
 
+import math
+import os
+import platform as platform_info
+import re
+import socket
+import subprocess
+import sys
+import time
+from dataclasses import dataclass, field
 from datetime import datetime, timedelta, timezone
-from typing import Any, Dict, Optional, Tuple
+from typing import Any, Callable, Dict, Mapping, Optional, Tuple
+from urllib.parse import urlsplit
 
 import uuid
 
 import httpx
 
+from ._version import __version__
 from .config import CliConfig, save_config
 from .client import _request_id_of
 from .errors import ApiError, AuthError, NetworkError
@@ -136,6 +152,312 @@ def verify_otp(
     return token, expires_in, user
 
 
+#: Sent at start and required back. A Cloud from before this feature's server half
+#: drops the field and would end the request in a machine key, so a missing echo
+#: means "no browser login here": nothing gets approved, and nothing gets minted.
+BROWSER_LOGIN_KIND = "session"
+
+#: A poll stalled on a bad connection freezes the countdown and the Esc key with it.
+_POLL_TIMEOUT_SECS = 10.0
+
+# Controls (a terminal executes them), bidi overrides and isolates, and zero-width
+# formatting. Same set as `displayText` in the npm CLI's `cloud-login.ts`.
+_INVISIBLE = re.compile(
+    "[\u0000-\u001f\u007f-\u009f؜᠎​-‏‪-‮⁠-⁩]"
+)
+
+
+#: What a session token can be and still be sent back on every later request. A real one is
+#: 64 hex characters; a cookie or a header can't carry a control or a non-ASCII character.
+_SESSION_TOKEN = re.compile(r"[A-Za-z0-9._~+/=-]{1,4096}")
+
+
+def display_text(value: Any, max_chars: int = 200) -> Optional[str]:
+    """A server-supplied string made safe to print, or ``None`` if nothing is left."""
+    if not isinstance(value, str):
+        return None
+    return _INVISIBLE.sub("", value).strip()[:max_chars] or None
+
+
+def _machine_label() -> str:
+    """This machine's name, always sendable. Python hands back a hostname's non-UTF-8 bytes
+    as surrogates, which JSON can't carry, and the server refuses a label with nothing in it."""
+    name = socket.gethostname().encode("utf-8", "replace").decode("utf-8")
+    return display_text(name) or "unknown"
+
+
+def _within(value: Any, low: float, high: float, fallback: float) -> float:
+    """A server's number, kept to a range this client can live with."""
+    if isinstance(value, bool) or not isinstance(value, (int, float)):
+        return fallback
+    # `isfinite` only on a float: JSON integers have no size limit, and past a float's
+    # range it raises instead of answering.
+    if (isinstance(value, float) and not math.isfinite(value)) or value <= 0:
+        return fallback
+    return min(high, max(low, value))
+
+
+def _is_openable(url: Any) -> bool:
+    """Only a plain http(s) link is printed or handed to the opener: it comes from the
+    server, and ``xdg-open`` will act on any scheme it knows."""
+    if not isinstance(url, str) or not all(33 <= ord(c) < 127 for c in url):
+        return False
+    try:
+        parts = urlsplit(url)
+        return parts.scheme in ("http", "https") and bool(parts.hostname) and parts.port != 0
+    except ValueError:  # malformed, or `.port` past 65535
+        return False
+
+
+def can_open_browser(
+    env: Mapping[str, str] = os.environ, platform: str = sys.platform
+) -> bool:
+    """False over SSH, where a browser would start on the remote machine, and on a Linux
+    box with no display. A guess: being wrong costs a browser that doesn't appear next to
+    a link that is printed anyway."""
+    if env.get("SSH_CONNECTION") or env.get("SSH_CLIENT") or env.get("SSH_TTY"):
+        return False
+    if platform.startswith("linux") and not env.get("DISPLAY") and not env.get("WAYLAND_DISPLAY"):
+        return False
+    return True
+
+
+def open_url(url: str, platform: str = sys.platform) -> None:
+    """Open a link with the platform's handler. Never raises: the link is on screen.
+
+    Not ``webbrowser``: it falls back to text browsers like lynx, which would take over
+    this terminal in the middle of the login box."""
+    try:
+        if platform == "win32":
+            os.startfile(url)  # type: ignore[attr-defined]
+            return
+        subprocess.Popen(
+            ["open" if platform == "darwin" else "xdg-open", url],
+            stdin=subprocess.DEVNULL,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            start_new_session=True,
+        )
+    except OSError:
+        pass
+
+
+def _post_login(
+    base_url: str,
+    path: str,
+    body: Dict[str, Any],
+    *,
+    timeout: float,
+    transport: Optional[httpx.BaseTransport],
+    verify: bool,
+) -> httpx.Response:
+    try:
+        with httpx.Client(
+            base_url=base_url.rstrip("/"),
+            timeout=timeout,
+            transport=transport,
+            verify=verify,
+            headers=_request_id_header(),
+        ) as client:
+            return client.post(path, json=body)
+    except httpx.RequestError as exc:
+        raise _network_error(base_url, exc)
+
+
+def _json_object(response: httpx.Response) -> Optional[Dict[str, Any]]:
+    try:
+        body = response.json()
+    except Exception:
+        return None
+    return body if isinstance(body, dict) else None
+
+
+@dataclass(frozen=True)
+class BrowserLogin:
+    verification_url: str
+    poll_secret: str
+    expires_in: float
+    interval: float
+    started: float = field(default_factory=time.monotonic, compare=False)
+
+
+def start_browser_login(
+    base_url: str,
+    *,
+    timeout: float = 30.0,
+    transport: Optional[httpx.BaseTransport] = None,
+    verify: bool = True,
+) -> Optional[BrowserLogin]:
+    """Open a login request. ``None`` means this Cloud can't do browser login, and the
+    emailed code still works."""
+    response = _post_login(
+        base_url,
+        "/api/auth/cli/start",
+        {
+            "machine_label": _machine_label(),
+            "machine_os": "macOS" if sys.platform == "darwin" else platform_info.system().lower(),
+            "cli_version": f"fp {__version__}",
+            "kind": BROWSER_LOGIN_KIND,
+        },
+        timeout=timeout,
+        transport=transport,
+        verify=verify,
+    )
+    status = response.status_code
+    body = _json_object(response)
+    # No such route, the web app redirecting an unknown path, or serving a page in its
+    # place: a Cloud from before browser login. Not an error.
+    if status == 404 or 300 <= status < 400 or (status == 200 and body is None):
+        return None
+    request_id = _request_id_of(response)
+    if status == 429:
+        raise ApiError(
+            "Too many login attempts from here — wait a minute, then run fp login again.",
+            status=429,
+            request_id=request_id,
+        )
+    if status >= 500:
+        raise NetworkError(
+            f"FailproofAI Cloud at {base_url} answered HTTP {status}.", request_id=request_id
+        )
+    if status != 201 or body is None:
+        raise ApiError(
+            f"Could not start a browser login (HTTP {status}).", status=status, request_id=request_id
+        )
+    url = body.get("verification_url")
+    secret = body.get("poll_secret")
+    if body.get("kind") != BROWSER_LOGIN_KIND or not _is_openable(url):
+        return None
+    if not isinstance(secret, str) or not secret:
+        return None
+    return BrowserLogin(
+        verification_url=url,
+        poll_secret=secret,
+        expires_in=_within(body.get("expires_in"), 30, 3600, 600),
+        interval=_within(body.get("interval"), 1, 30, 2),
+    )
+
+
+def poll_browser_login(
+    base_url: str,
+    poll_secret: str,
+    *,
+    timeout: float = _POLL_TIMEOUT_SECS,
+    transport: Optional[httpx.BaseTransport] = None,
+    verify: bool = True,
+) -> str:
+    """One "approved yet?". Raises ``NetworkError`` for anything worth trying again."""
+    response = _post_login(
+        base_url,
+        "/api/auth/cli/poll",
+        {"poll_secret": poll_secret},
+        timeout=timeout,
+        transport=transport,
+        verify=verify,
+    )
+    if response.status_code == 404:
+        return "unknown"
+    body = _json_object(response)
+    if response.status_code != 200 or body is None:
+        raise NetworkError(
+            f"FailproofAI Cloud at {base_url} answered HTTP {response.status_code}.",
+            request_id=_request_id_of(response),
+        )
+    status = body.get("status")
+    known = ("pending", "slow_down", "approved", "denied", "expired", "claimed")
+    return status if status in known else "unknown"
+
+
+def await_browser_approval(
+    base_url: str,
+    login: BrowserLogin,
+    *,
+    tick: Callable[[float, bool], None],
+    timeout: float = _POLL_TIMEOUT_SECS,
+    transport: Optional[httpx.BaseTransport] = None,
+    verify: bool = True,
+) -> str:
+    """Poll until the person answers or the link runs out; returns the final status.
+
+    ``tick(seconds_left, offline)`` waits a moment and may draw; it is how the caller
+    stays responsive, and how a key press gets to cancel. A dropped connection is not
+    an answer, so polling carries on through it.
+    """
+    deadline = login.started + login.expires_in  # not from now: Tab can come back to a link
+    next_poll = time.monotonic() + login.interval
+    offline = False
+    while True:
+        now = time.monotonic()
+        if now >= deadline:
+            return "expired"
+        tick(deadline - now, offline)
+        if time.monotonic() < next_poll:
+            continue
+        try:
+            status = poll_browser_login(
+                base_url,
+                login.poll_secret,
+                timeout=min(timeout, _POLL_TIMEOUT_SECS),
+                transport=transport,
+                verify=verify,
+            )
+            offline = False
+        except NetworkError:
+            status, offline = "pending", True
+        if status not in ("pending", "slow_down"):
+            return status
+        next_poll = time.monotonic() + login.interval + (1 if status == "slow_down" else 0)
+
+
+def claim_browser_login(
+    base_url: str,
+    poll_secret: str,
+    *,
+    timeout: float = 30.0,
+    transport: Optional[httpx.BaseTransport] = None,
+    verify: bool = True,
+) -> Tuple[str, int, Dict[str, Any]]:
+    """Collect the session, once. Returns ``(token, expires_in_secs, user)``, the same
+    shape as :func:`verify_otp`."""
+    response = _post_login(
+        base_url,
+        "/api/auth/cli/claim",
+        {"poll_secret": poll_secret},
+        timeout=timeout,
+        transport=transport,
+        verify=verify,
+    )
+    request_id = _request_id_of(response)
+    if response.status_code >= 500:
+        raise NetworkError(
+            f"FailproofAI Cloud at {base_url} answered HTTP {response.status_code}.",
+            hint="run fp login again",
+            request_id=request_id,
+        )
+    body = _json_object(response) or {}
+    token = body.get("session_token")
+    user = body.get("user")
+    user = user if isinstance(user, dict) else {}
+    user_id, email = display_text(user.get("id")), display_text(user.get("email"))
+    # No identity is no login: `persist_session` keeps the previous one when a field is
+    # missing, which would save this session under whoever was signed in before.
+    if (
+        response.status_code != 201
+        or not isinstance(token, str)
+        or not _SESSION_TOKEN.fullmatch(token)
+        or not user_id
+        or not email
+    ):
+        raise AuthError(
+            "That login can't be finished any more.",
+            hint="run fp login again",
+            request_id=request_id,
+        )
+    # The server's own range for a session lifetime. Past it `timedelta` raises on saving.
+    expires_in = int(_within(body.get("expires_in_secs"), 60, 30 * 86400, 86400))
+    return token, expires_in, {"id": user_id, "email": email}
+
+
 def persist_session(
     cfg: CliConfig,
     base_url: str,
diff --git a/fp-cloud-cli/fp_cli/cloud_output.py b/fp-cloud-cli/fp_cli/cloud_output.py
index 3993dc238..c69837226 100644
--- a/fp-cloud-cli/fp_cli/cloud_output.py
+++ b/fp-cloud-cli/fp_cli/cloud_output.py
@@ -15,7 +15,6 @@
 
 
 def begin(title: str) -> None:
-    output.screen_header()
     output._stdout.print(Text(title.upper(), style="bold"))
 
 
diff --git a/fp-cloud-cli/fp_cli/commands/auth_cmds.py b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
index 7572c3a8f..ee11e7014 100644
--- a/fp-cloud-cli/fp_cli/commands/auth_cmds.py
+++ b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+import itertools
+import time
 from dataclasses import asdict
 from typing import List, Optional, Tuple
 
@@ -23,7 +25,7 @@
     resolved_base_url,
 )
 from ..client import ClientContext, get_session_user, org_is_accessible
-from ..errors import ApiError, AuthError
+from ..errors import ApiError, AuthError, NetworkError
 
 
 def _resolve_login_org(
@@ -106,40 +108,187 @@ def _looks_like_email(value: str) -> bool:
     return "@" in s and " " not in s and "." in s.rsplit("@", 1)[-1] and len(s) >= 5
 
 
+_LINK_OPENING = "opening your browser — if nothing appears, open this link:"
+_LINK_ANYWHERE = "open this link on any device to authorize:"
+_NO_BROWSER_LOGIN = "this Cloud has no browser login yet — using an emailed code"
+_NO_LINK_NOW = "couldn't get a link right now — using an emailed code"
+_LINK_ENDED = {
+    "denied": "not authorized",
+    "expired": "that link expired",
+    "claimed": "that link was already used",
+}
+_SPINNER = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"
+
+
+def _offer_link(url: str) -> None:
+    """The link goes on screen before any browser opens, so one that never appears strands
+    nobody. Over SSH or with no display it is the whole offer, and works from any device."""
+    opening = auth.can_open_browser()
+    output.print_unwrapped(_LINK_OPENING if opening else _LINK_ANYWHERE)
+    output.print_unwrapped(url)
+    if opening:
+        auth.open_url(url)
+
+
+def _browser_login_in_box(state: AppState, base: str, box: selectmod.LoginBox):
+    """Link → approval → session, inside the box. Returns ``(token, expires_in, user)``, or ``None``
+    with a note saying why when there's no link to offer. Tab raises ``SwitchSignIn``, and ``box.link`` keeps the
+    link for coming back: asking for another each time would spend the rate limit and open another
+    tab, and an approval given in the meantime would be lost."""
+    options = {"timeout": state.timeout, "verify": not state.insecure}
+    frames = itertools.cycle(_SPINNER)
+
+    def tick(left: float, offline: bool) -> None:
+        minutes, seconds = divmod(int(left), 60)
+        doing = "reconnecting" if offline else "waiting for you to authorize"
+        box.waiting(f"{next(frames)} {doing} · {minutes}:{seconds:02d}", "tab use email · esc cancel")
+        if box.wait_key(0.1) == "\t":
+            raise selectmod.SwitchSignIn()
+
+    try:
+        while True:
+            if box.link is not None:
+                box.show_link(_LINK_ANYWHERE, box.link.verification_url)
+            else:
+                box.working("asking for a link…")
+                try:
+                    box.link = auth.start_browser_login(base, **options)
+                except (ApiError, NetworkError):
+                    # The link is only the default. A rate limit or an outage of this one route
+                    # must not stand between a person and the emailed code.
+                    box.note(_NO_LINK_NOW)
+                    return None
+                if box.link is None:
+                    box.note(_NO_BROWSER_LOGIN)
+                    return None
+                # The link goes on screen before any browser opens, so one that never appears
+                # strands nobody. Over SSH or with no display it is the whole offer.
+                opening = auth.can_open_browser()
+                box.show_link(_LINK_OPENING if opening else _LINK_ANYWHERE, box.link.verification_url)
+                if opening:
+                    auth.open_url(box.link.verification_url)
+            # ponytail: Esc during a stalled poll waits out its 10s timeout (Ctrl-C doesn't);
+            # polling on a thread would fix that if it ever matters.
+            outcome = auth.await_browser_approval(base, box.link, tick=tick, **options)
+            # A key pressed during the last poll is still waiting to be read. Esc and Tab mean no
+            # session, and this is the last moment that can be honoured: the claim creates it.
+            # Anything else was pressed at a screen that's gone, and must not answer the next
+            # one: Enter would take a new link with "not authorized" on screen for no time.
+            # `is not None`: the first byte of a non-ASCII character reads as "".
+            left_for_email = False
+            while (key := box.wait_key(0)) is not None:
+                left_for_email = left_for_email or key == "\t"
+            if outcome == "approved":
+                if left_for_email:
+                    raise selectmod.SwitchSignIn()
+                box.working("finishing sign-in…")
+                return auth.claim_browser_login(base, box.link.poll_secret, **options)
+            box.link = None
+            box.link_ended(_LINK_ENDED.get(outcome, "that link can't be used any more"))
+    except KeyboardInterrupt:  # Ctrl-C during a request, outside `wait_key`
+        raise selectmod.LoginCancelled()
+
+
+def _browser_login_plain(state: AppState, base: str):
+    """The same, for a terminal with no raw mode (Windows). ``None`` when this Cloud has
+    no browser login. A link that ends ends the login: `fp login` is one command away."""
+    options = {"timeout": state.timeout, "verify": not state.insecure}
+    try:
+        login = auth.start_browser_login(base, **options)
+    except (ApiError, NetworkError):  # as in the box: the link is not the only way in
+        output.info(_NO_LINK_NOW)
+        return None
+    if login is None:
+        output.info(_NO_BROWSER_LOGIN)
+        return None
+    _offer_link(login.verification_url)
+    output.info("waiting for you to authorize — ctrl-c to cancel")
+    was_offline = False
+
+    def tick(_left: float, offline: bool) -> None:
+        nonlocal was_offline
+        if offline and not was_offline:
+            output.info("reconnecting…")
+        elif was_offline and not offline:
+            output.info("back online — still waiting for you to authorize")
+        was_offline = offline
+        time.sleep(0.25)
+
+    outcome = auth.await_browser_approval(base, login, tick=tick, **options)
+    if outcome == "approved":
+        if was_offline:
+            output.info("back online")
+        return auth.claim_browser_login(base, login.poll_secret, **options)
+    raise AuthError(
+        f"{_LINK_ENDED.get(outcome, 'That link cannot be used any more')}.".capitalize(),
+        hint="run fp login for a new link",
+    )
+
+
+def _email_code_in_box(state: AppState, base: str, box: selectmod.LoginBox, email_opt: Optional[str],
+                       *, typed: str = "", tab: bool = False):
+    """Email → code → verify, inside the box. Returns ``(token, expires_in, user)``. With ``tab``,
+    Tab at the email raises ``SwitchSignIn``; ``typed`` is what the field starts with."""
+    # email
+    if email_opt:
+        email = email_opt
+        box.note("email", email)
+    else:
+        keys = "enter send a code · tab SSO · esc cancel" if tab else "enter send a code · esc cancel"
+        email = box.text_step("email", helper=keys, validate=_looks_like_email,
+                              error_msg="that doesn't look like an email", value=typed, tab=tab)
+    # send the code
+    box.working("sending a code…")
+    auth.request_otp(base, email, timeout=state.timeout, verify=not state.insecure)
+    box.note("code sent")
+    # code → verify. A wrong/expired code is reported cleanly INSIDE the box (not a raw
+    # HTTP 500) with a relogin hint, then we exit — re-run `fp login` for a fresh code.
+    code = box.text_step("code", helper="enter the 6-digit code", slots=6, collapse=False)
+    box.working("verifying…")
+    try:
+        token, expires_in, user = auth.verify_otp(
+            base, email, code.strip(), timeout=state.timeout, verify=not state.insecure
+        )
+    except AuthError:
+        box.fail("that code didn't match or has expired", "sign in again with fp login")
+        raise typer.Exit(code=4)
+    except ApiError as exc:  # e.g. too many attempts (429)
+        box.fail(exc.message, "try fp login again in a bit")
+        raise typer.Exit(code=exc.exit_code)
+    box.note("code")  # collapse to `✓ code` — never echo the value
+    return token, expires_in, {**user, "email": user.get("email") or email}
+
+
+def _sign_in_in_box(state: AppState, base: str, box: selectmod.LoginBox, email_opt: Optional[str]):
+    """Start on a browser link, with Tab to an emailed code and back. Returns ``(method, creds)``."""
+    if email_opt:
+        return "email", _email_code_in_box(state, base, box, email_opt)
+    typed = ""
+    while True:
+        try:
+            creds = _browser_login_in_box(state, base, box)
+        except selectmod.SwitchSignIn:
+            try:
+                return "email", _email_code_in_box(state, base, box, None, typed=typed, tab=True)
+            except selectmod.SwitchSignIn as switch:
+                typed = switch.typed
+                continue
+        if creds:
+            return "browser", creds
+        return "email", _email_code_in_box(state, base, box, None, typed=typed)
+
+
 def _login_interactive(state: AppState, base: str, email_opt: Optional[str], org_opt: Optional[str]) -> None:
-    """The single-box interactive login (real TTY only): one redrawn-in-place panel — email → code →
-    (org picker) → signed-in. Mirrors the non-interactive orchestration below; only the UI differs.
-    Network/auth errors propagate (terminal restored on the way out) to the standard red error box."""
+    """The single-box interactive login (real TTY only): one redrawn-in-place panel — browser link
+    or email code → (org picker) → signed-in. Mirrors the non-interactive orchestration below; only the
+    UI differs. Network/auth errors propagate (terminal restored on the way out) to the standard red
+    error box."""
     saved = state.config.org
     persisted = False
+
     with selectmod.LoginBox() as box:
         try:
-            # email
-            if email_opt:
-                email = email_opt
-                box.note("email", email)
-            else:
-                email = box.text_step("email", validate=_looks_like_email,
-                                      error_msg="that doesn't look like an email")
-            # send the code
-            box.working("sending a code…")
-            auth.request_otp(base, email, timeout=state.timeout, verify=not state.insecure)
-            box.note("code sent")
-            # code → verify. A wrong/expired code is reported cleanly INSIDE the box (not a raw
-            # HTTP 500) with a relogin hint, then we exit — re-run `fp login` for a fresh code.
-            code = box.text_step("code", helper="enter the 6-digit code", slots=6, collapse=False)
-            box.working("verifying…")
-            try:
-                token, expires_in, user = auth.verify_otp(
-                    base, email, code.strip(), timeout=state.timeout, verify=not state.insecure
-                )
-            except AuthError:
-                box.fail("that code didn't match or has expired", "sign in again with fp login")
-                raise typer.Exit(code=4)
-            except ApiError as exc:  # e.g. too many attempts (429)
-                box.fail(exc.message, "try fp login again in a bit")
-                raise typer.Exit(code=exc.exit_code)
-            box.note("code")  # collapse to `✓ code` — never echo the value
+            method, (token, expires_in, user) = _sign_in_in_box(state, base, box, email_opt)
             # persist first (so we can read authoritative memberships), then resolve the org
             auth.persist_session(state.config, base, token, expires_in, user, insecure=state.insecure)
             persisted = True
@@ -181,32 +330,35 @@ def _login_interactive(state: AppState, base: str, email_opt: Optional[str], org
                 chosen = slugs[0] if slugs else None  # single/none → named only in the final block
             state.config.org = chosen
             cfgmod.save_config(state.config)
-            analytics.capture("logged_in")  # also count the interactive (real-TTY) login path
-            who = user.get("email") or email
-            box.finish(who, chosen)
+            analytics.capture("logged_in", {"method": method})  # also count the interactive (real-TTY) login path
+            box.finish(user.get("email"), chosen)
         except selectmod.LoginCancelled:
             box.cancel(persisted)  # calm close inside the same frame
 
 
 def login(
     ctx: typer.Context,
-    email: Optional[str] = typer.Option(None, "--email", "-e", help="Email to send the login code to (prompted if omitted)."),
+    email: Optional[str] = typer.Option(None, "--email", "-e", help="Send the sign-in code to this email, without asking for it."),
     org: Optional[str] = typer.Option(None, "--org", help="Org/tenant slug to sign in to — skips the picker. Must be one you can access."),
     force: bool = typer.Option(False, "--force", help="Re-authenticate even if you already have a valid session."),
 ) -> None:
-    """Sign in to the dashboard with an emailed one-time code.
-
-    You enter your email (or pass `--email`), the dashboard emails a 6-digit code, and you paste
-    it back. The session is saved to `~/.failproofai/fpcli/cli-auth.json` (mode 0600) and lasts ~24h — just
+    """Sign in to the dashboard, from a browser or with an emailed one-time code.
+
+    On a terminal it starts on a link, to sign in with your browser or SSO. It opens your browser
+    (over SSH or with no display it just shows the link, which works from any device); authorize
+    there and the terminal finishes on its own. Press **Tab** for a 6-digit code by email instead,
+    which is also what `--email`, `--json` and anything without a terminal use. A Cloud without
+    browser login uses the code by itself.
+    The session is saved to `~/.failproofai/fpcli/cli-auth.json` (mode 0600) and lasts ~24h — just
     re-run `login` when it expires. Already signed in? `login` shows who you are and exits 0
     without prompting; pass `--force` to re-authenticate anyway.
 
     The active org is chosen here and saved for later commands. With one org it's picked
-    automatically; with several you choose from a list once your email is verified (your last-used
+    automatically; with several you choose from a list once you're signed in (your last-used
     org is the Enter-to-keep default), or pass `--org <slug>` to skip the picker. Switch it later
     with `fp orgs switch <slug>`.
 
-    Both prompts are skippable: `--email` / `--org` provide the values up front, otherwise you're
+    The prompts are skippable: `--email` / `--org` provide the values up front, otherwise you're
     asked interactively. First time, set the dashboard URL with the global `--base-url` (saved for
     next time); add the global `--insecure` for a self-signed/internal dashboard.
 
@@ -216,9 +368,9 @@ def login(
 
     Examples:
 
-    * `fp login` — fully interactive: prompts for your email, then the org picker
+    * `fp login` — fully interactive: browser or email code, then the org picker
     * `fp --base-url https://fp.example.com login` — first time: set the dashboard URL, then sign in interactively
-    * `fp login --email you@example.com --org acme` — skip both prompts (email + org up front)
+    * `fp login --email you@example.com --org acme` — skip the menu and the picker (email code + org up front)
     * `fp --base-url https://dash.internal --insecure login` — self-signed / internal dashboard
     """
     state: AppState = ctx.obj
@@ -284,14 +436,29 @@ def login(
         _login_interactive(state, base, email, org)
         return
     output.auth_header()
-    if not email:
-        email = output.prompt("email")
-    auth.request_otp(base, email, timeout=state.timeout, verify=not state.insecure)
-    output.code_sent(email)
-    code = output.prompt("code")
-    token, expires_in, user = auth.verify_otp(
-        base, email, str(code).strip(), timeout=state.timeout, verify=not state.insecure
-    )
+    method = "email"
+    creds = None
+    # A terminal this can't draw the box on (Windows). Pipes, CI and `--json` skip this, and so
+    # does a redirected stderr: the link and the waiting would go to that file, out of sight.
+    if not state.json and not email and selectmod.stdin_is_tty() and selectmod.stderr_is_tty():
+        email = str(output.prompt("email, or just press enter for a browser link", default="")).strip()
+        if not email:
+            try:
+                creds = _browser_login_plain(state, base)
+            except KeyboardInterrupt:
+                output.info("cancelled — not signed in")
+                return
+            method = "browser" if creds else "email"
+    if creds is None:
+        if not email:
+            email = output.prompt("email")
+        auth.request_otp(base, email, timeout=state.timeout, verify=not state.insecure)
+        output.code_sent(email)
+        code = output.prompt("code")
+        creds = auth.verify_otp(
+            base, email, str(code).strip(), timeout=state.timeout, verify=not state.insecure
+        )
+    token, expires_in, user = creds
     # Persist the token first so we can query the session for authoritative memberships:
     # the OTP-verify payload is slim (no memberships / is_instance_admin) — only
     # GET /api/auth/session returns them.
@@ -354,7 +521,7 @@ def login(
                         f"{slugs[0]}`) or `fp orgs switch <slug>`.")
         raise typer.Exit(code=2)
 
-    analytics.capture("logged_in")  # name-only business event (no email/id/org value)
+    analytics.capture("logged_in", {"method": method})  # no email/id/org value
     if state.json:
         output.emit_json(
             {"logged_in": True, "email": who, "org": chosen, "expires_in_secs": expires_in}
diff --git a/fp-cloud-cli/fp_cli/commands/orgs_cmds.py b/fp-cloud-cli/fp_cli/commands/orgs_cmds.py
index a994c4a4a..7d2f927d0 100644
--- a/fp-cloud-cli/fp_cli/commands/orgs_cmds.py
+++ b/fp-cloud-cli/fp_cli/commands/orgs_cmds.py
@@ -227,7 +227,7 @@ def org_switch(
     """Switch the active org/tenant — pass a slug, or omit it to pick one interactively.
 
     `fp orgs switch acme` switches straight to `acme`. `fp orgs switch` with no slug
-    opens an arrow-key picker (↑↓ to move, ⏎ to select, esc to cancel) starting on your current
+    opens an arrow-key picker (↑↓ to move, enter to select, esc to cancel) starting on your current
     org; if you belong to exactly one org there's nothing to switch to. Either way the result is
     a boxed `switched org` card, and the choice is persisted to
     `~/.failproofai/fpcli/cli-auth.json` so later
diff --git a/fp-cloud-cli/fp_cli/output.py b/fp-cloud-cli/fp_cli/output.py
index 73cc3c4af..19d8f3d3a 100644
--- a/fp-cloud-cli/fp_cli/output.py
+++ b/fp-cloud-cli/fp_cli/output.py
@@ -17,96 +17,26 @@
 
 import typer
 from rich.box import ROUNDED, SIMPLE_HEAD
+from rich.cells import cell_len
 from rich.console import Console, Group
 from rich.padding import Padding
-from rich.panel import Panel as RichPanel
-from rich.rule import Rule as RichRule
+from rich.panel import Panel
+from rich.rule import Rule
 from rich.table import Table as RichTable
-from rich.measure import Measurement
 from rich.text import Text
 
 from . import theme
-from ._version import __version__
-
-_screen_started = False
-_screen_context = "Cloud"
-
-
-def wordmark(context: Optional[str] = None) -> Text:
-    line = Text("fa", style="bold")
-    line.append("il", style=f"bold {theme.PINK}")
-    line.append("proof ai", style="bold")
-    line.append(f" v{__version__} · {context or _screen_context}", style=theme.LABEL)
-    return line
-
-
-def heading(value: Any) -> Text:
-    text = value.copy() if isinstance(value, Text) else Text.from_markup(str(value))
-    # Change chrome, never the case of a resource name/id in a title.
-    name, sep, rest = text.plain.partition(" · ")
-    known = {"events", "sessions", "evals", "errors", "keys", "users", "queries", "settings",
-             "issues", "models", "chats", "audits", "findings", "commands", "version",
-             "permissions", "orgs", "assistant", "usage", "guardrails", "policies", "fleet",
-             "options", "arguments"}
-    if name.lower() in known:
-        text = Text(name.upper(), style=f"bold {theme.TEXT}") + Text(sep + rest, style=theme.LABEL)
-    return text
-
-
-def screen_header(console=None) -> None:
-    global _screen_started
-    if not _screen_started and not _quiet and not _json_out:
-        _screen_started = True
-        (console or _stdout).print(wordmark())
-        (console or _stdout).print()
-
-
-class Panel(RichPanel):
-    """Legacy cards rendered through the open-screen primitive, without boxes.
-
-    Keep RichPanel's constructor/attributes so existing renderers need no rewrite.
-    """
-    def __rich_console__(self, console, options):
-        global _screen_started
-        if not _screen_started and not _quiet and not _json_out:
-            _screen_started = True
-            yield wordmark()
-            yield Text("")
-        if self.title:
-            yield heading(self.title)
-        yield self.renderable
-        if self.subtitle:
-            yield heading(self.subtitle)
-
-    def __rich_measure__(self, console, options):
-        parts = [self.renderable]
-        if self.title:
-            parts.insert(0, heading(self.title))
-        return Measurement.get(console, options, Group(*parts))
-
-
-class Rule(RichRule):
-    """Legacy separators are intentionally invisible in the 2026-10 language."""
-    def __rich_console__(self, console, options):
-        return iter(())
-
-    def __rich_measure__(self, console, options):
-        return Measurement(0, 0)
 
 
 class Table(RichTable):
-    """Shared tables: grey labels, no borders/rules, fold instead of cut."""
-    def __init__(self, *args, **kwargs):
-        kwargs["box"] = None
-        kwargs["show_edge"] = False
-        kwargs["header_style"] = theme.LABEL
-        super().__init__(*args, **kwargs)
-
+    """Long values wrap rather than being cut: an id, a URL or a command is never shown with a
+    ``…``. Everything else about a table is the caller's."""
     def add_column(self, *args, **kwargs):
         kwargs["overflow"] = "fold"
         kwargs["no_wrap"] = False
         return super().add_column(*args, **kwargs)
 
+
 _stdout = Console()
 _stderr = Console(stderr=True)
 _quiet = False
@@ -114,16 +44,14 @@ def add_column(self, *args, **kwargs):
 _json_out = False
 
 
-def configure(*, no_color: bool = False, quiet: bool = False, json: bool = False, context: str = "Cloud") -> None:
+def configure(*, no_color: bool = False, quiet: bool = False, json: bool = False) -> None:
     """Reconfigure the consoles from the resolved global flags."""
-    global _stdout, _stderr, _quiet, _no_color, _json_out, _screen_started, _screen_context
+    global _stdout, _stderr, _quiet, _no_color, _json_out
     _stdout = Console(no_color=no_color)
     _stderr = Console(stderr=True, no_color=no_color)
     _quiet = quiet
     _no_color = no_color
     _json_out = json
-    _screen_started = False
-    _screen_context = context
 
 
 def is_json() -> bool:
@@ -170,6 +98,7 @@ def prompt(label: str, *, default: Optional[str] = None, hide_input: bool = Fals
     kwargs: dict = {"err": True, "prompt_suffix": " ", "hide_input": hide_input}
     if default is not None:
         kwargs["default"] = default
+        kwargs["show_default"] = bool(default)  # a blank default would show as `[]`
     return typer.prompt(text, **kwargs)
 
 
@@ -214,30 +143,29 @@ def print_table(
     title: Optional[str] = None,
     show_header: bool = True,
 ) -> None:
-    screen_header()
-    if title:
-        _stdout.print(Text(str(title).upper(), style="bold"))
     widths = [max([len(str(column))] + [len(_cell(row[i])) for row in rows if i < len(row)]) for i, column in enumerate(columns)]
-    if len(columns) > 1 and sum(widths) + 3 * len(columns) > _stdout.width:
+    if len(columns) > 1 and sum(widths) + 3 * len(columns) + 1 > _stdout.width:
         # On a narrow terminal, wrapped adjacent columns interleave copyable
         # ids and URLs. Stack the fields so each value remains a whole line.
+        if title:
+            _stdout.print(Text(str(title), style="bold"))
         for row in rows:
             for column, value in zip(columns, row):
-                _stdout.print(Text(str(column).upper(), style=theme.LABEL))
+                _stdout.print(Text(str(column), style=theme.LABEL))
                 _stdout.print(Text("  " + _cell(value)), soft_wrap=True)
             _stdout.print()
         return
-    table = Table(show_header=show_header)
+    table = Table(
+        title=Text(title) if title else None, title_justify="left", header_style="bold",
+        show_header=show_header,
+    )
     for column in columns:
         table.add_column(str(column), overflow="fold")
     for row in rows:
         # Wrap each cell in Text so a value containing Rich markup (e.g. "[/]" or
         # "[red]" in a server-provided field) renders literally instead of raising
         # MarkupError mid-render (which would abort with a raw traceback).
-        table.add_row(*[
-            Text(_cell(value), style=theme.LABEL if list(columns) == ["Field", "Value"] and i == 0 else "")
-            for i, value in enumerate(row)
-        ])
+        table.add_row(*[Text(_cell(value)) for value in row])
     _stdout.print(table)
 
 
@@ -254,7 +182,7 @@ def info(message: str) -> None:
 
 def success(message: str) -> None:
     if not _quiet:
-        _stderr.print(Text("✓ ", style=theme.SUCCESS) + Text(message))
+        _stderr.print(Text(message, style="green"))
 
 
 def hint(message: str) -> None:
@@ -263,12 +191,12 @@ def hint(message: str) -> None:
 
 
 def error(message: str) -> None:
-    _stderr.print(Text("✕ ", style=theme.ERROR) + Text(message))
+    _stderr.print(Text(message, style="bold red"))
 
 
 def warn(message: str) -> None:
     if not _quiet:
-        _stderr.print(Text("▲ ", style=theme.PINK) + Text(message))
+        _stderr.print(Text(message, style="yellow"))
 
 
 def cli_warn(message: str) -> None:
@@ -289,7 +217,7 @@ def cli_warn(message: str) -> None:
 # here is stderr status chrome (never the --json data on stdout); the accent is
 # the project's pink/magenta. All gated on `_quiet`.
 
-_ACCENT = theme.PINK
+_ACCENT = "magenta"
 _NEUTRAL = "grey62"  # gray for 'already in that state' no-op boxes (neutral, not red/green)
 
 
@@ -298,9 +226,8 @@ def auth_header() -> None:
     if _quiet:
         return
     _stderr.print()
-    screen_header(_stderr)
-    _stderr.print(Text("SIGN IN", style="bold"))
-    _stderr.print("  [dim]welcome — let's get you signed in with a one-time code[/]")
+    _stderr.print(f"  [bold {_ACCENT}]◆ fp[/]")
+    _stderr.print("  [dim]welcome — let's get you signed in[/]")
     _stderr.print()
 
 
@@ -315,7 +242,7 @@ def code_sent(email: str) -> None:
     """Confirm the one-time code was emailed (the completed `request_otp` step)."""
     if _quiet:
         return
-    _stderr.print(f"  [{theme.SUCCESS}]✓[/] code sent to [bold {_ACCENT}]{email}[/]")
+    _stderr.print(f"  [green]✓[/] code sent to [bold {_ACCENT}]{email}[/]")
 
 
 def org_picker(slugs: Sequence[str], current: Optional[str] = None) -> None:
@@ -406,17 +333,57 @@ def login_inset(slugs: Sequence[str], idx: int):
         table.add_row(ptr, name)
     inset = Panel(table, box=ROUNDED, border_style=theme.FAINT, style=f"on {theme.INSET_BG}",
                   padding=(0, 1), expand=False)
-    hint = Text("↑↓ move · ⏎ select · esc cancel", style=theme.FAINT)
+    hint = Text("↑↓ move · enter select · esc cancel", style=theme.FAINT)
     return Group(title, inset, hint)
 
 
+def print_unwrapped(text: str) -> None:
+    """One line on stderr that the terminal wraps, not Rich, so a long link stays one link.
+    Not silenced by ``--quiet``: the login can't go on without it."""
+    _stderr.print(Text(text), soft_wrap=True)
+
+
+def _login_keys(text: str) -> Text:
+    """A key hint, with the keys themselves standing out: ``enter send a code · esc cancel``."""
+    hint = Text(text, style=theme.TEXT_DIM)
+    if " · " in text:  # "enter the 6-digit code" is an instruction, and its "enter" is no key
+        hint.highlight_regex(r"\b(?:enter|tab|esc)\b", style=theme.TEXT)
+    return hint
+
+
+def print_login_link(done, intro: str, url: str) -> int:
+    """The still part of the box's link screen, once: the box says what to do, and the link sits
+    right under it, outside the border. A border would break a link wider than the window, so it
+    couldn't be clicked or copied whole, where the terminal can wrap it as one. Returns the rows it
+    took on screen."""
+    head = Group(render_login_frame(done, None, asks=intro), Text(""))
+    # One that fits lines up with the box. One that doesn't starts at the margin, so its rows line
+    # up with each other.
+    indent = "  " if cell_len(url) + 2 <= _stderr.width else ""
+    link = Text(indent).append(url, style=f"underline {theme.ACCENT}")
+    _stderr.print(head)
+    _stderr.print(link, soft_wrap=True)
+    _stderr.print()
+    return len(_stderr.render_lines(head, pad=False)) + math.ceil(link.cell_len / _stderr.width) + 1
+
+
+def render_login_waiting(line: str, keys: str):
+    """The live part of the box's link screen, under the link: a spinner, what it's waiting for and
+    the time left, then the keys."""
+    waiting = Text(line, style=theme.TEXT_DIM)
+    waiting.stylize(theme.ACCENT, 0, 1)
+    waiting.highlight_regex(r"\d+:\d\d$", style=theme.TEXT)
+    return Padding(Group(waiting, _login_keys(keys)), (0, 0, 0, 2))
+
+
 def render_login_frame(done, active, *, active_value: str = "", active_slots: Optional[int] = None,
                        helper=None, error=None, inset=None, note=None, signed_in=None,
-                       cancelled=None, failed=None):
+                       cancelled=None, failed=None, asks=None):
     """Build the one login Panel (a renderable the caller redraws via ``Live``). ``done`` is a list
     of ``(label, value)`` collapsed ✓ steps; ``active`` is the current step label (bright ``❯``
     line) with ``active_value`` the in-progress typed text (rendered as fixed slots when
-    ``active_slots`` is set, e.g. the 6-digit code). ``inset`` is the org-picker block; ``signed_in``
+    ``active_slots`` is set, e.g. the 6-digit code), and ``asks`` the same bright line for something
+    to do outside the box, with no field to type in. ``inset`` is a picker block; ``signed_in``
     = ``(email, org)`` flips the border green; ``cancelled`` (bool: was the session persisted?)
     renders the calm close; ``failed`` = ``(message, hint)`` flips the border red and shows the
     failure INSIDE the same box (e.g. a wrong code). Legend ``◆ fp`` rides the top border."""
@@ -433,7 +400,7 @@ def render_login_frame(done, active, *, active_value: str = "", active_slots: Op
         intro = Text()
         intro.append("welcome ", style=theme.TEXT_DIM)
         intro.append("— ", style=theme.FAINT)
-        intro.append("sign in with a one-time code", style=theme.TEXT_DIM)
+        intro.append("sign in", style=theme.TEXT_DIM)
         lines.append(intro)
     for label, value in done:
         ln = Text()
@@ -457,7 +424,12 @@ def render_login_frame(done, active, *, active_value: str = "", active_slots: Op
         if error:
             lines.append(Text("  " + str(error), style=theme.ERROR))
         elif helper:
-            lines.append(Text("  " + str(helper), style=theme.TEXT_DIM))
+            lines.append(_login_keys("  " + str(helper)))
+    if asks:
+        ln = Text()
+        ln.append("❯ ", style=f"bold {theme.ACCENT}")
+        ln.append(str(asks), style=theme.TEXT)
+        lines.append(ln)
     if note:
         lines.append(Text("· " + str(note), style=theme.FAINT))
     if inset is not None:
@@ -489,7 +461,7 @@ def render_login_frame(done, active, *, active_value: str = "", active_slots: Op
         fl.append(str(msg), style=theme.TEXT)
         lines.append(fl)
         if hint:
-            h = Text(str(hint), style=theme.TEXT_DIM)
+            h = _login_keys(str(hint))
             h.highlight_words(["fp login"], style=theme.ACCENT)  # glow the command to run
             lines.append(h)
     legend = Text()
@@ -506,7 +478,6 @@ def _panel(mark: str, color: str, title: str, body: Text, hint: Optional[str] =
     highlighted. Built from a `rich.Text` (literal body — no markup injection). The colour
     carries the meaning: **green** = success, **brand-accent** = neutral 'already-in-state'
     no-op, **red** = failure. One shape so they all read as one family."""
-    color = theme.SUCCESS if color == "green" else theme.PINK if color in ("red", "yellow", "cyan", "magenta") else color
     text = Text()
     indent = ""
     # A box may be mark-less (the colour/title carry the meaning, e.g. the red
@@ -519,7 +490,7 @@ def _panel(mark: str, color: str, title: str, body: Text, hint: Optional[str] =
         text.append(f"\n{indent}")
         text.append(hint, style="dim")
     text.highlight_words(
-        ["fp login", "fp logout", "login --force"], style=f"bold {theme.PINK}"
+        ["fp login", "fp logout", "login --force"], style="bold cyan"
     )
     panel = Panel(
         text,
@@ -537,12 +508,8 @@ def _panel(mark: str, color: str, title: str, body: Text, hint: Optional[str] =
 
 
 def _error_box(message: str, hint: Optional[str] = None) -> None:
-    """One failure line, followed by a grey recovery hint when present."""
-    _stderr.print(Text("✕ ", style=theme.ERROR) + Text(message))
-    if hint:
-        line = Text("  " + hint, style=theme.LABEL)
-        line.highlight_regex(r"(?:fp|failproofai)\s+[^`]+", style=theme.PINK)
-        _stderr.print(line)
+    """A red `✗` failure box — the chokepoint for every CLI error."""
+    _panel("✗", "red", "error", Text(message), hint)
 
 
 def _status_box(title: str, body: Text, hint: Optional[str] = None) -> None:
@@ -558,8 +525,21 @@ def version_banner(version: str) -> None:
     if _quiet:
         _stdout.print(version)
         return
-    screen_header()
-    _stdout.print(Text(f"fp v{version}", style=theme.LABEL))
+    body = Text()
+    body.append("◆  ", style=f"bold {_ACCENT}")
+    body.append("fp", style="bold")
+    body.append("  ")
+    body.append(f"v{version}", style=f"bold {_ACCENT}")
+    panel = Panel(
+        body,
+        border_style=_ACCENT,
+        title=f"[bold {_ACCENT}]version[/]",
+        title_align="left",
+        expand=False,
+        padding=(0, 1),
+    )
+    _stdout.print()
+    _stdout.print(Padding(panel, (0, 0, 0, 2)))
 
 
 # ── top-level help (the grouped `fp` / `fp help` / `fp --help` screen) ──
@@ -572,7 +552,7 @@ def version_banner(version: str) -> None:
     ("ESSENTIALS", [
         ("version", "Show the CLI version.", ""),
         ("help", "Show this help and the available commands.", ""),
-        ("login", "Sign in with an emailed one-time code.", ""),
+        ("login", "Sign in from a browser or with an emailed code.", ""),
         ("logout", "Clear the saved session on this machine.", ""),
         ("whoami", "Show the current user, active org, and perms.", ""),
     ]),
@@ -632,21 +612,17 @@ def render_top_level_help() -> None:
     bold-white headings, BLUE command names, white one-line descriptions, FAINT subcommand hints,
     a FAINT footer), then aligned EXAMPLES. Presentation only — same routing, same commands.
     NO_COLOR keeps the box + bold headings + alignment, drops colour."""
-    global _screen_started
     total = sum(len(cmds) for _, cmds in _TOP_LEVEL_GROUPS)
 
     def _bullet(*parts) -> Text:
         line = Text("  · ", style=theme.FAINT)
         for text, style in parts:
-            if text.startswith("fp "):
-                style = theme.PINK
             line.append(text, style=style)
         return line
 
     # ── brand mark ──
     _stdout.print()
-    _screen_started = True
-    _stdout.print(wordmark())
+    _stdout.print(Text("  ◆ fp", style=f"bold {theme.ACCENT}"))
 
     # ── getting started ──
     _stdout.print()
@@ -660,7 +636,7 @@ def _bullet(*parts) -> Text:
                   Text(" or set ", style=theme.FAINT) +
                   Text("FP_DASHBOARD_URL", style=theme.TEXT_DIM) +
                   Text("; saved after login.)", style=theme.FAINT))
-    _stdout.print(_bullet(("sign in with the 6-digit code emailed to you.  self-signed dashboard? add ", theme.TEXT),
+    _stdout.print(_bullet(("authorize the link in your browser, or press tab for a code by email.  self-signed dashboard? add ", theme.TEXT),
                           ("--insecure", theme.ACCENT), (".", theme.TEXT)))
     _stdout.print(_bullet(("then: ", theme.TEXT), ("fp whoami", theme.ACCENT),
                           ("   ", theme.FAINT), ("fp --json sessions --since 24h", theme.ACCENT)))
@@ -678,9 +654,9 @@ def _bullet(*parts) -> Text:
         glob.append(g, style=theme.TEXT_DIM)
     _stdout.print(glob)
     eg = Text("    e.g.  ")
-    eg.append("fp --json events ", style=theme.PINK)
+    eg.append("fp --json events ", style=theme.TEXT_DIM)
     eg.append("✓", style=theme.SUCCESS)
-    eg.append("     fp events --json ", style=theme.PINK)
+    eg.append("     fp events --json ", style=theme.TEXT_DIM)
     eg.append("✗", style=theme.ERROR)
     _stdout.print(eg)
     mt = Text("    multi-tenant: set the org at login (", style=theme.FAINT)
@@ -730,7 +706,7 @@ def _bullet(*parts) -> Text:
             if hint:
                 cell.append("  ·  ", style=theme.FAINT)
                 cell.append(hint, style=theme.FAINT)
-            table.add_row(Text(name, style=theme.PINK), cell)
+            table.add_row(Text(name, style=theme.BLUE), cell)
     footer = Text()
     footer.append("run ", style=theme.FAINT)
     footer.append("fp <command> --help", style=theme.TEXT_DIM)
@@ -751,7 +727,7 @@ def _bullet(*parts) -> Text:
     ex.add_column(no_wrap=True)
     ex.add_column(no_wrap=True, overflow="ellipsis", max_width=max(SCORES_MIN_WIDTH, min(_stdout.width, 110) - 56))
     for cmd, why in _TOP_LEVEL_EXAMPLES:
-        ex.add_row(Text(cmd, style=theme.PINK), Text(why, style=theme.TEXT_DIM))
+        ex.add_row(Text(cmd, style=theme.ACCENT), Text(why, style=theme.TEXT_DIM))
     _stdout.print(Padding(ex, (0, 0, 0, 2)))
 
     _stdout.print()
@@ -1020,7 +996,6 @@ def render_whoami(
     """The logged-in ``whoami`` view (stdout): an identity header, then the shared
     permissions + orgs panels. Presentation only; no legend."""
     c = _stdout
-    screen_header(c)
 
     # ── identity header (no box) ──
     c.print()
@@ -1131,14 +1106,14 @@ def render_org_perms(*, slug: str, role: str, permissions: Sequence[str],
 # The picker frame and the switched card share the same rounded Panel shell as every other
 # boxed view (only the border colour + contents differ), so they read as one system.
 
-_PICKER_FOOTER = "↑↓ move · ⏎ select · esc cancel"
+_PICKER_FOOTER = "↑↓ move · enter select · esc cancel"
 
 
 def org_picker_frame(orgs: Sequence[dict], idx: int):
     """One frame of the interactive ``orgs switch`` picker (a renderable, redrawn in place by the
     caller's ``Live``): a rounded ACCENT panel ``switch org · {n} available``; one row per org with
     a ``❯`` pointer (ACCENT) on row ``idx`` — the selected slug bright (TEXT), others dim — and a
-    ``● current`` (SUCCESS) / ``○`` (FAINT) status. Footer ``↑↓ move · ⏎ select · esc cancel`` in
+    ``● current`` (SUCCESS) / ``○`` (FAINT) status. Footer ``↑↓ move · enter select · esc cancel`` in
     the bottom border. NO_COLOR keeps the box, pointer, and ●/○ shapes (colour drops out)."""
     table = Table(box=None, pad_edge=False, show_header=False, padding=(0, 2, 0, 0))
     table.add_column(no_wrap=True)  # pointer
@@ -1158,7 +1133,7 @@ def org_picker_frame(orgs: Sequence[dict], idx: int):
     panel = Panel(table, box=ROUNDED, border_style=theme.ACCENT, title=title, title_align="left",
                   padding=(0, 1), expand=False)
     # The key hint rides as a FAINT line just beneath the panel (always fits — no border
-    # truncation of the wide ⏎/arrow glyphs), aligned under the box.
+    # truncation of the wide arrow glyphs), aligned under the box.
     footer = Text("  " + _PICKER_FOOTER, style=theme.FAINT)
     return Group(Padding(panel, (0, 0, 0, 2)), footer)
 
@@ -1942,6 +1917,9 @@ def _errors_title(count: int, order: Optional[str], days) -> Text:
     return t
 
 
+ERRORS_SUMMARY_MIN_WIDTH = 28
+
+
 def render_errors(items: Sequence[Any], *, order: Optional[str] = None, full_ids: bool = False,
                   empty_message: str = "no errors") -> None:
     """The ``errors`` list view (stdout): an error-themed (muted red-purple border) boxed table —
@@ -1968,7 +1946,8 @@ def render_errors(items: Sequence[Any], *, order: Optional[str] = None, full_ids
             max((len(x) for x in agents), default=0),
             max((len(x) for x in sessions), default=0),
         ))
-        budget = max(SCORES_MIN_WIDTH, _stdout.width - fixed - _LIST_CHROME)
+        # Full ids can fill the row: keep the summary readable, and let the long ids wrap instead.
+        budget = max(ERRORS_SUMMARY_MIN_WIDTH, _stdout.width - fixed - _LIST_CHROME)
 
     rows = []
     for i, e in enumerate(items):
@@ -2758,13 +2737,13 @@ def _sql_syntax_theme():
         class _FpSqlStyle(Style):
             background_color = "#0e0c12"  # overridden by Syntax(background_color="default")
             styles = {
-                Token: "",
+                Token: theme.TEXT,
                 Comment: f"italic {theme.FAINT}",
                 Keyword: f"bold {theme.ACCENT}",
                 Keyword.Type: theme.SCORE_HIGH,
                 Operator: theme.TEXT_DIM,
                 Operator.Word: f"bold {theme.ACCENT}",  # AND / OR / NOT
-                Name: "",
+                Name: theme.TEXT,
                 Name.Builtin: theme.SUCCESS,
                 Name.Function: theme.SUCCESS,
                 Name.Variable: theme.PERM_WRITE,  # :name / @var params
@@ -2896,8 +2875,6 @@ def _plain(*parts, console=None) -> None:
     ``--quiet`` for non-error chrome; callers that must always show pass ``console``)."""
     line = Text("  ")
     for text, style in parts:
-        if text.startswith("fp "):
-            style = theme.PINK
         line.append(text, style=style)
     (console or _stderr).print(line)
 
diff --git a/fp-cloud-cli/fp_cli/select.py b/fp-cloud-cli/fp_cli/select.py
index 92175c205..df61d5854 100644
--- a/fp-cloud-cli/fp_cli/select.py
+++ b/fp-cloud-cli/fp_cli/select.py
@@ -25,6 +25,14 @@ def stdin_is_tty() -> bool:  # noqa: D401
         return False
 
 
+def stderr_is_tty() -> bool:
+    """True iff stderr is an interactive terminal, so a person can see what's written there."""
+    try:
+        return sys.stderr.isatty()
+    except Exception:
+        return False
+
+
 def choose_org(slugs: Sequence[str], default: Optional[str] = None) -> str:
     """Render ``slugs`` and prompt until the user picks one (by slug or number).
 
@@ -160,6 +168,15 @@ class LoginCancelled(Exception):
     """The user pressed Esc / Ctrl-C during the login flow (calm cancel, not an error)."""
 
 
+class SwitchSignIn(Exception):
+    """Tab at the email or the link: the other way of signing in. ``typed`` is what the email
+    field held, to put back when the person returns to it."""
+
+    def __init__(self, typed: str = "") -> None:
+        super().__init__()
+        self.typed = typed
+
+
 def login_box_supported() -> bool:
     """True iff the single-box interactive login can run (real TTY on stdin+stderr + termios) —
     otherwise ``login`` uses the plain prompt flow (tests, pipes, CI, ``--json``)."""
@@ -175,9 +192,11 @@ class LoginBox:
     def __init__(self) -> None:
         self.done: List = []      # collapsed ✓ steps: (label, value)
         self.active: Optional[str] = None
+        self.link = None          # the browser link on offer, kept while Tab goes to email and back
         self._fd = sys.stdin.fileno()
         self._old = None
         self._live = None
+        self._link_rows = 0       # rows `show_link` printed above the live part
 
     def __enter__(self) -> "LoginBox":
         import termios
@@ -202,17 +221,26 @@ def __exit__(self, *exc) -> None:
             termios.tcsetattr(self._fd, termios.TCSADRAIN, self._old)
 
     def _draw(self, **kw) -> None:
+        if self._link_rows:  # take down what `show_link` printed
+            from rich.control import Control
+            from rich.segment import ControlType
+            from rich.text import Text
+
+            self._live.update(Text(""), refresh=True)  # the cursor is now just under those rows
+            up_and_erase = ((ControlType.CURSOR_UP, 1), (ControlType.ERASE_IN_LINE, 2))
+            self._live.console.control(Control(*up_and_erase * self._link_rows))
+            self._link_rows = 0
         self._live.update(output.render_login_frame(self.done, self.active, **kw))
         self._live.refresh()
 
-    def _read_line(self, *, helper, slots, error) -> str:
+    def _read_line(self, *, helper, slots, error, value: str = "", tab: bool = False) -> str:
         """Read one line in raw mode, redrawing the frame on every keystroke so the typed text
         appears INSIDE the box (echo is off). Backspace edits; Enter accepts; Esc / Ctrl-C / EOF
         cancel (an arrow escape-sequence mid-type is swallowed, not a cancel). A ``slots`` field
-        accepts digits only, capped at ``slots``."""
+        accepts digits only, capped at ``slots``. With ``tab``, Tab raises ``SwitchSignIn``."""
         import select as _sel
 
-        buf = ""
+        buf = value
         self._draw(active_value=buf, active_slots=slots, helper=helper, error=error)
         while True:
             try:
@@ -225,6 +253,9 @@ def _read_line(self, *, helper, slots, error) -> str:
                 return buf
             if ch == b"\x03":  # Ctrl-C as a byte (if signals were off)
                 raise LoginCancelled()
+            if ch == b"\t" and tab:
+                self.active = None
+                raise SwitchSignIn(buf)
             if ch == b"\x1b":  # Esc, or the start of an arrow escape sequence
                 r, _, _ = _sel.select([self._fd], [], [], 0.0008)
                 if r:
@@ -248,16 +279,18 @@ def _read_line(self, *, helper, slots, error) -> str:
 
     def text_step(self, label: str, *, helper=None, slots=None, validate=None,
                   error_msg=None, hidden_value: bool = False, collapse: bool = True,
-                  initial_error=None) -> str:
+                  initial_error=None, value: str = "", tab: bool = False) -> str:
         """Run one bright ``❯ {label}`` input step; on a failed ``validate`` show the error sub-line
         and re-prompt. On accept it collapses to a dim ``✓ {label} {value}`` line (the value is
         omitted when ``hidden_value``). With ``collapse=False`` it returns the value WITHOUT adding
         the ✓ line (the caller verifies it over the network first, then calls ``note``); ``initial_error``
-        seeds the error sub-line on the first draw (a re-prompt after a wrong code)."""
+        seeds the error sub-line on the first draw (a re-prompt after a wrong code). ``value`` starts
+        the field with text in it, and ``tab`` makes Tab raise ``SwitchSignIn``."""
         self.active = label
         error = initial_error
         while True:
-            buf = self._read_line(helper=helper, slots=slots, error=error).strip()
+            buf = self._read_line(helper=helper, slots=slots, error=error, value=value, tab=tab).strip()
+            value = ""
             if validate is None or validate(buf):
                 self.active = None
                 if collapse:
@@ -280,6 +313,51 @@ def retry_text(self, message: str) -> None:
         # text_step's own loop shows the error; this is for the verify-fail re-prompt path.
         self._draw(error=message)
 
+    def show_link(self, intro: str, url: str) -> None:
+        """Put a link in the box. It's printed, not drawn: the frame redraws on every tick, which
+        clears a person's selection, and Rich would break a long link across lines, where it
+        can't be clicked or copied whole. Only the waiting line under it stays live, and the next
+        frame takes it all down again."""
+        from rich.text import Text
+
+        self._live.update(Text(""), refresh=True)
+        self._link_rows = output.print_login_link(self.done, intro, url)
+
+    def waiting(self, line: str, keys: str) -> None:
+        """Redraw the live part under a link, leaving the link alone."""
+        self._live.update(output.render_login_waiting(line, keys))
+        self._live.refresh()
+
+    def wait_key(self, seconds: float) -> Optional[str]:
+        """Up to ``seconds`` for a keypress: its token, or ``None``. Esc / Ctrl-C raise
+        ``LoginCancelled``."""
+        import select as _sel
+
+        try:
+            ready, _, _ = _sel.select([self._fd], [], [], seconds)
+            key = _read_key(self._fd) if ready else None
+        except KeyboardInterrupt:
+            raise LoginCancelled()
+        if key in ("ESC", "CTRL_C", "EOF"):
+            raise LoginCancelled()
+        return key
+
+    def link_ended(self, message: str) -> None:
+        """A link that can't be used any more, inside the box. Returns on Enter, for a new link.
+        Tab raises ``SwitchSignIn``; Esc and Ctrl-C raise ``LoginCancelled``."""
+        self._draw(failed=(message, "enter new link · tab use email · esc cancel"))
+        while True:
+            try:
+                key = _read_key(self._fd)
+            except KeyboardInterrupt:
+                raise LoginCancelled()
+            if key == "ENTER":
+                return
+            if key == "\t":
+                raise SwitchSignIn()
+            if key in ("ESC", "CTRL_C", "EOF"):
+                raise LoginCancelled()
+
     def pick(self, slugs: Sequence[str], *, default: Optional[str] = None) -> str:
         """The nested org-picker inset: arrow keys move the cursor, Enter selects (collapses to
         ``✓ org {slug}``), Esc / Ctrl-C raise ``LoginCancelled``."""
@@ -314,6 +392,7 @@ def finish(self, email: str, org: Optional[str]) -> None:
     def cancel(self, persisted: bool) -> None:
         """Render the calm close — ``○ cancelled — not signed in`` (or ``○ signed in · pick an org …``
         when the session was already persisted)."""
+        self.active = None  # the step that was asking is over, so no prompt is left behind
         self._draw(cancelled=bool(persisted))
 
     def fail(self, message: str, hint: Optional[str] = None) -> None:
diff --git a/fp-cloud-cli/fp_cli/theme.py b/fp-cloud-cli/fp_cli/theme.py
index 7da050919..ff4fccd95 100644
--- a/fp-cloud-cli/fp_cli/theme.py
+++ b/fp-cloud-cli/fp_cli/theme.py
@@ -6,35 +6,35 @@
 
 from __future__ import annotations
 
-ACCENT = "#66d1b5"    # mint: active and successful states
-TEXT = "default"     # the terminal's foreground (also works on light themes)
-TEXT_DIM = "#767f8b"
-LABEL = "#767f8b"    # grey labels and metadata
-FAINT = "#767f8b"
-THIN_RULE = "#3e434c"
-BAR_EMPTY = "#3e434c"
-INSET_BG = "default"
+ACCENT = "#9d7bff"    # brand mark, box borders, active org, command names in hints
+TEXT = "#d8d2dd"      # primary values
+TEXT_DIM = "#7d7488"  # ids, resource names, org names
+LABEL = "#6b6478"     # field labels, header cells, hints
+FAINT = "#5a5266"     # separators, inactive markers
+THIN_RULE = "#2e2435" # the faint rule beneath a list-panel header
+BAR_EMPTY = "#2a2530" # the unfilled cells of a mini-bar (e.g. the aggregate avg bar)
+INSET_BG = "#231e2d"  # a hair-lighter fill for a nested inset box (the login org picker)
 
 # Errors theme — the one per-command border deviation (the `errors` list + aggregate card).
 # Always red, regardless of error count, so the two views read as one consistent family.
-BORDER_ERROR = "#e4587d"
-TITLE_ERROR_DIM = LABEL
-RULE_ERROR = THIN_RULE
+BORDER_ERROR = "#e2564a"  # red → the errors panel border (same as ERROR; consistent, not count-dependent)
+TITLE_ERROR_DIM = "#6e3530"  # dim red → the errors title's non-name part + card separators
+RULE_ERROR = "#3a2d2d"  # dim red → the errors list header rule (vs the neutral THIN_RULE)
 
 # Semantic value colors — for run/job states and score thresholds. (They coincide with
 # the perm risk colors below; named separately so the two uses can diverge later.)
-SUCCESS = ACCENT
-PINK = "#e4587d"      # pink: commands, selection and attention
-AMBER = PINK
-ERROR = PINK
-SCORE_HIGH = ACCENT
-BLUE = ACCENT
+SUCCESS = "#5dcaa5"   # green     → run status: done/passed
+AMBER = "#ef9f27"     # amber     → run status: running/pending · score band .50–.80
+ERROR = "#e2564a"     # red       → run status: failed/error · score band < .50
+SCORE_HIGH = "#3ddbb8"  # cyan-green → score band ≥ .80 (distinct from status green)
+BLUE = "#6b86d8"      # blue      → schema uuid/timestamp type category
+PINK = "#d4537e"      # pink      → numeric values (query run cells / scalar card) + numeric type category
 
 # Permission verb colors — by ACTION (the part after `:`), never by resource.
-PERM_READ = ACCENT
-PERM_WRITE = PINK
-PERM_ACTION = PINK
-PERM_DANGER = PINK
+PERM_READ = "#5dcaa5"    # green  → read
+PERM_WRITE = "#d4537e"   # pink   → add, create, write, update
+PERM_ACTION = "#ef9f27"  # amber  → use, trigger, run, ack
+PERM_DANGER = "#e2564a"  # red    → delete, disable, regenerate
 
 PERM_COLORS = {
     "read": PERM_READ,
diff --git a/fp-cloud-cli/skill/SKILL.md b/fp-cloud-cli/skill/SKILL.md
index e1a3c5ef5..bc151c01d 100644
--- a/fp-cloud-cli/skill/SKILL.md
+++ b/fp-cloud-cli/skill/SKILL.md
@@ -50,7 +50,7 @@ Throughout this skill, `fp` means "whichever form you resolved."
 
   | | How you supply it | What it is |
   |---|---|---|
-  | **Session** | `fp login` (interactive; it emails a one-time code) | a signed-in **user**, carrying that person's org memberships and permissions |
+  | **Session** | `fp login` (interactive; a browser link or an emailed one-time code) | a signed-in **user**, carrying that person's org memberships and permissions |
   | **API key** | `--api-key <key>`, or `FP_API_KEY` in the environment | a scoped **credential**, carrying exactly the permissions it was granted |
 
   A key is what you want in CI or any other non-interactive context: no browser, no
@@ -112,8 +112,8 @@ Throughout this skill, `fp` means "whichever form you resolved."
 Before real work, run `fp --json whoami` and react to the exit code:
 
 - **exit 4** → no usable credential. If the user is working from a session, tell
-  them to run `fp login` (it emails a one-time code and prompts
-  interactively — you can't complete it for them, and don't fabricate a token).
+  them to run `fp login` in their own terminal (they authorize a browser link or
+  paste an emailed code — you can't complete it for them, and don't fabricate a token).
   If a key was supplied, the key itself was rejected — say so and stop; logging in
   is not the fix, and silently switching to a session would run the command as a
   different identity than the user asked for.
diff --git a/fp-cloud-cli/skill/references/commands.md b/fp-cloud-cli/skill/references/commands.md
index 9bbf6ee9b..dbe7f2115 100644
--- a/fp-cloud-cli/skill/references/commands.md
+++ b/fp-cloud-cli/skill/references/commands.md
@@ -72,7 +72,7 @@ Exactly one credential is in play per invocation, chosen in this order:
 ## Identity
 
 ### login / logout / whoami
-- `fp login [--email you@x.com] [--org <slug>]` — emails a one-time code; on a real TTY it's a single interactive box, else a plain prompt. Saves the session to `~/.failproofai/fpcli/cli-auth.json` (was `~/.fp/cli.json`; a session at the old path is adopted automatically on the next command, so an upgrade signs nobody out). **You cannot complete this for the user** (it needs the emailed code). `--org` picks the tenant at login. **Session-only** — exit 2 under a key.
+- `fp login [--email you@x.com] [--org <slug>]` — on a real TTY, a single interactive box asking browser (authorize a link) or email (a one-time code); `--email`, `--json` and anything without a terminal go straight to the code at a plain prompt. Saves the session to `~/.failproofai/fpcli/cli-auth.json` (was `~/.fp/cli.json`; a session at the old path is adopted automatically on the next command, so an upgrade signs nobody out). **You cannot complete this for the user** (it needs their browser or their emailed code). `--org` picks the tenant at login. **Session-only** — exit 2 under a key.
 - `fp logout` — clears the saved session. **Session-only** — exit 2 under a key (a key cannot be "logged out"; revoke it instead).
 - `fp whoami` — active org + your permissions. Run this first; exit 4 = no usable credential.
   **Under a key it answers a different question and still exits 0:** it reports that there is no signed-in user, names the auth mode, and gives the org it will act on. So branch on the auth mode, not on the absence of a user identity — and note that it does not prove the key is accepted or check any permission. Let the first real read do that.
@@ -385,8 +385,8 @@ Unknown-route 404s exit 6 with “not available on this FailproofAI Cloud yet”
 Missing-record 404s also exit 6 but preserve the server's record-not-found message;
 an empty response on a record-scoped request identifies the missing record path.
 Session-only commands exit 2 before HTTP in key mode.
-Human output uses mint/pink open screens and full ids; legacy `--full-ids`
-remains accepted. Exports refuse to overwrite existing files.
+Human output uses rounded panels and full ids, which wrap rather than being cut;
+legacy `--full-ids` remains accepted. Exports refuse to overwrite existing files.
 
 Use global `--json` for API objects or `--out` to save a session/query JSON
 export. Without either, human mode renders a readable view rather than raw
diff --git a/fp-cloud-cli/tests/fake_cloud_smoke.py b/fp-cloud-cli/tests/fake_cloud_smoke.py
index ff7ee87ac..2717d4e5c 100644
--- a/fp-cloud-cli/tests/fake_cloud_smoke.py
+++ b/fp-cloud-cli/tests/fake_cloud_smoke.py
@@ -299,9 +299,9 @@ def run(argv, *, input=None, key=False, json_mode=True, expected=0):
         assert proc.returncode == 0 and sent, transcript[-1]
         assert Cloud.answers[-1]["decision"] == "approve"
         # CI may force colour even with NO_COLOR, inserting ANSI spans inside
-        # the wordmark. Compare visible text without weakening the order check.
+        # the text. Compare visible text.
         rendered = re.sub(r"\x1b\[[0-?]*[ -/]*[@-~]", "", output.decode(errors="replace"))
-        assert rendered.index("failproof ai") < rendered.index("EVENTS BY AGENT")
+        assert "EVENTS BY AGENT" in rendered
     server.shutdown()
     (artifacts / "fp-user-smoke.txt").write_text("\n".join(transcript), encoding="utf-8")
     (artifacts / "fp-fake-cloud-requests.json").write_text(json.dumps(Cloud.requests, indent=2), encoding="utf-8")
diff --git a/fp-cloud-cli/tests/test_browser_login.py b/fp-cloud-cli/tests/test_browser_login.py
new file mode 100644
index 000000000..5cda84420
--- /dev/null
+++ b/fp-cloud-cli/tests/test_browser_login.py
@@ -0,0 +1,943 @@
+"""`fp login` from a browser: the client half of `/api/auth/cli/*`, and the plain flow.
+
+The box itself needs a real terminal, so `__tests__/e2e/layout/fp-login.sh` drives it
+through a pty against a real stack. What is pinned here is everything that decides
+what a server's answer means, because each mistake there is silent: a Cloud that drops
+`kind` hands back a machine key, and a poll that gives up reads as a person's "no".
+"""
+
+from __future__ import annotations
+
+import io
+import json
+import time
+from types import SimpleNamespace
+
+import httpx
+import pytest
+import respx
+from rich.console import Console
+from rich.live import Live
+
+from fp_cli import auth, config, output
+from fp_cli import select as selectmod
+from fp_cli._context import AppState
+from fp_cli.app import app
+from fp_cli.commands import auth_cmds
+from fp_cli.errors import ApiError, AuthError, NetworkError
+
+BASE = "http://dash.test"
+LINK = f"{BASE}/cli/authorize?r=abc"
+STARTED = {
+    "verification_url": LINK,
+    "poll_secret": "POLL",
+    "expires_in": 600,
+    "interval": 2,
+    "kind": "session",
+}
+SESSION = {
+    "id": "u1",
+    "email": "me@test",
+    "is_instance_admin": False,
+    "memberships": [
+        {"org_id": "o1", "org_slug": "acme", "org_name": "Acme", "permissions": [], "permission_set": "admin"}
+    ],
+}
+CLAIMED = {"session_token": "tok-browser", "expires_in_secs": 3600, "user": {"id": "u1", "email": "me@test"}}
+
+
+def _start(**over):
+    return httpx.Response(over.pop("status", 201), json={**STARTED, **over})
+
+
+# --- start ------------------------------------------------------------------
+
+
+@respx.mock
+def test_start_asks_for_a_session_and_names_the_machine():
+    route = respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
+    login = auth.start_browser_login(BASE)
+    assert login == auth.BrowserLogin(LINK, "POLL", 600, 2)
+    sent = json.loads(route.calls[0].request.content)
+    assert sent["kind"] == "session"
+    assert sent["machine_label"]
+    assert sent["cli_version"].startswith("fp ")
+
+
+@respx.mock
+@pytest.mark.parametrize(
+    "response",
+    [
+        httpx.Response(404),
+        httpx.Response(302, headers={"location": f"{BASE}/login"}),
+        httpx.Response(200, text="<html>a page, not this API</html>"),
+        # A Cloud with `failproofai config`'s login but not this: it dropped `kind`,
+        # and approving this request would end in a machine key.
+        httpx.Response(201, json={k: v for k, v in STARTED.items() if k != "kind"}),
+        httpx.Response(201, json={**STARTED, "kind": "machine_key"}),
+        httpx.Response(201, json={"kind": "session"}),
+        httpx.Response(201, json={**STARTED, "poll_secret": ""}),
+    ],
+)
+def test_a_cloud_that_cannot_do_this_reads_as_unsupported(response):
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=response)
+    assert auth.start_browser_login(BASE) is None
+
+
+@respx.mock
+@pytest.mark.parametrize(
+    "url",
+    [
+        "file:///etc/passwd",
+        "javascript:alert(1)",
+        "ssh://dash.test",
+        "http://",
+        "https://:443/cli/authorize?r=abc",
+        "https://dash.test:99999/cli/authorize?r=abc",
+        "https://dash.test:0/cli/authorize?r=abc",
+        "https://[broken/cli/authorize?r=abc",
+        f"{LINK}\x1b]0;pwned\x07",
+        f"{LINK} --and-more",
+        None,
+    ],
+)
+def test_only_a_plain_http_link_is_ever_printed_or_opened(url):
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start(verification_url=url))
+    assert auth.start_browser_login(BASE) is None
+
+
+@respx.mock
+def test_start_failures_say_what_kind_of_failure_they_are():
+    route = respx.post(f"{BASE}/api/auth/cli/start")
+    route.mock(return_value=httpx.Response(429, json={"error": "rate_limited"}))
+    with pytest.raises(ApiError, match="Too many"):
+        auth.start_browser_login(BASE)
+    route.mock(return_value=httpx.Response(502, json={"error": "upstream unreachable"}))
+    with pytest.raises(NetworkError):
+        auth.start_browser_login(BASE)
+    route.mock(return_value=httpx.Response(422, json={"error": "machine_label_required"}))
+    with pytest.raises(ApiError, match="HTTP 422"):
+        auth.start_browser_login(BASE)
+    route.mock(side_effect=httpx.ConnectError("no route"))
+    with pytest.raises(NetworkError):
+        auth.start_browser_login(BASE)
+
+
+@respx.mock
+def test_a_servers_numbers_are_kept_to_a_range_this_client_can_live_with():
+    route = respx.post(f"{BASE}/api/auth/cli/start")
+    route.mock(return_value=_start(expires_in=10**9, interval=0.001))
+    login = auth.start_browser_login(BASE)
+    assert (login.expires_in, login.interval) == (3600, 1)
+    route.mock(return_value=_start(expires_in="soon", interval=True))
+    login = auth.start_browser_login(BASE)
+    assert (login.expires_in, login.interval) == (600, 2)
+    # JSON integers have no size limit, and a float can be infinite.
+    route.mock(return_value=_start(expires_in=10**400, interval=10**400))
+    login = auth.start_browser_login(BASE)
+    assert (login.expires_in, login.interval) == (3600, 30)
+    route.mock(return_value=httpx.Response(201, text=json.dumps(STARTED).replace("600", "Infinity")))
+    assert auth.start_browser_login(BASE).expires_in == 600
+
+
+# --- poll -------------------------------------------------------------------
+
+
+@respx.mock
+@pytest.mark.parametrize(
+    "status", ["pending", "slow_down", "approved", "denied", "expired", "claimed"]
+)
+def test_poll_reports_each_status(status):
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(return_value=httpx.Response(200, json={"status": status}))
+    assert auth.poll_browser_login(BASE, "POLL") == status
+
+
+@respx.mock
+def test_poll_tells_unknown_from_try_again():
+    route = respx.post(f"{BASE}/api/auth/cli/poll")
+    route.mock(return_value=httpx.Response(404, json={"status": "unknown"}))
+    assert auth.poll_browser_login(BASE, "POLL") == "unknown"
+    route.mock(return_value=httpx.Response(200, json={"status": "something new"}))
+    assert auth.poll_browser_login(BASE, "POLL") == "unknown"
+    for answer in (httpx.Response(500), httpx.Response(200, text="not json")):
+        route.mock(return_value=answer)
+        with pytest.raises(NetworkError):
+            auth.poll_browser_login(BASE, "POLL")
+
+
+def _quick(expires_in=60.0):
+    return auth.BrowserLogin(LINK, "POLL", expires_in, 0.0)
+
+
+@respx.mock
+def test_waiting_carries_on_through_a_dropped_connection():
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(
+        side_effect=[
+            httpx.Response(200, json={"status": "pending"}),
+            httpx.ConnectError("wifi went away"),
+            httpx.Response(500),
+            httpx.Response(200, json={"status": "slow_down"}),
+            httpx.Response(200, json={"status": "approved"}),
+        ]
+    )
+    seen = []
+    # `slow_down` adds a second before the next poll: the tick is what passes it.
+    def tick(_left, offline):
+        seen.append(offline)
+        time.sleep(0.05)
+
+    assert auth.await_browser_approval(BASE, _quick(), tick=tick) == "approved"
+    assert True in seen, "a dropped connection is shown to the person"
+    assert seen[-1] is False, "and clears once the server answers"
+
+
+@respx.mock
+@pytest.mark.parametrize("final", ["denied", "expired", "claimed"])
+def test_waiting_ends_on_any_final_answer(final):
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(return_value=httpx.Response(200, json={"status": final}))
+    assert auth.await_browser_approval(BASE, _quick(), tick=lambda *_: None) == final
+
+
+@respx.mock
+def test_waiting_gives_up_when_the_link_runs_out():
+    route = respx.post(f"{BASE}/api/auth/cli/poll")
+    assert auth.await_browser_approval(BASE, _quick(expires_in=0.0), tick=lambda *_: None) == "expired"
+    assert not route.called
+
+
+@respx.mock
+def test_coming_back_to_a_link_keeps_its_countdown():
+    # Tab away and back must not promise ten more minutes the server won't honour.
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(return_value=httpx.Response(200, json={"status": "approved"}))
+    left = []
+    old = auth.BrowserLogin(LINK, "POLL", 60.0, 0.0, started=time.monotonic() - 50.0)
+    auth.await_browser_approval(BASE, old, tick=lambda seconds, _offline: left.append(seconds))
+    assert left and left[0] <= 10.0
+    gone = auth.BrowserLogin(LINK, "POLL", 60.0, 0.0, started=time.monotonic() - 61.0)
+    assert auth.await_browser_approval(BASE, gone, tick=lambda *_: None) == "expired"
+
+
+# --- claim ------------------------------------------------------------------
+
+
+@respx.mock
+def test_claim_returns_the_session_in_the_shape_of_the_emailed_code():
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(return_value=httpx.Response(201, json=CLAIMED))
+    assert auth.claim_browser_login(BASE, "POLL") == ("tok-browser", 3600, CLAIMED["user"])
+
+
+@respx.mock
+@pytest.mark.parametrize("lifetime,saved", [(10**400, 30 * 86400), (0, 86400), ("soon", 86400), (None, 86400)])
+def test_a_servers_session_lifetime_cannot_crash_saving_it(home, lifetime, saved):
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(
+        return_value=httpx.Response(201, json={**CLAIMED, "expires_in_secs": lifetime})
+    )
+    token, expires_in, user = auth.claim_browser_login(BASE, "POLL")
+    assert expires_in == saved
+    auth.persist_session(config.load_config(), BASE, token, expires_in, user)
+    assert config.load_config().session_token == "tok-browser"
+
+
+@respx.mock
+def test_claim_refuses_anything_but_a_session():
+    route = respx.post(f"{BASE}/api/auth/cli/claim")
+    # What a machine-key request would answer. Never saved as if it were a session.
+    route.mock(return_value=httpx.Response(201, json={"api_key": "KEY", "key_id": "k"}))
+    with pytest.raises(AuthError):
+        auth.claim_browser_login(BASE, "POLL")
+    for status in (403, 409, 410):
+        route.mock(return_value=httpx.Response(status, json={"error": "approval_revoked"}))
+        with pytest.raises(AuthError) as err:
+            auth.claim_browser_login(BASE, "POLL")
+        assert err.value.hint == "run fp login again"
+    route.mock(return_value=httpx.Response(500))
+    with pytest.raises(NetworkError):
+        auth.claim_browser_login(BASE, "POLL")
+
+
+@respx.mock
+@pytest.mark.parametrize(
+    "user",
+    [None, {}, {"id": "u1"}, {"email": "me@test"}, {"id": "u1", "email": ""}, {"id": "u1", "email": "\x1b\u200b"}, "me"],
+)
+def test_a_claim_with_no_identity_is_no_login(user):
+    # `persist_session` keeps the previous identity when a field is missing, so this
+    # would otherwise save the new session under whoever was signed in before.
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(
+        return_value=httpx.Response(201, json={**CLAIMED, "user": user})
+    )
+    with pytest.raises(AuthError):
+        auth.claim_browser_login(BASE, "POLL")
+
+
+@respx.mock
+@pytest.mark.parametrize("token", ["☃☃☃", "abc\r\nx-evil: 1", "a b", "\x1b]0;x\x07", "x" * 5000, ""])
+def test_a_token_no_later_request_could_carry_is_never_saved(token):
+    # Saved, every later command fails on it, and a non-ASCII one with a traceback.
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(
+        return_value=httpx.Response(201, json={**CLAIMED, "session_token": token})
+    )
+    with pytest.raises(AuthError):
+        auth.claim_browser_login(BASE, "POLL")
+
+
+@respx.mock
+@pytest.mark.parametrize(
+    "hostname,label",
+    [("ho\udcffst", "ho?st"), ("\x01\x02", "unknown"), ("   ", "unknown"), ("", "unknown"), ("a\x1b]0;x\x07b", "a]0;xb")],
+    ids=["not-utf8", "controls", "spaces", "empty", "escape"],
+)
+def test_any_hostname_still_starts_a_login(monkeypatch, hostname, label):
+    # JSON can't carry a surrogate, which is how Python hands back bytes that aren't UTF-8,
+    # and the server refuses a label with nothing left in it.
+    monkeypatch.setattr(auth.socket, "gethostname", lambda: hostname)
+    route = respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
+    assert auth.start_browser_login(BASE) is not None
+    assert json.loads(route.calls[0].request.content)["machine_label"] == label
+
+
+@respx.mock
+def test_what_the_server_says_about_the_person_cannot_drive_the_terminal():
+    evil = "me\x1b]0;pwned\x07@te‮st\x1b[2J"
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(
+        return_value=httpx.Response(201, json={**CLAIMED, "user": {"id": "u1", "email": evil}})
+    )
+    _, _, user = auth.claim_browser_login(BASE, "POLL")
+    assert user["email"] == "me]0;pwned@test[2J"
+    assert auth.display_text("\x1b​  ") is None
+    assert auth.display_text(7) is None
+
+
+# --- opening a browser ------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "env,platform,expected",
+    [
+        ({"DISPLAY": ":0"}, "linux", True),
+        ({"WAYLAND_DISPLAY": "wayland-0"}, "linux", True),
+        ({}, "linux", False),
+        ({"DISPLAY": ":0", "SSH_TTY": "/dev/pts/1"}, "linux", False),
+        ({"SSH_CONNECTION": "1.2.3.4 1 5.6.7.8 22"}, "darwin", False),
+        ({"SSH_CLIENT": "1.2.3.4 1 22"}, "win32", False),
+        ({}, "darwin", True),
+        ({}, "win32", True),
+    ],
+)
+def test_a_browser_is_only_opened_where_a_person_can_see_it(env, platform, expected):
+    assert auth.can_open_browser(env, platform) is expected
+
+
+def test_opening_uses_the_platform_handler_detached_and_never_raises(monkeypatch):
+    calls = []
+
+    def popen(argv, **kw):
+        calls.append((argv, kw))
+
+    monkeypatch.setattr(auth.subprocess, "Popen", popen)
+    auth.open_url(LINK, "linux")
+    auth.open_url(LINK, "darwin")
+    assert [c[0] for c in calls] == [["xdg-open", LINK], ["open", LINK]]
+    assert calls[0][1]["start_new_session"] is True
+    assert calls[0][1]["stdin"] is auth.subprocess.DEVNULL
+
+    def missing(*_a, **_k):
+        raise FileNotFoundError("xdg-open")
+
+    monkeypatch.setattr(auth.subprocess, "Popen", missing)
+    auth.open_url(LINK, "linux")
+
+
+# --- the box, at the moment it claims ----------------------------------------
+
+
+class _Box:
+    """A login box with a queue of keys already pressed. `fp-login.sh` drives the real one."""
+
+    def __init__(self, *keys):
+        self.keys = list(keys)
+        self.ended = []
+        self.link = None
+        self.shown = []
+        self.notes = []
+
+    def working(self, _text):
+        pass
+
+    def show_link(self, intro, url):
+        self.shown.append((intro, url))
+
+    def note(self, label, value=None):
+        self.notes.append(label)
+
+    def waiting(self, _line, _keys):
+        pass
+
+    def link_ended(self, message):
+        self.ended.append((message, list(self.keys)))
+        raise selectmod.SwitchSignIn()  # as Tab there does: it gets a test out of the loop
+
+    def wait_key(self, _seconds):
+        key = self.keys.pop(0) if self.keys else None
+        if key == "ESC":
+            raise selectmod.LoginCancelled()
+        return key
+
+
+@pytest.fixture
+def approved_link(monkeypatch):
+    """A link whose last poll came back approved; returns the list of claims made."""
+    claims = []
+    monkeypatch.setattr(auth, "can_open_browser", lambda *_a: False)
+    monkeypatch.setattr(auth, "start_browser_login", lambda *_a, **_k: auth.BrowserLogin(LINK, "POLL", 60.0, 1.0))
+    monkeypatch.setattr(auth, "await_browser_approval", lambda *_a, **_k: "approved")
+
+    def claim(*_a, **_k):
+        claims.append(1)
+        return ("tok", 3600, CLAIMED["user"])
+
+    monkeypatch.setattr(auth, "claim_browser_login", claim)
+    return claims
+
+
+def _state():
+    return AppState(json=False, base_url=BASE, token=None, timeout=1.0, config=config.CliConfig())
+
+
+@pytest.mark.parametrize("before", [(), ("x",), ("UP",), ("", "")], ids=["alone", "letter", "arrow", "non-ascii"])
+def test_esc_pressed_during_the_last_poll_means_no_session(approved_link, before):
+    # A non-ASCII character reads as "", once per byte: not the end of the queue.
+    with pytest.raises(selectmod.LoginCancelled):
+        auth_cmds._browser_login_in_box(_state(), BASE, _Box(*before, "ESC"))
+    assert approved_link == []
+
+
+def test_any_other_key_pressed_during_the_last_poll_changes_nothing(approved_link):
+    assert auth_cmds._browser_login_in_box(_state(), BASE, _Box("x", "ENTER"))[0] == "tok"
+    assert approved_link == [1]
+
+
+@pytest.mark.parametrize("final", ["denied", "expired"])
+def test_enter_pressed_during_the_last_poll_cannot_answer_a_screen_nobody_saw(approved_link, monkeypatch, final):
+    # It would take the next link straight away, with the denial on screen for no time at all.
+    monkeypatch.setattr(auth, "await_browser_approval", lambda *_a, **_k: final)
+    box = _Box("ENTER", "")
+    with pytest.raises(selectmod.SwitchSignIn):
+        auth_cmds._browser_login_in_box(_state(), BASE, box)
+    assert [keys for _message, keys in box.ended] == [[]]
+    assert box.link is None, "the next time gets a new link, not this dead one"
+
+
+def test_esc_pressed_during_the_last_poll_of_a_denied_link_still_cancels(approved_link, monkeypatch):
+    monkeypatch.setattr(auth, "await_browser_approval", lambda *_a, **_k: "denied")
+    box = _Box("ESC")
+    with pytest.raises(selectmod.LoginCancelled):
+        auth_cmds._browser_login_in_box(_state(), BASE, box)
+    assert box.ended == []
+
+
+def test_tab_pressed_during_the_last_poll_means_no_session(approved_link):
+    box = _Box("x", "\t")
+    with pytest.raises(selectmod.SwitchSignIn):
+        auth_cmds._browser_login_in_box(_state(), BASE, box)
+    assert approved_link == []
+    assert box.link is not None, "the approval is still there to come back to"
+
+
+def test_tab_pressed_during_the_last_poll_of_a_denied_link_answers_nothing(approved_link, monkeypatch):
+    monkeypatch.setattr(auth, "await_browser_approval", lambda *_a, **_k: "denied")
+    box = _Box("\t")
+    with pytest.raises(selectmod.SwitchSignIn):  # raised by the denied screen, once shown
+        auth_cmds._browser_login_in_box(_state(), BASE, box)
+    assert [message for message, _keys in box.ended] == ["not authorized"]
+
+
+def test_tab_away_and_back_finds_the_same_link(approved_link, monkeypatch):
+    # Asking again would spend the rate limit, leave rows behind, and open another browser tab.
+    starts, opened = [], []
+
+    def start(*_a, **_k):
+        starts.append(1)
+        return auth.BrowserLogin(LINK, "POLL", 60.0, 1.0)
+
+    def waited(_base, _login, *, tick, **_k):
+        tick(60.0, False)
+        return "approved"
+
+    monkeypatch.setattr(auth, "start_browser_login", start)
+    monkeypatch.setattr(auth, "can_open_browser", lambda *_a: True)
+    monkeypatch.setattr(auth, "open_url", opened.append)
+    monkeypatch.setattr(auth, "await_browser_approval", waited)
+
+    box = _Box("\t")
+    with pytest.raises(selectmod.SwitchSignIn):
+        auth_cmds._browser_login_in_box(_state(), BASE, box)
+    assert auth_cmds._browser_login_in_box(_state(), BASE, box)[0] == "tok"
+
+    assert starts == [1]
+    assert opened == [LINK]
+    assert box.shown == [(auth_cmds._LINK_OPENING, LINK), (auth_cmds._LINK_ANYWHERE, LINK)]
+    assert approved_link == [1]
+
+
+def test_the_link_goes_on_screen_before_any_browser_opens(approved_link, monkeypatch):
+    box = _Box()
+    monkeypatch.setattr(auth, "can_open_browser", lambda *_a: True)
+    monkeypatch.setattr(auth, "open_url", lambda url: box.shown.append(("opened", url)))
+    auth_cmds._browser_login_in_box(_state(), BASE, box)
+    assert [what for what, _url in box.shown] == [auth_cmds._LINK_OPENING, "opened"]
+
+
+class _EmailBox(_Box):
+    """``text_step`` answers from a script: text to accept, or a Tab with what had been typed."""
+
+    def __init__(self, *steps):
+        super().__init__()
+        self.steps = list(steps)
+        self.asked = []
+
+    def text_step(self, label, *, helper=None, value="", tab=False, **_k):
+        self.asked.append((label, value, tab, helper))
+        step = self.steps.pop(0)
+        if isinstance(step, Exception):
+            raise step
+        return step
+
+
+@pytest.fixture
+def emailed_code(monkeypatch):
+    monkeypatch.setattr(auth, "request_otp", lambda *_a, **_k: None)
+    monkeypatch.setattr(auth, "verify_otp", lambda *_a, **_k: ("tok-otp", 3600, CLAIMED["user"]))
+
+
+def test_tab_at_the_link_goes_to_the_email_and_back_keeping_what_was_typed(emailed_code, monkeypatch):
+    def left(*_a, **_k):
+        raise selectmod.SwitchSignIn()
+
+    monkeypatch.setattr(auth_cmds, "_browser_login_in_box", left)
+    box = _EmailBox(selectmod.SwitchSignIn("me@te"), "me@test", "123456")
+
+    method, creds = auth_cmds._sign_in_in_box(_state(), BASE, box, None)
+
+    assert (method, creds[0]) == ("email", "tok-otp")
+    assert [(label, value, tab) for label, value, tab, _helper in box.asked] == [
+        ("email", "", True), ("email", "me@te", True), ("code", "", False),
+    ]
+    assert box.asked[0][3] == "enter send a code · tab SSO · esc cancel"
+
+
+def test_login_starts_on_the_link_and_never_asks_for_an_email(approved_link):
+    box = _EmailBox()
+    method, creds = auth_cmds._sign_in_in_box(_state(), BASE, box, None)
+    assert (method, creds[0]) == ("browser", "tok")
+    assert approved_link == [1]
+    assert box.asked == []
+    assert box.shown == [(auth_cmds._LINK_ANYWHERE, LINK)]
+
+
+def _uses_the_code(box):
+    label, value, tab, helper = box.asked[0]
+    assert (label, value, tab) == ("email", "", False)
+    assert "tab" not in helper
+
+
+def test_a_cloud_without_browser_login_uses_the_code_and_offers_no_tab(emailed_code, monkeypatch):
+    monkeypatch.setattr(auth, "start_browser_login", lambda *_a, **_k: None)
+    box = _EmailBox("me@test", "123456")
+
+    method, _creds = auth_cmds._sign_in_in_box(_state(), BASE, box, None)
+
+    assert method == "email"
+    assert box.notes[0] == auth_cmds._NO_BROWSER_LOGIN
+    _uses_the_code(box)
+
+
+@pytest.mark.parametrize(
+    "failure",
+    [ApiError("Too many login attempts", status=429), NetworkError("answered HTTP 502")],
+    ids=["rate-limited", "server-error"],
+)
+def test_failing_to_get_a_link_still_leaves_the_emailed_code(emailed_code, monkeypatch, failure):
+    # The link is only the default, so it must not be the only way in.
+    def refused(*_a, **_k):
+        raise failure
+
+    monkeypatch.setattr(auth, "start_browser_login", refused)
+    box = _EmailBox("me@test", "123456")
+
+    method, creds = auth_cmds._sign_in_in_box(_state(), BASE, box, None)
+
+    assert (method, creds[0]) == ("email", "tok-otp")
+    assert box.notes[0] == auth_cmds._NO_LINK_NOW
+    _uses_the_code(box)
+
+
+def test_a_claim_that_fails_is_not_mistaken_for_having_no_link(approved_link, monkeypatch):
+    # Someone approved this. Dropping to a code would hide why it didn't work.
+    def refused(*_a, **_k):
+        raise ApiError("approval_revoked", status=403)
+
+    monkeypatch.setattr(auth, "claim_browser_login", refused)
+    with pytest.raises(ApiError, match="approval_revoked"):
+        auth_cmds._sign_in_in_box(_state(), BASE, _EmailBox(), None)
+
+
+def test_the_email_flag_goes_straight_to_the_code(emailed_code, monkeypatch):
+    monkeypatch.setattr(auth, "start_browser_login", lambda *_a, **_k: pytest.fail("asked for a link"))
+    box = _EmailBox("123456")
+    assert auth_cmds._sign_in_in_box(_state(), BASE, box, "me@test")[0] == "email"
+    assert [label for label, *_rest in box.asked] == ["code"]
+
+
+LONG_LINK = "https://app.befailproof.ai/cli/authorize?r=" + "a" * 64  # 107 characters
+
+
+@pytest.mark.parametrize(
+    "width,indent,rows",
+    [(200, "  ", 1), (110, "  ", 1), (109, "  ", 1), (108, "", 1), (107, "", 1), (106, "", 2), (80, "", 2), (54, "", 2), (53, "", 3)],
+)
+def test_a_link_stays_whole_and_its_rows_are_counted(monkeypatch, width, indent, rows):
+    # Rich mustn't break it, and a wrong count leaves stray rows on screen or eats the ones above.
+    console = Console(file=io.StringIO(), force_terminal=True, width=width, color_system=None)
+    monkeypatch.setattr(output, "_stderr", console)
+
+    taken = output.print_login_link([("code", None)], "open this link:", LONG_LINK)
+
+    printed = console.file.getvalue()
+    # Right under the box, never inside its border. It lines up with the box when it fits, and
+    # starts at the margin when it doesn't, so its rows line up with each other.
+    under_the_box = printed.split("╯")[-1]
+    assert under_the_box.strip("\n ") == LONG_LINK
+    assert f"\n{indent}{LONG_LINK}\n" in under_the_box
+    box = ["╭─ ◆ fp ─╮", "welcome", "✓ code", "❯ open this link:", "╰────╯", "blank above the link"]
+    assert taken == len(box) + rows + len(["blank below the link"])
+
+
+def test_the_box_leaves_the_link_alone_until_it_takes_it_down_row_by_row(monkeypatch):
+    monkeypatch.setenv("TERM", "xterm")  # Live draws nothing on a dumb terminal
+    console = Console(file=io.StringIO(), force_terminal=True, width=80, color_system=None)
+    monkeypatch.setattr(output, "_stderr", console)
+    monkeypatch.setattr("sys.stdin", SimpleNamespace(fileno=lambda: 0))
+    box = selectmod.LoginBox()
+    box._live = Live(console=console, auto_refresh=False)
+
+    def written_by(step):
+        console.file.seek(0)
+        console.file.truncate()
+        step()
+        return console.file.getvalue()
+
+    with box._live:
+        assert LONG_LINK in written_by(lambda: box.show_link("open this link:", LONG_LINK))
+        for _tick in range(2):  # redrawing it would clear a person's selection
+            tick = written_by(lambda: box.waiting("waiting", "keys"))
+            assert "waiting" in tick and LONG_LINK not in tick
+        taken_down = written_by(box._draw)
+        # The box (border, welcome, the ask, border), a blank, two rows of link, a blank, and the
+        # waiting line's own row.
+        assert taken_down.count("\x1b[1A\x1b[2K") == 4 + 1 + 2 + 1 + 1
+        # Nothing more to take down: only the frame's own rows (border, welcome, border).
+        assert written_by(box._draw).count("\x1b[1A\x1b[2K") == 2
+
+
+def test_cancelling_leaves_no_prompt_behind(monkeypatch):
+    monkeypatch.setenv("TERM", "xterm")
+    console = Console(file=io.StringIO(), force_terminal=True, width=80, color_system=None)
+    monkeypatch.setattr(output, "_stderr", console)
+    monkeypatch.setattr("sys.stdin", SimpleNamespace(fileno=lambda: 0))
+    box = selectmod.LoginBox()
+    box._live = Live(console=console, auto_refresh=False)
+    box.active = "email"
+    with box._live:
+        box._draw()
+        console.file.seek(0)
+        console.file.truncate()
+        box.cancel(False)
+    closing = console.file.getvalue()
+    assert "cancelled" in closing and "❯ email" not in closing
+
+
+@pytest.mark.parametrize("step", ["start_browser_login", "claim_browser_login"])
+def test_ctrl_c_during_any_request_of_a_browser_login_cancels_calmly(approved_link, monkeypatch, step):
+    def interrupted(*_a, **_k):
+        raise KeyboardInterrupt()
+
+    monkeypatch.setattr(auth, step, interrupted)
+    with pytest.raises(selectmod.LoginCancelled):
+        auth_cmds._browser_login_in_box(_state(), BASE, _Box())
+
+
+# --- the command, on a terminal with no raw mode ----------------------------
+#
+# The box needs termios and a real pty, so this is the path CliRunner can reach:
+# stdin stubbed as a terminal, the box stubbed as unavailable. It is what Windows gets,
+# and every decision it makes about a server's answer is the box's too.
+
+
+@pytest.fixture
+def plain_terminal(monkeypatch):
+    monkeypatch.setattr("fp_cli.select.stdin_is_tty", lambda: True)
+    monkeypatch.setattr("fp_cli.select.stderr_is_tty", lambda: True)
+    monkeypatch.setattr("fp_cli.select.login_box_supported", lambda: False)
+    # Never a real browser from a test run, wherever it runs.
+    monkeypatch.setattr(auth, "open_url", lambda *_a, **_k: pytest.fail("opened a browser"))
+    monkeypatch.setenv("SSH_TTY", "/dev/pts/1")
+
+
+def _approved_on_first_poll():
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(return_value=httpx.Response(200, json={"status": "approved"}))
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+
+def _fast_links(monkeypatch):
+    real = auth.start_browser_login
+
+    def start(*a, **k):
+        login = real(*a, **k)
+        return login and auth.BrowserLogin(login.verification_url, login.poll_secret, 60.0, 0.0)
+
+    monkeypatch.setattr(auth, "start_browser_login", start)
+
+
+@respx.mock
+def test_choosing_browser_signs_in_without_any_email(home, runner, plain_terminal, monkeypatch):
+    _fast_links(monkeypatch)
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(return_value=httpx.Response(201, json=CLAIMED))
+    _approved_on_first_poll()
+    otp = respx.post(f"{BASE}/api/auth/otp/request")
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="\n")
+
+    assert result.exit_code == 0, result.output
+    assert LINK in result.output
+    assert not otp.called
+    cfg = config.load_config()
+    assert (cfg.session_token, cfg.email, cfg.org) == ("tok-browser", "me@test", "acme")
+
+
+@respx.mock
+def test_a_cloud_without_browser_login_falls_back_to_the_emailed_code(home, runner, plain_terminal):
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=httpx.Response(404))
+    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(
+        return_value=httpx.Response(
+            200,
+            json={"user": {"id": "u1", "email": "me@test"}, "expires_in_secs": 3600},
+            headers={"set-cookie": "ae_session=tok-otp; Path=/"},
+        )
+    )
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="\nme@test\n123456\n")
+
+    assert result.exit_code == 0, result.output
+    assert "no browser login" in result.output
+    assert config.load_config().session_token == "tok-otp"
+
+
+@respx.mock
+@pytest.mark.parametrize("failed", [429, 500], ids=["rate-limited", "server-error"])
+def test_failing_to_get_a_link_on_a_plain_terminal_still_leaves_the_emailed_code(home, runner, plain_terminal, failed):
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=httpx.Response(failed, json={"error": "nope"}))
+    otp = respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(
+        return_value=httpx.Response(
+            200,
+            json={"user": {"id": "u1", "email": "me@test"}, "expires_in_secs": 3600},
+            headers={"set-cookie": "ae_session=tok-otp; Path=/"},
+        )
+    )
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="\nme@test\n123456\n")
+
+    assert result.exit_code == 0, result.output
+    assert auth_cmds._NO_LINK_NOW in result.output
+    assert otp.called
+    assert config.load_config().session_token == "tok-otp"
+
+
+@respx.mock
+def test_a_cloud_that_dropped_the_kind_is_never_claimed_from(home, runner, plain_terminal):
+    respx.post(f"{BASE}/api/auth/cli/start").mock(
+        return_value=httpx.Response(201, json={k: v for k, v in STARTED.items() if k != "kind"})
+    )
+    claim = respx.post(f"{BASE}/api/auth/cli/claim")
+    poll = respx.post(f"{BASE}/api/auth/cli/poll")
+    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(return_value=httpx.Response(401))
+
+    runner.invoke(app, ["--base-url", BASE, "login"], input="\nme@test\n000000\n")
+
+    assert not poll.called and not claim.called
+
+
+@respx.mock
+@pytest.mark.parametrize("final", ["denied", "expired", "claimed"])
+def test_a_link_that_ends_leaves_nothing_saved(home, runner, plain_terminal, monkeypatch, final):
+    _fast_links(monkeypatch)
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(return_value=httpx.Response(200, json={"status": final}))
+    claim = respx.post(f"{BASE}/api/auth/cli/claim")
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="\n")
+
+    assert result.exit_code == 4, result.output
+    assert not claim.called
+    assert config.load_config().session_token is None
+
+
+@respx.mock
+def test_an_email_at_the_prompt_is_the_email_and_starts_no_link(home, runner, plain_terminal):
+    start = respx.post(f"{BASE}/api/auth/cli/start")
+    otp = respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(return_value=httpx.Response(401))
+
+    runner.invoke(app, ["--base-url", BASE, "login"], input="me@test\n000000\n")
+
+    assert not start.called
+    assert json.loads(otp.calls[0].request.content)["email"] == "me@test"
+
+
+@respx.mock
+def test_ctrl_c_while_waiting_cancels_calmly(home, runner, plain_terminal, monkeypatch):
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
+    claim = respx.post(f"{BASE}/api/auth/cli/claim")
+
+    def interrupted(*_a, **_k):
+        raise KeyboardInterrupt()
+
+    monkeypatch.setattr(auth, "await_browser_approval", interrupted)
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="\n")
+
+    assert result.exit_code == 0, result.output
+    assert "cancelled" in result.output
+    assert not claim.called
+    assert config.load_config().session_token is None
+
+
+@respx.mock
+def test_the_plain_flow_says_when_it_is_reconnecting_once(home, runner, plain_terminal, monkeypatch):
+    _fast_links(monkeypatch)
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(
+        side_effect=[
+            httpx.ConnectError("x"),
+            httpx.ConnectError("x"),
+            httpx.Response(200, json={"status": "pending"}),
+            httpx.Response(200, json={"status": "approved"}),
+        ]
+    )
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(return_value=httpx.Response(201, json=CLAIMED))
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="\n")
+
+    assert result.exit_code == 0, result.output
+    assert result.output.count("reconnecting") == 1
+    assert "back online" in result.output
+
+
+@respx.mock
+def test_the_plain_flow_says_it_is_back_when_the_next_answer_is_the_approval(home, runner, plain_terminal, monkeypatch):
+    _fast_links(monkeypatch)
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(
+        side_effect=[httpx.ConnectError("x"), httpx.Response(200, json={"status": "approved"})]
+    )
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(return_value=httpx.Response(201, json=CLAIMED))
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="\n")
+
+    assert result.exit_code == 0, result.output
+    assert result.output.index("reconnecting") < result.output.index("back online")
+
+
+@respx.mock
+def test_a_redirected_stderr_keeps_the_old_prompts(home, runner, plain_terminal, monkeypatch):
+    # The link and the waiting would go to that file, and the person would watch nothing.
+    monkeypatch.setattr("fp_cli.select.stderr_is_tty", lambda: False)
+    start = respx.post(f"{BASE}/api/auth/cli/start")
+    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(
+        return_value=httpx.Response(
+            200,
+            json={"user": {"id": "u1", "email": "me@test"}, "expires_in_secs": 3600},
+            headers={"set-cookie": "ae_session=tok-otp; Path=/"},
+        )
+    )
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="me@test\n123456\n")
+
+    assert result.exit_code == 0, result.output
+    assert not start.called
+    assert "browser link" not in result.output
+    assert config.load_config().session_token == "tok-otp"
+
+
+@respx.mock
+def test_choosing_email_never_touches_the_browser_routes(home, runner, plain_terminal):
+    start = respx.post(f"{BASE}/api/auth/cli/start")
+    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(
+        return_value=httpx.Response(
+            200,
+            json={"user": {"id": "u1", "email": "me@test"}, "expires_in_secs": 3600},
+            headers={"set-cookie": "ae_session=tok-otp; Path=/"},
+        )
+    )
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="me@test\n123456\n")
+
+    assert result.exit_code == 0, result.output
+    assert not start.called
+
+
+@respx.mock
+@pytest.mark.parametrize(
+    "args,tty,stdin",
+    [
+        (["--base-url", BASE, "login", "--email", "me@test"], True, "123456\n"),
+        (["--base-url", BASE, "--json", "login"], True, "me@test\n123456\n"),
+        (["--base-url", BASE, "login"], False, "me@test\n123456\n"),
+    ],
+)
+def test_email_flag_json_and_no_terminal_are_never_offered_a_link(home, runner, monkeypatch, args, tty, stdin):
+    monkeypatch.setattr("fp_cli.select.stdin_is_tty", lambda: tty)
+    monkeypatch.setattr("fp_cli.select.login_box_supported", lambda: False)
+    start = respx.post(f"{BASE}/api/auth/cli/start")
+    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(
+        return_value=httpx.Response(
+            200,
+            json={"user": {"id": "u1", "email": "me@test"}, "expires_in_secs": 3600},
+            headers={"set-cookie": "ae_session=tok-otp; Path=/"},
+        )
+    )
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+    result = runner.invoke(app, args, input=stdin)
+
+    assert result.exit_code == 0, result.output
+    assert not start.called
+    assert "browser link" not in result.output
+    assert config.load_config().session_token == "tok-otp"
+
+
+@respx.mock
+def test_a_blank_line_without_a_terminal_starts_no_link(home, runner, monkeypatch):
+    # At a terminal a blank answer means the link. Down a pipe nobody could see one.
+    monkeypatch.setattr("fp_cli.select.stdin_is_tty", lambda: False)
+    monkeypatch.setattr("fp_cli.select.login_box_supported", lambda: False)
+    start = respx.post(f"{BASE}/api/auth/cli/start")
+    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(return_value=httpx.Response(401))
+
+    runner.invoke(app, ["--base-url", BASE, "login"], input="\nme@test\n000000\n")
+
+    assert not start.called
diff --git a/fp-cloud-cli/tests/test_cloud_agent.py b/fp-cloud-cli/tests/test_cloud_agent.py
index 464168949..5aa61bd54 100644
--- a/fp-cloud-cli/tests/test_cloud_agent.py
+++ b/fp-cloud-cli/tests/test_cloud_agent.py
@@ -65,7 +65,6 @@ class Sys:
     else:
         assert "EVENT TOTAL" in result.output
         assert "42" in result.output
-        assert result.stdout.index("failproof ai v") < result.stdout.index("EVENT TOTAL")
         if tty:
             assert "alert a1" in result.output
             assert "Approve this change" in result.output
@@ -184,8 +183,7 @@ def test_approval_answer_failure_is_clean(logged_in, runner, json_mode, failure,
         assert data["exit_code"] == exit_code
         message = data["error"]
     else:
-        assert len(result.stderr.strip().splitlines()) == 1
-        message = result.stderr
+        message = " ".join(result.stderr.replace("│", " ").split())  # wrapped in the red error box
     assert "Assistant approval answer failed" in message
     assert "delivery unconfirmed" in message
     if failure == "404":
@@ -239,15 +237,13 @@ def test_ask_api_key_uses_session_only_wording(logged_in, runner, json_mode):
     if json_mode:
         assert json.loads(result.stdout)["error"] == expected
     else:
-        assert expected in result.stderr
-        assert len(result.stderr.strip().splitlines()) == 1
+        assert expected in " ".join(result.stderr.replace("│", " ").split())  # the red error box wraps it
 
 
-def test_artifact_header_precedes_title_once(capsys):
+def test_artifacts_render_in_order(capsys):
     from fp_cli.commands.agent_cmds import render_artifact
     output.configure(no_color=True)
     render_artifact({"title": "First artifact", "result": RESULT})
     render_artifact({"title": "Second artifact", "result": RESULT})
     rendered = capsys.readouterr().out
-    assert rendered.count("failproof ai v") == 1
-    assert rendered.index("failproof ai v") < rendered.index("FIRST ARTIFACT") < rendered.index("SECOND ARTIFACT")
+    assert rendered.index("FIRST ARTIFACT") < rendered.index("SECOND ARTIFACT")
diff --git a/fp-cloud-cli/tests/test_cloud_human_views.py b/fp-cloud-cli/tests/test_cloud_human_views.py
index 32014ab78..37bb8be40 100644
--- a/fp-cloud-cli/tests/test_cloud_human_views.py
+++ b/fp-cloud-cli/tests/test_cloud_human_views.py
@@ -235,8 +235,6 @@ def test_deliberate_human_command_views(logged_in, runner, monkeypatch, tmp_path
         result = runner.invoke(app, args)
     assert result.exit_code == 0, result.output
     assert expected in result.stdout, result.stdout
-    if argv[:2] != ["query", "export"] or "--out" in argv or "json" in argv:
-        assert result.stdout.lstrip().startswith("failproof ai"), result.stdout
     assert "\nFIELD\n" not in result.stdout and "\nVALUE\n" not in result.stdout
     for raw in ('"eval_key":', '"created":', '"permissions":', "dashboards  []", "{'"):
         assert raw not in result.stdout, result.stdout
diff --git a/fp-cloud-cli/tests/test_commands.py b/fp-cloud-cli/tests/test_commands.py
index bc8f9a284..092551efe 100644
--- a/fp-cloud-cli/tests/test_commands.py
+++ b/fp-cloud-cli/tests/test_commands.py
@@ -522,7 +522,7 @@ def test_sessions_table(logged_in, runner):
     )
     result = runner.invoke(app, ["sessions"])
     assert result.exit_code == 0, result.output
-    assert "SESSIONS" in result.stdout
+    assert "sessions" in result.stdout  # the boxed panel title
     assert "done" in result.stdout  # status flattened up from latest_evaluation
 
 
@@ -679,7 +679,7 @@ def test_help_command(home, runner):
     result = runner.invoke(app, ["help"])
     assert result.exit_code == 0
     out = result.stdout
-    assert "COMMANDS" in out
+    assert "Commands" in out  # the grouped top-level panel
     # the four purpose groups, in order
     for g in ("ESSENTIALS", "OBSERVE", "MANAGE", "TOOLS"):
         assert g in out
@@ -744,7 +744,7 @@ def test_fields_unknown_is_usage_error(logged_in, runner):
 def test_dash_h_alias_shows_help(home, runner):
     result = runner.invoke(app, ["-h"])
     assert result.exit_code == 0
-    assert "COMMANDS" in result.stdout and "sessions" in result.stdout
+    assert "Commands" in result.stdout and "sessions" in result.stdout
     assert "ESSENTIALS" in result.stdout  # the grouped top-level help, via the rich_format_help override
 
 
diff --git a/fp-cloud-cli/tests/test_dashboards_agent.py b/fp-cloud-cli/tests/test_dashboards_agent.py
index be8baea07..2bd87bbee 100644
--- a/fp-cloud-cli/tests/test_dashboards_agent.py
+++ b/fp-cloud-cli/tests/test_dashboards_agent.py
@@ -171,7 +171,7 @@ def test_agent_health_renders_configured_card(logged_in, runner):
     result = runner.invoke(app, ["agent", "health"])
     assert result.exit_code == 0, result.output
     out = result.stdout
-    assert "ASSISTANT" in out and "configured" in out and "claude-x" in out
+    assert "assistant" in out and "configured" in out and "claude-x" in out
 
 
 @respx.mock
@@ -192,7 +192,7 @@ def test_agent_models_renders_default_marker(logged_in, runner):
     result = runner.invoke(app, ["agent", "models"])
     assert result.exit_code == 0, result.output
     out = result.stdout
-    assert "MODELS" in out and "m-default" in out and "m-fast" in out and "default" in out
+    assert "models" in out and "m-default" in out and "m-fast" in out and "default" in out
 
 
 @respx.mock
@@ -213,7 +213,7 @@ def test_agent_chats_renders_table(logged_in, runner):
     )
     result = runner.invoke(app, ["agent", "chats"])
     assert result.exit_code == 0, result.output
-    assert "CHATS" in result.stdout and "perf review" in result.stdout
+    assert "chats" in result.stdout and "perf review" in result.stdout
     assert "chat-id" in result.stdout and "c1" in result.stdout  # full chat-id column by default
     assert "open one with" not in (result.stderr or "")           # footer removed
 
diff --git a/fp-cloud-cli/tests/test_facets.py b/fp-cloud-cli/tests/test_facets.py
index 86d0500c1..31ae8c8df 100644
--- a/fp-cloud-cli/tests/test_facets.py
+++ b/fp-cloud-cli/tests/test_facets.py
@@ -87,7 +87,7 @@ def test_errors_list_table(logged_in, runner):
     result = runner.invoke(app, ["errors", "--since", "24h"])
     assert result.exit_code == 0, result.output
     # the 80-col CliRunner truncates cells; just assert the error-themed box rendered
-    assert "ERRORS" in result.stdout and "newest first" in result.stdout
+    assert "errors" in result.stdout and "newest first" in result.stdout
 
 
 @respx.mock
diff --git a/fp-cloud-cli/tests/test_operator.py b/fp-cloud-cli/tests/test_operator.py
index 659162842..2cbdc8bb6 100644
--- a/fp-cloud-cli/tests/test_operator.py
+++ b/fp-cloud-cli/tests/test_operator.py
@@ -388,7 +388,7 @@ def test_settings_list_human_boxed(logged_in, runner):
     result = runner.invoke(app, ["settings", "list"])
     assert result.exit_code == 0, result.output
     out = result.stdout + result.stderr
-    assert "SETTINGS · 3" in out
+    assert "settings · 3" in out
     for c in ("key", "value", "type", "updated"):
         assert c in out
     assert "session_ttl_secs" in out and "86400" in out and "integer" in out
diff --git a/fp-cloud-cli/tests/test_orgs.py b/fp-cloud-cli/tests/test_orgs.py
index f65caea07..1b78be434 100644
--- a/fp-cloud-cli/tests/test_orgs.py
+++ b/fp-cloud-cli/tests/test_orgs.py
@@ -393,7 +393,7 @@ def test_orgs_perms_table(logged_in, runner):
     # identity header (name · slug · role) + the shared grouped permissions panel, with the
     # org NAME in the panel's border title.
     assert "Globex" in result.stdout and "globex" in result.stdout and "role admin" in result.stdout
-    assert "PERMISSIONS · 2 · Globex" in result.stdout
+    assert "permissions · 2 · Globex" in result.stdout
     assert "events" in result.stdout and "keys" in result.stdout
 
 
diff --git a/fp-cloud-cli/tests/test_output.py b/fp-cloud-cli/tests/test_output.py
index 576d6ec97..c1369d374 100644
--- a/fp-cloud-cli/tests/test_output.py
+++ b/fp-cloud-cli/tests/test_output.py
@@ -51,7 +51,7 @@ def test_print_table_writes_to_stdout(capsys):
     output.configure(no_color=True, quiet=False)
     output.print_table(["a", "b"], [["1", "2"]], title="Demo")
     out = capsys.readouterr().out
-    assert "DEMO" in out
+    assert "Demo" in out
     assert "1" in out and "2" in out
 
 
@@ -91,7 +91,7 @@ def test_render_events_box_to_stdout(capsys):
     output.render_events([_event("2026-06-22T12:21:54Z")], order="desc")
     captured = capsys.readouterr()
     # The box (human data view) goes to STDOUT; the title carries count, direction and date.
-    assert "EVENTS" in captured.out
+    assert "events" in captured.out
     assert "newest first" in captured.out
     assert "2026-06-22" in captured.out
     assert captured.err == ""
@@ -208,7 +208,7 @@ def test_render_sessions_box_has_no_scores(capsys):
     _wide_stdout()
     output.render_sessions([_sample_eval()])
     out = capsys.readouterr().out
-    assert "SESSIONS" in out and "newest first" in out and "2026-06-22" in out
+    assert "sessions" in out and "newest first" in out and "2026-06-22" in out
     assert "agent-codegen" in out and "done" in out
     assert "12:56:31" in out and "sess-20260615-fcf97e01" in out
     assert "coherence" not in out and "scores" not in out  # scores moved to evals
@@ -219,7 +219,7 @@ def test_render_evals_box_has_scores(capsys):
     _wide_stdout()
     output.render_evals([_sample_eval()])
     out = capsys.readouterr().out
-    assert "EVALS" in out and "scores" in out and "coherence" in out
+    assert "evals" in out and "scores" in out and "coherence" in out
     assert "agent-codegen" in out and "sess-20260615-fcf97e01" in out
     output.configure(no_color=True, quiet=False)
 
@@ -296,7 +296,7 @@ def test_render_sessions_expanded_lists_full_roster(capsys):
     assert "agent-testgen" in out and "9 ev" in out
     assert "●" not in out                                  # uniform: no special "root" marker
     assert "├" in out and "└" in out                       # uniform tree glyphs, └ closes the list
-    assert "SESSIONS · 1" in out                           # count = sessions, not rows
+    assert "sessions · 1" in out                           # panel count = sessions, not rows
     output.configure(no_color=True, quiet=False)
 
 
@@ -403,7 +403,7 @@ def test_render_errors_box(capsys):
     _wide_stdout()
     output.render_errors([_errevent("error", "RateLimitError: upstream timed out")])
     out = capsys.readouterr().out
-    assert "ERRORS" in out and "newest first" in out
+    assert "errors" in out and "newest first" in out
     assert "agent-orderbot" in out and "sess-20260622-4b90b240" in out
     assert "RateLimitError: upstream timed out" in out          # server-computed summary field
     assert "17:51:34" in out
@@ -479,7 +479,7 @@ def test_render_org_perms(capsys):
     out = capsys.readouterr().out
     # header leads with the org name + slug + role; the count moved into the box title
     assert "Globex Corp" in out and "globex" in out and "role admin" in out
-    assert "PERMISSIONS · 5 · Globex Corp" in out
+    assert "permissions · 5 · Globex Corp" in out
     assert "dashboards" in out and "keys" in out and "agent" in out
     output.configure(no_color=True, quiet=False)
 
@@ -659,7 +659,7 @@ def test_render_users_box_and_footer(capsys):
     output.users_footer(users)
     cap = capsys.readouterr()
     out, err = cap.out, cap.err
-    assert "USERS · 3" in out
+    assert "users · 3" in out
     for c in ("email", "access", "perms", "joined", "status"):
         assert c in out
     assert "root@test" in out and "admin" in out and "06-25" in out
@@ -695,7 +695,7 @@ def test_render_user_show_card_and_perms(capsys):
     out = capsys.readouterr().out  # show is a read view → stdout
     assert "user" in out and "dev@test" in out and "protected" in out
     assert "access admin" in out and "3 permissions" in out and "active" in out
-    assert "PERMISSIONS · 3" in out and "keys" in out and "dashboards" in out
+    assert "permissions · 3" in out and "keys" in out and "dashboards" in out
     output.configure(no_color=True, quiet=False)
 
 
@@ -706,7 +706,7 @@ def test_render_user_created_green_card(capsys):
     err = capsys.readouterr().err  # write result → stderr chrome
     assert "user created" in err and "new@test" in err
     assert "access read-only" in err and "2 permissions" in err and "active" in err
-    assert "PERMISSIONS · 2 · read-only" in err  # suffix shows the set
+    assert "permissions · 2 · read-only" in err  # suffix shows the set
     output.configure(no_color=True, quiet=False)
 
 
@@ -718,7 +718,7 @@ def test_render_user_updated_diff(capsys):
     err = capsys.readouterr().err
     assert "permissions updated · dev@test" in err
     assert "now 3" in err and "+1 added" in err and "−1 removed" in err
-    assert "PERMISSIONS · 3" in err          # NEW set size (struck removal not counted)
+    assert "permissions · 3" in err          # NEW set size (struck removal not counted)
     assert "+create" in err and "-write" in err  # added chip / removed ghost (no-color prefixes)
     assert "unchanged" in err                # legend
     output.configure(no_color=True, quiet=False)
@@ -1146,7 +1146,7 @@ def test_render_settings_box(capsys):
     output.render_settings(rows)
     cap = capsys.readouterr()
     out, err = cap.out, cap.err
-    assert "SETTINGS · 3" in out
+    assert "settings · 3" in out
     for c in ("key", "value", "type", "updated"):
         assert c in out
     assert "session_ttl_secs" in out and "86400" in out and "integer" in out
@@ -1231,7 +1231,7 @@ def test_render_incidents_box_and_footer(capsys):
     output.incidents_footer(incs)
     cap = capsys.readouterr()
     out, err = cap.out, cap.err
-    assert "ISSUES · 3" in out
+    assert "issues · 3" in out
     for c in ("id", "alert", "severity", "state", "opened", "assignees"):
         assert c in out
     assert "1f5803aaaaaabbbbcccc000000009826" in out
@@ -1399,7 +1399,7 @@ def test_render_agent_health_configured(capsys):
     _wide_stdout()
     output.render_agent_health(configured=True, default_model="claude-x", model_count=3)
     out = capsys.readouterr().out  # data view → stdout
-    assert "ASSISTANT" in out and "configured" in out
+    assert "assistant" in out and "configured" in out
     assert "default model claude-x" in out and "3 models available" in out
     output.configure(no_color=True, quiet=False)
 
@@ -1417,7 +1417,7 @@ def test_render_agent_models_marks_default(capsys):
     _wide_stdout()
     output.render_agent_models(["m-default", "m-fast"], default_model="m-default")
     out = capsys.readouterr().out
-    assert "MODELS · 2" in out and "m-default" in out and "m-fast" in out and "default" in out
+    assert "models · 2" in out and "m-default" in out and "m-fast" in out and "default" in out
     output.configure(no_color=True, quiet=False)
 
 
@@ -1425,7 +1425,7 @@ def test_render_agent_models_empty(capsys):
     _wide_stdout()
     output.render_agent_models([], default_model=None)
     out = capsys.readouterr().out
-    assert "MODELS · 0" in out and "no models reported" in out
+    assert "models · 0" in out and "no models reported" in out
     output.configure(no_color=True, quiet=False)
 
 
@@ -1438,7 +1438,7 @@ def test_render_agent_chats_box(capsys):
     output.render_agent_chats(chats)
     cap = capsys.readouterr()
     out, err = cap.out, cap.err
-    assert "CHATS · 2" in out
+    assert "chats · 2" in out
     for c in ("chat-id", "title", "messages", "updated"):
         assert c in out
     assert "older" in out and "newer" in out
@@ -1642,7 +1642,7 @@ def pv(pid, version):
     _wide_stdout()
     output.render_policies([pv("a", 1), pv("b", 2), pv("b", 1)])
     out = capsys.readouterr().out
-    assert "POLICIES · 2 · 3 versions" in out
+    assert "policies · 2 · 3 versions" in out
     # newest version of each policy first, rather than server order
     b_rows = [ln for ln in out.splitlines() if "b" in ln and "v" in ln
               and ("v1" in ln or "v2" in ln)]
@@ -1657,7 +1657,7 @@ def test_policy_list_omits_the_caption_when_each_policy_has_one_version(capsys):
                                           source=None, created_at="", created_by=None,
                                           disabled=False, archived=False)])
     out = capsys.readouterr().out
-    assert "POLICIES · 1" in out and "versions" not in out
+    assert "policies · 1" in out and "versions" not in out
 
 
 # ─────────────────────────────────────────────────────────────────────────────
diff --git a/fp-cloud-cli/tests/test_screen_language.py b/fp-cloud-cli/tests/test_screen_language.py
index 2f5c4fff8..90b7554eb 100644
--- a/fp-cloud-cli/tests/test_screen_language.py
+++ b/fp-cloud-cli/tests/test_screen_language.py
@@ -1,41 +1,76 @@
 import json
 from io import StringIO
 
+import pytest
 from rich.console import Console
 
 from fp_cli import output, theme
 from fp_cli.models import AgentEvent
 
+BOXES = "╭╮╰╯┌┐└┘─━│┃"
 
-def test_two_accent_palette():
-    assert theme.ACCENT == "#66d1b5"
-    assert theme.PINK == "#e4587d"
-    assert {theme.SUCCESS, theme.ERROR, theme.AMBER, theme.BLUE, theme.SCORE_HIGH} <= {theme.ACCENT, theme.PINK}
+
+def test_palette():
+    assert theme.ACCENT == "#9d7bff"
+    assert theme.SUCCESS == "#5dcaa5"
+    assert theme.AMBER == "#ef9f27"
+    assert theme.ERROR == "#e2564a"
+    assert theme.BLUE == "#6b86d8"
+    assert theme.PINK == "#d4537e"
+    # The states that have to read differently are different colours.
+    assert len({theme.PERM_READ, theme.PERM_WRITE, theme.PERM_ACTION, theme.PERM_DANGER}) == 4
 
 
 def test_permission_risk_order_is_independent_of_shared_colours():
-    assert theme.PERM_WRITE == theme.PERM_ACTION == theme.PERM_DANGER
     assert sorted(["delete", "run", "write", "read"], key=output._perm_act_key) == [
         "read", "write", "run", "delete",
     ]
 
 
-def test_open_table_and_header(capsys):
+def test_boxed_table_and_no_header(capsys):
     output.configure(no_color=True)
     output.print_table(["Id", "URL"], [["run-001", "https://cloud.example.test"]], title="Resources")
     text = capsys.readouterr().out
-    assert "failproof ai v" in text
-    assert "RESOURCES" in text
-    assert not any(c in text for c in "╭╮╰╯┌┐└┘─━│┃")
+    assert "failproof ai v" not in text
+    assert "Resources" in text and "RESOURCES" not in text
+    assert any(c in text for c in BOXES)
 
 
-def test_legacy_panels_use_open_screen(capsys):
+def test_panels_have_rounded_boxes_and_lowercase_titles(capsys):
     output.configure(no_color=True)
     output.render_events([AgentEvent(id=1, session_id="run-001", agent_id="agent", event_type="tool_use", ts="2026-10-13T00:00:00Z")])
     text = capsys.readouterr().out
-    assert "EVENTS" in text
-    assert "failproof ai v" in text
-    assert not any(c in text for c in "╭╮╰╯┌┐└┘─━│┃")
+    assert "╭─ events" in text and "╰" in text
+    assert "EVENTS" not in text
+    assert "failproof ai v" not in text
+
+
+def test_errors_are_a_red_box(capsys):
+    output.configure(no_color=True)
+    output._error_box("that failed", "try fp login")
+    text = capsys.readouterr().err
+    assert "╭─ error" in text and "✗" in text
+    assert "that failed" in text and "try fp login" in text
+
+
+@pytest.mark.parametrize("say", [output.error, output.warn, output.success])
+def test_a_message_is_shown_as_written_whatever_is_in_it(capsys, say):
+    # Rich would read these as markup: one raises, the other disappears.
+    output.configure(no_color=True)
+    say("from the server: [/] and [red]")
+    assert "from the server: [/] and [red]" in capsys.readouterr().err
+
+
+def test_a_table_title_is_shown_as_written(capsys):
+    output.configure(no_color=True)
+    output.print_table(["a"], [["1"]], title="from the server: [/] and [red]")
+    assert "fromtheserver:[/]and[red]" in "".join(capsys.readouterr().out.split())  # it wraps to the table
+
+
+def test_only_a_key_hint_lights_up_its_keys():
+    lit = lambda text: [text[span.start:span.end] for span in output._login_keys(text).spans]
+    assert lit("enter send a code · tab SSO · esc cancel") == ["enter", "tab", "esc"]
+    assert lit("  enter the 6-digit code") == []
 
 
 def test_narrow_ids_and_urls_are_not_cut(capsys):
@@ -49,6 +84,36 @@ def test_narrow_ids_and_urls_are_not_cut(capsys):
     assert "…" not in compact
 
 
+@pytest.mark.parametrize("field", ["session_id", "agent_id"])
+def test_a_value_in_a_boxed_table_is_never_cut(field):
+    capture = StringIO()
+    output.configure(no_color=True)
+    output._stdout = Console(file=capture, width=70, no_color=True)
+    long_value = "sess-20260615-" + "abcdef0123456789" * 3
+    event = {"session_id": "run-001", "agent_id": "agent", field: long_value}
+    output.render_events([AgentEvent(id=1, event_type="tool_use", ts="2026-10-13T00:00:00Z", **event)])
+    text = capture.getvalue()
+    assert any(c in text for c in BOXES)
+    assert "…" not in text
+    # Flattened, a wrapped value reads whole once the short cell beside its first row is gone.
+    assert long_value in "".join(c for c in text if c not in BOXES and not c.isspace()).replace("run-001", "")
+
+
+@pytest.mark.parametrize("render", [output.render_events, output.render_errors])
+def test_short_values_stay_on_one_line_when_a_long_one_wraps(render):
+    capture = StringIO()
+    output.configure(no_color=True)
+    output._stdout = Console(file=capture, width=100, no_color=True)
+    long_id = "sess-20260615-" + "abcdef0123456789" * 4
+    # Two days, so the time column carries the date as well, at its widest.
+    render([
+        AgentEvent(id=1, session_id=long_id, agent_id="agent", event_type="tool_use", ts="2026-10-13T09:41:07Z"),
+        AgentEvent(id=2, session_id=long_id, agent_id="agent", event_type="tool_use", ts="2026-10-12T17:51:34Z"),
+    ])
+    text = capture.getvalue()
+    assert "10-13 09:41:07" in text and "10-12 17:51:34" in text, text
+
+
 def test_json_bytes_unchanged(capsys):
     output.configure(json=True)
     data = {"session_id": "run-001", "scores": {"quality": 0.9}}
@@ -56,25 +121,21 @@ def test_json_bytes_unchanged(capsys):
     assert capsys.readouterr().out == json.dumps(data, indent=2, ensure_ascii=False) + "\n"
 
 
-def test_generated_help_has_no_boxes(logged_in, runner):
+def test_generated_help_has_boxes(logged_in, runner):
     from fp_cli.app import app
     result = runner.invoke(app, ["evaluators", "create", "--help"])
     assert result.exit_code == 0
     assert "Code:" in result.stdout and "Judge:" in result.stdout and "Jev:" in result.stdout
-    assert not any(c in result.stdout for c in "╭╮╰╯┌┐└┘─━│┃")
-
-
-def test_shared_key_value_labels_are_grey():
-    capture = StringIO()
-    output.configure()
-    output._stdout = Console(file=capture, width=140, force_terminal=True, color_system="truecolor")
-    output.print_table(["Field", "Value"], [["enabled", "true"]])
-    assert "\x1b[38;2;118;127;139menabled" in capture.getvalue()
+    assert any(c in result.stdout for c in BOXES)
 
 
-def test_help_typeable_commands_are_pink():
+def test_help_has_the_brand_mark_and_old_command_colours():
     capture = StringIO()
     output.configure()
     output._stdout = Console(file=capture, width=140, force_terminal=True, color_system="truecolor")
     output.render_top_level_help()
-    assert "\x1b[38;2;228;88;125mfp login" in capture.getvalue()
+    text = capture.getvalue()
+    assert "◆ fp" in text
+    assert "failproof ai v" not in text
+    assert "\x1b[38;2;157;123;255mfp login" in text  # theme.ACCENT
+    assert "\x1b[38;2;228;88;125m" not in text        # the redesign's pink
diff --git a/fp-cloud-cli/tests/test_whoami.py b/fp-cloud-cli/tests/test_whoami.py
index c3c47879f..b03e354fc 100644
--- a/fp-cloud-cli/tests/test_whoami.py
+++ b/fp-cloud-cli/tests/test_whoami.py
@@ -66,7 +66,7 @@ def test_whoami_human_renders_header_and_panels(logged_in, runner):
     assert "62230791-4811-4f04-b388-ae57bdcb422e" in out
     assert "instance admin" in out
     # permissions panel
-    assert "PERMISSIONS" in out
+    assert "permissions" in out
     assert "dashboards" in out and "read" in out and "write" in out and "delete" in out
     # orgs panel + switch hint to the non-active org
     assert "your orgs" in out