From 7b4bcf004b3c61e9973c83f51bcb062b51484b16 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Wed, 4 Nov 2026 20:58:46 +0530
Subject: [PATCH 01/15] [failproofai-feat-failproofai-cloud-login] Sign in to
 `fp` from a browser

On a terminal, `fp login` now asks: browser opens a link (or prints it over SSH or
with no display), the person authorizes it, and the terminal finishes on its own;
email sends the 6-digit code as before. Either way it ends in the same session,
because most of `fp` refuses API keys and it never stores one.

`--email`, `--json` and anything without a terminal behave as they always did. A
Cloud without browser login falls back to the code by itself, including one that has
`failproofai config`'s login but drops `kind` and would end in a machine key:
`fp` requires the echo, so nothing is approved and nothing is minted.

Adds `__tests__/e2e/layout/fp-login.sh`, and fixes `has`/`hasnt` in `cli-login.sh`,
which could report the wrong result on large output under pipefail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                              |   4 +
 __tests__/e2e/layout/README.md            |   7 +
 __tests__/e2e/layout/cli-login-driver.py  |  24 +-
 __tests__/e2e/layout/cli-login.sh         |   6 +-
 __tests__/e2e/layout/fp-login.sh          | 519 ++++++++++++++++++++++
 docs/reference/cloud-cli.mdx              |   5 +-
 fp-cloud-cli/CHANGELOG.md                 |   7 +-
 fp-cloud-cli/README.md                    |  14 +-
 fp-cloud-cli/fp_cli/app.py                |   2 +-
 fp-cloud-cli/fp_cli/auth.py               | 306 ++++++++++++-
 fp-cloud-cli/fp_cli/commands/auth_cmds.py | 213 +++++++--
 fp-cloud-cli/fp_cli/output.py             |  39 +-
 fp-cloud-cli/fp_cli/select.py             |  47 +-
 fp-cloud-cli/skill/SKILL.md               |   6 +-
 fp-cloud-cli/skill/references/commands.md |   2 +-
 fp-cloud-cli/tests/test_browser_login.py  | 413 +++++++++++++++++
 16 files changed, 1521 insertions(+), 93 deletions(-)
 create mode 100755 __tests__/e2e/layout/fp-login.sh
 create mode 100644 fp-cloud-cli/tests/test_browser_login.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index da7e34b63..0a04233ca 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 ## 1.0.14-beta.0 — 2026-11-02
 
+### Features
+
+- `fp login` can sign you in from a browser, as `failproofai config` does: on a terminal it asks browser or email code, and either way you get your own session. New deliberate-run harness: `__tests__/e2e/layout/fp-login.sh`.
+
 ### Dependencies
 
 - Replace Dependabot's #965 and #955, neither of which could install, and clear every fixable Dependabot alert in the TypeScript SDK's integration fixtures. `mastra-1` takes `@mastra/mcp` 2.7.0 with the `@mastra/core` 1.81.0 and `@mastra/memory` 1.40.0 it needs, `mastra-0` stays on Mastra 0.x and clears `@hono/node-server`, `systeminformation`, `glob` and `minimatch`, `deepmerge` leaves three fixtures through `html-to-text` 10.0.1, and the nested zod 3 leaves two. None of these lockfiles ship in a published package (#966)
diff --git a/__tests__/e2e/layout/README.md b/__tests__/e2e/layout/README.md
index 360a7d180..b79eef3ff 100644
--- a/__tests__/e2e/layout/README.md
+++ b/__tests__/e2e/layout/README.md
@@ -10,6 +10,7 @@ not depend on — so they are invoked deliberately.
 | `cloud-collector.sh` | an AgentEye stack | real connect against a live server, daemon + collector writing layout-2 paths, decisions reaching ClickHouse, disconnect back to OSS |
 | `systemd-service.sh` | Docker | REAL `systemctl enable --now` as root in a privileged container: service lifecycle, fail-closed, self-heal, reinstall |
 | `cli-login.sh` | an AgentEye stack (dashboard + mailpit + its Postgres), an older Cloud server without `/api/auth/cli/*` routes, Docker, `bun run build` + the release daemon | `config`'s browser login through a real pty in a systemd container: approve, re-login, deny + retry, abandon after approval (no key minted), esc, expiry, revoked saved key, older server, and the person-side refusals (Origin, form posts, no session, start rate limit) |
+| `fp-login.sh` | an AgentEye stack (dashboard + mailpit + its containers), `uv sync` in `fp-cloud-cli`; optionally a Cloud with `config`'s login but not `fp`'s | `fp login`'s browser flow through a real pty: approve, the org picker, the email code from the menu, deny + retry, expiry, esc and ctrl-c, an approval nobody collects (no session), a dropped connection, opening the browser, Clouds without it (nothing minted), the network warning and when the email goes out, the person-side refusals, and no secret in any log |
 
 `systemd-service.sh` exists because the service half cannot be tested on a
 developer machine without a password prompt, and a container gives real systemd
@@ -38,6 +39,12 @@ bash __tests__/e2e/layout/systemd-service.sh
 DASH=http://localhost:3000 MAILPIT=http://localhost:8026 OLD_CLOUD=http://localhost:28080 PG_CONTAINER=agenteye-postgres-1 \
   bash __tests__/e2e/layout/cli-login.sh
 
+# fp-login.sh drives the real `fp` the same way. STACK is the compose project, which
+# names the containers it reads. Add CLOUD_1090 and PG_1090 to cover a Cloud from
+# before `fp`'s half of this; it stops and restarts the dashboard container once.
+DASH=http://127.0.0.1:3000 MAILPIT=http://127.0.0.1:8026 STACK=agenteye \
+  bash __tests__/e2e/layout/fp-login.sh
+
 # cloud-collector.sh expects the stack on the remapped ports (18080/18123) so it
 # can run alongside an existing project rather than displacing it:
 docker compose -p aefpai -f docker-compose.yml -f ports.yml up -d
diff --git a/__tests__/e2e/layout/cli-login-driver.py b/__tests__/e2e/layout/cli-login-driver.py
index 45a465918..25239567c 100755
--- a/__tests__/e2e/layout/cli-login-driver.py
+++ b/__tests__/e2e/layout/cli-login-driver.py
@@ -1,16 +1,18 @@
 #!/usr/bin/env python3
-"""Drive `failproofai config` through a real pseudo-terminal, screen by screen.
+"""Drive a login through a real pseudo-terminal, screen by screen.
 
-Used by cli-login.sh, inside the systemd container, as the unprivileged user.
-The wizard only offers browser login to a real terminal, so a pty is the only
-honest way to test it end to end.
+Used by cli-login.sh for `failproofai config` (inside the systemd container, as the
+unprivileged user) and by fp-login.sh for `fp login`. Both only offer browser login
+to a real terminal, so a pty is the only honest way to test it end to end.
 
 Usage: cli-login-driver.py <script> <transcript-file> <url-file> -- <command...>
 
 <script> is a comma-separated list of steps, each `wait:<text>` (block until
 the screen shows <text>), `key:<name>` (enter, down, up, esc, ctrl-c, tab),
-`url` (wait for the authorize link and write it to <url-file>), or
-`sleep:<seconds>`. Exit status is the command's own, or 124 on a timeout.
+`url` (wait for the authorize link and write it to <url-file>), `sleep:<seconds>`,
+`type:<text>`, or `typefile:<path>` (wait for that file, then type what it holds:
+for a value the script only learns later, like an emailed code). Exit status is
+the command's own, or 124 on a timeout.
 """
 import os
 import pty
@@ -83,6 +85,16 @@ def plain() -> str:
         elif kind == "key":
             time.sleep(0.3)  # let the screen settle so the key lands on it
             os.write(fd, KEYS[arg])
+        elif kind == "type":
+            time.sleep(0.3)
+            os.write(fd, arg.encode())
+        elif kind == "typefile":
+            while not os.path.exists(arg):
+                if time.time() > deadline or not pump(0.2):
+                    print(f"driver: {arg} never appeared", file=sys.stderr)
+                    return 124
+            with open(arg, "rb") as f:
+                os.write(fd, f.read().strip())
         elif kind == "sleep":
             end = time.time() + float(arg)
             while time.time() < end:
diff --git a/__tests__/e2e/layout/cli-login.sh b/__tests__/e2e/layout/cli-login.sh
index fd477fd35..f31657d2e 100755
--- a/__tests__/e2e/layout/cli-login.sh
+++ b/__tests__/e2e/layout/cli-login.sh
@@ -39,8 +39,10 @@ OUT=$(mktemp -d)
 PASS=0; FAIL=0
 ok()  { PASS=$((PASS+1)); printf '  \033[32mPASS\033[0m %s\n' "$1"; }
 bad() { FAIL=$((FAIL+1)); printf '  \033[31mFAIL\033[0m %s\n       %s\n' "$1" "${2:-}"; }
-has()   { if printf '%s' "$2" | grep -qF -- "$3"; then ok "$1"; else bad "$1" "missing [$3] in: $(printf '%s' "$2" | tr '\n' ' ' | tail -c 400)"; fi; }
-hasnt() { if printf '%s' "$2" | grep -qF -- "$3"; then bad "$1" "unexpected [$3]"; else ok "$1"; fi; }
+# Not `printf | grep -q`: on input bigger than a pipe buffer grep exits at the first match,
+# printf dies of SIGPIPE, and under pipefail a found string reads as a missing one.
+has()   { if [[ "$2" == *"$3"* ]]; then ok "$1"; else bad "$1" "missing [$3] in: $(printf '%s' "$2" | tr '\n' ' ' | tail -c 400)"; fi; }
+hasnt() { if [[ "$2" == *"$3"* ]]; then bad "$1" "unexpected [$3]"; else ok "$1"; fi; }
 eq()    { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1" "want [$3] got [$2]"; fi; }
 head1() { printf '\n\033[1m── %s\033[0m\n' "$1"; }
 jqp() { python3 -c "import sys,json;d=json.load(sys.stdin);print(eval('d'+sys.argv[1]))" "$1" 2>/dev/null; }
diff --git a/__tests__/e2e/layout/fp-login.sh b/__tests__/e2e/layout/fp-login.sh
new file mode 100755
index 000000000..a43476a51
--- /dev/null
+++ b/__tests__/e2e/layout/fp-login.sh
@@ -0,0 +1,519 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# `fp login` from a browser, end to end, for real.
+#
+# The real `fp` runs in a real pseudo-terminal (cli-login-driver.py). A person's
+# half — signing in, approving, denying — happens through the real AgentEye
+# dashboard API, with sign-in codes read out of mailpit. Then it checks what
+# landed: the saved session, that it works, what the server recorded, and which
+# emails went out. Nothing is mocked except a stand-in for a Cloud older than any
+# of this, which only has to answer 404.
+#
+# Needs, all local:
+#   - an AgentEye stack: dashboard on $DASH, mailpit API on $MAILPIT, and its
+#     containers reachable through `docker exec` / `docker logs`
+#   - fp-cloud-cli synced (`uv sync --locked --extra dev`), or FP=<path to fp>
+#   - optionally a Cloud with `failproofai config`'s login but not `fp`'s, on
+#     $CLOUD_1090 with its Postgres in $PG_1090. Skipped when unset.
+#
+# Not part of `bun run test:e2e`: like the other harnesses here, it is run
+# deliberately (see README.md in this directory). It stops and restarts the
+# dashboard container once, to test a dropped connection.
+#
+#   DASH=http://127.0.0.1:43000 MAILPIT=http://127.0.0.1:48026 \
+#     STACK=agenteye-fp-login bash __tests__/e2e/layout/fp-login.sh
+# ─────────────────────────────────────────────────────────────────────────────
+set -uo pipefail
+
+R="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+DASH=${DASH:-http://127.0.0.1:3000}
+MAILPIT=${MAILPIT:-http://127.0.0.1:8026}
+STACK=${STACK:-agenteye}
+PG_CONTAINER=${PG_CONTAINER:-$STACK-postgres-1}
+SERVER_CONTAINER=${SERVER_CONTAINER:-$STACK-server-1}
+DASH_CONTAINER=${DASH_CONTAINER:-$STACK-dashboard-1}
+REDIS_CONTAINER=${REDIS_CONTAINER:-$STACK-redis-1}
+FP=${FP:-$R/fp-cloud-cli/.venv/bin/fp}
+CLOUD_1090=${CLOUD_1090:-}
+PG_1090=${PG_1090:-}
+KEEP=${KEEP:-0}  # 1 = leave the temp dir behind, for reading transcripts
+STAMP=$(date +%s)
+OUT=$(mktemp -d)
+FP_DIR="$OUT/fp-home"
+STUB_PID=""
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  \033[32mPASS\033[0m %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  \033[31mFAIL\033[0m %s\n       %s\n' "$1" "${2:-}"; }
+# Not `printf | grep -q`: on input bigger than a pipe buffer grep exits at the first match,
+# printf dies of SIGPIPE, and under pipefail a found string reads as a missing one.
+has()   { if [[ "$2" == *"$3"* ]]; then ok "$1"; else bad "$1" "missing [$3] in: $(printf '%s' "$2" | tr '\n' ' ' | tail -c 400)"; fi; }
+hasnt() { if [[ "$2" == *"$3"* ]]; then bad "$1" "unexpected [$3]"; else ok "$1"; fi; }
+eq()    { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1" "want [$3] got [$2]"; fi; }
+head1() { printf '\n\033[1m── %s\033[0m\n' "$1"; }
+jqp() { python3 -c "import sys,json;d=json.load(sys.stdin);print(eval('d'+sys.argv[1]))" "$1" 2>/dev/null; }
+sql() { docker exec "$PG_CONTAINER" psql -U postgres -d agenteye -tAc "$1"; }
+
+cleanup() {
+  [ -n "$STUB_PID" ] && kill "$STUB_PID" 2>/dev/null
+  if [ "$KEEP" = 1 ]; then echo "kept: $OUT"; else rm -rf "$OUT"; fi
+}
+trap cleanup EXIT
+
+# ── A person, through the dashboard ──────────────────────────────────────────
+
+otp_code() { # <email> -> the code from the newest sign-in email
+  local email=$1 id="" _
+  for _ in $(seq 1 40); do
+    id=$(curl -s "$MAILPIT/api/v1/search?query=to:$email&limit=1" | jqp '["messages"][0]["ID"]')
+    [ -n "$id" ] && break
+    sleep 0.5
+  done
+  # The CLI's email spaces its digits out; the browser's does not.
+  curl -s "$MAILPIT/api/v1/message/$id" | python3 -c 'import sys,json,re;print(re.search(r"\b(\d(?: ?\d){5})\b",json.load(sys.stdin)["Text"]).group(1).replace(" ",""))'
+}
+
+# Starts are limited to 10 a minute per address, and with nothing in front of the
+# dashboard every local caller is one address. This script starts far more than that.
+unthrottle() {
+  docker exec "$REDIS_CONTAINER" sh -c "redis-cli --scan --pattern 'ratelimit:cli_login_start:*' | xargs -r redis-cli del" >/dev/null
+}
+
+sign_in() { # <email> -> its session, through the real email-code flow
+  local email=$1 code
+  curl -s -X DELETE "$MAILPIT/api/v1/search?query=to:$email" >/dev/null || true
+  curl -s -X POST "$DASH/api/auth/otp/request" -H 'content-type: application/json' -d "{\"email\":\"$email\"}" >/dev/null
+  code=$(otp_code "$email")
+  curl -s -D - -o /dev/null -X POST "$DASH/api/auth/otp/verify" -H 'content-type: application/json' \
+    -d "{\"email\":\"$email\",\"code\":\"$code\"}" | tr -d '\r' | sed -n 's/^[Ss]et-[Cc]ookie: ae_session=\([^;]*\).*/\1/p'
+}
+
+person() { # <session> <action> <json> [address] -> body; status in $OUT/status
+  local xff=()
+  [ -n "${4:-}" ] && xff=(-H "x-forwarded-for: $4")
+  curl -s -o "$OUT/body" -w '%{http_code}' -X POST "$DASH/api/auth/cli/$2" -b "ae_session=$1" \
+    "${xff[@]}" -H "origin: $DASH" -H 'content-type: application/json' -d "$3" > "$OUT/status"
+  cat "$OUT/body"
+}
+
+new_org() { # <session> <slug>
+  curl -s -X POST "$DASH/api/orgs" -b "ae_session=$1" -H 'content-type: application/json' \
+    -d "{\"slug\":\"$2\",\"name\":\"$2\"}" | jqp '["id"]'
+}
+
+link_token() { python3 -c 'import sys,urllib.parse as u;print(u.parse_qs(u.urlparse(sys.argv[1]).query)["r"][0])' "$1"; }
+sessions_of() { sql "select count(*) from sessions where user_id = (select id from users where email = '$1')"; }
+request_status() { sql "select status from cli_login_requests where link_token_hash = encode(sha256('$1'::bytea), 'hex')"; }
+sign_in_mails() { # <email> -> how many sign-in alerts it received
+  curl -s -G "$MAILPIT/api/v1/search" --data-urlencode "query=to:$1 subject:\"new sign-in\"" | jqp '["messages_count"]'
+}
+wait_sign_in_mail() { for _ in $(seq 1 30); do [ "$(sign_in_mails "$1")" != 0 ] && return; sleep 0.5; done; }
+sign_in_mail_text() {
+  local id
+  id=$(curl -s -G "$MAILPIT/api/v1/search" --data-urlencode "query=to:$1 subject:\"new sign-in\"" | jqp '["messages"][0]["ID"]')
+  curl -s "$MAILPIT/api/v1/message/$id" | jqp '["Text"]'
+}
+
+# ── The terminal ─────────────────────────────────────────────────────────────
+
+# Run `fp` under the pty driver in the background. No display and an SSH marker by
+# default, so nothing here ever opens a browser on the machine running it.
+# <name> <script> <base-url> [env assignments...] -- <fp args...>
+run_fp() {
+  local name=$1 script=$2 base=$3; shift 3
+  local extra=()
+  while [ "$#" -gt 0 ] && [ "$1" != "--" ]; do extra+=("$1"); shift; done
+  shift
+  rm -f "$OUT/$name".*
+  unthrottle
+  ( env -u DISPLAY -u WAYLAND_DISPLAY -u SSH_CONNECTION -u SSH_CLIENT -u FP_TOKEN -u FP_API_KEY -u FP_ORG \
+      -u FP_DASHBOARD_URL -u FAILPROOFAI_HOME \
+      SSH_TTY=e2e TERM=xterm-256color NO_COLOR=1 FP_ANALYTICS_DISABLED=1 FP_HOME="$FP_DIR" "${extra[@]}" \
+      python3 "$R/__tests__/e2e/layout/cli-login-driver.py" "$script" "$OUT/$name.log" "$OUT/$name.url" \
+      -- "$FP" --base-url "$base" "$@" ; echo $? > "$OUT/$name.rc" ) 2>"$OUT/$name.err" &
+}
+
+wait_url() { # <name> -> the link fp printed
+  local _
+  for _ in $(seq 1 120); do
+    if [ -s "$OUT/$1.url" ]; then cat "$OUT/$1.url"; rm -f "$OUT/$1.url"; return; fi
+    sleep 0.25
+  done
+}
+
+wait_done() { # <name> -> transcript with the terminal codes taken out
+  local _
+  for _ in $(seq 1 480); do [ -f "$OUT/$1.rc" ] && break; sleep 0.25; done
+  sed 's/\x1b\[[0-9;?]*[A-Za-z]//g' "$OUT/$1.log" 2>/dev/null | tr -d '\r'
+}
+
+fp_plain() { # <base-url> <fp args...>, no terminal
+  local base=$1; shift
+  env -u FP_TOKEN -u FP_API_KEY -u FP_ORG -u FP_DASHBOARD_URL -u FAILPROOFAI_HOME \
+    NO_COLOR=1 FP_ANALYTICS_DISABLED=1 FP_HOME="$FP_DIR" "$FP" --base-url "$base" "$@"
+}
+
+saved() { python3 -c "import json;print(json.load(open('$FP_DIR/cli-auth.json')).get('$1') or '')" 2>/dev/null; }
+reset_fp() { rm -rf "$FP_DIR"; }
+
+MENU=wait:how\ do\ you\ want\ to\ sign\ in
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 0 — preconditions"
+curl -s -m 5 -o /dev/null "$DASH/login" && ok "dashboard is up on $DASH" || bad "dashboard is up" "$DASH/login"
+curl -s -m 5 -o /dev/null "$MAILPIT/api/v1/messages" && ok "mailpit is up on $MAILPIT" || bad "mailpit is up" "$MAILPIT"
+[ -n "$(sql 'select 1' 2>/dev/null)" ] && ok "Postgres reachable via $PG_CONTAINER" || bad "Postgres reachable" "$PG_CONTAINER"
+[ -x "$FP" ] && ok "fp is built" || bad "fp is built" "cd fp-cloud-cli && uv sync --locked --extra dev"
+[ "$FAIL" = 0 ] || { echo "preconditions failed"; exit 1; }
+
+ONE="fp-one-$STAMP@example.test"
+ONE_SESSION=$(sign_in "$ONE")
+[ -n "$(new_org "$ONE_SESSION" "fp-one-$STAMP")" ] && ok "a person with one org" || bad "a person with one org" "no org"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 1 — browser login: the link, the approval, and the terminal finishes alone"
+run_fp first "$MENU,key:enter,url" "$DASH" -- login
+URL=$(wait_url first)
+has "fp printed the authorize link" "$URL" "$DASH/cli/authorize?r="
+LINK=$(link_token "$URL")
+PAGE=$(person "$ONE_SESSION" lookup "{\"link_token\":\"$LINK\"}")
+eq "the page sees a pending request" "$(echo "$PAGE" | jqp '["status"]')" "pending"
+eq "…of the session kind" "$(echo "$PAGE" | jqp '["kind"]')" "session"
+eq "…for this machine" "$(echo "$PAGE" | jqp '["machine"]["label"]')" "$(hostname)"
+eq "…offering no org to pick" "$(echo "$PAGE" | jqp '["orgs"]')" "[]"
+BEFORE=$(sessions_of "$ONE")
+sleep 3
+eq "nothing is created while it waits" "$(sessions_of "$ONE")" "$BEFORE"
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+eq "approve answered 200" "$(cat "$OUT/status")" "200"
+T=$(wait_done first)
+eq "fp exited 0" "$(cat "$OUT/first.rc")" "0"
+has "the menu offers the browser" "$T" "authorize from a link"
+has "the menu offers the email code" "$T" "send me a 6-digit code"
+has "no display here, so it says the link works anywhere" "$T" "open this link on any device"
+has "it waited with a countdown" "$T" "waiting for you to authorize"
+has "it says it signed in" "$T" "signed in"
+has "…as the person who approved" "$T" "$ONE"
+# In the raw bytes: nothing between the start of the line and the link, and nothing
+# after it. Rich wrapping it, or the box around it, would break it for a click or a copy.
+LINE=$(grep -caP '(\x1b\[[0-9;?]*[A-Za-z]|[\r\n])https?://\S+/cli/authorize\?r=[0-9a-f]{64}\r?$' "$OUT/first.log")
+eq "the link is one unbroken run on its own line, outside the box" "$LINE" "1"
+eq "one more session on the server" "$(sessions_of "$ONE")" "$((BEFORE + 1))"
+eq "the request is spent" "$(request_status "$LINK")" "claimed"
+eq "no machine key came of it" "$(sql "select count(*) from api_keys where created_by_user_id = (select id from users where email = '$ONE')")" "0"
+TOKEN=$(saved session_token)
+[ -n "$TOKEN" ] && ok "the session was saved" || bad "the session was saved" "cli-auth.json"
+eq "saved owner-only" "$(stat -c '%a' "$FP_DIR/cli-auth.json")" "600"
+eq "saved the org it auto-picked" "$(saved org)" "fp-one-$STAMP"
+hasnt "the token never appears in the terminal" "$T" "$TOKEN"
+WHO=$(fp_plain "$DASH" --json whoami)
+eq "the saved session works" "$(echo "$WHO" | jqp '["email"]')" "$ONE"
+eq "…as a person, not a key" "$(echo "$WHO" | jqp '["auth_mode"]')" "session"
+ORGS=$(fp_plain "$DASH" --json orgs list 2>&1)
+has "a command an API key is refused works" "$ORGS" "fp-one-$STAMP"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 2 — signed in already: no menu; --force asks again"
+run_fp again "wait:$ONE" "$DASH" -- login
+T=$(wait_done again)
+eq "fp exited 0" "$(cat "$OUT/again.rc")" "0"
+hasnt "no menu for someone already signed in" "$T" "how do you want to sign in"
+run_fp force "$MENU,key:esc" "$DASH" -- login --force
+T=$(wait_done force)
+eq "--force shows the menu, and esc leaves it" "$(cat "$OUT/force.rc")" "0"
+has "…saying nothing changed" "$T" "cancelled"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 3 — several orgs: picked in the terminal, or by --org"
+TWO="fp-two-$STAMP@example.test"
+TWO_SESSION=$(sign_in "$TWO")
+new_org "$TWO_SESSION" "fp-a-$STAMP" >/dev/null
+new_org "$TWO_SESSION" "fp-b-$STAMP" >/dev/null
+reset_fp
+run_fp pick "$MENU,key:enter,url,wait:choose your org,key:down,key:enter" "$DASH" -- login
+LINK=$(link_token "$(wait_url pick)")
+person "$TWO_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+T=$(wait_done pick)
+eq "fp exited 0" "$(cat "$OUT/pick.rc")" "0"
+PICKED=$(saved org)
+[ "$PICKED" = "fp-a-$STAMP" ] || [ "$PICKED" = "fp-b-$STAMP" ] && ok "the org picked in the terminal was saved" || bad "the org was saved" "$PICKED"
+reset_fp
+run_fp flag "$MENU,key:enter,url" "$DASH" -- login --org "fp-b-$STAMP"
+LINK=$(link_token "$(wait_url flag)")
+person "$TWO_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+T=$(wait_done flag)
+eq "--org skips the picker" "$(saved org)" "fp-b-$STAMP"
+hasnt "…no picker shown" "$T" "choose your org"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 4 — the email code still works, from the menu and with --email"
+reset_fp
+MAILED="fp-mail-$STAMP@example.test"
+curl -s -X DELETE "$MAILPIT/api/v1/search?query=to:$MAILED" >/dev/null || true
+rm -f "$OUT/code"
+run_fp menu_mail "$MENU,key:down,key:enter,wait:email,type:$MAILED,key:enter,wait:enter the 6-digit code,typefile:$OUT/code,key:enter" "$DASH" -- login
+CODE=$(otp_code "$MAILED"); echo "$CODE" > "$OUT/code"
+T=$(wait_done menu_mail)
+eq "fp exited 0" "$(cat "$OUT/menu_mail.rc")" "0"
+eq "the emailed code signed in" "$(saved email)" "$MAILED"
+hasnt "no link was offered" "$T" "/cli/authorize"
+eq "the email code path sends no sign-in alert" "$(sign_in_mails "$MAILED")" "0"
+reset_fp
+curl -s -X DELETE "$MAILPIT/api/v1/search?query=to:$MAILED" >/dev/null || true
+rm -f "$OUT/code"
+run_fp flag_mail "wait:enter the 6-digit code,typefile:$OUT/code,key:enter" "$DASH" -- login --email "$MAILED"
+CODE=$(otp_code "$MAILED"); echo "$CODE" > "$OUT/code"
+T=$(wait_done flag_mail)
+eq "--email signed in" "$(saved email)" "$MAILED"
+hasnt "--email skips the menu" "$T" "how do you want to sign in"
+reset_fp
+OUTPUT=$(env -u FP_TOKEN -u FP_API_KEY NO_COLOR=1 FP_ANALYTICS_DISABLED=1 FP_HOME="$FP_DIR" "$FP" --base-url "$DASH" login </dev/null 2>&1)
+hasnt "no terminal: no menu" "$OUTPUT" "how do you want to sign in"
+hasnt "no terminal: no link" "$OUTPUT" "/cli/authorize"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 5 — not authorized: enter for a new link, esc back to the menu"
+reset_fp
+run_fp deny "$MENU,key:enter,url,wait:not authorized,key:enter,url" "$DASH" -- login
+LINK1=$(link_token "$(wait_url deny)")
+person "$ONE_SESSION" deny "{\"link_token\":\"$LINK1\"}" >/dev/null
+eq "deny answered 200" "$(cat "$OUT/status")" "200"
+LINK2=$(link_token "$(wait_url deny)")
+[ -n "$LINK2" ] && [ "$LINK1" != "$LINK2" ] && ok "enter fetched a NEW link" || bad "enter fetched a new link" "$LINK2"
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK2\"}" >/dev/null
+T=$(wait_done deny)
+eq "fp exited 0 on the new link" "$(cat "$OUT/deny.rc")" "0"
+eq "signed in" "$(saved email)" "$ONE"
+eq "the denied request stays denied" "$(request_status "$LINK1")" "denied"
+reset_fp
+BEFORE=$(sessions_of "$ONE")
+run_fp back "$MENU,key:enter,url,wait:not authorized,key:esc,$MENU,key:esc" "$DASH" -- login
+LINK=$(link_token "$(wait_url back)")
+person "$ONE_SESSION" deny "{\"link_token\":\"$LINK\"}" >/dev/null
+T=$(wait_done back)
+eq "esc went back to the menu, and esc again left" "$(cat "$OUT/back.rc")" "0"
+has "…calmly" "$T" "cancelled"
+eq "…with nothing saved" "$(saved session_token)" ""
+eq "…and no session" "$(sessions_of "$ONE")" "$BEFORE"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 6 — a link that expires offers a fresh one"
+reset_fp
+run_fp expire "$MENU,key:enter,url,wait:that link expired,key:enter,url" "$DASH" -- login
+LINK1=$(link_token "$(wait_url expire)")
+sql "update cli_login_requests set expires_at = now() - interval '1 second' where link_token_hash = encode(sha256('$LINK1'::bytea), 'hex')" >/dev/null
+LINK2=$(link_token "$(wait_url expire)")
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK2\"}" >/dev/null
+T=$(wait_done expire)
+eq "fp exited 0 on the fresh link" "$(cat "$OUT/expire.rc")" "0"
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK1\"}" >/dev/null
+eq "the expired link can no longer be approved" "$(cat "$OUT/status")" "410"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 7 — leaving: esc, ctrl-c, and an approval nobody collects"
+reset_fp
+run_fp esc "$MENU,key:enter,url,wait:waiting for you,key:esc" "$DASH" -- login
+LINK=$(link_token "$(wait_url esc)")
+T=$(wait_done esc)
+eq "esc while waiting exits 0" "$(cat "$OUT/esc.rc")" "0"
+has "…calmly" "$T" "cancelled"
+eq "…with nothing saved" "$(saved session_token)" ""
+BEFORE=$(sessions_of "$ONE")
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+eq "the abandoned link can still be approved" "$(cat "$OUT/status")" "200"
+sleep 3
+eq "…but no session ever exists: nobody claimed it" "$(sessions_of "$ONE")" "$BEFORE"
+eq "…and it stays unclaimed" "$(request_status "$LINK")" "approved"
+run_fp ctrlc "$MENU,key:enter,url,wait:waiting for you,key:ctrl-c" "$DASH" -- login
+wait_url ctrlc >/dev/null
+T=$(wait_done ctrlc)
+eq "ctrl-c while waiting exits 0" "$(cat "$OUT/ctrlc.rc")" "0"
+has "…calmly" "$T" "cancelled"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 8 — a dropped connection is not an answer"
+reset_fp
+run_fp drop "$MENU,key:enter,url,wait:waiting for you,wait:reconnecting,wait:waiting for you" "$DASH" -- login
+LINK=$(link_token "$(wait_url drop)")
+docker stop -t 0 "$DASH_CONTAINER" >/dev/null
+sleep 5
+docker start "$DASH_CONTAINER" >/dev/null
+for _ in $(seq 1 60); do curl -s -m 2 -o /dev/null "$DASH/login" && break; sleep 0.5; done
+ok "the dashboard went away and came back"
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+T=$(wait_done drop)
+eq "fp finished on the same link" "$(cat "$OUT/drop.rc")" "0"
+has "…after saying it was reconnecting" "$T" "reconnecting"
+eq "…and signed in" "$(saved email)" "$ONE"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 9 — where a browser can open, it opens"
+reset_fp
+mkdir -p "$OUT/bin"
+printf '#!/bin/sh\necho "$@" > "%s/opened"\n' "$OUT" > "$OUT/bin/xdg-open"
+chmod +x "$OUT/bin/xdg-open"
+rm -f "$OUT/opened"
+run_fp opens "$MENU,key:enter,url,wait:waiting for you,key:esc" "$DASH" DISPLAY=:99 SSH_TTY= PATH="$OUT/bin:$PATH" -- login
+URL=$(wait_url opens)
+T=$(wait_done opens)
+for _ in $(seq 1 20); do [ -s "$OUT/opened" ] && break; sleep 0.25; done
+eq "the handler got exactly the link" "$(cat "$OUT/opened" 2>/dev/null)" "$URL"
+has "…and the link is on screen as well" "$T" "if nothing appears, open this link"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 10 — a Cloud without this: the email code takes over, and nothing is minted"
+python3 - "$OUT/stub.port" <<'PY' &
+import http.server, sys
+class H(http.server.BaseHTTPRequestHandler):
+    def _404(self):
+        self.send_response(404); self.send_header("content-length", "0"); self.end_headers()
+    do_GET = do_POST = _404
+    def log_message(self, *a): pass
+s = http.server.HTTPServer(("127.0.0.1", 0), H)
+open(sys.argv[1], "w").write(str(s.server_address[1]))
+s.serve_forever()
+PY
+STUB_PID=$!
+for _ in $(seq 1 40); do [ -s "$OUT/stub.port" ] && break; sleep 0.1; done
+reset_fp
+run_fp old404 "$MENU,key:enter,wait:no browser login,wait:email,key:esc" "http://127.0.0.1:$(cat "$OUT/stub.port")" -- login
+T=$(wait_done old404)
+eq "a Cloud with no such route falls through to the email step" "$(cat "$OUT/old404.rc")" "0"
+has "…saying why" "$T" "this Cloud has no browser login yet"
+if [ -n "$CLOUD_1090" ]; then
+  reset_fp
+  KEYS_BEFORE=$(docker exec "$PG_1090" psql -U postgres -d agenteye -tAc "select count(*) from api_keys where created_via = 'cli_login'")
+  STARTED_BEFORE=$(docker exec "$PG_1090" psql -U postgres -d agenteye -tAc "select count(*) from cli_login_requests")
+  run_fp old1090 "$MENU,key:enter,wait:no browser login,wait:email,key:esc" "$CLOUD_1090" -- login
+  T=$(wait_done old1090)
+  eq "a Cloud with only \`failproofai config\`'s login falls through too" "$(cat "$OUT/old1090.rc")" "0"
+  has "…saying why" "$T" "this Cloud has no browser login yet"
+  hasnt "…never offering its machine-key link" "$T" "/cli/authorize"
+  eq "…its request is left pending, for nobody" "$(docker exec "$PG_1090" psql -U postgres -d agenteye -tAc "select count(*) from cli_login_requests where status <> 'pending'")" "0"
+  eq "…one row, as the old route always makes" "$(docker exec "$PG_1090" psql -U postgres -d agenteye -tAc "select count(*) from cli_login_requests")" "$((STARTED_BEFORE + 1))"
+  eq "…and no key" "$(docker exec "$PG_1090" psql -U postgres -d agenteye -tAc "select count(*) from api_keys where created_via = 'cli_login'")" "$KEYS_BEFORE"
+else
+  printf '  \033[33mSKIP\033[0m a Cloud with only failproofai config'"'"'s login (set CLOUD_1090 and PG_1090)\n'
+fi
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 11 — the network warning and the email"
+api_start() { # <address> -> start response
+  unthrottle
+  curl -s -X POST "$DASH/api/auth/cli/start" -H "x-forwarded-for: $1" -H 'content-type: application/json' \
+    -d '{"machine_label":"e2e-box","machine_os":"linux","cli_version":"fp e2e","kind":"session"}'
+}
+api_claim() { curl -s -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$1\"}"; }
+
+AWAY="fp-away-$STAMP@example.test"
+AWAY_SESSION=$(sign_in "$AWAY")
+S=$(api_start 203.0.113.7)
+LINK=$(link_token "$(echo "$S" | jqp '["verification_url"]')")
+SECRET=$(echo "$S" | jqp '["poll_secret"]')
+PAGE=$(person "$AWAY_SESSION" lookup "{\"link_token\":\"$LINK\"}" 198.51.100.9)
+eq "another network: the page warns" "$(echo "$PAGE" | jqp '["different_network"]')" "True"
+eq "…and names the address" "$(echo "$PAGE" | jqp '["requester_address"]')" "203.0.113.7"
+person "$AWAY_SESSION" approve "{\"link_token\":\"$LINK\",\"client_address\":\"203.0.113.7\"}" 198.51.100.9 >/dev/null
+C=$(api_claim "$SECRET")
+has "…the session is still handed over: it warns, it doesn't block" "$C" "session_token"
+AWAY_TOKEN=$(echo "$C" | jqp '["session_token"]')
+wait_sign_in_mail "$AWAY"
+eq "…one email, even though the page forged a matching address" "$(sign_in_mails "$AWAY")" "1"
+M=$(sign_in_mail_text "$AWAY")
+has "…naming the machine" "$M" "fp on e2e-box signed in"
+has "…and where the login started" "$M" "The login started from 203.0.113.7"
+has "…and what that terminal now has" "$M" "in all your organizations"
+hasnt "…carrying no secret" "$M" "$AWAY_TOKEN"
+
+SAME="fp-same-$STAMP@example.test"
+SAME_SESSION=$(sign_in "$SAME")
+S=$(api_start 203.0.113.8)
+LINK=$(link_token "$(echo "$S" | jqp '["verification_url"]')")
+SECRET=$(echo "$S" | jqp '["poll_secret"]')
+PAGE=$(person "$SAME_SESSION" lookup "{\"link_token\":\"$LINK\"}" 203.0.113.8)
+eq "the same network: no warning" "$(echo "$PAGE" | jqp '["different_network"]')" "False"
+eq "…and no address" "$(echo "$PAGE" | jqp '["requester_address"]')" "None"
+person "$SAME_SESSION" approve "{\"link_token\":\"$LINK\"}" 203.0.113.8 >/dev/null
+api_claim "$SECRET" >/dev/null
+sleep 4
+eq "…and no email" "$(sign_in_mails "$SAME")" "0"
+
+# The real `fp`, approved from the same machine: the everyday login stays quiet.
+# (With nothing in front of the dashboard, Next fills in x-forwarded-for from the socket,
+# so both ends read as the docker gateway here. "Can't be compared" is in cli_login_test.rs.)
+LOCAL="fp-local-$STAMP@example.test"
+LOCAL_SESSION=$(sign_in "$LOCAL")
+reset_fp
+run_fp samebox "$MENU,key:enter,url" "$DASH" -- login
+LINK=$(link_token "$(wait_url samebox)")
+PAGE=$(person "$LOCAL_SESSION" lookup "{\"link_token\":\"$LINK\"}")
+eq "the real fp, same machine: no warning" "$(echo "$PAGE" | jqp '["different_network"]')" "False"
+person "$LOCAL_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+wait_done samebox >/dev/null
+sleep 4
+eq "…and no email" "$(sign_in_mails "$LOCAL")" "0"
+
+# The real `fp`, approved from somewhere else: what a phished link looks like.
+reset_fp
+run_fp elsewhere "$MENU,key:enter,url" "$DASH" -- login
+LINK=$(link_token "$(wait_url elsewhere)")
+PAGE=$(person "$LOCAL_SESSION" lookup "{\"link_token\":\"$LINK\"}" 198.51.100.50)
+eq "the real fp, approved elsewhere: the page warns" "$(echo "$PAGE" | jqp '["different_network"]')" "True"
+ADDRESS=$(echo "$PAGE" | jqp '["requester_address"]')
+[ -n "$ADDRESS" ] && [ "$ADDRESS" != None ] && ok "…naming where it started ($ADDRESS)" || bad "…naming where it started" "$PAGE"
+person "$LOCAL_SESSION" approve "{\"link_token\":\"$LINK\"}" 198.51.100.50 >/dev/null
+T=$(wait_done elsewhere)
+eq "…and fp still finishes: a warning, not a block" "$(cat "$OUT/elsewhere.rc")" "0"
+wait_sign_in_mail "$LOCAL"
+eq "…with one email" "$(sign_in_mails "$LOCAL")" "1"
+has "…naming the machine" "$(sign_in_mail_text "$LOCAL")" "fp on $(hostname) signed in"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 12 — what must be refused"
+S=$(api_start 203.0.113.9)
+LINK=$(link_token "$(echo "$S" | jqp '["verification_url"]')")
+SECRET=$(echo "$S" | jqp '["poll_secret"]')
+BAD=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/start" -H 'x-forwarded-for: 203.0.113.10' -H 'content-type: application/json' -d '{"machine_label":"x","kind":"root"}')
+eq "an unknown kind is refused" "$BAD" "422"
+EVIL=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/approve" -b "ae_session=$ONE_SESSION" \
+  -H 'origin: https://evil.example' -H 'content-type: application/json' -d "{\"link_token\":\"$LINK\"}")
+eq "a cross-site approve is refused" "$EVIL" "403"
+FORM=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/approve" -b "ae_session=$ONE_SESSION" \
+  -H "origin: $DASH" -H 'content-type: application/x-www-form-urlencoded' -d "link_token=$LINK")
+eq "a form-encoded approve is refused" "$FORM" "403"
+NOSESS=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/approve" -H "origin: $DASH" \
+  -H 'content-type: application/json' -d "{\"link_token\":\"$LINK\"}")
+eq "no session, no approve" "$NOSESS" "401"
+EARLY=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$SECRET\"}")
+eq "no claim before approval" "$EARLY" "409"
+LINKCLAIM=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$LINK\"}")
+eq "the link cannot claim" "$LINKCLAIM" "404"
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+FIRST=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$SECRET\"}")
+SECOND=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$SECRET\"}")
+eq "the first claim works" "$FIRST" "201"
+eq "…and only the first" "$SECOND" "409"
+CACHE=$(curl -s -D - -o /dev/null -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$SECRET\"}" | tr -d '\r' | grep -i '^cache-control')
+has "a claim answer is never cacheable" "$CACHE" "no-store"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 13 — logout, and no secret in any log"
+reset_fp
+run_fp last "$MENU,key:enter,url" "$DASH" -- login
+LINK=$(link_token "$(wait_url last)")
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+wait_done last >/dev/null
+TOKEN=$(saved session_token)
+eq "signed in" "$(saved email)" "$ONE"
+fp_plain "$DASH" logout >/dev/null 2>&1
+eq "logout clears the saved session" "$(saved session_token)" ""
+eq "…and revokes it on the server" "$(sql "select revoked_at is not null from sessions where token_hash = encode(sha256('$TOKEN'::bytea), 'hex')")" "t"
+for c in "$SERVER_CONTAINER" "$DASH_CONTAINER"; do
+  L=$(docker logs "$c" 2>&1)
+  hasnt "$c logs no session token" "$L" "$TOKEN"
+  hasnt "$c logs no session token from the emails phase" "$L" "$AWAY_TOKEN"
+  hasnt "$c logs no poll secret" "$L" "$SECRET"
+done
+
+printf '\n\033[1m%s passed, %s failed\033[0m\n' "$PASS" "$FAIL"
+[ "$FAIL" = 0 ]
diff --git a/docs/reference/cloud-cli.mdx b/docs/reference/cloud-cli.mdx
index dd9fafcb5..ef89a5f81 100644
--- a/docs/reference/cloud-cli.mdx
+++ b/docs/reference/cloud-cli.mdx
@@ -163,17 +163,20 @@ unchanged when no artifact is returned.
 
 | Command | Purpose | Options |
 | --- | --- | --- |
-| `fp login` | Sign in with an emailed one-time code and select an organization. | `--email`, `-e`; `--org`; `--force` |
+| `fp login` | Sign in from a browser or with an emailed one-time code, and select an organization. `--email` goes straight to the code. | `--email`, `-e`; `--org`; `--force` |
 | `fp logout` | Revoke and remove the saved user session. | — |
 | `fp whoami` | Show the current identity, authentication mode, organization, and permissions. | — |
 | `fp version` | Show the installed CLI version. | — |
 | `fp help` | Show top-level command help. | — |
 
 ```bash
+fp login
 fp login --email you@example.com --org reliability-team
 fp whoami
 ```
 
+On a terminal, `fp login` asks how you want to sign in. **browser** opens a link (over SSH or with no display it prints it, and it works from any device); authorize it and the terminal finishes on its own. That terminal gets your access in all your organizations until the session expires, so only authorize a link you just asked for. If the login started on a different network, the page warns you and you get an email once the session exists. **email** sends a 6-digit code to paste back, and is what `--email`, `--json` and anything without a terminal use.
+
 ### Events
 
 ```text
diff --git a/fp-cloud-cli/CHANGELOG.md b/fp-cloud-cli/CHANGELOG.md
index e26e320a7..38d08723c 100644
--- a/fp-cloud-cli/CHANGELOG.md
+++ b/fp-cloud-cli/CHANGELOG.md
@@ -2,10 +2,9 @@
 
 ## 0.0.3b0 — 2026-10-25
 
-Open for the next release. `0.0.2` published on 2026-10-25 and the `bump` job
-moved the version here automatically; nothing has landed against `0.0.3b0` yet.
-Add entries as changes merge — this section becomes the GitHub Release body when
-it ships.
+### Added
+
+- `fp login` can sign you in from a browser. On a terminal it now asks: **browser** opens a link (over SSH or with no display it prints it, and it works from any device), you authorize it, and the terminal finishes on its own, or **email** sends the 6-digit code as before. `--email` goes straight to the code, and `--json` and anything without a terminal behave as they always did. A dashboard without browser login falls back to the code by itself and never creates a key. Either way you get the same session, with the same lifetime.
 
 ## 0.0.2 — 2026-10-25
 
diff --git a/fp-cloud-cli/README.md b/fp-cloud-cli/README.md
index 107eef0df..f19da79df 100644
--- a/fp-cloud-cli/README.md
+++ b/fp-cloud-cli/README.md
@@ -34,17 +34,23 @@ uv run fp --help
 
 ## Authentication
 
-The CLI talks to your dashboard (set `--base-url` or `FP_DASHBOARD_URL`) and logs in with
-an emailed one-time code:
+The CLI talks to your dashboard (set `--base-url` or `FP_DASHBOARD_URL`) and signs you in
+from a browser or with an emailed one-time code:
 
 ```bash
-fp login --email you@example.com
-# enter the 6-digit code; the session is stored in
+fp login                           # choose: authorize from a link, or get a code by email
+fp login --email you@example.com   # straight to the code; also what scripts and pipes use
+# either way the session is stored in
 # ~/.failproofai/fpcli/cli-auth.json (mode 0600)
 fp whoami
 fp logout
 ```
 
+With **browser**, `fp` opens a link (over SSH or with no display it prints it, and it works
+from any device). Authorize it and the terminal finishes on its own. That terminal gets your
+access in all your orgs until the session expires, so only authorize a link you just asked
+for. A dashboard without browser login falls back to the code by itself.
+
 Sessions expire (24h by default); re-run `fp login` when prompted.
 
 ## Working across orgs (multi-tenant)
diff --git a/fp-cloud-cli/fp_cli/app.py b/fp-cloud-cli/fp_cli/app.py
index 7a438a9c7..21af77eed 100644
--- a/fp-cloud-cli/fp_cli/app.py
+++ b/fp-cloud-cli/fp_cli/app.py
@@ -51,7 +51,7 @@
 
 **Getting started**
 
-* `fp --base-url https://cloud.example.com login` — email a one-time code, then paste it
+* `fp --base-url https://cloud.example.com login` — authorize from a browser, or use an emailed code
 * `fp whoami` — confirm who you are and your permissions
 * `fp --json sessions --since 24h` — run a query (results are newest-first)
 
diff --git a/fp-cloud-cli/fp_cli/auth.py b/fp-cloud-cli/fp_cli/auth.py
index 41d78828f..d6ec89b56 100644
--- a/fp-cloud-cli/fp_cli/auth.py
+++ b/fp-cloud-cli/fp_cli/auth.py
@@ -1,19 +1,35 @@
-"""Email-OTP device login against the dashboard.
+"""Signing in against the dashboard. Both ways end in the same session.
 
-Flow: ``/api/auth/otp/request`` (sends a code) then ``/api/auth/otp/verify``.
+Emailed code: ``/api/auth/otp/request`` (sends a code) then ``/api/auth/otp/verify``.
 The verify response carries the session token in the ``ae_session`` **Set-Cookie**
 header (not the JSON body), so we read it from ``response.cookies``.
+
+Browser: ``/api/auth/cli/start`` returns a link and a poll secret, a person approves
+the link while this polls ``/poll`` with the secret, then ``/claim`` creates the
+session and returns it, once. The token is in the JSON body there: nothing is setting a
+browser cookie. The other end is ``server/src/routes/cli_login.rs`` in AgentEye.
 """
 
 from __future__ import annotations
 
+import math
+import os
+import platform as platform_info
+import re
+import socket
+import subprocess
+import sys
+import time
+from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
-from typing import Any, Dict, Optional, Tuple
+from typing import Any, Callable, Dict, Mapping, Optional, Tuple
+from urllib.parse import urlsplit
 
 import uuid
 
 import httpx
 
+from ._version import __version__
 from .config import CliConfig, save_config
 from .client import _request_id_of
 from .errors import ApiError, AuthError, NetworkError
@@ -136,6 +152,290 @@ def verify_otp(
     return token, expires_in, user
 
 
+#: Sent at start and required back. A Cloud from before this feature's server half
+#: drops the field and would end the request in a machine key, so a missing echo
+#: means "no browser login here": nothing gets approved, and nothing gets minted.
+BROWSER_LOGIN_KIND = "session"
+
+#: A poll stalled on a bad connection freezes the countdown and the Esc key with it.
+_POLL_TIMEOUT_SECS = 10.0
+
+# Controls (a terminal executes them), bidi overrides and isolates, and zero-width
+# formatting. Same set as `displayText` in the npm CLI's `cloud-login.ts`.
+_INVISIBLE = re.compile(
+    "[\u0000-\u001f\u007f-\u009f؜᠎​-‏‪-‮⁠-⁩]"
+)
+
+
+def display_text(value: Any, max_chars: int = 200) -> Optional[str]:
+    """A server-supplied string made safe to print, or ``None`` if nothing is left."""
+    if not isinstance(value, str):
+        return None
+    return _INVISIBLE.sub("", value).strip()[:max_chars] or None
+
+
+def _within(value: Any, low: float, high: float, fallback: float) -> float:
+    """A server's number, kept to a range this client can live with."""
+    if isinstance(value, bool) or not isinstance(value, (int, float)):
+        return fallback
+    if not math.isfinite(value) or value <= 0:
+        return fallback
+    return min(high, max(low, value))
+
+
+def _is_openable(url: Any) -> bool:
+    """Only a plain http(s) link is printed or handed to the opener: it comes from the
+    server, and ``xdg-open`` will act on any scheme it knows."""
+    if not isinstance(url, str) or not all(33 <= ord(c) < 127 for c in url):
+        return False
+    try:
+        parts = urlsplit(url)
+    except ValueError:
+        return False
+    return parts.scheme in ("http", "https") and bool(parts.netloc)
+
+
+def can_open_browser(
+    env: Mapping[str, str] = os.environ, platform: str = sys.platform
+) -> bool:
+    """False over SSH, where a browser would start on the remote machine, and on a Linux
+    box with no display. A guess: being wrong costs a browser that doesn't appear next to
+    a link that is printed anyway."""
+    if env.get("SSH_CONNECTION") or env.get("SSH_CLIENT") or env.get("SSH_TTY"):
+        return False
+    if platform.startswith("linux") and not env.get("DISPLAY") and not env.get("WAYLAND_DISPLAY"):
+        return False
+    return True
+
+
+def open_url(url: str, platform: str = sys.platform) -> None:
+    """Open a link with the platform's handler. Never raises: the link is on screen.
+
+    Not ``webbrowser``: it falls back to text browsers like lynx, which would take over
+    this terminal in the middle of the login box."""
+    try:
+        if platform == "win32":
+            os.startfile(url)  # type: ignore[attr-defined]
+            return
+        subprocess.Popen(
+            ["open" if platform == "darwin" else "xdg-open", url],
+            stdin=subprocess.DEVNULL,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            start_new_session=True,
+        )
+    except OSError:
+        pass
+
+
+def _post_login(
+    base_url: str,
+    path: str,
+    body: Dict[str, Any],
+    *,
+    timeout: float,
+    transport: Optional[httpx.BaseTransport],
+    verify: bool,
+) -> httpx.Response:
+    try:
+        with httpx.Client(
+            base_url=base_url.rstrip("/"),
+            timeout=timeout,
+            transport=transport,
+            verify=verify,
+            headers=_request_id_header(),
+        ) as client:
+            return client.post(path, json=body)
+    except httpx.RequestError as exc:
+        raise _network_error(base_url, exc)
+
+
+def _json_object(response: httpx.Response) -> Optional[Dict[str, Any]]:
+    try:
+        body = response.json()
+    except Exception:
+        return None
+    return body if isinstance(body, dict) else None
+
+
+@dataclass(frozen=True)
+class BrowserLogin:
+    verification_url: str
+    poll_secret: str
+    expires_in: float
+    interval: float
+
+
+def start_browser_login(
+    base_url: str,
+    *,
+    timeout: float = 30.0,
+    transport: Optional[httpx.BaseTransport] = None,
+    verify: bool = True,
+) -> Optional[BrowserLogin]:
+    """Open a login request. ``None`` means this Cloud can't do browser login, and the
+    emailed code still works."""
+    response = _post_login(
+        base_url,
+        "/api/auth/cli/start",
+        {
+            "machine_label": socket.gethostname() or "unknown",
+            "machine_os": "macOS" if sys.platform == "darwin" else platform_info.system().lower(),
+            "cli_version": f"fp {__version__}",
+            "kind": BROWSER_LOGIN_KIND,
+        },
+        timeout=timeout,
+        transport=transport,
+        verify=verify,
+    )
+    status = response.status_code
+    body = _json_object(response)
+    # No such route, the web app redirecting an unknown path, or serving a page in its
+    # place: a Cloud from before browser login. Not an error.
+    if status == 404 or 300 <= status < 400 or (status == 200 and body is None):
+        return None
+    request_id = _request_id_of(response)
+    if status == 429:
+        raise ApiError(
+            "Too many login attempts from here — wait a minute, then run fp login again.",
+            status=429,
+            request_id=request_id,
+        )
+    if status >= 500:
+        raise NetworkError(
+            f"FailproofAI Cloud at {base_url} answered HTTP {status}.", request_id=request_id
+        )
+    if status != 201 or body is None:
+        raise ApiError(
+            f"Could not start a browser login (HTTP {status}).", status=status, request_id=request_id
+        )
+    url = body.get("verification_url")
+    secret = body.get("poll_secret")
+    if body.get("kind") != BROWSER_LOGIN_KIND or not _is_openable(url):
+        return None
+    if not isinstance(secret, str) or not secret:
+        return None
+    return BrowserLogin(
+        verification_url=url,
+        poll_secret=secret,
+        expires_in=_within(body.get("expires_in"), 30, 3600, 600),
+        interval=_within(body.get("interval"), 1, 30, 2),
+    )
+
+
+def poll_browser_login(
+    base_url: str,
+    poll_secret: str,
+    *,
+    timeout: float = _POLL_TIMEOUT_SECS,
+    transport: Optional[httpx.BaseTransport] = None,
+    verify: bool = True,
+) -> str:
+    """One "approved yet?". Raises ``NetworkError`` for anything worth trying again."""
+    response = _post_login(
+        base_url,
+        "/api/auth/cli/poll",
+        {"poll_secret": poll_secret},
+        timeout=timeout,
+        transport=transport,
+        verify=verify,
+    )
+    if response.status_code == 404:
+        return "unknown"
+    body = _json_object(response)
+    if response.status_code != 200 or body is None:
+        raise NetworkError(
+            f"FailproofAI Cloud at {base_url} answered HTTP {response.status_code}.",
+            request_id=_request_id_of(response),
+        )
+    status = body.get("status")
+    known = ("pending", "slow_down", "approved", "denied", "expired", "claimed")
+    return status if status in known else "unknown"
+
+
+def await_browser_approval(
+    base_url: str,
+    login: BrowserLogin,
+    *,
+    tick: Callable[[float, bool], None],
+    timeout: float = _POLL_TIMEOUT_SECS,
+    transport: Optional[httpx.BaseTransport] = None,
+    verify: bool = True,
+) -> str:
+    """Poll until the person answers or the link runs out; returns the final status.
+
+    ``tick(seconds_left, offline)`` waits a moment and may draw; it is how the caller
+    stays responsive, and how a key press gets to cancel. A dropped connection is not
+    an answer, so polling carries on through it.
+    """
+    deadline = time.monotonic() + login.expires_in
+    next_poll = time.monotonic() + login.interval
+    offline = False
+    while True:
+        now = time.monotonic()
+        if now >= deadline:
+            return "expired"
+        tick(deadline - now, offline)
+        if time.monotonic() < next_poll:
+            continue
+        try:
+            status = poll_browser_login(
+                base_url,
+                login.poll_secret,
+                timeout=min(timeout, _POLL_TIMEOUT_SECS),
+                transport=transport,
+                verify=verify,
+            )
+            offline = False
+        except NetworkError:
+            status, offline = "pending", True
+        if status not in ("pending", "slow_down"):
+            return status
+        next_poll = time.monotonic() + login.interval + (1 if status == "slow_down" else 0)
+
+
+def claim_browser_login(
+    base_url: str,
+    poll_secret: str,
+    *,
+    timeout: float = 30.0,
+    transport: Optional[httpx.BaseTransport] = None,
+    verify: bool = True,
+) -> Tuple[str, int, Dict[str, Any]]:
+    """Collect the session, once. Returns ``(token, expires_in_secs, user)``, the same
+    shape as :func:`verify_otp`."""
+    response = _post_login(
+        base_url,
+        "/api/auth/cli/claim",
+        {"poll_secret": poll_secret},
+        timeout=timeout,
+        transport=transport,
+        verify=verify,
+    )
+    request_id = _request_id_of(response)
+    if response.status_code >= 500:
+        raise NetworkError(
+            f"FailproofAI Cloud at {base_url} answered HTTP {response.status_code}.",
+            hint="run fp login again",
+            request_id=request_id,
+        )
+    body = _json_object(response) or {}
+    token = body.get("session_token")
+    if response.status_code != 201 or not isinstance(token, str) or not token:
+        raise AuthError(
+            "That login can't be finished any more.",
+            hint="run fp login again",
+            request_id=request_id,
+        )
+    try:
+        expires_in = int(body.get("expires_in_secs"))
+    except (TypeError, ValueError):
+        expires_in = 86400
+    user = body.get("user")
+    user = user if isinstance(user, dict) else {}
+    return token, expires_in, {"id": display_text(user.get("id")), "email": display_text(user.get("email"))}
+
+
 def persist_session(
     cfg: CliConfig,
     base_url: str,
diff --git a/fp-cloud-cli/fp_cli/commands/auth_cmds.py b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
index 7572c3a8f..8508cbf2f 100644
--- a/fp-cloud-cli/fp_cli/commands/auth_cmds.py
+++ b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+import itertools
+import time
 from dataclasses import asdict
 from typing import List, Optional, Tuple
 
@@ -106,40 +108,141 @@ def _looks_like_email(value: str) -> bool:
     return "@" in s and " " not in s and "." in s.rsplit("@", 1)[-1] and len(s) >= 5
 
 
+_SIGN_IN_WITH = {"browser": "authorize from a link", "email": "send me a 6-digit code"}
+_NO_BROWSER_LOGIN = "this Cloud has no browser login yet — using an emailed code"
+_LINK_ENDED = {
+    "denied": "not authorized",
+    "expired": "that link expired",
+    "claimed": "that link was already used",
+}
+_BACK_TO_MENU = object()
+_SPINNER = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"
+
+
+def _offer_link(url: str) -> None:
+    """The link goes on screen before any browser opens, so one that never appears strands
+    nobody. Over SSH or with no display it is the whole offer, and works from any device."""
+    opening = auth.can_open_browser()
+    output.print_unwrapped(
+        "opening your browser — if nothing appears, open this link:"
+        if opening
+        else "open this link on any device to authorize:"
+    )
+    output.print_unwrapped(url)
+    if opening:
+        auth.open_url(url)
+
+
+def _browser_login_in_box(state: AppState, base: str, box: selectmod.LoginBox):
+    """Link → approval → session, inside the box. Returns ``(token, expires_in, user)``,
+    ``None`` when this Cloud has no browser login, or ``_BACK_TO_MENU``."""
+    options = {"timeout": state.timeout, "verify": not state.insecure}
+    frames = itertools.cycle(_SPINNER)
+
+    def tick(left: float, offline: bool) -> None:
+        minutes, seconds = divmod(int(left), 60)
+        doing = "reconnecting" if offline else "waiting for you to authorize"
+        box.waiting(f"{next(frames)} {doing} · {minutes}:{seconds:02d} · esc to cancel")
+        box.wait_key(0.1)
+
+    while True:
+        box.working("asking for a link…")
+        login = auth.start_browser_login(base, **options)
+        if login is None:
+            return None
+        _offer_link(login.verification_url)
+        try:
+            outcome = auth.await_browser_approval(base, login, tick=tick, **options)
+        except KeyboardInterrupt:  # Ctrl-C during a poll, outside `wait_key`
+            raise selectmod.LoginCancelled()
+        if outcome == "approved":
+            box.working("finishing sign-in…")
+            return auth.claim_browser_login(base, login.poll_secret, **options)
+        if not box.link_ended(_LINK_ENDED.get(outcome, "that link can't be used any more")):
+            return _BACK_TO_MENU
+
+
+def _browser_login_plain(state: AppState, base: str):
+    """The same, for a terminal with no raw mode (Windows). ``None`` when this Cloud has
+    no browser login. A link that ends ends the login: `fp login` is one command away."""
+    options = {"timeout": state.timeout, "verify": not state.insecure}
+    login = auth.start_browser_login(base, **options)
+    if login is None:
+        output.info(_NO_BROWSER_LOGIN)
+        return None
+    _offer_link(login.verification_url)
+    output.info("waiting for you to authorize — ctrl-c to cancel")
+    outcome = auth.await_browser_approval(
+        base, login, tick=lambda _left, _offline: time.sleep(0.25), **options
+    )
+    if outcome == "approved":
+        return auth.claim_browser_login(base, login.poll_secret, **options)
+    raise AuthError(
+        f"{_LINK_ENDED.get(outcome, 'That link cannot be used any more')}.".capitalize(),
+        hint="run fp login for a new link",
+    )
+
+
+def _email_code_in_box(state: AppState, base: str, box: selectmod.LoginBox, email_opt: Optional[str]):
+    """Email → code → verify, inside the box. Returns ``(token, expires_in, user)``."""
+    # email
+    if email_opt:
+        email = email_opt
+        box.note("email", email)
+    else:
+        email = box.text_step("email", validate=_looks_like_email,
+                              error_msg="that doesn't look like an email")
+    # send the code
+    box.working("sending a code…")
+    auth.request_otp(base, email, timeout=state.timeout, verify=not state.insecure)
+    box.note("code sent")
+    # code → verify. A wrong/expired code is reported cleanly INSIDE the box (not a raw
+    # HTTP 500) with a relogin hint, then we exit — re-run `fp login` for a fresh code.
+    code = box.text_step("code", helper="enter the 6-digit code", slots=6, collapse=False)
+    box.working("verifying…")
+    try:
+        token, expires_in, user = auth.verify_otp(
+            base, email, code.strip(), timeout=state.timeout, verify=not state.insecure
+        )
+    except AuthError:
+        box.fail("that code didn't match or has expired", "sign in again with fp login")
+        raise typer.Exit(code=4)
+    except ApiError as exc:  # e.g. too many attempts (429)
+        box.fail(exc.message, "try fp login again in a bit")
+        raise typer.Exit(code=exc.exit_code)
+    box.note("code")  # collapse to `✓ code` — never echo the value
+    return token, expires_in, {**user, "email": user.get("email") or email}
+
+
 def _login_interactive(state: AppState, base: str, email_opt: Optional[str], org_opt: Optional[str]) -> None:
-    """The single-box interactive login (real TTY only): one redrawn-in-place panel — email → code →
-    (org picker) → signed-in. Mirrors the non-interactive orchestration below; only the UI differs.
-    Network/auth errors propagate (terminal restored on the way out) to the standard red error box."""
+    """The single-box interactive login (real TTY only): one redrawn-in-place panel — browser or
+    email code → (org picker) → signed-in. Mirrors the non-interactive orchestration below; only the
+    UI differs. Network/auth errors propagate (terminal restored on the way out) to the standard red
+    error box."""
     saved = state.config.org
     persisted = False
+
+    def choose_method(box: selectmod.LoginBox) -> str:
+        return box.pick(list(_SIGN_IN_WITH), title="how do you want to sign in?",
+                        step="sign in with", notes=_SIGN_IN_WITH)
+
     with selectmod.LoginBox() as box:
         try:
-            # email
-            if email_opt:
-                email = email_opt
-                box.note("email", email)
-            else:
-                email = box.text_step("email", validate=_looks_like_email,
-                                      error_msg="that doesn't look like an email")
-            # send the code
-            box.working("sending a code…")
-            auth.request_otp(base, email, timeout=state.timeout, verify=not state.insecure)
-            box.note("code sent")
-            # code → verify. A wrong/expired code is reported cleanly INSIDE the box (not a raw
-            # HTTP 500) with a relogin hint, then we exit — re-run `fp login` for a fresh code.
-            code = box.text_step("code", helper="enter the 6-digit code", slots=6, collapse=False)
-            box.working("verifying…")
-            try:
-                token, expires_in, user = auth.verify_otp(
-                    base, email, code.strip(), timeout=state.timeout, verify=not state.insecure
-                )
-            except AuthError:
-                box.fail("that code didn't match or has expired", "sign in again with fp login")
-                raise typer.Exit(code=4)
-            except ApiError as exc:  # e.g. too many attempts (429)
-                box.fail(exc.message, "try fp login again in a bit")
-                raise typer.Exit(code=exc.exit_code)
-            box.note("code")  # collapse to `✓ code` — never echo the value
+            method = "email" if email_opt else choose_method(box)
+            creds = None
+            while method == "browser" and creds is None:
+                creds = _browser_login_in_box(state, base, box)
+                if creds is _BACK_TO_MENU:
+                    box.done.pop()  # the `✓ sign in with browser` being taken back
+                    creds = None
+                    method = choose_method(box)
+                elif creds is None:
+                    box.done.pop()
+                    box.note(_NO_BROWSER_LOGIN)
+                    method = "email"
+            if method == "email":
+                creds = _email_code_in_box(state, base, box, email_opt)
+            token, expires_in, user = creds
             # persist first (so we can read authoritative memberships), then resolve the org
             auth.persist_session(state.config, base, token, expires_in, user, insecure=state.insecure)
             persisted = True
@@ -181,32 +284,34 @@ def _login_interactive(state: AppState, base: str, email_opt: Optional[str], org
                 chosen = slugs[0] if slugs else None  # single/none → named only in the final block
             state.config.org = chosen
             cfgmod.save_config(state.config)
-            analytics.capture("logged_in")  # also count the interactive (real-TTY) login path
-            who = user.get("email") or email
-            box.finish(who, chosen)
+            analytics.capture("logged_in", {"method": method})  # also count the interactive (real-TTY) login path
+            box.finish(user.get("email"), chosen)
         except selectmod.LoginCancelled:
             box.cancel(persisted)  # calm close inside the same frame
 
 
 def login(
     ctx: typer.Context,
-    email: Optional[str] = typer.Option(None, "--email", "-e", help="Email to send the login code to (prompted if omitted)."),
+    email: Optional[str] = typer.Option(None, "--email", "-e", help="Sign in with a code sent to this email, skipping the browser-or-email menu."),
     org: Optional[str] = typer.Option(None, "--org", help="Org/tenant slug to sign in to — skips the picker. Must be one you can access."),
     force: bool = typer.Option(False, "--force", help="Re-authenticate even if you already have a valid session."),
 ) -> None:
-    """Sign in to the dashboard with an emailed one-time code.
+    """Sign in to the dashboard, from a browser or with an emailed one-time code.
 
-    You enter your email (or pass `--email`), the dashboard emails a 6-digit code, and you paste
-    it back. The session is saved to `~/.failproofai/fpcli/cli-auth.json` (mode 0600) and lasts ~24h — just
+    On a terminal you choose. **browser** opens a link (over SSH or with no display it prints
+    the link, which works from any device); authorize there and the terminal finishes on its own.
+    **email** sends a 6-digit code that you paste back, and is what `--email`, `--json` and anything
+    without a terminal use. A Cloud without browser login falls back to the code by itself.
+    The session is saved to `~/.failproofai/fpcli/cli-auth.json` (mode 0600) and lasts ~24h — just
     re-run `login` when it expires. Already signed in? `login` shows who you are and exits 0
     without prompting; pass `--force` to re-authenticate anyway.
 
     The active org is chosen here and saved for later commands. With one org it's picked
-    automatically; with several you choose from a list once your email is verified (your last-used
+    automatically; with several you choose from a list once you're signed in (your last-used
     org is the Enter-to-keep default), or pass `--org <slug>` to skip the picker. Switch it later
     with `fp orgs switch <slug>`.
 
-    Both prompts are skippable: `--email` / `--org` provide the values up front, otherwise you're
+    The prompts are skippable: `--email` / `--org` provide the values up front, otherwise you're
     asked interactively. First time, set the dashboard URL with the global `--base-url` (saved for
     next time); add the global `--insecure` for a self-signed/internal dashboard.
 
@@ -216,9 +321,9 @@ def login(
 
     Examples:
 
-    * `fp login` — fully interactive: prompts for your email, then the org picker
+    * `fp login` — fully interactive: browser or email code, then the org picker
     * `fp --base-url https://fp.example.com login` — first time: set the dashboard URL, then sign in interactively
-    * `fp login --email you@example.com --org acme` — skip both prompts (email + org up front)
+    * `fp login --email you@example.com --org acme` — skip the menu and the picker (email code + org up front)
     * `fp --base-url https://dash.internal --insecure login` — self-signed / internal dashboard
     """
     state: AppState = ctx.obj
@@ -284,14 +389,24 @@ def login(
         _login_interactive(state, base, email, org)
         return
     output.auth_header()
-    if not email:
-        email = output.prompt("email")
-    auth.request_otp(base, email, timeout=state.timeout, verify=not state.insecure)
-    output.code_sent(email)
-    code = output.prompt("code")
-    token, expires_in, user = auth.verify_otp(
-        base, email, str(code).strip(), timeout=state.timeout, verify=not state.insecure
-    )
+    method = "email"
+    creds = None
+    # A terminal this can't draw the box on (Windows). Pipes, CI and `--json` skip this.
+    if not state.json and not email and selectmod.stdin_is_tty():
+        answer = str(output.prompt("sign in with [browser/email]", default="browser"))
+        if answer.strip().lower() != "email":
+            creds = _browser_login_plain(state, base)
+            method = "browser" if creds else "email"
+    if creds is None:
+        if not email:
+            email = output.prompt("email")
+        auth.request_otp(base, email, timeout=state.timeout, verify=not state.insecure)
+        output.code_sent(email)
+        code = output.prompt("code")
+        creds = auth.verify_otp(
+            base, email, str(code).strip(), timeout=state.timeout, verify=not state.insecure
+        )
+    token, expires_in, user = creds
     # Persist the token first so we can query the session for authoritative memberships:
     # the OTP-verify payload is slim (no memberships / is_instance_admin) — only
     # GET /api/auth/session returns them.
@@ -354,7 +469,7 @@ def login(
                         f"{slugs[0]}`) or `fp orgs switch <slug>`.")
         raise typer.Exit(code=2)
 
-    analytics.capture("logged_in")  # name-only business event (no email/id/org value)
+    analytics.capture("logged_in", {"method": method})  # no email/id/org value
     if state.json:
         output.emit_json(
             {"logged_in": True, "email": who, "org": chosen, "expires_in_secs": expires_in}
diff --git a/fp-cloud-cli/fp_cli/output.py b/fp-cloud-cli/fp_cli/output.py
index 73cc3c4af..4f8b2294c 100644
--- a/fp-cloud-cli/fp_cli/output.py
+++ b/fp-cloud-cli/fp_cli/output.py
@@ -389,34 +389,45 @@ def _login_slots(buf: str, slots: int) -> Text:
     return out
 
 
-def login_inset(slugs: Sequence[str], idx: int):
-    """The nested org-picker inset (a renderable inside the login frame): a ``choose your org · N``
-    title, then a FAINT-bordered inset box (a hair-lighter fill) with one row per org — ``❯`` cursor
-    (ACCENT) on row ``idx``, selected slug bright, others dim — then a FAINT key-hint line."""
-    title = Text()
-    title.append("choose your org", style=f"bold {theme.TEXT}")
-    title.append(f"  ·  {len(slugs)}", style=theme.FAINT)
+def login_inset(slugs: Sequence[str], idx: int, *, title: str = "choose your org", notes=None):
+    """The nested picker inset (a renderable inside the login frame): a ``{title} · N`` title,
+    then a FAINT-bordered inset box (a hair-lighter fill) with one row per choice — ``❯`` cursor
+    (ACCENT) on row ``idx``, selected slug bright, others dim, and its ``notes`` entry if any —
+    then a FAINT key-hint line."""
+    heading = Text()
+    heading.append(title, style=f"bold {theme.TEXT}")
+    if notes is None:  # a count says something about a list of orgs, not about a menu
+        heading.append(f"  ·  {len(slugs)}", style=theme.FAINT)
     table = Table(box=None, show_header=False, pad_edge=False, padding=(0, 2, 0, 0))
     table.add_column(no_wrap=True)
     table.add_column(no_wrap=True)
+    table.add_column(no_wrap=True)
     for i, slug in enumerate(slugs):
         selected = i == idx
         ptr = Text("❯", style=f"bold {theme.ACCENT}") if selected else Text(" ")
         name = Text(str(slug), style=theme.TEXT if selected else theme.TEXT_DIM)
-        table.add_row(ptr, name)
+        table.add_row(ptr, name, Text((notes or {}).get(slug, ""), style=theme.FAINT))
     inset = Panel(table, box=ROUNDED, border_style=theme.FAINT, style=f"on {theme.INSET_BG}",
                   padding=(0, 1), expand=False)
     hint = Text("↑↓ move · ⏎ select · esc cancel", style=theme.FAINT)
-    return Group(title, inset, hint)
+    return Group(heading, inset, hint)
+
+
+def print_unwrapped(text: str) -> None:
+    """One line on stderr that the terminal wraps, not Rich, so a long link stays one link.
+    Above the login box when it is up (same console), and not silenced by ``--quiet``:
+    the login can't go on without it."""
+    _stderr.print(Text(text), soft_wrap=True)
 
 
 def render_login_frame(done, active, *, active_value: str = "", active_slots: Optional[int] = None,
                        helper=None, error=None, inset=None, note=None, signed_in=None,
-                       cancelled=None, failed=None):
+                       cancelled=None, failed=None, waiting=None):
     """Build the one login Panel (a renderable the caller redraws via ``Live``). ``done`` is a list
     of ``(label, value)`` collapsed ✓ steps; ``active`` is the current step label (bright ``❯``
     line) with ``active_value`` the in-progress typed text (rendered as fixed slots when
-    ``active_slots`` is set, e.g. the 6-digit code). ``inset`` is the org-picker block; ``signed_in``
+    ``active_slots`` is set, e.g. the 6-digit code). ``inset`` is a picker block; ``waiting`` is the
+    live line while a browser approval is pending; ``signed_in``
     = ``(email, org)`` flips the border green; ``cancelled`` (bool: was the session persisted?)
     renders the calm close; ``failed`` = ``(message, hint)`` flips the border red and shows the
     failure INSIDE the same box (e.g. a wrong code). Legend ``◆ fp`` rides the top border."""
@@ -433,7 +444,7 @@ def render_login_frame(done, active, *, active_value: str = "", active_slots: Op
         intro = Text()
         intro.append("welcome ", style=theme.TEXT_DIM)
         intro.append("— ", style=theme.FAINT)
-        intro.append("sign in with a one-time code", style=theme.TEXT_DIM)
+        intro.append("sign in", style=theme.TEXT_DIM)
         lines.append(intro)
     for label, value in done:
         ln = Text()
@@ -460,6 +471,8 @@ def render_login_frame(done, active, *, active_value: str = "", active_slots: Op
             lines.append(Text("  " + str(helper), style=theme.TEXT_DIM))
     if note:
         lines.append(Text("· " + str(note), style=theme.FAINT))
+    if waiting:
+        lines.append(Text(str(waiting), style=theme.TEXT_DIM))
     if inset is not None:
         lines.append(inset)
     if signed_in is not None:
@@ -572,7 +585,7 @@ def version_banner(version: str) -> None:
     ("ESSENTIALS", [
         ("version", "Show the CLI version.", ""),
         ("help", "Show this help and the available commands.", ""),
-        ("login", "Sign in with an emailed one-time code.", ""),
+        ("login", "Sign in from a browser or with an emailed code.", ""),
         ("logout", "Clear the saved session on this machine.", ""),
         ("whoami", "Show the current user, active org, and perms.", ""),
     ]),
diff --git a/fp-cloud-cli/fp_cli/select.py b/fp-cloud-cli/fp_cli/select.py
index 92175c205..d4840e0cf 100644
--- a/fp-cloud-cli/fp_cli/select.py
+++ b/fp-cloud-cli/fp_cli/select.py
@@ -280,13 +280,48 @@ def retry_text(self, message: str) -> None:
         # text_step's own loop shows the error; this is for the verify-fail re-prompt path.
         self._draw(error=message)
 
-    def pick(self, slugs: Sequence[str], *, default: Optional[str] = None) -> str:
-        """The nested org-picker inset: arrow keys move the cursor, Enter selects (collapses to
-        ``✓ org {slug}``), Esc / Ctrl-C raise ``LoginCancelled``."""
+    def waiting(self, text: str) -> None:
+        """Redraw the live line of a pending browser approval."""
+        self._draw(waiting=text)
+
+    def wait_key(self, seconds: float) -> Optional[str]:
+        """Up to ``seconds`` for a keypress: its token, or ``None``. Esc / Ctrl-C raise
+        ``LoginCancelled``."""
+        import select as _sel
+
+        try:
+            ready, _, _ = _sel.select([self._fd], [], [], seconds)
+            key = _read_key(self._fd) if ready else None
+        except KeyboardInterrupt:
+            raise LoginCancelled()
+        if key in ("ESC", "CTRL_C", "EOF"):
+            raise LoginCancelled()
+        return key
+
+    def link_ended(self, message: str) -> bool:
+        """A link that can't be used any more, inside the box. ``True`` asks for a new link
+        (Enter), ``False`` goes back to the menu (Esc), Ctrl-C raises ``LoginCancelled``."""
+        self._draw(failed=(message, "⏎ new link · esc back"))
+        while True:
+            try:
+                key = _read_key(self._fd)
+            except KeyboardInterrupt:
+                raise LoginCancelled()
+            if key == "ENTER":
+                return True
+            if key == "ESC":
+                return False
+            if key in ("CTRL_C", "EOF"):
+                raise LoginCancelled()
+
+    def pick(self, slugs: Sequence[str], *, default: Optional[str] = None,
+             title: str = "choose your org", step: str = "org", notes=None) -> str:
+        """The nested picker inset: arrow keys move the cursor, Enter selects (collapses to
+        ``✓ {step} {slug}``), Esc / Ctrl-C raise ``LoginCancelled``."""
         slugs = list(slugs)
         idx = slugs.index(default) if default in slugs else 0
         self.active = None
-        self._draw(inset=output.login_inset(slugs, idx))
+        self._draw(inset=output.login_inset(slugs, idx, title=title, notes=notes))
         while True:
             try:
                 key = _read_key(self._fd)
@@ -298,14 +333,14 @@ def pick(self, slugs: Sequence[str], *, default: Optional[str] = None) -> str:
                 idx = (idx + 1) % len(slugs)
             elif key == "ENTER":
                 chosen = slugs[idx]
-                self.done.append(("org", chosen))
+                self.done.append((step, chosen))
                 self._draw()
                 return chosen
             elif key in ("ESC", "CTRL_C", "q", "EOF"):
                 raise LoginCancelled()
             else:
                 continue
-            self._draw(inset=output.login_inset(slugs, idx))
+            self._draw(inset=output.login_inset(slugs, idx, title=title, notes=notes))
 
     def finish(self, email: str, org: Optional[str]) -> None:
         """Final state: the outer border + legend flip SUCCESS green; ``● signed in`` + email + org."""
diff --git a/fp-cloud-cli/skill/SKILL.md b/fp-cloud-cli/skill/SKILL.md
index e1a3c5ef5..bc151c01d 100644
--- a/fp-cloud-cli/skill/SKILL.md
+++ b/fp-cloud-cli/skill/SKILL.md
@@ -50,7 +50,7 @@ Throughout this skill, `fp` means "whichever form you resolved."
 
   | | How you supply it | What it is |
   |---|---|---|
-  | **Session** | `fp login` (interactive; it emails a one-time code) | a signed-in **user**, carrying that person's org memberships and permissions |
+  | **Session** | `fp login` (interactive; a browser link or an emailed one-time code) | a signed-in **user**, carrying that person's org memberships and permissions |
   | **API key** | `--api-key <key>`, or `FP_API_KEY` in the environment | a scoped **credential**, carrying exactly the permissions it was granted |
 
   A key is what you want in CI or any other non-interactive context: no browser, no
@@ -112,8 +112,8 @@ Throughout this skill, `fp` means "whichever form you resolved."
 Before real work, run `fp --json whoami` and react to the exit code:
 
 - **exit 4** → no usable credential. If the user is working from a session, tell
-  them to run `fp login` (it emails a one-time code and prompts
-  interactively — you can't complete it for them, and don't fabricate a token).
+  them to run `fp login` in their own terminal (they authorize a browser link or
+  paste an emailed code — you can't complete it for them, and don't fabricate a token).
   If a key was supplied, the key itself was rejected — say so and stop; logging in
   is not the fix, and silently switching to a session would run the command as a
   different identity than the user asked for.
diff --git a/fp-cloud-cli/skill/references/commands.md b/fp-cloud-cli/skill/references/commands.md
index 9bbf6ee9b..3ad6c4bfd 100644
--- a/fp-cloud-cli/skill/references/commands.md
+++ b/fp-cloud-cli/skill/references/commands.md
@@ -72,7 +72,7 @@ Exactly one credential is in play per invocation, chosen in this order:
 ## Identity
 
 ### login / logout / whoami
-- `fp login [--email you@x.com] [--org <slug>]` — emails a one-time code; on a real TTY it's a single interactive box, else a plain prompt. Saves the session to `~/.failproofai/fpcli/cli-auth.json` (was `~/.fp/cli.json`; a session at the old path is adopted automatically on the next command, so an upgrade signs nobody out). **You cannot complete this for the user** (it needs the emailed code). `--org` picks the tenant at login. **Session-only** — exit 2 under a key.
+- `fp login [--email you@x.com] [--org <slug>]` — on a real TTY, a single interactive box asking browser (authorize a link) or email (a one-time code); `--email`, `--json` and anything without a terminal go straight to the code at a plain prompt. Saves the session to `~/.failproofai/fpcli/cli-auth.json` (was `~/.fp/cli.json`; a session at the old path is adopted automatically on the next command, so an upgrade signs nobody out). **You cannot complete this for the user** (it needs their browser or their emailed code). `--org` picks the tenant at login. **Session-only** — exit 2 under a key.
 - `fp logout` — clears the saved session. **Session-only** — exit 2 under a key (a key cannot be "logged out"; revoke it instead).
 - `fp whoami` — active org + your permissions. Run this first; exit 4 = no usable credential.
   **Under a key it answers a different question and still exits 0:** it reports that there is no signed-in user, names the auth mode, and gives the org it will act on. So branch on the auth mode, not on the absence of a user identity — and note that it does not prove the key is accepted or check any permission. Let the first real read do that.
diff --git a/fp-cloud-cli/tests/test_browser_login.py b/fp-cloud-cli/tests/test_browser_login.py
new file mode 100644
index 000000000..90019d88f
--- /dev/null
+++ b/fp-cloud-cli/tests/test_browser_login.py
@@ -0,0 +1,413 @@
+"""`fp login` from a browser: the client half of `/api/auth/cli/*`, and the plain flow.
+
+The box itself needs a real terminal, so `__tests__/e2e/layout/fp-login.sh` drives it
+through a pty against a real stack. What is pinned here is everything that decides
+what a server's answer means, because each mistake there is silent: a Cloud that drops
+`kind` hands back a machine key, and a poll that gives up reads as a person's "no".
+"""
+
+from __future__ import annotations
+
+import json
+import time
+
+import httpx
+import pytest
+import respx
+
+from fp_cli import auth, config
+from fp_cli.app import app
+from fp_cli.errors import ApiError, AuthError, NetworkError
+
+BASE = "http://dash.test"
+LINK = f"{BASE}/cli/authorize?r=abc"
+STARTED = {
+    "verification_url": LINK,
+    "poll_secret": "POLL",
+    "expires_in": 600,
+    "interval": 2,
+    "kind": "session",
+}
+SESSION = {
+    "id": "u1",
+    "email": "me@test",
+    "is_instance_admin": False,
+    "memberships": [
+        {"org_id": "o1", "org_slug": "acme", "org_name": "Acme", "permissions": [], "permission_set": "admin"}
+    ],
+}
+CLAIMED = {"session_token": "tok-browser", "expires_in_secs": 3600, "user": {"id": "u1", "email": "me@test"}}
+
+
+def _start(**over):
+    return httpx.Response(over.pop("status", 201), json={**STARTED, **over})
+
+
+# --- start ------------------------------------------------------------------
+
+
+@respx.mock
+def test_start_asks_for_a_session_and_names_the_machine():
+    route = respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
+    login = auth.start_browser_login(BASE)
+    assert login == auth.BrowserLogin(LINK, "POLL", 600, 2)
+    sent = json.loads(route.calls[0].request.content)
+    assert sent["kind"] == "session"
+    assert sent["machine_label"]
+    assert sent["cli_version"].startswith("fp ")
+
+
+@respx.mock
+@pytest.mark.parametrize(
+    "response",
+    [
+        httpx.Response(404),
+        httpx.Response(302, headers={"location": f"{BASE}/login"}),
+        httpx.Response(200, text="<html>a page, not this API</html>"),
+        # A Cloud with `failproofai config`'s login but not this: it dropped `kind`,
+        # and approving this request would end in a machine key.
+        httpx.Response(201, json={k: v for k, v in STARTED.items() if k != "kind"}),
+        httpx.Response(201, json={**STARTED, "kind": "machine_key"}),
+        httpx.Response(201, json={"kind": "session"}),
+        httpx.Response(201, json={**STARTED, "poll_secret": ""}),
+    ],
+)
+def test_a_cloud_that_cannot_do_this_reads_as_unsupported(response):
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=response)
+    assert auth.start_browser_login(BASE) is None
+
+
+@respx.mock
+@pytest.mark.parametrize(
+    "url",
+    [
+        "file:///etc/passwd",
+        "javascript:alert(1)",
+        "ssh://dash.test",
+        "http://",
+        f"{LINK}\x1b]0;pwned\x07",
+        f"{LINK} --and-more",
+        None,
+    ],
+)
+def test_only_a_plain_http_link_is_ever_printed_or_opened(url):
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start(verification_url=url))
+    assert auth.start_browser_login(BASE) is None
+
+
+@respx.mock
+def test_start_failures_say_what_kind_of_failure_they_are():
+    route = respx.post(f"{BASE}/api/auth/cli/start")
+    route.mock(return_value=httpx.Response(429, json={"error": "rate_limited"}))
+    with pytest.raises(ApiError, match="Too many"):
+        auth.start_browser_login(BASE)
+    route.mock(return_value=httpx.Response(502, json={"error": "upstream unreachable"}))
+    with pytest.raises(NetworkError):
+        auth.start_browser_login(BASE)
+    route.mock(return_value=httpx.Response(422, json={"error": "machine_label_required"}))
+    with pytest.raises(ApiError, match="HTTP 422"):
+        auth.start_browser_login(BASE)
+    route.mock(side_effect=httpx.ConnectError("no route"))
+    with pytest.raises(NetworkError):
+        auth.start_browser_login(BASE)
+
+
+@respx.mock
+def test_a_servers_numbers_are_kept_to_a_range_this_client_can_live_with():
+    route = respx.post(f"{BASE}/api/auth/cli/start")
+    route.mock(return_value=_start(expires_in=10**9, interval=0.001))
+    login = auth.start_browser_login(BASE)
+    assert (login.expires_in, login.interval) == (3600, 1)
+    route.mock(return_value=_start(expires_in="soon", interval=True))
+    login = auth.start_browser_login(BASE)
+    assert (login.expires_in, login.interval) == (600, 2)
+
+
+# --- poll -------------------------------------------------------------------
+
+
+@respx.mock
+@pytest.mark.parametrize(
+    "status", ["pending", "slow_down", "approved", "denied", "expired", "claimed"]
+)
+def test_poll_reports_each_status(status):
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(return_value=httpx.Response(200, json={"status": status}))
+    assert auth.poll_browser_login(BASE, "POLL") == status
+
+
+@respx.mock
+def test_poll_tells_unknown_from_try_again():
+    route = respx.post(f"{BASE}/api/auth/cli/poll")
+    route.mock(return_value=httpx.Response(404, json={"status": "unknown"}))
+    assert auth.poll_browser_login(BASE, "POLL") == "unknown"
+    route.mock(return_value=httpx.Response(200, json={"status": "something new"}))
+    assert auth.poll_browser_login(BASE, "POLL") == "unknown"
+    for answer in (httpx.Response(500), httpx.Response(200, text="not json")):
+        route.mock(return_value=answer)
+        with pytest.raises(NetworkError):
+            auth.poll_browser_login(BASE, "POLL")
+
+
+def _quick(expires_in=60.0):
+    return auth.BrowserLogin(LINK, "POLL", expires_in, 0.0)
+
+
+@respx.mock
+def test_waiting_carries_on_through_a_dropped_connection():
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(
+        side_effect=[
+            httpx.Response(200, json={"status": "pending"}),
+            httpx.ConnectError("wifi went away"),
+            httpx.Response(500),
+            httpx.Response(200, json={"status": "slow_down"}),
+            httpx.Response(200, json={"status": "approved"}),
+        ]
+    )
+    seen = []
+    # `slow_down` adds a second before the next poll: the tick is what passes it.
+    def tick(_left, offline):
+        seen.append(offline)
+        time.sleep(0.05)
+
+    assert auth.await_browser_approval(BASE, _quick(), tick=tick) == "approved"
+    assert True in seen, "a dropped connection is shown to the person"
+    assert seen[-1] is False, "and clears once the server answers"
+
+
+@respx.mock
+@pytest.mark.parametrize("final", ["denied", "expired", "claimed"])
+def test_waiting_ends_on_any_final_answer(final):
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(return_value=httpx.Response(200, json={"status": final}))
+    assert auth.await_browser_approval(BASE, _quick(), tick=lambda *_: None) == final
+
+
+@respx.mock
+def test_waiting_gives_up_when_the_link_runs_out():
+    route = respx.post(f"{BASE}/api/auth/cli/poll")
+    assert auth.await_browser_approval(BASE, _quick(expires_in=0.0), tick=lambda *_: None) == "expired"
+    assert not route.called
+
+
+# --- claim ------------------------------------------------------------------
+
+
+@respx.mock
+def test_claim_returns_the_session_in_the_shape_of_the_emailed_code():
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(return_value=httpx.Response(201, json=CLAIMED))
+    assert auth.claim_browser_login(BASE, "POLL") == ("tok-browser", 3600, CLAIMED["user"])
+
+
+@respx.mock
+def test_claim_refuses_anything_but_a_session():
+    route = respx.post(f"{BASE}/api/auth/cli/claim")
+    # What a machine-key request would answer. Never saved as if it were a session.
+    route.mock(return_value=httpx.Response(201, json={"api_key": "KEY", "key_id": "k"}))
+    with pytest.raises(AuthError):
+        auth.claim_browser_login(BASE, "POLL")
+    for status in (403, 409, 410):
+        route.mock(return_value=httpx.Response(status, json={"error": "approval_revoked"}))
+        with pytest.raises(AuthError) as err:
+            auth.claim_browser_login(BASE, "POLL")
+        assert err.value.hint == "run fp login again"
+    route.mock(return_value=httpx.Response(500))
+    with pytest.raises(NetworkError):
+        auth.claim_browser_login(BASE, "POLL")
+
+
+@respx.mock
+def test_what_the_server_says_about_the_person_cannot_drive_the_terminal():
+    evil = "me\x1b]0;pwned\x07@te‮st\x1b[2J"
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(
+        return_value=httpx.Response(201, json={**CLAIMED, "user": {"id": "u1", "email": evil}})
+    )
+    _, _, user = auth.claim_browser_login(BASE, "POLL")
+    assert user["email"] == "me]0;pwned@test[2J"
+    assert auth.display_text("\x1b​  ") is None
+    assert auth.display_text(7) is None
+
+
+# --- opening a browser ------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "env,platform,expected",
+    [
+        ({"DISPLAY": ":0"}, "linux", True),
+        ({"WAYLAND_DISPLAY": "wayland-0"}, "linux", True),
+        ({}, "linux", False),
+        ({"DISPLAY": ":0", "SSH_TTY": "/dev/pts/1"}, "linux", False),
+        ({"SSH_CONNECTION": "1.2.3.4 1 5.6.7.8 22"}, "darwin", False),
+        ({"SSH_CLIENT": "1.2.3.4 1 22"}, "win32", False),
+        ({}, "darwin", True),
+        ({}, "win32", True),
+    ],
+)
+def test_a_browser_is_only_opened_where_a_person_can_see_it(env, platform, expected):
+    assert auth.can_open_browser(env, platform) is expected
+
+
+def test_opening_uses_the_platform_handler_detached_and_never_raises(monkeypatch):
+    calls = []
+
+    def popen(argv, **kw):
+        calls.append((argv, kw))
+
+    monkeypatch.setattr(auth.subprocess, "Popen", popen)
+    auth.open_url(LINK, "linux")
+    auth.open_url(LINK, "darwin")
+    assert [c[0] for c in calls] == [["xdg-open", LINK], ["open", LINK]]
+    assert calls[0][1]["start_new_session"] is True
+    assert calls[0][1]["stdin"] is auth.subprocess.DEVNULL
+
+    def missing(*_a, **_k):
+        raise FileNotFoundError("xdg-open")
+
+    monkeypatch.setattr(auth.subprocess, "Popen", missing)
+    auth.open_url(LINK, "linux")
+
+
+# --- the command, on a terminal with no raw mode ----------------------------
+#
+# The box needs termios and a real pty, so this is the path CliRunner can reach:
+# stdin stubbed as a terminal, the box stubbed as unavailable. It is what Windows gets,
+# and every decision it makes about a server's answer is the box's too.
+
+
+@pytest.fixture
+def plain_terminal(monkeypatch):
+    monkeypatch.setattr("fp_cli.select.stdin_is_tty", lambda: True)
+    monkeypatch.setattr("fp_cli.select.login_box_supported", lambda: False)
+    # Never a real browser from a test run, wherever it runs.
+    monkeypatch.setattr(auth, "open_url", lambda *_a, **_k: pytest.fail("opened a browser"))
+    monkeypatch.setenv("SSH_TTY", "/dev/pts/1")
+
+
+def _approved_on_first_poll():
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(return_value=httpx.Response(200, json={"status": "approved"}))
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+
+def _fast_links(monkeypatch):
+    real = auth.start_browser_login
+
+    def start(*a, **k):
+        login = real(*a, **k)
+        return login and auth.BrowserLogin(login.verification_url, login.poll_secret, 60.0, 0.0)
+
+    monkeypatch.setattr(auth, "start_browser_login", start)
+
+
+@respx.mock
+def test_choosing_browser_signs_in_without_any_email(home, runner, plain_terminal, monkeypatch):
+    _fast_links(monkeypatch)
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(return_value=httpx.Response(201, json=CLAIMED))
+    _approved_on_first_poll()
+    otp = respx.post(f"{BASE}/api/auth/otp/request")
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="\n")
+
+    assert result.exit_code == 0, result.output
+    assert LINK in result.output
+    assert not otp.called
+    cfg = config.load_config()
+    assert (cfg.session_token, cfg.email, cfg.org) == ("tok-browser", "me@test", "acme")
+
+
+@respx.mock
+def test_a_cloud_without_browser_login_falls_back_to_the_emailed_code(home, runner, plain_terminal):
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=httpx.Response(404))
+    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(
+        return_value=httpx.Response(
+            200,
+            json={"user": {"id": "u1", "email": "me@test"}, "expires_in_secs": 3600},
+            headers={"set-cookie": "ae_session=tok-otp; Path=/"},
+        )
+    )
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="browser\nme@test\n123456\n")
+
+    assert result.exit_code == 0, result.output
+    assert "no browser login" in result.output
+    assert config.load_config().session_token == "tok-otp"
+
+
+@respx.mock
+def test_a_cloud_that_dropped_the_kind_is_never_claimed_from(home, runner, plain_terminal):
+    respx.post(f"{BASE}/api/auth/cli/start").mock(
+        return_value=httpx.Response(201, json={k: v for k, v in STARTED.items() if k != "kind"})
+    )
+    claim = respx.post(f"{BASE}/api/auth/cli/claim")
+    poll = respx.post(f"{BASE}/api/auth/cli/poll")
+    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(return_value=httpx.Response(401))
+
+    runner.invoke(app, ["--base-url", BASE, "login"], input="browser\nme@test\n000000\n")
+
+    assert not poll.called and not claim.called
+
+
+@respx.mock
+@pytest.mark.parametrize("final", ["denied", "expired", "claimed"])
+def test_a_link_that_ends_leaves_nothing_saved(home, runner, plain_terminal, monkeypatch, final):
+    _fast_links(monkeypatch)
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(return_value=httpx.Response(200, json={"status": final}))
+    claim = respx.post(f"{BASE}/api/auth/cli/claim")
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="browser\n")
+
+    assert result.exit_code == 4, result.output
+    assert not claim.called
+    assert config.load_config().session_token is None
+
+
+@respx.mock
+def test_choosing_email_never_touches_the_browser_routes(home, runner, plain_terminal):
+    start = respx.post(f"{BASE}/api/auth/cli/start")
+    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(
+        return_value=httpx.Response(
+            200,
+            json={"user": {"id": "u1", "email": "me@test"}, "expires_in_secs": 3600},
+            headers={"set-cookie": "ae_session=tok-otp; Path=/"},
+        )
+    )
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="email\nme@test\n123456\n")
+
+    assert result.exit_code == 0, result.output
+    assert not start.called
+
+
+@respx.mock
+@pytest.mark.parametrize(
+    "args,tty,stdin",
+    [
+        (["--base-url", BASE, "login", "--email", "me@test"], True, "123456\n"),
+        (["--base-url", BASE, "--json", "login"], True, "me@test\n123456\n"),
+        (["--base-url", BASE, "login"], False, "me@test\n123456\n"),
+    ],
+)
+def test_email_flag_json_and_no_terminal_never_see_the_menu(home, runner, monkeypatch, args, tty, stdin):
+    monkeypatch.setattr("fp_cli.select.stdin_is_tty", lambda: tty)
+    monkeypatch.setattr("fp_cli.select.login_box_supported", lambda: False)
+    start = respx.post(f"{BASE}/api/auth/cli/start")
+    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(
+        return_value=httpx.Response(
+            200,
+            json={"user": {"id": "u1", "email": "me@test"}, "expires_in_secs": 3600},
+            headers={"set-cookie": "ae_session=tok-otp; Path=/"},
+        )
+    )
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+    result = runner.invoke(app, args, input=stdin)
+
+    assert result.exit_code == 0, result.output
+    assert not start.called
+    assert config.load_config().session_token == "tok-otp"

From 825ff35e4cf76d17f9dd1fd25646d913d9336245 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Wed, 4 Nov 2026 20:59:59 +0530
Subject: [PATCH 02/15] [failproofai-feat-failproofai-cloud-login] Add the PR
 number to the changelog entries

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md              | 2 +-
 fp-cloud-cli/CHANGELOG.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0a04233ca..cd04b7e94 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### Features
 
-- `fp login` can sign you in from a browser, as `failproofai config` does: on a terminal it asks browser or email code, and either way you get your own session. New deliberate-run harness: `__tests__/e2e/layout/fp-login.sh`.
+- `fp login` can sign you in from a browser, as `failproofai config` does: on a terminal it asks browser or email code, and either way you get your own session. New deliberate-run harness: `__tests__/e2e/layout/fp-login.sh`. (#981)
 
 ### Dependencies
 
diff --git a/fp-cloud-cli/CHANGELOG.md b/fp-cloud-cli/CHANGELOG.md
index 38d08723c..2150fae51 100644
--- a/fp-cloud-cli/CHANGELOG.md
+++ b/fp-cloud-cli/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### Added
 
-- `fp login` can sign you in from a browser. On a terminal it now asks: **browser** opens a link (over SSH or with no display it prints it, and it works from any device), you authorize it, and the terminal finishes on its own, or **email** sends the 6-digit code as before. `--email` goes straight to the code, and `--json` and anything without a terminal behave as they always did. A dashboard without browser login falls back to the code by itself and never creates a key. Either way you get the same session, with the same lifetime.
+- `fp login` can sign you in from a browser. On a terminal it now asks: **browser** opens a link (over SSH or with no display it prints it, and it works from any device), you authorize it, and the terminal finishes on its own, or **email** sends the 6-digit code as before. `--email` goes straight to the code, and `--json` and anything without a terminal behave as they always did. A dashboard without browser login falls back to the code by itself and never creates a key. Either way you get the same session, with the same lifetime. (#981)
 
 ## 0.0.2 — 2026-10-25
 

From 47c522d92225a10d8b9fff2ee025416558603540 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Wed, 4 Nov 2026 21:25:48 +0530
Subject: [PATCH 03/15] [failproofai-feat-failproofai-cloud-login] Harden `fp
 login` against odd server answers

From review. A huge integer from the server crashed `fp login` with a traceback:
`math.isfinite` raises past a float's range, and a huge session lifetime did the same
through `timedelta` when saving. A link with no host (`https://:443/`) read as openable
and left the terminal waiting on something no browser could open.

In the E2E harness, `typefile` could type an empty file while the shell was still
writing it, and an interrupted run could leave the dashboard container stopped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 __tests__/e2e/layout/cli-login-driver.py | 12 ++++++++----
 __tests__/e2e/layout/fp-login.sh         |  5 +++++
 fp-cloud-cli/fp_cli/auth.py              | 12 ++++++------
 fp-cloud-cli/tests/test_browser_login.py | 19 +++++++++++++++++++
 4 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/__tests__/e2e/layout/cli-login-driver.py b/__tests__/e2e/layout/cli-login-driver.py
index 25239567c..e64f8c9f0 100755
--- a/__tests__/e2e/layout/cli-login-driver.py
+++ b/__tests__/e2e/layout/cli-login-driver.py
@@ -89,12 +89,16 @@ def plain() -> str:
             time.sleep(0.3)
             os.write(fd, arg.encode())
         elif kind == "typefile":
-            while not os.path.exists(arg):
-                if time.time() > deadline or not pump(0.2):
+            # Not just "exists": the shell creates the file before it writes to it.
+            data = b""
+            while not data:
+                if os.path.exists(arg):
+                    with open(arg, "rb") as f:
+                        data = f.read().strip()
+                if not data and (time.time() > deadline or not pump(0.2)):
                     print(f"driver: {arg} never appeared", file=sys.stderr)
                     return 124
-            with open(arg, "rb") as f:
-                os.write(fd, f.read().strip())
+            os.write(fd, data)
         elif kind == "sleep":
             end = time.time() + float(arg)
             while time.time() < end:
diff --git a/__tests__/e2e/layout/fp-login.sh b/__tests__/e2e/layout/fp-login.sh
index a43476a51..65e60ebd7 100755
--- a/__tests__/e2e/layout/fp-login.sh
+++ b/__tests__/e2e/layout/fp-login.sh
@@ -41,6 +41,7 @@ STAMP=$(date +%s)
 OUT=$(mktemp -d)
 FP_DIR="$OUT/fp-home"
 STUB_PID=""
+DASH_STOPPED=0
 
 PASS=0; FAIL=0
 ok()  { PASS=$((PASS+1)); printf '  \033[32mPASS\033[0m %s\n' "$1"; }
@@ -56,6 +57,8 @@ sql() { docker exec "$PG_CONTAINER" psql -U postgres -d agenteye -tAc "$1"; }
 
 cleanup() {
   [ -n "$STUB_PID" ] && kill "$STUB_PID" 2>/dev/null
+  # An interrupted run must not leave someone's stack without its dashboard.
+  [ "$DASH_STOPPED" = 1 ] && docker start "$DASH_CONTAINER" >/dev/null 2>&1
   if [ "$KEEP" = 1 ]; then echo "kept: $OUT"; else rm -rf "$OUT"; fi
 }
 trap cleanup EXIT
@@ -335,9 +338,11 @@ head1 "PHASE 8 — a dropped connection is not an answer"
 reset_fp
 run_fp drop "$MENU,key:enter,url,wait:waiting for you,wait:reconnecting,wait:waiting for you" "$DASH" -- login
 LINK=$(link_token "$(wait_url drop)")
+DASH_STOPPED=1
 docker stop -t 0 "$DASH_CONTAINER" >/dev/null
 sleep 5
 docker start "$DASH_CONTAINER" >/dev/null
+DASH_STOPPED=0
 for _ in $(seq 1 60); do curl -s -m 2 -o /dev/null "$DASH/login" && break; sleep 0.5; done
 ok "the dashboard went away and came back"
 person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
diff --git a/fp-cloud-cli/fp_cli/auth.py b/fp-cloud-cli/fp_cli/auth.py
index d6ec89b56..2523e886b 100644
--- a/fp-cloud-cli/fp_cli/auth.py
+++ b/fp-cloud-cli/fp_cli/auth.py
@@ -178,7 +178,9 @@ def _within(value: Any, low: float, high: float, fallback: float) -> float:
     """A server's number, kept to a range this client can live with."""
     if isinstance(value, bool) or not isinstance(value, (int, float)):
         return fallback
-    if not math.isfinite(value) or value <= 0:
+    # `isfinite` only on a float: JSON integers have no size limit, and past a float's
+    # range it raises instead of answering.
+    if (isinstance(value, float) and not math.isfinite(value)) or value <= 0:
         return fallback
     return min(high, max(low, value))
 
@@ -192,7 +194,7 @@ def _is_openable(url: Any) -> bool:
         parts = urlsplit(url)
     except ValueError:
         return False
-    return parts.scheme in ("http", "https") and bool(parts.netloc)
+    return parts.scheme in ("http", "https") and bool(parts.hostname)
 
 
 def can_open_browser(
@@ -427,10 +429,8 @@ def claim_browser_login(
             hint="run fp login again",
             request_id=request_id,
         )
-    try:
-        expires_in = int(body.get("expires_in_secs"))
-    except (TypeError, ValueError):
-        expires_in = 86400
+    # The server's own range for a session lifetime. Past it `timedelta` raises on saving.
+    expires_in = int(_within(body.get("expires_in_secs"), 60, 30 * 86400, 86400))
     user = body.get("user")
     user = user if isinstance(user, dict) else {}
     return token, expires_in, {"id": display_text(user.get("id")), "email": display_text(user.get("email"))}
diff --git a/fp-cloud-cli/tests/test_browser_login.py b/fp-cloud-cli/tests/test_browser_login.py
index 90019d88f..783127159 100644
--- a/fp-cloud-cli/tests/test_browser_login.py
+++ b/fp-cloud-cli/tests/test_browser_login.py
@@ -85,6 +85,7 @@ def test_a_cloud_that_cannot_do_this_reads_as_unsupported(response):
         "javascript:alert(1)",
         "ssh://dash.test",
         "http://",
+        "https://:443/cli/authorize?r=abc",
         f"{LINK}\x1b]0;pwned\x07",
         f"{LINK} --and-more",
         None,
@@ -121,6 +122,12 @@ def test_a_servers_numbers_are_kept_to_a_range_this_client_can_live_with():
     route.mock(return_value=_start(expires_in="soon", interval=True))
     login = auth.start_browser_login(BASE)
     assert (login.expires_in, login.interval) == (600, 2)
+    # JSON integers have no size limit, and a float can be infinite.
+    route.mock(return_value=_start(expires_in=10**400, interval=10**400))
+    login = auth.start_browser_login(BASE)
+    assert (login.expires_in, login.interval) == (3600, 30)
+    route.mock(return_value=httpx.Response(201, text=json.dumps(STARTED).replace("600", "Infinity")))
+    assert auth.start_browser_login(BASE).expires_in == 600
 
 
 # --- poll -------------------------------------------------------------------
@@ -197,6 +204,18 @@ def test_claim_returns_the_session_in_the_shape_of_the_emailed_code():
     assert auth.claim_browser_login(BASE, "POLL") == ("tok-browser", 3600, CLAIMED["user"])
 
 
+@respx.mock
+@pytest.mark.parametrize("lifetime,saved", [(10**400, 30 * 86400), (0, 86400), ("soon", 86400), (None, 86400)])
+def test_a_servers_session_lifetime_cannot_crash_saving_it(home, lifetime, saved):
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(
+        return_value=httpx.Response(201, json={**CLAIMED, "expires_in_secs": lifetime})
+    )
+    token, expires_in, user = auth.claim_browser_login(BASE, "POLL")
+    assert expires_in == saved
+    auth.persist_session(config.load_config(), BASE, token, expires_in, user)
+    assert config.load_config().session_token == "tok-browser"
+
+
 @respx.mock
 def test_claim_refuses_anything_but_a_session():
     route = respx.post(f"{BASE}/api/auth/cli/claim")

From 4a61405256f1489698293e1f5a9337f9cd21ced9 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Wed, 4 Nov 2026 22:06:33 +0530
Subject: [PATCH 04/15] [failproofai-feat-failproofai-cloud-login] Honour Esc
 pressed during the last poll

From review. A key pressed while a poll was in flight sat unread in stdin, so when
that poll came back approved, `fp` claimed the session and saved it anyway, after the
person had cancelled. Pending keys are now read right before the claim, the last
moment a cancel can be honoured. `fp-login.sh` gains a stand-in that holds a poll open.

Also from review:
- A claim with no `user.id` or `user.email` is refused. `persist_session` keeps the
  previous identity when a field is missing, so it would have saved the new session
  under whoever was signed in before.
- A link with an out-of-range port no longer reads as openable.
- The plain flow (no raw mode) asks again on a typo instead of starting a browser login,
  ends calmly on Ctrl-C, says when it is reconnecting, and no longer promises a code
  in its welcome line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 __tests__/e2e/layout/fp-login.sh          |  49 +++++++++
 fp-cloud-cli/fp_cli/auth.py               |  15 +--
 fp-cloud-cli/fp_cli/commands/auth_cmds.py |  31 ++++--
 fp-cloud-cli/fp_cli/output.py             |   2 +-
 fp-cloud-cli/tests/test_browser_login.py  | 116 ++++++++++++++++++++++
 5 files changed, 200 insertions(+), 13 deletions(-)

diff --git a/__tests__/e2e/layout/fp-login.sh b/__tests__/e2e/layout/fp-login.sh
index 65e60ebd7..4849e58bf 100755
--- a/__tests__/e2e/layout/fp-login.sh
+++ b/__tests__/e2e/layout/fp-login.sh
@@ -333,6 +333,55 @@ T=$(wait_done ctrlc)
 eq "ctrl-c while waiting exits 0" "$(cat "$OUT/ctrlc.rc")" "0"
 has "…calmly" "$T" "cancelled"
 
+# A person who presses esc while a poll is in flight has said no, even if that poll comes
+# back approved. Only a stand-in can hold a poll open, so this one records every claim.
+python3 - "$OUT/held.port" "$OUT/held.claims" <<'PY' &
+import http.server, json, sys, time
+class H(http.server.BaseHTTPRequestHandler):
+    def reply(self, code, body):
+        data = json.dumps(body).encode()
+        self.send_response(code)
+        self.send_header("content-type", "application/json")
+        self.send_header("content-length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+    def do_GET(self):
+        self.reply(200, {"id": "u1", "email": "held@example.test", "is_instance_admin": False, "memberships": []})
+    def do_POST(self):
+        self.rfile.read(int(self.headers.get("content-length", 0)))
+        if self.path.endswith("/start"):
+            self.reply(201, {"verification_url": f"http://{self.headers['host']}/cli/authorize?r=" + "a" * 64,
+                             "poll_secret": "p", "expires_in": 600, "interval": 1, "kind": "session"})
+        elif self.path.endswith("/poll"):
+            time.sleep(4)
+            self.reply(200, {"status": "approved"})
+        elif self.path.endswith("/claim"):
+            open(sys.argv[2], "a").write("claim\n")
+            self.reply(201, {"session_token": "HELD-TOKEN", "expires_in_secs": 3600,
+                             "user": {"id": "u1", "email": "held@example.test"}})
+    def log_message(self, *a): pass
+s = http.server.ThreadingHTTPServer(("127.0.0.1", 0), H)
+open(sys.argv[1], "w").write(str(s.server_address[1]))
+s.serve_forever()
+PY
+HELD_PID=$!
+for _ in $(seq 1 40); do [ -s "$OUT/held.port" ] && break; sleep 0.1; done
+HELD="http://127.0.0.1:$(cat "$OUT/held.port")"
+reset_fp
+run_fp held "$MENU,key:enter,url,wait:waiting for you,sleep:2,key:esc" "$HELD" -- login
+wait_url held >/dev/null
+T=$(wait_done held)
+eq "esc during a poll that comes back approved exits 0" "$(cat "$OUT/held.rc")" "0"
+has "…calmly" "$T" "cancelled"
+eq "…with no claim" "$(cat "$OUT/held.claims" 2>/dev/null | wc -l)" "0"
+eq "…and nothing saved" "$(saved session_token)" ""
+reset_fp
+run_fp notheld "$MENU,key:enter,url" "$HELD" -- login
+wait_url notheld >/dev/null
+T=$(wait_done notheld)
+eq "the same poll with no key pressed does claim, so the stand-in is a fair test" "$(cat "$OUT/held.claims" 2>/dev/null | wc -l)" "1"
+kill "$HELD_PID" 2>/dev/null
+
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 8 — a dropped connection is not an answer"
 reset_fp
diff --git a/fp-cloud-cli/fp_cli/auth.py b/fp-cloud-cli/fp_cli/auth.py
index 2523e886b..4a9534b91 100644
--- a/fp-cloud-cli/fp_cli/auth.py
+++ b/fp-cloud-cli/fp_cli/auth.py
@@ -192,9 +192,9 @@ def _is_openable(url: Any) -> bool:
         return False
     try:
         parts = urlsplit(url)
-    except ValueError:
+        return parts.scheme in ("http", "https") and bool(parts.hostname) and parts.port != 0
+    except ValueError:  # malformed, or `.port` past 65535
         return False
-    return parts.scheme in ("http", "https") and bool(parts.hostname)
 
 
 def can_open_browser(
@@ -423,7 +423,12 @@ def claim_browser_login(
         )
     body = _json_object(response) or {}
     token = body.get("session_token")
-    if response.status_code != 201 or not isinstance(token, str) or not token:
+    user = body.get("user")
+    user = user if isinstance(user, dict) else {}
+    user_id, email = display_text(user.get("id")), display_text(user.get("email"))
+    # No identity is no login: `persist_session` keeps the previous one when a field is
+    # missing, which would save this session under whoever was signed in before.
+    if response.status_code != 201 or not isinstance(token, str) or not token or not user_id or not email:
         raise AuthError(
             "That login can't be finished any more.",
             hint="run fp login again",
@@ -431,9 +436,7 @@ def claim_browser_login(
         )
     # The server's own range for a session lifetime. Past it `timedelta` raises on saving.
     expires_in = int(_within(body.get("expires_in_secs"), 60, 30 * 86400, 86400))
-    user = body.get("user")
-    user = user if isinstance(user, dict) else {}
-    return token, expires_in, {"id": display_text(user.get("id")), "email": display_text(user.get("email"))}
+    return token, expires_in, {"id": user_id, "email": email}
 
 
 def persist_session(
diff --git a/fp-cloud-cli/fp_cli/commands/auth_cmds.py b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
index 8508cbf2f..0f636ee51 100644
--- a/fp-cloud-cli/fp_cli/commands/auth_cmds.py
+++ b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
@@ -152,10 +152,16 @@ def tick(left: float, offline: bool) -> None:
             return None
         _offer_link(login.verification_url)
         try:
+            # ponytail: Esc during a stalled poll waits out its 10s timeout (Ctrl-C doesn't);
+            # polling on a thread would fix that if it ever matters.
             outcome = auth.await_browser_approval(base, login, tick=tick, **options)
         except KeyboardInterrupt:  # Ctrl-C during a poll, outside `wait_key`
             raise selectmod.LoginCancelled()
         if outcome == "approved":
+            # A key pressed during the last poll is still waiting to be read, and Esc means no
+            # session. This is the last moment that can be honoured: the claim creates it.
+            while box.wait_key(0):
+                pass
             box.working("finishing sign-in…")
             return auth.claim_browser_login(base, login.poll_secret, **options)
         if not box.link_ended(_LINK_ENDED.get(outcome, "that link can't be used any more")):
@@ -172,9 +178,16 @@ def _browser_login_plain(state: AppState, base: str):
         return None
     _offer_link(login.verification_url)
     output.info("waiting for you to authorize — ctrl-c to cancel")
-    outcome = auth.await_browser_approval(
-        base, login, tick=lambda _left, _offline: time.sleep(0.25), **options
-    )
+    was_offline = False
+
+    def tick(_left: float, offline: bool) -> None:
+        nonlocal was_offline
+        if offline and not was_offline:
+            output.info("reconnecting…")
+        was_offline = offline
+        time.sleep(0.25)
+
+    outcome = auth.await_browser_approval(base, login, tick=tick, **options)
     if outcome == "approved":
         return auth.claim_browser_login(base, login.poll_secret, **options)
     raise AuthError(
@@ -393,9 +406,15 @@ def login(
     creds = None
     # A terminal this can't draw the box on (Windows). Pipes, CI and `--json` skip this.
     if not state.json and not email and selectmod.stdin_is_tty():
-        answer = str(output.prompt("sign in with [browser/email]", default="browser"))
-        if answer.strip().lower() != "email":
-            creds = _browser_login_plain(state, base)
+        answer = ""
+        while answer not in _SIGN_IN_WITH:
+            answer = str(output.prompt("sign in with [browser/email]", default="browser")).strip().lower()
+        if answer == "browser":
+            try:
+                creds = _browser_login_plain(state, base)
+            except KeyboardInterrupt:
+                output.info("cancelled — not signed in")
+                return
             method = "browser" if creds else "email"
     if creds is None:
         if not email:
diff --git a/fp-cloud-cli/fp_cli/output.py b/fp-cloud-cli/fp_cli/output.py
index 4f8b2294c..46e25864d 100644
--- a/fp-cloud-cli/fp_cli/output.py
+++ b/fp-cloud-cli/fp_cli/output.py
@@ -300,7 +300,7 @@ def auth_header() -> None:
     _stderr.print()
     screen_header(_stderr)
     _stderr.print(Text("SIGN IN", style="bold"))
-    _stderr.print("  [dim]welcome — let's get you signed in with a one-time code[/]")
+    _stderr.print("  [dim]welcome — let's get you signed in[/]")
     _stderr.print()
 
 
diff --git a/fp-cloud-cli/tests/test_browser_login.py b/fp-cloud-cli/tests/test_browser_login.py
index 783127159..4acdf527b 100644
--- a/fp-cloud-cli/tests/test_browser_login.py
+++ b/fp-cloud-cli/tests/test_browser_login.py
@@ -16,7 +16,10 @@
 import respx
 
 from fp_cli import auth, config
+from fp_cli import select as selectmod
+from fp_cli._context import AppState
 from fp_cli.app import app
+from fp_cli.commands import auth_cmds
 from fp_cli.errors import ApiError, AuthError, NetworkError
 
 BASE = "http://dash.test"
@@ -86,6 +89,9 @@ def test_a_cloud_that_cannot_do_this_reads_as_unsupported(response):
         "ssh://dash.test",
         "http://",
         "https://:443/cli/authorize?r=abc",
+        "https://dash.test:99999/cli/authorize?r=abc",
+        "https://dash.test:0/cli/authorize?r=abc",
+        "https://[broken/cli/authorize?r=abc",
         f"{LINK}\x1b]0;pwned\x07",
         f"{LINK} --and-more",
         None,
@@ -233,6 +239,21 @@ def test_claim_refuses_anything_but_a_session():
         auth.claim_browser_login(BASE, "POLL")
 
 
+@respx.mock
+@pytest.mark.parametrize(
+    "user",
+    [None, {}, {"id": "u1"}, {"email": "me@test"}, {"id": "u1", "email": ""}, {"id": "u1", "email": "\x1b\u200b"}, "me"],
+)
+def test_a_claim_with_no_identity_is_no_login(user):
+    # `persist_session` keeps the previous identity when a field is missing, so this
+    # would otherwise save the new session under whoever was signed in before.
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(
+        return_value=httpx.Response(201, json={**CLAIMED, "user": user})
+    )
+    with pytest.raises(AuthError):
+        auth.claim_browser_login(BASE, "POLL")
+
+
 @respx.mock
 def test_what_the_server_says_about_the_person_cannot_drive_the_terminal():
     evil = "me\x1b]0;pwned\x07@te‮st\x1b[2J"
@@ -285,6 +306,56 @@ def missing(*_a, **_k):
     auth.open_url(LINK, "linux")
 
 
+# --- the box, at the moment it claims ----------------------------------------
+
+
+class _Box:
+    """A login box with a queue of keys already pressed. `fp-login.sh` drives the real one."""
+
+    def __init__(self, *keys):
+        self.keys = list(keys)
+
+    def working(self, _text):
+        pass
+
+    def wait_key(self, _seconds):
+        key = self.keys.pop(0) if self.keys else None
+        if key == "ESC":
+            raise selectmod.LoginCancelled()
+        return key
+
+
+@pytest.fixture
+def approved_link(monkeypatch):
+    """A link whose last poll came back approved; returns the list of claims made."""
+    claims = []
+    monkeypatch.setattr(auth, "can_open_browser", lambda *_a: False)
+    monkeypatch.setattr(auth, "start_browser_login", lambda *_a, **_k: auth.BrowserLogin(LINK, "POLL", 60.0, 1.0))
+    monkeypatch.setattr(auth, "await_browser_approval", lambda *_a, **_k: "approved")
+
+    def claim(*_a, **_k):
+        claims.append(1)
+        return ("tok", 3600, CLAIMED["user"])
+
+    monkeypatch.setattr(auth, "claim_browser_login", claim)
+    return claims
+
+
+def _state():
+    return AppState(json=False, base_url=BASE, token=None, timeout=1.0, config=config.CliConfig())
+
+
+def test_esc_pressed_during_the_last_poll_means_no_session(approved_link):
+    with pytest.raises(selectmod.LoginCancelled):
+        auth_cmds._browser_login_in_box(_state(), BASE, _Box("x", "ESC"))
+    assert approved_link == []
+
+
+def test_any_other_key_pressed_during_the_last_poll_changes_nothing(approved_link):
+    assert auth_cmds._browser_login_in_box(_state(), BASE, _Box("x", "ENTER"))[0] == "tok"
+    assert approved_link == [1]
+
+
 # --- the command, on a terminal with no raw mode ----------------------------
 #
 # The box needs termios and a real pty, so this is the path CliRunner can reach:
@@ -383,6 +454,51 @@ def test_a_link_that_ends_leaves_nothing_saved(home, runner, plain_terminal, mon
     assert config.load_config().session_token is None
 
 
+@respx.mock
+def test_a_typo_at_the_prompt_asks_again_instead_of_starting_a_login(home, runner, plain_terminal):
+    start = respx.post(f"{BASE}/api/auth/cli/start")
+    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(return_value=httpx.Response(401))
+
+    runner.invoke(app, ["--base-url", BASE, "login"], input="emial\nemail\nme@test\n000000\n")
+
+    assert not start.called
+
+
+@respx.mock
+def test_ctrl_c_while_waiting_cancels_calmly(home, runner, plain_terminal, monkeypatch):
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
+    claim = respx.post(f"{BASE}/api/auth/cli/claim")
+
+    def interrupted(*_a, **_k):
+        raise KeyboardInterrupt()
+
+    monkeypatch.setattr(auth, "await_browser_approval", interrupted)
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="browser\n")
+
+    assert result.exit_code == 0, result.output
+    assert "cancelled" in result.output
+    assert not claim.called
+    assert config.load_config().session_token is None
+
+
+@respx.mock
+def test_the_plain_flow_says_when_it_is_reconnecting_once(home, runner, plain_terminal, monkeypatch):
+    _fast_links(monkeypatch)
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(
+        side_effect=[httpx.ConnectError("x"), httpx.ConnectError("x"), httpx.Response(200, json={"status": "approved"})]
+    )
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(return_value=httpx.Response(201, json=CLAIMED))
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="browser\n")
+
+    assert result.exit_code == 0, result.output
+    assert result.output.count("reconnecting") == 1
+
+
 @respx.mock
 def test_choosing_email_never_touches_the_browser_routes(home, runner, plain_terminal):
     start = respx.post(f"{BASE}/api/auth/cli/start")

From aebcd46b2abf87a8526a02d08073e0a19cf4cfeb Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Wed, 4 Nov 2026 22:35:45 +0530
Subject: [PATCH 05/15] [failproofai-feat-failproofai-cloud-login] Test the
 address rules on both kinds of deployment

The Cloud half now only believes a client address behind a trusted ingress. A default
deployment must ignore a forged address and still send the email, and the warning is
only reachable with `DASHBOARD_TRUSTED_INGRESS=1`, so `fp-login.sh` takes `TRUSTED_DASH`
and covers both through real Next servers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 __tests__/e2e/layout/README.md   |   5 +-
 __tests__/e2e/layout/fp-login.sh | 161 ++++++++++++++++++-------------
 2 files changed, 99 insertions(+), 67 deletions(-)

diff --git a/__tests__/e2e/layout/README.md b/__tests__/e2e/layout/README.md
index b79eef3ff..7ef59fc28 100644
--- a/__tests__/e2e/layout/README.md
+++ b/__tests__/e2e/layout/README.md
@@ -10,7 +10,7 @@ not depend on — so they are invoked deliberately.
 | `cloud-collector.sh` | an AgentEye stack | real connect against a live server, daemon + collector writing layout-2 paths, decisions reaching ClickHouse, disconnect back to OSS |
 | `systemd-service.sh` | Docker | REAL `systemctl enable --now` as root in a privileged container: service lifecycle, fail-closed, self-heal, reinstall |
 | `cli-login.sh` | an AgentEye stack (dashboard + mailpit + its Postgres), an older Cloud server without `/api/auth/cli/*` routes, Docker, `bun run build` + the release daemon | `config`'s browser login through a real pty in a systemd container: approve, re-login, deny + retry, abandon after approval (no key minted), esc, expiry, revoked saved key, older server, and the person-side refusals (Origin, form posts, no session, start rate limit) |
-| `fp-login.sh` | an AgentEye stack (dashboard + mailpit + its containers), `uv sync` in `fp-cloud-cli`; optionally a Cloud with `config`'s login but not `fp`'s | `fp login`'s browser flow through a real pty: approve, the org picker, the email code from the menu, deny + retry, expiry, esc and ctrl-c, an approval nobody collects (no session), a dropped connection, opening the browser, Clouds without it (nothing minted), the network warning and when the email goes out, the person-side refusals, and no secret in any log |
+| `fp-login.sh` | an AgentEye stack (dashboard + mailpit + its containers), `uv sync` in `fp-cloud-cli`; optionally a Cloud with `config`'s login but not `fp`'s, and a dashboard with `DASHBOARD_TRUSTED_INGRESS=1` | `fp login`'s browser flow through a real pty: approve, the org picker, the email code from the menu, deny + retry, expiry, esc and ctrl-c, an approval nobody collects (no session), a dropped connection, opening the browser, Clouds without it (nothing minted), the network warning and when the email goes out, the person-side refusals, and no secret in any log |
 
 `systemd-service.sh` exists because the service half cannot be tested on a
 developer machine without a password prompt, and a container gives real systemd
@@ -41,7 +41,8 @@ DASH=http://localhost:3000 MAILPIT=http://localhost:8026 OLD_CLOUD=http://localh
 
 # fp-login.sh drives the real `fp` the same way. STACK is the compose project, which
 # names the containers it reads. Add CLOUD_1090 and PG_1090 to cover a Cloud from
-# before `fp`'s half of this; it stops and restarts the dashboard container once.
+# before `fp`'s half of this, and TRUSTED_DASH for the different-network warning. It
+# stops and restarts the dashboard container once.
 DASH=http://127.0.0.1:3000 MAILPIT=http://127.0.0.1:8026 STACK=agenteye \
   bash __tests__/e2e/layout/fp-login.sh
 
diff --git a/__tests__/e2e/layout/fp-login.sh b/__tests__/e2e/layout/fp-login.sh
index 4849e58bf..01503c1db 100755
--- a/__tests__/e2e/layout/fp-login.sh
+++ b/__tests__/e2e/layout/fp-login.sh
@@ -15,6 +15,9 @@
 #   - fp-cloud-cli synced (`uv sync --locked --extra dev`), or FP=<path to fp>
 #   - optionally a Cloud with `failproofai config`'s login but not `fp`'s, on
 #     $CLOUD_1090 with its Postgres in $PG_1090. Skipped when unset.
+#   - optionally the same dashboard image with DASHBOARD_TRUSTED_INGRESS=1 on
+#     $TRUSTED_DASH, for the different-network warning. This script plays the ingress
+#     by setting the header itself. Skipped when unset.
 #
 # Not part of `bun run test:e2e`: like the other harnesses here, it is run
 # deliberately (see README.md in this directory). It stops and restarts the
@@ -36,6 +39,8 @@ REDIS_CONTAINER=${REDIS_CONTAINER:-$STACK-redis-1}
 FP=${FP:-$R/fp-cloud-cli/.venv/bin/fp}
 CLOUD_1090=${CLOUD_1090:-}
 PG_1090=${PG_1090:-}
+TRUSTED_DASH=${TRUSTED_DASH:-}
+PERSON_DASH=$DASH  # which dashboard a person's calls go to
 KEEP=${KEEP:-0}  # 1 = leave the temp dir behind, for reading transcripts
 STAMP=$(date +%s)
 OUT=$(mktemp -d)
@@ -94,8 +99,8 @@ sign_in() { # <email> -> its session, through the real email-code flow
 person() { # <session> <action> <json> [address] -> body; status in $OUT/status
   local xff=()
   [ -n "${4:-}" ] && xff=(-H "x-forwarded-for: $4")
-  curl -s -o "$OUT/body" -w '%{http_code}' -X POST "$DASH/api/auth/cli/$2" -b "ae_session=$1" \
-    "${xff[@]}" -H "origin: $DASH" -H 'content-type: application/json' -d "$3" > "$OUT/status"
+  curl -s -o "$OUT/body" -w '%{http_code}' -X POST "$PERSON_DASH/api/auth/cli/$2" -b "ae_session=$1" \
+    "${xff[@]}" -H "origin: $PERSON_DASH" -H 'content-type: application/json' -d "$3" > "$OUT/status"
   cat "$OUT/body"
 }
 
@@ -451,80 +456,106 @@ else
 fi
 
 # ═════════════════════════════════════════════════════════════════════════════
-head1 "PHASE 11 — the network warning and the email"
-api_start() { # <address> -> start response
+head1 "PHASE 11 — no trusted ingress: no address is believed, and the email always goes out"
+api_start() { # <dashboard> <address> -> start response
   unthrottle
-  curl -s -X POST "$DASH/api/auth/cli/start" -H "x-forwarded-for: $1" -H 'content-type: application/json' \
+  curl -s -X POST "$1/api/auth/cli/start" -H "x-forwarded-for: $2" -H 'content-type: application/json' \
     -d '{"machine_label":"e2e-box","machine_os":"linux","cli_version":"fp e2e","kind":"session"}'
 }
-api_claim() { curl -s -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$1\"}"; }
-
-AWAY="fp-away-$STAMP@example.test"
-AWAY_SESSION=$(sign_in "$AWAY")
-S=$(api_start 203.0.113.7)
+api_claim() { curl -s -X POST "$1/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$2\"}"; }
+requester_of() { sql "select coalesce(requester_address, 'none') from cli_login_requests where link_token_hash = encode(sha256('$1'::bytea), 'hex')"; }
+
+# What a forger would do with nothing in front of the dashboard: write the victim's own
+# address on the request that starts the login.
+FORGED="fp-forged-$STAMP@example.test"
+FORGED_SESSION=$(sign_in "$FORGED")
+S=$(api_start "$DASH" 203.0.113.7)
 LINK=$(link_token "$(echo "$S" | jqp '["verification_url"]')")
 SECRET=$(echo "$S" | jqp '["poll_secret"]')
-PAGE=$(person "$AWAY_SESSION" lookup "{\"link_token\":\"$LINK\"}" 198.51.100.9)
-eq "another network: the page warns" "$(echo "$PAGE" | jqp '["different_network"]')" "True"
-eq "…and names the address" "$(echo "$PAGE" | jqp '["requester_address"]')" "203.0.113.7"
-person "$AWAY_SESSION" approve "{\"link_token\":\"$LINK\",\"client_address\":\"203.0.113.7\"}" 198.51.100.9 >/dev/null
-C=$(api_claim "$SECRET")
-has "…the session is still handed over: it warns, it doesn't block" "$C" "session_token"
-AWAY_TOKEN=$(echo "$C" | jqp '["session_token"]')
-wait_sign_in_mail "$AWAY"
-eq "…one email, even though the page forged a matching address" "$(sign_in_mails "$AWAY")" "1"
-M=$(sign_in_mail_text "$AWAY")
+eq "a forged address is not stored" "$(requester_of "$LINK")" "none"
+PAGE=$(person "$FORGED_SESSION" lookup "{\"link_token\":\"$LINK\"}" 203.0.113.7)
+eq "…and the page has nothing to compare" "$(echo "$PAGE" | jqp '["different_network"]')" "False"
+eq "…so it names no address" "$(echo "$PAGE" | jqp '["requester_address"]')" "None"
+person "$FORGED_SESSION" approve "{\"link_token\":\"$LINK\"}" 203.0.113.7 >/dev/null
+C=$(api_claim "$DASH" "$SECRET")
+has "the session is handed over" "$C" "session_token"
+CLAIMED_TOKEN=$(echo "$C" | jqp '["session_token"]')
+wait_sign_in_mail "$FORGED"
+eq "…and matching forged addresses can't silence the email" "$(sign_in_mails "$FORGED")" "1"
+M=$(sign_in_mail_text "$FORGED")
 has "…naming the machine" "$M" "fp on e2e-box signed in"
-has "…and where the login started" "$M" "The login started from 203.0.113.7"
 has "…and what that terminal now has" "$M" "in all your organizations"
-hasnt "…carrying no secret" "$M" "$AWAY_TOKEN"
+hasnt "…not claiming to know where it started" "$M" "started from"
+hasnt "…and carrying no secret" "$M" "$CLAIMED_TOKEN"
 
-SAME="fp-same-$STAMP@example.test"
-SAME_SESSION=$(sign_in "$SAME")
-S=$(api_start 203.0.113.8)
-LINK=$(link_token "$(echo "$S" | jqp '["verification_url"]')")
-SECRET=$(echo "$S" | jqp '["poll_secret"]')
-PAGE=$(person "$SAME_SESSION" lookup "{\"link_token\":\"$LINK\"}" 203.0.113.8)
-eq "the same network: no warning" "$(echo "$PAGE" | jqp '["different_network"]')" "False"
-eq "…and no address" "$(echo "$PAGE" | jqp '["requester_address"]')" "None"
-person "$SAME_SESSION" approve "{\"link_token\":\"$LINK\"}" 203.0.113.8 >/dev/null
-api_claim "$SECRET" >/dev/null
-sleep 4
-eq "…and no email" "$(sign_in_mails "$SAME")" "0"
-
-# The real `fp`, approved from the same machine: the everyday login stays quiet.
-# (With nothing in front of the dashboard, Next fills in x-forwarded-for from the socket,
-# so both ends read as the docker gateway here. "Can't be compared" is in cli_login_test.rs.)
-LOCAL="fp-local-$STAMP@example.test"
-LOCAL_SESSION=$(sign_in "$LOCAL")
+# The real `fp`, same machine, on a deployment like this one.
+PLAIN="fp-plain-$STAMP@example.test"
+PLAIN_SESSION=$(sign_in "$PLAIN")
 reset_fp
-run_fp samebox "$MENU,key:enter,url" "$DASH" -- login
-LINK=$(link_token "$(wait_url samebox)")
-PAGE=$(person "$LOCAL_SESSION" lookup "{\"link_token\":\"$LINK\"}")
-eq "the real fp, same machine: no warning" "$(echo "$PAGE" | jqp '["different_network"]')" "False"
-person "$LOCAL_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
-wait_done samebox >/dev/null
-sleep 4
-eq "…and no email" "$(sign_in_mails "$LOCAL")" "0"
-
-# The real `fp`, approved from somewhere else: what a phished link looks like.
-reset_fp
-run_fp elsewhere "$MENU,key:enter,url" "$DASH" -- login
-LINK=$(link_token "$(wait_url elsewhere)")
-PAGE=$(person "$LOCAL_SESSION" lookup "{\"link_token\":\"$LINK\"}" 198.51.100.50)
-eq "the real fp, approved elsewhere: the page warns" "$(echo "$PAGE" | jqp '["different_network"]')" "True"
-ADDRESS=$(echo "$PAGE" | jqp '["requester_address"]')
-[ -n "$ADDRESS" ] && [ "$ADDRESS" != None ] && ok "…naming where it started ($ADDRESS)" || bad "…naming where it started" "$PAGE"
-person "$LOCAL_SESSION" approve "{\"link_token\":\"$LINK\"}" 198.51.100.50 >/dev/null
-T=$(wait_done elsewhere)
-eq "…and fp still finishes: a warning, not a block" "$(cat "$OUT/elsewhere.rc")" "0"
-wait_sign_in_mail "$LOCAL"
-eq "…with one email" "$(sign_in_mails "$LOCAL")" "1"
-has "…naming the machine" "$(sign_in_mail_text "$LOCAL")" "fp on $(hostname) signed in"
+run_fp plainbox "$MENU,key:enter,url" "$DASH" -- login
+LINK=$(link_token "$(wait_url plainbox)")
+PAGE=$(person "$PLAIN_SESSION" lookup "{\"link_token\":\"$LINK\"}")
+eq "the real fp: no warning" "$(echo "$PAGE" | jqp '["different_network"]')" "False"
+person "$PLAIN_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+wait_done plainbox >/dev/null
+wait_sign_in_mail "$PLAIN"
+eq "…and the email goes out" "$(sign_in_mails "$PLAIN")" "1"
+
+# ═════════════════════════════════════════════════════════════════════════════
+head1 "PHASE 11b — behind a trusted ingress: the warning, and an email only when it matters"
+if [ -n "$TRUSTED_DASH" ]; then
+  PERSON_DASH=$TRUSTED_DASH
+  AWAY="fp-away-$STAMP@example.test"
+  AWAY_SESSION=$(sign_in "$AWAY")
+  S=$(api_start "$TRUSTED_DASH" 203.0.113.17)
+  LINK=$(link_token "$(echo "$S" | jqp '["verification_url"]')")
+  SECRET=$(echo "$S" | jqp '["poll_secret"]')
+  eq "the address that started it is kept" "$(requester_of "$LINK")" "203.0.113.17"
+  PAGE=$(person "$AWAY_SESSION" lookup "{\"link_token\":\"$LINK\"}" 198.51.100.9)
+  eq "another network: the page warns" "$(echo "$PAGE" | jqp '["different_network"]')" "True"
+  eq "…and names the address" "$(echo "$PAGE" | jqp '["requester_address"]')" "203.0.113.17"
+  person "$AWAY_SESSION" approve "{\"link_token\":\"$LINK\",\"client_address\":\"203.0.113.17\"}" 198.51.100.9 >/dev/null
+  C=$(api_claim "$TRUSTED_DASH" "$SECRET")
+  has "…the session is still handed over: it warns, it doesn't block" "$C" "session_token"
+  wait_sign_in_mail "$AWAY"
+  eq "…one email, even though the page forged a matching address" "$(sign_in_mails "$AWAY")" "1"
+  has "…saying where the login started" "$(sign_in_mail_text "$AWAY")" "The login started from 203.0.113.17"
+
+  SAME="fp-same-$STAMP@example.test"
+  SAME_SESSION=$(sign_in "$SAME")
+  S=$(api_start "$TRUSTED_DASH" 203.0.113.18)
+  LINK=$(link_token "$(echo "$S" | jqp '["verification_url"]')")
+  SECRET=$(echo "$S" | jqp '["poll_secret"]')
+  PAGE=$(person "$SAME_SESSION" lookup "{\"link_token\":\"$LINK\"}" 203.0.113.18)
+  eq "the same network: no warning" "$(echo "$PAGE" | jqp '["different_network"]')" "False"
+  eq "…and no address" "$(echo "$PAGE" | jqp '["requester_address"]')" "None"
+  person "$SAME_SESSION" approve "{\"link_token\":\"$LINK\"}" 203.0.113.18 >/dev/null
+  api_claim "$TRUSTED_DASH" "$SECRET" >/dev/null
+  sleep 4
+  eq "…and no email" "$(sign_in_mails "$SAME")" "0"
+
+  # The real `fp`, approved from somewhere else: what a phished link looks like.
+  LOCAL="fp-local-$STAMP@example.test"
+  LOCAL_SESSION=$(sign_in "$LOCAL")
+  reset_fp
+  run_fp elsewhere "$MENU,key:enter,url" "$TRUSTED_DASH" -- login
+  LINK=$(link_token "$(wait_url elsewhere)")
+  PAGE=$(person "$LOCAL_SESSION" lookup "{\"link_token\":\"$LINK\"}" 198.51.100.50)
+  eq "the real fp, approved elsewhere: the page warns" "$(echo "$PAGE" | jqp '["different_network"]')" "True"
+  person "$LOCAL_SESSION" approve "{\"link_token\":\"$LINK\"}" 198.51.100.50 >/dev/null
+  T=$(wait_done elsewhere)
+  eq "…and fp still finishes: a warning, not a block" "$(cat "$OUT/elsewhere.rc")" "0"
+  wait_sign_in_mail "$LOCAL"
+  eq "…with one email" "$(sign_in_mails "$LOCAL")" "1"
+  has "…naming the machine" "$(sign_in_mail_text "$LOCAL")" "fp on $(hostname) signed in"
+  PERSON_DASH=$DASH
+else
+  printf '  \033[33mSKIP\033[0m the different-network warning (set TRUSTED_DASH)\n'
+fi
 
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 12 — what must be refused"
-S=$(api_start 203.0.113.9)
+S=$(api_start "$DASH" 203.0.113.9)
 LINK=$(link_token "$(echo "$S" | jqp '["verification_url"]')")
 SECRET=$(echo "$S" | jqp '["poll_secret"]')
 BAD=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/start" -H 'x-forwarded-for: 203.0.113.10' -H 'content-type: application/json' -d '{"machine_label":"x","kind":"root"}')
@@ -565,7 +596,7 @@ eq "…and revokes it on the server" "$(sql "select revoked_at is not null from
 for c in "$SERVER_CONTAINER" "$DASH_CONTAINER"; do
   L=$(docker logs "$c" 2>&1)
   hasnt "$c logs no session token" "$L" "$TOKEN"
-  hasnt "$c logs no session token from the emails phase" "$L" "$AWAY_TOKEN"
+  hasnt "$c logs no session token from the emails phase" "$L" "$CLAIMED_TOKEN"
   hasnt "$c logs no poll secret" "$L" "$SECRET"
 done
 

From 131d09408066a9558ecc22a1a82357d6e8438907 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Wed, 4 Nov 2026 23:28:47 +0530
Subject: [PATCH 06/15] [failproofai-feat-failproofai-cloud-login] Read every
 pending key before claiming, whatever it is

From review. The first byte of a non-ASCII character reads as an empty string, and the
loop draining pending keys took that as "none left". So Esc typed after one was never
read, and the login claimed and saved a session anyway. It now stops only on `None`.
`fp-login.sh` covers it with a held poll.

Also from review: the plain flow says when it is back online instead of leaving
"reconnecting" as its last line, and an interrupted harness run no longer leaves the
held stand-in running.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 __tests__/e2e/layout/fp-login.sh          |  9 +++++++++
 fp-cloud-cli/fp_cli/commands/auth_cmds.py |  5 ++++-
 fp-cloud-cli/tests/test_browser_login.py  | 14 +++++++++++---
 3 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/__tests__/e2e/layout/fp-login.sh b/__tests__/e2e/layout/fp-login.sh
index 01503c1db..712471a5a 100755
--- a/__tests__/e2e/layout/fp-login.sh
+++ b/__tests__/e2e/layout/fp-login.sh
@@ -46,6 +46,7 @@ STAMP=$(date +%s)
 OUT=$(mktemp -d)
 FP_DIR="$OUT/fp-home"
 STUB_PID=""
+HELD_PID=""
 DASH_STOPPED=0
 
 PASS=0; FAIL=0
@@ -62,6 +63,7 @@ sql() { docker exec "$PG_CONTAINER" psql -U postgres -d agenteye -tAc "$1"; }
 
 cleanup() {
   [ -n "$STUB_PID" ] && kill "$STUB_PID" 2>/dev/null
+  [ -n "$HELD_PID" ] && kill "$HELD_PID" 2>/dev/null
   # An interrupted run must not leave someone's stack without its dashboard.
   [ "$DASH_STOPPED" = 1 ] && docker start "$DASH_CONTAINER" >/dev/null 2>&1
   if [ "$KEEP" = 1 ]; then echo "kept: $OUT"; else rm -rf "$OUT"; fi
@@ -381,6 +383,13 @@ has "…calmly" "$T" "cancelled"
 eq "…with no claim" "$(cat "$OUT/held.claims" 2>/dev/null | wc -l)" "0"
 eq "…and nothing saved" "$(saved session_token)" ""
 reset_fp
+run_fp heldutf "$MENU,key:enter,url,wait:waiting for you,sleep:1,type:é,key:esc" "$HELD" -- login
+wait_url heldutf >/dev/null
+T=$(wait_done heldutf)
+has "esc after a non-ASCII key, same poll: calm too" "$T" "cancelled"
+eq "…with no claim" "$(cat "$OUT/held.claims" 2>/dev/null | wc -l)" "0"
+eq "…and nothing saved" "$(saved session_token)" ""
+reset_fp
 run_fp notheld "$MENU,key:enter,url" "$HELD" -- login
 wait_url notheld >/dev/null
 T=$(wait_done notheld)
diff --git a/fp-cloud-cli/fp_cli/commands/auth_cmds.py b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
index 0f636ee51..174f48d39 100644
--- a/fp-cloud-cli/fp_cli/commands/auth_cmds.py
+++ b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
@@ -160,7 +160,8 @@ def tick(left: float, offline: bool) -> None:
         if outcome == "approved":
             # A key pressed during the last poll is still waiting to be read, and Esc means no
             # session. This is the last moment that can be honoured: the claim creates it.
-            while box.wait_key(0):
+            # `is not None`: the first byte of a non-ASCII character reads as "".
+            while box.wait_key(0) is not None:
                 pass
             box.working("finishing sign-in…")
             return auth.claim_browser_login(base, login.poll_secret, **options)
@@ -184,6 +185,8 @@ def tick(_left: float, offline: bool) -> None:
         nonlocal was_offline
         if offline and not was_offline:
             output.info("reconnecting…")
+        elif was_offline and not offline:
+            output.info("back online — still waiting for you to authorize")
         was_offline = offline
         time.sleep(0.25)
 
diff --git a/fp-cloud-cli/tests/test_browser_login.py b/fp-cloud-cli/tests/test_browser_login.py
index 4acdf527b..28bf90fe9 100644
--- a/fp-cloud-cli/tests/test_browser_login.py
+++ b/fp-cloud-cli/tests/test_browser_login.py
@@ -345,9 +345,11 @@ def _state():
     return AppState(json=False, base_url=BASE, token=None, timeout=1.0, config=config.CliConfig())
 
 
-def test_esc_pressed_during_the_last_poll_means_no_session(approved_link):
+@pytest.mark.parametrize("before", [(), ("x",), ("UP",), ("", "")], ids=["alone", "letter", "arrow", "non-ascii"])
+def test_esc_pressed_during_the_last_poll_means_no_session(approved_link, before):
+    # A non-ASCII character reads as "", once per byte: not the end of the queue.
     with pytest.raises(selectmod.LoginCancelled):
-        auth_cmds._browser_login_in_box(_state(), BASE, _Box("x", "ESC"))
+        auth_cmds._browser_login_in_box(_state(), BASE, _Box(*before, "ESC"))
     assert approved_link == []
 
 
@@ -488,7 +490,12 @@ def test_the_plain_flow_says_when_it_is_reconnecting_once(home, runner, plain_te
     _fast_links(monkeypatch)
     respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
     respx.post(f"{BASE}/api/auth/cli/poll").mock(
-        side_effect=[httpx.ConnectError("x"), httpx.ConnectError("x"), httpx.Response(200, json={"status": "approved"})]
+        side_effect=[
+            httpx.ConnectError("x"),
+            httpx.ConnectError("x"),
+            httpx.Response(200, json={"status": "pending"}),
+            httpx.Response(200, json={"status": "approved"}),
+        ]
     )
     respx.post(f"{BASE}/api/auth/cli/claim").mock(return_value=httpx.Response(201, json=CLAIMED))
     respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
@@ -497,6 +504,7 @@ def test_the_plain_flow_says_when_it_is_reconnecting_once(home, runner, plain_te
 
     assert result.exit_code == 0, result.output
     assert result.output.count("reconnecting") == 1
+    assert "back online" in result.output
 
 
 @respx.mock

From 7c549b77bdf493e7d69c7dbb0772d9708974afa1 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Thu, 5 Nov 2026 01:39:44 +0530
Subject: [PATCH 07/15] [failproofai-feat-failproofai-cloud-login] Refuse a
 claimed token no later request could carry, and send any hostname

`claim_browser_login` saved any non-empty string as the session. A hostile or broken server could
hand back a token with a control or non-ASCII character: it was written to cli-auth.json, every
later command failed on it, and a non-ASCII one made `fp whoami` a traceback. A hostname that isn't
UTF-8 was a traceback at `start`, because Python hands those bytes back as surrogates and JSON can't
carry them, and a blank one was a 422 from the server with no fallback to the emailed code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 fp-cloud-cli/fp_cli/auth.py              | 22 ++++++++++++++++++--
 fp-cloud-cli/tests/test_browser_login.py | 26 ++++++++++++++++++++++++
 2 files changed, 46 insertions(+), 2 deletions(-)

diff --git a/fp-cloud-cli/fp_cli/auth.py b/fp-cloud-cli/fp_cli/auth.py
index 4a9534b91..b3bc146cb 100644
--- a/fp-cloud-cli/fp_cli/auth.py
+++ b/fp-cloud-cli/fp_cli/auth.py
@@ -167,6 +167,11 @@ def verify_otp(
 )
 
 
+#: What a session token can be and still be sent back on every later request. A real one is
+#: 64 hex characters; a cookie or a header can't carry a control or a non-ASCII character.
+_SESSION_TOKEN = re.compile(r"[A-Za-z0-9._~+/=-]{1,4096}")
+
+
 def display_text(value: Any, max_chars: int = 200) -> Optional[str]:
     """A server-supplied string made safe to print, or ``None`` if nothing is left."""
     if not isinstance(value, str):
@@ -174,6 +179,13 @@ def display_text(value: Any, max_chars: int = 200) -> Optional[str]:
     return _INVISIBLE.sub("", value).strip()[:max_chars] or None
 
 
+def _machine_label() -> str:
+    """This machine's name, always sendable. Python hands back a hostname's non-UTF-8 bytes
+    as surrogates, which JSON can't carry, and the server refuses a label with nothing in it."""
+    name = socket.gethostname().encode("utf-8", "replace").decode("utf-8")
+    return display_text(name) or "unknown"
+
+
 def _within(value: Any, low: float, high: float, fallback: float) -> float:
     """A server's number, kept to a range this client can live with."""
     if isinstance(value, bool) or not isinstance(value, (int, float)):
@@ -281,7 +293,7 @@ def start_browser_login(
         base_url,
         "/api/auth/cli/start",
         {
-            "machine_label": socket.gethostname() or "unknown",
+            "machine_label": _machine_label(),
             "machine_os": "macOS" if sys.platform == "darwin" else platform_info.system().lower(),
             "cli_version": f"fp {__version__}",
             "kind": BROWSER_LOGIN_KIND,
@@ -428,7 +440,13 @@ def claim_browser_login(
     user_id, email = display_text(user.get("id")), display_text(user.get("email"))
     # No identity is no login: `persist_session` keeps the previous one when a field is
     # missing, which would save this session under whoever was signed in before.
-    if response.status_code != 201 or not isinstance(token, str) or not token or not user_id or not email:
+    if (
+        response.status_code != 201
+        or not isinstance(token, str)
+        or not _SESSION_TOKEN.fullmatch(token)
+        or not user_id
+        or not email
+    ):
         raise AuthError(
             "That login can't be finished any more.",
             hint="run fp login again",
diff --git a/fp-cloud-cli/tests/test_browser_login.py b/fp-cloud-cli/tests/test_browser_login.py
index 28bf90fe9..f86263321 100644
--- a/fp-cloud-cli/tests/test_browser_login.py
+++ b/fp-cloud-cli/tests/test_browser_login.py
@@ -254,6 +254,32 @@ def test_a_claim_with_no_identity_is_no_login(user):
         auth.claim_browser_login(BASE, "POLL")
 
 
+@respx.mock
+@pytest.mark.parametrize("token", ["☃☃☃", "abc\r\nx-evil: 1", "a b", "\x1b]0;x\x07", "x" * 5000, ""])
+def test_a_token_no_later_request_could_carry_is_never_saved(token):
+    # Saved, every later command fails on it, and a non-ASCII one with a traceback.
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(
+        return_value=httpx.Response(201, json={**CLAIMED, "session_token": token})
+    )
+    with pytest.raises(AuthError):
+        auth.claim_browser_login(BASE, "POLL")
+
+
+@respx.mock
+@pytest.mark.parametrize(
+    "hostname,label",
+    [("ho\udcffst", "ho?st"), ("\x01\x02", "unknown"), ("   ", "unknown"), ("", "unknown"), ("a\x1b]0;x\x07b", "a]0;xb")],
+    ids=["not-utf8", "controls", "spaces", "empty", "escape"],
+)
+def test_any_hostname_still_starts_a_login(monkeypatch, hostname, label):
+    # JSON can't carry a surrogate, which is how Python hands back bytes that aren't UTF-8,
+    # and the server refuses a label with nothing left in it.
+    monkeypatch.setattr(auth.socket, "gethostname", lambda: hostname)
+    route = respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
+    assert auth.start_browser_login(BASE) is not None
+    assert json.loads(route.calls[0].request.content)["machine_label"] == label
+
+
 @respx.mock
 def test_what_the_server_says_about_the_person_cannot_drive_the_terminal():
     evil = "me\x1b]0;pwned\x07@te‮st\x1b[2J"

From cfa9e5766619d604c2f7dc488b74ca72dd7ae4d4 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Thu, 5 Nov 2026 01:39:44 +0530
Subject: [PATCH 08/15] [failproofai-feat-failproofai-cloud-login] Don't let a
 key pressed during the last poll answer the next screen

Pending keys were only read when that poll came back approved. On a poll that came back denied or
expired, a queued Enter went straight to `link_ended`, so a new link started with "not authorized"
on screen for no time at all, and a queued Esc went back to the menu when the screen had promised
to cancel. Pending keys are now read whatever the poll said.

Ctrl-C while asking for a link or finishing sign-in also wasn't the calm cancel the PR promises: it
left the box with exit 130 and no message. It now covers every request of the browser flow. The
email path is deliberately left as it is on main.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 __tests__/e2e/layout/fp-login.sh          | 52 +++++++++++++++++++++--
 fp-cloud-cli/fp_cli/commands/auth_cmds.py | 34 ++++++++-------
 fp-cloud-cli/tests/test_browser_login.py  | 32 ++++++++++++++
 3 files changed, 98 insertions(+), 20 deletions(-)

diff --git a/__tests__/e2e/layout/fp-login.sh b/__tests__/e2e/layout/fp-login.sh
index 712471a5a..11a570452 100755
--- a/__tests__/e2e/layout/fp-login.sh
+++ b/__tests__/e2e/layout/fp-login.sh
@@ -342,8 +342,10 @@ has "…calmly" "$T" "cancelled"
 
 # A person who presses esc while a poll is in flight has said no, even if that poll comes
 # back approved. Only a stand-in can hold a poll open, so this one records every claim.
-python3 - "$OUT/held.port" "$OUT/held.claims" <<'PY' &
-import http.server, json, sys, time
+python3 - "$OUT/held.port" "$OUT/held.claims" "$OUT/held.mode" "$OUT/held.starts" <<'PY' &
+import http.server, json, os, sys, time
+def mode():
+    return open(sys.argv[3]).read().strip() if os.path.exists(sys.argv[3]) else ""
 class H(http.server.BaseHTTPRequestHandler):
     def reply(self, code, body):
         data = json.dumps(body).encode()
@@ -357,13 +359,19 @@ class H(http.server.BaseHTTPRequestHandler):
     def do_POST(self):
         self.rfile.read(int(self.headers.get("content-length", 0)))
         if self.path.endswith("/start"):
+            open(sys.argv[4], "a").write("start\n")
+            if mode() == "slow-start":
+                time.sleep(8)
             self.reply(201, {"verification_url": f"http://{self.headers['host']}/cli/authorize?r=" + "a" * 64,
                              "poll_secret": "p", "expires_in": 600, "interval": 1, "kind": "session"})
         elif self.path.endswith("/poll"):
-            time.sleep(4)
-            self.reply(200, {"status": "approved"})
+            if mode() != "slow-claim":
+                time.sleep(4)
+            self.reply(200, {"status": "denied" if mode() == "denied" else "approved"})
         elif self.path.endswith("/claim"):
             open(sys.argv[2], "a").write("claim\n")
+            if mode() == "slow-claim":
+                time.sleep(8)
             self.reply(201, {"session_token": "HELD-TOKEN", "expires_in_secs": 3600,
                              "user": {"id": "u1", "email": "held@example.test"}})
     def log_message(self, *a): pass
@@ -394,6 +402,42 @@ run_fp notheld "$MENU,key:enter,url" "$HELD" -- login
 wait_url notheld >/dev/null
 T=$(wait_done notheld)
 eq "the same poll with no key pressed does claim, so the stand-in is a fair test" "$(cat "$OUT/held.claims" 2>/dev/null | wc -l)" "1"
+
+# Enter pressed during a poll that comes back denied was pressed at a screen that's gone.
+reset_fp
+echo denied > "$OUT/held.mode"
+rm -f "$OUT/held.starts"
+run_fp heldenter "$MENU,key:enter,url,wait:waiting for you,sleep:1,key:enter,wait:not authorized,sleep:2,key:esc,$MENU,key:esc" "$HELD" -- login
+wait_url heldenter >/dev/null
+T=$(wait_done heldenter)
+eq "enter during a poll that comes back denied doesn't take a new link" "$(wc -l < "$OUT/held.starts")" "1"
+has "…the denial stays on screen until it's answered" "$T" "new link"
+eq "…and the person can still leave" "$(cat "$OUT/heldenter.rc")" "0"
+reset_fp
+rm -f "$OUT/held.starts"
+run_fp heldescdeny "$MENU,key:enter,url,wait:waiting for you,sleep:1,key:esc" "$HELD" -- login
+wait_url heldescdeny >/dev/null
+T=$(wait_done heldescdeny)
+eq "esc during a poll that comes back denied exits 0" "$(cat "$OUT/heldescdeny.rc")" "0"
+has "…calmly, as the screen promised" "$T" "cancelled"
+eq "…with one link" "$(wc -l < "$OUT/held.starts")" "1"
+
+# Ctrl-C at any request, not only during a poll.
+reset_fp
+echo slow-start > "$OUT/held.mode"
+run_fp heldstart "$MENU,key:enter,wait:asking for a link,sleep:1,key:ctrl-c" "$HELD" -- login
+T=$(wait_done heldstart)
+eq "ctrl-c while asking for a link exits 0" "$(cat "$OUT/heldstart.rc")" "0"
+has "…calmly" "$T" "cancelled"
+reset_fp
+echo slow-claim > "$OUT/held.mode"
+rm -f "$OUT/held.claims"
+run_fp heldclaim "$MENU,key:enter,url,wait:finishing sign-in,sleep:1,key:ctrl-c" "$HELD" -- login
+wait_url heldclaim >/dev/null
+T=$(wait_done heldclaim)
+eq "ctrl-c while finishing exits 0" "$(cat "$OUT/heldclaim.rc")" "0"
+has "…calmly" "$T" "cancelled"
+eq "…and saves nothing" "$(saved session_token)" ""
 kill "$HELD_PID" 2>/dev/null
 
 # ═════════════════════════════════════════════════════════════════════════════
diff --git a/fp-cloud-cli/fp_cli/commands/auth_cmds.py b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
index 174f48d39..d15229a88 100644
--- a/fp-cloud-cli/fp_cli/commands/auth_cmds.py
+++ b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
@@ -145,28 +145,30 @@ def tick(left: float, offline: bool) -> None:
         box.waiting(f"{next(frames)} {doing} · {minutes}:{seconds:02d} · esc to cancel")
         box.wait_key(0.1)
 
-    while True:
-        box.working("asking for a link…")
-        login = auth.start_browser_login(base, **options)
-        if login is None:
-            return None
-        _offer_link(login.verification_url)
-        try:
+    try:
+        while True:
+            box.working("asking for a link…")
+            login = auth.start_browser_login(base, **options)
+            if login is None:
+                return None
+            _offer_link(login.verification_url)
             # ponytail: Esc during a stalled poll waits out its 10s timeout (Ctrl-C doesn't);
             # polling on a thread would fix that if it ever matters.
             outcome = auth.await_browser_approval(base, login, tick=tick, **options)
-        except KeyboardInterrupt:  # Ctrl-C during a poll, outside `wait_key`
-            raise selectmod.LoginCancelled()
-        if outcome == "approved":
-            # A key pressed during the last poll is still waiting to be read, and Esc means no
-            # session. This is the last moment that can be honoured: the claim creates it.
+            # A key pressed during the last poll is still waiting to be read. Esc means no
+            # session, and this is the last moment that can be honoured: the claim creates it.
+            # Anything else was pressed at a screen that's gone, and must not answer the next
+            # one: Enter would take a new link with "not authorized" on screen for no time.
             # `is not None`: the first byte of a non-ASCII character reads as "".
             while box.wait_key(0) is not None:
                 pass
-            box.working("finishing sign-in…")
-            return auth.claim_browser_login(base, login.poll_secret, **options)
-        if not box.link_ended(_LINK_ENDED.get(outcome, "that link can't be used any more")):
-            return _BACK_TO_MENU
+            if outcome == "approved":
+                box.working("finishing sign-in…")
+                return auth.claim_browser_login(base, login.poll_secret, **options)
+            if not box.link_ended(_LINK_ENDED.get(outcome, "that link can't be used any more")):
+                return _BACK_TO_MENU
+    except KeyboardInterrupt:  # Ctrl-C during a request, outside `wait_key`
+        raise selectmod.LoginCancelled()
 
 
 def _browser_login_plain(state: AppState, base: str):
diff --git a/fp-cloud-cli/tests/test_browser_login.py b/fp-cloud-cli/tests/test_browser_login.py
index f86263321..84cb5ffb4 100644
--- a/fp-cloud-cli/tests/test_browser_login.py
+++ b/fp-cloud-cli/tests/test_browser_login.py
@@ -340,10 +340,15 @@ class _Box:
 
     def __init__(self, *keys):
         self.keys = list(keys)
+        self.ended = []
 
     def working(self, _text):
         pass
 
+    def link_ended(self, message):
+        self.ended.append((message, list(self.keys)))
+        return False
+
     def wait_key(self, _seconds):
         key = self.keys.pop(0) if self.keys else None
         if key == "ESC":
@@ -384,6 +389,33 @@ def test_any_other_key_pressed_during_the_last_poll_changes_nothing(approved_lin
     assert approved_link == [1]
 
 
+@pytest.mark.parametrize("final", ["denied", "expired"])
+def test_enter_pressed_during_the_last_poll_cannot_answer_a_screen_nobody_saw(approved_link, monkeypatch, final):
+    # It would take the next link straight away, with the denial on screen for no time at all.
+    monkeypatch.setattr(auth, "await_browser_approval", lambda *_a, **_k: final)
+    box = _Box("ENTER", "")
+    assert auth_cmds._browser_login_in_box(_state(), BASE, box) is auth_cmds._BACK_TO_MENU
+    assert [keys for _message, keys in box.ended] == [[]]
+
+
+def test_esc_pressed_during_the_last_poll_of_a_denied_link_still_cancels(approved_link, monkeypatch):
+    monkeypatch.setattr(auth, "await_browser_approval", lambda *_a, **_k: "denied")
+    box = _Box("ESC")
+    with pytest.raises(selectmod.LoginCancelled):
+        auth_cmds._browser_login_in_box(_state(), BASE, box)
+    assert box.ended == []
+
+
+@pytest.mark.parametrize("step", ["start_browser_login", "claim_browser_login"])
+def test_ctrl_c_during_any_request_of_a_browser_login_cancels_calmly(approved_link, monkeypatch, step):
+    def interrupted(*_a, **_k):
+        raise KeyboardInterrupt()
+
+    monkeypatch.setattr(auth, step, interrupted)
+    with pytest.raises(selectmod.LoginCancelled):
+        auth_cmds._browser_login_in_box(_state(), BASE, _Box())
+
+
 # --- the command, on a terminal with no raw mode ----------------------------
 #
 # The box needs termios and a real pty, so this is the path CliRunner can reach:

From f7b70016dbed9589a98405220c5fa8476bc2f62e Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Thu, 5 Nov 2026 01:39:44 +0530
Subject: [PATCH 09/15] [failproofai-feat-failproofai-cloud-login] Keep the old
 prompts when stderr is redirected, and say when the plain flow is back

`fp login 2>file` on a terminal now offered the browser flow, with the link and the waiting going
to that file: Enter started a login the person couldn't see or finish. Main asked for an email, so
this broke the claim that only a terminal sees anything new. The plain menu now needs stderr to be a
terminal too, which it is on Windows, the case it exists for. The test fixture stubs the new check
for that reason: the condition it pins changed.

`_browser_login_plain` also never said "back online" when the very next poll was the approval, as
CodeRabbit pointed out, leaving "reconnecting" as its last word.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 fp-cloud-cli/fp_cli/commands/auth_cmds.py |  7 ++--
 fp-cloud-cli/fp_cli/select.py             |  8 +++++
 fp-cloud-cli/tests/test_browser_login.py  | 39 +++++++++++++++++++++++
 3 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/fp-cloud-cli/fp_cli/commands/auth_cmds.py b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
index d15229a88..7753dee53 100644
--- a/fp-cloud-cli/fp_cli/commands/auth_cmds.py
+++ b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
@@ -194,6 +194,8 @@ def tick(_left: float, offline: bool) -> None:
 
     outcome = auth.await_browser_approval(base, login, tick=tick, **options)
     if outcome == "approved":
+        if was_offline:
+            output.info("back online")
         return auth.claim_browser_login(base, login.poll_secret, **options)
     raise AuthError(
         f"{_LINK_ENDED.get(outcome, 'That link cannot be used any more')}.".capitalize(),
@@ -409,8 +411,9 @@ def login(
     output.auth_header()
     method = "email"
     creds = None
-    # A terminal this can't draw the box on (Windows). Pipes, CI and `--json` skip this.
-    if not state.json and not email and selectmod.stdin_is_tty():
+    # A terminal this can't draw the box on (Windows). Pipes, CI and `--json` skip this, and so
+    # does a redirected stderr: the link and the waiting would go to that file, out of sight.
+    if not state.json and not email and selectmod.stdin_is_tty() and selectmod.stderr_is_tty():
         answer = ""
         while answer not in _SIGN_IN_WITH:
             answer = str(output.prompt("sign in with [browser/email]", default="browser")).strip().lower()
diff --git a/fp-cloud-cli/fp_cli/select.py b/fp-cloud-cli/fp_cli/select.py
index d4840e0cf..f9e344cd9 100644
--- a/fp-cloud-cli/fp_cli/select.py
+++ b/fp-cloud-cli/fp_cli/select.py
@@ -25,6 +25,14 @@ def stdin_is_tty() -> bool:  # noqa: D401
         return False
 
 
+def stderr_is_tty() -> bool:
+    """True iff stderr is an interactive terminal, so a person can see what's written there."""
+    try:
+        return sys.stderr.isatty()
+    except Exception:
+        return False
+
+
 def choose_org(slugs: Sequence[str], default: Optional[str] = None) -> str:
     """Render ``slugs`` and prompt until the user picks one (by slug or number).
 
diff --git a/fp-cloud-cli/tests/test_browser_login.py b/fp-cloud-cli/tests/test_browser_login.py
index 84cb5ffb4..b4191646a 100644
--- a/fp-cloud-cli/tests/test_browser_login.py
+++ b/fp-cloud-cli/tests/test_browser_login.py
@@ -426,6 +426,7 @@ def interrupted(*_a, **_k):
 @pytest.fixture
 def plain_terminal(monkeypatch):
     monkeypatch.setattr("fp_cli.select.stdin_is_tty", lambda: True)
+    monkeypatch.setattr("fp_cli.select.stderr_is_tty", lambda: True)
     monkeypatch.setattr("fp_cli.select.login_box_supported", lambda: False)
     # Never a real browser from a test run, wherever it runs.
     monkeypatch.setattr(auth, "open_url", lambda *_a, **_k: pytest.fail("opened a browser"))
@@ -565,6 +566,44 @@ def test_the_plain_flow_says_when_it_is_reconnecting_once(home, runner, plain_te
     assert "back online" in result.output
 
 
+@respx.mock
+def test_the_plain_flow_says_it_is_back_when_the_next_answer_is_the_approval(home, runner, plain_terminal, monkeypatch):
+    _fast_links(monkeypatch)
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=_start())
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(
+        side_effect=[httpx.ConnectError("x"), httpx.Response(200, json={"status": "approved"})]
+    )
+    respx.post(f"{BASE}/api/auth/cli/claim").mock(return_value=httpx.Response(201, json=CLAIMED))
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="browser\n")
+
+    assert result.exit_code == 0, result.output
+    assert result.output.index("reconnecting") < result.output.index("back online")
+
+
+@respx.mock
+def test_a_redirected_stderr_keeps_the_old_prompts(home, runner, plain_terminal, monkeypatch):
+    # The link and the waiting would go to that file, and the person would watch nothing.
+    monkeypatch.setattr("fp_cli.select.stderr_is_tty", lambda: False)
+    start = respx.post(f"{BASE}/api/auth/cli/start")
+    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(
+        return_value=httpx.Response(
+            200,
+            json={"user": {"id": "u1", "email": "me@test"}, "expires_in_secs": 3600},
+            headers={"set-cookie": "ae_session=tok-otp; Path=/"},
+        )
+    )
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="me@test\n123456\n")
+
+    assert result.exit_code == 0, result.output
+    assert not start.called
+    assert config.load_config().session_token == "tok-otp"
+
+
 @respx.mock
 def test_choosing_email_never_touches_the_browser_routes(home, runner, plain_terminal):
     start = respx.post(f"{BASE}/api/auth/cli/start")

From fe8aeb4e4d38b504a39eefe00042d756ce0dfb0d Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Thu, 5 Nov 2026 01:39:44 +0530
Subject: [PATCH 10/15] [failproofai-feat-failproofai-cloud-login] Fix a race
 in the E2E, check a session can't renew itself, and correct the CLI reference

Phase 8 approved the moment the dashboard came back, so the next poll could be the approval and `fp`
never said it was waiting again, which the driver was waiting for. It failed one run in three. It
now approves only once `fp` is waiting, so the test asks the same question without the race.

Phase 12 now checks the Cloud half's refusal end to end: a session claimed from a link can look at
another link, can't approve it, and leaves it pending. That needs FailproofAI/agenteye#1277's latest
commit in the stack under test.

The public reference said the page warns on a different network, with no word about deployments
that can't tell. They send the email and show no warning.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 __tests__/e2e/layout/fp-login.sh | 11 +++++++++++
 docs/reference/cloud-cli.mdx     |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/__tests__/e2e/layout/fp-login.sh b/__tests__/e2e/layout/fp-login.sh
index 11a570452..2ab6ad4a2 100755
--- a/__tests__/e2e/layout/fp-login.sh
+++ b/__tests__/e2e/layout/fp-login.sh
@@ -452,6 +452,11 @@ docker start "$DASH_CONTAINER" >/dev/null
 DASH_STOPPED=0
 for _ in $(seq 1 60); do curl -s -m 2 -o /dev/null "$DASH/login" && break; sleep 0.5; done
 ok "the dashboard went away and came back"
+# Only once it says it's waiting again, or the very next poll is the approval and it never does.
+for _ in $(seq 1 60); do
+  sed 's/\x1b\[[0-9;?]*[A-Za-z]//g' "$OUT/drop.log" | grep -a -E 'reconnecting|waiting for you' | tail -1 | grep -q 'waiting for you' && break
+  sleep 0.5
+done
 person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
 T=$(wait_done drop)
 eq "fp finished on the same link" "$(cat "$OUT/drop.rc")" "0"
@@ -626,6 +631,12 @@ EARLY=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/claim
 eq "no claim before approval" "$EARLY" "409"
 LINKCLAIM=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$LINK\"}")
 eq "the link cannot claim" "$LINKCLAIM" "404"
+# Sessions never slide. One that could approve its own replacement would never end.
+person "$CLAIMED_TOKEN" lookup "{\"link_token\":\"$LINK\"}" >/dev/null
+eq "a session claimed from a link can look at another link" "$(cat "$OUT/status")" "200"
+person "$CLAIMED_TOKEN" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+eq "…but can't approve it, or it would renew itself for ever" "$(cat "$OUT/status")" "403"
+eq "…which leaves that link pending" "$(request_status "$LINK")" "pending"
 person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
 FIRST=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$SECRET\"}")
 SECOND=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DASH/api/auth/cli/claim" -H 'content-type: application/json' -d "{\"poll_secret\":\"$SECRET\"}")
diff --git a/docs/reference/cloud-cli.mdx b/docs/reference/cloud-cli.mdx
index ef89a5f81..90ce5ca0e 100644
--- a/docs/reference/cloud-cli.mdx
+++ b/docs/reference/cloud-cli.mdx
@@ -175,7 +175,7 @@ fp login --email you@example.com --org reliability-team
 fp whoami
 ```
 
-On a terminal, `fp login` asks how you want to sign in. **browser** opens a link (over SSH or with no display it prints it, and it works from any device); authorize it and the terminal finishes on its own. That terminal gets your access in all your organizations until the session expires, so only authorize a link you just asked for. If the login started on a different network, the page warns you and you get an email once the session exists. **email** sends a 6-digit code to paste back, and is what `--email`, `--json` and anything without a terminal use.
+On a terminal, `fp login` asks how you want to sign in. **browser** opens a link (over SSH or with no display it prints it, and it works from any device); authorize it and the terminal finishes on its own. That terminal gets your access in all your organizations until the session expires, so only authorize a link you just asked for. If the login started on a different network, you get an email once the session exists, and the page warns you where the deployment can tell. **email** sends a 6-digit code to paste back, and is what `--email`, `--json` and anything without a terminal use.
 
 ### Events
 

From fbb0fd31d2601ce5a8d0816d42b26a5a48aeb946 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Thu, 5 Nov 2026 14:31:34 +0530
Subject: [PATCH 11/15] [failproofai-feat-failproofai-cloud-login] Ask for the
 email first, with Tab to a browser link and back

`fp login` opened on a menu, and the link went above the box. The owner asked for the email first,
with a hint that Tab signs in with a browser or SSO, and the link in the box.

Tab now goes from the email to the link and back, keeping what was typed and the same link: another
each time would spend the rate limit, leave rows behind and open another browser tab, and an
approval given at the email would be lost. Coming back keeps the link's countdown. Esc cancels on
every screen, including one where the link ended, where Tab goes back to the email.

The link is printed, not drawn. The frame redraws on every tick, which clears a person's selection,
and Rich would break a long link across lines. Only the waiting lines under it stay live, and the
terminal does the wrapping. A terminal with no raw mode can't see Tab, so a blank answer at its
email prompt means the link. Anything without a terminal is never offered one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                              |   2 +-
 __tests__/e2e/layout/README.md            |   2 +-
 __tests__/e2e/layout/fp-login.sh          | 132 ++++++++----
 docs/reference/cloud-cli.mdx              |   4 +-
 fp-cloud-cli/CHANGELOG.md                 |   2 +-
 fp-cloud-cli/README.md                    |  13 +-
 fp-cloud-cli/fp_cli/auth.py               |   5 +-
 fp-cloud-cli/fp_cli/commands/auth_cmds.py | 130 ++++++------
 fp-cloud-cli/fp_cli/output.py             |  47 +++--
 fp-cloud-cli/fp_cli/select.py             |  83 +++++---
 fp-cloud-cli/tests/test_browser_login.py  | 236 ++++++++++++++++++++--
 11 files changed, 487 insertions(+), 169 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cd04b7e94..4176ca433 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### Features
 
-- `fp login` can sign you in from a browser, as `failproofai config` does: on a terminal it asks browser or email code, and either way you get your own session. New deliberate-run harness: `__tests__/e2e/layout/fp-login.sh`. (#981)
+- `fp login` can sign you in from a browser, as `failproofai config` does: on a terminal it asks for your email, Tab switches to a browser link, and either way you get your own session. New deliberate-run harness: `__tests__/e2e/layout/fp-login.sh`. (#981)
 
 ### Dependencies
 
diff --git a/__tests__/e2e/layout/README.md b/__tests__/e2e/layout/README.md
index 7ef59fc28..d97cffef9 100644
--- a/__tests__/e2e/layout/README.md
+++ b/__tests__/e2e/layout/README.md
@@ -10,7 +10,7 @@ not depend on — so they are invoked deliberately.
 | `cloud-collector.sh` | an AgentEye stack | real connect against a live server, daemon + collector writing layout-2 paths, decisions reaching ClickHouse, disconnect back to OSS |
 | `systemd-service.sh` | Docker | REAL `systemctl enable --now` as root in a privileged container: service lifecycle, fail-closed, self-heal, reinstall |
 | `cli-login.sh` | an AgentEye stack (dashboard + mailpit + its Postgres), an older Cloud server without `/api/auth/cli/*` routes, Docker, `bun run build` + the release daemon | `config`'s browser login through a real pty in a systemd container: approve, re-login, deny + retry, abandon after approval (no key minted), esc, expiry, revoked saved key, older server, and the person-side refusals (Origin, form posts, no session, start rate limit) |
-| `fp-login.sh` | an AgentEye stack (dashboard + mailpit + its containers), `uv sync` in `fp-cloud-cli`; optionally a Cloud with `config`'s login but not `fp`'s, and a dashboard with `DASHBOARD_TRUSTED_INGRESS=1` | `fp login`'s browser flow through a real pty: approve, the org picker, the email code from the menu, deny + retry, expiry, esc and ctrl-c, an approval nobody collects (no session), a dropped connection, opening the browser, Clouds without it (nothing minted), the network warning and when the email goes out, the person-side refusals, and no secret in any log |
+| `fp-login.sh` | an AgentEye stack (dashboard + mailpit + its containers), `uv sync` in `fp-cloud-cli`; optionally a Cloud with `config`'s login but not `fp`'s, and a dashboard with `DASHBOARD_TRUSTED_INGRESS=1` | `fp login`'s browser flow through a real pty: approve, the org picker, the email code from the first screen, tab to the link and back, deny + retry, expiry, esc and ctrl-c, an approval nobody collects (no session), a dropped connection, opening the browser, Clouds without it (nothing minted), the network warning and when the email goes out, the person-side refusals, and no secret in any log |
 
 `systemd-service.sh` exists because the service half cannot be tested on a
 developer machine without a password prompt, and a container gives real systemd
diff --git a/__tests__/e2e/layout/fp-login.sh b/__tests__/e2e/layout/fp-login.sh
index 2ab6ad4a2..685c7c678 100755
--- a/__tests__/e2e/layout/fp-login.sh
+++ b/__tests__/e2e/layout/fp-login.sh
@@ -86,7 +86,7 @@ otp_code() { # <email> -> the code from the newest sign-in email
 # Starts are limited to 10 a minute per address, and with nothing in front of the
 # dashboard every local caller is one address. This script starts far more than that.
 unthrottle() {
-  docker exec "$REDIS_CONTAINER" sh -c "redis-cli --scan --pattern 'ratelimit:cli_login_start:*' | xargs -r redis-cli del" >/dev/null
+  docker exec "$REDIS_CONTAINER" sh -c "redis-cli --scan --pattern 'ratelimit:cli_login_start:*' | xargs -r redis-cli del; redis-cli --scan --pattern 'ratelimit:cli_login:decide:*' | xargs -r redis-cli del" >/dev/null
 }
 
 sign_in() { # <email> -> its session, through the real email-code flow
@@ -154,8 +154,9 @@ wait_url() { # <name> -> the link fp printed
 wait_done() { # <name> -> transcript with the terminal codes taken out
   local _
   for _ in $(seq 1 480); do [ -f "$OUT/$1.rc" ] && break; sleep 0.25; done
-  sed 's/\x1b\[[0-9;?]*[A-Za-z]//g' "$OUT/$1.log" 2>/dev/null | tr -d '\r'
+  transcript "$1"
 }
+transcript() { sed 's/\x1b\[[0-9;?]*[A-Za-z]//g' "$OUT/$1.log" 2>/dev/null | tr -d '\r'; }
 
 fp_plain() { # <base-url> <fp args...>, no terminal
   local base=$1; shift
@@ -166,7 +167,7 @@ fp_plain() { # <base-url> <fp args...>, no terminal
 saved() { python3 -c "import json;print(json.load(open('$FP_DIR/cli-auth.json')).get('$1') or '')" 2>/dev/null; }
 reset_fp() { rm -rf "$FP_DIR"; }
 
-MENU=wait:how\ do\ you\ want\ to\ sign\ in
+EMAIL_STEP=wait:tab\ browser\ or\ SSO
 
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 0 — preconditions"
@@ -182,7 +183,7 @@ ONE_SESSION=$(sign_in "$ONE")
 
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 1 — browser login: the link, the approval, and the terminal finishes alone"
-run_fp first "$MENU,key:enter,url" "$DASH" -- login
+run_fp first "$EMAIL_STEP,key:tab,url" "$DASH" -- login
 URL=$(wait_url first)
 has "fp printed the authorize link" "$URL" "$DASH/cli/authorize?r="
 LINK=$(link_token "$URL")
@@ -198,16 +199,18 @@ person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
 eq "approve answered 200" "$(cat "$OUT/status")" "200"
 T=$(wait_done first)
 eq "fp exited 0" "$(cat "$OUT/first.rc")" "0"
-has "the menu offers the browser" "$T" "authorize from a link"
-has "the menu offers the email code" "$T" "send me a 6-digit code"
+has "it opens on the email, offering the browser" "$T" "tab browser or SSO"
+has "…and saying enter sends a code" "$T" "send a code"
 has "no display here, so it says the link works anywhere" "$T" "open this link on any device"
 has "it waited with a countdown" "$T" "waiting for you to authorize"
 has "it says it signed in" "$T" "signed in"
 has "…as the person who approved" "$T" "$ONE"
-# In the raw bytes: nothing between the start of the line and the link, and nothing
-# after it. Rich wrapping it, or the box around it, would break it for a click or a copy.
-LINE=$(grep -caP '(\x1b\[[0-9;?]*[A-Za-z]|[\r\n])https?://\S+/cli/authorize\?r=[0-9a-f]{64}\r?$' "$OUT/first.log")
-eq "the link is one unbroken run on its own line, outside the box" "$LINE" "1"
+# In the raw bytes: the window is 100 wide, the link wider, and nothing but the terminal may
+# wrap it. A line break from Rich would break it for a click or a copy, and so would writing it
+# again with the spinner, which clears a selection.
+LINE=$(grep -caP '^(\r|\x1b\[[0-9;?]*[A-Za-z])*  (\x1b\[[0-9;]*m)?https?://\S+/cli/authorize\?r=[0-9a-f]{64}(\x1b\[[0-9;]*m)?\r?$' "$OUT/first.log")
+eq "the link is one unbroken run on its own line, in the box" "$LINE" "1"
+eq "…written once, not again with the spinner" "$(grep -ao 'cli/authorize?r=' "$OUT/first.log" | wc -l)" "1"
 eq "one more session on the server" "$(sessions_of "$ONE")" "$((BEFORE + 1))"
 eq "the request is spent" "$(request_status "$LINK")" "claimed"
 eq "no machine key came of it" "$(sql "select count(*) from api_keys where created_by_user_id = (select id from users where email = '$ONE')")" "0"
@@ -223,14 +226,14 @@ ORGS=$(fp_plain "$DASH" --json orgs list 2>&1)
 has "a command an API key is refused works" "$ORGS" "fp-one-$STAMP"
 
 # ═════════════════════════════════════════════════════════════════════════════
-head1 "PHASE 2 — signed in already: no menu; --force asks again"
+head1 "PHASE 2 — signed in already: no asking; --force asks again"
 run_fp again "wait:$ONE" "$DASH" -- login
 T=$(wait_done again)
 eq "fp exited 0" "$(cat "$OUT/again.rc")" "0"
-hasnt "no menu for someone already signed in" "$T" "how do you want to sign in"
-run_fp force "$MENU,key:esc" "$DASH" -- login --force
+hasnt "no asking someone already signed in" "$T" "tab browser or SSO"
+run_fp force "$EMAIL_STEP,key:esc" "$DASH" -- login --force
 T=$(wait_done force)
-eq "--force shows the menu, and esc leaves it" "$(cat "$OUT/force.rc")" "0"
+eq "--force asks, and esc leaves it" "$(cat "$OUT/force.rc")" "0"
 has "…saying nothing changed" "$T" "cancelled"
 
 # ═════════════════════════════════════════════════════════════════════════════
@@ -240,7 +243,7 @@ TWO_SESSION=$(sign_in "$TWO")
 new_org "$TWO_SESSION" "fp-a-$STAMP" >/dev/null
 new_org "$TWO_SESSION" "fp-b-$STAMP" >/dev/null
 reset_fp
-run_fp pick "$MENU,key:enter,url,wait:choose your org,key:down,key:enter" "$DASH" -- login
+run_fp pick "$EMAIL_STEP,key:tab,url,wait:choose your org,key:down,key:enter" "$DASH" -- login
 LINK=$(link_token "$(wait_url pick)")
 person "$TWO_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
 T=$(wait_done pick)
@@ -248,7 +251,7 @@ eq "fp exited 0" "$(cat "$OUT/pick.rc")" "0"
 PICKED=$(saved org)
 [ "$PICKED" = "fp-a-$STAMP" ] || [ "$PICKED" = "fp-b-$STAMP" ] && ok "the org picked in the terminal was saved" || bad "the org was saved" "$PICKED"
 reset_fp
-run_fp flag "$MENU,key:enter,url" "$DASH" -- login --org "fp-b-$STAMP"
+run_fp flag "$EMAIL_STEP,key:tab,url" "$DASH" -- login --org "fp-b-$STAMP"
 LINK=$(link_token "$(wait_url flag)")
 person "$TWO_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
 T=$(wait_done flag)
@@ -256,12 +259,12 @@ eq "--org skips the picker" "$(saved org)" "fp-b-$STAMP"
 hasnt "…no picker shown" "$T" "choose your org"
 
 # ═════════════════════════════════════════════════════════════════════════════
-head1 "PHASE 4 — the email code still works, from the menu and with --email"
+head1 "PHASE 4 — the email code still works, from the first screen and with --email"
 reset_fp
 MAILED="fp-mail-$STAMP@example.test"
 curl -s -X DELETE "$MAILPIT/api/v1/search?query=to:$MAILED" >/dev/null || true
 rm -f "$OUT/code"
-run_fp menu_mail "$MENU,key:down,key:enter,wait:email,type:$MAILED,key:enter,wait:enter the 6-digit code,typefile:$OUT/code,key:enter" "$DASH" -- login
+run_fp menu_mail "$EMAIL_STEP,type:$MAILED,key:enter,wait:enter the 6-digit code,typefile:$OUT/code,key:enter" "$DASH" -- login
 CODE=$(otp_code "$MAILED"); echo "$CODE" > "$OUT/code"
 T=$(wait_done menu_mail)
 eq "fp exited 0" "$(cat "$OUT/menu_mail.rc")" "0"
@@ -275,16 +278,16 @@ run_fp flag_mail "wait:enter the 6-digit code,typefile:$OUT/code,key:enter" "$DA
 CODE=$(otp_code "$MAILED"); echo "$CODE" > "$OUT/code"
 T=$(wait_done flag_mail)
 eq "--email signed in" "$(saved email)" "$MAILED"
-hasnt "--email skips the menu" "$T" "how do you want to sign in"
+hasnt "--email skips the asking" "$T" "tab browser or SSO"
 reset_fp
 OUTPUT=$(env -u FP_TOKEN -u FP_API_KEY NO_COLOR=1 FP_ANALYTICS_DISABLED=1 FP_HOME="$FP_DIR" "$FP" --base-url "$DASH" login </dev/null 2>&1)
-hasnt "no terminal: no menu" "$OUTPUT" "how do you want to sign in"
+hasnt "no terminal: no offer of a browser" "$OUTPUT" "tab browser or SSO"
 hasnt "no terminal: no link" "$OUTPUT" "/cli/authorize"
 
 # ═════════════════════════════════════════════════════════════════════════════
-head1 "PHASE 5 — not authorized: enter for a new link, esc back to the menu"
+head1 "PHASE 5 — not authorized: enter for a new link, tab back to the email, esc to leave"
 reset_fp
-run_fp deny "$MENU,key:enter,url,wait:not authorized,key:enter,url" "$DASH" -- login
+run_fp deny "$EMAIL_STEP,key:tab,url,wait:not authorized,key:enter,url" "$DASH" -- login
 LINK1=$(link_token "$(wait_url deny)")
 person "$ONE_SESSION" deny "{\"link_token\":\"$LINK1\"}" >/dev/null
 eq "deny answered 200" "$(cat "$OUT/status")" "200"
@@ -297,19 +300,66 @@ eq "signed in" "$(saved email)" "$ONE"
 eq "the denied request stays denied" "$(request_status "$LINK1")" "denied"
 reset_fp
 BEFORE=$(sessions_of "$ONE")
-run_fp back "$MENU,key:enter,url,wait:not authorized,key:esc,$MENU,key:esc" "$DASH" -- login
+run_fp back "$EMAIL_STEP,key:tab,url,wait:not authorized,key:tab,$EMAIL_STEP,key:esc" "$DASH" -- login
 LINK=$(link_token "$(wait_url back)")
 person "$ONE_SESSION" deny "{\"link_token\":\"$LINK\"}" >/dev/null
 T=$(wait_done back)
-eq "esc went back to the menu, and esc again left" "$(cat "$OUT/back.rc")" "0"
+eq "tab went back to the email, and esc left" "$(cat "$OUT/back.rc")" "0"
 has "…calmly" "$T" "cancelled"
 eq "…with nothing saved" "$(saved session_token)" ""
+reset_fp
+run_fp leave "$EMAIL_STEP,key:tab,url,wait:not authorized,key:esc" "$DASH" -- login
+LINK=$(link_token "$(wait_url leave)")
+person "$ONE_SESSION" deny "{\"link_token\":\"$LINK\"}" >/dev/null
+T=$(wait_done leave)
+eq "esc at not authorized leaves, like everywhere else" "$(cat "$OUT/leave.rc")" "0"
+has "…calmly" "$T" "cancelled"
+
+# Tab goes to the link and back, and it stays the same link: another each time would spend the
+# rate limit, leave rows behind, and open another browser tab.
+reset_fp
+ROWS=$(sql "select count(*) from cli_login_requests")
+run_fp toggle "$EMAIL_STEP,type:half@,key:tab,url,wait:waiting for you,key:tab,wait:half@,key:tab,url,wait:waiting for you" "$DASH" -- login
+LINK=$(link_token "$(wait_url toggle)")
+until [ "$(grep -ao 'cli/authorize?r=' "$OUT/toggle.log" | wc -l)" = 2 ]; do sleep 0.1; done
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+T=$(wait_done toggle)
+eq "tab there and back still signs in" "$(cat "$OUT/toggle.rc")" "0"
+has "…what was typed came back" "$(transcript toggle | sed -n '/waiting for you/,$p')" "half@"
+eq "…the same link both times" "$(grep -aoP 'authorize\?r=\K[0-9a-f]{64}' "$OUT/toggle.log" | sort -u | wc -l)" "1"
+eq "…one request on the server" "$(sql "select count(*) from cli_login_requests")" "$((ROWS + 1))"
+eq "…signed in" "$(saved email)" "$ONE"
+
+# Approved while the person was back at the email: coming back finds it.
+reset_fp
+run_fp later "$EMAIL_STEP,key:tab,url,wait:waiting for you,key:tab,wait:send a code,sleep:4,key:tab" "$DASH" -- login
+LINK=$(link_token "$(wait_url later)")
+until transcript later | sed -n '/waiting for you/,$p' | grep -q 'send a code'; do sleep 0.1; done
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+sleep 1
+eq "an approval given at the email waits" "$(request_status "$LINK")" "approved"
+T=$(wait_done later)
+eq "…and coming back collects it" "$(cat "$OUT/later.rc")" "0"
+eq "…signed in" "$(saved email)" "$ONE"
+eq "…the request spent" "$(request_status "$LINK")" "claimed"
+
+# Left at the email with the approval unclaimed: nobody collects it, so it makes nothing.
+reset_fp
+BEFORE=$(sessions_of "$ONE")
+run_fp nocollect "$EMAIL_STEP,key:tab,url,wait:waiting for you,key:tab,wait:send a code,sleep:3,key:esc" "$DASH" -- login
+LINK=$(link_token "$(wait_url nocollect)")
+until transcript nocollect | sed -n '/waiting for you/,$p' | grep -q 'send a code'; do sleep 0.1; done
+person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
+T=$(wait_done nocollect)
+eq "esc at the email with an approval waiting exits 0" "$(cat "$OUT/nocollect.rc")" "0"
+eq "…and no session is made" "$(sessions_of "$ONE")" "$BEFORE"
+eq "…nothing saved" "$(saved session_token)" ""
 eq "…and no session" "$(sessions_of "$ONE")" "$BEFORE"
 
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 6 — a link that expires offers a fresh one"
 reset_fp
-run_fp expire "$MENU,key:enter,url,wait:that link expired,key:enter,url" "$DASH" -- login
+run_fp expire "$EMAIL_STEP,key:tab,url,wait:that link expired,key:enter,url" "$DASH" -- login
 LINK1=$(link_token "$(wait_url expire)")
 sql "update cli_login_requests set expires_at = now() - interval '1 second' where link_token_hash = encode(sha256('$LINK1'::bytea), 'hex')" >/dev/null
 LINK2=$(link_token "$(wait_url expire)")
@@ -322,7 +372,7 @@ eq "the expired link can no longer be approved" "$(cat "$OUT/status")" "410"
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 7 — leaving: esc, ctrl-c, and an approval nobody collects"
 reset_fp
-run_fp esc "$MENU,key:enter,url,wait:waiting for you,key:esc" "$DASH" -- login
+run_fp esc "$EMAIL_STEP,key:tab,url,wait:waiting for you,key:esc" "$DASH" -- login
 LINK=$(link_token "$(wait_url esc)")
 T=$(wait_done esc)
 eq "esc while waiting exits 0" "$(cat "$OUT/esc.rc")" "0"
@@ -334,7 +384,7 @@ eq "the abandoned link can still be approved" "$(cat "$OUT/status")" "200"
 sleep 3
 eq "…but no session ever exists: nobody claimed it" "$(sessions_of "$ONE")" "$BEFORE"
 eq "…and it stays unclaimed" "$(request_status "$LINK")" "approved"
-run_fp ctrlc "$MENU,key:enter,url,wait:waiting for you,key:ctrl-c" "$DASH" -- login
+run_fp ctrlc "$EMAIL_STEP,key:tab,url,wait:waiting for you,key:ctrl-c" "$DASH" -- login
 wait_url ctrlc >/dev/null
 T=$(wait_done ctrlc)
 eq "ctrl-c while waiting exits 0" "$(cat "$OUT/ctrlc.rc")" "0"
@@ -383,7 +433,7 @@ HELD_PID=$!
 for _ in $(seq 1 40); do [ -s "$OUT/held.port" ] && break; sleep 0.1; done
 HELD="http://127.0.0.1:$(cat "$OUT/held.port")"
 reset_fp
-run_fp held "$MENU,key:enter,url,wait:waiting for you,sleep:2,key:esc" "$HELD" -- login
+run_fp held "$EMAIL_STEP,key:tab,url,wait:waiting for you,sleep:2,key:esc" "$HELD" -- login
 wait_url held >/dev/null
 T=$(wait_done held)
 eq "esc during a poll that comes back approved exits 0" "$(cat "$OUT/held.rc")" "0"
@@ -391,14 +441,14 @@ has "…calmly" "$T" "cancelled"
 eq "…with no claim" "$(cat "$OUT/held.claims" 2>/dev/null | wc -l)" "0"
 eq "…and nothing saved" "$(saved session_token)" ""
 reset_fp
-run_fp heldutf "$MENU,key:enter,url,wait:waiting for you,sleep:1,type:é,key:esc" "$HELD" -- login
+run_fp heldutf "$EMAIL_STEP,key:tab,url,wait:waiting for you,sleep:1,type:é,key:esc" "$HELD" -- login
 wait_url heldutf >/dev/null
 T=$(wait_done heldutf)
 has "esc after a non-ASCII key, same poll: calm too" "$T" "cancelled"
 eq "…with no claim" "$(cat "$OUT/held.claims" 2>/dev/null | wc -l)" "0"
 eq "…and nothing saved" "$(saved session_token)" ""
 reset_fp
-run_fp notheld "$MENU,key:enter,url" "$HELD" -- login
+run_fp notheld "$EMAIL_STEP,key:tab,url" "$HELD" -- login
 wait_url notheld >/dev/null
 T=$(wait_done notheld)
 eq "the same poll with no key pressed does claim, so the stand-in is a fair test" "$(cat "$OUT/held.claims" 2>/dev/null | wc -l)" "1"
@@ -407,7 +457,7 @@ eq "the same poll with no key pressed does claim, so the stand-in is a fair test
 reset_fp
 echo denied > "$OUT/held.mode"
 rm -f "$OUT/held.starts"
-run_fp heldenter "$MENU,key:enter,url,wait:waiting for you,sleep:1,key:enter,wait:not authorized,sleep:2,key:esc,$MENU,key:esc" "$HELD" -- login
+run_fp heldenter "$EMAIL_STEP,key:tab,url,wait:waiting for you,sleep:1,key:enter,wait:not authorized,sleep:2,key:esc" "$HELD" -- login
 wait_url heldenter >/dev/null
 T=$(wait_done heldenter)
 eq "enter during a poll that comes back denied doesn't take a new link" "$(wc -l < "$OUT/held.starts")" "1"
@@ -415,7 +465,7 @@ has "…the denial stays on screen until it's answered" "$T" "new link"
 eq "…and the person can still leave" "$(cat "$OUT/heldenter.rc")" "0"
 reset_fp
 rm -f "$OUT/held.starts"
-run_fp heldescdeny "$MENU,key:enter,url,wait:waiting for you,sleep:1,key:esc" "$HELD" -- login
+run_fp heldescdeny "$EMAIL_STEP,key:tab,url,wait:waiting for you,sleep:1,key:esc" "$HELD" -- login
 wait_url heldescdeny >/dev/null
 T=$(wait_done heldescdeny)
 eq "esc during a poll that comes back denied exits 0" "$(cat "$OUT/heldescdeny.rc")" "0"
@@ -425,14 +475,14 @@ eq "…with one link" "$(wc -l < "$OUT/held.starts")" "1"
 # Ctrl-C at any request, not only during a poll.
 reset_fp
 echo slow-start > "$OUT/held.mode"
-run_fp heldstart "$MENU,key:enter,wait:asking for a link,sleep:1,key:ctrl-c" "$HELD" -- login
+run_fp heldstart "$EMAIL_STEP,key:tab,wait:asking for a link,sleep:1,key:ctrl-c" "$HELD" -- login
 T=$(wait_done heldstart)
 eq "ctrl-c while asking for a link exits 0" "$(cat "$OUT/heldstart.rc")" "0"
 has "…calmly" "$T" "cancelled"
 reset_fp
 echo slow-claim > "$OUT/held.mode"
 rm -f "$OUT/held.claims"
-run_fp heldclaim "$MENU,key:enter,url,wait:finishing sign-in,sleep:1,key:ctrl-c" "$HELD" -- login
+run_fp heldclaim "$EMAIL_STEP,key:tab,url,wait:finishing sign-in,sleep:1,key:ctrl-c" "$HELD" -- login
 wait_url heldclaim >/dev/null
 T=$(wait_done heldclaim)
 eq "ctrl-c while finishing exits 0" "$(cat "$OUT/heldclaim.rc")" "0"
@@ -443,7 +493,7 @@ kill "$HELD_PID" 2>/dev/null
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 8 — a dropped connection is not an answer"
 reset_fp
-run_fp drop "$MENU,key:enter,url,wait:waiting for you,wait:reconnecting,wait:waiting for you" "$DASH" -- login
+run_fp drop "$EMAIL_STEP,key:tab,url,wait:waiting for you,wait:reconnecting,wait:waiting for you" "$DASH" -- login
 LINK=$(link_token "$(wait_url drop)")
 DASH_STOPPED=1
 docker stop -t 0 "$DASH_CONTAINER" >/dev/null
@@ -470,7 +520,7 @@ mkdir -p "$OUT/bin"
 printf '#!/bin/sh\necho "$@" > "%s/opened"\n' "$OUT" > "$OUT/bin/xdg-open"
 chmod +x "$OUT/bin/xdg-open"
 rm -f "$OUT/opened"
-run_fp opens "$MENU,key:enter,url,wait:waiting for you,key:esc" "$DASH" DISPLAY=:99 SSH_TTY= PATH="$OUT/bin:$PATH" -- login
+run_fp opens "$EMAIL_STEP,key:tab,url,wait:waiting for you,key:esc" "$DASH" DISPLAY=:99 SSH_TTY= PATH="$OUT/bin:$PATH" -- login
 URL=$(wait_url opens)
 T=$(wait_done opens)
 for _ in $(seq 1 20); do [ -s "$OUT/opened" ] && break; sleep 0.25; done
@@ -493,7 +543,7 @@ PY
 STUB_PID=$!
 for _ in $(seq 1 40); do [ -s "$OUT/stub.port" ] && break; sleep 0.1; done
 reset_fp
-run_fp old404 "$MENU,key:enter,wait:no browser login,wait:email,key:esc" "http://127.0.0.1:$(cat "$OUT/stub.port")" -- login
+run_fp old404 "$EMAIL_STEP,key:tab,wait:no browser login,wait:send a code,key:esc" "http://127.0.0.1:$(cat "$OUT/stub.port")" -- login
 T=$(wait_done old404)
 eq "a Cloud with no such route falls through to the email step" "$(cat "$OUT/old404.rc")" "0"
 has "…saying why" "$T" "this Cloud has no browser login yet"
@@ -501,7 +551,7 @@ if [ -n "$CLOUD_1090" ]; then
   reset_fp
   KEYS_BEFORE=$(docker exec "$PG_1090" psql -U postgres -d agenteye -tAc "select count(*) from api_keys where created_via = 'cli_login'")
   STARTED_BEFORE=$(docker exec "$PG_1090" psql -U postgres -d agenteye -tAc "select count(*) from cli_login_requests")
-  run_fp old1090 "$MENU,key:enter,wait:no browser login,wait:email,key:esc" "$CLOUD_1090" -- login
+  run_fp old1090 "$EMAIL_STEP,key:tab,wait:no browser login,wait:send a code,key:esc" "$CLOUD_1090" -- login
   T=$(wait_done old1090)
   eq "a Cloud with only \`failproofai config\`'s login falls through too" "$(cat "$OUT/old1090.rc")" "0"
   has "…saying why" "$T" "this Cloud has no browser login yet"
@@ -550,7 +600,7 @@ hasnt "…and carrying no secret" "$M" "$CLAIMED_TOKEN"
 PLAIN="fp-plain-$STAMP@example.test"
 PLAIN_SESSION=$(sign_in "$PLAIN")
 reset_fp
-run_fp plainbox "$MENU,key:enter,url" "$DASH" -- login
+run_fp plainbox "$EMAIL_STEP,key:tab,url" "$DASH" -- login
 LINK=$(link_token "$(wait_url plainbox)")
 PAGE=$(person "$PLAIN_SESSION" lookup "{\"link_token\":\"$LINK\"}")
 eq "the real fp: no warning" "$(echo "$PAGE" | jqp '["different_network"]')" "False"
@@ -596,7 +646,7 @@ if [ -n "$TRUSTED_DASH" ]; then
   LOCAL="fp-local-$STAMP@example.test"
   LOCAL_SESSION=$(sign_in "$LOCAL")
   reset_fp
-  run_fp elsewhere "$MENU,key:enter,url" "$TRUSTED_DASH" -- login
+  run_fp elsewhere "$EMAIL_STEP,key:tab,url" "$TRUSTED_DASH" -- login
   LINK=$(link_token "$(wait_url elsewhere)")
   PAGE=$(person "$LOCAL_SESSION" lookup "{\"link_token\":\"$LINK\"}" 198.51.100.50)
   eq "the real fp, approved elsewhere: the page warns" "$(echo "$PAGE" | jqp '["different_network"]')" "True"
@@ -648,7 +698,7 @@ has "a claim answer is never cacheable" "$CACHE" "no-store"
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 13 — logout, and no secret in any log"
 reset_fp
-run_fp last "$MENU,key:enter,url" "$DASH" -- login
+run_fp last "$EMAIL_STEP,key:tab,url" "$DASH" -- login
 LINK=$(link_token "$(wait_url last)")
 person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
 wait_done last >/dev/null
diff --git a/docs/reference/cloud-cli.mdx b/docs/reference/cloud-cli.mdx
index 90ce5ca0e..ac167eb54 100644
--- a/docs/reference/cloud-cli.mdx
+++ b/docs/reference/cloud-cli.mdx
@@ -163,7 +163,7 @@ unchanged when no artifact is returned.
 
 | Command | Purpose | Options |
 | --- | --- | --- |
-| `fp login` | Sign in from a browser or with an emailed one-time code, and select an organization. `--email` goes straight to the code. | `--email`, `-e`; `--org`; `--force` |
+| `fp login` | Sign in with an emailed one-time code or from a browser, and select an organization. `--email` goes straight to the code. | `--email`, `-e`; `--org`; `--force` |
 | `fp logout` | Revoke and remove the saved user session. | — |
 | `fp whoami` | Show the current identity, authentication mode, organization, and permissions. | — |
 | `fp version` | Show the installed CLI version. | — |
@@ -175,7 +175,7 @@ fp login --email you@example.com --org reliability-team
 fp whoami
 ```
 
-On a terminal, `fp login` asks how you want to sign in. **browser** opens a link (over SSH or with no display it prints it, and it works from any device); authorize it and the terminal finishes on its own. That terminal gets your access in all your organizations until the session expires, so only authorize a link you just asked for. If the login started on a different network, you get an email once the session exists, and the page warns you where the deployment can tell. **email** sends a 6-digit code to paste back, and is what `--email`, `--json` and anything without a terminal use.
+On a terminal, `fp login` asks for your email and sends a 6-digit code to paste back, which is also what `--email`, `--json` and anything without a terminal use. Press **Tab** there to sign in with your browser or SSO instead, and Tab again to go back. `fp` shows a link and opens it (over SSH or with no display it only shows it, and it works from any device); authorize it and the terminal finishes on its own. That terminal gets your access in all your organizations until the session expires, so only authorize a link you just asked for. If the login started on a different network, you get an email once the session exists, and the page warns you where the deployment can tell.
 
 ### Events
 
diff --git a/fp-cloud-cli/CHANGELOG.md b/fp-cloud-cli/CHANGELOG.md
index 2150fae51..f366fc385 100644
--- a/fp-cloud-cli/CHANGELOG.md
+++ b/fp-cloud-cli/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### Added
 
-- `fp login` can sign you in from a browser. On a terminal it now asks: **browser** opens a link (over SSH or with no display it prints it, and it works from any device), you authorize it, and the terminal finishes on its own, or **email** sends the 6-digit code as before. `--email` goes straight to the code, and `--json` and anything without a terminal behave as they always did. A dashboard without browser login falls back to the code by itself and never creates a key. Either way you get the same session, with the same lifetime. (#981)
+- `fp login` can sign you in from a browser. On a terminal it asks for your email and sends a 6-digit code, as before; press Tab there for a link instead, to use your browser or SSO, and Tab again to go back. The link stays in the login box, opens where a browser can (over SSH or with no display it only shows it, and it works from any device), and the terminal finishes on its own once you authorize it. `--email`, `--json` and anything without a terminal keep the code as they always did. A dashboard without browser login stays with the code and never creates a key. Either way you get the same session, with the same lifetime. (#981)
 
 ## 0.0.2 — 2026-10-25
 
diff --git a/fp-cloud-cli/README.md b/fp-cloud-cli/README.md
index f19da79df..94c27c0cb 100644
--- a/fp-cloud-cli/README.md
+++ b/fp-cloud-cli/README.md
@@ -35,10 +35,10 @@ uv run fp --help
 ## Authentication
 
 The CLI talks to your dashboard (set `--base-url` or `FP_DASHBOARD_URL`) and signs you in
-from a browser or with an emailed one-time code:
+with an emailed one-time code or from a browser:
 
 ```bash
-fp login                           # choose: authorize from a link, or get a code by email
+fp login                           # enter your email for a code, or press tab for a browser link
 fp login --email you@example.com   # straight to the code; also what scripts and pipes use
 # either way the session is stored in
 # ~/.failproofai/fpcli/cli-auth.json (mode 0600)
@@ -46,10 +46,11 @@ fp whoami
 fp logout
 ```
 
-With **browser**, `fp` opens a link (over SSH or with no display it prints it, and it works
-from any device). Authorize it and the terminal finishes on its own. That terminal gets your
-access in all your orgs until the session expires, so only authorize a link you just asked
-for. A dashboard without browser login falls back to the code by itself.
+Press **tab** at the email to sign in with your browser or SSO instead, and tab again to go
+back. `fp` shows a link and opens it (over SSH or with no display it only shows it, and it
+works from any device). Authorize it and the terminal finishes on its own. That terminal gets
+your access in all your orgs until the session expires, so only authorize a link you just
+asked for. A dashboard without browser login stays with the code.
 
 Sessions expire (24h by default); re-run `fp login` when prompted.
 
diff --git a/fp-cloud-cli/fp_cli/auth.py b/fp-cloud-cli/fp_cli/auth.py
index b3bc146cb..3fe96e904 100644
--- a/fp-cloud-cli/fp_cli/auth.py
+++ b/fp-cloud-cli/fp_cli/auth.py
@@ -20,7 +20,7 @@
 import subprocess
 import sys
 import time
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from datetime import datetime, timedelta, timezone
 from typing import Any, Callable, Dict, Mapping, Optional, Tuple
 from urllib.parse import urlsplit
@@ -278,6 +278,7 @@ class BrowserLogin:
     poll_secret: str
     expires_in: float
     interval: float
+    started: float = field(default_factory=time.monotonic, compare=False)
 
 
 def start_browser_login(
@@ -382,7 +383,7 @@ def await_browser_approval(
     stays responsive, and how a key press gets to cancel. A dropped connection is not
     an answer, so polling carries on through it.
     """
-    deadline = time.monotonic() + login.expires_in
+    deadline = login.started + login.expires_in  # not from now: Tab can come back to a link
     next_poll = time.monotonic() + login.interval
     offline = False
     while True:
diff --git a/fp-cloud-cli/fp_cli/commands/auth_cmds.py b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
index 7753dee53..5607c759b 100644
--- a/fp-cloud-cli/fp_cli/commands/auth_cmds.py
+++ b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
@@ -108,14 +108,14 @@ def _looks_like_email(value: str) -> bool:
     return "@" in s and " " not in s and "." in s.rsplit("@", 1)[-1] and len(s) >= 5
 
 
-_SIGN_IN_WITH = {"browser": "authorize from a link", "email": "send me a 6-digit code"}
+_LINK_OPENING = "opening your browser — if nothing appears, open this link:"
+_LINK_ANYWHERE = "open this link on any device to authorize:"
 _NO_BROWSER_LOGIN = "this Cloud has no browser login yet — using an emailed code"
 _LINK_ENDED = {
     "denied": "not authorized",
     "expired": "that link expired",
     "claimed": "that link was already used",
 }
-_BACK_TO_MENU = object()
 _SPINNER = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"
 
 
@@ -123,50 +123,60 @@ def _offer_link(url: str) -> None:
     """The link goes on screen before any browser opens, so one that never appears strands
     nobody. Over SSH or with no display it is the whole offer, and works from any device."""
     opening = auth.can_open_browser()
-    output.print_unwrapped(
-        "opening your browser — if nothing appears, open this link:"
-        if opening
-        else "open this link on any device to authorize:"
-    )
+    output.print_unwrapped(_LINK_OPENING if opening else _LINK_ANYWHERE)
     output.print_unwrapped(url)
     if opening:
         auth.open_url(url)
 
 
 def _browser_login_in_box(state: AppState, base: str, box: selectmod.LoginBox):
-    """Link → approval → session, inside the box. Returns ``(token, expires_in, user)``,
-    ``None`` when this Cloud has no browser login, or ``_BACK_TO_MENU``."""
+    """Link → approval → session, inside the box. Returns ``(token, expires_in, user)``, or ``None``
+    when this Cloud has no browser login. Tab raises ``SwitchSignIn``, and ``box.link`` keeps the
+    link for coming back: asking for another each time would spend the rate limit and open another
+    tab, and an approval given in the meantime would be lost."""
     options = {"timeout": state.timeout, "verify": not state.insecure}
     frames = itertools.cycle(_SPINNER)
 
     def tick(left: float, offline: bool) -> None:
         minutes, seconds = divmod(int(left), 60)
         doing = "reconnecting" if offline else "waiting for you to authorize"
-        box.waiting(f"{next(frames)} {doing} · {minutes}:{seconds:02d} · esc to cancel")
-        box.wait_key(0.1)
+        box.waiting(f"{next(frames)} {doing} · {minutes}:{seconds:02d}", "tab use email · esc cancel")
+        if box.wait_key(0.1) == "\t":
+            raise selectmod.SwitchSignIn()
 
     try:
         while True:
-            box.working("asking for a link…")
-            login = auth.start_browser_login(base, **options)
-            if login is None:
-                return None
-            _offer_link(login.verification_url)
+            if box.link is not None:
+                box.show_link(_LINK_ANYWHERE, box.link.verification_url)
+            else:
+                box.working("asking for a link…")
+                box.link = auth.start_browser_login(base, **options)
+                if box.link is None:
+                    return None
+                # The link goes on screen before any browser opens, so one that never appears
+                # strands nobody. Over SSH or with no display it is the whole offer.
+                opening = auth.can_open_browser()
+                box.show_link(_LINK_OPENING if opening else _LINK_ANYWHERE, box.link.verification_url)
+                if opening:
+                    auth.open_url(box.link.verification_url)
             # ponytail: Esc during a stalled poll waits out its 10s timeout (Ctrl-C doesn't);
             # polling on a thread would fix that if it ever matters.
-            outcome = auth.await_browser_approval(base, login, tick=tick, **options)
-            # A key pressed during the last poll is still waiting to be read. Esc means no
+            outcome = auth.await_browser_approval(base, box.link, tick=tick, **options)
+            # A key pressed during the last poll is still waiting to be read. Esc and Tab mean no
             # session, and this is the last moment that can be honoured: the claim creates it.
             # Anything else was pressed at a screen that's gone, and must not answer the next
             # one: Enter would take a new link with "not authorized" on screen for no time.
             # `is not None`: the first byte of a non-ASCII character reads as "".
-            while box.wait_key(0) is not None:
-                pass
+            left_for_email = False
+            while (key := box.wait_key(0)) is not None:
+                left_for_email = left_for_email or key == "\t"
             if outcome == "approved":
+                if left_for_email:
+                    raise selectmod.SwitchSignIn()
                 box.working("finishing sign-in…")
-                return auth.claim_browser_login(base, login.poll_secret, **options)
-            if not box.link_ended(_LINK_ENDED.get(outcome, "that link can't be used any more")):
-                return _BACK_TO_MENU
+                return auth.claim_browser_login(base, box.link.poll_secret, **options)
+            box.link = None
+            box.link_ended(_LINK_ENDED.get(outcome, "that link can't be used any more"))
     except KeyboardInterrupt:  # Ctrl-C during a request, outside `wait_key`
         raise selectmod.LoginCancelled()
 
@@ -203,15 +213,18 @@ def tick(_left: float, offline: bool) -> None:
     )
 
 
-def _email_code_in_box(state: AppState, base: str, box: selectmod.LoginBox, email_opt: Optional[str]):
-    """Email → code → verify, inside the box. Returns ``(token, expires_in, user)``."""
+def _email_code_in_box(state: AppState, base: str, box: selectmod.LoginBox, email_opt: Optional[str],
+                       *, typed: str = "", tab: bool = False):
+    """Email → code → verify, inside the box. Returns ``(token, expires_in, user)``. With ``tab``,
+    Tab at the email raises ``SwitchSignIn``; ``typed`` is what the field starts with."""
     # email
     if email_opt:
         email = email_opt
         box.note("email", email)
     else:
-        email = box.text_step("email", validate=_looks_like_email,
-                              error_msg="that doesn't look like an email")
+        keys = "⏎ send a code · tab browser or SSO · esc cancel" if tab else "⏎ send a code · esc cancel"
+        email = box.text_step("email", helper=keys, validate=_looks_like_email,
+                              error_msg="that doesn't look like an email", value=typed, tab=tab)
     # send the code
     box.working("sending a code…")
     auth.request_otp(base, email, timeout=state.timeout, verify=not state.insecure)
@@ -234,35 +247,37 @@ def _email_code_in_box(state: AppState, base: str, box: selectmod.LoginBox, emai
     return token, expires_in, {**user, "email": user.get("email") or email}
 
 
+def _sign_in_in_box(state: AppState, base: str, box: selectmod.LoginBox, email_opt: Optional[str]):
+    """Ask for an email, with Tab to a browser link and back. Returns ``(method, creds)``."""
+    if email_opt:
+        return "email", _email_code_in_box(state, base, box, email_opt)
+    typed, tab = "", True
+    while True:
+        try:
+            return "email", _email_code_in_box(state, base, box, None, typed=typed, tab=tab)
+        except selectmod.SwitchSignIn as switch:
+            typed = switch.typed
+        try:
+            creds = _browser_login_in_box(state, base, box)
+        except selectmod.SwitchSignIn:
+            continue
+        if creds:
+            return "browser", creds
+        box.note(_NO_BROWSER_LOGIN)
+        tab = False
+
+
 def _login_interactive(state: AppState, base: str, email_opt: Optional[str], org_opt: Optional[str]) -> None:
-    """The single-box interactive login (real TTY only): one redrawn-in-place panel — browser or
-    email code → (org picker) → signed-in. Mirrors the non-interactive orchestration below; only the
+    """The single-box interactive login (real TTY only): one redrawn-in-place panel — email code
+    or browser link → (org picker) → signed-in. Mirrors the non-interactive orchestration below; only the
     UI differs. Network/auth errors propagate (terminal restored on the way out) to the standard red
     error box."""
     saved = state.config.org
     persisted = False
 
-    def choose_method(box: selectmod.LoginBox) -> str:
-        return box.pick(list(_SIGN_IN_WITH), title="how do you want to sign in?",
-                        step="sign in with", notes=_SIGN_IN_WITH)
-
     with selectmod.LoginBox() as box:
         try:
-            method = "email" if email_opt else choose_method(box)
-            creds = None
-            while method == "browser" and creds is None:
-                creds = _browser_login_in_box(state, base, box)
-                if creds is _BACK_TO_MENU:
-                    box.done.pop()  # the `✓ sign in with browser` being taken back
-                    creds = None
-                    method = choose_method(box)
-                elif creds is None:
-                    box.done.pop()
-                    box.note(_NO_BROWSER_LOGIN)
-                    method = "email"
-            if method == "email":
-                creds = _email_code_in_box(state, base, box, email_opt)
-            token, expires_in, user = creds
+            method, (token, expires_in, user) = _sign_in_in_box(state, base, box, email_opt)
             # persist first (so we can read authoritative memberships), then resolve the org
             auth.persist_session(state.config, base, token, expires_in, user, insecure=state.insecure)
             persisted = True
@@ -312,16 +327,17 @@ def choose_method(box: selectmod.LoginBox) -> str:
 
 def login(
     ctx: typer.Context,
-    email: Optional[str] = typer.Option(None, "--email", "-e", help="Sign in with a code sent to this email, skipping the browser-or-email menu."),
+    email: Optional[str] = typer.Option(None, "--email", "-e", help="Send the sign-in code to this email, without asking for it."),
     org: Optional[str] = typer.Option(None, "--org", help="Org/tenant slug to sign in to — skips the picker. Must be one you can access."),
     force: bool = typer.Option(False, "--force", help="Re-authenticate even if you already have a valid session."),
 ) -> None:
-    """Sign in to the dashboard, from a browser or with an emailed one-time code.
+    """Sign in to the dashboard, with an emailed one-time code or from a browser.
 
-    On a terminal you choose. **browser** opens a link (over SSH or with no display it prints
-    the link, which works from any device); authorize there and the terminal finishes on its own.
-    **email** sends a 6-digit code that you paste back, and is what `--email`, `--json` and anything
-    without a terminal use. A Cloud without browser login falls back to the code by itself.
+    On a terminal it asks for your email and sends a 6-digit code to paste back, which is also
+    what `--email`, `--json` and anything without a terminal use. Press **Tab** there for a link
+    instead, to sign in with your browser or SSO. It opens your browser (over SSH or with no display
+    it just shows the link, which works from any device); authorize there and the terminal finishes
+    on its own. A Cloud without browser login stays with the code.
     The session is saved to `~/.failproofai/fpcli/cli-auth.json` (mode 0600) and lasts ~24h — just
     re-run `login` when it expires. Already signed in? `login` shows who you are and exits 0
     without prompting; pass `--force` to re-authenticate anyway.
@@ -414,10 +430,8 @@ def login(
     # A terminal this can't draw the box on (Windows). Pipes, CI and `--json` skip this, and so
     # does a redirected stderr: the link and the waiting would go to that file, out of sight.
     if not state.json and not email and selectmod.stdin_is_tty() and selectmod.stderr_is_tty():
-        answer = ""
-        while answer not in _SIGN_IN_WITH:
-            answer = str(output.prompt("sign in with [browser/email]", default="browser")).strip().lower()
-        if answer == "browser":
+        email = str(output.prompt("email, or just press enter for a browser link", default="")).strip()
+        if not email:
             try:
                 creds = _browser_login_plain(state, base)
             except KeyboardInterrupt:
diff --git a/fp-cloud-cli/fp_cli/output.py b/fp-cloud-cli/fp_cli/output.py
index 46e25864d..afba99a0d 100644
--- a/fp-cloud-cli/fp_cli/output.py
+++ b/fp-cloud-cli/fp_cli/output.py
@@ -170,6 +170,7 @@ def prompt(label: str, *, default: Optional[str] = None, hide_input: bool = Fals
     kwargs: dict = {"err": True, "prompt_suffix": " ", "hide_input": hide_input}
     if default is not None:
         kwargs["default"] = default
+        kwargs["show_default"] = bool(default)  # a blank default would show as `[]`
     return typer.prompt(text, **kwargs)
 
 
@@ -389,45 +390,55 @@ def _login_slots(buf: str, slots: int) -> Text:
     return out
 
 
-def login_inset(slugs: Sequence[str], idx: int, *, title: str = "choose your org", notes=None):
-    """The nested picker inset (a renderable inside the login frame): a ``{title} · N`` title,
-    then a FAINT-bordered inset box (a hair-lighter fill) with one row per choice — ``❯`` cursor
-    (ACCENT) on row ``idx``, selected slug bright, others dim, and its ``notes`` entry if any —
-    then a FAINT key-hint line."""
-    heading = Text()
-    heading.append(title, style=f"bold {theme.TEXT}")
-    if notes is None:  # a count says something about a list of orgs, not about a menu
-        heading.append(f"  ·  {len(slugs)}", style=theme.FAINT)
+def login_inset(slugs: Sequence[str], idx: int):
+    """The nested org-picker inset (a renderable inside the login frame): a ``choose your org · N``
+    title, then a FAINT-bordered inset box (a hair-lighter fill) with one row per org — ``❯`` cursor
+    (ACCENT) on row ``idx``, selected slug bright, others dim — then a FAINT key-hint line."""
+    title = Text()
+    title.append("choose your org", style=f"bold {theme.TEXT}")
+    title.append(f"  ·  {len(slugs)}", style=theme.FAINT)
     table = Table(box=None, show_header=False, pad_edge=False, padding=(0, 2, 0, 0))
     table.add_column(no_wrap=True)
     table.add_column(no_wrap=True)
-    table.add_column(no_wrap=True)
     for i, slug in enumerate(slugs):
         selected = i == idx
         ptr = Text("❯", style=f"bold {theme.ACCENT}") if selected else Text(" ")
         name = Text(str(slug), style=theme.TEXT if selected else theme.TEXT_DIM)
-        table.add_row(ptr, name, Text((notes or {}).get(slug, ""), style=theme.FAINT))
+        table.add_row(ptr, name)
     inset = Panel(table, box=ROUNDED, border_style=theme.FAINT, style=f"on {theme.INSET_BG}",
                   padding=(0, 1), expand=False)
     hint = Text("↑↓ move · ⏎ select · esc cancel", style=theme.FAINT)
-    return Group(heading, inset, hint)
+    return Group(title, inset, hint)
 
 
 def print_unwrapped(text: str) -> None:
     """One line on stderr that the terminal wraps, not Rich, so a long link stays one link.
-    Above the login box when it is up (same console), and not silenced by ``--quiet``:
-    the login can't go on without it."""
+    Not silenced by ``--quiet``: the login can't go on without it."""
     _stderr.print(Text(text), soft_wrap=True)
 
 
+def print_login_link(done, intro: str, url: str) -> int:
+    """The still part of the box's link screen, once: the steps so far, ``intro``, then the link,
+    which the terminal wraps. Returns the rows it took on screen."""
+    head = Group(render_login_frame(done, None), Padding(Text(intro, style=theme.TEXT_DIM), (0, 0, 0, 2)))
+    link = Text("  ").append(url, style=theme.ACCENT)
+    _stderr.print(head)
+    _stderr.print(link, soft_wrap=True)
+    return len(_stderr.render_lines(head, pad=False)) + math.ceil(link.cell_len / _stderr.width)
+
+
+def render_login_waiting(line: str, keys: str):
+    """The live part of the box's link screen, under the link."""
+    return Padding(Group(Text(line, style=theme.TEXT_DIM), Text(keys, style=theme.FAINT)), (0, 0, 0, 2))
+
+
 def render_login_frame(done, active, *, active_value: str = "", active_slots: Optional[int] = None,
                        helper=None, error=None, inset=None, note=None, signed_in=None,
-                       cancelled=None, failed=None, waiting=None):
+                       cancelled=None, failed=None):
     """Build the one login Panel (a renderable the caller redraws via ``Live``). ``done`` is a list
     of ``(label, value)`` collapsed ✓ steps; ``active`` is the current step label (bright ``❯``
     line) with ``active_value`` the in-progress typed text (rendered as fixed slots when
-    ``active_slots`` is set, e.g. the 6-digit code). ``inset`` is a picker block; ``waiting`` is the
-    live line while a browser approval is pending; ``signed_in``
+    ``active_slots`` is set, e.g. the 6-digit code). ``inset`` is a picker block; ``signed_in``
     = ``(email, org)`` flips the border green; ``cancelled`` (bool: was the session persisted?)
     renders the calm close; ``failed`` = ``(message, hint)`` flips the border red and shows the
     failure INSIDE the same box (e.g. a wrong code). Legend ``◆ fp`` rides the top border."""
@@ -471,8 +482,6 @@ def render_login_frame(done, active, *, active_value: str = "", active_slots: Op
             lines.append(Text("  " + str(helper), style=theme.TEXT_DIM))
     if note:
         lines.append(Text("· " + str(note), style=theme.FAINT))
-    if waiting:
-        lines.append(Text(str(waiting), style=theme.TEXT_DIM))
     if inset is not None:
         lines.append(inset)
     if signed_in is not None:
diff --git a/fp-cloud-cli/fp_cli/select.py b/fp-cloud-cli/fp_cli/select.py
index f9e344cd9..0b41e984e 100644
--- a/fp-cloud-cli/fp_cli/select.py
+++ b/fp-cloud-cli/fp_cli/select.py
@@ -168,6 +168,15 @@ class LoginCancelled(Exception):
     """The user pressed Esc / Ctrl-C during the login flow (calm cancel, not an error)."""
 
 
+class SwitchSignIn(Exception):
+    """Tab at the email or the link: the other way of signing in. ``typed`` is what the email
+    field held, to put back when the person returns to it."""
+
+    def __init__(self, typed: str = "") -> None:
+        super().__init__()
+        self.typed = typed
+
+
 def login_box_supported() -> bool:
     """True iff the single-box interactive login can run (real TTY on stdin+stderr + termios) —
     otherwise ``login`` uses the plain prompt flow (tests, pipes, CI, ``--json``)."""
@@ -183,9 +192,11 @@ class LoginBox:
     def __init__(self) -> None:
         self.done: List = []      # collapsed ✓ steps: (label, value)
         self.active: Optional[str] = None
+        self.link = None          # the browser link on offer, kept while Tab goes to email and back
         self._fd = sys.stdin.fileno()
         self._old = None
         self._live = None
+        self._link_rows = 0       # rows `show_link` printed above the live part
 
     def __enter__(self) -> "LoginBox":
         import termios
@@ -210,17 +221,26 @@ def __exit__(self, *exc) -> None:
             termios.tcsetattr(self._fd, termios.TCSADRAIN, self._old)
 
     def _draw(self, **kw) -> None:
+        if self._link_rows:  # take down what `show_link` printed
+            from rich.control import Control
+            from rich.segment import ControlType
+            from rich.text import Text
+
+            self._live.update(Text(""), refresh=True)  # the cursor is now just under those rows
+            up_and_erase = ((ControlType.CURSOR_UP, 1), (ControlType.ERASE_IN_LINE, 2))
+            self._live.console.control(Control(*up_and_erase * self._link_rows))
+            self._link_rows = 0
         self._live.update(output.render_login_frame(self.done, self.active, **kw))
         self._live.refresh()
 
-    def _read_line(self, *, helper, slots, error) -> str:
+    def _read_line(self, *, helper, slots, error, value: str = "", tab: bool = False) -> str:
         """Read one line in raw mode, redrawing the frame on every keystroke so the typed text
         appears INSIDE the box (echo is off). Backspace edits; Enter accepts; Esc / Ctrl-C / EOF
         cancel (an arrow escape-sequence mid-type is swallowed, not a cancel). A ``slots`` field
-        accepts digits only, capped at ``slots``."""
+        accepts digits only, capped at ``slots``. With ``tab``, Tab raises ``SwitchSignIn``."""
         import select as _sel
 
-        buf = ""
+        buf = value
         self._draw(active_value=buf, active_slots=slots, helper=helper, error=error)
         while True:
             try:
@@ -233,6 +253,9 @@ def _read_line(self, *, helper, slots, error) -> str:
                 return buf
             if ch == b"\x03":  # Ctrl-C as a byte (if signals were off)
                 raise LoginCancelled()
+            if ch == b"\t" and tab:
+                self.active = None
+                raise SwitchSignIn(buf)
             if ch == b"\x1b":  # Esc, or the start of an arrow escape sequence
                 r, _, _ = _sel.select([self._fd], [], [], 0.0008)
                 if r:
@@ -256,16 +279,18 @@ def _read_line(self, *, helper, slots, error) -> str:
 
     def text_step(self, label: str, *, helper=None, slots=None, validate=None,
                   error_msg=None, hidden_value: bool = False, collapse: bool = True,
-                  initial_error=None) -> str:
+                  initial_error=None, value: str = "", tab: bool = False) -> str:
         """Run one bright ``❯ {label}`` input step; on a failed ``validate`` show the error sub-line
         and re-prompt. On accept it collapses to a dim ``✓ {label} {value}`` line (the value is
         omitted when ``hidden_value``). With ``collapse=False`` it returns the value WITHOUT adding
         the ✓ line (the caller verifies it over the network first, then calls ``note``); ``initial_error``
-        seeds the error sub-line on the first draw (a re-prompt after a wrong code)."""
+        seeds the error sub-line on the first draw (a re-prompt after a wrong code). ``value`` starts
+        the field with text in it, and ``tab`` makes Tab raise ``SwitchSignIn``."""
         self.active = label
         error = initial_error
         while True:
-            buf = self._read_line(helper=helper, slots=slots, error=error).strip()
+            buf = self._read_line(helper=helper, slots=slots, error=error, value=value, tab=tab).strip()
+            value = ""
             if validate is None or validate(buf):
                 self.active = None
                 if collapse:
@@ -288,9 +313,20 @@ def retry_text(self, message: str) -> None:
         # text_step's own loop shows the error; this is for the verify-fail re-prompt path.
         self._draw(error=message)
 
-    def waiting(self, text: str) -> None:
-        """Redraw the live line of a pending browser approval."""
-        self._draw(waiting=text)
+    def show_link(self, intro: str, url: str) -> None:
+        """Put a link in the box. It's printed, not drawn: the frame redraws on every tick, which
+        clears a person's selection, and Rich would break a long link across lines, where it
+        can't be clicked or copied whole. Only the waiting line under it stays live, and the next
+        frame takes it all down again."""
+        from rich.text import Text
+
+        self._live.update(Text(""), refresh=True)
+        self._link_rows = output.print_login_link(self.done, intro, url)
+
+    def waiting(self, line: str, keys: str) -> None:
+        """Redraw the live part under a link, leaving the link alone."""
+        self._live.update(output.render_login_waiting(line, keys))
+        self._live.refresh()
 
     def wait_key(self, seconds: float) -> Optional[str]:
         """Up to ``seconds`` for a keypress: its token, or ``None``. Esc / Ctrl-C raise
@@ -306,30 +342,29 @@ def wait_key(self, seconds: float) -> Optional[str]:
             raise LoginCancelled()
         return key
 
-    def link_ended(self, message: str) -> bool:
-        """A link that can't be used any more, inside the box. ``True`` asks for a new link
-        (Enter), ``False`` goes back to the menu (Esc), Ctrl-C raises ``LoginCancelled``."""
-        self._draw(failed=(message, "⏎ new link · esc back"))
+    def link_ended(self, message: str) -> None:
+        """A link that can't be used any more, inside the box. Returns on Enter, for a new link.
+        Tab raises ``SwitchSignIn``; Esc and Ctrl-C raise ``LoginCancelled``."""
+        self._draw(failed=(message, "⏎ new link · tab use email · esc cancel"))
         while True:
             try:
                 key = _read_key(self._fd)
             except KeyboardInterrupt:
                 raise LoginCancelled()
             if key == "ENTER":
-                return True
-            if key == "ESC":
-                return False
-            if key in ("CTRL_C", "EOF"):
+                return
+            if key == "\t":
+                raise SwitchSignIn()
+            if key in ("ESC", "CTRL_C", "EOF"):
                 raise LoginCancelled()
 
-    def pick(self, slugs: Sequence[str], *, default: Optional[str] = None,
-             title: str = "choose your org", step: str = "org", notes=None) -> str:
-        """The nested picker inset: arrow keys move the cursor, Enter selects (collapses to
-        ``✓ {step} {slug}``), Esc / Ctrl-C raise ``LoginCancelled``."""
+    def pick(self, slugs: Sequence[str], *, default: Optional[str] = None) -> str:
+        """The nested org-picker inset: arrow keys move the cursor, Enter selects (collapses to
+        ``✓ org {slug}``), Esc / Ctrl-C raise ``LoginCancelled``."""
         slugs = list(slugs)
         idx = slugs.index(default) if default in slugs else 0
         self.active = None
-        self._draw(inset=output.login_inset(slugs, idx, title=title, notes=notes))
+        self._draw(inset=output.login_inset(slugs, idx))
         while True:
             try:
                 key = _read_key(self._fd)
@@ -341,14 +376,14 @@ def pick(self, slugs: Sequence[str], *, default: Optional[str] = None,
                 idx = (idx + 1) % len(slugs)
             elif key == "ENTER":
                 chosen = slugs[idx]
-                self.done.append((step, chosen))
+                self.done.append(("org", chosen))
                 self._draw()
                 return chosen
             elif key in ("ESC", "CTRL_C", "q", "EOF"):
                 raise LoginCancelled()
             else:
                 continue
-            self._draw(inset=output.login_inset(slugs, idx, title=title, notes=notes))
+            self._draw(inset=output.login_inset(slugs, idx))
 
     def finish(self, email: str, org: Optional[str]) -> None:
         """Final state: the outer border + legend flip SUCCESS green; ``● signed in`` + email + org."""
diff --git a/fp-cloud-cli/tests/test_browser_login.py b/fp-cloud-cli/tests/test_browser_login.py
index b4191646a..3b3c61149 100644
--- a/fp-cloud-cli/tests/test_browser_login.py
+++ b/fp-cloud-cli/tests/test_browser_login.py
@@ -8,14 +8,18 @@
 
 from __future__ import annotations
 
+import io
 import json
 import time
+from types import SimpleNamespace
 
 import httpx
 import pytest
 import respx
+from rich.console import Console
+from rich.live import Live
 
-from fp_cli import auth, config
+from fp_cli import auth, config, output
 from fp_cli import select as selectmod
 from fp_cli._context import AppState
 from fp_cli.app import app
@@ -201,6 +205,18 @@ def test_waiting_gives_up_when_the_link_runs_out():
     assert not route.called
 
 
+@respx.mock
+def test_coming_back_to_a_link_keeps_its_countdown():
+    # Tab away and back must not promise ten more minutes the server won't honour.
+    respx.post(f"{BASE}/api/auth/cli/poll").mock(return_value=httpx.Response(200, json={"status": "approved"}))
+    left = []
+    old = auth.BrowserLogin(LINK, "POLL", 60.0, 0.0, started=time.monotonic() - 50.0)
+    auth.await_browser_approval(BASE, old, tick=lambda seconds, _offline: left.append(seconds))
+    assert left and left[0] <= 10.0
+    gone = auth.BrowserLogin(LINK, "POLL", 60.0, 0.0, started=time.monotonic() - 61.0)
+    assert auth.await_browser_approval(BASE, gone, tick=lambda *_: None) == "expired"
+
+
 # --- claim ------------------------------------------------------------------
 
 
@@ -341,13 +357,21 @@ class _Box:
     def __init__(self, *keys):
         self.keys = list(keys)
         self.ended = []
+        self.link = None
+        self.shown = []
 
     def working(self, _text):
         pass
 
+    def show_link(self, intro, url):
+        self.shown.append((intro, url))
+
+    def waiting(self, _line, _keys):
+        pass
+
     def link_ended(self, message):
         self.ended.append((message, list(self.keys)))
-        return False
+        raise selectmod.SwitchSignIn()  # as Tab there does: it gets a test out of the loop
 
     def wait_key(self, _seconds):
         key = self.keys.pop(0) if self.keys else None
@@ -394,8 +418,10 @@ def test_enter_pressed_during_the_last_poll_cannot_answer_a_screen_nobody_saw(ap
     # It would take the next link straight away, with the denial on screen for no time at all.
     monkeypatch.setattr(auth, "await_browser_approval", lambda *_a, **_k: final)
     box = _Box("ENTER", "")
-    assert auth_cmds._browser_login_in_box(_state(), BASE, box) is auth_cmds._BACK_TO_MENU
+    with pytest.raises(selectmod.SwitchSignIn):
+        auth_cmds._browser_login_in_box(_state(), BASE, box)
     assert [keys for _message, keys in box.ended] == [[]]
+    assert box.link is None, "the next time gets a new link, not this dead one"
 
 
 def test_esc_pressed_during_the_last_poll_of_a_denied_link_still_cancels(approved_link, monkeypatch):
@@ -406,6 +432,171 @@ def test_esc_pressed_during_the_last_poll_of_a_denied_link_still_cancels(approve
     assert box.ended == []
 
 
+def test_tab_pressed_during_the_last_poll_means_no_session(approved_link):
+    box = _Box("x", "\t")
+    with pytest.raises(selectmod.SwitchSignIn):
+        auth_cmds._browser_login_in_box(_state(), BASE, box)
+    assert approved_link == []
+    assert box.link is not None, "the approval is still there to come back to"
+
+
+def test_tab_pressed_during_the_last_poll_of_a_denied_link_answers_nothing(approved_link, monkeypatch):
+    monkeypatch.setattr(auth, "await_browser_approval", lambda *_a, **_k: "denied")
+    box = _Box("\t")
+    with pytest.raises(selectmod.SwitchSignIn):  # raised by the denied screen, once shown
+        auth_cmds._browser_login_in_box(_state(), BASE, box)
+    assert [message for message, _keys in box.ended] == ["not authorized"]
+
+
+def test_tab_away_and_back_finds_the_same_link(approved_link, monkeypatch):
+    # Asking again would spend the rate limit, leave rows behind, and open another browser tab.
+    starts, opened = [], []
+
+    def start(*_a, **_k):
+        starts.append(1)
+        return auth.BrowserLogin(LINK, "POLL", 60.0, 1.0)
+
+    def waited(_base, _login, *, tick, **_k):
+        tick(60.0, False)
+        return "approved"
+
+    monkeypatch.setattr(auth, "start_browser_login", start)
+    monkeypatch.setattr(auth, "can_open_browser", lambda *_a: True)
+    monkeypatch.setattr(auth, "open_url", opened.append)
+    monkeypatch.setattr(auth, "await_browser_approval", waited)
+
+    box = _Box("\t")
+    with pytest.raises(selectmod.SwitchSignIn):
+        auth_cmds._browser_login_in_box(_state(), BASE, box)
+    assert auth_cmds._browser_login_in_box(_state(), BASE, box)[0] == "tok"
+
+    assert starts == [1]
+    assert opened == [LINK]
+    assert box.shown == [(auth_cmds._LINK_OPENING, LINK), (auth_cmds._LINK_ANYWHERE, LINK)]
+    assert approved_link == [1]
+
+
+def test_the_link_goes_on_screen_before_any_browser_opens(approved_link, monkeypatch):
+    box = _Box()
+    monkeypatch.setattr(auth, "can_open_browser", lambda *_a: True)
+    monkeypatch.setattr(auth, "open_url", lambda url: box.shown.append(("opened", url)))
+    auth_cmds._browser_login_in_box(_state(), BASE, box)
+    assert [what for what, _url in box.shown] == [auth_cmds._LINK_OPENING, "opened"]
+
+
+class _EmailBox(_Box):
+    """``text_step`` answers from a script: text to accept, or a Tab with what had been typed."""
+
+    def __init__(self, *steps):
+        super().__init__()
+        self.steps = list(steps)
+        self.asked = []
+        self.notes = []
+
+    def text_step(self, label, *, helper=None, value="", tab=False, **_k):
+        self.asked.append((label, value, tab, helper))
+        step = self.steps.pop(0)
+        if isinstance(step, Exception):
+            raise step
+        return step
+
+    def note(self, label, value=None):
+        self.notes.append(label)
+
+
+@pytest.fixture
+def emailed_code(monkeypatch):
+    monkeypatch.setattr(auth, "request_otp", lambda *_a, **_k: None)
+    monkeypatch.setattr(auth, "verify_otp", lambda *_a, **_k: ("tok-otp", 3600, CLAIMED["user"]))
+
+
+def test_tab_at_the_email_goes_to_the_link_and_back_keeping_what_was_typed(emailed_code, monkeypatch):
+    def left(*_a, **_k):
+        raise selectmod.SwitchSignIn()
+
+    monkeypatch.setattr(auth_cmds, "_browser_login_in_box", left)
+    box = _EmailBox(selectmod.SwitchSignIn("me@te"), "me@test", "123456")
+
+    method, creds = auth_cmds._sign_in_in_box(_state(), BASE, box, None)
+
+    assert (method, creds[0]) == ("email", "tok-otp")
+    assert [(label, value, tab) for label, value, tab, _helper in box.asked] == [
+        ("email", "", True), ("email", "me@te", True), ("code", "", False),
+    ]
+    assert "tab browser or SSO" in box.asked[0][3]
+
+
+def test_a_browser_link_from_the_email_step_signs_in(approved_link):
+    box = _EmailBox(selectmod.SwitchSignIn(""))
+    method, creds = auth_cmds._sign_in_in_box(_state(), BASE, box, None)
+    assert (method, creds[0]) == ("browser", "tok")
+    assert approved_link == [1]
+
+
+def test_a_cloud_without_browser_login_stops_offering_tab(emailed_code, monkeypatch):
+    monkeypatch.setattr(auth, "start_browser_login", lambda *_a, **_k: None)
+    box = _EmailBox(selectmod.SwitchSignIn("me@"), "me@test", "123456")
+
+    method, _creds = auth_cmds._sign_in_in_box(_state(), BASE, box, None)
+
+    assert method == "email"
+    assert box.notes[0] == auth_cmds._NO_BROWSER_LOGIN
+    label, value, tab, helper = box.asked[1]
+    assert (label, value, tab) == ("email", "me@", False)
+    assert "tab" not in helper
+
+
+def test_the_email_flag_goes_straight_to_the_code(emailed_code, monkeypatch):
+    monkeypatch.setattr(auth, "start_browser_login", lambda *_a, **_k: pytest.fail("asked for a link"))
+    box = _EmailBox("123456")
+    assert auth_cmds._sign_in_in_box(_state(), BASE, box, "me@test")[0] == "email"
+    assert [label for label, *_rest in box.asked] == ["code"]
+
+
+LONG_LINK = "https://app.befailproof.ai/cli/authorize?r=" + "a" * 64  # 107 characters
+
+
+@pytest.mark.parametrize("width,rows", [(200, 1), (110, 1), (109, 1), (108, 2), (80, 2), (55, 2), (54, 3)])
+def test_a_link_stays_whole_and_its_rows_are_counted(monkeypatch, width, rows):
+    # Rich mustn't break it, and a wrong count leaves stray rows on screen or eats the ones above.
+    console = Console(file=io.StringIO(), force_terminal=True, width=width, color_system=None)
+    monkeypatch.setattr(output, "_stderr", console)
+    monkeypatch.setattr(output, "_screen_started", True)
+
+    taken = output.print_login_link([("code", None)], "open this link:", LONG_LINK)
+
+    printed = console.file.getvalue()
+    assert f"  {LONG_LINK}\n" in printed
+    assert taken == len(["◆ fp", "welcome", "✓ code", "open this link:"]) + rows
+
+
+def test_the_box_leaves_the_link_alone_until_it_takes_it_down_row_by_row(monkeypatch):
+    monkeypatch.setenv("TERM", "xterm")  # Live draws nothing on a dumb terminal
+    console = Console(file=io.StringIO(), force_terminal=True, width=80, color_system=None)
+    monkeypatch.setattr(output, "_stderr", console)
+    monkeypatch.setattr(output, "_screen_started", True)
+    monkeypatch.setattr("sys.stdin", SimpleNamespace(fileno=lambda: 0))
+    box = selectmod.LoginBox()
+    box._live = Live(console=console, auto_refresh=False)
+
+    def written_by(step):
+        console.file.seek(0)
+        console.file.truncate()
+        step()
+        return console.file.getvalue()
+
+    with box._live:
+        assert LONG_LINK in written_by(lambda: box.show_link("open this link:", LONG_LINK))
+        for _tick in range(2):  # redrawing it would clear a person's selection
+            tick = written_by(lambda: box.waiting("waiting", "keys"))
+            assert "waiting" in tick and LONG_LINK not in tick
+        taken_down = written_by(box._draw)
+        # ◆ fp, welcome, the intro and two rows of link, and the waiting line's own row.
+        assert taken_down.count("\x1b[1A\x1b[2K") == 5 + 1
+        # Nothing more to take down: only the frame's own second row.
+        assert written_by(box._draw).count("\x1b[1A\x1b[2K") == 1
+
+
 @pytest.mark.parametrize("step", ["start_browser_login", "claim_browser_login"])
 def test_ctrl_c_during_any_request_of_a_browser_login_cancels_calmly(approved_link, monkeypatch, step):
     def interrupted(*_a, **_k):
@@ -478,7 +669,7 @@ def test_a_cloud_without_browser_login_falls_back_to_the_emailed_code(home, runn
     )
     respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
 
-    result = runner.invoke(app, ["--base-url", BASE, "login"], input="browser\nme@test\n123456\n")
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="\nme@test\n123456\n")
 
     assert result.exit_code == 0, result.output
     assert "no browser login" in result.output
@@ -495,7 +686,7 @@ def test_a_cloud_that_dropped_the_kind_is_never_claimed_from(home, runner, plain
     respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
     respx.post(f"{BASE}/api/auth/otp/verify").mock(return_value=httpx.Response(401))
 
-    runner.invoke(app, ["--base-url", BASE, "login"], input="browser\nme@test\n000000\n")
+    runner.invoke(app, ["--base-url", BASE, "login"], input="\nme@test\n000000\n")
 
     assert not poll.called and not claim.called
 
@@ -508,7 +699,7 @@ def test_a_link_that_ends_leaves_nothing_saved(home, runner, plain_terminal, mon
     respx.post(f"{BASE}/api/auth/cli/poll").mock(return_value=httpx.Response(200, json={"status": final}))
     claim = respx.post(f"{BASE}/api/auth/cli/claim")
 
-    result = runner.invoke(app, ["--base-url", BASE, "login"], input="browser\n")
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="\n")
 
     assert result.exit_code == 4, result.output
     assert not claim.called
@@ -516,14 +707,15 @@ def test_a_link_that_ends_leaves_nothing_saved(home, runner, plain_terminal, mon
 
 
 @respx.mock
-def test_a_typo_at_the_prompt_asks_again_instead_of_starting_a_login(home, runner, plain_terminal):
+def test_an_email_at_the_prompt_is_the_email_and_starts_no_link(home, runner, plain_terminal):
     start = respx.post(f"{BASE}/api/auth/cli/start")
-    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    otp = respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
     respx.post(f"{BASE}/api/auth/otp/verify").mock(return_value=httpx.Response(401))
 
-    runner.invoke(app, ["--base-url", BASE, "login"], input="emial\nemail\nme@test\n000000\n")
+    runner.invoke(app, ["--base-url", BASE, "login"], input="me@test\n000000\n")
 
     assert not start.called
+    assert json.loads(otp.calls[0].request.content)["email"] == "me@test"
 
 
 @respx.mock
@@ -536,7 +728,7 @@ def interrupted(*_a, **_k):
 
     monkeypatch.setattr(auth, "await_browser_approval", interrupted)
 
-    result = runner.invoke(app, ["--base-url", BASE, "login"], input="browser\n")
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="\n")
 
     assert result.exit_code == 0, result.output
     assert "cancelled" in result.output
@@ -559,7 +751,7 @@ def test_the_plain_flow_says_when_it_is_reconnecting_once(home, runner, plain_te
     respx.post(f"{BASE}/api/auth/cli/claim").mock(return_value=httpx.Response(201, json=CLAIMED))
     respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
 
-    result = runner.invoke(app, ["--base-url", BASE, "login"], input="browser\n")
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="\n")
 
     assert result.exit_code == 0, result.output
     assert result.output.count("reconnecting") == 1
@@ -576,7 +768,7 @@ def test_the_plain_flow_says_it_is_back_when_the_next_answer_is_the_approval(hom
     respx.post(f"{BASE}/api/auth/cli/claim").mock(return_value=httpx.Response(201, json=CLAIMED))
     respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
 
-    result = runner.invoke(app, ["--base-url", BASE, "login"], input="browser\n")
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="\n")
 
     assert result.exit_code == 0, result.output
     assert result.output.index("reconnecting") < result.output.index("back online")
@@ -601,6 +793,7 @@ def test_a_redirected_stderr_keeps_the_old_prompts(home, runner, plain_terminal,
 
     assert result.exit_code == 0, result.output
     assert not start.called
+    assert "browser link" not in result.output
     assert config.load_config().session_token == "tok-otp"
 
 
@@ -617,7 +810,7 @@ def test_choosing_email_never_touches_the_browser_routes(home, runner, plain_ter
     )
     respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
 
-    result = runner.invoke(app, ["--base-url", BASE, "login"], input="email\nme@test\n123456\n")
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="me@test\n123456\n")
 
     assert result.exit_code == 0, result.output
     assert not start.called
@@ -632,7 +825,7 @@ def test_choosing_email_never_touches_the_browser_routes(home, runner, plain_ter
         (["--base-url", BASE, "login"], False, "me@test\n123456\n"),
     ],
 )
-def test_email_flag_json_and_no_terminal_never_see_the_menu(home, runner, monkeypatch, args, tty, stdin):
+def test_email_flag_json_and_no_terminal_are_never_offered_a_link(home, runner, monkeypatch, args, tty, stdin):
     monkeypatch.setattr("fp_cli.select.stdin_is_tty", lambda: tty)
     monkeypatch.setattr("fp_cli.select.login_box_supported", lambda: False)
     start = respx.post(f"{BASE}/api/auth/cli/start")
@@ -650,4 +843,19 @@ def test_email_flag_json_and_no_terminal_never_see_the_menu(home, runner, monkey
 
     assert result.exit_code == 0, result.output
     assert not start.called
+    assert "browser link" not in result.output
     assert config.load_config().session_token == "tok-otp"
+
+
+@respx.mock
+def test_a_blank_line_without_a_terminal_starts_no_link(home, runner, monkeypatch):
+    # At a terminal a blank answer means the link. Down a pipe nobody could see one.
+    monkeypatch.setattr("fp_cli.select.stdin_is_tty", lambda: False)
+    monkeypatch.setattr("fp_cli.select.login_box_supported", lambda: False)
+    start = respx.post(f"{BASE}/api/auth/cli/start")
+    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(return_value=httpx.Response(401))
+
+    runner.invoke(app, ["--base-url", BASE, "login"], input="\nme@test\n000000\n")
+
+    assert not start.called

From c64f84a569a919105e07bf46ec690cfeba553e33 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Thu, 5 Nov 2026 15:00:14 +0530
Subject: [PATCH 12/15] [failproofai-feat-failproofai-cloud-login] Take fp back
 to its earlier look
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The owner asked for the rounded panels, the purple accent, the `◆ fp` mark, lowercase panel titles
and red error boxes back. This changes how output looks and nothing about what fp fetches, decides,
returns or exits with: `fp_cli/commands/`, `client.py`, `models.py`, `auth.py` and `select.py` are
untouched, and so is every assertion about `--json` and exit codes.

Three things deliberately don't go back:

- Ids stay whole. `_short_session`, `_short_id`, `_short_chat_id` and `_truncate` are unchanged, and
  `Table` still forces wrapping, so a long value wraps instead of ending in `…`. `print_table` keeps
  its narrow branch that stacks fields.
- Screens added after the redesign keep their heading and plain table, in the old palette. They
  never had a design to return to.
- `error()`, `success()`, `warn()` and `print_table` titles keep the old colours but print their text
  literally. Restoring them exactly would parse Rich markup, and a `[/]` in a server's message would
  be a traceback.

With real borders the login link can't sit inside the box: a border would break a link wider than
the window, so it couldn't be clicked or copied whole. It sits right under a closed box instead,
with only the waiting lines below it live.

Full ids squeezed the `fp errors` summary to 8 columns at 100 wide, so it gets a floor of 28 and the
long ids wrap instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 __tests__/e2e/layout/fp-login.sh             |   4 +-
 fp-cloud-cli/CHANGELOG.md                    |   4 +
 fp-cloud-cli/README.md                       |   4 +-
 fp-cloud-cli/fp_cli/app.py                   |   8 +-
 fp-cloud-cli/fp_cli/cloud_output.py          |   1 -
 fp-cloud-cli/fp_cli/output.py                | 220 ++++++++-----------
 fp-cloud-cli/fp_cli/theme.py                 |  42 ++--
 fp-cloud-cli/skill/references/commands.md    |   4 +-
 fp-cloud-cli/tests/fake_cloud_smoke.py       |   4 +-
 fp-cloud-cli/tests/test_browser_login.py     |  27 ++-
 fp-cloud-cli/tests/test_cloud_agent.py       |  12 +-
 fp-cloud-cli/tests/test_cloud_human_views.py |   2 -
 fp-cloud-cli/tests/test_commands.py          |   6 +-
 fp-cloud-cli/tests/test_dashboards_agent.py  |   6 +-
 fp-cloud-cli/tests/test_facets.py            |   2 +-
 fp-cloud-cli/tests/test_operator.py          |   2 +-
 fp-cloud-cli/tests/test_orgs.py              |   2 +-
 fp-cloud-cli/tests/test_output.py            |  38 ++--
 fp-cloud-cli/tests/test_screen_language.py   | 105 ++++++---
 fp-cloud-cli/tests/test_whoami.py            |   2 +-
 20 files changed, 251 insertions(+), 244 deletions(-)

diff --git a/__tests__/e2e/layout/fp-login.sh b/__tests__/e2e/layout/fp-login.sh
index 685c7c678..a16323aa0 100755
--- a/__tests__/e2e/layout/fp-login.sh
+++ b/__tests__/e2e/layout/fp-login.sh
@@ -208,8 +208,8 @@ has "…as the person who approved" "$T" "$ONE"
 # In the raw bytes: the window is 100 wide, the link wider, and nothing but the terminal may
 # wrap it. A line break from Rich would break it for a click or a copy, and so would writing it
 # again with the spinner, which clears a selection.
-LINE=$(grep -caP '^(\r|\x1b\[[0-9;?]*[A-Za-z])*  (\x1b\[[0-9;]*m)?https?://\S+/cli/authorize\?r=[0-9a-f]{64}(\x1b\[[0-9;]*m)?\r?$' "$OUT/first.log")
-eq "the link is one unbroken run on its own line, in the box" "$LINE" "1"
+LINE=$(grep -caP '^(\r|\x1b\[[0-9;?]*[A-Za-z])*( {2})?(\x1b\[[0-9;]*m)?https?://\S+/cli/authorize\?r=[0-9a-f]{64}(\x1b\[[0-9;]*m)?\r?$' "$OUT/first.log")
+eq "the link is one unbroken run on its own line, right under the box" "$LINE" "1"
 eq "…written once, not again with the spinner" "$(grep -ao 'cli/authorize?r=' "$OUT/first.log" | wc -l)" "1"
 eq "one more session on the server" "$(sessions_of "$ONE")" "$((BEFORE + 1))"
 eq "the request is spent" "$(request_status "$LINK")" "claimed"
diff --git a/fp-cloud-cli/CHANGELOG.md b/fp-cloud-cli/CHANGELOG.md
index f366fc385..042385824 100644
--- a/fp-cloud-cli/CHANGELOG.md
+++ b/fp-cloud-cli/CHANGELOG.md
@@ -6,6 +6,10 @@
 
 - `fp login` can sign you in from a browser. On a terminal it asks for your email and sends a 6-digit code, as before; press Tab there for a link instead, to use your browser or SSO, and Tab again to go back. The link stays in the login box, opens where a browser can (over SSH or with no display it only shows it, and it works from any device), and the terminal finishes on its own once you authorize it. `--email`, `--json` and anything without a terminal keep the code as they always did. A dashboard without browser login stays with the code and never creates a key. Either way you get the same session, with the same lifetime. (#981)
 
+### Changed
+
+- Back to the earlier look: rounded panels, the purple `◆ fp` mark, lowercase panel titles and red error boxes. Ids stay whole, wrapping instead of being cut, and screens added since keep their plain tables. `--json`, exit codes and messages are unchanged. (#981)
+
 ## 0.0.2 — 2026-10-25
 
 **Stable release.** The `0.0.2b0` line the `bump` job opened after `0.0.1` is cut stable
diff --git a/fp-cloud-cli/README.md b/fp-cloud-cli/README.md
index 94c27c0cb..69d50661c 100644
--- a/fp-cloud-cli/README.md
+++ b/fp-cloud-cli/README.md
@@ -329,8 +329,8 @@ Unknown-route 404s exit 6 with “not available on this FailproofAI Cloud yet”
 Missing-record 404s also exit 6 but report that the record was not found.
 `plan` and `plan claim` require a signed-in person and deny API-key mode before
 HTTP with the standard `fp login` message.
-Human screens use the mint/pink wordmark, grey labels, open tables and full ids;
-existing JSON shapes are unchanged.
+Human screens use rounded panels, the purple `◆ fp` mark and full ids, which wrap
+rather than being cut; existing JSON shapes are unchanged.
 
 Human commands show summaries, tables and wrapped text rather than response
 objects. Use global `--json` for raw API results. For `sessions export` or
diff --git a/fp-cloud-cli/fp_cli/app.py b/fp-cloud-cli/fp_cli/app.py
index 21af77eed..2c5e71ae9 100644
--- a/fp-cloud-cli/fp_cli/app.py
+++ b/fp-cloud-cli/fp_cli/app.py
@@ -132,12 +132,6 @@
 # function Typer calls for this; falls back silently if its internals change.
 try:  # pragma: no cover - exercised via real command output, not unit assertions
     import typer.rich_utils as _rich_utils
-    # Keep generated subcommand help on the same shared screen primitives.
-    _rich_utils.Panel = output.Panel
-    _rich_utils.Table = output.Table
-    _rich_utils.STYLE_OPTION = output.theme.PINK
-    _rich_utils.STYLE_COMMANDS_TABLE_FIRST_COLUMN = output.theme.PINK
-    _rich_utils.STYLE_OPTION_ENVVAR = output.theme.LABEL
 
     import re as _re
 
@@ -337,7 +331,7 @@ def main(
             "must be a positive number of seconds.", param_hint="--timeout"
         )
     cfg = cfgmod.load_config()
-    output.configure(no_color=no_color, quiet=quiet, json=json_output, context=ctx.invoked_subcommand or "Cloud")
+    output.configure(no_color=no_color, quiet=quiet, json=json_output)
     # Resolve the credential BEFORE telemetry starts: the distinct-id depends on it.
     # `get_parameter_source` is what separates a flag from its env var — the values
     # alone cannot, and the precedence rules differ between the two (see resolve_auth).
diff --git a/fp-cloud-cli/fp_cli/cloud_output.py b/fp-cloud-cli/fp_cli/cloud_output.py
index 3993dc238..c69837226 100644
--- a/fp-cloud-cli/fp_cli/cloud_output.py
+++ b/fp-cloud-cli/fp_cli/cloud_output.py
@@ -15,7 +15,6 @@
 
 
 def begin(title: str) -> None:
-    output.screen_header()
     output._stdout.print(Text(title.upper(), style="bold"))
 
 
diff --git a/fp-cloud-cli/fp_cli/output.py b/fp-cloud-cli/fp_cli/output.py
index afba99a0d..77610496c 100644
--- a/fp-cloud-cli/fp_cli/output.py
+++ b/fp-cloud-cli/fp_cli/output.py
@@ -17,96 +17,26 @@
 
 import typer
 from rich.box import ROUNDED, SIMPLE_HEAD
+from rich.cells import cell_len
 from rich.console import Console, Group
 from rich.padding import Padding
-from rich.panel import Panel as RichPanel
-from rich.rule import Rule as RichRule
+from rich.panel import Panel
+from rich.rule import Rule
 from rich.table import Table as RichTable
-from rich.measure import Measurement
 from rich.text import Text
 
 from . import theme
-from ._version import __version__
-
-_screen_started = False
-_screen_context = "Cloud"
-
-
-def wordmark(context: Optional[str] = None) -> Text:
-    line = Text("fa", style="bold")
-    line.append("il", style=f"bold {theme.PINK}")
-    line.append("proof ai", style="bold")
-    line.append(f" v{__version__} · {context or _screen_context}", style=theme.LABEL)
-    return line
-
-
-def heading(value: Any) -> Text:
-    text = value.copy() if isinstance(value, Text) else Text.from_markup(str(value))
-    # Change chrome, never the case of a resource name/id in a title.
-    name, sep, rest = text.plain.partition(" · ")
-    known = {"events", "sessions", "evals", "errors", "keys", "users", "queries", "settings",
-             "issues", "models", "chats", "audits", "findings", "commands", "version",
-             "permissions", "orgs", "assistant", "usage", "guardrails", "policies", "fleet",
-             "options", "arguments"}
-    if name.lower() in known:
-        text = Text(name.upper(), style=f"bold {theme.TEXT}") + Text(sep + rest, style=theme.LABEL)
-    return text
-
-
-def screen_header(console=None) -> None:
-    global _screen_started
-    if not _screen_started and not _quiet and not _json_out:
-        _screen_started = True
-        (console or _stdout).print(wordmark())
-        (console or _stdout).print()
-
-
-class Panel(RichPanel):
-    """Legacy cards rendered through the open-screen primitive, without boxes.
-
-    Keep RichPanel's constructor/attributes so existing renderers need no rewrite.
-    """
-    def __rich_console__(self, console, options):
-        global _screen_started
-        if not _screen_started and not _quiet and not _json_out:
-            _screen_started = True
-            yield wordmark()
-            yield Text("")
-        if self.title:
-            yield heading(self.title)
-        yield self.renderable
-        if self.subtitle:
-            yield heading(self.subtitle)
-
-    def __rich_measure__(self, console, options):
-        parts = [self.renderable]
-        if self.title:
-            parts.insert(0, heading(self.title))
-        return Measurement.get(console, options, Group(*parts))
-
-
-class Rule(RichRule):
-    """Legacy separators are intentionally invisible in the 2026-10 language."""
-    def __rich_console__(self, console, options):
-        return iter(())
-
-    def __rich_measure__(self, console, options):
-        return Measurement(0, 0)
 
 
 class Table(RichTable):
-    """Shared tables: grey labels, no borders/rules, fold instead of cut."""
-    def __init__(self, *args, **kwargs):
-        kwargs["box"] = None
-        kwargs["show_edge"] = False
-        kwargs["header_style"] = theme.LABEL
-        super().__init__(*args, **kwargs)
-
+    """Long values wrap rather than being cut: an id, a URL or a command is never shown with a
+    ``…``. Everything else about a table is the caller's."""
     def add_column(self, *args, **kwargs):
         kwargs["overflow"] = "fold"
         kwargs["no_wrap"] = False
         return super().add_column(*args, **kwargs)
 
+
 _stdout = Console()
 _stderr = Console(stderr=True)
 _quiet = False
@@ -114,16 +44,14 @@ def add_column(self, *args, **kwargs):
 _json_out = False
 
 
-def configure(*, no_color: bool = False, quiet: bool = False, json: bool = False, context: str = "Cloud") -> None:
+def configure(*, no_color: bool = False, quiet: bool = False, json: bool = False) -> None:
     """Reconfigure the consoles from the resolved global flags."""
-    global _stdout, _stderr, _quiet, _no_color, _json_out, _screen_started, _screen_context
+    global _stdout, _stderr, _quiet, _no_color, _json_out
     _stdout = Console(no_color=no_color)
     _stderr = Console(stderr=True, no_color=no_color)
     _quiet = quiet
     _no_color = no_color
     _json_out = json
-    _screen_started = False
-    _screen_context = context
 
 
 def is_json() -> bool:
@@ -215,30 +143,29 @@ def print_table(
     title: Optional[str] = None,
     show_header: bool = True,
 ) -> None:
-    screen_header()
-    if title:
-        _stdout.print(Text(str(title).upper(), style="bold"))
     widths = [max([len(str(column))] + [len(_cell(row[i])) for row in rows if i < len(row)]) for i, column in enumerate(columns)]
-    if len(columns) > 1 and sum(widths) + 3 * len(columns) > _stdout.width:
+    if len(columns) > 1 and sum(widths) + 3 * len(columns) + 1 > _stdout.width:
         # On a narrow terminal, wrapped adjacent columns interleave copyable
         # ids and URLs. Stack the fields so each value remains a whole line.
+        if title:
+            _stdout.print(Text(str(title), style="bold"))
         for row in rows:
             for column, value in zip(columns, row):
-                _stdout.print(Text(str(column).upper(), style=theme.LABEL))
+                _stdout.print(Text(str(column), style=theme.LABEL))
                 _stdout.print(Text("  " + _cell(value)), soft_wrap=True)
             _stdout.print()
         return
-    table = Table(show_header=show_header)
+    table = Table(
+        title=Text(title) if title else None, title_justify="left", header_style="bold",
+        show_header=show_header,
+    )
     for column in columns:
         table.add_column(str(column), overflow="fold")
     for row in rows:
         # Wrap each cell in Text so a value containing Rich markup (e.g. "[/]" or
         # "[red]" in a server-provided field) renders literally instead of raising
         # MarkupError mid-render (which would abort with a raw traceback).
-        table.add_row(*[
-            Text(_cell(value), style=theme.LABEL if list(columns) == ["Field", "Value"] and i == 0 else "")
-            for i, value in enumerate(row)
-        ])
+        table.add_row(*[Text(_cell(value)) for value in row])
     _stdout.print(table)
 
 
@@ -255,7 +182,7 @@ def info(message: str) -> None:
 
 def success(message: str) -> None:
     if not _quiet:
-        _stderr.print(Text("✓ ", style=theme.SUCCESS) + Text(message))
+        _stderr.print(Text(message, style="green"))
 
 
 def hint(message: str) -> None:
@@ -264,12 +191,12 @@ def hint(message: str) -> None:
 
 
 def error(message: str) -> None:
-    _stderr.print(Text("✕ ", style=theme.ERROR) + Text(message))
+    _stderr.print(Text(message, style="bold red"))
 
 
 def warn(message: str) -> None:
     if not _quiet:
-        _stderr.print(Text("▲ ", style=theme.PINK) + Text(message))
+        _stderr.print(Text(message, style="yellow"))
 
 
 def cli_warn(message: str) -> None:
@@ -290,7 +217,7 @@ def cli_warn(message: str) -> None:
 # here is stderr status chrome (never the --json data on stdout); the accent is
 # the project's pink/magenta. All gated on `_quiet`.
 
-_ACCENT = theme.PINK
+_ACCENT = "magenta"
 _NEUTRAL = "grey62"  # gray for 'already in that state' no-op boxes (neutral, not red/green)
 
 
@@ -299,8 +226,7 @@ def auth_header() -> None:
     if _quiet:
         return
     _stderr.print()
-    screen_header(_stderr)
-    _stderr.print(Text("SIGN IN", style="bold"))
+    _stderr.print(f"  [bold {_ACCENT}]◆ fp[/]")
     _stderr.print("  [dim]welcome — let's get you signed in[/]")
     _stderr.print()
 
@@ -316,7 +242,7 @@ def code_sent(email: str) -> None:
     """Confirm the one-time code was emailed (the completed `request_otp` step)."""
     if _quiet:
         return
-    _stderr.print(f"  [{theme.SUCCESS}]✓[/] code sent to [bold {_ACCENT}]{email}[/]")
+    _stderr.print(f"  [green]✓[/] code sent to [bold {_ACCENT}]{email}[/]")
 
 
 def org_picker(slugs: Sequence[str], current: Optional[str] = None) -> None:
@@ -417,28 +343,46 @@ def print_unwrapped(text: str) -> None:
     _stderr.print(Text(text), soft_wrap=True)
 
 
+def _login_keys(text: str) -> Text:
+    """A key hint, with the keys themselves standing out: ``⏎ send a code · esc cancel``."""
+    hint = Text(text, style=theme.TEXT_DIM)
+    hint.highlight_regex(r"⏎|\btab\b|\besc\b", style=theme.TEXT)
+    return hint
+
+
 def print_login_link(done, intro: str, url: str) -> int:
-    """The still part of the box's link screen, once: the steps so far, ``intro``, then the link,
-    which the terminal wraps. Returns the rows it took on screen."""
-    head = Group(render_login_frame(done, None), Padding(Text(intro, style=theme.TEXT_DIM), (0, 0, 0, 2)))
-    link = Text("  ").append(url, style=theme.ACCENT)
+    """The still part of the box's link screen, once: the box says what to do, and the link sits
+    right under it, outside the border. A border would break a link wider than the window, so it
+    couldn't be clicked or copied whole, where the terminal can wrap it as one. Returns the rows it
+    took on screen."""
+    head = Group(render_login_frame(done, None, asks=intro), Text(""))
+    # One that fits lines up with the box. One that doesn't starts at the margin, so its rows line
+    # up with each other.
+    indent = "  " if cell_len(url) + 2 <= _stderr.width else ""
+    link = Text(indent).append(url, style=f"underline {theme.ACCENT}")
     _stderr.print(head)
     _stderr.print(link, soft_wrap=True)
-    return len(_stderr.render_lines(head, pad=False)) + math.ceil(link.cell_len / _stderr.width)
+    _stderr.print()
+    return len(_stderr.render_lines(head, pad=False)) + math.ceil(link.cell_len / _stderr.width) + 1
 
 
 def render_login_waiting(line: str, keys: str):
-    """The live part of the box's link screen, under the link."""
-    return Padding(Group(Text(line, style=theme.TEXT_DIM), Text(keys, style=theme.FAINT)), (0, 0, 0, 2))
+    """The live part of the box's link screen, under the link: a spinner, what it's waiting for and
+    the time left, then the keys."""
+    waiting = Text(line, style=theme.TEXT_DIM)
+    waiting.stylize(theme.ACCENT, 0, 1)
+    waiting.highlight_regex(r"\d+:\d\d$", style=theme.TEXT)
+    return Padding(Group(waiting, _login_keys(keys)), (0, 0, 0, 2))
 
 
 def render_login_frame(done, active, *, active_value: str = "", active_slots: Optional[int] = None,
                        helper=None, error=None, inset=None, note=None, signed_in=None,
-                       cancelled=None, failed=None):
+                       cancelled=None, failed=None, asks=None):
     """Build the one login Panel (a renderable the caller redraws via ``Live``). ``done`` is a list
     of ``(label, value)`` collapsed ✓ steps; ``active`` is the current step label (bright ``❯``
     line) with ``active_value`` the in-progress typed text (rendered as fixed slots when
-    ``active_slots`` is set, e.g. the 6-digit code). ``inset`` is a picker block; ``signed_in``
+    ``active_slots`` is set, e.g. the 6-digit code), and ``asks`` the same bright line for something
+    to do outside the box, with no field to type in. ``inset`` is a picker block; ``signed_in``
     = ``(email, org)`` flips the border green; ``cancelled`` (bool: was the session persisted?)
     renders the calm close; ``failed`` = ``(message, hint)`` flips the border red and shows the
     failure INSIDE the same box (e.g. a wrong code). Legend ``◆ fp`` rides the top border."""
@@ -479,7 +423,12 @@ def render_login_frame(done, active, *, active_value: str = "", active_slots: Op
         if error:
             lines.append(Text("  " + str(error), style=theme.ERROR))
         elif helper:
-            lines.append(Text("  " + str(helper), style=theme.TEXT_DIM))
+            lines.append(_login_keys("  " + str(helper)))
+    if asks:
+        ln = Text()
+        ln.append("❯ ", style=f"bold {theme.ACCENT}")
+        ln.append(str(asks), style=theme.TEXT)
+        lines.append(ln)
     if note:
         lines.append(Text("· " + str(note), style=theme.FAINT))
     if inset is not None:
@@ -511,7 +460,7 @@ def render_login_frame(done, active, *, active_value: str = "", active_slots: Op
         fl.append(str(msg), style=theme.TEXT)
         lines.append(fl)
         if hint:
-            h = Text(str(hint), style=theme.TEXT_DIM)
+            h = _login_keys(str(hint))
             h.highlight_words(["fp login"], style=theme.ACCENT)  # glow the command to run
             lines.append(h)
     legend = Text()
@@ -528,7 +477,6 @@ def _panel(mark: str, color: str, title: str, body: Text, hint: Optional[str] =
     highlighted. Built from a `rich.Text` (literal body — no markup injection). The colour
     carries the meaning: **green** = success, **brand-accent** = neutral 'already-in-state'
     no-op, **red** = failure. One shape so they all read as one family."""
-    color = theme.SUCCESS if color == "green" else theme.PINK if color in ("red", "yellow", "cyan", "magenta") else color
     text = Text()
     indent = ""
     # A box may be mark-less (the colour/title carry the meaning, e.g. the red
@@ -541,7 +489,7 @@ def _panel(mark: str, color: str, title: str, body: Text, hint: Optional[str] =
         text.append(f"\n{indent}")
         text.append(hint, style="dim")
     text.highlight_words(
-        ["fp login", "fp logout", "login --force"], style=f"bold {theme.PINK}"
+        ["fp login", "fp logout", "login --force"], style="bold cyan"
     )
     panel = Panel(
         text,
@@ -559,12 +507,8 @@ def _panel(mark: str, color: str, title: str, body: Text, hint: Optional[str] =
 
 
 def _error_box(message: str, hint: Optional[str] = None) -> None:
-    """One failure line, followed by a grey recovery hint when present."""
-    _stderr.print(Text("✕ ", style=theme.ERROR) + Text(message))
-    if hint:
-        line = Text("  " + hint, style=theme.LABEL)
-        line.highlight_regex(r"(?:fp|failproofai)\s+[^`]+", style=theme.PINK)
-        _stderr.print(line)
+    """A red `✗` failure box — the chokepoint for every CLI error."""
+    _panel("✗", "red", "error", Text(message), hint)
 
 
 def _status_box(title: str, body: Text, hint: Optional[str] = None) -> None:
@@ -580,8 +524,21 @@ def version_banner(version: str) -> None:
     if _quiet:
         _stdout.print(version)
         return
-    screen_header()
-    _stdout.print(Text(f"fp v{version}", style=theme.LABEL))
+    body = Text()
+    body.append("◆  ", style=f"bold {_ACCENT}")
+    body.append("fp", style="bold")
+    body.append("  ")
+    body.append(f"v{version}", style=f"bold {_ACCENT}")
+    panel = Panel(
+        body,
+        border_style=_ACCENT,
+        title=f"[bold {_ACCENT}]version[/]",
+        title_align="left",
+        expand=False,
+        padding=(0, 1),
+    )
+    _stdout.print()
+    _stdout.print(Padding(panel, (0, 0, 0, 2)))
 
 
 # ── top-level help (the grouped `fp` / `fp help` / `fp --help` screen) ──
@@ -654,21 +611,17 @@ def render_top_level_help() -> None:
     bold-white headings, BLUE command names, white one-line descriptions, FAINT subcommand hints,
     a FAINT footer), then aligned EXAMPLES. Presentation only — same routing, same commands.
     NO_COLOR keeps the box + bold headings + alignment, drops colour."""
-    global _screen_started
     total = sum(len(cmds) for _, cmds in _TOP_LEVEL_GROUPS)
 
     def _bullet(*parts) -> Text:
         line = Text("  · ", style=theme.FAINT)
         for text, style in parts:
-            if text.startswith("fp "):
-                style = theme.PINK
             line.append(text, style=style)
         return line
 
     # ── brand mark ──
     _stdout.print()
-    _screen_started = True
-    _stdout.print(wordmark())
+    _stdout.print(Text("  ◆ fp", style=f"bold {theme.ACCENT}"))
 
     # ── getting started ──
     _stdout.print()
@@ -700,9 +653,9 @@ def _bullet(*parts) -> Text:
         glob.append(g, style=theme.TEXT_DIM)
     _stdout.print(glob)
     eg = Text("    e.g.  ")
-    eg.append("fp --json events ", style=theme.PINK)
+    eg.append("fp --json events ", style=theme.TEXT_DIM)
     eg.append("✓", style=theme.SUCCESS)
-    eg.append("     fp events --json ", style=theme.PINK)
+    eg.append("     fp events --json ", style=theme.TEXT_DIM)
     eg.append("✗", style=theme.ERROR)
     _stdout.print(eg)
     mt = Text("    multi-tenant: set the org at login (", style=theme.FAINT)
@@ -752,7 +705,7 @@ def _bullet(*parts) -> Text:
             if hint:
                 cell.append("  ·  ", style=theme.FAINT)
                 cell.append(hint, style=theme.FAINT)
-            table.add_row(Text(name, style=theme.PINK), cell)
+            table.add_row(Text(name, style=theme.BLUE), cell)
     footer = Text()
     footer.append("run ", style=theme.FAINT)
     footer.append("fp <command> --help", style=theme.TEXT_DIM)
@@ -773,7 +726,7 @@ def _bullet(*parts) -> Text:
     ex.add_column(no_wrap=True)
     ex.add_column(no_wrap=True, overflow="ellipsis", max_width=max(SCORES_MIN_WIDTH, min(_stdout.width, 110) - 56))
     for cmd, why in _TOP_LEVEL_EXAMPLES:
-        ex.add_row(Text(cmd, style=theme.PINK), Text(why, style=theme.TEXT_DIM))
+        ex.add_row(Text(cmd, style=theme.ACCENT), Text(why, style=theme.TEXT_DIM))
     _stdout.print(Padding(ex, (0, 0, 0, 2)))
 
     _stdout.print()
@@ -1042,7 +995,6 @@ def render_whoami(
     """The logged-in ``whoami`` view (stdout): an identity header, then the shared
     permissions + orgs panels. Presentation only; no legend."""
     c = _stdout
-    screen_header(c)
 
     # ── identity header (no box) ──
     c.print()
@@ -1964,6 +1916,9 @@ def _errors_title(count: int, order: Optional[str], days) -> Text:
     return t
 
 
+ERRORS_SUMMARY_MIN_WIDTH = 28
+
+
 def render_errors(items: Sequence[Any], *, order: Optional[str] = None, full_ids: bool = False,
                   empty_message: str = "no errors") -> None:
     """The ``errors`` list view (stdout): an error-themed (muted red-purple border) boxed table —
@@ -1990,7 +1945,8 @@ def render_errors(items: Sequence[Any], *, order: Optional[str] = None, full_ids
             max((len(x) for x in agents), default=0),
             max((len(x) for x in sessions), default=0),
         ))
-        budget = max(SCORES_MIN_WIDTH, _stdout.width - fixed - _LIST_CHROME)
+        # Full ids can fill the row: keep the summary readable, and let the long ids wrap instead.
+        budget = max(ERRORS_SUMMARY_MIN_WIDTH, _stdout.width - fixed - _LIST_CHROME)
 
     rows = []
     for i, e in enumerate(items):
@@ -2780,13 +2736,13 @@ def _sql_syntax_theme():
         class _FpSqlStyle(Style):
             background_color = "#0e0c12"  # overridden by Syntax(background_color="default")
             styles = {
-                Token: "",
+                Token: theme.TEXT,
                 Comment: f"italic {theme.FAINT}",
                 Keyword: f"bold {theme.ACCENT}",
                 Keyword.Type: theme.SCORE_HIGH,
                 Operator: theme.TEXT_DIM,
                 Operator.Word: f"bold {theme.ACCENT}",  # AND / OR / NOT
-                Name: "",
+                Name: theme.TEXT,
                 Name.Builtin: theme.SUCCESS,
                 Name.Function: theme.SUCCESS,
                 Name.Variable: theme.PERM_WRITE,  # :name / @var params
@@ -2918,8 +2874,6 @@ def _plain(*parts, console=None) -> None:
     ``--quiet`` for non-error chrome; callers that must always show pass ``console``)."""
     line = Text("  ")
     for text, style in parts:
-        if text.startswith("fp "):
-            style = theme.PINK
         line.append(text, style=style)
     (console or _stderr).print(line)
 
diff --git a/fp-cloud-cli/fp_cli/theme.py b/fp-cloud-cli/fp_cli/theme.py
index 7da050919..ff4fccd95 100644
--- a/fp-cloud-cli/fp_cli/theme.py
+++ b/fp-cloud-cli/fp_cli/theme.py
@@ -6,35 +6,35 @@
 
 from __future__ import annotations
 
-ACCENT = "#66d1b5"    # mint: active and successful states
-TEXT = "default"     # the terminal's foreground (also works on light themes)
-TEXT_DIM = "#767f8b"
-LABEL = "#767f8b"    # grey labels and metadata
-FAINT = "#767f8b"
-THIN_RULE = "#3e434c"
-BAR_EMPTY = "#3e434c"
-INSET_BG = "default"
+ACCENT = "#9d7bff"    # brand mark, box borders, active org, command names in hints
+TEXT = "#d8d2dd"      # primary values
+TEXT_DIM = "#7d7488"  # ids, resource names, org names
+LABEL = "#6b6478"     # field labels, header cells, hints
+FAINT = "#5a5266"     # separators, inactive markers
+THIN_RULE = "#2e2435" # the faint rule beneath a list-panel header
+BAR_EMPTY = "#2a2530" # the unfilled cells of a mini-bar (e.g. the aggregate avg bar)
+INSET_BG = "#231e2d"  # a hair-lighter fill for a nested inset box (the login org picker)
 
 # Errors theme — the one per-command border deviation (the `errors` list + aggregate card).
 # Always red, regardless of error count, so the two views read as one consistent family.
-BORDER_ERROR = "#e4587d"
-TITLE_ERROR_DIM = LABEL
-RULE_ERROR = THIN_RULE
+BORDER_ERROR = "#e2564a"  # red → the errors panel border (same as ERROR; consistent, not count-dependent)
+TITLE_ERROR_DIM = "#6e3530"  # dim red → the errors title's non-name part + card separators
+RULE_ERROR = "#3a2d2d"  # dim red → the errors list header rule (vs the neutral THIN_RULE)
 
 # Semantic value colors — for run/job states and score thresholds. (They coincide with
 # the perm risk colors below; named separately so the two uses can diverge later.)
-SUCCESS = ACCENT
-PINK = "#e4587d"      # pink: commands, selection and attention
-AMBER = PINK
-ERROR = PINK
-SCORE_HIGH = ACCENT
-BLUE = ACCENT
+SUCCESS = "#5dcaa5"   # green     → run status: done/passed
+AMBER = "#ef9f27"     # amber     → run status: running/pending · score band .50–.80
+ERROR = "#e2564a"     # red       → run status: failed/error · score band < .50
+SCORE_HIGH = "#3ddbb8"  # cyan-green → score band ≥ .80 (distinct from status green)
+BLUE = "#6b86d8"      # blue      → schema uuid/timestamp type category
+PINK = "#d4537e"      # pink      → numeric values (query run cells / scalar card) + numeric type category
 
 # Permission verb colors — by ACTION (the part after `:`), never by resource.
-PERM_READ = ACCENT
-PERM_WRITE = PINK
-PERM_ACTION = PINK
-PERM_DANGER = PINK
+PERM_READ = "#5dcaa5"    # green  → read
+PERM_WRITE = "#d4537e"   # pink   → add, create, write, update
+PERM_ACTION = "#ef9f27"  # amber  → use, trigger, run, ack
+PERM_DANGER = "#e2564a"  # red    → delete, disable, regenerate
 
 PERM_COLORS = {
     "read": PERM_READ,
diff --git a/fp-cloud-cli/skill/references/commands.md b/fp-cloud-cli/skill/references/commands.md
index 3ad6c4bfd..dbe7f2115 100644
--- a/fp-cloud-cli/skill/references/commands.md
+++ b/fp-cloud-cli/skill/references/commands.md
@@ -385,8 +385,8 @@ Unknown-route 404s exit 6 with “not available on this FailproofAI Cloud yet”
 Missing-record 404s also exit 6 but preserve the server's record-not-found message;
 an empty response on a record-scoped request identifies the missing record path.
 Session-only commands exit 2 before HTTP in key mode.
-Human output uses mint/pink open screens and full ids; legacy `--full-ids`
-remains accepted. Exports refuse to overwrite existing files.
+Human output uses rounded panels and full ids, which wrap rather than being cut;
+legacy `--full-ids` remains accepted. Exports refuse to overwrite existing files.
 
 Use global `--json` for API objects or `--out` to save a session/query JSON
 export. Without either, human mode renders a readable view rather than raw
diff --git a/fp-cloud-cli/tests/fake_cloud_smoke.py b/fp-cloud-cli/tests/fake_cloud_smoke.py
index ff7ee87ac..2717d4e5c 100644
--- a/fp-cloud-cli/tests/fake_cloud_smoke.py
+++ b/fp-cloud-cli/tests/fake_cloud_smoke.py
@@ -299,9 +299,9 @@ def run(argv, *, input=None, key=False, json_mode=True, expected=0):
         assert proc.returncode == 0 and sent, transcript[-1]
         assert Cloud.answers[-1]["decision"] == "approve"
         # CI may force colour even with NO_COLOR, inserting ANSI spans inside
-        # the wordmark. Compare visible text without weakening the order check.
+        # the text. Compare visible text.
         rendered = re.sub(r"\x1b\[[0-?]*[ -/]*[@-~]", "", output.decode(errors="replace"))
-        assert rendered.index("failproof ai") < rendered.index("EVENTS BY AGENT")
+        assert "EVENTS BY AGENT" in rendered
     server.shutdown()
     (artifacts / "fp-user-smoke.txt").write_text("\n".join(transcript), encoding="utf-8")
     (artifacts / "fp-fake-cloud-requests.json").write_text(json.dumps(Cloud.requests, indent=2), encoding="utf-8")
diff --git a/fp-cloud-cli/tests/test_browser_login.py b/fp-cloud-cli/tests/test_browser_login.py
index 3b3c61149..ccebfe328 100644
--- a/fp-cloud-cli/tests/test_browser_login.py
+++ b/fp-cloud-cli/tests/test_browser_login.py
@@ -556,25 +556,31 @@ def test_the_email_flag_goes_straight_to_the_code(emailed_code, monkeypatch):
 LONG_LINK = "https://app.befailproof.ai/cli/authorize?r=" + "a" * 64  # 107 characters
 
 
-@pytest.mark.parametrize("width,rows", [(200, 1), (110, 1), (109, 1), (108, 2), (80, 2), (55, 2), (54, 3)])
-def test_a_link_stays_whole_and_its_rows_are_counted(monkeypatch, width, rows):
+@pytest.mark.parametrize(
+    "width,indent,rows",
+    [(200, "  ", 1), (110, "  ", 1), (109, "  ", 1), (108, "", 1), (107, "", 1), (106, "", 2), (80, "", 2), (54, "", 2), (53, "", 3)],
+)
+def test_a_link_stays_whole_and_its_rows_are_counted(monkeypatch, width, indent, rows):
     # Rich mustn't break it, and a wrong count leaves stray rows on screen or eats the ones above.
     console = Console(file=io.StringIO(), force_terminal=True, width=width, color_system=None)
     monkeypatch.setattr(output, "_stderr", console)
-    monkeypatch.setattr(output, "_screen_started", True)
 
     taken = output.print_login_link([("code", None)], "open this link:", LONG_LINK)
 
     printed = console.file.getvalue()
-    assert f"  {LONG_LINK}\n" in printed
-    assert taken == len(["◆ fp", "welcome", "✓ code", "open this link:"]) + rows
+    # Right under the box, never inside its border. It lines up with the box when it fits, and
+    # starts at the margin when it doesn't, so its rows line up with each other.
+    under_the_box = printed.split("╯")[-1]
+    assert under_the_box.strip("\n ") == LONG_LINK
+    assert f"\n{indent}{LONG_LINK}\n" in under_the_box
+    box = ["╭─ ◆ fp ─╮", "welcome", "✓ code", "❯ open this link:", "╰────╯", "blank above the link"]
+    assert taken == len(box) + rows + len(["blank below the link"])
 
 
 def test_the_box_leaves_the_link_alone_until_it_takes_it_down_row_by_row(monkeypatch):
     monkeypatch.setenv("TERM", "xterm")  # Live draws nothing on a dumb terminal
     console = Console(file=io.StringIO(), force_terminal=True, width=80, color_system=None)
     monkeypatch.setattr(output, "_stderr", console)
-    monkeypatch.setattr(output, "_screen_started", True)
     monkeypatch.setattr("sys.stdin", SimpleNamespace(fileno=lambda: 0))
     box = selectmod.LoginBox()
     box._live = Live(console=console, auto_refresh=False)
@@ -591,10 +597,11 @@ def written_by(step):
             tick = written_by(lambda: box.waiting("waiting", "keys"))
             assert "waiting" in tick and LONG_LINK not in tick
         taken_down = written_by(box._draw)
-        # ◆ fp, welcome, the intro and two rows of link, and the waiting line's own row.
-        assert taken_down.count("\x1b[1A\x1b[2K") == 5 + 1
-        # Nothing more to take down: only the frame's own second row.
-        assert written_by(box._draw).count("\x1b[1A\x1b[2K") == 1
+        # The box (border, welcome, the ask, border), a blank, two rows of link, a blank, and the
+        # waiting line's own row.
+        assert taken_down.count("\x1b[1A\x1b[2K") == 4 + 1 + 2 + 1 + 1
+        # Nothing more to take down: only the frame's own rows (border, welcome, border).
+        assert written_by(box._draw).count("\x1b[1A\x1b[2K") == 2
 
 
 @pytest.mark.parametrize("step", ["start_browser_login", "claim_browser_login"])
diff --git a/fp-cloud-cli/tests/test_cloud_agent.py b/fp-cloud-cli/tests/test_cloud_agent.py
index 464168949..5aa61bd54 100644
--- a/fp-cloud-cli/tests/test_cloud_agent.py
+++ b/fp-cloud-cli/tests/test_cloud_agent.py
@@ -65,7 +65,6 @@ class Sys:
     else:
         assert "EVENT TOTAL" in result.output
         assert "42" in result.output
-        assert result.stdout.index("failproof ai v") < result.stdout.index("EVENT TOTAL")
         if tty:
             assert "alert a1" in result.output
             assert "Approve this change" in result.output
@@ -184,8 +183,7 @@ def test_approval_answer_failure_is_clean(logged_in, runner, json_mode, failure,
         assert data["exit_code"] == exit_code
         message = data["error"]
     else:
-        assert len(result.stderr.strip().splitlines()) == 1
-        message = result.stderr
+        message = " ".join(result.stderr.replace("│", " ").split())  # wrapped in the red error box
     assert "Assistant approval answer failed" in message
     assert "delivery unconfirmed" in message
     if failure == "404":
@@ -239,15 +237,13 @@ def test_ask_api_key_uses_session_only_wording(logged_in, runner, json_mode):
     if json_mode:
         assert json.loads(result.stdout)["error"] == expected
     else:
-        assert expected in result.stderr
-        assert len(result.stderr.strip().splitlines()) == 1
+        assert expected in " ".join(result.stderr.replace("│", " ").split())  # the red error box wraps it
 
 
-def test_artifact_header_precedes_title_once(capsys):
+def test_artifacts_render_in_order(capsys):
     from fp_cli.commands.agent_cmds import render_artifact
     output.configure(no_color=True)
     render_artifact({"title": "First artifact", "result": RESULT})
     render_artifact({"title": "Second artifact", "result": RESULT})
     rendered = capsys.readouterr().out
-    assert rendered.count("failproof ai v") == 1
-    assert rendered.index("failproof ai v") < rendered.index("FIRST ARTIFACT") < rendered.index("SECOND ARTIFACT")
+    assert rendered.index("FIRST ARTIFACT") < rendered.index("SECOND ARTIFACT")
diff --git a/fp-cloud-cli/tests/test_cloud_human_views.py b/fp-cloud-cli/tests/test_cloud_human_views.py
index 32014ab78..37bb8be40 100644
--- a/fp-cloud-cli/tests/test_cloud_human_views.py
+++ b/fp-cloud-cli/tests/test_cloud_human_views.py
@@ -235,8 +235,6 @@ def test_deliberate_human_command_views(logged_in, runner, monkeypatch, tmp_path
         result = runner.invoke(app, args)
     assert result.exit_code == 0, result.output
     assert expected in result.stdout, result.stdout
-    if argv[:2] != ["query", "export"] or "--out" in argv or "json" in argv:
-        assert result.stdout.lstrip().startswith("failproof ai"), result.stdout
     assert "\nFIELD\n" not in result.stdout and "\nVALUE\n" not in result.stdout
     for raw in ('"eval_key":', '"created":', '"permissions":', "dashboards  []", "{'"):
         assert raw not in result.stdout, result.stdout
diff --git a/fp-cloud-cli/tests/test_commands.py b/fp-cloud-cli/tests/test_commands.py
index bc8f9a284..092551efe 100644
--- a/fp-cloud-cli/tests/test_commands.py
+++ b/fp-cloud-cli/tests/test_commands.py
@@ -522,7 +522,7 @@ def test_sessions_table(logged_in, runner):
     )
     result = runner.invoke(app, ["sessions"])
     assert result.exit_code == 0, result.output
-    assert "SESSIONS" in result.stdout
+    assert "sessions" in result.stdout  # the boxed panel title
     assert "done" in result.stdout  # status flattened up from latest_evaluation
 
 
@@ -679,7 +679,7 @@ def test_help_command(home, runner):
     result = runner.invoke(app, ["help"])
     assert result.exit_code == 0
     out = result.stdout
-    assert "COMMANDS" in out
+    assert "Commands" in out  # the grouped top-level panel
     # the four purpose groups, in order
     for g in ("ESSENTIALS", "OBSERVE", "MANAGE", "TOOLS"):
         assert g in out
@@ -744,7 +744,7 @@ def test_fields_unknown_is_usage_error(logged_in, runner):
 def test_dash_h_alias_shows_help(home, runner):
     result = runner.invoke(app, ["-h"])
     assert result.exit_code == 0
-    assert "COMMANDS" in result.stdout and "sessions" in result.stdout
+    assert "Commands" in result.stdout and "sessions" in result.stdout
     assert "ESSENTIALS" in result.stdout  # the grouped top-level help, via the rich_format_help override
 
 
diff --git a/fp-cloud-cli/tests/test_dashboards_agent.py b/fp-cloud-cli/tests/test_dashboards_agent.py
index be8baea07..2bd87bbee 100644
--- a/fp-cloud-cli/tests/test_dashboards_agent.py
+++ b/fp-cloud-cli/tests/test_dashboards_agent.py
@@ -171,7 +171,7 @@ def test_agent_health_renders_configured_card(logged_in, runner):
     result = runner.invoke(app, ["agent", "health"])
     assert result.exit_code == 0, result.output
     out = result.stdout
-    assert "ASSISTANT" in out and "configured" in out and "claude-x" in out
+    assert "assistant" in out and "configured" in out and "claude-x" in out
 
 
 @respx.mock
@@ -192,7 +192,7 @@ def test_agent_models_renders_default_marker(logged_in, runner):
     result = runner.invoke(app, ["agent", "models"])
     assert result.exit_code == 0, result.output
     out = result.stdout
-    assert "MODELS" in out and "m-default" in out and "m-fast" in out and "default" in out
+    assert "models" in out and "m-default" in out and "m-fast" in out and "default" in out
 
 
 @respx.mock
@@ -213,7 +213,7 @@ def test_agent_chats_renders_table(logged_in, runner):
     )
     result = runner.invoke(app, ["agent", "chats"])
     assert result.exit_code == 0, result.output
-    assert "CHATS" in result.stdout and "perf review" in result.stdout
+    assert "chats" in result.stdout and "perf review" in result.stdout
     assert "chat-id" in result.stdout and "c1" in result.stdout  # full chat-id column by default
     assert "open one with" not in (result.stderr or "")           # footer removed
 
diff --git a/fp-cloud-cli/tests/test_facets.py b/fp-cloud-cli/tests/test_facets.py
index 86d0500c1..31ae8c8df 100644
--- a/fp-cloud-cli/tests/test_facets.py
+++ b/fp-cloud-cli/tests/test_facets.py
@@ -87,7 +87,7 @@ def test_errors_list_table(logged_in, runner):
     result = runner.invoke(app, ["errors", "--since", "24h"])
     assert result.exit_code == 0, result.output
     # the 80-col CliRunner truncates cells; just assert the error-themed box rendered
-    assert "ERRORS" in result.stdout and "newest first" in result.stdout
+    assert "errors" in result.stdout and "newest first" in result.stdout
 
 
 @respx.mock
diff --git a/fp-cloud-cli/tests/test_operator.py b/fp-cloud-cli/tests/test_operator.py
index 659162842..2cbdc8bb6 100644
--- a/fp-cloud-cli/tests/test_operator.py
+++ b/fp-cloud-cli/tests/test_operator.py
@@ -388,7 +388,7 @@ def test_settings_list_human_boxed(logged_in, runner):
     result = runner.invoke(app, ["settings", "list"])
     assert result.exit_code == 0, result.output
     out = result.stdout + result.stderr
-    assert "SETTINGS · 3" in out
+    assert "settings · 3" in out
     for c in ("key", "value", "type", "updated"):
         assert c in out
     assert "session_ttl_secs" in out and "86400" in out and "integer" in out
diff --git a/fp-cloud-cli/tests/test_orgs.py b/fp-cloud-cli/tests/test_orgs.py
index f65caea07..1b78be434 100644
--- a/fp-cloud-cli/tests/test_orgs.py
+++ b/fp-cloud-cli/tests/test_orgs.py
@@ -393,7 +393,7 @@ def test_orgs_perms_table(logged_in, runner):
     # identity header (name · slug · role) + the shared grouped permissions panel, with the
     # org NAME in the panel's border title.
     assert "Globex" in result.stdout and "globex" in result.stdout and "role admin" in result.stdout
-    assert "PERMISSIONS · 2 · Globex" in result.stdout
+    assert "permissions · 2 · Globex" in result.stdout
     assert "events" in result.stdout and "keys" in result.stdout
 
 
diff --git a/fp-cloud-cli/tests/test_output.py b/fp-cloud-cli/tests/test_output.py
index 576d6ec97..c1369d374 100644
--- a/fp-cloud-cli/tests/test_output.py
+++ b/fp-cloud-cli/tests/test_output.py
@@ -51,7 +51,7 @@ def test_print_table_writes_to_stdout(capsys):
     output.configure(no_color=True, quiet=False)
     output.print_table(["a", "b"], [["1", "2"]], title="Demo")
     out = capsys.readouterr().out
-    assert "DEMO" in out
+    assert "Demo" in out
     assert "1" in out and "2" in out
 
 
@@ -91,7 +91,7 @@ def test_render_events_box_to_stdout(capsys):
     output.render_events([_event("2026-06-22T12:21:54Z")], order="desc")
     captured = capsys.readouterr()
     # The box (human data view) goes to STDOUT; the title carries count, direction and date.
-    assert "EVENTS" in captured.out
+    assert "events" in captured.out
     assert "newest first" in captured.out
     assert "2026-06-22" in captured.out
     assert captured.err == ""
@@ -208,7 +208,7 @@ def test_render_sessions_box_has_no_scores(capsys):
     _wide_stdout()
     output.render_sessions([_sample_eval()])
     out = capsys.readouterr().out
-    assert "SESSIONS" in out and "newest first" in out and "2026-06-22" in out
+    assert "sessions" in out and "newest first" in out and "2026-06-22" in out
     assert "agent-codegen" in out and "done" in out
     assert "12:56:31" in out and "sess-20260615-fcf97e01" in out
     assert "coherence" not in out and "scores" not in out  # scores moved to evals
@@ -219,7 +219,7 @@ def test_render_evals_box_has_scores(capsys):
     _wide_stdout()
     output.render_evals([_sample_eval()])
     out = capsys.readouterr().out
-    assert "EVALS" in out and "scores" in out and "coherence" in out
+    assert "evals" in out and "scores" in out and "coherence" in out
     assert "agent-codegen" in out and "sess-20260615-fcf97e01" in out
     output.configure(no_color=True, quiet=False)
 
@@ -296,7 +296,7 @@ def test_render_sessions_expanded_lists_full_roster(capsys):
     assert "agent-testgen" in out and "9 ev" in out
     assert "●" not in out                                  # uniform: no special "root" marker
     assert "├" in out and "└" in out                       # uniform tree glyphs, └ closes the list
-    assert "SESSIONS · 1" in out                           # count = sessions, not rows
+    assert "sessions · 1" in out                           # panel count = sessions, not rows
     output.configure(no_color=True, quiet=False)
 
 
@@ -403,7 +403,7 @@ def test_render_errors_box(capsys):
     _wide_stdout()
     output.render_errors([_errevent("error", "RateLimitError: upstream timed out")])
     out = capsys.readouterr().out
-    assert "ERRORS" in out and "newest first" in out
+    assert "errors" in out and "newest first" in out
     assert "agent-orderbot" in out and "sess-20260622-4b90b240" in out
     assert "RateLimitError: upstream timed out" in out          # server-computed summary field
     assert "17:51:34" in out
@@ -479,7 +479,7 @@ def test_render_org_perms(capsys):
     out = capsys.readouterr().out
     # header leads with the org name + slug + role; the count moved into the box title
     assert "Globex Corp" in out and "globex" in out and "role admin" in out
-    assert "PERMISSIONS · 5 · Globex Corp" in out
+    assert "permissions · 5 · Globex Corp" in out
     assert "dashboards" in out and "keys" in out and "agent" in out
     output.configure(no_color=True, quiet=False)
 
@@ -659,7 +659,7 @@ def test_render_users_box_and_footer(capsys):
     output.users_footer(users)
     cap = capsys.readouterr()
     out, err = cap.out, cap.err
-    assert "USERS · 3" in out
+    assert "users · 3" in out
     for c in ("email", "access", "perms", "joined", "status"):
         assert c in out
     assert "root@test" in out and "admin" in out and "06-25" in out
@@ -695,7 +695,7 @@ def test_render_user_show_card_and_perms(capsys):
     out = capsys.readouterr().out  # show is a read view → stdout
     assert "user" in out and "dev@test" in out and "protected" in out
     assert "access admin" in out and "3 permissions" in out and "active" in out
-    assert "PERMISSIONS · 3" in out and "keys" in out and "dashboards" in out
+    assert "permissions · 3" in out and "keys" in out and "dashboards" in out
     output.configure(no_color=True, quiet=False)
 
 
@@ -706,7 +706,7 @@ def test_render_user_created_green_card(capsys):
     err = capsys.readouterr().err  # write result → stderr chrome
     assert "user created" in err and "new@test" in err
     assert "access read-only" in err and "2 permissions" in err and "active" in err
-    assert "PERMISSIONS · 2 · read-only" in err  # suffix shows the set
+    assert "permissions · 2 · read-only" in err  # suffix shows the set
     output.configure(no_color=True, quiet=False)
 
 
@@ -718,7 +718,7 @@ def test_render_user_updated_diff(capsys):
     err = capsys.readouterr().err
     assert "permissions updated · dev@test" in err
     assert "now 3" in err and "+1 added" in err and "−1 removed" in err
-    assert "PERMISSIONS · 3" in err          # NEW set size (struck removal not counted)
+    assert "permissions · 3" in err          # NEW set size (struck removal not counted)
     assert "+create" in err and "-write" in err  # added chip / removed ghost (no-color prefixes)
     assert "unchanged" in err                # legend
     output.configure(no_color=True, quiet=False)
@@ -1146,7 +1146,7 @@ def test_render_settings_box(capsys):
     output.render_settings(rows)
     cap = capsys.readouterr()
     out, err = cap.out, cap.err
-    assert "SETTINGS · 3" in out
+    assert "settings · 3" in out
     for c in ("key", "value", "type", "updated"):
         assert c in out
     assert "session_ttl_secs" in out and "86400" in out and "integer" in out
@@ -1231,7 +1231,7 @@ def test_render_incidents_box_and_footer(capsys):
     output.incidents_footer(incs)
     cap = capsys.readouterr()
     out, err = cap.out, cap.err
-    assert "ISSUES · 3" in out
+    assert "issues · 3" in out
     for c in ("id", "alert", "severity", "state", "opened", "assignees"):
         assert c in out
     assert "1f5803aaaaaabbbbcccc000000009826" in out
@@ -1399,7 +1399,7 @@ def test_render_agent_health_configured(capsys):
     _wide_stdout()
     output.render_agent_health(configured=True, default_model="claude-x", model_count=3)
     out = capsys.readouterr().out  # data view → stdout
-    assert "ASSISTANT" in out and "configured" in out
+    assert "assistant" in out and "configured" in out
     assert "default model claude-x" in out and "3 models available" in out
     output.configure(no_color=True, quiet=False)
 
@@ -1417,7 +1417,7 @@ def test_render_agent_models_marks_default(capsys):
     _wide_stdout()
     output.render_agent_models(["m-default", "m-fast"], default_model="m-default")
     out = capsys.readouterr().out
-    assert "MODELS · 2" in out and "m-default" in out and "m-fast" in out and "default" in out
+    assert "models · 2" in out and "m-default" in out and "m-fast" in out and "default" in out
     output.configure(no_color=True, quiet=False)
 
 
@@ -1425,7 +1425,7 @@ def test_render_agent_models_empty(capsys):
     _wide_stdout()
     output.render_agent_models([], default_model=None)
     out = capsys.readouterr().out
-    assert "MODELS · 0" in out and "no models reported" in out
+    assert "models · 0" in out and "no models reported" in out
     output.configure(no_color=True, quiet=False)
 
 
@@ -1438,7 +1438,7 @@ def test_render_agent_chats_box(capsys):
     output.render_agent_chats(chats)
     cap = capsys.readouterr()
     out, err = cap.out, cap.err
-    assert "CHATS · 2" in out
+    assert "chats · 2" in out
     for c in ("chat-id", "title", "messages", "updated"):
         assert c in out
     assert "older" in out and "newer" in out
@@ -1642,7 +1642,7 @@ def pv(pid, version):
     _wide_stdout()
     output.render_policies([pv("a", 1), pv("b", 2), pv("b", 1)])
     out = capsys.readouterr().out
-    assert "POLICIES · 2 · 3 versions" in out
+    assert "policies · 2 · 3 versions" in out
     # newest version of each policy first, rather than server order
     b_rows = [ln for ln in out.splitlines() if "b" in ln and "v" in ln
               and ("v1" in ln or "v2" in ln)]
@@ -1657,7 +1657,7 @@ def test_policy_list_omits_the_caption_when_each_policy_has_one_version(capsys):
                                           source=None, created_at="", created_by=None,
                                           disabled=False, archived=False)])
     out = capsys.readouterr().out
-    assert "POLICIES · 1" in out and "versions" not in out
+    assert "policies · 1" in out and "versions" not in out
 
 
 # ─────────────────────────────────────────────────────────────────────────────
diff --git a/fp-cloud-cli/tests/test_screen_language.py b/fp-cloud-cli/tests/test_screen_language.py
index 2f5c4fff8..e0b16355d 100644
--- a/fp-cloud-cli/tests/test_screen_language.py
+++ b/fp-cloud-cli/tests/test_screen_language.py
@@ -1,41 +1,70 @@
 import json
 from io import StringIO
 
+import pytest
 from rich.console import Console
 
 from fp_cli import output, theme
 from fp_cli.models import AgentEvent
 
+BOXES = "╭╮╰╯┌┐└┘─━│┃"
 
-def test_two_accent_palette():
-    assert theme.ACCENT == "#66d1b5"
-    assert theme.PINK == "#e4587d"
-    assert {theme.SUCCESS, theme.ERROR, theme.AMBER, theme.BLUE, theme.SCORE_HIGH} <= {theme.ACCENT, theme.PINK}
+
+def test_palette():
+    assert theme.ACCENT == "#9d7bff"
+    assert theme.SUCCESS == "#5dcaa5"
+    assert theme.AMBER == "#ef9f27"
+    assert theme.ERROR == "#e2564a"
+    assert theme.BLUE == "#6b86d8"
+    assert theme.PINK == "#d4537e"
+    # The states that have to read differently are different colours.
+    assert len({theme.PERM_READ, theme.PERM_WRITE, theme.PERM_ACTION, theme.PERM_DANGER}) == 4
 
 
 def test_permission_risk_order_is_independent_of_shared_colours():
-    assert theme.PERM_WRITE == theme.PERM_ACTION == theme.PERM_DANGER
     assert sorted(["delete", "run", "write", "read"], key=output._perm_act_key) == [
         "read", "write", "run", "delete",
     ]
 
 
-def test_open_table_and_header(capsys):
+def test_boxed_table_and_no_header(capsys):
     output.configure(no_color=True)
     output.print_table(["Id", "URL"], [["run-001", "https://cloud.example.test"]], title="Resources")
     text = capsys.readouterr().out
-    assert "failproof ai v" in text
-    assert "RESOURCES" in text
-    assert not any(c in text for c in "╭╮╰╯┌┐└┘─━│┃")
+    assert "failproof ai v" not in text
+    assert "Resources" in text and "RESOURCES" not in text
+    assert any(c in text for c in BOXES)
 
 
-def test_legacy_panels_use_open_screen(capsys):
+def test_panels_have_rounded_boxes_and_lowercase_titles(capsys):
     output.configure(no_color=True)
     output.render_events([AgentEvent(id=1, session_id="run-001", agent_id="agent", event_type="tool_use", ts="2026-10-13T00:00:00Z")])
     text = capsys.readouterr().out
-    assert "EVENTS" in text
-    assert "failproof ai v" in text
-    assert not any(c in text for c in "╭╮╰╯┌┐└┘─━│┃")
+    assert "╭─ events" in text and "╰" in text
+    assert "EVENTS" not in text
+    assert "failproof ai v" not in text
+
+
+def test_errors_are_a_red_box(capsys):
+    output.configure(no_color=True)
+    output._error_box("that failed", "try fp login")
+    text = capsys.readouterr().err
+    assert "╭─ error" in text and "✗" in text
+    assert "that failed" in text and "try fp login" in text
+
+
+@pytest.mark.parametrize("say", [output.error, output.warn, output.success])
+def test_a_message_is_shown_as_written_whatever_is_in_it(capsys, say):
+    # Rich would read these as markup: one raises, the other disappears.
+    output.configure(no_color=True)
+    say("from the server: [/] and [red]")
+    assert "from the server: [/] and [red]" in capsys.readouterr().err
+
+
+def test_a_table_title_is_shown_as_written(capsys):
+    output.configure(no_color=True)
+    output.print_table(["a"], [["1"]], title="from the server: [/] and [red]")
+    assert "fromtheserver:[/]and[red]" in "".join(capsys.readouterr().out.split())  # it wraps to the table
 
 
 def test_narrow_ids_and_urls_are_not_cut(capsys):
@@ -49,6 +78,36 @@ def test_narrow_ids_and_urls_are_not_cut(capsys):
     assert "…" not in compact
 
 
+@pytest.mark.parametrize("field", ["session_id", "agent_id"])
+def test_a_value_in_a_boxed_table_is_never_cut(field):
+    capture = StringIO()
+    output.configure(no_color=True)
+    output._stdout = Console(file=capture, width=70, no_color=True)
+    long_value = "sess-20260615-" + "abcdef0123456789" * 3
+    event = {"session_id": "run-001", "agent_id": "agent", field: long_value}
+    output.render_events([AgentEvent(id=1, event_type="tool_use", ts="2026-10-13T00:00:00Z", **event)])
+    text = capture.getvalue()
+    assert any(c in text for c in BOXES)
+    assert "…" not in text
+    # Flattened, a wrapped value reads whole once the short cell beside its first row is gone.
+    assert long_value in "".join(c for c in text if c not in BOXES and not c.isspace()).replace("run-001", "")
+
+
+@pytest.mark.parametrize("render", [output.render_events, output.render_errors])
+def test_short_values_stay_on_one_line_when_a_long_one_wraps(render):
+    capture = StringIO()
+    output.configure(no_color=True)
+    output._stdout = Console(file=capture, width=100, no_color=True)
+    long_id = "sess-20260615-" + "abcdef0123456789" * 4
+    # Two days, so the time column carries the date as well, at its widest.
+    render([
+        AgentEvent(id=1, session_id=long_id, agent_id="agent", event_type="tool_use", ts="2026-10-13T09:41:07Z"),
+        AgentEvent(id=2, session_id=long_id, agent_id="agent", event_type="tool_use", ts="2026-10-12T17:51:34Z"),
+    ])
+    text = capture.getvalue()
+    assert "10-13 09:41:07" in text and "10-12 17:51:34" in text, text
+
+
 def test_json_bytes_unchanged(capsys):
     output.configure(json=True)
     data = {"session_id": "run-001", "scores": {"quality": 0.9}}
@@ -56,25 +115,21 @@ def test_json_bytes_unchanged(capsys):
     assert capsys.readouterr().out == json.dumps(data, indent=2, ensure_ascii=False) + "\n"
 
 
-def test_generated_help_has_no_boxes(logged_in, runner):
+def test_generated_help_has_boxes(logged_in, runner):
     from fp_cli.app import app
     result = runner.invoke(app, ["evaluators", "create", "--help"])
     assert result.exit_code == 0
     assert "Code:" in result.stdout and "Judge:" in result.stdout and "Jev:" in result.stdout
-    assert not any(c in result.stdout for c in "╭╮╰╯┌┐└┘─━│┃")
-
-
-def test_shared_key_value_labels_are_grey():
-    capture = StringIO()
-    output.configure()
-    output._stdout = Console(file=capture, width=140, force_terminal=True, color_system="truecolor")
-    output.print_table(["Field", "Value"], [["enabled", "true"]])
-    assert "\x1b[38;2;118;127;139menabled" in capture.getvalue()
+    assert any(c in result.stdout for c in BOXES)
 
 
-def test_help_typeable_commands_are_pink():
+def test_help_has_the_brand_mark_and_old_command_colours():
     capture = StringIO()
     output.configure()
     output._stdout = Console(file=capture, width=140, force_terminal=True, color_system="truecolor")
     output.render_top_level_help()
-    assert "\x1b[38;2;228;88;125mfp login" in capture.getvalue()
+    text = capture.getvalue()
+    assert "◆ fp" in text
+    assert "failproof ai v" not in text
+    assert "\x1b[38;2;157;123;255mfp login" in text  # theme.ACCENT
+    assert "\x1b[38;2;228;88;125m" not in text        # the redesign's pink
diff --git a/fp-cloud-cli/tests/test_whoami.py b/fp-cloud-cli/tests/test_whoami.py
index c3c47879f..b03e354fc 100644
--- a/fp-cloud-cli/tests/test_whoami.py
+++ b/fp-cloud-cli/tests/test_whoami.py
@@ -66,7 +66,7 @@ def test_whoami_human_renders_header_and_panels(logged_in, runner):
     assert "62230791-4811-4f04-b388-ae57bdcb422e" in out
     assert "instance admin" in out
     # permissions panel
-    assert "PERMISSIONS" in out
+    assert "permissions" in out
     assert "dashboards" in out and "read" in out and "write" in out and "delete" in out
     # orgs panel + switch hint to the non-active org
     assert "your orgs" in out

From 23e5863a94fa0d470adccaf5100b9b764eb8ff49 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Thu, 5 Nov 2026 15:23:26 +0530
Subject: [PATCH 13/15] [failproofai-feat-failproofai-cloud-login] Say enter
 and SSO in the login hints
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The owner asked for the word `enter` rather than the `⏎` symbol, and just `SSO` on the email line:
`enter send a code · tab SSO · esc cancel`. The symbol goes everywhere it was shown, so one login
doesn't mix the two: the screen where a link ended, both org pickers and `fp orgs switch --help`.

Only a hint with separators lights up its keys now, or the "enter" in "enter the 6-digit code" would
read as a key.

`fp-login.sh` also looks for the sign-in email's new wording from FailproofAI/agenteye#1277, so the
stack under test needs that head.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 __tests__/e2e/layout/fp-login.sh           | 14 +++++++-------
 fp-cloud-cli/fp_cli/commands/auth_cmds.py  |  2 +-
 fp-cloud-cli/fp_cli/commands/orgs_cmds.py  |  2 +-
 fp-cloud-cli/fp_cli/output.py              | 13 +++++++------
 fp-cloud-cli/fp_cli/select.py              |  2 +-
 fp-cloud-cli/tests/test_browser_login.py   |  2 +-
 fp-cloud-cli/tests/test_screen_language.py |  6 ++++++
 7 files changed, 24 insertions(+), 17 deletions(-)

diff --git a/__tests__/e2e/layout/fp-login.sh b/__tests__/e2e/layout/fp-login.sh
index a16323aa0..9d8b1c0ed 100755
--- a/__tests__/e2e/layout/fp-login.sh
+++ b/__tests__/e2e/layout/fp-login.sh
@@ -167,7 +167,7 @@ fp_plain() { # <base-url> <fp args...>, no terminal
 saved() { python3 -c "import json;print(json.load(open('$FP_DIR/cli-auth.json')).get('$1') or '')" 2>/dev/null; }
 reset_fp() { rm -rf "$FP_DIR"; }
 
-EMAIL_STEP=wait:tab\ browser\ or\ SSO
+EMAIL_STEP=wait:tab\ SSO
 
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 0 — preconditions"
@@ -199,7 +199,7 @@ person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
 eq "approve answered 200" "$(cat "$OUT/status")" "200"
 T=$(wait_done first)
 eq "fp exited 0" "$(cat "$OUT/first.rc")" "0"
-has "it opens on the email, offering the browser" "$T" "tab browser or SSO"
+has "it opens on the email, offering the browser" "$T" "tab SSO"
 has "…and saying enter sends a code" "$T" "send a code"
 has "no display here, so it says the link works anywhere" "$T" "open this link on any device"
 has "it waited with a countdown" "$T" "waiting for you to authorize"
@@ -230,7 +230,7 @@ head1 "PHASE 2 — signed in already: no asking; --force asks again"
 run_fp again "wait:$ONE" "$DASH" -- login
 T=$(wait_done again)
 eq "fp exited 0" "$(cat "$OUT/again.rc")" "0"
-hasnt "no asking someone already signed in" "$T" "tab browser or SSO"
+hasnt "no asking someone already signed in" "$T" "tab SSO"
 run_fp force "$EMAIL_STEP,key:esc" "$DASH" -- login --force
 T=$(wait_done force)
 eq "--force asks, and esc leaves it" "$(cat "$OUT/force.rc")" "0"
@@ -278,10 +278,10 @@ run_fp flag_mail "wait:enter the 6-digit code,typefile:$OUT/code,key:enter" "$DA
 CODE=$(otp_code "$MAILED"); echo "$CODE" > "$OUT/code"
 T=$(wait_done flag_mail)
 eq "--email signed in" "$(saved email)" "$MAILED"
-hasnt "--email skips the asking" "$T" "tab browser or SSO"
+hasnt "--email skips the asking" "$T" "tab SSO"
 reset_fp
 OUTPUT=$(env -u FP_TOKEN -u FP_API_KEY NO_COLOR=1 FP_ANALYTICS_DISABLED=1 FP_HOME="$FP_DIR" "$FP" --base-url "$DASH" login </dev/null 2>&1)
-hasnt "no terminal: no offer of a browser" "$OUTPUT" "tab browser or SSO"
+hasnt "no terminal: no offer of a browser" "$OUTPUT" "tab SSO"
 hasnt "no terminal: no link" "$OUTPUT" "/cli/authorize"
 
 # ═════════════════════════════════════════════════════════════════════════════
@@ -591,7 +591,7 @@ CLAIMED_TOKEN=$(echo "$C" | jqp '["session_token"]')
 wait_sign_in_mail "$FORGED"
 eq "…and matching forged addresses can't silence the email" "$(sign_in_mails "$FORGED")" "1"
 M=$(sign_in_mail_text "$FORGED")
-has "…naming the machine" "$M" "fp on e2e-box signed in"
+has "…naming the machine" "$M" "fp-cloud-cli on e2e-box signed in"
 has "…and what that terminal now has" "$M" "in all your organizations"
 hasnt "…not claiming to know where it started" "$M" "started from"
 hasnt "…and carrying no secret" "$M" "$CLAIMED_TOKEN"
@@ -655,7 +655,7 @@ if [ -n "$TRUSTED_DASH" ]; then
   eq "…and fp still finishes: a warning, not a block" "$(cat "$OUT/elsewhere.rc")" "0"
   wait_sign_in_mail "$LOCAL"
   eq "…with one email" "$(sign_in_mails "$LOCAL")" "1"
-  has "…naming the machine" "$(sign_in_mail_text "$LOCAL")" "fp on $(hostname) signed in"
+  has "…naming the machine" "$(sign_in_mail_text "$LOCAL")" "fp-cloud-cli on $(hostname) signed in"
   PERSON_DASH=$DASH
 else
   printf '  \033[33mSKIP\033[0m the different-network warning (set TRUSTED_DASH)\n'
diff --git a/fp-cloud-cli/fp_cli/commands/auth_cmds.py b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
index 5607c759b..ecc596141 100644
--- a/fp-cloud-cli/fp_cli/commands/auth_cmds.py
+++ b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
@@ -222,7 +222,7 @@ def _email_code_in_box(state: AppState, base: str, box: selectmod.LoginBox, emai
         email = email_opt
         box.note("email", email)
     else:
-        keys = "⏎ send a code · tab browser or SSO · esc cancel" if tab else "⏎ send a code · esc cancel"
+        keys = "enter send a code · tab SSO · esc cancel" if tab else "enter send a code · esc cancel"
         email = box.text_step("email", helper=keys, validate=_looks_like_email,
                               error_msg="that doesn't look like an email", value=typed, tab=tab)
     # send the code
diff --git a/fp-cloud-cli/fp_cli/commands/orgs_cmds.py b/fp-cloud-cli/fp_cli/commands/orgs_cmds.py
index a994c4a4a..7d2f927d0 100644
--- a/fp-cloud-cli/fp_cli/commands/orgs_cmds.py
+++ b/fp-cloud-cli/fp_cli/commands/orgs_cmds.py
@@ -227,7 +227,7 @@ def org_switch(
     """Switch the active org/tenant — pass a slug, or omit it to pick one interactively.
 
     `fp orgs switch acme` switches straight to `acme`. `fp orgs switch` with no slug
-    opens an arrow-key picker (↑↓ to move, ⏎ to select, esc to cancel) starting on your current
+    opens an arrow-key picker (↑↓ to move, enter to select, esc to cancel) starting on your current
     org; if you belong to exactly one org there's nothing to switch to. Either way the result is
     a boxed `switched org` card, and the choice is persisted to
     `~/.failproofai/fpcli/cli-auth.json` so later
diff --git a/fp-cloud-cli/fp_cli/output.py b/fp-cloud-cli/fp_cli/output.py
index 77610496c..6e88552df 100644
--- a/fp-cloud-cli/fp_cli/output.py
+++ b/fp-cloud-cli/fp_cli/output.py
@@ -333,7 +333,7 @@ def login_inset(slugs: Sequence[str], idx: int):
         table.add_row(ptr, name)
     inset = Panel(table, box=ROUNDED, border_style=theme.FAINT, style=f"on {theme.INSET_BG}",
                   padding=(0, 1), expand=False)
-    hint = Text("↑↓ move · ⏎ select · esc cancel", style=theme.FAINT)
+    hint = Text("↑↓ move · enter select · esc cancel", style=theme.FAINT)
     return Group(title, inset, hint)
 
 
@@ -344,9 +344,10 @@ def print_unwrapped(text: str) -> None:
 
 
 def _login_keys(text: str) -> Text:
-    """A key hint, with the keys themselves standing out: ``⏎ send a code · esc cancel``."""
+    """A key hint, with the keys themselves standing out: ``enter send a code · esc cancel``."""
     hint = Text(text, style=theme.TEXT_DIM)
-    hint.highlight_regex(r"⏎|\btab\b|\besc\b", style=theme.TEXT)
+    if " · " in text:  # "enter the 6-digit code" is an instruction, and its "enter" is no key
+        hint.highlight_regex(r"\b(?:enter|tab|esc)\b", style=theme.TEXT)
     return hint
 
 
@@ -1105,14 +1106,14 @@ def render_org_perms(*, slug: str, role: str, permissions: Sequence[str],
 # The picker frame and the switched card share the same rounded Panel shell as every other
 # boxed view (only the border colour + contents differ), so they read as one system.
 
-_PICKER_FOOTER = "↑↓ move · ⏎ select · esc cancel"
+_PICKER_FOOTER = "↑↓ move · enter select · esc cancel"
 
 
 def org_picker_frame(orgs: Sequence[dict], idx: int):
     """One frame of the interactive ``orgs switch`` picker (a renderable, redrawn in place by the
     caller's ``Live``): a rounded ACCENT panel ``switch org · {n} available``; one row per org with
     a ``❯`` pointer (ACCENT) on row ``idx`` — the selected slug bright (TEXT), others dim — and a
-    ``● current`` (SUCCESS) / ``○`` (FAINT) status. Footer ``↑↓ move · ⏎ select · esc cancel`` in
+    ``● current`` (SUCCESS) / ``○`` (FAINT) status. Footer ``↑↓ move · enter select · esc cancel`` in
     the bottom border. NO_COLOR keeps the box, pointer, and ●/○ shapes (colour drops out)."""
     table = Table(box=None, pad_edge=False, show_header=False, padding=(0, 2, 0, 0))
     table.add_column(no_wrap=True)  # pointer
@@ -1132,7 +1133,7 @@ def org_picker_frame(orgs: Sequence[dict], idx: int):
     panel = Panel(table, box=ROUNDED, border_style=theme.ACCENT, title=title, title_align="left",
                   padding=(0, 1), expand=False)
     # The key hint rides as a FAINT line just beneath the panel (always fits — no border
-    # truncation of the wide ⏎/arrow glyphs), aligned under the box.
+    # truncation of the wide arrow glyphs), aligned under the box.
     footer = Text("  " + _PICKER_FOOTER, style=theme.FAINT)
     return Group(Padding(panel, (0, 0, 0, 2)), footer)
 
diff --git a/fp-cloud-cli/fp_cli/select.py b/fp-cloud-cli/fp_cli/select.py
index 0b41e984e..f4a0245ad 100644
--- a/fp-cloud-cli/fp_cli/select.py
+++ b/fp-cloud-cli/fp_cli/select.py
@@ -345,7 +345,7 @@ def wait_key(self, seconds: float) -> Optional[str]:
     def link_ended(self, message: str) -> None:
         """A link that can't be used any more, inside the box. Returns on Enter, for a new link.
         Tab raises ``SwitchSignIn``; Esc and Ctrl-C raise ``LoginCancelled``."""
-        self._draw(failed=(message, "⏎ new link · tab use email · esc cancel"))
+        self._draw(failed=(message, "enter new link · tab use email · esc cancel"))
         while True:
             try:
                 key = _read_key(self._fd)
diff --git a/fp-cloud-cli/tests/test_browser_login.py b/fp-cloud-cli/tests/test_browser_login.py
index ccebfe328..158bb5505 100644
--- a/fp-cloud-cli/tests/test_browser_login.py
+++ b/fp-cloud-cli/tests/test_browser_login.py
@@ -523,7 +523,7 @@ def left(*_a, **_k):
     assert [(label, value, tab) for label, value, tab, _helper in box.asked] == [
         ("email", "", True), ("email", "me@te", True), ("code", "", False),
     ]
-    assert "tab browser or SSO" in box.asked[0][3]
+    assert box.asked[0][3] == "enter send a code · tab SSO · esc cancel"
 
 
 def test_a_browser_link_from_the_email_step_signs_in(approved_link):
diff --git a/fp-cloud-cli/tests/test_screen_language.py b/fp-cloud-cli/tests/test_screen_language.py
index e0b16355d..90b7554eb 100644
--- a/fp-cloud-cli/tests/test_screen_language.py
+++ b/fp-cloud-cli/tests/test_screen_language.py
@@ -67,6 +67,12 @@ def test_a_table_title_is_shown_as_written(capsys):
     assert "fromtheserver:[/]and[red]" in "".join(capsys.readouterr().out.split())  # it wraps to the table
 
 
+def test_only_a_key_hint_lights_up_its_keys():
+    lit = lambda text: [text[span.start:span.end] for span in output._login_keys(text).spans]
+    assert lit("enter send a code · tab SSO · esc cancel") == ["enter", "tab", "esc"]
+    assert lit("  enter the 6-digit code") == []
+
+
 def test_narrow_ids_and_urls_are_not_cut(capsys):
     output.configure(no_color=True)
     output._stdout = Console(width=45, no_color=True)

From 42a6b4e70bc71566515c77c3685347248eb66ed4 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Thu, 5 Nov 2026 16:46:10 +0530
Subject: [PATCH 14/15] [failproofai-feat-failproofai-cloud-login] Start fp
 login on the browser link, with Tab to an emailed code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The owner asked for the link by default. `fp login` on a terminal now opens straight on it, and Tab
goes to the email and back, keeping what was typed and the same link. `--email`, `--json` and
anything without a terminal still use the code.

With the link as the default, failing to get one can't be the end of the login: a rate limit or a
5xx at `start` now drops to the emailed code with a note saying so, as a Cloud without browser login
already did. A failed claim doesn't, because someone approved that link and a code would hide why it
didn't work.

A terminal with no raw mode can't see Tab, so it keeps its prompt, where Enter means the link. Every
interactive login now makes a request at `start`, including one that goes on to use the code.

Esc at the email also left `❯ email ▌` on the cancelled screen, which the emulator caught once that
screen became a place people leave from.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                              |  2 +-
 __tests__/e2e/layout/README.md            |  2 +-
 __tests__/e2e/layout/fp-login.sh          | 74 +++++++++++-----------
 docs/reference/cloud-cli.mdx              |  4 +-
 fp-cloud-cli/CHANGELOG.md                 |  2 +-
 fp-cloud-cli/README.md                    | 14 ++---
 fp-cloud-cli/fp_cli/commands/auth_cmds.py | 47 ++++++++------
 fp-cloud-cli/fp_cli/output.py             |  2 +-
 fp-cloud-cli/fp_cli/select.py             |  1 +
 fp-cloud-cli/tests/test_browser_login.py  | 77 +++++++++++++++++++----
 10 files changed, 144 insertions(+), 81 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4176ca433..7178e44d2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### Features
 
-- `fp login` can sign you in from a browser, as `failproofai config` does: on a terminal it asks for your email, Tab switches to a browser link, and either way you get your own session. New deliberate-run harness: `__tests__/e2e/layout/fp-login.sh`. (#981)
+- `fp login` can sign you in from a browser, as `failproofai config` does: on a terminal it starts on a link, Tab switches to a code by email, and either way you get your own session. New deliberate-run harness: `__tests__/e2e/layout/fp-login.sh`. (#981)
 
 ### Dependencies
 
diff --git a/__tests__/e2e/layout/README.md b/__tests__/e2e/layout/README.md
index d97cffef9..0c95e1586 100644
--- a/__tests__/e2e/layout/README.md
+++ b/__tests__/e2e/layout/README.md
@@ -10,7 +10,7 @@ not depend on — so they are invoked deliberately.
 | `cloud-collector.sh` | an AgentEye stack | real connect against a live server, daemon + collector writing layout-2 paths, decisions reaching ClickHouse, disconnect back to OSS |
 | `systemd-service.sh` | Docker | REAL `systemctl enable --now` as root in a privileged container: service lifecycle, fail-closed, self-heal, reinstall |
 | `cli-login.sh` | an AgentEye stack (dashboard + mailpit + its Postgres), an older Cloud server without `/api/auth/cli/*` routes, Docker, `bun run build` + the release daemon | `config`'s browser login through a real pty in a systemd container: approve, re-login, deny + retry, abandon after approval (no key minted), esc, expiry, revoked saved key, older server, and the person-side refusals (Origin, form posts, no session, start rate limit) |
-| `fp-login.sh` | an AgentEye stack (dashboard + mailpit + its containers), `uv sync` in `fp-cloud-cli`; optionally a Cloud with `config`'s login but not `fp`'s, and a dashboard with `DASHBOARD_TRUSTED_INGRESS=1` | `fp login`'s browser flow through a real pty: approve, the org picker, the email code from the first screen, tab to the link and back, deny + retry, expiry, esc and ctrl-c, an approval nobody collects (no session), a dropped connection, opening the browser, Clouds without it (nothing minted), the network warning and when the email goes out, the person-side refusals, and no secret in any log |
+| `fp-login.sh` | an AgentEye stack (dashboard + mailpit + its containers), `uv sync` in `fp-cloud-cli`; optionally a Cloud with `config`'s login but not `fp`'s, and a dashboard with `DASHBOARD_TRUSTED_INGRESS=1` | `fp login`'s browser flow through a real pty: approve, the org picker, the email code with tab, tab to the email and back, deny + retry, expiry, esc and ctrl-c, an approval nobody collects (no session), a dropped connection, opening the browser, Clouds without it (nothing minted), the network warning and when the email goes out, the person-side refusals, and no secret in any log |
 
 `systemd-service.sh` exists because the service half cannot be tested on a
 developer machine without a password prompt, and a container gives real systemd
diff --git a/__tests__/e2e/layout/fp-login.sh b/__tests__/e2e/layout/fp-login.sh
index 9d8b1c0ed..a0dd55a93 100755
--- a/__tests__/e2e/layout/fp-login.sh
+++ b/__tests__/e2e/layout/fp-login.sh
@@ -168,6 +168,7 @@ saved() { python3 -c "import json;print(json.load(open('$FP_DIR/cli-auth.json'))
 reset_fp() { rm -rf "$FP_DIR"; }
 
 EMAIL_STEP=wait:tab\ SSO
+TO_EMAIL=wait:waiting\ for\ you,key:tab,$EMAIL_STEP
 
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 0 — preconditions"
@@ -183,7 +184,7 @@ ONE_SESSION=$(sign_in "$ONE")
 
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 1 — browser login: the link, the approval, and the terminal finishes alone"
-run_fp first "$EMAIL_STEP,key:tab,url" "$DASH" -- login
+run_fp first "url" "$DASH" -- login
 URL=$(wait_url first)
 has "fp printed the authorize link" "$URL" "$DASH/cli/authorize?r="
 LINK=$(link_token "$URL")
@@ -199,8 +200,8 @@ person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
 eq "approve answered 200" "$(cat "$OUT/status")" "200"
 T=$(wait_done first)
 eq "fp exited 0" "$(cat "$OUT/first.rc")" "0"
-has "it opens on the email, offering the browser" "$T" "tab SSO"
-has "…and saying enter sends a code" "$T" "send a code"
+has "it starts on the link, offering the email" "$T" "tab use email"
+hasnt "…without asking for an email first" "$T" "send a code"
 has "no display here, so it says the link works anywhere" "$T" "open this link on any device"
 has "it waited with a countdown" "$T" "waiting for you to authorize"
 has "it says it signed in" "$T" "signed in"
@@ -230,8 +231,8 @@ head1 "PHASE 2 — signed in already: no asking; --force asks again"
 run_fp again "wait:$ONE" "$DASH" -- login
 T=$(wait_done again)
 eq "fp exited 0" "$(cat "$OUT/again.rc")" "0"
-hasnt "no asking someone already signed in" "$T" "tab SSO"
-run_fp force "$EMAIL_STEP,key:esc" "$DASH" -- login --force
+hasnt "no asking someone already signed in" "$T" "tab use email"
+run_fp force "wait:waiting for you,key:esc" "$DASH" -- login --force
 T=$(wait_done force)
 eq "--force asks, and esc leaves it" "$(cat "$OUT/force.rc")" "0"
 has "…saying nothing changed" "$T" "cancelled"
@@ -243,7 +244,7 @@ TWO_SESSION=$(sign_in "$TWO")
 new_org "$TWO_SESSION" "fp-a-$STAMP" >/dev/null
 new_org "$TWO_SESSION" "fp-b-$STAMP" >/dev/null
 reset_fp
-run_fp pick "$EMAIL_STEP,key:tab,url,wait:choose your org,key:down,key:enter" "$DASH" -- login
+run_fp pick "url,wait:choose your org,key:down,key:enter" "$DASH" -- login
 LINK=$(link_token "$(wait_url pick)")
 person "$TWO_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
 T=$(wait_done pick)
@@ -251,7 +252,7 @@ eq "fp exited 0" "$(cat "$OUT/pick.rc")" "0"
 PICKED=$(saved org)
 [ "$PICKED" = "fp-a-$STAMP" ] || [ "$PICKED" = "fp-b-$STAMP" ] && ok "the org picked in the terminal was saved" || bad "the org was saved" "$PICKED"
 reset_fp
-run_fp flag "$EMAIL_STEP,key:tab,url" "$DASH" -- login --org "fp-b-$STAMP"
+run_fp flag "url" "$DASH" -- login --org "fp-b-$STAMP"
 LINK=$(link_token "$(wait_url flag)")
 person "$TWO_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
 T=$(wait_done flag)
@@ -259,17 +260,17 @@ eq "--org skips the picker" "$(saved org)" "fp-b-$STAMP"
 hasnt "…no picker shown" "$T" "choose your org"
 
 # ═════════════════════════════════════════════════════════════════════════════
-head1 "PHASE 4 — the email code still works, from the first screen and with --email"
+head1 "PHASE 4 — the email code still works, with tab and with --email"
 reset_fp
 MAILED="fp-mail-$STAMP@example.test"
 curl -s -X DELETE "$MAILPIT/api/v1/search?query=to:$MAILED" >/dev/null || true
 rm -f "$OUT/code"
-run_fp menu_mail "$EMAIL_STEP,type:$MAILED,key:enter,wait:enter the 6-digit code,typefile:$OUT/code,key:enter" "$DASH" -- login
+run_fp menu_mail "$TO_EMAIL,type:$MAILED,key:enter,wait:enter the 6-digit code,typefile:$OUT/code,key:enter" "$DASH" -- login
 CODE=$(otp_code "$MAILED"); echo "$CODE" > "$OUT/code"
 T=$(wait_done menu_mail)
 eq "fp exited 0" "$(cat "$OUT/menu_mail.rc")" "0"
 eq "the emailed code signed in" "$(saved email)" "$MAILED"
-hasnt "no link was offered" "$T" "/cli/authorize"
+has "…after starting on the link" "$T" "/cli/authorize"
 eq "the email code path sends no sign-in alert" "$(sign_in_mails "$MAILED")" "0"
 reset_fp
 curl -s -X DELETE "$MAILPIT/api/v1/search?query=to:$MAILED" >/dev/null || true
@@ -279,6 +280,7 @@ CODE=$(otp_code "$MAILED"); echo "$CODE" > "$OUT/code"
 T=$(wait_done flag_mail)
 eq "--email signed in" "$(saved email)" "$MAILED"
 hasnt "--email skips the asking" "$T" "tab SSO"
+hasnt "…and never asks for a link" "$T" "/cli/authorize"
 reset_fp
 OUTPUT=$(env -u FP_TOKEN -u FP_API_KEY NO_COLOR=1 FP_ANALYTICS_DISABLED=1 FP_HOME="$FP_DIR" "$FP" --base-url "$DASH" login </dev/null 2>&1)
 hasnt "no terminal: no offer of a browser" "$OUTPUT" "tab SSO"
@@ -287,7 +289,7 @@ hasnt "no terminal: no link" "$OUTPUT" "/cli/authorize"
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 5 — not authorized: enter for a new link, tab back to the email, esc to leave"
 reset_fp
-run_fp deny "$EMAIL_STEP,key:tab,url,wait:not authorized,key:enter,url" "$DASH" -- login
+run_fp deny "url,wait:not authorized,key:enter,url" "$DASH" -- login
 LINK1=$(link_token "$(wait_url deny)")
 person "$ONE_SESSION" deny "{\"link_token\":\"$LINK1\"}" >/dev/null
 eq "deny answered 200" "$(cat "$OUT/status")" "200"
@@ -300,7 +302,7 @@ eq "signed in" "$(saved email)" "$ONE"
 eq "the denied request stays denied" "$(request_status "$LINK1")" "denied"
 reset_fp
 BEFORE=$(sessions_of "$ONE")
-run_fp back "$EMAIL_STEP,key:tab,url,wait:not authorized,key:tab,$EMAIL_STEP,key:esc" "$DASH" -- login
+run_fp back "url,wait:not authorized,key:tab,$EMAIL_STEP,key:esc" "$DASH" -- login
 LINK=$(link_token "$(wait_url back)")
 person "$ONE_SESSION" deny "{\"link_token\":\"$LINK\"}" >/dev/null
 T=$(wait_done back)
@@ -308,31 +310,31 @@ eq "tab went back to the email, and esc left" "$(cat "$OUT/back.rc")" "0"
 has "…calmly" "$T" "cancelled"
 eq "…with nothing saved" "$(saved session_token)" ""
 reset_fp
-run_fp leave "$EMAIL_STEP,key:tab,url,wait:not authorized,key:esc" "$DASH" -- login
+run_fp leave "url,wait:not authorized,key:esc" "$DASH" -- login
 LINK=$(link_token "$(wait_url leave)")
 person "$ONE_SESSION" deny "{\"link_token\":\"$LINK\"}" >/dev/null
 T=$(wait_done leave)
 eq "esc at not authorized leaves, like everywhere else" "$(cat "$OUT/leave.rc")" "0"
 has "…calmly" "$T" "cancelled"
 
-# Tab goes to the link and back, and it stays the same link: another each time would spend the
+# Tab goes to the email and back, and it stays the same link: another each time would spend the
 # rate limit, leave rows behind, and open another browser tab.
 reset_fp
 ROWS=$(sql "select count(*) from cli_login_requests")
-run_fp toggle "$EMAIL_STEP,type:half@,key:tab,url,wait:waiting for you,key:tab,wait:half@,key:tab,url,wait:waiting for you" "$DASH" -- login
+run_fp toggle "url,$TO_EMAIL,type:half@,key:tab,url,wait:waiting for you,key:tab,wait:half@,key:tab,url,wait:waiting for you" "$DASH" -- login
 LINK=$(link_token "$(wait_url toggle)")
-until [ "$(grep -ao 'cli/authorize?r=' "$OUT/toggle.log" | wc -l)" = 2 ]; do sleep 0.1; done
+until [ "$(grep -ao 'cli/authorize?r=' "$OUT/toggle.log" | wc -l)" = 3 ]; do sleep 0.1; done
 person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
 T=$(wait_done toggle)
 eq "tab there and back still signs in" "$(cat "$OUT/toggle.rc")" "0"
 has "…what was typed came back" "$(transcript toggle | sed -n '/waiting for you/,$p')" "half@"
-eq "…the same link both times" "$(grep -aoP 'authorize\?r=\K[0-9a-f]{64}' "$OUT/toggle.log" | sort -u | wc -l)" "1"
+eq "…the same link every time" "$(grep -aoP 'authorize\?r=\K[0-9a-f]{64}' "$OUT/toggle.log" | sort -u | wc -l)" "1"
 eq "…one request on the server" "$(sql "select count(*) from cli_login_requests")" "$((ROWS + 1))"
 eq "…signed in" "$(saved email)" "$ONE"
 
 # Approved while the person was back at the email: coming back finds it.
 reset_fp
-run_fp later "$EMAIL_STEP,key:tab,url,wait:waiting for you,key:tab,wait:send a code,sleep:4,key:tab" "$DASH" -- login
+run_fp later "url,wait:waiting for you,key:tab,wait:send a code,sleep:4,key:tab" "$DASH" -- login
 LINK=$(link_token "$(wait_url later)")
 until transcript later | sed -n '/waiting for you/,$p' | grep -q 'send a code'; do sleep 0.1; done
 person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
@@ -346,7 +348,7 @@ eq "…the request spent" "$(request_status "$LINK")" "claimed"
 # Left at the email with the approval unclaimed: nobody collects it, so it makes nothing.
 reset_fp
 BEFORE=$(sessions_of "$ONE")
-run_fp nocollect "$EMAIL_STEP,key:tab,url,wait:waiting for you,key:tab,wait:send a code,sleep:3,key:esc" "$DASH" -- login
+run_fp nocollect "url,wait:waiting for you,key:tab,wait:send a code,sleep:3,key:esc" "$DASH" -- login
 LINK=$(link_token "$(wait_url nocollect)")
 until transcript nocollect | sed -n '/waiting for you/,$p' | grep -q 'send a code'; do sleep 0.1; done
 person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
@@ -359,7 +361,7 @@ eq "…and no session" "$(sessions_of "$ONE")" "$BEFORE"
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 6 — a link that expires offers a fresh one"
 reset_fp
-run_fp expire "$EMAIL_STEP,key:tab,url,wait:that link expired,key:enter,url" "$DASH" -- login
+run_fp expire "url,wait:that link expired,key:enter,url" "$DASH" -- login
 LINK1=$(link_token "$(wait_url expire)")
 sql "update cli_login_requests set expires_at = now() - interval '1 second' where link_token_hash = encode(sha256('$LINK1'::bytea), 'hex')" >/dev/null
 LINK2=$(link_token "$(wait_url expire)")
@@ -372,7 +374,7 @@ eq "the expired link can no longer be approved" "$(cat "$OUT/status")" "410"
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 7 — leaving: esc, ctrl-c, and an approval nobody collects"
 reset_fp
-run_fp esc "$EMAIL_STEP,key:tab,url,wait:waiting for you,key:esc" "$DASH" -- login
+run_fp esc "url,wait:waiting for you,key:esc" "$DASH" -- login
 LINK=$(link_token "$(wait_url esc)")
 T=$(wait_done esc)
 eq "esc while waiting exits 0" "$(cat "$OUT/esc.rc")" "0"
@@ -384,7 +386,7 @@ eq "the abandoned link can still be approved" "$(cat "$OUT/status")" "200"
 sleep 3
 eq "…but no session ever exists: nobody claimed it" "$(sessions_of "$ONE")" "$BEFORE"
 eq "…and it stays unclaimed" "$(request_status "$LINK")" "approved"
-run_fp ctrlc "$EMAIL_STEP,key:tab,url,wait:waiting for you,key:ctrl-c" "$DASH" -- login
+run_fp ctrlc "url,wait:waiting for you,key:ctrl-c" "$DASH" -- login
 wait_url ctrlc >/dev/null
 T=$(wait_done ctrlc)
 eq "ctrl-c while waiting exits 0" "$(cat "$OUT/ctrlc.rc")" "0"
@@ -433,7 +435,7 @@ HELD_PID=$!
 for _ in $(seq 1 40); do [ -s "$OUT/held.port" ] && break; sleep 0.1; done
 HELD="http://127.0.0.1:$(cat "$OUT/held.port")"
 reset_fp
-run_fp held "$EMAIL_STEP,key:tab,url,wait:waiting for you,sleep:2,key:esc" "$HELD" -- login
+run_fp held "url,wait:waiting for you,sleep:2,key:esc" "$HELD" -- login
 wait_url held >/dev/null
 T=$(wait_done held)
 eq "esc during a poll that comes back approved exits 0" "$(cat "$OUT/held.rc")" "0"
@@ -441,14 +443,14 @@ has "…calmly" "$T" "cancelled"
 eq "…with no claim" "$(cat "$OUT/held.claims" 2>/dev/null | wc -l)" "0"
 eq "…and nothing saved" "$(saved session_token)" ""
 reset_fp
-run_fp heldutf "$EMAIL_STEP,key:tab,url,wait:waiting for you,sleep:1,type:é,key:esc" "$HELD" -- login
+run_fp heldutf "url,wait:waiting for you,sleep:1,type:é,key:esc" "$HELD" -- login
 wait_url heldutf >/dev/null
 T=$(wait_done heldutf)
 has "esc after a non-ASCII key, same poll: calm too" "$T" "cancelled"
 eq "…with no claim" "$(cat "$OUT/held.claims" 2>/dev/null | wc -l)" "0"
 eq "…and nothing saved" "$(saved session_token)" ""
 reset_fp
-run_fp notheld "$EMAIL_STEP,key:tab,url" "$HELD" -- login
+run_fp notheld "url" "$HELD" -- login
 wait_url notheld >/dev/null
 T=$(wait_done notheld)
 eq "the same poll with no key pressed does claim, so the stand-in is a fair test" "$(cat "$OUT/held.claims" 2>/dev/null | wc -l)" "1"
@@ -457,7 +459,7 @@ eq "the same poll with no key pressed does claim, so the stand-in is a fair test
 reset_fp
 echo denied > "$OUT/held.mode"
 rm -f "$OUT/held.starts"
-run_fp heldenter "$EMAIL_STEP,key:tab,url,wait:waiting for you,sleep:1,key:enter,wait:not authorized,sleep:2,key:esc" "$HELD" -- login
+run_fp heldenter "url,wait:waiting for you,sleep:1,key:enter,wait:not authorized,sleep:2,key:esc" "$HELD" -- login
 wait_url heldenter >/dev/null
 T=$(wait_done heldenter)
 eq "enter during a poll that comes back denied doesn't take a new link" "$(wc -l < "$OUT/held.starts")" "1"
@@ -465,7 +467,7 @@ has "…the denial stays on screen until it's answered" "$T" "new link"
 eq "…and the person can still leave" "$(cat "$OUT/heldenter.rc")" "0"
 reset_fp
 rm -f "$OUT/held.starts"
-run_fp heldescdeny "$EMAIL_STEP,key:tab,url,wait:waiting for you,sleep:1,key:esc" "$HELD" -- login
+run_fp heldescdeny "url,wait:waiting for you,sleep:1,key:esc" "$HELD" -- login
 wait_url heldescdeny >/dev/null
 T=$(wait_done heldescdeny)
 eq "esc during a poll that comes back denied exits 0" "$(cat "$OUT/heldescdeny.rc")" "0"
@@ -475,14 +477,14 @@ eq "…with one link" "$(wc -l < "$OUT/held.starts")" "1"
 # Ctrl-C at any request, not only during a poll.
 reset_fp
 echo slow-start > "$OUT/held.mode"
-run_fp heldstart "$EMAIL_STEP,key:tab,wait:asking for a link,sleep:1,key:ctrl-c" "$HELD" -- login
+run_fp heldstart "wait:asking for a link,sleep:1,key:ctrl-c" "$HELD" -- login
 T=$(wait_done heldstart)
 eq "ctrl-c while asking for a link exits 0" "$(cat "$OUT/heldstart.rc")" "0"
 has "…calmly" "$T" "cancelled"
 reset_fp
 echo slow-claim > "$OUT/held.mode"
 rm -f "$OUT/held.claims"
-run_fp heldclaim "$EMAIL_STEP,key:tab,url,wait:finishing sign-in,sleep:1,key:ctrl-c" "$HELD" -- login
+run_fp heldclaim "url,wait:finishing sign-in,sleep:1,key:ctrl-c" "$HELD" -- login
 wait_url heldclaim >/dev/null
 T=$(wait_done heldclaim)
 eq "ctrl-c while finishing exits 0" "$(cat "$OUT/heldclaim.rc")" "0"
@@ -493,7 +495,7 @@ kill "$HELD_PID" 2>/dev/null
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 8 — a dropped connection is not an answer"
 reset_fp
-run_fp drop "$EMAIL_STEP,key:tab,url,wait:waiting for you,wait:reconnecting,wait:waiting for you" "$DASH" -- login
+run_fp drop "url,wait:waiting for you,wait:reconnecting,wait:waiting for you" "$DASH" -- login
 LINK=$(link_token "$(wait_url drop)")
 DASH_STOPPED=1
 docker stop -t 0 "$DASH_CONTAINER" >/dev/null
@@ -520,7 +522,7 @@ mkdir -p "$OUT/bin"
 printf '#!/bin/sh\necho "$@" > "%s/opened"\n' "$OUT" > "$OUT/bin/xdg-open"
 chmod +x "$OUT/bin/xdg-open"
 rm -f "$OUT/opened"
-run_fp opens "$EMAIL_STEP,key:tab,url,wait:waiting for you,key:esc" "$DASH" DISPLAY=:99 SSH_TTY= PATH="$OUT/bin:$PATH" -- login
+run_fp opens "url,wait:waiting for you,key:esc" "$DASH" DISPLAY=:99 SSH_TTY= PATH="$OUT/bin:$PATH" -- login
 URL=$(wait_url opens)
 T=$(wait_done opens)
 for _ in $(seq 1 20); do [ -s "$OUT/opened" ] && break; sleep 0.25; done
@@ -543,7 +545,7 @@ PY
 STUB_PID=$!
 for _ in $(seq 1 40); do [ -s "$OUT/stub.port" ] && break; sleep 0.1; done
 reset_fp
-run_fp old404 "$EMAIL_STEP,key:tab,wait:no browser login,wait:send a code,key:esc" "http://127.0.0.1:$(cat "$OUT/stub.port")" -- login
+run_fp old404 "wait:no browser login,wait:send a code,key:esc" "http://127.0.0.1:$(cat "$OUT/stub.port")" -- login
 T=$(wait_done old404)
 eq "a Cloud with no such route falls through to the email step" "$(cat "$OUT/old404.rc")" "0"
 has "…saying why" "$T" "this Cloud has no browser login yet"
@@ -551,7 +553,7 @@ if [ -n "$CLOUD_1090" ]; then
   reset_fp
   KEYS_BEFORE=$(docker exec "$PG_1090" psql -U postgres -d agenteye -tAc "select count(*) from api_keys where created_via = 'cli_login'")
   STARTED_BEFORE=$(docker exec "$PG_1090" psql -U postgres -d agenteye -tAc "select count(*) from cli_login_requests")
-  run_fp old1090 "$EMAIL_STEP,key:tab,wait:no browser login,wait:send a code,key:esc" "$CLOUD_1090" -- login
+  run_fp old1090 "wait:no browser login,wait:send a code,key:esc" "$CLOUD_1090" -- login
   T=$(wait_done old1090)
   eq "a Cloud with only \`failproofai config\`'s login falls through too" "$(cat "$OUT/old1090.rc")" "0"
   has "…saying why" "$T" "this Cloud has no browser login yet"
@@ -600,7 +602,7 @@ hasnt "…and carrying no secret" "$M" "$CLAIMED_TOKEN"
 PLAIN="fp-plain-$STAMP@example.test"
 PLAIN_SESSION=$(sign_in "$PLAIN")
 reset_fp
-run_fp plainbox "$EMAIL_STEP,key:tab,url" "$DASH" -- login
+run_fp plainbox "url" "$DASH" -- login
 LINK=$(link_token "$(wait_url plainbox)")
 PAGE=$(person "$PLAIN_SESSION" lookup "{\"link_token\":\"$LINK\"}")
 eq "the real fp: no warning" "$(echo "$PAGE" | jqp '["different_network"]')" "False"
@@ -646,7 +648,7 @@ if [ -n "$TRUSTED_DASH" ]; then
   LOCAL="fp-local-$STAMP@example.test"
   LOCAL_SESSION=$(sign_in "$LOCAL")
   reset_fp
-  run_fp elsewhere "$EMAIL_STEP,key:tab,url" "$TRUSTED_DASH" -- login
+  run_fp elsewhere "url" "$TRUSTED_DASH" -- login
   LINK=$(link_token "$(wait_url elsewhere)")
   PAGE=$(person "$LOCAL_SESSION" lookup "{\"link_token\":\"$LINK\"}" 198.51.100.50)
   eq "the real fp, approved elsewhere: the page warns" "$(echo "$PAGE" | jqp '["different_network"]')" "True"
@@ -698,7 +700,7 @@ has "a claim answer is never cacheable" "$CACHE" "no-store"
 # ═════════════════════════════════════════════════════════════════════════════
 head1 "PHASE 13 — logout, and no secret in any log"
 reset_fp
-run_fp last "$EMAIL_STEP,key:tab,url" "$DASH" -- login
+run_fp last "url" "$DASH" -- login
 LINK=$(link_token "$(wait_url last)")
 person "$ONE_SESSION" approve "{\"link_token\":\"$LINK\"}" >/dev/null
 wait_done last >/dev/null
diff --git a/docs/reference/cloud-cli.mdx b/docs/reference/cloud-cli.mdx
index ac167eb54..058f288f9 100644
--- a/docs/reference/cloud-cli.mdx
+++ b/docs/reference/cloud-cli.mdx
@@ -163,7 +163,7 @@ unchanged when no artifact is returned.
 
 | Command | Purpose | Options |
 | --- | --- | --- |
-| `fp login` | Sign in with an emailed one-time code or from a browser, and select an organization. `--email` goes straight to the code. | `--email`, `-e`; `--org`; `--force` |
+| `fp login` | Sign in from a browser or with an emailed one-time code, and select an organization. `--email` goes straight to the code. | `--email`, `-e`; `--org`; `--force` |
 | `fp logout` | Revoke and remove the saved user session. | — |
 | `fp whoami` | Show the current identity, authentication mode, organization, and permissions. | — |
 | `fp version` | Show the installed CLI version. | — |
@@ -175,7 +175,7 @@ fp login --email you@example.com --org reliability-team
 fp whoami
 ```
 
-On a terminal, `fp login` asks for your email and sends a 6-digit code to paste back, which is also what `--email`, `--json` and anything without a terminal use. Press **Tab** there to sign in with your browser or SSO instead, and Tab again to go back. `fp` shows a link and opens it (over SSH or with no display it only shows it, and it works from any device); authorize it and the terminal finishes on its own. That terminal gets your access in all your organizations until the session expires, so only authorize a link you just asked for. If the login started on a different network, you get an email once the session exists, and the page warns you where the deployment can tell.
+On a terminal, `fp login` starts on a link, to sign in with your browser or SSO, and opens it (over SSH or with no display it only shows it, and it works from any device); authorize it and the terminal finishes on its own. That terminal gets your access in all your organizations until the session expires, so only authorize a link you just asked for. If the login started on a different network, you get an email once the session exists, and the page warns you where the deployment can tell. Press **Tab** for a 6-digit code by email instead, and Tab again to go back. `--email`, `--json` and anything without a terminal use the code.
 
 ### Events
 
diff --git a/fp-cloud-cli/CHANGELOG.md b/fp-cloud-cli/CHANGELOG.md
index 042385824..49c692ed2 100644
--- a/fp-cloud-cli/CHANGELOG.md
+++ b/fp-cloud-cli/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### Added
 
-- `fp login` can sign you in from a browser. On a terminal it asks for your email and sends a 6-digit code, as before; press Tab there for a link instead, to use your browser or SSO, and Tab again to go back. The link stays in the login box, opens where a browser can (over SSH or with no display it only shows it, and it works from any device), and the terminal finishes on its own once you authorize it. `--email`, `--json` and anything without a terminal keep the code as they always did. A dashboard without browser login stays with the code and never creates a key. Either way you get the same session, with the same lifetime. (#981)
+- `fp login` can sign you in from a browser. On a terminal it starts on a link, to use your browser or SSO: it opens where a browser can (over SSH or with no display it only shows it, and it works from any device), and the terminal finishes on its own once you authorize it. Press Tab for a 6-digit code by email instead, and Tab again to go back. `--email`, `--json` and anything without a terminal keep the code as they always did. If there's no link to offer, as on a dashboard without browser login, it uses the code and never creates a key. Either way you get the same session, with the same lifetime. (#981)
 
 ### Changed
 
diff --git a/fp-cloud-cli/README.md b/fp-cloud-cli/README.md
index 69d50661c..d1cd00041 100644
--- a/fp-cloud-cli/README.md
+++ b/fp-cloud-cli/README.md
@@ -35,10 +35,10 @@ uv run fp --help
 ## Authentication
 
 The CLI talks to your dashboard (set `--base-url` or `FP_DASHBOARD_URL`) and signs you in
-with an emailed one-time code or from a browser:
+from a browser or with an emailed one-time code:
 
 ```bash
-fp login                           # enter your email for a code, or press tab for a browser link
+fp login                           # opens a link to authorize; press tab for a code by email instead
 fp login --email you@example.com   # straight to the code; also what scripts and pipes use
 # either way the session is stored in
 # ~/.failproofai/fpcli/cli-auth.json (mode 0600)
@@ -46,11 +46,11 @@ fp whoami
 fp logout
 ```
 
-Press **tab** at the email to sign in with your browser or SSO instead, and tab again to go
-back. `fp` shows a link and opens it (over SSH or with no display it only shows it, and it
-works from any device). Authorize it and the terminal finishes on its own. That terminal gets
-your access in all your orgs until the session expires, so only authorize a link you just
-asked for. A dashboard without browser login stays with the code.
+`fp` starts on a link, to sign in with your browser or SSO, and opens it (over SSH or with no
+display it only shows it, and it works from any device). Authorize it and the terminal finishes
+on its own. That terminal gets your access in all your orgs until the session expires, so only
+authorize a link you just asked for. Press **tab** for a code by email instead, and tab again to
+go back. If there's no link to offer, as on a dashboard without browser login, it uses the code.
 
 Sessions expire (24h by default); re-run `fp login` when prompted.
 
diff --git a/fp-cloud-cli/fp_cli/commands/auth_cmds.py b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
index ecc596141..076d1ed8a 100644
--- a/fp-cloud-cli/fp_cli/commands/auth_cmds.py
+++ b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
@@ -25,7 +25,7 @@
     resolved_base_url,
 )
 from ..client import ClientContext, get_session_user, org_is_accessible
-from ..errors import ApiError, AuthError
+from ..errors import ApiError, AuthError, NetworkError
 
 
 def _resolve_login_org(
@@ -111,6 +111,7 @@ def _looks_like_email(value: str) -> bool:
 _LINK_OPENING = "opening your browser — if nothing appears, open this link:"
 _LINK_ANYWHERE = "open this link on any device to authorize:"
 _NO_BROWSER_LOGIN = "this Cloud has no browser login yet — using an emailed code"
+_NO_LINK_NOW = "couldn't get a link right now — using an emailed code"
 _LINK_ENDED = {
     "denied": "not authorized",
     "expired": "that link expired",
@@ -131,7 +132,7 @@ def _offer_link(url: str) -> None:
 
 def _browser_login_in_box(state: AppState, base: str, box: selectmod.LoginBox):
     """Link → approval → session, inside the box. Returns ``(token, expires_in, user)``, or ``None``
-    when this Cloud has no browser login. Tab raises ``SwitchSignIn``, and ``box.link`` keeps the
+    with a note saying why when there's no link to offer. Tab raises ``SwitchSignIn``, and ``box.link`` keeps the
     link for coming back: asking for another each time would spend the rate limit and open another
     tab, and an approval given in the meantime would be lost."""
     options = {"timeout": state.timeout, "verify": not state.insecure}
@@ -150,8 +151,15 @@ def tick(left: float, offline: bool) -> None:
                 box.show_link(_LINK_ANYWHERE, box.link.verification_url)
             else:
                 box.working("asking for a link…")
-                box.link = auth.start_browser_login(base, **options)
+                try:
+                    box.link = auth.start_browser_login(base, **options)
+                except (ApiError, NetworkError):
+                    # The link is only the default. A rate limit or an outage of this one route
+                    # must not stand between a person and the emailed code.
+                    box.note(_NO_LINK_NOW)
+                    return None
                 if box.link is None:
+                    box.note(_NO_BROWSER_LOGIN)
                     return None
                 # The link goes on screen before any browser opens, so one that never appears
                 # strands nobody. Over SSH or with no display it is the whole offer.
@@ -248,28 +256,27 @@ def _email_code_in_box(state: AppState, base: str, box: selectmod.LoginBox, emai
 
 
 def _sign_in_in_box(state: AppState, base: str, box: selectmod.LoginBox, email_opt: Optional[str]):
-    """Ask for an email, with Tab to a browser link and back. Returns ``(method, creds)``."""
+    """Start on a browser link, with Tab to an emailed code and back. Returns ``(method, creds)``."""
     if email_opt:
         return "email", _email_code_in_box(state, base, box, email_opt)
-    typed, tab = "", True
+    typed = ""
     while True:
-        try:
-            return "email", _email_code_in_box(state, base, box, None, typed=typed, tab=tab)
-        except selectmod.SwitchSignIn as switch:
-            typed = switch.typed
         try:
             creds = _browser_login_in_box(state, base, box)
         except selectmod.SwitchSignIn:
-            continue
+            try:
+                return "email", _email_code_in_box(state, base, box, None, typed=typed, tab=True)
+            except selectmod.SwitchSignIn as switch:
+                typed = switch.typed
+                continue
         if creds:
             return "browser", creds
-        box.note(_NO_BROWSER_LOGIN)
-        tab = False
+        return "email", _email_code_in_box(state, base, box, None, typed=typed)
 
 
 def _login_interactive(state: AppState, base: str, email_opt: Optional[str], org_opt: Optional[str]) -> None:
-    """The single-box interactive login (real TTY only): one redrawn-in-place panel — email code
-    or browser link → (org picker) → signed-in. Mirrors the non-interactive orchestration below; only the
+    """The single-box interactive login (real TTY only): one redrawn-in-place panel — browser link
+    or email code → (org picker) → signed-in. Mirrors the non-interactive orchestration below; only the
     UI differs. Network/auth errors propagate (terminal restored on the way out) to the standard red
     error box."""
     saved = state.config.org
@@ -331,13 +338,13 @@ def login(
     org: Optional[str] = typer.Option(None, "--org", help="Org/tenant slug to sign in to — skips the picker. Must be one you can access."),
     force: bool = typer.Option(False, "--force", help="Re-authenticate even if you already have a valid session."),
 ) -> None:
-    """Sign in to the dashboard, with an emailed one-time code or from a browser.
+    """Sign in to the dashboard, from a browser or with an emailed one-time code.
 
-    On a terminal it asks for your email and sends a 6-digit code to paste back, which is also
-    what `--email`, `--json` and anything without a terminal use. Press **Tab** there for a link
-    instead, to sign in with your browser or SSO. It opens your browser (over SSH or with no display
-    it just shows the link, which works from any device); authorize there and the terminal finishes
-    on its own. A Cloud without browser login stays with the code.
+    On a terminal it starts on a link, to sign in with your browser or SSO. It opens your browser
+    (over SSH or with no display it just shows the link, which works from any device); authorize
+    there and the terminal finishes on its own. Press **Tab** for a 6-digit code by email instead,
+    which is also what `--email`, `--json` and anything without a terminal use. A Cloud without
+    browser login uses the code by itself.
     The session is saved to `~/.failproofai/fpcli/cli-auth.json` (mode 0600) and lasts ~24h — just
     re-run `login` when it expires. Already signed in? `login` shows who you are and exits 0
     without prompting; pass `--force` to re-authenticate anyway.
diff --git a/fp-cloud-cli/fp_cli/output.py b/fp-cloud-cli/fp_cli/output.py
index 6e88552df..19d8f3d3a 100644
--- a/fp-cloud-cli/fp_cli/output.py
+++ b/fp-cloud-cli/fp_cli/output.py
@@ -636,7 +636,7 @@ def _bullet(*parts) -> Text:
                   Text(" or set ", style=theme.FAINT) +
                   Text("FP_DASHBOARD_URL", style=theme.TEXT_DIM) +
                   Text("; saved after login.)", style=theme.FAINT))
-    _stdout.print(_bullet(("sign in with the 6-digit code emailed to you.  self-signed dashboard? add ", theme.TEXT),
+    _stdout.print(_bullet(("authorize the link in your browser, or press tab for a code by email.  self-signed dashboard? add ", theme.TEXT),
                           ("--insecure", theme.ACCENT), (".", theme.TEXT)))
     _stdout.print(_bullet(("then: ", theme.TEXT), ("fp whoami", theme.ACCENT),
                           ("   ", theme.FAINT), ("fp --json sessions --since 24h", theme.ACCENT)))
diff --git a/fp-cloud-cli/fp_cli/select.py b/fp-cloud-cli/fp_cli/select.py
index f4a0245ad..df61d5854 100644
--- a/fp-cloud-cli/fp_cli/select.py
+++ b/fp-cloud-cli/fp_cli/select.py
@@ -392,6 +392,7 @@ def finish(self, email: str, org: Optional[str]) -> None:
     def cancel(self, persisted: bool) -> None:
         """Render the calm close — ``○ cancelled — not signed in`` (or ``○ signed in · pick an org …``
         when the session was already persisted)."""
+        self.active = None  # the step that was asking is over, so no prompt is left behind
         self._draw(cancelled=bool(persisted))
 
     def fail(self, message: str, hint: Optional[str] = None) -> None:
diff --git a/fp-cloud-cli/tests/test_browser_login.py b/fp-cloud-cli/tests/test_browser_login.py
index 158bb5505..6b40a814c 100644
--- a/fp-cloud-cli/tests/test_browser_login.py
+++ b/fp-cloud-cli/tests/test_browser_login.py
@@ -359,6 +359,7 @@ def __init__(self, *keys):
         self.ended = []
         self.link = None
         self.shown = []
+        self.notes = []
 
     def working(self, _text):
         pass
@@ -366,6 +367,9 @@ def working(self, _text):
     def show_link(self, intro, url):
         self.shown.append((intro, url))
 
+    def note(self, label, value=None):
+        self.notes.append(label)
+
     def waiting(self, _line, _keys):
         pass
 
@@ -491,7 +495,6 @@ def __init__(self, *steps):
         super().__init__()
         self.steps = list(steps)
         self.asked = []
-        self.notes = []
 
     def text_step(self, label, *, helper=None, value="", tab=False, **_k):
         self.asked.append((label, value, tab, helper))
@@ -500,9 +503,6 @@ def text_step(self, label, *, helper=None, value="", tab=False, **_k):
             raise step
         return step
 
-    def note(self, label, value=None):
-        self.notes.append(label)
-
 
 @pytest.fixture
 def emailed_code(monkeypatch):
@@ -510,7 +510,7 @@ def emailed_code(monkeypatch):
     monkeypatch.setattr(auth, "verify_otp", lambda *_a, **_k: ("tok-otp", 3600, CLAIMED["user"]))
 
 
-def test_tab_at_the_email_goes_to_the_link_and_back_keeping_what_was_typed(emailed_code, monkeypatch):
+def test_tab_at_the_link_goes_to_the_email_and_back_keeping_what_was_typed(emailed_code, monkeypatch):
     def left(*_a, **_k):
         raise selectmod.SwitchSignIn()
 
@@ -526,24 +526,60 @@ def left(*_a, **_k):
     assert box.asked[0][3] == "enter send a code · tab SSO · esc cancel"
 
 
-def test_a_browser_link_from_the_email_step_signs_in(approved_link):
-    box = _EmailBox(selectmod.SwitchSignIn(""))
+def test_login_starts_on_the_link_and_never_asks_for_an_email(approved_link):
+    box = _EmailBox()
     method, creds = auth_cmds._sign_in_in_box(_state(), BASE, box, None)
     assert (method, creds[0]) == ("browser", "tok")
     assert approved_link == [1]
+    assert box.asked == []
+    assert box.shown == [(auth_cmds._LINK_ANYWHERE, LINK)]
 
 
-def test_a_cloud_without_browser_login_stops_offering_tab(emailed_code, monkeypatch):
+def _uses_the_code(box):
+    label, value, tab, helper = box.asked[0]
+    assert (label, value, tab) == ("email", "", False)
+    assert "tab" not in helper
+
+
+def test_a_cloud_without_browser_login_uses_the_code_and_offers_no_tab(emailed_code, monkeypatch):
     monkeypatch.setattr(auth, "start_browser_login", lambda *_a, **_k: None)
-    box = _EmailBox(selectmod.SwitchSignIn("me@"), "me@test", "123456")
+    box = _EmailBox("me@test", "123456")
 
     method, _creds = auth_cmds._sign_in_in_box(_state(), BASE, box, None)
 
     assert method == "email"
     assert box.notes[0] == auth_cmds._NO_BROWSER_LOGIN
-    label, value, tab, helper = box.asked[1]
-    assert (label, value, tab) == ("email", "me@", False)
-    assert "tab" not in helper
+    _uses_the_code(box)
+
+
+@pytest.mark.parametrize(
+    "failure",
+    [ApiError("Too many login attempts", status=429), NetworkError("answered HTTP 502")],
+    ids=["rate-limited", "server-error"],
+)
+def test_failing_to_get_a_link_still_leaves_the_emailed_code(emailed_code, monkeypatch, failure):
+    # The link is only the default, so it must not be the only way in.
+    def refused(*_a, **_k):
+        raise failure
+
+    monkeypatch.setattr(auth, "start_browser_login", refused)
+    box = _EmailBox("me@test", "123456")
+
+    method, creds = auth_cmds._sign_in_in_box(_state(), BASE, box, None)
+
+    assert (method, creds[0]) == ("email", "tok-otp")
+    assert box.notes[0] == auth_cmds._NO_LINK_NOW
+    _uses_the_code(box)
+
+
+def test_a_claim_that_fails_is_not_mistaken_for_having_no_link(approved_link, monkeypatch):
+    # Someone approved this. Dropping to a code would hide why it didn't work.
+    def refused(*_a, **_k):
+        raise ApiError("approval_revoked", status=403)
+
+    monkeypatch.setattr(auth, "claim_browser_login", refused)
+    with pytest.raises(ApiError, match="approval_revoked"):
+        auth_cmds._sign_in_in_box(_state(), BASE, _EmailBox(), None)
 
 
 def test_the_email_flag_goes_straight_to_the_code(emailed_code, monkeypatch):
@@ -604,6 +640,23 @@ def written_by(step):
         assert written_by(box._draw).count("\x1b[1A\x1b[2K") == 2
 
 
+def test_cancelling_leaves_no_prompt_behind(monkeypatch):
+    monkeypatch.setenv("TERM", "xterm")
+    console = Console(file=io.StringIO(), force_terminal=True, width=80, color_system=None)
+    monkeypatch.setattr(output, "_stderr", console)
+    monkeypatch.setattr("sys.stdin", SimpleNamespace(fileno=lambda: 0))
+    box = selectmod.LoginBox()
+    box._live = Live(console=console, auto_refresh=False)
+    box.active = "email"
+    with box._live:
+        box._draw()
+        console.file.seek(0)
+        console.file.truncate()
+        box.cancel(False)
+    closing = console.file.getvalue()
+    assert "cancelled" in closing and "❯ email" not in closing
+
+
 @pytest.mark.parametrize("step", ["start_browser_login", "claim_browser_login"])
 def test_ctrl_c_during_any_request_of_a_browser_login_cancels_calmly(approved_link, monkeypatch, step):
     def interrupted(*_a, **_k):

From 2c17534d2bd94f62d74e59178c60397a06edf6c4 Mon Sep 17 00:00:00 2001
From: Siddartha Aralakuppe Yogesha <siddartha_ay@protonmail.com>
Date: Sat, 7 Nov 2026 13:00:47 +0530
Subject: [PATCH 15/15] [failproofai-feat-failproofai-cloud-login] Fall back to
 an emailed code when a plain terminal can't get a link

On a terminal with no raw mode (Windows), a 429 or 500 from starting the
browser login ended `fp login` with an error. It now says so and asks for
the email, as the login box already does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 fp-cloud-cli/fp_cli/commands/auth_cmds.py |  6 +++++-
 fp-cloud-cli/tests/test_browser_login.py  | 22 ++++++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/fp-cloud-cli/fp_cli/commands/auth_cmds.py b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
index 076d1ed8a..ee11e7014 100644
--- a/fp-cloud-cli/fp_cli/commands/auth_cmds.py
+++ b/fp-cloud-cli/fp_cli/commands/auth_cmds.py
@@ -193,7 +193,11 @@ def _browser_login_plain(state: AppState, base: str):
     """The same, for a terminal with no raw mode (Windows). ``None`` when this Cloud has
     no browser login. A link that ends ends the login: `fp login` is one command away."""
     options = {"timeout": state.timeout, "verify": not state.insecure}
-    login = auth.start_browser_login(base, **options)
+    try:
+        login = auth.start_browser_login(base, **options)
+    except (ApiError, NetworkError):  # as in the box: the link is not the only way in
+        output.info(_NO_LINK_NOW)
+        return None
     if login is None:
         output.info(_NO_BROWSER_LOGIN)
         return None
diff --git a/fp-cloud-cli/tests/test_browser_login.py b/fp-cloud-cli/tests/test_browser_login.py
index 6b40a814c..5cda84420 100644
--- a/fp-cloud-cli/tests/test_browser_login.py
+++ b/fp-cloud-cli/tests/test_browser_login.py
@@ -736,6 +736,28 @@ def test_a_cloud_without_browser_login_falls_back_to_the_emailed_code(home, runn
     assert config.load_config().session_token == "tok-otp"
 
 
+@respx.mock
+@pytest.mark.parametrize("failed", [429, 500], ids=["rate-limited", "server-error"])
+def test_failing_to_get_a_link_on_a_plain_terminal_still_leaves_the_emailed_code(home, runner, plain_terminal, failed):
+    respx.post(f"{BASE}/api/auth/cli/start").mock(return_value=httpx.Response(failed, json={"error": "nope"}))
+    otp = respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(200, json={"ok": True}))
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(
+        return_value=httpx.Response(
+            200,
+            json={"user": {"id": "u1", "email": "me@test"}, "expires_in_secs": 3600},
+            headers={"set-cookie": "ae_session=tok-otp; Path=/"},
+        )
+    )
+    respx.get(f"{BASE}/api/auth/session").mock(return_value=httpx.Response(200, json=SESSION))
+
+    result = runner.invoke(app, ["--base-url", BASE, "login"], input="\nme@test\n123456\n")
+
+    assert result.exit_code == 0, result.output
+    assert auth_cmds._NO_LINK_NOW in result.output
+    assert otp.called
+    assert config.load_config().session_token == "tok-otp"
+
+
 @respx.mock
 def test_a_cloud_that_dropped_the_kind_is_never_claimed_from(home, runner, plain_terminal):
     respx.post(f"{BASE}/api/auth/cli/start").mock(