@synap-core/cli 1.11.0 → 1.13.0

package/dist/commands/init.js

@@ -1,10 +1,12 @@
 /**
  * synap init
  *
- * Three paths based on environment detection:
- *   A: OpenClaw found → connect mode (primary funnel, 250K users)
- *   B: Server, no OpenClaw → bundle mode (fresh setup)
- *   C: Laptop/desktop → need hosting
+ * Laptop/desktop (the default): find or create a pod → connect the agents on
+ * this machine (Claude Code, Codex, Cursor — one row each) → pair
+ * the phone → hand the person one real task to give their agent.
+ *
+ * One flow for every machine, a server running a pod included: Synap is
+ * agent-agnostic, so init connects the agents found here and installs none.
  */
 import prompts from "prompts";
 import ora from "ora";
@@ -12,955 +14,498 @@ import chalk from "chalk";
 import { execSync } from "child_process";
 import fs from "fs";
 import { log, banner } from "../utils/logger.js";
-import { detectOpenClaw, readOpenClawConfig, writeOpenClawConfig, setConfigValue, } from "../lib/openclaw.js";
-import { checkPodHealth, setupAgentViaPod, provisionUserOnPod, installSynapSkill, enableOpenClawAddonManaged, saveLocalPodConfig, checkServerResources, startOpenClawOnServer, findSynapDeployDir, getLocalPodConfig, getActiveProjectId, } from "../lib/pod.js";
-import { provisionAgentKey, configureAgentContext } from "../lib/targets.js";
-import { seedAgentEntities } from "../lib/seed.js";
-import { login, isLoggedIn, listPods, getStoredToken, waitForPodCallback } from "../lib/auth.js";
+import { checkPodHealth, getLocalPodConfig, listPodProfiles, addPodProfile, setActivePod, } from "../lib/pod.js";
+import { CP_URL, login, isLoggedIn, listPods, podUrlOf, getStoredToken, waitForPodCallback } from "../lib/auth.js";
+import { detectAgents } from "../lib/agent-detect.js";
+import { reachChecklist, unreachableMessage } from "../lib/pod-reach.js";
+import { createPodInBrowser } from "../lib/init-pod.js";
+import { buildPairLink, renderTerminalQr } from "../lib/pair-link.js";
+import { buildHandoff } from "../lib/init-handoff.js";
+import { connectAgentsBatch } from "../lib/agent-door.js";
+import { INIT_EXIT, InitExit } from "../lib/init-exit.js";
+import { askControlPlaneWherePodIs, podMovedMessage } from "../lib/pod-moved.js";
+import { reserveStdoutForJson } from "../lib/init-output.js";
+import { isManagedPod, keyChoices } from "../lib/init-flow.js";
+import { installWakeHookForProject } from "./hooks.js";
+import { computerKeyNeedsRenewal, deviceConnect, DeviceStartError, saveDeviceGrant, wireApprovedAgents, } from "../lib/device-connect.js";
+/** Where a phone without Relay gets it (synap-landing/app/download/relay). */
+const RELAY_DOWNLOAD_URL = "https://synap.live/download/relay";
+const AGENT_CHOICES = ["claude-code", "codex", "cursor"];
 export async function init(opts) {
+    const emitJson = opts.json ? reserveStdoutForJson() : null;
     banner();
-    // ── Pre-flight: "no pod anywhere" gate ──────────────────────────────────
-    // Keep this CLI laptop/agent-focused. If the user ran `synap init` without
-    // any signal of an existing pod, point them at the two supported ways to
-    // get one (self-host via ./synap install on a server, or a managed pod on
-    // synap.live) and exit. This replaces silent failure / interactive
-    // provisioning when there's nothing to connect to.
-    //
-    // A --pod-url flag that's explicitly unreachable is a separate diagnostic
-    // (handled below once checkPodHealth has confirmed).
-    if (!opts.podUrl) {
-        if (await hasAnyPodSignal()) {
-            // fall through into the normal flow
-        }
-        else {
-            printNoPodInstructions();
-            process.exit(2);
-        }
+    let summary = null;
+    let exitCode = INIT_EXIT.ok;
+    let error;
+    try {
+        summary = await runInit(opts);
+        if (summary && summary.connected.length === 0)
+            exitCode = INIT_EXIT.noAgent;
     }
-    else {
-        // Explicit URL was passed — probe it before letting downstream assume
-        // reachability. Fail loud with a helpful hint instead of silent 500s.
+    catch (err) {
+        if (!(err instanceof InitExit))
+            throw err;
+        exitCode = err.code;
+        error = err.message;
+        if (!err.shown)
+            log.error(error);
+    }
+    emitJson?.(JSON.stringify(summary ? { ...summary, exitCode } : { exitCode, error }) + "\n");
+    if (exitCode !== INIT_EXIT.ok)
+        process.exit(exitCode);
+}
+/** `--agents claude-code,codex` → the targets, or a usage error naming the bad one. */
+function parseAgents(list) {
+    const names = list.split(",").map((a) => a.trim()).filter(Boolean);
+    const bad = names.filter((a) => !AGENT_CHOICES.includes(a));
+    if (bad.length > 0 || names.length === 0) {
+        throw new InitExit(INIT_EXIT.usage, `Unknown agent${bad.length > 1 ? "s" : ""}: ${bad.join(", ") || "(none)"}. Use ${AGENT_CHOICES.join(", ")}.`);
+    }
+    return [...new Set(names)];
+}
+/**
+ * The one line for a pod address that redirects to another host: the new
+ * address when the Control Plane knows it (never the redirect's), else what
+ * to run to find it.
+ */
+async function movedPodLine(podUrl, next, saved = false) {
+    const answer = await askControlPlaneWherePodIs({
+        podUrl,
+        cpUrl: CP_URL,
+        cpToken: getStoredToken()?.token,
+    });
+    if (answer.kind === "moved")
+        return `The pod at ${podUrl} moved to ${answer.podUrl}. ${next(answer.podUrl)}`;
+    if (saved)
+        return podMovedMessage(podUrl);
+    return answer.kind === "signed-out"
+        ? `The pod at ${podUrl} has a new address. Run: synap login — then run init again to look it up.`
+        : `The pod at ${podUrl} has a new address. Use the address shown in your account.`;
+}
+async function runInit(opts) {
+    const tty = Boolean(process.stdin.isTTY);
+    if (!tty && (!opts.podUrl || !opts.agents)) {
+        throw new InitExit(INIT_EXIT.usage, "Not a terminal. Pass --pod-url and --agents claude-code,codex");
+    }
+    opts.unattended = !tty || Boolean(opts.yes);
+    const agents = opts.agents ? parseAgents(opts.agents) : undefined;
+    // An explicit --pod-url is probed before anything assumes reachability: a
+    // typo'd URL fails loud with a checklist instead of silent 500s later.
+    if (opts.podUrl) {
         const probe = await checkPodHealth(opts.podUrl);
-        if (!probe.healthy) {
-            printUnreachablePodInstructions(opts.podUrl);
-            process.exit(2);
-        }
-    }
-    // ── Auto-detect environment ─────────────────────────────────────────────
-    // Pod URL is always the primary decision axis. OpenClaw, if present, is an
-    // optional enhancement that gets wired after the pod connection is set up —
-    // it is no longer the gating condition for which path runs.
-    const oc = detectOpenClaw();
-    const isServer = detectServer();
-    if (oc.found) {
-        log.info(`OpenClaw detected${oc.version ? ` v${oc.version}` : ""} — will wire it after pod setup`);
-    }
-    if (isServer) {
-        // Before assuming fresh install, check if a pod is already running
-        const spinner = ora("Scanning for existing Synap pod...").start();
-        const existingPodUrl = opts.podUrl ?? (await detectLocalPod());
-        spinner.stop();
-        if (existingPodUrl) {
-            log.success(`Found existing pod at ${existingPodUrl}`);
-            if (oc.found) {
-                log.info("Server + OpenClaw — connecting pod then wiring OpenClaw");
-                await pathA(opts, oc);
-            }
-            else {
-                log.info("Server detected — connecting to existing pod");
-                await pathBExisting(opts, existingPodUrl);
-            }
+        if (probe.moved) {
+            throw new InitExit(INIT_EXIT.noPod, await movedPodLine(opts.podUrl, (to) => `Run: synap init --pod-url ${to}`));
         }
-        else {
-            log.info("Server detected — fresh setup mode");
-            await pathB(opts);
+        if (!probe.healthy) {
+            printUnreachablePodInstructions(opts.podUrl, probe.failure);
+            throw new InitExit(INIT_EXIT.noPod, unreachableMessage(opts.podUrl, probe.failure), true);
         }
-        return;
-    }
-    if (oc.found) {
-        // Desktop with OpenClaw — use pathA (OpenClaw connect mode)
-        await pathA(opts, oc);
-        return;
     }
-    log.info("Running on desktop — hosting mode");
-    await pathC(opts);
+    return desktopFlow(opts, agents);
 }
 // =============================================================================
-// PATH A: Existing OpenClaw (primary funnel)
+// DESKTOP: pod → agents → phone → first task
 // =============================================================================
-async function pathA(opts, oc) {
-    // ── Report ──────────────────────────────────────────────────────────────
-    log.heading("Step 1: OpenClaw Detected");
-    log.success(`Version: ${oc.version ?? "unknown"}`);
-    log.success(`Gateway: ${oc.gatewayRunning ? "running" : "stopped"} (port ${oc.gatewayPort ?? 18789})`);
-    // ── Pod ─────────────────────────────────────────────────────────────────
-    const podUrl = await podChoiceStep(opts);
-    if (!podUrl)
-        return;
-    // ── Connect ─────────────────────────────────────────────────────────────
-    const apiKey = await connectStep(podUrl, opts, true);
-    if (!apiKey)
-        return;
-    // ── Skill ───────────────────────────────────────────────────────────────
-    await skillStep(true, oc);
-    // ── Seed ────────────────────────────────────────────────────────────────
-    await seedStep(podUrl, apiKey, oc);
-    // ── IS ──────────────────────────────────────────────────────────────────
-    if (!opts.skipIs) {
-        await isStep(podUrl, apiKey, true);
-    }
-    printSummary(podUrl, true);
+async function desktopFlow(opts, agents) {
+    log.heading("Your pod");
+    const pod = await resolveDesktopPod(opts);
+    // The agents asked for WITH the computer: --agents, else the ones found here.
+    const wanted = agents ?? detectAgents().filter((r) => r.found).map((r) => r.target);
+    const { key: humanKey, grant } = await ensurePodKey(pod.podUrl, opts, pod.podId, wanted);
+    // Connected just now: the person already chose the agents on the approval
+    // page, so connect exactly those.
+    const picked = grant
+        ? grant.agents.map((a) => a.agentType).filter((t) => AGENT_CHOICES.includes(t))
+        : agents;
+    const outcome = await connectAgentsStep(pod.podUrl, humanKey, opts, picked);
+    // Claude Code connected: let another session's agent (or the person, in the
+    // room) wake this project's terminals — the asyncRewake Stop hook.
+    if (outcome.connected.includes("claude-code"))
+        installWakeHookForProject();
+    const pairLink = await pairPhoneStep(pod.podUrl);
+    printClosing(outcome.connectedLabels);
+    return {
+        podUrl: pod.podUrl,
+        connected: outcome.connected,
+        notApproved: outcome.notApproved,
+        failed: outcome.failed,
+        pairLink,
+    };
 }
-// =============================================================================
-// PATH B-EXISTING: Server with pod already running, just needs OpenClaw
-// =============================================================================
-async function pathBExisting(opts, detectedUrl) {
-    log.heading("Step 1: Verify Pod");
-    // Confirm URL with the user — let them override if detection was wrong
-    const { podUrl } = await prompts({
-        type: "text",
-        name: "podUrl",
-        message: "Pod URL:",
-        initial: detectedUrl,
-    });
-    if (!podUrl)
-        return;
-    const spinner = ora("Checking pod health...").start();
-    const health = await checkPodHealth(podUrl);
-    if (!health.healthy) {
-        spinner.fail(`Pod not reachable at ${podUrl}`);
-        log.dim("Check docker compose logs, or provide the correct URL.");
-        return;
-    }
-    spinner.succeed(`Pod healthy${health.version ? ` (v${health.version})` : ""}`);
-    // Connect (generate Hub API key)
-    const apiKey = await connectStep(podUrl, opts, false);
-    if (!apiKey)
-        return;
-    // OpenClaw — always Docker on a server with an existing compose stack
-    log.heading("Step 2: OpenClaw");
-    const deployDir = findSynapDeployDir();
-    if (!deployDir) {
-        log.warn("Could not find your Synap deploy directory automatically.");
-        log.dim("Start OpenClaw manually from your synap-backend dir:");
-        log.dim("  docker compose --profile openclaw up -d openclaw");
-        log.dim("Then run: synap update");
-        return;
-    }
-    log.info(`Deploy dir: ${deployDir}`);
-    log.blank();
-    const localConfig = getLocalPodConfig();
-    // Stop any spinner before running docker compose — its output goes to stdout
-    // and will conflict with ora. We print progress directly.
-    log.info("Running: docker compose --profile openclaw up -d openclaw");
-    log.dim("(This may take a few minutes on first run — pulling image ~1GB)");
-    log.blank();
-    let ocStarted = false;
-    try {
-        startOpenClawOnServer(apiKey, localConfig?.agentUserId ?? "", localConfig?.workspaceId ?? "", podUrl, getActiveProjectId());
-        ocStarted = true;
-        log.success("OpenClaw container started");
-    }
-    catch (err) {
-        log.warn(err instanceof Error ? err.message : String(err));
-    }
-    log.blank();
-    if (ocStarted) {
-        log.info("OpenClaw is initializing (first boot takes 1-2 min).");
-        log.info("Once it's ready, run:");
-        console.log(chalk.cyan("\n  synap update\n"));
-        log.dim("This will install the skill, seed your workspace, and configure AI routing.");
-        log.dim("Check progress at any time: synap status");
+/**
+ * The pod this machine talks to. In order: --pod-url, a saved profile that
+ * answers, a pod running on this machine — and when there is none, create one
+ * instead of exiting.
+ */
+async function resolveDesktopPod(opts) {
+    if (opts.podUrl)
+        return { podUrl: opts.podUrl };
+    const saved = getLocalPodConfig();
+    if (saved?.podUrl) {
+        const spinner = ora(`Checking ${saved.podUrl}…`).start();
+        const health = await checkPodHealth(saved.podUrl);
+        if (health.healthy) {
+            spinner.succeed(`Pod: ${saved.podUrl}`);
+            return { podUrl: saved.podUrl, podId: saved.podId };
+        }
+        if (health.moved) {
+            spinner.fail();
+            throw new InitExit(INIT_EXIT.noPod, await movedPodLine(saved.podUrl, () => "Run: synap doctor --fix", true));
+        }
+        spinner.warn(`Your saved pod at ${saved.podUrl} is not answering.`);
     }
-    else {
-        log.info("Start OpenClaw manually:");
-        console.log(chalk.cyan(`\n  cd ${deployDir} && docker compose --profile openclaw up -d openclaw\n`));
-        log.dim("Then run: synap update");
+    const local = await detectLocalPod();
+    if (local) {
+        log.success(`Pod running on this machine: ${local}`);
+        return { podUrl: local };
     }
+    if (opts.unattended)
+        throw new InitExit(INIT_EXIT.noPod, "No pod found. Pass --pod-url <url>.");
+    return noPodStep();
 }
-// =============================================================================
-// PATH B: Fresh server (no OpenClaw)
-// =============================================================================
-async function pathB(opts) {
-    log.heading("Step 1: Server Setup");
-    // Last-chance check: probe localhost ports in case detection missed something
-    // (e.g. pod on a non-standard port or started after init was launched)
-    const existingUrl = await detectLocalPod();
-    if (existingUrl) {
-        log.success(`Found a running pod at ${existingUrl} — switching to connect mode`);
-        await pathBExisting(opts, existingUrl);
-        return;
-    }
-    // Resource check
-    const resources = checkServerResources();
-    log.info(`RAM: ${resources.ramTotal}MB total, ${resources.ramFree}MB free`);
-    log.info(`Disk: ${resources.diskFree} free`);
-    if (resources.ramFree < 1500) {
-        log.warn("Low RAM — Synap + OpenClaw need ~1.5GB. Performance may be affected.");
-    }
-    // What to install
-    const { installChoice } = await prompts({
+/** Sign-in first (and the default): a person with a pod on synap.live must not land on "Create". */
+export const NO_POD_CHOICES = [
+    { title: "I have one on synap.live (sign in)", value: "login" },
+    { title: "Create in browser", value: "create" },
+    { title: "I have a URL", value: "url" },
+    { title: "Self-host", value: "self-host" },
+];
+async function noPodStep() {
+    log.blank();
+    const { choice } = await prompts({
         type: "select",
-        name: "installChoice",
-        message: "What would you like to set up?",
-        choices: [
-            {
-                title: "Synap pod + OpenClaw (full stack)",
-                description: "Recommended — everything on this server",
-                value: "bundle",
-            },
-            {
-                title: "Synap pod only",
-                description: "Add OpenClaw later",
-                value: "pod-only",
-            },
-        ],
+        name: "choice",
+        message: "No Synap pod yet. Create one, or point me at yours?",
+        choices: [...NO_POD_CHOICES],
+        initial: 0,
     });
-    if (!installChoice)
-        return;
-    // Install pod
-    const podUrl = await podInstallLocalStep(opts);
-    if (!podUrl)
-        return;
-    // Get the API key once
-    const apiKey = await connectStep(podUrl, opts, false);
-    if (!apiKey)
-        return;
-    if (installChoice === "bundle") {
-        log.blank();
-        log.info("Running: docker compose --profile openclaw up -d openclaw");
-        log.dim("(First run pulls ~1GB image — this may take a few minutes)");
-        log.blank();
-        try {
-            const localConfig = getLocalPodConfig();
-            startOpenClawOnServer(apiKey, localConfig?.agentUserId ?? "", localConfig?.workspaceId ?? "", podUrl, getActiveProjectId());
-            log.success("OpenClaw container started");
+    if (!choice)
+        throw new InitExit(INIT_EXIT.cancelled, "Cancelled.");
+    if (choice === "create")
+        return createPodStep();
+    if (choice === "login") {
+        const picked = await loginAndSelectPod();
+        if (!picked)
+            throw new InitExit(INIT_EXIT.noPod, "No pod selected.");
+        return { podUrl: picked.url, podId: picked.podId || undefined };
+    }
+    if (choice === "url") {
+        const { url } = await prompts({ type: "text", name: "url", message: "Pod URL:" });
+        if (!url)
+            throw new InitExit(INIT_EXIT.cancelled, "Cancelled.");
+        const spinner = ora("Checking pod health...").start();
+        const health = await checkPodHealth(url);
+        if (health.healthy) {
+            spinner.succeed(`Pod: ${url}`);
+            return { podUrl: url };
         }
-        catch (err) {
-            log.warn(err instanceof Error ? err.message : String(err));
+        if (health.moved) {
+            spinner.fail();
+            throw new InitExit(INIT_EXIT.noPod, await movedPodLine(url, (to) => `Run: synap init --pod-url ${to}`));
         }
-        log.blank();
-        log.info("OpenClaw is initializing. Once it's ready, run:");
-        console.log(chalk.cyan("\n  synap update\n"));
-        log.dim("Check progress: synap status");
-        return;
+        spinner.fail(unreachableMessage(url, health.failure));
+        throw new InitExit(INIT_EXIT.noPod, unreachableMessage(url, health.failure), true);
     }
-    printSummary(podUrl, false);
+    log.blank();
+    log.info("On your server, run:");
+    console.log(chalk.cyan("\n  curl -fsSL https://synap.live/install.sh | bash\n"));
+    log.info("Then here: " + chalk.cyan("npx @synap-core/cli init --pod-url <your-pod-url>"));
+    throw new InitExit(INIT_EXIT.noPod, "No pod yet: self-host one, then run init with --pod-url.", true);
 }
-// =============================================================================
-// PATH C: Laptop/desktop user
-// =============================================================================
-async function pathC(opts) {
-    log.heading("Step 1: Connect to Your Pod");
-    const { hostChoice } = await prompts({
-        type: "select",
-        name: "hostChoice",
-        message: "How do you want to connect?",
-        choices: [
-            {
-                title: "Login to Synap (managed pods)",
-                description: "Sign in via browser — auto-detect your pods",
-                value: "login",
-            },
-            {
-                title: "Connect to an existing pod (enter URL)",
-                description: "Self-hosted or managed — enter the URL directly",
-                value: "existing",
-            },
-            {
-                title: "I don't have a pod yet",
-                value: "none",
-            },
-        ],
+/** Open synap.live to create a pod, then continue here once it answers. */
+async function createPodStep() {
+    log.info("Opening synap.live to create your pod…");
+    const spinner = ora("Waiting for you in the browser…").start();
+    const result = await createPodInBrowser({
+        waitForPodCallback: async () => {
+            const created = await waitForPodCallback();
+            if (created)
+                spinner.text = "Your pod is starting (usually ~2 min). I'll continue here.";
+            return created;
+        },
+        checkPodHealth,
     });
-    if (hostChoice === "login") {
-        const podResult = await loginAndSelectPod();
-        if (!podResult)
-            return;
-        await connectExistingPod(podResult.url, opts, "managed", podResult.podId);
-        return;
-    }
-    if (hostChoice === "none") {
-        const { createChoice } = await prompts({
-            type: "select",
-            name: "createChoice",
-            message: "Create a pod:",
-            choices: [
-                {
-                    title: "Managed by Synap — €15/mo",
-                    description: "We host it, zero ops",
-                    value: "managed",
-                },
-                {
-                    title: "Self-hosted on my VPS — FREE",
-                    value: "vps",
-                },
-            ],
-        });
-        if (createChoice === "managed") {
-            log.blank();
-            log.info("Opening synap.live to provision your pod...");
-            log.info(chalk.dim("(Waiting up to 5 minutes for provisioning to complete)"));
-            log.blank();
-            const spinner = ora("Waiting for pod provisioning...").start();
-            const result = await waitForPodCallback();
-            if (result) {
-                spinner.succeed(`Pod provisioned at ${chalk.cyan(result.podUrl)}`);
-                await connectExistingPod(result.podUrl, opts, "managed");
-            }
-            else {
-                spinner.fail("Pod provisioning timed out or was cancelled.");
-                log.blank();
-                log.info("You can resume at any time by running: " + chalk.cyan("synap init"));
-                log.info("Or connect manually: " + chalk.cyan(`synap connect --pod-url <your-pod-url>`));
-            }
-        }
-        else if (createChoice === "vps") {
-            log.blank();
-            log.info("SSH into your server and run:");
-            console.log(chalk.cyan("\n  curl -fsSL https://raw.githubusercontent.com/Synap-core/backend/main/install.sh | bash\n"));
-            log.info("Then on that server: npx @synap/cli init");
-        }
-        return;
-    }
-    if (hostChoice === "existing") {
-        const { url } = await prompts({
-            type: "text",
-            name: "url",
-            message: "Pod URL:",
-            initial: "https://pod.synap.live",
-        });
-        if (!url)
-            return;
-        const spinner = ora("Checking pod health...").start();
-        const status = await checkPodHealth(url);
-        if (!status.healthy) {
-            spinner.fail(`Pod not reachable at ${url}`);
-            return;
-        }
-        spinner.succeed(`Pod healthy at ${url}`);
-        // Detect if self-hosted or managed by checking URL
-        const isSynapLive = url.includes("synap.live");
-        await connectExistingPod(url, opts, isSynapLive ? "managed" : "self-hosted");
-    }
+    if (result.ok) {
+        spinner.succeed(`Pod ready: ${result.podUrl}`);
+        return { podUrl: result.podUrl };
+    }
+    if (result.reason === "not-reachable") {
+        spinner.warn(`Your pod at ${result.podUrl} is still starting.`);
+        log.info("Pick up where you left off: " + chalk.cyan(`synap init --pod-url ${result.podUrl}`));
+        throw new InitExit(INIT_EXIT.noPod, `Your pod at ${result.podUrl} is still starting.`, true);
+    }
+    spinner.fail("No pod was created (the browser window timed out or was closed).");
+    log.info("Try again any time: " + chalk.cyan("synap init"));
+    throw new InitExit(INIT_EXIT.noPod, "No pod was created.", true);
 }
 /**
- * Connect to an existing pod — handles both self-hosted and managed.
+ * This computer's key for this pod — the one `/setup/agent` accepts to mint an
+ * agent's key, and the CLI's own identity there. Reuses a saved profile for
+ * this pod while it works and is not about to expire; otherwise connects this
+ * computer through the pod's device flow (never without a person at the
+ * terminal: unattended runs pass --api-key).
+ *
+ * `grant` is set when the device flow ran now: its agents were approved with
+ * the computer, and their keys are already saved for their installers.
  */
-async function connectExistingPod(podUrl, opts, podType, podId) {
-    // Check for local OpenClaw
-    const oc = detectOpenClaw();
-    if (oc.found) {
-        log.success(`OpenClaw detected${oc.version ? ` v${oc.version}` : ""}`);
-        // Security audit removed — no longer OpenClaw-specific
-    }
-    // Get API key
-    const apiKey = await connectStep(podUrl, opts, oc.found, podId);
-    if (!apiKey)
-        return;
-    // OpenClaw handling
-    if (!oc.found) {
-        log.heading("OpenClaw");
-        const { ocChoice } = await prompts({
-            type: "select",
-            name: "ocChoice",
-            message: "OpenClaw not detected locally. What would you like to do?",
-            choices: [
-                {
-                    title: "Enable OpenClaw on my pod server (free addon)",
-                    description: "Runs alongside your pod via Docker — zero extra cost",
-                    value: "addon",
-                },
-                {
-                    title: "Install OpenClaw on this computer",
-                    description: "npm i -g openclaw",
-                    value: "local",
-                },
-                { title: "Skip OpenClaw for now", value: "skip" },
-            ],
-        });
-        if (ocChoice === "addon") {
-            if (podType === "self-hosted") {
-                log.blank();
-                log.info("SSH into your pod server and run:");
-                log.blank();
-                console.log(chalk.cyan("  cd /srv/synap && ./deploy/setup-openclaw.sh"));
-                log.blank();
-                log.info("This will start OpenClaw as a Docker addon on your pod.");
-                log.info("Then re-run: synap init --pod-url " + podUrl);
-            }
-            else {
-                // Managed pod — activate via CP (requires user session, not PROVISIONING_TOKEN)
-                log.info("Activating OpenClaw addon on your managed pod...");
-                const creds = getStoredToken();
-                try {
-                    if (!creds)
-                        throw new Error("Not logged in to CP");
-                    await enableOpenClawAddonManaged(creds.token, podUrl);
-                    log.success("OpenClaw addon provisioning started — may take a minute");
-                }
-                catch (err) {
-                    const msg = err instanceof Error ? err.message : String(err);
-                    if (msg.includes("422") || msg.includes("provisioned pod server")) {
-                        // Pod doesn't have a managed server — OpenClaw can't run server-side
-                        log.blank();
-                        log.info("Your pod doesn't have a managed server for addons.");
-                        log.info("Install OpenClaw locally instead:");
-                        log.dim("  npm i -g openclaw && openclaw onboard");
-                        log.info("Then re-run: " + chalk.cyan(`synap init --pod-url ${podUrl}`));
-                    }
-                    else {
-                        log.warn("Could not activate OpenClaw automatically.");
-                        log.dim(msg);
-                        log.info("Enable it from: https://synap.live/account/pods");
-                    }
-                }
+async function ensurePodKey(podUrl, opts, podId, agents = []) {
+    if (opts.apiKey)
+        return { key: opts.apiKey, grant: null };
+    const norm = (u) => u.replace(/\/+$/, "");
+    const saved = listPodProfiles().find((p) => norm(p.config.podUrl) === norm(podUrl));
+    if (saved?.config.hubApiKey) {
+        const res = await fetch(`${norm(podUrl)}/api/hub/auth/status`, {
+            headers: { Authorization: `Bearer ${saved.config.hubApiKey}` },
+            signal: AbortSignal.timeout(15_000),
+        }).catch(() => null);
+        const renew = computerKeyNeedsRenewal(saved.config);
+        if (res?.ok && (!renew || opts.unattended)) {
+            if (renew) {
+                log.warn(`This computer's key for this pod expires ${saved.config.keyExpiresAt}. Renew it: ${chalk.cyan("synap login")}`);
             }
+            if (!saved.active)
+                setActivePod(saved.name);
+            return { key: saved.config.hubApiKey, grant: null };
         }
-        else if (ocChoice === "local") {
-            log.blank();
-            log.info("Install OpenClaw:");
-            log.dim("  npm i -g openclaw && openclaw onboard");
-            log.info("Then re-run: synap init --pod-url " + podUrl);
-            return;
+        if (res?.ok) {
+            log.info(`This computer's key for this pod expires ${saved.config.keyExpiresAt}. Renewing it.`);
+        }
+        else if (res && (res.status === 401 || res.status === 403)) {
+            log.warn("Your saved key for this pod no longer works. Connecting this computer again.");
+        }
+        else {
+            throw new InitExit(INIT_EXIT.noKey, `Could not check your saved key for this pod (${res ? `HTTP ${res.status}` : "unreachable"}).`);
         }
     }
-    // Install skill + seed (if OpenClaw available)
-    const ocAfter = detectOpenClaw();
-    if (ocAfter.found) {
-        await skillStep(true, ocAfter);
-        await seedStep(podUrl, apiKey, ocAfter);
-        if (!opts.skipIs)
-            await isStep(podUrl, apiKey, true);
+    const { key, grant } = await connectStep(podUrl, opts, podId, agents);
+    if (key)
+        return { key, grant };
+    throw new InitExit(INIT_EXIT.noKey, opts.unattended
+        ? "No key for this pod. Pass --api-key <key>: without a person at the terminal, nobody can approve this computer."
+        : "No key for this pod, so no agent can connect yet.");
+}
+/** A pod's profile name: its host name. Never another pod's profile. */
+function podProfileName(podUrl) {
+    try {
+        return new URL(podUrl).hostname;
     }
-    else {
-        log.blank();
-        log.info("Pod connected. Once OpenClaw is running:");
-        log.dim("  Local:  openclaw skills install synap");
-        log.dim("  Docker: docker exec openclaw openclaw skills install synap");
-        log.dim("  Or run: synap update");
+    catch {
+        return "default";
     }
-    printSummary(podUrl, ocAfter.found);
 }
-async function podChoiceStep(opts) {
-    log.heading("Synap Pod");
-    if (opts.podUrl) {
-        const status = await checkPodHealth(opts.podUrl);
-        if (status.healthy) {
-            log.success(`Pod healthy at ${opts.podUrl}`);
-            return opts.podUrl;
-        }
-        log.error(`Pod not reachable at ${opts.podUrl}`);
-        return null;
+/** Save the pod as a named profile (host name) and make it active. */
+function rememberPod(config) {
+    const name = podProfileName(config.podUrl);
+    addPodProfile(name, config);
+    setActivePod(name);
+}
+async function connectAgentsStep(podUrl, humanKey, opts, requested) {
+    log.heading("Your agents");
+    const rows = detectAgents();
+    const found = rows.filter((r) => r.found);
+    const labelOf = (t) => rows.find((r) => r.target === t)?.label ?? t;
+    let picked;
+    if (requested) {
+        picked = requested;
+    }
+    else if (opts.unattended) {
+        picked = found.map((r) => r.target);
+        if (picked.length === 0)
+            log.info("No agent found on this machine.");
     }
-    // Check if pod already running locally
-    const localStatus = await checkPodHealth("http://localhost:4000");
-    if (localStatus.healthy) {
-        log.success("Pod already running at http://localhost:4000");
-        return "http://localhost:4000";
+    else {
+        log.info(found.length > 0
+            ? `Found: ${found.map((r) => r.label).join(", ")}.`
+            : "No agent found on this machine. Pick one to set up anyway, or skip.");
+        const { targets } = await prompts({
+            type: "multiselect",
+            name: "targets",
+            message: found.length > 1 ? `Connect ${found.length === 2 ? "both" : "them"}?` : "Connect:",
+            choices: rows.map((r) => ({
+                title: r.label,
+                description: r.found ? r.evidence : "not found on this machine",
+                value: r.target,
+                selected: r.found,
+            })),
+            hint: "space to toggle, enter to confirm",
+            instructions: false,
+        });
+        picked = (targets ?? []);
     }
-    const { podChoice } = await prompts({
-        type: "select",
-        name: "podChoice",
-        message: "Where should your Synap pod run?",
-        choices: [
-            {
-                title: "Login to Synap — connect to your existing pod",
-                description: "Sign in via browser and find your pod automatically",
-                value: "login",
-            },
-            {
-                title: "This machine (docker-compose) — FREE",
-                description: "Runs alongside OpenClaw, ~1.5GB RAM",
-                value: "local",
-            },
-            {
-                title: "Managed by Synap — €15/mo",
-                description: "We host it, you connect",
-                value: "managed",
-            },
-            {
-                title: "I already have a pod (enter URL)",
-                value: "existing",
-            },
-        ],
+    // One click for every key that needs approval (V1 D5): mint them all first,
+    // open ONE review page, then install with the approved keys. The same batch
+    // door `synap agents add` uses — pod-wide, no scope.
+    const result = await connectAgentsBatch({ podUrl, apiKey: humanKey }, picked, {}, {
+        labelOf,
     });
-    if (podChoice === "login") {
-        const podResult = await loginAndSelectPod();
-        return podResult?.url ?? null;
-    }
-    if (podChoice === "local") {
-        return await podInstallLocalStep(opts);
-    }
-    if (podChoice === "managed") {
-        log.blank();
-        log.info("Sign up at: " + chalk.cyan("https://synap.live"));
-        log.info("After provisioning, re-run:");
-        log.dim("  synap init --pod-url https://your-pod.synap.live");
-        return null;
-    }
-    if (podChoice === "existing") {
-        const { url } = await prompts({
-            type: "text",
-            name: "url",
-            message: "Pod URL:",
-        });
-        if (!url)
-            return null;
-        const spinner = ora("Checking pod health...").start();
-        const status = await checkPodHealth(url);
-        if (status.healthy) {
-            spinner.succeed(`Pod healthy at ${url}`);
-            return url;
+    return { ...result, connectedLabels: result.connected.map(labelOf) };
+}
+/** Prints the QR for Relay; returns the link, or null when a phone can't use this pod. */
+async function pairPhoneStep(podUrl) {
+    log.heading("Your phone");
+    const pair = buildPairLink({ podUrl, email: getStoredToken()?.email });
+    if (!pair.ok) {
+        if (pair.reason === "loopback") {
+            log.info("Pair later, once the pod has a public URL: " + chalk.cyan("synap init --pod-url https://…"));
+        }
+        else if (pair.reason === "insecure") {
+            log.info("Pair later, once the pod is served over https: " + chalk.cyan("synap init --pod-url https://…"));
+        }
+        else {
+            log.info(`Can't make a pairing link for ${podUrl}.`);
         }
-        spinner.fail(`Pod not reachable at ${url}`);
         return null;
     }
-    return null;
+    log.info("Scan with Relay so your agents can reach you. That's where their questions arrive.");
+    log.dim(`No Relay yet? ${RELAY_DOWNLOAD_URL}`);
+    console.log("\n" + (await renderTerminalQr(pair.link)));
+    log.dim(pair.link);
+    return pair.link;
 }
-async function podInstallLocalStep(opts) {
-    // Check resources first
-    const resources = checkServerResources();
-    if (resources.ramFree < 1500) {
-        log.warn(`Low RAM (${resources.ramFree}MB free). Synap needs ~1.5GB. Consider managed hosting.`);
-    }
-    const { installDomain } = await prompts({
-        type: "text",
-        name: "installDomain",
-        message: "Domain for this pod (use localhost for local setup):",
-        initial: "localhost",
-    });
-    if (!installDomain)
-        return null;
-    let installEmail = "";
-    if (installDomain !== "localhost") {
-        const emailPrompt = await prompts({
-            type: "text",
-            name: "installEmail",
-            message: "Email for Let's Encrypt SSL certificates:",
-        });
-        installEmail = emailPrompt.installEmail ?? "";
-        if (!installEmail) {
-            log.error("Email is required for non-localhost domains.");
-            return null;
-        }
+function printClosing(connected) {
+    log.blank();
+    if (connected.length === 0) {
+        console.log("  No agent connected yet. When you're ready: " + chalk.cyan("synap connect --target=claude-code"));
+        log.blank();
+        return;
     }
-    const escapedDomain = String(installDomain).replace(/'/g, "'\\''");
-    const escapedEmail = String(installEmail).replace(/'/g, "'\\''");
-    const installCmd = installDomain === "localhost"
-        ? `curl -fsSL https://raw.githubusercontent.com/Synap-core/backend/main/install.sh | bash -s -- --domain '${escapedDomain}'`
-        : `curl -fsSL https://raw.githubusercontent.com/Synap-core/backend/main/install.sh | bash -s -- --domain '${escapedDomain}' --email '${escapedEmail}'`;
+    const h = buildHandoff(connected);
+    console.log(chalk.green.bold("  ✓ Done.") + ` Try it now. In ${h.agentLabel}, say:`);
     log.blank();
-    log.info("Install Synap pod with:");
+    console.log(chalk.bold(`  "${h.prompt}"`));
     log.blank();
-    console.log(chalk.cyan(`  ${installCmd}`));
+    log.dim("More:");
+    for (const m of h.more)
+        log.dim(`  "${m}"`);
     log.blank();
-    const { proceed } = await prompts({
-        type: "confirm",
-        name: "proceed",
-        message: "Run the installer now?",
-        initial: true,
-    });
-    if (proceed) {
-        try {
-            execSync(installCmd, { stdio: "inherit" });
-            return "http://localhost:4000";
-        }
-        catch {
-            log.error("Installation failed. Check the output above.");
-            return null;
-        }
-    }
-    log.dim("Run the command above manually, then: synap init");
-    return null;
 }
-async function connectStep(podUrl, opts, openclawFound, podId) {
-    log.heading("Connect to Pod");
+/**
+ * This computer's own key for this pod: it mints each agent's key and is
+ * saved as a named profile.
+ */
+async function connectStep(podUrl, opts, podId, 
+/** Agents to ask the pod for along with this computer. */
+agents = []) {
     let apiKey = opts.apiKey;
-    if (!apiKey) {
-        // Check if user is authenticated via CP — if so, auto-generate key
-        const creds = getStoredToken();
-        const isAuthenticated = creds && new Date(creds.expiresAt) > new Date();
-        if (isAuthenticated) {
-            // User is logged in — generate API key automatically via CP session
-            // The pod trusts the user's session to create agent credentials
-            const spinner = ora("Generating API key for OpenClaw agent...").start();
-            try {
-                // Provision the user on the pod (creates Kratos identity + pod user
-                // account) AND capture the Kratos session the handshake mints. This is
-                // idempotent — safe to call on every init.
-                let sessionToken = null;
-                try {
-                    ({ sessionToken } = await provisionUserOnPod(podUrl, creds.token));
-                }
-                catch (err) {
-                    // Non-fatal here — the missing-session guard below decides what to do.
-                    log.warn(`Could not provision user on pod: ${err instanceof Error ? err.message : String(err)}`);
-                }
-                if (!sessionToken) {
-                    throw new Error("Could not establish a pod session to issue an agent key.");
-                }
-                // Canonical key issuance: mint a scoped Hub Protocol key via the pod's
-                // apiKeys.connectIntegration tRPC procedure — the same path the pod-admin
-                // /connect page and the browser use (replaces the removed CP relay).
-                const result = await setupAgentViaPod(podUrl, sessionToken, "openclaw");
-                apiKey = result.hubApiKey;
-                opts.apiKey = apiKey;
-                spinner.succeed("API key generated");
-                if (result.agentUserId) {
-                    log.dim(`Agent user: ${result.agentUserId}`);
-                }
-                log.dim(`Workspace: ${result.workspaceId}`);
-                log.blank();
-                log.info("This key lets OpenClaw read/write your knowledge graph.");
-                log.info("It's scoped to Hub Protocol operations only.");
-                // Always save to ~/.synap/pod-config.json (works even without OpenClaw)
-                saveLocalPodConfig({
-                    podUrl,
-                    podId: podId ?? undefined,
-                    workspaceId: result.workspaceId,
-                    agentUserId: result.agentUserId,
-                    hubApiKey: result.hubApiKey,
-                    savedAt: new Date().toISOString(),
-                });
-                if (openclawFound) {
-                    const config = readOpenClawConfig() ?? {};
-                    setConfigValue(config, "synap.podUrl", podUrl);
-                    setConfigValue(config, "synap.workspaceId", result.workspaceId);
-                    setConfigValue(config, "synap.agentUserId", result.agentUserId);
-                    writeOpenClawConfig(config);
-                }
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                spinner.fail(`Auto-generation failed: ${msg}`);
-                // Fall through to manual options below
-            }
-        }
-        if (!apiKey) {
-            // Manual path — not authenticated or auto-gen failed
-            const { keyChoice } = await prompts({
-                type: "select",
-                name: "keyChoice",
-                message: "How to get an API key?",
-                choices: [
-                    {
-                        title: "Generate via PROVISIONING_TOKEN",
-                        description: "Use the token from your pod's .env file",
-                        value: "generate",
-                    },
-                    {
-                        title: "Paste an existing API key",
-                        description: "From pod Settings → API Keys",
-                        value: "paste",
-                    },
-                ],
-            });
-            if (keyChoice === "paste") {
-                const { key } = await prompts({
-                    type: "password",
-                    name: "key",
-                    message: "Hub Protocol API key:",
-                });
-                apiKey = key;
-            }
-            else {
-                const { token } = await prompts({
-                    type: "password",
-                    name: "token",
-                    message: "PROVISIONING_TOKEN (from pod .env):",
-                });
-                if (token) {
-                    const spinner = ora("Creating agent credentials...").start();
-                    try {
-                        // Agents are pod-wide singletons now — setupAgent() never passed a
-                        // workspaceId in its request either, so the response's workspaceId
-                        // was already always null/"" in practice. Provision via the shared
-                        // wrapper (no enrollAgentIfNeeded: a PROVISIONING_TOKEN can't
-                        // authorize /workspaces/enroll-agent, same as before).
-                        const result = await provisionAgentKey(podUrl, token, "openclaw");
-                        apiKey = result.hubApiKey;
-                        opts.apiKey = apiKey;
-                        spinner.succeed("Credentials created");
-                        log.dim(`Agent: ${result.agentUserId}`);
-                        saveLocalPodConfig({
-                            podUrl,
-                            podId: podId ?? undefined,
-                            workspaceId: "",
-                            agentUserId: result.agentUserId,
-                            hubApiKey: result.hubApiKey,
-                            savedAt: new Date().toISOString(),
-                        });
-                        if (openclawFound) {
-                            const config = readOpenClawConfig() ?? {};
-                            setConfigValue(config, "synap.podUrl", podUrl);
-                            setConfigValue(config, "synap.agentUserId", result.agentUserId);
-                            writeOpenClawConfig(config);
-                        }
-                        if (result.agentUserId) {
-                            try {
-                                await configureAgentContext(podUrl, apiKey, "openclaw", result.agentUserId);
-                            }
-                            catch (err) {
-                                log.warn(`Agent context wizard failed: ${err instanceof Error ? err.message : String(err)}`);
-                            }
-                        }
-                    }
-                    catch (err) {
-                        spinner.fail(err instanceof Error ? err.message : String(err));
-                        return null;
-                    }
-                }
-            }
+    let grant = null;
+    // Nobody at the terminal to approve a code or paste a key.
+    if (!apiKey && opts.unattended)
+        return { key: null, grant: null };
+    // The pod's device flow: a code the person approves on any device. This
+    // computer gets its own key; the agents asked for get theirs in the same step.
+    let deviceTried = false;
+    let deviceAvailable = true;
+    const connectComputer = async () => {
+        deviceTried = true;
+        let outcome;
+        try {
+            outcome = await deviceConnect(podUrl, { agents });
         }
-    }
-    if (apiKey) {
-        log.success(`API Key: ${apiKey}`);
-        log.warn("Save this key — it will not be shown again.");
-    }
-    return apiKey ?? null;
-}
-export async function skillStep(openclawFound, oc) {
-    if (!openclawFound)
-        return;
-    log.heading("Install Skill");
-    const isDocker = oc?.runtime === "docker";
-    const containerName = oc?.containerName;
-    if (isDocker) {
-        log.dim(`Installing via docker exec ${containerName ?? "openclaw"}...`);
-    }
-    const spinner = ora("Installing synap skill...").start();
-    try {
-        installSynapSkill(isDocker ? (containerName ?? "openclaw") : undefined);
-        spinner.succeed("Synap skill installed");
-    }
-    catch (err) {
-        spinner.fail(err instanceof Error ? err.message : "Failed");
-        if (isDocker) {
-            log.dim(`Install manually: docker exec ${containerName ?? "openclaw"} openclaw skills install synap`);
+        catch (err) {
+            if (err instanceof DeviceStartError && err.status === 404)
+                deviceAvailable = false;
+            log.error(err instanceof Error ? err.message : String(err));
+            return;
         }
-        else {
-            log.dim("Install manually: openclaw skills install synap");
+        if (outcome.status !== "approved") {
+            log.error(outcome.message);
+            return;
         }
-    }
-}
-export async function seedStep(podUrl, apiKey, oc) {
-    log.heading("Seed Workspace");
-    const spinner = ora("Creating entities from OpenClaw config...").start();
-    try {
-        const count = await seedAgentEntities(podUrl, apiKey, oc);
-        spinner.succeed(`${count} entities created`);
-    }
-    catch (err) {
-        spinner.fail(err instanceof Error ? err.message : "Seed failed");
-    }
-}
-export async function isStep(podUrl, apiKey, openclawFound) {
-    log.heading("Intelligence Service");
-    // 1. Check current IS status on the pod
-    const spinner = ora("Checking Intelligence Service status...").start();
-    let isActive = false;
-    let isUrl;
-    try {
-        const statusRes = await fetch(`${podUrl}/api/provision/status`, {
-            signal: AbortSignal.timeout(5000),
-        }).catch(() => null);
-        if (statusRes?.ok) {
-            const data = (await statusRes.json());
-            const svc = data?.intelligenceService;
-            isActive = svc?.status === "active";
-            isUrl = svc?.url;
+        grant = outcome.grant;
+        apiKey = grant.computer.apiKey;
+        opts.apiKey = apiKey;
+        await saveDeviceGrant(podUrl, grant, { name: podProfileName(podUrl), podId });
+        setActivePod(podProfileName(podUrl));
+        log.success(`${grant.computer.name} connected`);
+    };
+    if (!apiKey)
+        await connectComputer();
+    // No key yet: connecting this computer again first, the advanced ways after.
+    const managed = isManagedPod(podUrl);
+    while (!apiKey) {
+        const { keyChoice } = (await prompts({
+            type: "select",
+            name: "keyChoice",
+            message: "How do you want to connect to this pod?",
+            choices: keyChoices({ managed, deviceTried, deviceAvailable }),
+        }));
+        if (keyChoice === "device") {
+            await connectComputer();
         }
-    }
-    catch {
-        // Pod may not support this endpoint — continue
-    }
-    if (isActive) {
-        spinner.succeed(`Intelligence Service active${isUrl ? ` (${isUrl})` : ""}`);
-    }
-    else {
-        spinner.stop();
-    }
-    // 2. If IS is not active, try to provision via CP (if user is logged in)
-    if (!isActive) {
-        const creds = getStoredToken();
-        if (creds) {
-            const cpUrl = process.env.SYNAP_CP_URL ?? "https://api.synap.live";
-            try {
-                const pods = await listPods(creds.token);
-                const matchingPod = pods.find((p) => (p.podUrl ?? p.url ?? "").replace(/\/+$/, "") === podUrl.replace(/\/+$/, ""));
-                if (matchingPod) {
-                    const podId = matchingPod.id;
-                    const provStatus = await fetch(`${cpUrl}/intelligence/provision/status/${podId}`, { headers: { Authorization: `Bearer ${creds.token}` } }).catch(() => null);
-                    const provData = provStatus?.ok
-                        ? (await provStatus.json())
-                        : null;
-                    if (provData?.subscribed && !provData?.cpProvisioned) {
-                        const { provision } = await prompts({
-                            type: "confirm",
-                            name: "provision",
-                            message: "Your subscription includes AI. Provision Intelligence Service on this pod?",
-                            initial: true,
-                        });
-                        if (provision) {
-                            const provSpinner = ora("Provisioning Intelligence Service...").start();
-                            try {
-                                const res = await fetch(`${cpUrl}/intelligence/provision/${podId}`, {
-                                    method: "POST",
-                                    headers: {
-                                        Authorization: `Bearer ${creds.token}`,
-                                        "Content-Type": "application/json",
-                                    },
-                                });
-                                if (res.ok) {
-                                    provSpinner.succeed("Intelligence Service provisioned successfully");
-                                    isActive = true;
-                                }
-                                else {
-                                    const err = (await res.json().catch(() => null));
-                                    provSpinner.fail(`Provisioning failed: ${err?.error ?? res.status}`);
-                                }
-                            }
-                            catch (e) {
-                                provSpinner.fail(`Provisioning error: ${e instanceof Error ? e.message : "unknown"}`);
-                            }
-                        }
-                    }
-                    else if (!provData?.subscribed) {
-                        log.dim("No AI subscription — subscribe at https://synap.live/pricing");
-                        log.dim("Skip this step with: synap update --skip-is");
-                    }
-                    else if (provData?.cpProvisioned) {
-                        log.dim("IS provisioned on CP but not yet confirmed on pod.");
-                        log.dim("Re-run 'synap update' in a minute, or reprovision from Browser Settings.");
-                    }
-                }
-                else {
-                    // Logged in but pod not found on CP account — self-hosted pod
-                    log.dim("Intelligence Service not configured on this pod.");
-                    log.dim("To enable: connect this pod to your Synap account at https://synap.live/account/pods");
-                    log.dim("Then subscribe to a plan with AI and provision from Browser Settings > Add-ons.");
-                }
-            }
-            catch {
-                log.dim("Could not reach Synap to check IS status — skipping.");
-            }
+        else if (keyChoice === "paste") {
+            apiKey = await pasteKey(podUrl, podId);
+            break;
         }
         else {
-            // No CP login — common on servers. Give clear actionable paths.
-            log.dim("Intelligence Service not active on this pod.");
-            log.blank();
-            log.dim("To enable AI routing via Synap:");
-            log.dim("  1. Log in:  synap login --token <token>  (get token at synap.live/account/tokens)");
-            log.dim("  2. Re-run:  synap update");
-            log.blank();
-            log.dim("Or skip AI for now: synap update --skip-is");
+            break;
         }
     }
-    // 3. Configure OpenClaw provider (if found and IS is active)
-    if (openclawFound && isActive) {
-        const ocRuntime = detectOpenClaw();
-        const { configureOc } = await prompts({
-            type: "confirm",
-            name: "configureOc",
-            message: "Configure Synap IS as OpenClaw AI provider?",
-            initial: true,
+    return { key: apiKey ?? null, grant };
+}
+/** Ask for a key the person copies from their pod; saved as this pod's profile. */
+async function pasteKey(podUrl, podId) {
+    const { key } = await prompts({
+        type: "password",
+        name: "key",
+        message: "API key:",
+    });
+    if (key) {
+        rememberPod({
+            podUrl,
+            podId: podId ?? undefined,
+            workspaceId: "",
+            agentUserId: "",
+            hubApiKey: key,
+            savedAt: new Date().toISOString(),
         });
-        if (configureOc) {
-            // Fetch real model IDs from the pod so OpenClaw shows actual provider names
-            const { fetchPodProviders } = await import("./providers.js");
-            const podProviders = await fetchPodProviders(podUrl, apiKey);
-            const models = podProviders.flatMap((p) => p.models.map((m) => ({
-                id: `${p.providerId}/${m.id}`,
-                name: `${p.name} — ${m.id}`,
-                ...(m.contextWindow ? { contextWindow: m.contextWindow } : {}),
-            })));
-            if (models.length === 0) {
-                log.warn("No model IDs found — configure models in pod admin → Intelligence → Providers.");
-                log.dim("Skipping OpenClaw AI provider setup. Re-run: synap update");
-                return;
-            }
-            const synapProvider = {
-                baseUrl: `${podUrl}/v1`,
-                api: "openai-completions",
-                apiKey,
-                models,
-            };
-            if (ocRuntime.runtime === "docker") {
-                const containerName = ocRuntime.containerName ?? "openclaw";
-                const spinner = ora("Writing Synap IS provider to OpenClaw config...").start();
-                try {
-                    execSync(`docker exec ${containerName} openclaw config set models.providers.synap ${JSON.stringify(JSON.stringify(synapProvider))}`, { stdio: "pipe", timeout: 15000 });
-                    spinner.succeed("Synap IS registered as OpenClaw provider");
-                    log.dim(`Models: ${models.slice(0, 3).map((m) => m.id).join(", ")}${models.length > 3 ? ` +${models.length - 3} more` : ""}`);
-                    try {
-                        execSync(`docker restart ${containerName}`, { stdio: "pipe", timeout: 30000 });
-                        log.dim("Container restarted to pick up new config");
-                    }
-                    catch {
-                        log.warn("Restart failed — run manually: docker restart openclaw");
-                    }
-                }
-                catch (err) {
-                    const stderr = err.stderr?.toString().trim();
-                    spinner.fail("Failed to set Synap IS provider");
-                    if (stderr)
-                        log.dim(stderr);
-                    log.dim(`  docker exec ${containerName} openclaw config set models.providers.synap.baseUrl ${podUrl}/v1`);
-                }
-            }
-            else {
-                const config = readOpenClawConfig() ?? {};
-                setConfigValue(config, "models.providers.synap", synapProvider);
-                writeOpenClawConfig(config);
-                log.success("Synap IS configured as OpenClaw provider — restart OpenClaw to apply");
-                log.dim(`Models: ${models.slice(0, 3).map((m) => m.id).join(", ")}${models.length > 3 ? ` +${models.length - 3} more` : ""}`);
-            }
-        }
     }
+    return key || undefined;
 }
-function printSummary(podUrl, openclawConnected) {
-    log.blank();
-    console.log(chalk.green("═══════════════════════════════════════════"));
-    console.log(chalk.green.bold("  Synap Setup Complete"));
-    console.log(chalk.green("═══════════════════════════════════════════"));
-    log.blank();
-    log.info(`Pod: ${podUrl}`);
-    if (openclawConnected)
-        log.info("Skill: synap (knowledge graph + relay)");
-    log.blank();
-    if (openclawConnected) {
-        log.info("Try it now:");
-        log.dim('  Ask your agent: "remember that Marc prefers email"');
-        log.dim('  Then later: "what do I know about Marc?"');
+/**
+ * `synap login` with no pod saved: sign in to the Synap account, pick one of
+ * its pods, issue this machine's key and save the profile — the same steps as
+ * init's "sign in" path. Returns the pod URL, or null when no pod came of it.
+ */
+export async function signInAndSavePod() {
+    try {
+        const pod = await loginAndSelectPod();
+        if (!pod)
+            return null;
+        const wanted = detectAgents().filter((r) => r.found).map((r) => r.target);
+        const { key, grant } = await ensurePodKey(pod.url, {}, pod.podId || undefined, wanted);
+        // Approved with the computer: write each agent's own key into its config.
+        if (grant)
+            await wireApprovedAgents(pod.url, key, grant);
+        return pod.url;
     }
-    log.blank();
-    log.dim("  synap status         — health check");
-    log.dim("  synap status          — verify security");
-    log.blank();
-    if (!openclawConnected) {
-        log.info("OpenClaw is provisioning on your pod server (2-5 min).");
-        log.info("Once it's ready, run:");
-        log.blank();
-        console.log(chalk.cyan("  synap update"));
-        log.blank();
-        log.dim("This will install the skill, seed your workspace, and configure AI routing.");
-        log.dim("Check progress: synap status");
+    catch (err) {
+        if (!(err instanceof InitExit))
+            throw err;
+        if (!err.shown)
+            log.error(err.message);
+        return null;
     }
 }
 async function loginAndSelectPod() {
     // Check if already logged in
     const authStatus = await isLoggedIn();
-    if (!authStatus.valid) {
-        log.info("Opening browser to sign in and select your pod...");
-        const spinner = ora("Waiting for browser authentication...").start();
+    if (authStatus.valid) {
+        log.success(`Already logged in as ${authStatus.email}`);
+    }
+    else {
+        log.info("You are not currently logged in to Synap.");
+    }
+    let storedToken = getStoredToken();
+    if (!storedToken || !authStatus.valid) {
+        // No token or not valid — need to login
+        log.info("Sign in to Synap and pick your pod.");
         const creds = await login();
         if (!creds) {
-            spinner.fail("Authentication timed out or failed");
+            log.error("Sign-in timed out or failed.");
             log.dim("Try again or use --pod-url to connect directly");
             return null;
         }
-        spinner.succeed(`Authenticated as ${creds.email}`);
+        log.success(`Signed in as ${creds.email}`);
         // If the web flow already performed pod selection, use that result directly.
         if (creds.podUrl && creds.podId) {
             const healthSpinner = ora("Checking pod health...").start();
@@ -969,39 +514,58 @@ async function loginAndSelectPod() {
                 healthSpinner.succeed(`Pod ready at ${creds.podUrl}`);
                 return { url: creds.podUrl, podId: creds.podId };
             }
-            healthSpinner.warn(`Pod selected (${creds.podUrl}) but not yet reachable — may still be provisioning`);
+            healthSpinner.warn(`Pod selected (${creds.podUrl}) but not yet reachable. It may still be provisioning.`);
             return { url: creds.podUrl, podId: creds.podId };
         }
+        // After login, re-fetch stored token (login() writes credentials)
+        storedToken = getStoredToken();
     }
-    else {
-        log.success(`Already logged in as ${authStatus.email}`);
-    }
-    const token = getStoredToken();
-    if (!token)
+    // We have a valid token
+    if (!storedToken) {
+        log.warn("No stored credentials found. Please sign in.");
         return null;
+    }
     // Short-circuit if credentials already carry a pod from a previous web-based selection.
-    if (token.podUrl && token.podId) {
-        return { url: token.podUrl, podId: token.podId };
+    if (storedToken.podUrl && storedToken.podId) {
+        log.info(`You have a previously selected pod: ${storedToken.podUrl}`);
+        const { useExisting } = await prompts({
+            type: "confirm",
+            name: "useExisting",
+            message: "Use this pod?",
+            initial: true,
+        });
+        if (useExisting) {
+            const healthSpinner = ora("Checking pod health...").start();
+            const status = await checkPodHealth(storedToken.podUrl);
+            if (status.healthy) {
+                healthSpinner.succeed(`Pod healthy at ${storedToken.podUrl}`);
+                return { url: storedToken.podUrl, podId: storedToken.podId };
+            }
+            healthSpinner.fail(`Pod not reachable at ${storedToken.podUrl}`);
+            log.blank();
+        }
+        // Fall through to pod selection if user doesn't want to use existing pod or pod is unreachable
     }
     // List pods
     const podsSpinner = ora("Fetching your pods...").start();
     try {
-        const pods = await listPods(token.token);
+        const pods = await listPods(storedToken.token);
         if (pods.length === 0) {
-            podsSpinner.info("No pods found on your account");
-            log.blank();
-            log.info("Create a pod at: " + chalk.cyan("https://synap.live"));
-            log.info("Then re-run: " + chalk.dim("synap init"));
-            return null;
+            podsSpinner.info("No pods on your account yet");
+            const created = await createPodStep();
+            return created ? { url: created.podUrl, podId: "" } : null;
         }
         podsSpinner.succeed(`Found ${pods.length} pod(s)`);
+        log.blank();
+        log.info("Your available pods:");
         if (pods.length === 1) {
             const pod = pods[0];
-            const podUrl = pod.url || `https://${pod.subdomain}.synap.live`;
+            const podUrl = podUrlOf(pod);
+            log.dim(`  • ${podUrl} (${pod.status})`);
             const { connect } = await prompts({
                 type: "confirm",
                 name: "connect",
-                message: `Connect to ${podUrl}?`,
+                message: `Connect to this pod?`,
                 initial: true,
             });
             if (!connect)
@@ -1021,17 +585,16 @@ async function loginAndSelectPod() {
             name: "selectedPodUrl",
             message: "Which pod do you want to connect to?",
             choices: pods.map((pod) => {
-                const podUrl = pod.url || `https://${pod.subdomain}.synap.live`;
+                const podUrl = podUrlOf(pod);
                 return {
-                    title: `${pod.subdomain} (${pod.status}) — ${pod.region}`,
-                    description: podUrl,
+                    title: `${pod.subdomain} · ${new URL(podUrl).host} (${pod.status})`,
                     value: podUrl,
                 };
             }),
         });
         if (!selectedPodUrl)
             return null;
-        const selectedPod = pods.find((p) => (p.url || `https://${p.subdomain}.synap.live`) === selectedPodUrl);
+        const selectedPod = pods.find((p) => podUrlOf(p) === selectedPodUrl);
         const healthSpinner = ora("Checking pod health...").start();
         const status = await checkPodHealth(selectedPodUrl);
         if (status.healthy) {
@@ -1049,83 +612,13 @@ async function loginAndSelectPod() {
 // =============================================================================
 // HELPERS
 // =============================================================================
-function detectServer() {
-    try {
-        const platform = process.platform;
-        if (platform !== "linux")
-            return false;
-        execSync("docker info >/dev/null 2>&1", { timeout: 5000 });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Does the environment carry ANY signal that a Synap pod exists somewhere?
- * Used by `init` to decide whether to run the full flow or short-circuit
- * with a "no pod detected" instruction message.
- *
- * Treat these as signals (in cheap-to-expensive order):
- *   1. SYNAP_POD_URL env var
- *   2. A stored ~/.synap/pod-config.json from a previous run
- *   3. A running pod detected on this machine
- *   4. An OpenClaw install that already has synap.podUrl configured
- */
-async function hasAnyPodSignal() {
-    if (process.env.SYNAP_POD_URL)
-        return true;
-    if (getLocalPodConfig()?.podUrl)
-        return true;
-    // OpenClaw may already carry a pod URL in its config — respect that.
-    try {
-        const oc = detectOpenClaw();
-        const ocSynap = oc.config?.synap;
-        if (typeof ocSynap?.podUrl === "string" && ocSynap.podUrl.length > 0)
-            return true;
-    }
-    catch {
-        // ignore — detection is best-effort
-    }
-    // Last: probe the local machine. This is the expensive step.
-    const local = await detectLocalPod();
-    return Boolean(local);
-}
-function printNoPodInstructions() {
-    const line = "─".repeat(63);
-    console.log(`
-┌${line}┐
-│ No Synap pod detected.                                        │
-│                                                               │
-│ You need a running pod before using @synap/cli init.          │
-│                                                               │
-│ Options:                                                      │
-│                                                               │
-│   1. Self-host on a server (free):                            │
-│      On your server, run:                                     │
-│        curl -fsSL https://synap.live/install.sh | bash        │
-│      Then come back and run:                                  │
-│        npx @synap-core/cli init --pod-url https://your-pod... │
-│                                                               │
-│   2. Use a hosted pod ($):                                    │
-│      Sign up at https://synap.live                            │
-│      Then run:                                                │
-│        npx @synap-core/cli init --pod-url <your-pod-url>      │
-│                                                               │
-│   3. Already running locally? Pass --pod-url:                 │
-│        npx @synap-core/cli init --pod-url http://localhost:4000 │
-└${line}┘
-`);
-}
-function printUnreachablePodInstructions(podUrl) {
+function printUnreachablePodInstructions(podUrl, failure) {
     console.log("");
-    log.error(`Pod at ${podUrl} is not reachable.`);
+    log.error(unreachableMessage(podUrl, failure));
     log.blank();
     log.info("Checklist:");
-    log.dim("  - Is the pod URL correct? (scheme + host + port)");
-    log.dim("  - Is the pod container running? On the server: ./synap health");
-    log.dim("  - Is there a firewall or reverse proxy in the way?");
-    log.dim("  - For localhost setups, did you start the stack? ./synap start");
+    for (const line of reachChecklist(failure))
+        log.dim(`  ${line}`);
     log.blank();
     log.info("Once the pod is reachable, re-run:");
     log.dim(`  npx @synap-core/cli init --pod-url ${podUrl}`);
@@ -1145,6 +638,13 @@ async function detectLocalPod() {
     // ── 1. Env var ──────────────────────────────────────────────────────────
     if (process.env.SYNAP_POD_URL)
         return process.env.SYNAP_POD_URL;
+    return probeThisMachineForPod();
+}
+/**
+ * Steps 2-4 of detectLocalPod: a pod actually running on this machine. The
+ * env var is left out on purpose: it points at a pod, often a remote one.
+ */
+async function probeThisMachineForPod() {
     const candidates = [];
     // ── 2. Deploy dir scan ──────────────────────────────────────────────────
     // Look for a .env that has PUBLIC_URL or DOMAIN, which tells us the