failproofai 1.0.11-beta.4 → 1.0.12-beta.0

package/dist/cli.mjs

@@ -29,7 +29,7 @@ var __esm = (fn, res, err) => () => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // package.json
-var version2 = "1.0.11-beta.4", package_default;
+var version2 = "1.0.12-beta.0", package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "failproofai",
@@ -114,7 +114,7 @@ var init_package = __esm(() => {
       access: "public"
     },
     devDependencies: {
-      "@anthropic-ai/sdk": "^0.133.0",
+      "@anthropic-ai/sdk": "^0.135.0",
       "@mdx-js/mdx": "^3.1.1",
       "@tailwindcss/postcss": "^4.3.1",
       "@tanstack/react-virtual": "^3.14.10",
@@ -150,7 +150,7 @@ var init_package = __esm(() => {
       nanoid: "3.3.18",
       postcss: "8.5.26",
       "eslint-plugin-react-hooks": "7.0.1",
-      vite: "8.0.16",
+      vite: "8.1.6",
       undici: "7.29.1",
       "brace-expansion": "5.0.12",
       sharp: "0.35.5",
@@ -158,16 +158,16 @@ var init_package = __esm(() => {
       browserslist: "4.28.8"
     },
     optionalDependencies: {
-      "@failproofai/failproofaid-linux-x64": "1.0.11-beta.4",
-      "@failproofai/failproofaid-linux-arm64": "1.0.11-beta.4",
-      "@failproofai/failproofaid-darwin-x64": "1.0.11-beta.4",
-      "@failproofai/failproofaid-darwin-arm64": "1.0.11-beta.4"
+      "@failproofai/failproofaid-linux-x64": "1.0.12-beta.0",
+      "@failproofai/failproofaid-linux-arm64": "1.0.12-beta.0",
+      "@failproofai/failproofaid-darwin-x64": "1.0.12-beta.0",
+      "@failproofai/failproofaid-darwin-arm64": "1.0.12-beta.0"
     },
     failproofaidBinaries: {
-      "linux-x64": "cd8b119c3564df2537c1dffc700931e6a44445acbac3f66d013897513d36ff15",
-      "linux-arm64": "1a25a9f0118b727dcdae3154f26907d0733c9bd7bfdf5271bf7d359c7224e93e",
-      "darwin-x64": "fc25edbc30ef0505dbf1a3f34064a04b92b4b949f550a48d3bd051b3f5168c5f",
-      "darwin-arm64": "c44d4bd89db1532d9307b5d18e5351465d73124e0de5eb367944951393af6b29"
+      "linux-x64": "61710dd6261ff0deb1116e390c366c26809bf04bb2e2c16f279b7d79e1819049",
+      "linux-arm64": "5e9501522d35b32790664b4f3b1b90aa1728629f5013df94e72c2e2a11842bd2",
+      "darwin-x64": "e9d195cf30b6bc2427b7cbe89e354cc8dab7ae02e7c45a7e44a941eda84c2674",
+      "darwin-arm64": "d70ae3a3b8073ace0852a20671dba3d32f380b97ed4a01f5791a13d2fa12e63b"
     }
   };
 });
@@ -20171,6 +20171,199 @@ function promptCloudKey(opts) {
     });
   });
 }
+function slowedDown(interval) {
+  return Math.max(interval, Math.min(10, interval + 2));
+}
+function promptBrowserLogin(opts) {
+  const stdin = opts.stdin ?? process.stdin;
+  const stdout = opts.stdout ?? process.stdout;
+  if (!stdin.isTTY || !stdout.isTTY)
+    return Promise.resolve(null);
+  const now = opts.now ?? Date.now;
+  const c = paint(colorsEnabled(stdout));
+  const kit = screenKit({ cols: stdout.columns || 80, color: colorsEnabled(stdout) });
+  const spinnerFrames = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏";
+  const region = { lastCount: 0 };
+  let phase = "starting";
+  let failLine = "";
+  let cautionLine = "";
+  let expiresAt = 0;
+  let interval = 2;
+  let frame = 0;
+  let settled = false;
+  let headingShown = false;
+  const above = [];
+  let pollTimer = null;
+  let spinTimer = null;
+  let attempt = 0;
+  const countdown = () => {
+    const left = Math.max(0, Math.ceil((expiresAt - now()) / 1000));
+    return `${Math.floor(left / 60)}:${String(left % 60).padStart(2, "0")}`;
+  };
+  const build = () => {
+    const spin = c.ink3(spinnerFrames[frame % spinnerFrames.length]);
+    switch (phase) {
+      case "starting":
+        return [`${INDENT}${spin} Getting a link…`];
+      case "waiting":
+        return [
+          `${INDENT}${spin} Waiting for you to authorize in the browser  ${c.ink3(`· expires in ${countdown()}`)}`,
+          ...cautionLine ? [kit.caution(cautionLine)] : [],
+          "",
+          kit.keys(["tab more options", "ctrl-c cancel"])
+        ];
+      case "expired":
+        return [kit.fail("That link expired."), "", kit.keys(["enter new link", "tab more options"])];
+      case "denied":
+        return [kit.fail("Not authorized in the browser."), "", kit.keys(["enter try again", "tab more options"])];
+      case "failed":
+        return [kit.fail(failLine), "", kit.keys(["enter try again", "tab more options"])];
+    }
+  };
+  const draw = () => {
+    if (settled)
+      return;
+    repaint(stdout, region, headingShown ? build() : [promptHeading(c, opts.message, opts.meta), ...build()]);
+  };
+  const printAbove = (lines) => {
+    const clear = region.lastCount > 0 ? `${ESC}[${region.lastCount}A${ESC}[J` : "";
+    stdout.write(`${clear}${lines.join(`
+`)}
+`);
+    region.lastCount = 0;
+    above.push(...lines);
+  };
+  const clearPoll = () => {
+    if (pollTimer)
+      clearTimeout(pollTimer);
+    pollTimer = null;
+  };
+  const restoreTerminal = () => showCursor(stdout);
+  return new Promise((resolve) => {
+    const wasRaw = stdin.isRaw;
+    const finish = (answer) => {
+      if (settled)
+        return;
+      clearPoll();
+      if (spinTimer)
+        clearInterval(spinTimer);
+      stdin.removeListener("keypress", onKey);
+      stdin.setRawMode?.(wasRaw ?? false);
+      stdin.pause();
+      process.removeListener("exit", restoreTerminal);
+      if (answer === BACK) {
+        const cols = stdout.columns || 80;
+        for (const line of above)
+          region.lastCount += Math.max(1, Math.ceil(visibleWidth(line) / cols));
+      }
+      const lines = answer === null ? [c.ink3("cancelled")] : answer === BACK ? [] : opts.collapsed(answer.value);
+      repaint(stdout, region, lines, { cut: false });
+      settled = true;
+      restoreTerminal();
+      resolve(answer);
+    };
+    const schedulePoll = (forAttempt) => {
+      clearPoll();
+      pollTimer = setTimeout(() => void pollOnce(forAttempt), interval * 1000);
+    };
+    const pollOnce = async (forAttempt) => {
+      let answer;
+      try {
+        answer = await opts.poll();
+      } catch (err) {
+        answer = { state: "unreachable", line: err instanceof Error ? err.message : String(err) };
+      }
+      if (settled || forAttempt !== attempt)
+        return;
+      switch (answer.state) {
+        case "approved":
+          return finish({ value: answer.value });
+        case "denied":
+          phase = "denied";
+          return draw();
+        case "expired":
+          phase = "expired";
+          return draw();
+        case "slow_down":
+          interval = slowedDown(interval);
+          break;
+        case "unreachable":
+          cautionLine = `Can't reach the server right now (${answer.line}) — still trying.`;
+          break;
+        case "pending":
+          cautionLine = "";
+          if (answer.interval && answer.interval > 0)
+            interval = answer.interval;
+          break;
+      }
+      if (now() > expiresAt + interval * 1000) {
+        phase = "expired";
+        return draw();
+      }
+      draw();
+      schedulePoll(forAttempt);
+    };
+    const begin = async () => {
+      const mine = ++attempt;
+      clearPoll();
+      cautionLine = "";
+      phase = "starting";
+      draw();
+      let started;
+      try {
+        started = await opts.start();
+      } catch (err) {
+        started = { ok: false, line: err instanceof Error ? err.message : String(err), retryable: true };
+      }
+      if (settled || mine !== attempt)
+        return;
+      if (!started.ok) {
+        if (!started.retryable)
+          return finish(BACK);
+        phase = "failed";
+        failLine = started.line;
+        return draw();
+      }
+      expiresAt = now() + started.expiresIn * 1000;
+      interval = started.interval > 0 ? started.interval : 2;
+      const opened = opts.open(started.url);
+      printAbove([
+        ...headingShown ? [] : [promptHeading(c, opts.message, opts.meta)],
+        opened ? `${INDENT}Opening your browser to connect ${opts.machineLabel}. If it doesn't open, use this link:` : `${INDENT}Open this link in any browser to connect ${opts.machineLabel}:`,
+        `${INDENT}${c.bold(started.url)}`,
+        ""
+      ]);
+      headingShown = true;
+      phase = "waiting";
+      draw();
+      schedulePoll(mine);
+    };
+    function onKey(_str, key) {
+      if (!key || settled)
+        return;
+      if (key.ctrl && (key.name === "c" || key.name === "d"))
+        return finish(null);
+      if (key.name === "escape" || key.name === "tab")
+        return finish(BACK);
+      if ((key.name === "return" || key.name === "enter") && phase !== "waiting" && phase !== "starting") {
+        begin();
+      }
+    }
+    process.once("exit", restoreTerminal);
+    readline.emitKeypressEvents(stdin);
+    stdin.setRawMode?.(true);
+    stdin.resume();
+    hideCursor(stdout);
+    stdin.on("keypress", onKey);
+    spinTimer = setInterval(() => {
+      frame++;
+      if (phase === "waiting" || phase === "starting")
+        draw();
+    }, 120);
+    spinTimer.unref?.();
+    begin();
+  });
+}
 function ctx(opts) {
   return { cols: Math.max(20, opts?.cols ?? 80), c: paint(opts?.color ?? false) };
 }
@@ -33272,6 +33465,195 @@ var init_first_run_gate = __esm(() => {
   ];
 });
 
+// src/hooks/cloud-login.ts
+async function postJson2(origin, path, body, fetchImpl) {
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const res = await fetchImpl(`${origin.replace(/\/+$/, "")}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      redirect: "manual",
+      signal: controller.signal
+    });
+    let json = null;
+    try {
+      const parsed = await res.json();
+      json = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    } catch {
+      json = null;
+    }
+    return { status: res.status, json };
+  } catch (err) {
+    return { error: err instanceof Error ? err.name === "AbortError" ? "timed out" : err.message : String(err) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function displayText(v, max = 200) {
+  if (typeof v !== "string")
+    return;
+  const t = v.replace(INVISIBLE, "").trim().slice(0, max);
+  return t.length > 0 ? t : undefined;
+}
+function org(v) {
+  const o = v && typeof v === "object" ? v : {};
+  return { id: str3(o.id), slug: displayText(o.slug), name: displayText(o.name) };
+}
+function permissions(v) {
+  return Array.isArray(v) ? v.map((p) => displayText(p, 64)).filter((p) => p !== undefined) : [];
+}
+function isOpenableUrl(raw) {
+  try {
+    const u = new URL(raw);
+    return u.protocol === "https:" || u.protocol === "http:";
+  } catch {
+    return false;
+  }
+}
+function machineOs(platform = process.platform) {
+  return platform === "darwin" ? "macOS" : platform === "win32" ? "windows" : platform;
+}
+async function startLogin(origin, machine, fetchImpl = fetch) {
+  const r = await postJson2(origin, LOGIN_START_PATH, { machine_label: machine.label, machine_os: machine.os, cli_version: machine.cliVersion }, fetchImpl);
+  if ("error" in r)
+    return { kind: "unreachable", reason: r.error };
+  if (r.status === 404 || r.status >= 300 && r.status < 400)
+    return { kind: "unsupported" };
+  if (r.status === 429)
+    return { kind: "refused", reason: "too many login attempts from here — wait a minute" };
+  if (r.status !== 201 || !r.json) {
+    return r.status >= 500 ? { kind: "unreachable", reason: `the server answered ${r.status}` } : { kind: "refused", reason: displayText(r.json?.error, 120) ?? `the server answered ${r.status}` };
+  }
+  const verificationUrl = str3(r.json.verification_url);
+  const pollSecret = str3(r.json.poll_secret);
+  if (!verificationUrl || !pollSecret || !isOpenableUrl(verificationUrl)) {
+    return { kind: "unsupported" };
+  }
+  return {
+    kind: "ok",
+    verificationUrl: new URL(verificationUrl).href,
+    pollSecret,
+    expiresIn: within(r.json.expires_in, 30, 3600, 600),
+    interval: within(r.json.interval, 1, 30, 2)
+  };
+}
+async function pollLogin(origin, pollSecret, fetchImpl = fetch) {
+  const r = await postJson2(origin, LOGIN_POLL_PATH, { poll_secret: pollSecret }, fetchImpl);
+  if ("error" in r)
+    return { kind: "unreachable", reason: r.error };
+  if (r.status === 404)
+    return { kind: "unknown" };
+  if (r.status !== 200 || !r.json)
+    return { kind: "unreachable", reason: `the server answered ${r.status}` };
+  const j = r.json;
+  switch (j.status) {
+    case "pending":
+      return { kind: "pending", interval: typeof j.interval === "number" ? within(j.interval, 1, 30, 2) : undefined };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "approved":
+      return {
+        kind: "approved",
+        org: org(j.org),
+        approvedBy: displayText(j.approved_by),
+        keyName: displayText(j.key_name),
+        permissions: permissions(j.permissions)
+      };
+    case "denied":
+      return { kind: "denied" };
+    case "expired":
+      return { kind: "expired" };
+    case "claimed":
+      return { kind: "claimed" };
+    default:
+      return { kind: "unknown" };
+  }
+}
+async function claimLogin(origin, pollSecret, fetchImpl = fetch) {
+  const r = await postJson2(origin, LOGIN_CLAIM_PATH, { poll_secret: pollSecret }, fetchImpl);
+  if ("error" in r)
+    return { kind: "unreachable", reason: r.error };
+  const j = r.json ?? {};
+  if (r.status === 201) {
+    const key = str3(j.api_key);
+    if (!key)
+      return { kind: "refused", reason: "the server answered without a key" };
+    return {
+      kind: "ok",
+      key,
+      keyId: str3(j.key_id),
+      keyName: displayText(j.key_name),
+      org: org(j.org),
+      permissions: permissions(j.permissions),
+      approvedBy: displayText(j.approved_by)
+    };
+  }
+  if (r.status === 410)
+    return { kind: "expired" };
+  if (r.status === 403 && j.error === "approval_revoked")
+    return { kind: "revoked" };
+  if (r.status >= 500)
+    return { kind: "unreachable", reason: `the server answered ${r.status}` };
+  return {
+    kind: "refused",
+    reason: displayText(j.status, 40) ? `the login request is ${displayText(j.status, 40)}` : `the server answered ${r.status}`
+  };
+}
+var LOGIN_START_PATH = "/api/auth/cli/start", LOGIN_POLL_PATH = "/api/auth/cli/poll", LOGIN_CLAIM_PATH = "/api/auth/cli/claim", TIMEOUT_MS = 1e4, str3 = (v) => typeof v === "string" && v.length > 0 ? v : undefined, INVISIBLE, within = (v, lo, hi, fallback) => typeof v === "number" && Number.isFinite(v) && v > 0 ? Math.min(hi, Math.max(lo, v)) : fallback;
+var init_cloud_login = __esm(() => {
+  INVISIBLE = /[\u0000-\u001f\u007f-\u009f\u061c\u180e\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff]/g;
+});
+
+// src/audit/open-browser.ts
+import { spawn } from "node:child_process";
+function canOpenBrowser(env = process.env, platform = process.platform) {
+  if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY)
+    return false;
+  if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY)
+    return false;
+  return true;
+}
+function openUrl(url) {
+  let cmd;
+  let args;
+  if (process.platform === "darwin") {
+    cmd = "open";
+    args = [url];
+  } else if (process.platform === "win32") {
+    cmd = "cmd";
+    args = ["/c", "start", "", url];
+  } else {
+    cmd = "xdg-open";
+    args = [url];
+  }
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+  } catch {}
+}
+function openWhenReady(port, path) {
+  const base = `http://localhost:${port}`;
+  const target = `${base}${path}`;
+  (async () => {
+    const deadline = Date.now() + POLL_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      try {
+        await fetch(base, { method: "GET", redirect: "manual" });
+        openUrl(target);
+        return;
+      } catch {
+        await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+      }
+    }
+    openUrl(target);
+  })();
+}
+var POLL_INTERVAL_MS = 150, POLL_TIMEOUT_MS = 30000;
+var init_open_browser = () => {};
+
 // src/cli-error.ts
 var CliError;
 var init_cli_error = __esm(() => {
@@ -34336,8 +34718,8 @@ async function introspectKey(origin, token, fetchImpl = fetch, timeoutMs = 1e4)
     identity: {
       keyId: typeof b.key_id === "string" ? b.key_id : undefined,
       orgId: typeof b.org_id === "string" ? b.org_id : undefined,
-      orgSlug: typeof b.org_slug === "string" ? b.org_slug : undefined,
-      orgName: typeof b.org_name === "string" ? b.org_name : undefined,
+      orgSlug: displayText(b.org_slug),
+      orgName: displayText(b.org_name),
       permissions: b.permissions.filter((p) => typeof p === "string"),
       expiresAt: typeof b.expires_at === "string" ? b.expires_at : null,
       otelIngest: typeof b.otel_ingest === "boolean" ? b.otel_ingest : undefined
@@ -34353,6 +34735,9 @@ function describeOrg(identity) {
   return identity.orgName ?? identity.orgSlug ?? identity.orgId ?? "an unknown organisation";
 }
 var INTROSPECT_PATH = "/v1/auth/introspect", PERMISSION_EVENTS = "events:add", PERMISSION_POLICIES = "policies:pull", PERMISSION_JEV = "jev:evaluate";
+var init_cloud_introspect = __esm(() => {
+  init_cloud_login();
+});
 
 // src/hooks/credential-recovery.ts
 import { createHash as createHash11 } from "node:crypto";
@@ -34734,10 +35119,10 @@ async function connectToCloud(input) {
     const { since: _drop, ...kept } = orgSwitch ? {} : prev.org ?? {};
     next.org = { ...kept, ...since };
   }
+  writeCredentials(next);
   if (ingestResult.ok && prev.ingest && prev.ingest.key !== input.token) {
     recoverCredentialRefusals(Boolean(prev.org?.id && prev.org.id === known?.orgId && sameOrigin(prev.ingest.url)), prev.org?.id);
   }
-  writeCredentials(next);
   if (process.env.FAILPROOFAI_CLOUD_CREDENTIALS) {
     if (policyResult.ok)
       writeCloudCredentials(creds);
@@ -34884,6 +35269,7 @@ var init_cloud_connection = __esm(() => {
   init_cloud_enrollment();
   init_fp_home();
   init_fp_config();
+  init_cloud_introspect();
   init_effective_reviewers();
   init_collector_config();
   init_credential_recovery();
@@ -37279,47 +37665,6 @@ function sanitizeErrorMessage(err) {
 var MAX_ERROR_MESSAGE_LEN = 300;
 var init_telemetry_sanitize = () => {};
 
-// src/audit/open-browser.ts
-import { spawn } from "node:child_process";
-function openUrl(url) {
-  let cmd;
-  let args;
-  if (process.platform === "darwin") {
-    cmd = "open";
-    args = [url];
-  } else if (process.platform === "win32") {
-    cmd = "cmd";
-    args = ["/c", "start", "", url];
-  } else {
-    cmd = "xdg-open";
-    args = [url];
-  }
-  try {
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
-    child.on("error", () => {});
-    child.unref();
-  } catch {}
-}
-function openWhenReady(port, path) {
-  const base = `http://localhost:${port}`;
-  const target = `${base}${path}`;
-  (async () => {
-    const deadline = Date.now() + POLL_TIMEOUT_MS;
-    while (Date.now() < deadline) {
-      try {
-        await fetch(base, { method: "GET", redirect: "manual" });
-        openUrl(target);
-        return;
-      } catch {
-        await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-      }
-    }
-    openUrl(target);
-  })();
-}
-var POLL_INTERVAL_MS = 150, POLL_TIMEOUT_MS = 30000;
-var init_open_browser = () => {};
-
 // lib/telemetry.ts
 function trackEvent(name, properties) {
   if (!isTelemetryEnabled())
@@ -37407,7 +37752,7 @@ async function fetchWithTimeout2(url, init) {
     throw err;
   }
 }
-async function postJson2(path, body, init) {
+async function postJson3(path, body, init) {
   const headers = { "content-type": "application/json" };
   if (init?.accessToken)
     headers["authorization"] = `Bearer ${init.accessToken}`;
@@ -37423,18 +37768,18 @@ async function postJson2(path, body, init) {
   return await res.json();
 }
 async function requestLoginCode(email) {
-  return postJson2("/v0/auth/login/request", { email });
+  return postJson3("/v0/auth/login/request", { email });
 }
 async function verifyLoginCode(email, code) {
-  return postJson2("/v0/auth/login/verify", { email, code });
+  return postJson3("/v0/auth/login/verify", { email, code });
 }
 async function refreshAccessToken(refreshToken) {
-  return postJson2("/v0/auth/token/refresh", {
+  return postJson3("/v0/auth/token/refresh", {
     refresh_token: refreshToken
   });
 }
 async function submitAuditReport(accessToken, body) {
-  return postJson2("/v0/audit-reports", body, { accessToken });
+  return postJson3("/v0/audit-reports", body, { accessToken });
 }
 var DEFAULT_API_BASE = "https://api.befailproof.ai", AuthApiError, REQUEST_TIMEOUT_MS = 1e4;
 var init_api_server_client = __esm(() => {
@@ -38514,6 +38859,156 @@ ${process.platform} service target.
     stdin,
     stdout
   });
+  const askKey = () => promptCloudKey({
+    message: "Connect to cloud",
+    meta: source ? `${host}  ·  from ${source}` : host,
+    tabHint: "go back",
+    emptyError: "Paste a key, or press tab to go back.",
+    check: async (key) => {
+      if (!url)
+        return { ok: false, line: badUrl ?? "No usable endpoint." };
+      const r = await checkCloudKey(url, key);
+      if (r.ok) {
+        typedOrg = r.org;
+        return { ok: true, line: r.note };
+      }
+      return { ok: false, line: r.refused ? `That key was refused: ${r.reason}.` : `Couldn't check the key: ${r.reason}.` };
+    },
+    collapsed: (answer) => answer === OPEN_SOURCE ? [] : [...cloudLines(planFor(answer)), ""],
+    stdin,
+    stdout
+  });
+  let loginUnsupported = false;
+  const askLogin = (endpoint) => {
+    let pollSecret = "";
+    return promptBrowserLogin({
+      message: "Connect to cloud",
+      meta: source ? `${host}  ·  from ${source}` : host,
+      machineLabel,
+      start: async () => {
+        const r = await startLogin(endpoint, { label: machineLabel, os: machineOs(), cliVersion: version2 });
+        if (r.kind === "ok") {
+          pollSecret = r.pollSecret;
+          emit("configure_cloud_login", { step: "started" });
+          return { ok: true, url: r.verificationUrl, expiresIn: r.expiresIn, interval: r.interval };
+        }
+        if (r.kind === "unsupported") {
+          emit("configure_cloud_login", { step: "unsupported" });
+          loginUnsupported = true;
+          return { ok: false, retryable: false, line: `${host} doesn't support logging in from here yet.` };
+        }
+        return {
+          ok: false,
+          retryable: true,
+          line: r.kind === "refused" ? `Couldn't start the login: ${r.reason}.` : `Couldn't reach ${host}: ${r.reason}.`
+        };
+      },
+      poll: async () => {
+        const p = await pollLogin(endpoint, pollSecret);
+        switch (p.kind) {
+          case "approved":
+            emit("configure_cloud_login", { step: "approved" });
+            return {
+              state: "approved",
+              value: {
+                kind: "login",
+                pollSecret,
+                org: p.org,
+                approvedBy: p.approvedBy,
+                keyName: p.keyName,
+                permissions: p.permissions
+              }
+            };
+          case "pending":
+            return { state: "pending", interval: p.interval };
+          case "slow_down":
+            return { state: "slow_down" };
+          case "denied":
+            emit("configure_cloud_login", { step: "denied" });
+            return { state: "denied" };
+          case "unreachable":
+            return { state: "unreachable", line: p.reason };
+          default:
+            return { state: "expired" };
+        }
+      },
+      open: (link) => {
+        if (!canOpenBrowser())
+          return false;
+        openUrl(link);
+        return true;
+      },
+      collapsed: (plan) => [...cloudLines(plan), ""],
+      stdin,
+      stdout
+    });
+  };
+  const chooseConnection = async () => {
+    const verdict = saved && !saved.splitKeys ? await transient("Checking your saved key…", () => checkCloudKey(saved.url, saved.token)) : null;
+    const savedBroken = verdict !== null && !verdict.ok && verdict.refused;
+    const keptPlan = verdict && verdict.ok ? { kind: "kept", how: "saved", verified: true } : verdict && !verdict.refused ? { kind: "kept", how: "saved", verified: false } : { kind: "kept", how: "skip", verified: false };
+    const keepHint = !saved ? "" : saved.splitKeys ? "leave both keys as they are" : verdict?.ok ? `${verdict.org ?? saved.org ?? hostOf(saved.url)} · key ${maskToken(saved.token)}` : savedBroken ? "its key no longer works" : "its key couldn't be checked just now";
+    const login = {
+      label: saved ? "Log in again" : "Log in to FailproofAI Cloud",
+      value: "login",
+      hint: savedBroken ? "recommended · your saved key no longer works" : saved ? "opens your browser and makes a new key" : "recommended · opens your browser"
+    };
+    const key = { label: "Paste an API key", value: "key", hint: "one you already have" };
+    const oss = { label: "Use open source", value: "oss", hint: "skip the cloud" };
+    const keep = { label: "Keep current connection", value: "keep", hint: keepHint };
+    const choices = !saved ? [login, key, oss] : savedBroken ? [login, key, keep] : [keep, login, key];
+    const leftLogin = (result) => {
+      if (result === null || result === BACK) {
+        if (result === BACK && loginUnsupported) {
+          write([kit.caution(`${host} doesn't support logging in from here yet. Paste an API key instead.`), ""]);
+        }
+        return result;
+      }
+      return result.value;
+    };
+    if (url && (!saved || savedBroken)) {
+      if (savedBroken && verdict && !verdict.ok) {
+        write([kit.caution(`Your saved key no longer works: ${verdict.reason}. Logging in again.`)]);
+      }
+      emit("configure_cloud_choice", { choice: "login", connected: Boolean(saved), auto: true });
+      const first = leftLogin(await askLogin(url));
+      if (first !== BACK)
+        return first;
+    }
+    for (;; ) {
+      const pick = await selectOne({
+        message: "Connect to cloud",
+        meta: source ? `${host}  ·  from ${source}` : host,
+        choices: loginUnsupported ? choices.filter((c) => c.value !== "login") : choices,
+        collapsed: (p) => p === "keep" ? [...cloudLines(keptPlan), ""] : p === "oss" ? [...cloudLines({ kind: "oss" }), ""] : [],
+        stdin,
+        stdout
+      });
+      if (pick === null)
+        return null;
+      emit("configure_cloud_choice", { choice: pick, connected: Boolean(saved) });
+      if (pick === "keep")
+        return keptPlan;
+      if (pick === "oss")
+        return { kind: "oss" };
+      if (pick === "key") {
+        const answer = await askKey();
+        if (answer === null)
+          return null;
+        if (answer === OPEN_SOURCE)
+          continue;
+        return planFor(answer);
+      }
+      if (!url) {
+        write([kit.fail(badUrl ?? "No usable endpoint."), ""]);
+        continue;
+      }
+      const result = leftLogin(await askLogin(url));
+      if (result === BACK)
+        continue;
+      return result;
+    }
+  };
   let cloud;
   if (answers.oss) {
     cloud = saved ? { kind: "kept", how: "skip", verified: false } : { kind: "oss" };
@@ -38545,16 +39040,17 @@ ${process.platform} service target.
   } else {
     if (badUrl)
       write([kit.fail(badUrl)]);
-    const answer = await askCloud();
-    if (answer === null)
+    const chosen = await chooseConnection();
+    if (chosen === null)
       return cancel();
-    cloud = planFor(answer);
+    cloud = chosen;
   }
   const fp = readConfig();
   const hookedNow = INTEGRATION_TYPES.filter((id) => hookedAtUserScope(id, cwd));
   const plan = planAgents({ detected: detectInstalledClis(), saved: fp.agents, hooked: hookedNow });
-  const collectingAfter = cloud.kind === "connect" || readIngestCredential() !== null;
-  const sessionsOn = cloud.kind === "connect" ? answers.noTranscripts !== true : fp.collector.sessions === true;
+  const connecting = cloud.kind === "connect" || cloud.kind === "login";
+  const collectingAfter = connecting || readIngestCredential() !== null;
+  const sessionsOn = connecting ? answers.noTranscripts !== true : fp.collector.sessions === true;
   let selected;
   if (answers.agents && answers.agents.length > 0) {
     const named = new Set(answers.agents);
@@ -38586,6 +39082,27 @@ ${process.platform} service target.
   const { added, removed } = agentChanges(plan, selected);
   const done = [];
   let daemonInstalled = daemonAlreadyRunning;
+  if ((daemonWanted || daemonUnitStale) && !unattended) {
+    let stillRoot = false;
+    try {
+      stillRoot = canElevate();
+    } catch {
+      stillRoot = false;
+    }
+    if (!stillRoot && daemonWanted) {
+      if (!elevate("Your sudo session expired while you were away. Installing failproofaid needs root again.")) {
+        write([
+          kit.fail("Couldn't get root, so setup stopped before changing anything."),
+          `  Re-run once you can use sudo:  ${kit.cmd("failproofai config")}`
+        ]);
+        emit("configure_aborted", { reason: "needs_root" });
+        return { applied: false, abort: "needs_root" };
+      }
+    } else if (!stillRoot && !elevate("Your sudo session expired while you were away. Refreshing failproofaid's service definition needs root again.")) {
+      done.push(kit.caution("No root, so its service definition stays as it is. Scheduled audits stay off until it is refreshed."));
+      daemonUnitStale = false;
+    }
+  }
   if (daemonWanted) {
     if (daemonBroken) {
       await transient("Removing the failproofaid service that can't start…", async () => {
@@ -38652,14 +39169,14 @@ ${process.platform} service target.
     setDaemonConfigured(true, version2);
     pruneOldDaemonBinaries();
   }
-  const connectedAfterPlan = cloud.kind === "connect" || cloud.kind === "kept";
+  const connectedAfterPlan = connecting || cloud.kind === "kept";
   const applied = emit("configure_applied", {
     target: "user",
     scopes: ["user"],
     cli: selected,
     cli_count: selected.length,
     policy_count: (readScopedHooksConfig("user", cwd).enabledPolicies ?? []).length,
-    connected: cloud.kind === "connect",
+    connected: connecting,
     mode: connectedAfterPlan ? "cloud" : "oss",
     agents_selected: selected.length,
     agents_detected: plan.detected.size,
@@ -38672,8 +39189,22 @@ ${process.platform} service target.
   requestFreshStart(plan.mode === "rerun" ? added : [], collectingAfter && sessionsOn);
   updateConfig({ agents: { selected, seen: plan.seen } });
   let connected = false;
-  if (cloud.kind === "connect" && url) {
-    const token = cloud.token;
+  let token = cloud.kind === "connect" ? cloud.token : null;
+  let orgLabel = cloud.kind === "connect" ? cloud.org : undefined;
+  let mintedName;
+  if (cloud.kind === "login" && url) {
+    const claimed = await transient("Creating this machine's key…", () => claimLogin(url, cloud.pollSecret));
+    emit("configure_cloud_login", { step: "claimed", ok: claimed.kind === "ok", reason: claimed.kind });
+    if (claimed.kind === "ok") {
+      token = claimed.key;
+      orgLabel = loginOrgLabel(claimed.org);
+      mintedName = claimed.keyName;
+    } else {
+      hookLogWarn(`cloud login could not be completed: ${claimed.kind}`);
+      done.push(kit.caution(claimed.kind === "expired" ? "The login took too long to finish, so no key was created. Everything else was applied." : claimed.kind === "revoked" ? "Whoever approved the login can no longer create keys in that org, so no key was created." : claimed.kind === "unreachable" ? `Couldn't reach ${host} to create the key (${claimed.reason}); everything else was applied.` : `The key couldn't be created: ${claimed.reason}. Everything else was applied.`, "failproofai config"));
+    }
+  }
+  if (token && url) {
     try {
       const outcome = await transient("Connecting…", () => connectToCloud({
         url,
@@ -38684,7 +39215,10 @@ ${process.platform} service target.
       }));
       connected = outcome.anyConfigured;
       done.push(...outcome.changes ?? []);
-      done.push(...connectDoneLines(kit, outcome, host, cloud.org));
+      done.push(...connectDoneLines(kit, outcome, host, orgLabel));
+      if (cloud.kind === "login" && saved && connected) {
+        done.push(`  Your previous key for this machine still works until you revoke it on ${host}'s keys page.`);
+      }
       if (outcome.ingest.ok && answers.noTranscripts === true) {
         done.push("  Decisions only: session transcripts are not sent (--no-transcripts).");
       }
@@ -38693,9 +39227,15 @@ ${process.platform} service target.
       hookLogWarn(`cloud connection was not written: ${err instanceof Error ? err.message : String(err)}`);
       done.push(kit.caution("Couldn't connect; everything else was applied.", "failproofai config"));
     }
+    if (cloud.kind === "login" && !connected) {
+      done.push(`  The key ${mintedName ? `"${mintedName}" ` : ""}was created but isn't in use here; revoke it on ${host}'s keys page.`);
+    }
   } else if (cloud.kind === "kept" && cloud.how === "saved" && fp.mode !== "cloud") {
     updateConfig({ mode: "cloud" });
   }
+  const keptOld = cloud.kind === "login" && !token && saved !== undefined;
+  if (keptOld)
+    done.push("  This machine keeps its previous connection.");
   await applied;
   markLauncherSeen();
   clearOnboardingAttempt();
@@ -38705,7 +39245,7 @@ ${process.platform} service target.
     done,
     cwd,
     agents: selected.length,
-    connected: connected || cloud.kind === "kept",
+    connected: connected || cloud.kind === "kept" || keptOld,
     codexTrust
   }));
   return {
@@ -38716,10 +39256,15 @@ ${process.platform} service target.
     policies,
     daemonInstalled,
     connected,
-    mode: connected || cloud.kind === "kept" ? "cloud" : "oss",
+    mode: connected || cloud.kind === "kept" || keptOld ? "cloud" : "oss",
     agents: { selected, added, removed }
   };
 }
+function loginOrgLabel(org) {
+  if (org.name && org.slug)
+    return `${org.name} (${org.slug})`;
+  return org.name ?? org.slug ?? "your org";
+}
 function savedConnection() {
   const cloud = readCloudCredentials();
   const ingest = readIngestCredential();
@@ -38746,8 +39291,12 @@ function resolveCloudUrl(flag, existing) {
   const env = process.env.FAILPROOFAI_CLOUD_URL?.trim();
   const fromFlag = flag?.trim();
   const override = fromFlag || env;
-  if (!override)
-    return { ok: true, url: existing ?? cloudBaseFor(DEFAULT_INGEST_URL) };
+  if (!override) {
+    if (!existing)
+      return { ok: true, url: cloudBaseFor(DEFAULT_INGEST_URL) };
+    const saved = validateCloudUrl(existing);
+    return saved.ok ? { ok: true, url: existing } : { ok: false, message: `the saved cloud address "${existing}" cannot be used: ${saved.reason}` };
+  }
   const source = fromFlag && fromFlag !== env ? "--url" : "FAILPROOFAI_CLOUD_URL";
   const validated = validateCloudUrl(cloudBaseFor(override));
   if (!validated.ok) {
@@ -38802,6 +39351,11 @@ function cloudCollapsedLines(kit, plan, at) {
         kit.ok(plan.org ? `Key accepted for ${plan.org} on ${at.host}` : `Key accepted by ${at.host}`),
         ...plan.note ? [kit.caution(plan.note)] : []
       ];
+    case "login":
+      return [
+        head,
+        kit.ok(`Logged in${plan.approvedBy ? ` as ${plan.approvedBy}` : ""} · ${loginOrgLabel(plan.org)} on ${at.host}`)
+      ];
   }
 }
 function connectDoneLines(kit, outcome, host, org) {
@@ -38858,6 +39412,8 @@ function doneLines(kit, state) {
 var init_configure_wizard = __esm(() => {
   init_pack_store();
   init_tui();
+  init_cloud_login();
+  init_open_browser();
   init_collector_config();
   init_integrations();
   init_types();
@@ -38872,6 +39428,7 @@ var init_configure_wizard = __esm(() => {
   init_hook_logger();
   init_cloud_enrollment();
   init_cloud_connection();
+  init_cloud_introspect();
   init_fp_config();
   init_backfill_request();
   init_agent_selection();
@@ -41690,6 +42247,12 @@ function editAgentConfig(text, agent, writes) {
   parse(next);
   return next;
 }
+function cloudOtlpBase(origin) {
+  return `${origin.replace(/\/+$/, "")}/otel`;
+}
+function otlpDestination(origin, local, port) {
+  return local ? `http://127.0.0.1:${port}` : cloudOtlpBase(origin);
+}
 function agentOtelWrites(agent, endpoint, key, local, content, config = {}) {
   const auth = local ? {} : { Authorization: `Bearer ${key}` };
   const env = {
@@ -41813,8 +42376,12 @@ function credential() {
   const key = process.env.FAILPROOFAI_INGEST_KEY || ingest?.key;
   if (!key)
     throw new Error("No Cloud API key configured. Run `failproofai config` first.");
-  const url = new URL(process.env.FAILPROOFAI_INGEST_URL || ingest?.url || "https://app.befailproof.ai");
-  if (!["https:", "http:"].includes(url.protocol) || url.username || url.password)
+  const raw = process.env.FAILPROOFAI_INGEST_URL || ingest?.url || "https://app.befailproof.ai";
+  const checked = validateCloudUrl(raw);
+  if (!checked.ok)
+    throw new Error(`Invalid Cloud ingest URL: ${checked.reason}`);
+  const url = new URL(raw);
+  if (url.username || url.password)
     throw new Error("Invalid Cloud ingest URL.");
   return { key, origin: url.origin };
 }
@@ -41921,7 +42488,7 @@ async function enableAgent(agent, yes, localFlag, content, options) {
   const port = readConfig().collector.otlp?.port ?? 4318;
   if (!Number.isInteger(port) || port < 1 || port > 65535)
     throw new Error("collector.otlp.port must be between 1 and 65535.");
-  const destination = local ? `http://127.0.0.1:${port}` : origin;
+  const destination = otlpDestination(origin, local, port);
   const original = existsSync50(file) ? readFileSync38(file, "utf8") : null;
   const parsed = parseAgentConfig(original ?? "", agent);
   const oldState = existing ? privateState(agent) : null;
@@ -42039,7 +42606,9 @@ async function status(options) {
       try {
         const state = privateState(agent);
         const original = parseAgentConfig(state.original ?? "", agent);
-        const expected = parseAgentConfig(editAgentConfig(state.original ?? "", agent, agentOtelWrites(agent, record.destination, credential().key, record.local, record.content, original)), agent);
+        const { key, origin } = credential();
+        const expectedDestination = record.local ? record.destination : cloudOtlpBase(origin);
+        const expected = parseAgentConfig(editAgentConfig(state.original ?? "", agent, agentOtelWrites(agent, expectedDestination, key, record.local, record.content, original)), agent);
         managed = record.keys.every((k) => JSON.stringify(getSetting(parsed, k.path)) === JSON.stringify(getSetting(expected, k.path)));
       } catch {}
     }
@@ -42078,7 +42647,7 @@ async function runOtelCommand(args, options = {}) {
       if (consumed.length)
         throw new Error("env takes only --service <name> and --local.");
       const local = rest.includes("--local");
-      const endpoint = local ? `http://127.0.0.1:${readConfig().collector.otlp?.port ?? 4318}` : origin;
+      const endpoint = otlpDestination(origin, local, readConfig().collector.otlp?.port ?? 4318);
       const quote = (s) => `'${s.replace(/'/g, "'\\''")}'`;
       const values = {
         OTEL_EXPORTER_OTLP_ENDPOINT: endpoint,
@@ -42136,6 +42705,8 @@ var init_otel_cli = __esm(() => {
   init_fp_home();
   init_safe_config_write();
   init_collector_config();
+  init_cloud_introspect();
+  init_cloud_enrollment();
   init_integrations();
   init_tui();
   init_otel_writers();
@@ -42148,6 +42719,8 @@ var init_otel_cli2 = __esm(() => {
   init_fp_home();
   init_safe_config_write();
   init_collector_config();
+  init_cloud_introspect();
+  init_cloud_enrollment();
   init_integrations();
   init_tui();
   init_otel_writers();
@@ -42699,7 +43272,7 @@ function cloudKeyRow() {
 function octal(mode) {
   return mode === null ? null : mode.toString(8).padStart(4, "0");
 }
-function permissions(mode) {
+function permissions2(mode) {
   if (mode === null)
     return "unknown";
   return (mode & 63) === 0 ? `${octal(mode)} (owner-only)` : `${octal(mode)} (too open)`;
@@ -43200,7 +43773,7 @@ async function setupRun(argv, deps, opts) {
     ["timeout", `${cfg.timeoutMs} ms`],
     ["key", keyNote],
     ["config", path],
-    ["permissions", permissions(fileMode)]
+    ["permissions", permissions2(fileMode)]
   ], opts), offBase ? jevWarn([
     `Saved as given, but ${provider}'s API is at ${offBase.api}, and this URL sends requests to ${offBase.endpoint} instead.`,
     `Unless something of yours answers Jev requests at that path, every evaluation will fail there and hooks will fall back to regex — \`failproofai jev test\` says which it is in one request. To send requests back to ${provider}'s own API: failproofai jev setup --base-url default`
@@ -43325,7 +43898,7 @@ async function cloudSetup(values, bools, opts) {
     ["timeout", `${cfg.timeoutMs} ms`],
     ["key", keySource ? CLOUD_KEY_SOURCE : cloudKeyRow()],
     ["config", path],
-    ["permissions", permissions(fileMode)]
+    ["permissions", permissions2(fileMode)]
   ], opts), jevNote("Hooks read this file on every tool call — no restart. Calls are charged to your FailproofAI Cloud org's plan.", opts), shownMode === "off" ? null : keySource ? jevNext("failproofai jev test", "Check it with one live request:", opts) : jevNext("failproofai config --token <key>", `Jev stays off until this machine is connected with a key that carries jev:evaluate (the "machine" preset on the dashboard's Keys page):`, opts)));
 }
 function routeForRouting(routing) {
@@ -43485,7 +44058,7 @@ The daemon does not see this shell's environment.`) : [];
       ...route ? [["endpoint", displayEndpoint(route.endpoint)]] : [],
       ["mode", modeLine(inspection.routing.mode ?? DEFAULT_JEV_MODE)],
       ["key", `from ${JEV_API_KEY_ENV}, not set in this shell; the daemon never sees a shell's environment`],
-      ["config", `${inspection.path}${kit.sep}${permissions(inspection.mode)}`]
+      ["config", `${inspection.path}${kit.sep}${permissions2(inspection.mode)}`]
     ], [legacyNote], [step(`Set ${JEV_API_KEY_ENV} for this shell, or store the key in the file:`, "failproofai jev setup --key-stdin < key-file")]));
   }
   if (inspection.status === "off") {
@@ -43552,7 +44125,7 @@ The daemon does not see this shell's environment.`) : [];
       "key",
       inspection.keySource === "cloud" ? CLOUD_KEY_SOURCE : inspection.keySource === "file" ? "set in the config file" : `from ${JEV_API_KEY_ENV} (this shell only; the daemon does not see it)`
     ],
-    ["config", `${inspection.path}${kit.sep}${permissions(inspection.mode)}`],
+    ["config", `${inspection.path}${kit.sep}${permissions2(inspection.mode)}`],
     ...coverage ? [["reviewable", reviewableSummary(coverage)]] : []
   ], [coverageProblem ? kit.notice("caution", coverageProblem) : [], legacyNote], []));
 }
@@ -50202,7 +50775,7 @@ import { realpathSync as realpathSync9 } from "fs";
 import { dirname as dirname32, resolve as resolve43 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 // package.json
-var version = "1.0.11-beta.4";
+var version = "1.0.12-beta.0";
 
 // bin/failproofai.mjs
 if (!process.env.FAILPROOFAI_PACKAGE_ROOT) {