TeoSlayer · Sep 17, 2026 · Sep 17, 2026 · Sep 17, 2026
diff --git a/README.md b/README.md
@@ -12,6 +12,9 @@ you run it is a reasonable thing to do.
 
 ## Install
 
+This is installer v0.4.0. The `v1` URL follows the current compatible release;
+use `v0.4.0` in its place to pin this version.
+
 ```sh
 curl -fsSL https://raw.githubusercontent.com/pilot-protocol/cosift-install/v1/install.sh | sh
 ```
@@ -22,6 +25,14 @@ on the machine), writes the server entry, and verifies that the entry actually w
 it reports success. It also sets up [onboarding](#onboarding-one-step), the one step that
 tells Cosift what you work on.
 
+If the signed Cosift CLI is already on your `PATH`, the installer also connects it
+to the same account. It saves a verified session in
+`${XDG_CONFIG_HOME:-~/.config}/cosift/community-session.json`, mode `0600`, without
+printing the token or asking you to copy it from a harness. `--no-cli` skips this;
+`--cli` makes a missing CLI or failed handoff an error. An existing session is
+never replaced. The web app at [cosift.pilotprotocol.network](https://cosift.pilotprotocol.network)
+uses the same account when you sign in with the same email.
+
 Every file it writes, every network call it makes and every line it adds to your Claude Code
 settings is enumerated in [docs/WHAT-HAPPENS.md](docs/WHAT-HAPPENS.md), step by step, for
 anyone who wants to audit it rather than trust a summary.
@@ -62,6 +73,7 @@ server accepts is reused.
 | the opencode config named above | the `cosift` entry, written by `opencode mcp add` — the script never edits this file when adding |
 | `<each edited file>.cosift-backup-<UTC timestamp>` | a copy of the file as it was before the edit |
 | `${XDG_CONFIG_HOME:-~/.config}/cosift/state.json` | what was installed, mode `0600` |
+| `${XDG_CONFIG_HOME:-~/.config}/cosift/community-session.json` | verified CLI token, origin and expiry, mode `0600`, when a compatible CLI is available |
 | one file per selected harness, named under [onboarding](#onboarding-one-step) | the interview itself, mode `0644` — only if you agree to it |
 | `~/.local/bin/cosift-onboarding` | the local command the interview uses, mode `0755` — same condition |
 | `~/.claude/settings.json` | one `SessionStart` hook and five permission grants, so the interview can start and run without prompting you — same condition, Claude Code only |
@@ -83,8 +95,15 @@ refuses and exits `5` rather than overwriting it.
 
 ### Network
 
-The script contacts exactly two hosts: the Cosift auth service (`COSIFT_AUTH_BASE`) and the
-Cosift MCP endpoint (`COSIFT_MCP_URL`), both shown in `--help`. It sends your email address
+The script contacts the Cosift auth service (`COSIFT_AUTH_BASE`) and the
+Cosift MCP endpoint (`COSIFT_MCP_URL`), both shown in `--help`. When connecting an
+installed CLI, it also verifies the token at the web origin (`COSIFT_COMMUNITY_URL`).
+This release uses the production Cloud Run origins directly:
+`https://cosift-auth-udik5erlkq-uw.a.run.app` and
+`https://cosift-mcp-udik5erlkq-uw.a.run.app/v1/mcp`. The stable custom auth/MCP
+domains can replace them once DNS is configured; environment overrides remain
+available for a different deployment.
+It sends your email address
 to the auth service in order to email you a code, and it sends the credential to the MCP
 endpoint to check that it works.
 
@@ -104,6 +123,7 @@ The files that hold it are:
 - Claude Code — `~/.claude.json`
 - Codex CLI — `~/.codex/config.toml` (or `$CODEX_HOME/config.toml`)
 - opencode — `$XDG_CONFIG_HOME/opencode/opencode.json[c]`, else `~/.config/opencode/opencode.json[c]`
+- Cosift CLI, when connected — `${XDG_CONFIG_HOME:-~/.config}/cosift/community-session.json`
 
 Consequences worth taking seriously:
 
@@ -118,6 +138,34 @@ Consequences worth taking seriously:
 
 If a token leaks, revoke it — see [Revoking a token](#revoking-a-token).
 
+## Use the web app and CLI together
+
+The installer configures agents; the [web app](https://cosift.pilotprotocol.network)
+provides Search, Answer, Research, saved requests, followed topics, contributions
+and credits. Sign in there with the email used during installation.
+
+Install the signed v0.2.7 binary for your platform using the
+[CLI download and verification instructions](docs/CLI-INSTALL.md), then rerun:
+
+```sh
+sh install.sh --cli
+cosift request -query 'Rust async runtimes'
+cosift contribute https://example.org/article
+cosift contribute -credits
+```
+
+The CLI discovers only the session file written by this installer and uses its
+recorded origin. Explicit credentials or `-session-file` take precedence;
+`-server` cannot send that session to another origin. `-guest` ignores it.
+The installer does not download or overwrite a binary. A missing or unsupported
+CLI leaves the agent install usable and prints the signed-release link.
+
+An existing CLI session is left unchanged, including with `--new-account`.
+To switch, run `cosift logout` first and rerun the installer. Logout revokes the
+shared token in any agent still using it as well. `--uninstall` removes agent
+integration but leaves this independently usable CLI session; use `cosift logout`
+to revoke and remove it.
+
 ## Onboarding: one step
 
 Install it, open your agent, approve one list. That is the whole thing.
@@ -257,6 +305,8 @@ install.sh [OPTIONS]
   --yes              accept all detected harnesses without prompting
   --onboarding       install the onboarding interview without asking
   --no-onboarding    do not install the onboarding interview
+  --cli              require connecting an already installed Cosift CLI
+  --no-cli           skip connecting an installed CLI
   --help             print usage to stdout and exit 0
   --version          print the version string to stdout and exit 0
 ```
@@ -296,7 +346,8 @@ warns and carries on, and nothing that was already written is rolled back.
 | --- | --- |
 | `COSIFT_AUTH_BASE` | override the auth service base URL used for the email code flow |
 | `COSIFT_MCP_URL` | override the MCP server URL that gets written into the harness config |
-| `COSIFT_EXTRA_HEADER` | one additional header in `Name: value` form, sent on every request the installer makes and written into the harness config next to `Authorization`; needed only when your Cosift deployment sits behind a gateway that requires a second header |
+| `COSIFT_COMMUNITY_URL` | web and CLI origin; defaults to `https://cosift.pilotprotocol.network` |
+| `COSIFT_EXTRA_HEADER` | one additional header in `Name: value` form, sent on every auth/MCP request and written into the harness config next to `Authorization`; it is not forwarded to the community CLI |
 | `COSIFT_CODEX_SKILLS_DIR` | the skills root the Codex onboarding file is written under; defaults to `~/.agents/skills`. It has no effect on the MCP config, and `CODEX_HOME` has no effect on it |
 
 Most people never set any of these. They exist so that a private or self-hosted Cosift

diff --git a/docs/CLI-INSTALL.md b/docs/CLI-INSTALL.md
@@ -0,0 +1,79 @@
+# Install the signed Cosift CLI
+
+Cosift CLI v0.2.7 connects to the same account as the agent installer and web app.
+Use the official [v0.2.7 release](https://github.com/pilot-protocol/cosift/releases/tag/v0.2.7).
+Each binary has a SHA-256 checksum and a minisign signature. The release also
+publishes `cosift-minisign.pub`; its signing key ID is `6184E2C01CA477A6`.
+
+## Linux and macOS
+
+Install [minisign](https://jedisct1.github.io/minisign/) if it is not already
+available. Then run this block. It downloads to a temporary directory, verifies
+both checks, and installs only the verified binary in `~/.local/bin/cosift`.
+
+```sh
+(
+  set -eu
+  command -v minisign >/dev/null || { echo 'Install minisign first.' >&2; exit 1; }
+  case "$(uname -s)/$(uname -m)" in
+    Linux/x86_64) asset=cosift-linux-amd64 ;;
+    Linux/aarch64|Linux/arm64) asset=cosift-linux-arm64 ;;
+    Darwin/x86_64) asset=cosift-darwin-amd64 ;;
+    Darwin/arm64) asset=cosift-darwin-arm64 ;;
+    *) echo 'Unsupported platform; see the release assets.' >&2; exit 1 ;;
+  esac
+  release=https://github.com/pilot-protocol/cosift/releases/download/v0.2.7
+  scratch=$(mktemp -d)
+  trap 'rm -rf "$scratch"' EXIT
+  cd "$scratch"
+  for file in "$asset" "$asset.sha256" "$asset.minisig" cosift-minisign.pub; do
+    curl --proto '=https' --tlsv1.2 -fsSL "$release/$file" -o "$file"
+  done
+  if command -v sha256sum >/dev/null; then
+    sha256sum -c "$asset.sha256"
+  else
+    shasum -a 256 -c "$asset.sha256"
+  fi
+  minisign -Vm "$asset" -p cosift-minisign.pub
+  mkdir -p "$HOME/.local/bin"
+  install -m 0755 "$asset" "$HOME/.local/bin/cosift"
+)
+export PATH="$HOME/.local/bin:$PATH"
+cosift version
+```
+
+Keep `~/.local/bin` on your shell's `PATH`. A checksum or signature failure stops
+the block before installation. Check the release's trusted version comment is
+`cosift v0.2.7` followed by the selected asset name.
+
+Download and run the pinned agent installer after installing the CLI:
+
+```sh
+curl --proto '=https' --tlsv1.2 -fsSL \
+  https://raw.githubusercontent.com/pilot-protocol/cosift-install/v0.4.0/install.sh \
+  -o install.sh
+sh install.sh --cli
+cosift request -query 'Rust async runtimes'
+cosift contribute -credits
+```
+
+The installer detects your harnesses, signs in by email or reuses their verified
+Cosift token, and saves the CLI session. Existing sessions are preserved. The
+web app at [cosift.pilotprotocol.network](https://cosift.pilotprotocol.network)
+uses the same account when you sign in with the same email.
+
+## Windows
+
+The release includes `cosift-windows-amd64.exe`, its `.sha256` and `.minisig`
+files, and `cosift-minisign.pub`. Download them from the same official release.
+Compare `Get-FileHash -Algorithm SHA256 .\cosift-windows-amd64.exe` with the
+checksum file, then verify with:
+
+```powershell
+minisign -Vm .\cosift-windows-amd64.exe -p .\cosift-minisign.pub
+```
+
+Place the verified executable on your `PATH` as `cosift.exe`. The POSIX agent
+installer currently supports Linux and macOS; Windows users can use the CLI's
+explicit login options (`cosift login -help`) or run the Linux installer in WSL
+with the Linux binary.
diff --git a/docs/HARNESSES.md b/docs/HARNESSES.md
@@ -62,7 +62,7 @@ so that removal is exact:
 ```toml
 # >>> cosift (managed by cosift-install — do not edit)
 [mcp_servers.cosift]
-url = "https://cosift-mcp.pilotprotocol.network/v1/mcp"
+url = "https://cosift-mcp-udik5erlkq-uw.a.run.app/v1/mcp"
 [mcp_servers.cosift.http_headers]
 Authorization = "Bearer ck_..."
 # <<< cosift

diff --git a/docs/PP-HANDOFF.md b/docs/PP-HANDOFF.md
@@ -48,8 +48,8 @@ contents on the site — one copy stays accurate, two do not.
 
 ## Two points worth keeping in any copy you write
 
-- The installer sends **no telemetry** and contacts only the two Cosift endpoints. This is a
-  genuine differentiator for a piped-to-shell installer and is safe to state plainly.
+- The installer sends **no telemetry**. It contacts Cosift auth and MCP, and the
+  web origin when it connects an already installed Cosift CLI.
 - After install, the credential is stored **in cleartext in the tool's own config file** —
   that is how MCP headers work everywhere. The README says so prominently. Don't write copy
   that implies the credential is stored more securely than that.

diff --git a/docs/UNINSTALL.md b/docs/UNINSTALL.md
@@ -46,6 +46,11 @@ backups below still contain the token.
 
 There is no uninstall preview: `--dry-run` with `--uninstall` is a usage error and exits `2`.
 
+The Cosift CLI binary and `${XDG_CONFIG_HOME:-~/.config}/cosift/community-session.json`
+are left available for independent CLI use. Run `cosift logout` to revoke and
+remove that session. This also invalidates the same token in any remaining
+agent configuration; it does not revoke other tokens belonging to the account.
+
 ## Manual removal
 
 Use this if the installer is unavailable, if `--uninstall` reported a failure or a warning, or
@@ -76,7 +81,7 @@ If you must edit the file by hand, the entry is the `"cosift"` key of the top-le
 ```json
 "cosift": {
   "type": "http",
-  "url": "https://cosift-mcp.pilotprotocol.network/v1/mcp",
+  "url": "https://cosift-mcp-udik5erlkq-uw.a.run.app/v1/mcp",
   "headers": { "Authorization": "Bearer ck_..." }
 }
 ```
@@ -96,7 +101,7 @@ comments included:
 ```toml
 # >>> cosift (managed by cosift-install — do not edit)
 [mcp_servers.cosift]
-url = "https://cosift-mcp.pilotprotocol.network/v1/mcp"
+url = "https://cosift-mcp-udik5erlkq-uw.a.run.app/v1/mcp"
 [mcp_servers.cosift.http_headers]
 Authorization = "Bearer ck_..."
 # <<< cosift
@@ -145,7 +150,7 @@ like this:
     },
     "cosift": {
       "type": "remote",
-      "url": "https://cosift-mcp.pilotprotocol.network/v1/mcp",
+      "url": "https://cosift-mcp-udik5erlkq-uw.a.run.app/v1/mcp",
       "headers": { "Authorization": "Bearer ck_..." }
     }
   }

diff --git a/docs/WHAT-HAPPENS.md b/docs/WHAT-HAPPENS.md
@@ -6,7 +6,8 @@ every step rather than take a summary on trust.
 
 Everything here is checkable against two files: `install.sh` and the `cosift-onboarding`
 command, whose source the installer carries inside itself (`onboarding/bin/cosift-onboarding`
-in this repository). Nothing is fetched at runtime.
+in this repository). The optional CLI handoff also invokes the already installed
+[Cosift CLI](https://github.com/pilot-protocol/cosift). No code is fetched at runtime.
 
 ## 1. The install command
 
@@ -29,7 +30,12 @@ In order, the script:
 6. Installs onboarding, unless you declined it: one file per harness, the local command, and
    on Claude Code the hook and permission grants in `~/.claude/settings.json`.
 7. Makes one MCP `initialize` call with the credential it just wrote, to prove the entry works.
-8. Writes its state file and prints a summary of every path it touched.
+8. If a compatible `cosift` binary is on `PATH`, passes the verified token to its
+   `login` command through the subprocess environment. The CLI verifies it at
+   `GET $COSIFT_COMMUNITY_URL/api/me` and creates a private origin-bound session.
+   `--no-cli` skips this, and an existing session is never overwritten. No binary
+   is downloaded. `--cli` makes an unavailable or unsuccessful CLI handoff an error.
+9. Writes its state file and prints a summary of every path it touched.
 
 `--dry-run` stops after step 3: it prints the per-harness plan, including the `settings.json`
 line and the state of each interview path, and then exits without writing a byte under your
@@ -59,6 +65,7 @@ call with a credential already on the machine, to say whether that one would be
 | `~/.local/bin/cosift-onboarding` | the local command described in [section 5](#5-cosift-onboarding-digest) | `0755` |
 | `~/.claude/settings.json` | the hook and the permission grants in [section 3](#3-the-change-to-claudesettingsjson) | preserved; `0600` if the installer created the file |
 | `${XDG_CONFIG_HOME:-~/.config}/cosift/state.json` | what was installed | `0600` |
+| `${XDG_CONFIG_HOME:-~/.config}/cosift/community-session.json` | token, origin and expiry for the installed CLI; only if this file does not already exist | `0600` |
 | `<each edited file>.cosift-backup-<UTC timestamp>` | a copy of the file as it was before the edit | `0600` |
 | a directory under `$TMPDIR` | request bodies and curl header files, deleted on exit | `0700` |
 
@@ -73,13 +80,15 @@ can read the token, and so can any backup taken after it was written.
 
 ### Network calls
 
-The installer contacts two hosts and no others:
+The installer contacts the auth and MCP hosts, plus the community origin when
+connecting an installed CLI:
 
 | Request | To | Body |
 | --- | --- | --- |
 | `POST /auth/start` | `$COSIFT_AUTH_BASE` | the email address you typed |
 | `POST /auth/verify` | `$COSIFT_AUTH_BASE` | the request id from the previous call and the six-digit code |
 | `POST` the MCP endpoint | `$COSIFT_MCP_URL` | a JSON-RPC `initialize`, carrying the credential in a header |
+| `GET /api/me` through the installed CLI | `$COSIFT_COMMUNITY_URL` | no body; the same credential in the authorization header |
 
 `/auth/start` returns the same `200` for a deliverable address, an unknown one, a malformed one
 and one over its cap, on purpose — a differing response would let anyone test whether an address