From 617d633fa541586c517009ff9782c590264798a7 Mon Sep 17 00:00:00 2001
From: Yuval <yuval@qualifire.ai>
Date: Fri, 11 Sep 2026 08:28:39 +0300
Subject: [PATCH 1/6] feat(plugins): installer skips credentials when the
 machine env file holds a key (FIRE-2119)

A keyed /etc/rogue/env (C:\ProgramData\rogue\env) is read alone by every
hook, so install.sh and install.ps1 no longer prompt for an API key or write
the user env file on such a machine; one line names the file in use and the
plugin install proceeds. Absent, or present without ROGUE_API_KEY, both
installers behave as before. install.ps1's credential flow moves into
functions above the ROGUE_INSTALL_LIB_ONLY seam so the decision is testable.

Read-ApiKey decodes the BSTR with PtrToStringBSTR so the ps1 suite can run
under pwsh off Windows; identical on Windows.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 README.md                |   7 +-
 install.ps1              | 217 ++++++++++++++++++++++-----------------
 install.sh               |  24 +++--
 tests/test_setup_env.ps1 |   6 +-
 4 files changed, 150 insertions(+), 104 deletions(-)

diff --git a/README.md b/README.md
index 10cadc6..3550d4a 100644
--- a/README.md
+++ b/README.md
@@ -31,8 +31,11 @@ The one installer detects every supported coding agent and installs the matching
 Rogue plugin into each — **Claude Code**, **OpenAI Codex**, **Cursor**,
 **Gemini CLI**, **GitHub Copilot CLI**, **Google Antigravity**, and **Kiro** —
 writing the shared `~/.rogue-env` (`%USERPROFILE%\.rogue-env` on
-Windows) once. Claude and Codex install through their native plugin CLIs
-(`claude plugin install` / `codex plugin add`); **Cursor has no plugin CLI**, so
+Windows) once. On a machine whose `/etc/rogue/env` (`C:\ProgramData\rogue\env`)
+already holds `ROGUE_API_KEY` it prompts for nothing and writes no user file:
+that machine file is the one the hooks read. Claude and Codex install through
+their native plugin CLIs (`claude plugin install` / `codex plugin add`);
+**Cursor has no plugin CLI**, so
 its plugin is copied into `~/.cursor/plugins/local/rogue` from the release tarball;
 **Gemini CLI** installs from the release tarball via its native
 `gemini extensions install`. **Kiro** (IDE, CLI on both engines, Crew) has no
diff --git a/install.ps1 b/install.ps1
index 2607bb6..b7cea10 100644
--- a/install.ps1
+++ b/install.ps1
@@ -70,6 +70,7 @@ $MarketplaceName = 'rogue-marketplace'
 $CopilotMarketplaceName = 'rogue-copilot'
 $PluginName      = 'rogue'
 $EnvFile = Join-Path $env:USERPROFILE '.rogue-env'
+$MachineEnvFile = 'C:\ProgramData\rogue\env'
 
 # Merge env vars -> params (explicit params win).
 if (-not $ApiKey)     { $ApiKey     = $env:ROGUE_API_KEY }
@@ -320,67 +321,7 @@ function Test-KiroInstalled {
     return [bool](Test-Path (Join-Path $env:USERPROFILE '.kiro'))
 }
 
-# Test seam: load only the functions above (tests/test_install_kiro_ps1.ps1).
-if ($env:ROGUE_INSTALL_LIB_ONLY) { return }
-
-try {
-    [Net.ServicePointManager]::SecurityProtocol = `
-        [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
-} catch {}
-
-Write-Host ""
-Write-Host "Rogue Security (Windows)" -ForegroundColor Cyan
-
-# Agent selection. -Claude/-Codex/-Cursor pick an explicit set; with none, auto-detect
-# every supported agent. claude/codex ship a CLI on PATH; Cursor's `cursor` command is
-# opt-in, so detection also accepts %USERPROFILE%\.cursor. An explicitly selected CLI
-# agent still needs its binary; Cursor is a plain file copy, so it installs regardless.
-# Antigravity has no `antigravity` binary on PATH — detect the `agy` CLI or its data
-# dirs under %USERPROFILE%\.gemini (IDE and/or manual-CLI installs).
-$explicit = $Claude -or $Codex -or $Cursor -or $Gemini -or $Copilot -or $Antigravity -or $Kiro
-if ($explicit) {
-    $hasClaude      = [bool]$Claude
-    $hasCodex       = [bool]$Codex
-    $hasCursor      = [bool]$Cursor
-    $hasGemini      = [bool]$Gemini
-    $hasCopilot     = [bool]$Copilot
-    $hasAntigravity = [bool]$Antigravity
-    $hasKiro        = [bool]$Kiro
-    if ($hasClaude -and -not (Get-Command claude -ErrorAction SilentlyContinue)) {
-        Die "-Claude requested but the 'claude' CLI is not on PATH. Install Claude Code (https://claude.com/code) first."
-    }
-    if ($hasCodex -and -not (Get-Command codex -ErrorAction SilentlyContinue)) {
-        Die "-Codex requested but the 'codex' CLI is not on PATH. Install OpenAI Codex first."
-    }
-    if ($hasGemini -and -not (Get-Command gemini -ErrorAction SilentlyContinue)) {
-        Die "-Gemini requested but the 'gemini' CLI is not on PATH. Install Gemini CLI (https://geminicli.com) first."
-    }
-    if ($hasCopilot -and -not (Get-Command copilot -ErrorAction SilentlyContinue)) {
-        Die "-Copilot requested but the 'copilot' CLI is not on PATH. Install GitHub Copilot CLI (https://github.com/github/copilot-cli) first."
-    }
-    if ($hasAntigravity -and -not ((Get-Command agy -ErrorAction SilentlyContinue) -or (Test-Path (Join-Path $env:USERPROFILE '.gemini\antigravity*')))) {
-        Die "-Antigravity requested but no Antigravity install was detected (looked for: agy CLI, %USERPROFILE%\.gemini\antigravity*). Install Google Antigravity first."
-    }
-    if ($hasKiro -and -not (Test-KiroInstalled)) {
-        Die "-Kiro requested but no Kiro install was detected (looked for: kiro-cli, %LOCALAPPDATA%\Programs\Kiro, %USERPROFILE%\.kiro). Install Kiro (https://kiro.dev) first."
-    }
-} else {
-    $hasClaude      = [bool](Get-Command claude -ErrorAction SilentlyContinue)
-    $hasCodex       = [bool](Get-Command codex  -ErrorAction SilentlyContinue)
-    $hasCursor      = [bool](Get-Command cursor -ErrorAction SilentlyContinue) -or (Test-Path (Join-Path $env:USERPROFILE '.cursor'))
-    $hasGemini      = [bool](Get-Command gemini -ErrorAction SilentlyContinue)
-    $hasCopilot     = [bool](Get-Command copilot -ErrorAction SilentlyContinue)
-    $hasAntigravity = [bool](Get-Command agy -ErrorAction SilentlyContinue) -or (Test-Path (Join-Path $env:USERPROFILE '.gemini\antigravity*'))
-    $hasKiro        = Test-KiroInstalled
-    if (-not ($hasClaude -or $hasCodex -or $hasCursor -or $hasGemini -or $hasCopilot -or $hasAntigravity -or $hasKiro)) {
-        Die "No supported coding agent found (looked for: claude, codex, cursor, gemini, copilot, antigravity, kiro). Install Claude Code (https://claude.com/code), OpenAI Codex, Cursor (https://cursor.com), Gemini CLI (https://geminicli.com), GitHub Copilot CLI (https://github.com/github/copilot-cli), Google Antigravity, or Kiro (https://kiro.dev) first."
-    }
-}
-# Claude shells out to git to clone the marketplace; git is required only for it.
-if ($hasClaude -and -not (Get-Command git -ErrorAction SilentlyContinue)) {
-    Die "git not found. Install Git for Windows (https://git-scm.com/download/win) first."
-}
-
+# -- Credentials ---------------------------------------------------------------
 function ConvertFrom-ShellQuoted {
     param([string]$Val)
     if ($null -eq $Val) { return $Val }
@@ -411,51 +352,58 @@ function ConvertFrom-ShellQuoted {
     return $sb.ToString()
 }
 
-# Load existing creds from disk: the first env file holding ROGUE_API_KEY, as the
+function Test-EnvFileHasKey {
+    param([string]$Path)
+    if (-not (Test-Path -LiteralPath $Path)) { return $false }
+    foreach ($line in (Get-Content -LiteralPath $Path -Encoding UTF8 -ErrorAction SilentlyContinue)) {
+        if ($line -match '^\s*(?:export\s+)?ROGUE_API_KEY=["'']?[^"''\s]') { return $true }
+    }
+    return $false
+}
+
+# Load existing creds from the user env file when it holds ROGUE_API_KEY, as the
 # dispatcher reads it.
 function Load-ExistingCreds {
-    foreach ($f in @('C:\ProgramData\rogue\env', (Join-Path $env:USERPROFILE '.rogue-env'))) {
-        if (-not (Test-Path -LiteralPath $f)) { continue }
-        $vals = @{}
-        foreach ($line in (Get-Content -LiteralPath $f -Encoding UTF8 -ErrorAction SilentlyContinue)) {
-            if ($line -match '^\s*(?:export\s+)?([A-Z_][A-Z0-9_]*)=(.+)$') {
-                $vals[$Matches[1]] = ConvertFrom-ShellQuoted $Matches[2].Trim()
-            }
+    if (-not (Test-EnvFileHasKey $script:EnvFile)) { return }
+    $vals = @{}
+    foreach ($line in (Get-Content -LiteralPath $script:EnvFile -Encoding UTF8 -ErrorAction SilentlyContinue)) {
+        if ($line -match '^\s*(?:export\s+)?([A-Z_][A-Z0-9_]*)=(.+)$') {
+            $vals[$Matches[1]] = ConvertFrom-ShellQuoted $Matches[2].Trim()
         }
-        if (-not $vals['ROGUE_API_KEY']) { continue }
-        if (-not $script:ApiKey) { $script:ApiKey = $vals['ROGUE_API_KEY'] }
-        if (-not $script:Email -and $vals['ROGUE_ACTOR_EMAIL']) { $script:Email = $vals['ROGUE_ACTOR_EMAIL'] }
-        if (-not $script:Name -and $vals['ROGUE_ACTOR_NAME']) { $script:Name = $vals['ROGUE_ACTOR_NAME'] }
-        if (-not $script:BaseUrlExplicit -and $vals['ROGUE_BASE_URL']) { $script:BaseUrl = $vals['ROGUE_BASE_URL'] }
-        break
     }
+    if (-not $script:ApiKey) { $script:ApiKey = $vals['ROGUE_API_KEY'] }
+    if (-not $script:Email -and $vals['ROGUE_ACTOR_EMAIL']) { $script:Email = $vals['ROGUE_ACTOR_EMAIL'] }
+    if (-not $script:Name -and $vals['ROGUE_ACTOR_NAME']) { $script:Name = $vals['ROGUE_ACTOR_NAME'] }
+    if (-not $script:BaseUrlExplicit -and $vals['ROGUE_BASE_URL']) { $script:BaseUrl = $vals['ROGUE_BASE_URL'] }
 }
-Load-ExistingCreds
 
-if (-not $ApiKey) {
+function Read-ApiKey {
     if ($NonInteractive) {
         Warn2 'No API key set and running non-interactively - skipping key setup.'
         Warn2 'Run /rogue:setup inside Claude Code to connect your key later.'
-    } else {
-        $secure = Read-Host 'Rogue API key (rsk_...)' -AsSecureString
-        $bstr   = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure)
-        $ApiKey = [Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)
-        [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr)
-        if (-not $ApiKey) { Die 'API key cannot be empty.' }
+        return
     }
+    $secure = Read-Host 'Rogue API key (rsk_...)' -AsSecureString
+    $bstr   = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure)
+    # BSTR is UTF-16 everywhere; PtrToStringAuto decodes it as UTF-8 off Windows.
+    $script:ApiKey = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($bstr)
+    [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr)
+    if (-not $script:ApiKey) { Die 'API key cannot be empty.' }
 }
 
 # Actor identity: git config -> env fallbacks (mirrors actor.sh).
-if (-not $Email) { try { $Email = (& git config --global user.email 2>$null | Out-String).Trim() } catch {} }
-if (-not $Name)  { try { $Name  = (& git config --global user.name 2>$null | Out-String).Trim() } catch {} }
-if (-not $Email -and $env:CLAUDE_CODE_USER_EMAIL) { $Email = $env:CLAUDE_CODE_USER_EMAIL }
-if (-not $Email) { $Email = "$env:USERNAME@$env:COMPUTERNAME" }
-if (-not $Name)  { $Name  = $env:USERNAME }
-Log "Actor: $Name <$Email>"
+function Resolve-Actor {
+    if (-not $script:Email) { try { $script:Email = (& git config --global user.email 2>$null | Out-String).Trim() } catch {} }
+    if (-not $script:Name)  { try { $script:Name  = (& git config --global user.name 2>$null | Out-String).Trim() } catch {} }
+    if (-not $script:Email -and $env:CLAUDE_CODE_USER_EMAIL) { $script:Email = $env:CLAUDE_CODE_USER_EMAIL }
+    if (-not $script:Email) { $script:Email = "$env:USERNAME@$env:COMPUTERNAME" }
+    if (-not $script:Name)  { $script:Name  = $env:USERNAME }
+    Log "Actor: $script:Name <$script:Email>"
+}
 
 # Validate the key AND register this install via /api/v1/hooks/status (the same
 # heartbeat the SessionStart hook calls), so the dashboard roster row is deduped.
-if ($ApiKey) {
+function Register-ApiKey {
     Log 'Validating API key...'
     try {
         $hostName = $env:COMPUTERNAME; if (-not $hostName) { $hostName = 'unknown' }
@@ -488,8 +436,11 @@ if ($ApiKey) {
             Warn2 "Could not reach $BaseUrl to validate - saving without verification."
         }
     }
+}
 
-    function Format-EnvVal { param([string]$Val) return "'" + $Val.Replace("'", "'\''") + "'" }
+function Format-EnvVal { param([string]$Val) return "'" + $Val.Replace("'", "'\''") + "'" }
+
+function Write-UserEnvFile {
     $managed = @('ROGUE_API_KEY', 'ROGUE_ACTOR_EMAIL', 'ROGUE_ACTOR_NAME')
     if ($BaseUrlExplicit) { $managed += 'ROGUE_BASE_URL' }
     foreach ($pair in @(@('ROGUE_API_KEY', $ApiKey), @('ROGUE_ACTOR_EMAIL', $Email),
@@ -537,6 +488,88 @@ if ($ApiKey) {
     Ok "Credentials written to $EnvFile"
 }
 
+# The dispatchers read a keyed machine env file alone, so on such a machine the
+# user env file is never consulted: no prompt, no write.
+function Configure-Credentials {
+    if (Test-EnvFileHasKey $script:MachineEnvFile) {
+        $script:CredentialSource = $script:MachineEnvFile
+        Ok "Credentials come from the machine env file $script:MachineEnvFile - no API key prompt, $script:EnvFile not written."
+        return
+    }
+    $script:CredentialSource = $script:EnvFile
+    Load-ExistingCreds
+    if (-not $script:ApiKey) { Read-ApiKey }
+    Resolve-Actor
+    if (-not $script:ApiKey) { return }
+    Register-ApiKey
+    Write-UserEnvFile
+}
+
+
+# Test seam: load only the functions above (tests/test_install_kiro_ps1.ps1,
+# tests/test_install_env_ps1.ps1).
+if ($env:ROGUE_INSTALL_LIB_ONLY) { return }
+
+try {
+    [Net.ServicePointManager]::SecurityProtocol = `
+        [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+} catch {}
+
+Write-Host ""
+Write-Host "Rogue Security (Windows)" -ForegroundColor Cyan
+
+# Agent selection. -Claude/-Codex/-Cursor pick an explicit set; with none, auto-detect
+# every supported agent. claude/codex ship a CLI on PATH; Cursor's `cursor` command is
+# opt-in, so detection also accepts %USERPROFILE%\.cursor. An explicitly selected CLI
+# agent still needs its binary; Cursor is a plain file copy, so it installs regardless.
+# Antigravity has no `antigravity` binary on PATH — detect the `agy` CLI or its data
+# dirs under %USERPROFILE%\.gemini (IDE and/or manual-CLI installs).
+$explicit = $Claude -or $Codex -or $Cursor -or $Gemini -or $Copilot -or $Antigravity -or $Kiro
+if ($explicit) {
+    $hasClaude      = [bool]$Claude
+    $hasCodex       = [bool]$Codex
+    $hasCursor      = [bool]$Cursor
+    $hasGemini      = [bool]$Gemini
+    $hasCopilot     = [bool]$Copilot
+    $hasAntigravity = [bool]$Antigravity
+    $hasKiro        = [bool]$Kiro
+    if ($hasClaude -and -not (Get-Command claude -ErrorAction SilentlyContinue)) {
+        Die "-Claude requested but the 'claude' CLI is not on PATH. Install Claude Code (https://claude.com/code) first."
+    }
+    if ($hasCodex -and -not (Get-Command codex -ErrorAction SilentlyContinue)) {
+        Die "-Codex requested but the 'codex' CLI is not on PATH. Install OpenAI Codex first."
+    }
+    if ($hasGemini -and -not (Get-Command gemini -ErrorAction SilentlyContinue)) {
+        Die "-Gemini requested but the 'gemini' CLI is not on PATH. Install Gemini CLI (https://geminicli.com) first."
+    }
+    if ($hasCopilot -and -not (Get-Command copilot -ErrorAction SilentlyContinue)) {
+        Die "-Copilot requested but the 'copilot' CLI is not on PATH. Install GitHub Copilot CLI (https://github.com/github/copilot-cli) first."
+    }
+    if ($hasAntigravity -and -not ((Get-Command agy -ErrorAction SilentlyContinue) -or (Test-Path (Join-Path $env:USERPROFILE '.gemini\antigravity*')))) {
+        Die "-Antigravity requested but no Antigravity install was detected (looked for: agy CLI, %USERPROFILE%\.gemini\antigravity*). Install Google Antigravity first."
+    }
+    if ($hasKiro -and -not (Test-KiroInstalled)) {
+        Die "-Kiro requested but no Kiro install was detected (looked for: kiro-cli, %LOCALAPPDATA%\Programs\Kiro, %USERPROFILE%\.kiro). Install Kiro (https://kiro.dev) first."
+    }
+} else {
+    $hasClaude      = [bool](Get-Command claude -ErrorAction SilentlyContinue)
+    $hasCodex       = [bool](Get-Command codex  -ErrorAction SilentlyContinue)
+    $hasCursor      = [bool](Get-Command cursor -ErrorAction SilentlyContinue) -or (Test-Path (Join-Path $env:USERPROFILE '.cursor'))
+    $hasGemini      = [bool](Get-Command gemini -ErrorAction SilentlyContinue)
+    $hasCopilot     = [bool](Get-Command copilot -ErrorAction SilentlyContinue)
+    $hasAntigravity = [bool](Get-Command agy -ErrorAction SilentlyContinue) -or (Test-Path (Join-Path $env:USERPROFILE '.gemini\antigravity*'))
+    $hasKiro        = Test-KiroInstalled
+    if (-not ($hasClaude -or $hasCodex -or $hasCursor -or $hasGemini -or $hasCopilot -or $hasAntigravity -or $hasKiro)) {
+        Die "No supported coding agent found (looked for: claude, codex, cursor, gemini, copilot, antigravity, kiro). Install Claude Code (https://claude.com/code), OpenAI Codex, Cursor (https://cursor.com), Gemini CLI (https://geminicli.com), GitHub Copilot CLI (https://github.com/github/copilot-cli), Google Antigravity, or Kiro (https://kiro.dev) first."
+    }
+}
+# Claude shells out to git to clone the marketplace; git is required only for it.
+if ($hasClaude -and -not (Get-Command git -ErrorAction SilentlyContinue)) {
+    Die "git not found. Install Git for Windows (https://git-scm.com/download/win) first."
+}
+
+Configure-Credentials
+
 # Install through each agent's CLI marketplace (cross-platform; same monorepo for
 # both — Claude reads .claude-plugin/marketplace.json, Codex reads
 # .agents/plugins/marketplace.json; marketplace `rogue-marketplace` + plugin
@@ -830,7 +863,7 @@ Write-Host @"
 
 v Rogue Security installed.
 
-  Credentials:  $EnvFile
+  Credentials:  $CredentialSource
 
 Next steps:
   1. Fully quit and reopen each agent (hooks load credentials at session start).
diff --git a/install.sh b/install.sh
index 681cf3f..0bfe001 100755
--- a/install.sh
+++ b/install.sh
@@ -59,6 +59,7 @@ CONFIG_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
 STATUSLINE_PATH="$CONFIG_DIR/hooks/rogue-statusline.sh"
 SETTINGS_PATH="$CONFIG_DIR/settings.json"
 ENV_FILE="$HOME/.rogue-env"
+MACHINE_ENV_FILE="/etc/rogue/env"
 
 NON_INTERACTIVE="${ROGUE_NON_INTERACTIVE:-0}"
 # Explicit agent selection via --claude/--codex/--cursor. Empty = auto-detect all.
@@ -676,22 +677,27 @@ key_hint() { # key_hint <key>
   if [ "${#k}" -le 8 ]; then printf '%s' "$k"; else printf '%s…' "${k:0:8}"; fi
 }
 
+env_file_has_key() { # env_file_has_key <file>
+  [ -r "$1" ] && grep -Eq "^[[:space:]]*(export[[:space:]]+)?ROGUE_API_KEY=[\"']?[^\"'[:space:]]" "$1"
+}
+
 configure_credentials() {
+  # The hooks read a keyed machine env file alone, so a user env file written
+  # here would never be consulted.
+  if env_file_has_key "$MACHINE_ENV_FILE"; then
+    ok "Credentials come from the machine env file ${C_DIM}$MACHINE_ENV_FILE${C_RESET} — no API key prompt, $ENV_FILE not written"
+    return
+  fi
+
   # Capture explicit input (CLI flags / env vars) BEFORE sourcing the on-disk
-  # files — otherwise a stored key would clobber a key the caller passed to
+  # file — otherwise a stored key would clobber a key the caller passed to
   # rotate it. Explicit user intent wins; on-disk is the fallback.
   local flag_key="${ROGUE_API_KEY:-}"
   local flag_email="${ROGUE_ACTOR_EMAIL:-}"
   local flag_name="${ROGUE_ACTOR_NAME:-}"
   local flag_base_url="$ROGUE_BASE_URL"
 
-  # Pull anything already on disk into scope: the first env file holding
-  # ROGUE_API_KEY, as the hooks read it.
-  for _env_file in /etc/rogue/env "$ENV_FILE"; do
-    if [ -r "$_env_file" ] && grep -Eq "^[[:space:]]*(export[[:space:]]+)?ROGUE_API_KEY=[\"']?[^\"'[:space:]]" "$_env_file"; then
-      . "$_env_file"; break
-    fi
-  done
+  ! env_file_has_key "$ENV_FILE" || . "$ENV_FILE"
 
   [ "$BASE_URL_EXPLICIT" = "1" ] && ROGUE_BASE_URL="$flag_base_url"
 
@@ -1053,7 +1059,7 @@ main() {
     [ -n "$agents" ] || die "No supported coding agent found (looked for: claude, codex, cursor, gemini, copilot, antigravity, kiro). Install Claude Code (https://claude.com/code), OpenAI Codex, Cursor (https://cursor.com), Gemini CLI (https://geminicli.com), GitHub Copilot CLI (https://github.com/github/copilot-cli), Google Antigravity, or Kiro (https://kiro.dev) first."
   fi
 
-  # Credentials once — every plugin reads the shared ~/.rogue-env.
+  # Credentials once — every plugin reads the machine env file, else the shared ~/.rogue-env.
   configure_credentials
 
   for a in $agents; do
diff --git a/tests/test_setup_env.ps1 b/tests/test_setup_env.ps1
index aef3e2e..9b6c08a 100644
--- a/tests/test_setup_env.ps1
+++ b/tests/test_setup_env.ps1
@@ -190,7 +190,7 @@ Check 'install.ps1: merges existing lines' $true ($installer -match 'foreach \(\
 Check 'install.ps1: reads the merge source as UTF-8' $true `
     ($installer -match 'Get-Content -LiteralPath \$EnvFile -Encoding UTF8')
 Check 'install.ps1: reads existing creds as UTF-8' $true `
-    ($installer -match 'Get-Content -LiteralPath \$f -Encoding UTF8')
+    ($installer -match 'Get-Content -LiteralPath \$script:EnvFile -Encoding UTF8')
 
 $dispatcher = Get-Content -Raw -LiteralPath (Join-Path $repo 'plugins/rogue/scripts/hook.ps1')
 function Get-NormalizedFunction {
@@ -212,12 +212,16 @@ $loadFn = [regex]::Match($installer, '(?ms)^function Load-ExistingCreds \{.*?^\}
 Check 'install.ps1: Load-ExistingCreds located' $true ($loadFn.Length -gt 0)
 $unquoteFn = [regex]::Match($installer, '(?ms)^function ConvertFrom-ShellQuoted \{.*?^\}').Value
 Check 'install.ps1: ConvertFrom-ShellQuoted located' $true ($unquoteFn.Length -gt 0)
+$hasKeyFn = [regex]::Match($installer, '(?ms)^function Test-EnvFileHasKey \{.*?^\}').Value
+Check 'install.ps1: Test-EnvFileHasKey located' $true ($hasKeyFn.Length -gt 0)
 . ([scriptblock]::Create($unquoteFn))
+. ([scriptblock]::Create($hasKeyFn))
 . ([scriptblock]::Create($loadFn))
 
 $ROGUE_BASE_URL_DEFAULT = 'https://api.rogue.security'
 $saveProfile = $env:USERPROFILE
 $env:USERPROFILE = $sandbox
+$EnvFile = Join-Path $env:USERPROFILE '.rogue-env'
 [System.IO.File]::WriteAllText((Join-Path $sandbox '.rogue-env'), $seed + "`n",
     (New-Object System.Text.UTF8Encoding($false)))
 

From 1aa492f83353b39fc1e8fc6207f6d9e0b79df913 Mon Sep 17 00:00:00 2001
From: Yuval <yuval@qualifire.ai>
Date: Fri, 11 Sep 2026 08:28:50 +0300
Subject: [PATCH 2/6] test(plugins): cover the installer's machine env file
 skip and unchanged paths (FIRE-2119)

Both suites stage the machine candidate in a sandbox: the sh one runs a full
non-interactive --cursor install from a copy of install.sh with the path
redirected, plus configure_credentials with a fed terminal; the PowerShell one
drives Configure-Credentials through the seam with Read-Host counted.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/workflows/validate.yml |   4 +
 tests/test_install_env_ps1.ps1 | 113 +++++++++++++++++++++++++
 tests/test_install_env_sh.sh   | 147 +++++++++++++++++++++++++++++++++
 3 files changed, 264 insertions(+)
 create mode 100644 tests/test_install_env_ps1.ps1
 create mode 100755 tests/test_install_env_sh.sh

diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index e16fd73..051a964 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -118,6 +118,7 @@ jobs:
           TEST_SH=dash bash tests/test_hook_sh_cursor.sh
           TEST_SH=dash bash tests/test_env_first_found.sh
           TEST_SH=bash bash tests/test_env_first_found.sh
+          bash tests/test_install_env_sh.sh
       - name: Kiro installer (temp HOME, fake kiro-cli)
         # install.sh --kiro is the only installer that WRITES the vendor's hook
         # wiring itself (a hook file, Crew wrappers, a merge into every agent
@@ -362,6 +363,7 @@ jobs:
           pwsh -NoProfile -File tests/test_env_file_trust.ps1
           pwsh -NoProfile -File tests/test_env_first_found.ps1
           pwsh -NoProfile -File tests/test_install_kiro_ps1.ps1
+          pwsh -NoProfile -File tests/test_install_env_ps1.ps1
           pwsh -NoProfile -File tests/test_status_kiro_ps1.ps1
 
   windows:
@@ -427,5 +429,7 @@ jobs:
           if ($LASTEXITCODE -ne 0) { exit 1 }
           powershell -NoProfile -File tests/test_install_kiro_ps1.ps1
           if ($LASTEXITCODE -ne 0) { exit 1 }
+          powershell -NoProfile -File tests/test_install_env_ps1.ps1
+          if ($LASTEXITCODE -ne 0) { exit 1 }
           powershell -NoProfile -File tests/test_status_kiro_ps1.ps1
           if ($LASTEXITCODE -ne 0) { exit 1 }
diff --git a/tests/test_install_env_ps1.ps1 b/tests/test_install_env_ps1.ps1
new file mode 100644
index 0000000..751f03a
--- /dev/null
+++ b/tests/test_install_env_ps1.ps1
@@ -0,0 +1,113 @@
+#!/usr/bin/env pwsh
+# tests/test_install_env_ps1.ps1 - install.ps1 and the machine env file, in
+# lockstep with tests/test_install_env_sh.sh.
+#
+# A keyed C:\ProgramData\rogue\env is read alone by every dispatcher, so on such
+# a machine the installer prompts for nothing and writes no %USERPROFILE%\.rogue-env;
+# it names the file in use. With the machine file absent, or present without
+# ROGUE_API_KEY, the prompt and the user env file write are as they were.
+# Configure-Credentials is loaded through the ROGUE_INSTALL_LIB_ONLY seam with
+# both file paths pointed into a sandbox, Read-Host counting its calls, and
+# Invoke-WebRequest answering 200. Runs on any platform with PowerShell.
+
+$here = Split-Path -Parent $MyInvocation.MyCommand.Path
+$installer = [System.IO.Path]::Combine($here, '..', 'install.ps1')
+
+$work = Join-Path ([System.IO.Path]::GetTempPath()) ("rogue-env-install-" + [System.IO.Path]::GetRandomFileName())
+New-Item -ItemType Directory -Path $work -Force | Out-Null
+
+$prevKey = $env:ROGUE_API_KEY
+$prevProfile = $env:USERPROFILE
+$env:ROGUE_API_KEY = $null
+$env:USERPROFILE = $work
+$env:ROGUE_INSTALL_LIB_ONLY = '1'
+. $installer
+$env:ROGUE_INSTALL_LIB_ONLY = $null
+$ErrorActionPreference = 'Stop'
+
+$MachineEnvFile = Join-Path $work 'machine-env'
+$EnvFile        = Join-Path $work '.rogue-env'
+$Email = 'tester@example.com'; $Name = 'Tester'
+
+$script:prompts = 0
+function Read-Host {
+    param([Parameter(Position = 0)][string]$Prompt, [switch]$AsSecureString)
+    $script:prompts++
+    return (ConvertTo-SecureString 'typed-key' -AsPlainText -Force)
+}
+function Invoke-WebRequest { return [pscustomobject]@{ StatusCode = 200 } }
+
+$fails = 0
+function Assert-Eq {
+    param($Got, $Expected, [string]$Label)
+    if ([string]$Got -ceq [string]$Expected) { Write-Host "  ok: $Label" }
+    else { Write-Host "FAIL [$Label]: got <$Got>, expected <$Expected>"; $script:fails++ }
+}
+
+# Run-Configure <api-key> -> the installer's console output as one string.
+function Run-Configure {
+    param([string]$Key)
+    $script:ApiKey = $Key
+    $script:CredentialSource = $null
+    $script:prompts = 0
+    Remove-Item -LiteralPath $EnvFile -Force -ErrorAction SilentlyContinue
+    return (Configure-Credentials 6>&1 | Out-String)
+}
+function Get-WrittenKey {
+    if (-not (Test-Path -LiteralPath $EnvFile)) { return '<no file>' }
+    foreach ($line in (Get-Content -LiteralPath $EnvFile)) {
+        if ($line -match "^export ROGUE_API_KEY='(.*)'$") { return $Matches[1] }
+    }
+    return '<no key line>'
+}
+
+# -- 1. Machine env file with a key: no prompt, no user env file -------------------
+[System.IO.File]::WriteAllText($MachineEnvFile, "export ROGUE_API_KEY='machine-key'`nexport ROGUE_ACTOR_EMAIL='mdm@example.com'`n")
+$NonInteractive = $true
+$out = Run-Configure ''
+Assert-Eq $script:prompts 0 'keyed machine file: no credential prompt'
+Assert-Eq (Test-Path -LiteralPath $EnvFile) $false 'keyed machine file: no user env file'
+Assert-Eq ($out -match [regex]::Escape("machine env file $MachineEnvFile")) $true 'keyed machine file: output names the machine file'
+Assert-Eq $CredentialSource $MachineEnvFile 'keyed machine file: summary points at the machine file'
+
+$NonInteractive = $false
+$out = Run-Configure ''
+Assert-Eq $script:prompts 0 'keyed machine file, interactive: no prompt'
+Assert-Eq (Test-Path -LiteralPath $EnvFile) $false 'keyed machine file, interactive: no user env file'
+
+$out = Run-Configure 'passed-key'
+Assert-Eq (Test-Path -LiteralPath $EnvFile) $false 'keyed machine file + passed key: no user env file'
+
+# -- 2. No machine env file: unchanged ---------------------------------------------
+Remove-Item -LiteralPath $MachineEnvFile -Force
+$NonInteractive = $true
+$out = Run-Configure 'passed-key'
+Assert-Eq $script:prompts 0 'no machine file, non-interactive: no prompt'
+Assert-Eq (Get-WrittenKey) 'passed-key' 'no machine file, non-interactive: passed key written'
+Assert-Eq ($out -match 'machine env file') $false 'no machine file: output does not name a machine file'
+Assert-Eq $CredentialSource $EnvFile 'no machine file: summary points at the user file'
+
+$NonInteractive = $false
+$out = Run-Configure ''
+Assert-Eq $script:prompts 1 'no machine file, interactive: prompts once'
+Assert-Eq (Get-WrittenKey) 'typed-key' 'no machine file, interactive: typed key written'
+
+# -- 3. Machine env file without a key: unchanged, as in 2 --------------------------
+[System.IO.File]::WriteAllText($MachineEnvFile, "export ROGUE_ACTOR_EMAIL='mdm@example.com'`n# ROGUE_API_KEY='commented-out'`nexport ROGUE_API_KEY=`n")
+$NonInteractive = $true
+$out = Run-Configure 'passed-key'
+Assert-Eq $script:prompts 0 'keyless machine file, non-interactive: no prompt'
+Assert-Eq (Get-WrittenKey) 'passed-key' 'keyless machine file, non-interactive: passed key written'
+Assert-Eq ($out -match 'machine env file') $false 'keyless machine file: output does not name a machine file'
+
+$NonInteractive = $false
+$out = Run-Configure ''
+Assert-Eq $script:prompts 1 'keyless machine file, interactive: prompts once'
+Assert-Eq (Get-WrittenKey) 'typed-key' 'keyless machine file, interactive: typed key written'
+
+$env:ROGUE_API_KEY = $prevKey
+$env:USERPROFILE = $prevProfile
+Remove-Item -Recurse -Force $work -ErrorAction SilentlyContinue
+Write-Host ''
+if ($fails -eq 0) { Write-Host 'all install env-file tests passed'; exit 0 }
+Write-Host "$fails FAILED"; exit 1
diff --git a/tests/test_install_env_sh.sh b/tests/test_install_env_sh.sh
new file mode 100755
index 0000000..3c8d523
--- /dev/null
+++ b/tests/test_install_env_sh.sh
@@ -0,0 +1,147 @@
+#!/usr/bin/env bash
+# tests/test_install_env_sh.sh — install.sh and the machine env file.
+#
+# A keyed /etc/rogue/env is read alone by every hook, so on such a machine the
+# installer prompts for nothing and writes no ~/.rogue-env; it prints which file
+# is in use and installs the plugins as before. With the machine file absent, or
+# present without ROGUE_API_KEY, the prompt and the user env file write are as
+# they were. install.sh runs from a COPY whose /etc/rogue/env literal points into
+# the sandbox (the only way to stage the machine candidate without root).
+#
+#   bash tests/test_install_env_sh.sh
+set -euo pipefail
+
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+fails=0
+
+ok()  { echo "  ok: $1"; }
+bad() { echo "FAIL [$1]: $2"; fails=$((fails + 1)); }
+check() { # <label> <expected> <actual>
+  if [ "$2" = "$3" ]; then ok "$1"; else bad "$1" "expected [$2], got [$3]"; fi
+}
+
+MACHINE="$WORK/machine-env"
+INSTALLER="$WORK/install.sh"
+sed "s#/etc/rogue/env#$MACHINE#g" "$REPO/install.sh" > "$INSTALLER"
+grep -q "MACHINE_ENV_FILE=\"$MACHINE\"" "$INSTALLER" || { echo "the machine path was not redirected"; exit 1; }
+
+# `curl -o <file> <url>` hands the installer the locally built Cursor tarball;
+# any other call is the key validation POST and answers like an empty 200.
+BIN="$WORK/bin"; mkdir -p "$BIN"
+cat > "$BIN/curl" <<'STUB'
+#!/usr/bin/env bash
+out=""
+while [ $# -gt 0 ]; do case "$1" in -o) out="$2"; shift ;; esac; shift; done
+if [ -n "$out" ]; then cp "$TARBALL" "$out"; exit 0; fi
+printf '{}\n200'
+STUB
+chmod +x "$BIN/curl"
+
+stage="$WORK/stage/rogue-plugin-cursor/plugins"
+mkdir -p "$stage"
+cp -R "$REPO/plugins/cursor" "$stage/cursor"
+TARBALL="$WORK/rogue-plugin-cursor.tar.gz"
+tar -czf "$TARBALL" -C "$WORK/stage" rogue-plugin-cursor
+export TARBALL
+
+seed_machine() { # <line>...
+  printf '%s\n' "$@" > "$MACHINE"
+}
+
+OUT="$WORK/out"; ERR="$WORK/err"
+# run_install <home> [VAR=value ...] — a full non-interactive `--cursor` install.
+run_install() {
+  local home="$1"; shift
+  mkdir -p "$home"
+  set +e
+  ( cd "$home" && env "$@" PATH="$BIN:$PATH" HOME="$home" NO_COLOR=1 ROGUE_NON_INTERACTIVE=1 \
+      bash "$INSTALLER" --cursor ) > "$OUT" 2> "$ERR"
+  LAST_RC=$?
+  set -e
+}
+
+# run_configure <home> <input-file> [VAR=value ...] — configure_credentials alone,
+# interactive, with the terminal (fd 3) fed from <input-file>.
+run_configure() {
+  local home="$1" input="$2"; shift 2
+  mkdir -p "$home"
+  set +e
+  ( cd "$home" && env "$@" PATH="$BIN:$PATH" HOME="$home" NO_COLOR=1 ROGUE_INSTALL_LIB_ONLY=1 \
+      bash -c '. "$1"; NON_INTERACTIVE=0; HAVE_TTY=1; exec 3<"$2"; agents="cursor"; configure_credentials' _ "$INSTALLER" "$input" ) > "$OUT" 2> "$ERR"
+  LAST_RC=$?
+  set -e
+}
+
+prompted() { grep -c 'Rogue API key' "$ERR" || :; }
+
+# ═════════════════════════════════════════════════════════════════════════════
+# 1. Machine env file with a key: no prompt, no user env file, plugin installed
+# ═════════════════════════════════════════════════════════════════════════════
+seed_machine "export ROGUE_API_KEY='machine-key'" "export ROGUE_ACTOR_EMAIL='mdm@example.com'"
+H="$WORK/home1"
+run_install "$H" ROGUE_API_KEY=""
+check "keyed machine file: install exits 0" "0" "$LAST_RC"
+[ "$LAST_RC" = 0 ] || cat "$ERR"
+[ -e "$H/.rogue-env" ] && bad "keyed machine file: no user env file" "$H/.rogue-env was written" \
+  || ok "keyed machine file: no user env file"
+check "keyed machine file: no credential prompt" "0" "$(prompted)"
+check "keyed machine file: output names the machine file once" "1" "$(grep -c "machine env file $MACHINE" "$ERR" || :)"
+[ -f "$H/.cursor/plugins/local/rogue/.cursor-plugin/plugin.json" ] && ok "keyed machine file: plugin still installed" \
+  || bad "keyed machine file: plugin still installed" "$(cat "$ERR")"
+
+# A key passed by the caller changes nothing: the machine file is read alone.
+H="$WORK/home1b"
+run_install "$H" ROGUE_API_KEY="passed-key"
+check "keyed machine file + passed key: install exits 0" "0" "$LAST_RC"
+[ -e "$H/.rogue-env" ] && bad "keyed machine file + passed key: no user env file" "written" \
+  || ok "keyed machine file + passed key: no user env file"
+
+# Interactive: the prompt is skipped even with a terminal and typed input.
+H="$WORK/home1c"
+printf 'typed-key\n\n\n' > "$WORK/input1"
+run_configure "$H" "$WORK/input1" ROGUE_API_KEY=""
+check "keyed machine file, interactive: exits 0" "0" "$LAST_RC"
+check "keyed machine file, interactive: no prompt" "0" "$(prompted)"
+[ -e "$H/.rogue-env" ] && bad "keyed machine file, interactive: no user env file" "written" \
+  || ok "keyed machine file, interactive: no user env file"
+
+# ═════════════════════════════════════════════════════════════════════════════
+# 2. No machine env file: unchanged — the passed key lands in ~/.rogue-env, and an
+#    interactive run prompts
+# ═════════════════════════════════════════════════════════════════════════════
+rm -f "$MACHINE"
+H="$WORK/home2"
+run_install "$H" ROGUE_API_KEY="passed-key"
+check "no machine file: install exits 0" "0" "$LAST_RC"
+[ "$LAST_RC" = 0 ] || cat "$ERR"
+check "no machine file: user env file holds the passed key" "export ROGUE_API_KEY='passed-key'" "$(grep '^export ROGUE_API_KEY=' "$H/.rogue-env" || :)"
+check "no machine file: output does not name a machine file" "0" "$(grep -c 'machine env file' "$ERR" || :)"
+
+H="$WORK/home2b"
+printf 'typed-key\n\n\n' > "$WORK/input2"
+run_configure "$H" "$WORK/input2" ROGUE_API_KEY=""
+check "no machine file, interactive: exits 0" "0" "$LAST_RC"
+check "no machine file, interactive: prompts for the key" "1" "$(prompted)"
+check "no machine file, interactive: typed key written" "export ROGUE_API_KEY='typed-key'" "$(grep '^export ROGUE_API_KEY=' "$H/.rogue-env" || :)"
+
+# ═════════════════════════════════════════════════════════════════════════════
+# 3. Machine env file without a key: unchanged, as in 2
+# ═════════════════════════════════════════════════════════════════════════════
+seed_machine "export ROGUE_ACTOR_EMAIL='mdm@example.com'" "# ROGUE_API_KEY='commented-out'" "export ROGUE_API_KEY="
+H="$WORK/home3"
+run_install "$H" ROGUE_API_KEY="passed-key"
+check "keyless machine file: install exits 0" "0" "$LAST_RC"
+[ "$LAST_RC" = 0 ] || cat "$ERR"
+check "keyless machine file: user env file holds the passed key" "export ROGUE_API_KEY='passed-key'" "$(grep '^export ROGUE_API_KEY=' "$H/.rogue-env" || :)"
+check "keyless machine file: output does not name a machine file" "0" "$(grep -c 'machine env file' "$ERR" || :)"
+
+H="$WORK/home3b"
+printf 'typed-key\n\n\n' > "$WORK/input3"
+run_configure "$H" "$WORK/input3" ROGUE_API_KEY=""
+check "keyless machine file, interactive: prompts for the key" "1" "$(prompted)"
+check "keyless machine file, interactive: typed key written" "export ROGUE_API_KEY='typed-key'" "$(grep '^export ROGUE_API_KEY=' "$H/.rogue-env" || :)"
+
+echo
+if [ "$fails" -eq 0 ]; then echo "all install env-file tests passed"; else echo "$fails FAILED"; exit 1; fi

From 8f52b7744f7c6d125732faa6d676109ec5825602 Mon Sep 17 00:00:00 2001
From: Yuval <yuval@qualifire.ai>
Date: Sat, 12 Sep 2026 21:45:53 +0300
Subject: [PATCH 3/6] fix(plugins): installer trusts, validates and reports the
 machine env file as the hooks do (FIRE-2119)

Kiro and the log shipper read /etc/rogue/env (C:\ProgramData\rogue\env) only
when it is root/SYSTEM-owned and writable by nobody else, so the installer now
applies the same rule before skipping the user env file; a keyed but untrusted
machine file gets a warning naming its owner/mode and the user file is written
as before. On the machine path the file's key is validated (and the roster row
registered) with its own base URL and actor email, read without sourcing;
401/403 warns and names the file instead of passing silently. A key or base
URL passed to the installer on such a machine is reported as ignored, with the
MDM rotation path.

Both suites add the untrusted, rejected-key and ignored-key cases; the
PowerShell one also runs install.ps1 end to end with -Cursor so the credential
skip is shown not to end the installer.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 README.md                      |   5 +-
 install.ps1                    |  88 +++++++++++++++----
 install.sh                     |  86 +++++++++++++++----
 tests/test_install_env_ps1.ps1 | 149 +++++++++++++++++++++++++++++----
 tests/test_install_env_sh.sh   | 101 +++++++++++++++++-----
 tests/test_setup_env.ps1       |   5 +-
 6 files changed, 364 insertions(+), 70 deletions(-)

diff --git a/README.md b/README.md
index 3550d4a..217a35d 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,10 @@ Rogue plugin into each — **Claude Code**, **OpenAI Codex**, **Cursor**,
 writing the shared `~/.rogue-env` (`%USERPROFILE%\.rogue-env` on
 Windows) once. On a machine whose `/etc/rogue/env` (`C:\ProgramData\rogue\env`)
 already holds `ROGUE_API_KEY` it prompts for nothing and writes no user file:
-that machine file is the one the hooks read. Claude and Codex install through
+that machine file is the one the hooks read, and its key is validated in place.
+A machine file that is not root-owned (SYSTEM/Administrators on Windows) or is
+writable by others is skipped by Kiro and the log shipper, so the installer
+warns and falls back to the user file. Claude and Codex install through
 their native plugin CLIs (`claude plugin install` / `codex plugin add`);
 **Cursor has no plugin CLI**, so
 its plugin is copied into `~/.cursor/plugins/local/rogue` from the release tarball;
diff --git a/install.ps1 b/install.ps1
index b7cea10..586c172 100644
--- a/install.ps1
+++ b/install.ps1
@@ -7,6 +7,8 @@
 
     With credentials via environment variables (non-interactive):
     $env:ROGUE_API_KEY='rsk_xxx'; $env:ROGUE_ACTOR_EMAIL='you@co.com'; iwr -useb https://raw.githubusercontent.com/qualifire-dev/rogue-plugins/main/install.ps1 | iex
+    A key passed this way is ignored when C:\ProgramData\rogue\env already holds
+    one: that file is read alone.
 
     Direct invocation with flags:
     .\install.ps1 -ApiKey rsk_xxx -Email you@co.com -Name 'Your Name'
@@ -361,16 +363,50 @@ function Test-EnvFileHasKey {
     return $false
 }
 
-# Load existing creds from the user env file when it holds ROGUE_API_KEY, as the
-# dispatcher reads it.
-function Load-ExistingCreds {
-    if (-not (Test-EnvFileHasKey $script:EnvFile)) { return }
+function Read-EnvFileValues {
+    param([string]$Path)
     $vals = @{}
-    foreach ($line in (Get-Content -LiteralPath $script:EnvFile -Encoding UTF8 -ErrorAction SilentlyContinue)) {
+    foreach ($line in (Get-Content -LiteralPath $Path -Encoding UTF8 -ErrorAction SilentlyContinue)) {
         if ($line -match '^\s*(?:export\s+)?([A-Z_][A-Z0-9_]*)=(.+)$') {
             $vals[$Matches[1]] = ConvertFrom-ShellQuoted $Matches[2].Trim()
         }
     }
+    return $vals
+}
+
+# Same rule as Test-RogueEnvFile -System (scripts/shared/env-file.ps1), inlined
+# because this installer is one downloaded file: owned by SYSTEM or Administrators
+# (root off Windows), writable by nobody else.
+function Test-MachineEnvTrusted {
+    param([string]$Path)
+    try {
+        if ($PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows) {
+            $info = & stat -Lc '%u %a' $Path 2>$null
+            if ($LASTEXITCODE -ne 0) { $info = & stat -Lf '%u %Lp' $Path 2>$null }
+            if ($LASTEXITCODE -ne 0 -or $info -notmatch '^(\d+) ([0-7]+)$') { return $false }
+            return ($Matches[1] -eq '0' -and ([Convert]::ToInt32($Matches[2], 8) -band 18) -eq 0)
+        }
+        if ($PSVersionTable.PSVersion.Major -eq 5) {
+            Import-Module (Join-Path $PSHOME 'Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1') -ErrorAction Stop
+        }
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
+        $admins = @('S-1-5-18', 'S-1-5-32-544')
+        $trusted = @($admins) + [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+        if ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -notin $admins) { return $false }
+        $write = [System.Security.AccessControl.FileSystemRights]'Write, Delete, ChangePermissions, TakeOwnership, DeleteSubdirectoriesAndFiles'
+        foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+            if ($rule.AccessControlType -eq 'Allow' -and ($rule.FileSystemRights -band $write) -and
+                $rule.IdentityReference.Value -notin $trusted) { return $false }
+        }
+        return $true
+    } catch { return $false }
+}
+
+# Load existing creds from the user env file when it holds ROGUE_API_KEY, as the
+# dispatcher reads it.
+function Load-ExistingCreds {
+    if (-not (Test-EnvFileHasKey $script:EnvFile)) { return }
+    $vals = Read-EnvFileValues $script:EnvFile
     if (-not $script:ApiKey) { $script:ApiKey = $vals['ROGUE_API_KEY'] }
     if (-not $script:Email -and $vals['ROGUE_ACTOR_EMAIL']) { $script:Email = $vals['ROGUE_ACTOR_EMAIL'] }
     if (-not $script:Name -and $vals['ROGUE_ACTOR_NAME']) { $script:Name = $vals['ROGUE_ACTOR_NAME'] }
@@ -404,6 +440,7 @@ function Resolve-Actor {
 # Validate the key AND register this install via /api/v1/hooks/status (the same
 # heartbeat the SessionStart hook calls), so the dashboard roster row is deduped.
 function Register-ApiKey {
+    param([string]$Key, [string]$Url, [string]$ActorEmail, [string]$MachineFile)
     Log 'Validating API key...'
     try {
         $hostName = $env:COMPUTERNAME; if (-not $hostName) { $hostName = 'unknown' }
@@ -420,20 +457,26 @@ function Register-ApiKey {
         elseif ($hasGemini)  { $scFamily = 'gemini';  $scAgent = 'gemini_cli' }
         elseif ($hasCopilot) { $scFamily = 'copilot'; $scAgent = 'github_copilot' }
         elseif ($hasKiro)    { $scFamily = 'kiro';    $scAgent = 'kiro_cli' }
-        $body = @{ agent_family = $scFamily; agent = $scAgent; host = $hostName; actor_email = [string]$Email } | ConvertTo-Json -Compress
+        $body = @{ agent_family = $scFamily; agent = $scAgent; host = $hostName; actor_email = $ActorEmail } | ConvertTo-Json -Compress
         $bytes = [System.Text.Encoding]::UTF8.GetBytes($body)
-        $resp = Invoke-WebRequest -Uri "$($BaseUrl.TrimEnd('/'))/api/v1/hooks/status" -Method Post `
-            -Headers @{ 'x-rogue-api-key' = $ApiKey } -ContentType 'application/json' `
+        $resp = Invoke-WebRequest -Uri "$($Url.TrimEnd('/'))/api/v1/hooks/status" -Method Post `
+            -Headers @{ 'x-rogue-api-key' = $Key } -ContentType 'application/json' `
             -Body $bytes -UseBasicParsing -TimeoutSec 10 -ErrorAction Stop
-        if ($resp.StatusCode -eq 200) { Ok 'Key validated.' } else { Warn2 "Unexpected response (HTTP $($resp.StatusCode)) - saving without verification." }
+        if ($resp.StatusCode -eq 200) { Ok 'Key validated.'; return }
+        if ($MachineFile) { Warn2 "Unexpected response (HTTP $($resp.StatusCode)) validating the key in $MachineFile" }
+        else { Warn2 "Unexpected response (HTTP $($resp.StatusCode)) - saving without verification." }
     } catch {
         $code = $null
         if ($_.Exception.Response) { try { $code = [int]$_.Exception.Response.StatusCode } catch {} }
         if ($code -eq 401 -or $code -eq 403) {
+            # Nothing is saved on the machine path, so a bad key can only be reported.
+            if ($MachineFile) { Warn2 "The key in $MachineFile is invalid (HTTP $code) - every hook fails open until the MDM script pushes a valid one"; return }
             if ($NonInteractive) { Die "Invalid API key (HTTP $code)." }
             Warn2 "Invalid key (HTTP $code) - saving anyway. Verify it at https://app.rogue.security/settings/api-keys"
+        } elseif ($MachineFile) {
+            Warn2 "Could not reach $Url to validate the key in $MachineFile"
         } else {
-            Warn2 "Could not reach $BaseUrl to validate - saving without verification."
+            Warn2 "Could not reach $Url to validate - saving without verification."
         }
     }
 }
@@ -489,19 +532,34 @@ function Write-UserEnvFile {
 }
 
 # The dispatchers read a keyed machine env file alone, so on such a machine the
-# user env file is never consulted: no prompt, no write.
+# user env file is never consulted: no prompt, no write, and a key passed to the
+# installer goes nowhere. The key is still validated the way the hooks will use it.
+function Use-MachineEnvFile {
+    $script:CredentialSource = $script:MachineEnvFile
+    Ok "Credentials come from the machine env file $script:MachineEnvFile - no API key prompt, $script:EnvFile not written."
+    if ($script:ApiKey -or $script:BaseUrlExplicit) {
+        Warn2 "The passed API key / base URL is ignored: $script:MachineEnvFile is read alone. Rotate it through the MDM script (docs/deployment.md, Rotating the API key)."
+    }
+    $vals = Read-EnvFileValues $script:MachineEnvFile
+    $url = if ($vals['ROGUE_BASE_URL']) { $vals['ROGUE_BASE_URL'] } else { $ROGUE_BASE_URL_DEFAULT }
+    if ($vals['ROGUE_ACTOR_EMAIL']) { $script:Email = $vals['ROGUE_ACTOR_EMAIL'] }
+    Resolve-Actor
+    Register-ApiKey -Key $vals['ROGUE_API_KEY'] -Url $url -ActorEmail $script:Email -MachineFile $script:MachineEnvFile
+}
+
 function Configure-Credentials {
     if (Test-EnvFileHasKey $script:MachineEnvFile) {
-        $script:CredentialSource = $script:MachineEnvFile
-        Ok "Credentials come from the machine env file $script:MachineEnvFile - no API key prompt, $script:EnvFile not written."
-        return
+        if (Test-MachineEnvTrusted $script:MachineEnvFile) { Use-MachineEnvFile; return }
+        # Kiro and the log shipper skip an untrusted machine file, so the user file
+        # must still be written for them.
+        Warn2 "$script:MachineEnvFile holds ROGUE_API_KEY but is not owned by SYSTEM/Administrators or is writable by others - Kiro and log shipping ignore it; configuring $script:EnvFile instead."
     }
     $script:CredentialSource = $script:EnvFile
     Load-ExistingCreds
     if (-not $script:ApiKey) { Read-ApiKey }
     Resolve-Actor
     if (-not $script:ApiKey) { return }
-    Register-ApiKey
+    Register-ApiKey -Key $script:ApiKey -Url $script:BaseUrl -ActorEmail $script:Email
     Write-UserEnvFile
 }
 
diff --git a/install.sh b/install.sh
index 0bfe001..a1802f2 100755
--- a/install.sh
+++ b/install.sh
@@ -14,7 +14,8 @@
 #
 # Env knobs:
 #   ROGUE_NON_INTERACTIVE=1   no prompts (used by auto-update.sh re-invocation)
-#   ROGUE_API_KEY=...         pre-seed the API key (skips the prompt)
+#   ROGUE_API_KEY=...         pre-seed the API key (skips the prompt; ignored when
+#                             /etc/rogue/env already holds one — that file is read alone)
 #   ROGUE_ACTOR_EMAIL=...     pre-seed actor identity
 #   ROGUE_ACTOR_NAME=...
 #   ROGUE_PLUGIN_REPO=...     marketplace source (default below)
@@ -681,12 +682,75 @@ env_file_has_key() { # env_file_has_key <file>
   [ -r "$1" ] && grep -Eq "^[[:space:]]*(export[[:space:]]+)?ROGUE_API_KEY=[\"']?[^\"'[:space:]]" "$1"
 }
 
+env_file_value() { # env_file_value <file> <VAR> — first assignment, unquoted, without sourcing
+  sed -nE "s/^[[:space:]]*(export[[:space:]]+)?$2=[\"']?([^\"'[:space:]]+).*/\2/p" "$1" | head -1
+}
+
+# Owner uid and octal mode, or nothing when stat cannot say.
+file_owner_mode() { # file_owner_mode <file>
+  stat -Lc '%u %a' "$1" 2>/dev/null || stat -Lf '%u %Lp' "$1" 2>/dev/null
+}
+
+# Same rule as rogue_env_is_trusted (scripts/shared/env-file.sh) for the system
+# path, inlined because this installer is one downloaded file: root-owned, and
+# neither group nor other may write.
+machine_env_is_trusted() { # machine_env_is_trusted <file>
+  local info owner mode
+  info="$(file_owner_mode "$1")" || return 1
+  owner="${info%% *}"; mode="${info#* }"
+  case "$owner:$mode" in *[!0-9:]*|:*) return 1 ;; esac
+  [ "$owner" = 0 ] && [ "$((0$mode & 022))" = 0 ]
+}
+
+# Resolve actor defaults (same cascade as plugins/rogue/scripts/actor.sh) so key
+# validation can register the roster row under the real email, deduped with the
+# later SessionStart heartbeats. Explicit flag/env beats on-disk.
+resolve_actor_defaults() { # resolve_actor_defaults <flag-email> <flag-name> → DEF_EMAIL, DEF_NAME
+  DEF_EMAIL="${1:-${ROGUE_ACTOR_EMAIL:-$(git config --global user.email 2>/dev/null)}}"
+  DEF_NAME="${2:-${ROGUE_ACTOR_NAME:-$(git config --global user.name 2>/dev/null)}}"
+  [ -n "$DEF_EMAIL" ] || DEF_EMAIL="${CLAUDE_CODE_USER_EMAIL:-}"
+  [ -n "$DEF_NAME" ]  || { DEF_NAME="${CLAUDE_CODE_USER_EMAIL:-}"; DEF_NAME="${DEF_NAME%@*}"; }
+  [ -n "$DEF_EMAIL" ] || DEF_EMAIL="$(hostname 2>/dev/null)"
+  [ -n "$DEF_NAME" ]  || DEF_NAME="$(whoami 2>/dev/null)"
+}
+
+# Validate the machine file's key (and register the roster row) the way the
+# hooks will use it: its own base URL, else the default; its own actor email,
+# else the cascade. Nothing is saved, so a bad key can only be reported.
+validate_machine_env_key() {
+  local key url code
+  key="$(env_file_value "$MACHINE_ENV_FILE" ROGUE_API_KEY)"
+  url="$(env_file_value "$MACHINE_ENV_FILE" ROGUE_BASE_URL)"
+  ROGUE_BASE_URL="${url:-$ROGUE_BASE_URL_DEFAULT}"
+  resolve_actor_defaults "$(env_file_value "$MACHINE_ENV_FILE" ROGUE_ACTOR_EMAIL)" ""
+  code="$(status_check "$key" "$DEF_EMAIL")"
+  case "$code" in
+    200)     ok "Key validated${STATUS_ORG:+ — org: $STATUS_ORG}" ;;
+    401|403) warn "The key in $MACHINE_ENV_FILE is invalid (HTTP $code) — every hook fails open until the MDM script pushes a valid one" ;;
+    '')      warn "Could not reach $ROGUE_BASE_URL to validate the key in $MACHINE_ENV_FILE" ;;
+    *)       warn "Unexpected response (HTTP $code) validating the key in $MACHINE_ENV_FILE" ;;
+  esac
+}
+
+# The hooks read a keyed machine env file alone, so a user env file written
+# here would never be consulted, and a key passed to the installer goes nowhere.
+use_machine_env_file() {
+  ok "Credentials come from the machine env file ${C_DIM}$MACHINE_ENV_FILE${C_RESET} — no API key prompt, $ENV_FILE not written"
+  if [ -n "${ROGUE_API_KEY:-}" ] || [ "$BASE_URL_EXPLICIT" = "1" ]; then
+    warn "The passed API key / base URL is ignored: $MACHINE_ENV_FILE is read alone. Rotate it through the MDM script (docs/deployment.md, Rotating the API key)."
+  fi
+  validate_machine_env_key
+}
+
 configure_credentials() {
-  # The hooks read a keyed machine env file alone, so a user env file written
-  # here would never be consulted.
   if env_file_has_key "$MACHINE_ENV_FILE"; then
-    ok "Credentials come from the machine env file ${C_DIM}$MACHINE_ENV_FILE${C_RESET} — no API key prompt, $ENV_FILE not written"
-    return
+    if machine_env_is_trusted "$MACHINE_ENV_FILE"; then
+      use_machine_env_file
+      return
+    fi
+    # Kiro and the log shipper skip an untrusted machine file, so the user file
+    # must still be written for them.
+    warn "$MACHINE_ENV_FILE holds ROGUE_API_KEY but is not root-owned with mode 644 or stricter (owner/mode: $(file_owner_mode "$MACHINE_ENV_FILE")) — Kiro and log shipping ignore it; configuring $ENV_FILE instead"
   fi
 
   # Capture explicit input (CLI flags / env vars) BEFORE sourcing the on-disk
@@ -703,16 +767,8 @@ configure_credentials() {
 
   local cur_key="${flag_key:-${ROGUE_API_KEY:-}}"
 
-  # Resolve actor defaults up front (same cascade as plugins/rogue/scripts/actor.sh)
-  # so key validation can register the roster row under the real email, deduped
-  # with the later SessionStart heartbeats. Explicit flag/env beats on-disk.
-  local def_email def_name
-  def_email="${flag_email:-${ROGUE_ACTOR_EMAIL:-$(git config --global user.email 2>/dev/null)}}"
-  def_name="${flag_name:-${ROGUE_ACTOR_NAME:-$(git config --global user.name 2>/dev/null)}}"
-  [ -n "$def_email" ] || def_email="${CLAUDE_CODE_USER_EMAIL:-}"
-  [ -n "$def_name" ]  || { def_name="${CLAUDE_CODE_USER_EMAIL:-}"; def_name="${def_name%@*}"; }
-  [ -n "$def_email" ] || def_email="$(hostname 2>/dev/null)"
-  [ -n "$def_name" ]  || def_name="$(whoami 2>/dev/null)"
+  resolve_actor_defaults "$flag_email" "$flag_name"
+  local def_email="$DEF_EMAIL" def_name="$DEF_NAME"
 
   # Non-interactive: persist whatever key is in scope (env-passed or on-disk),
   # filling actor identity from the resolved cascade. A key passed only via the
diff --git a/tests/test_install_env_ps1.ps1 b/tests/test_install_env_ps1.ps1
index 751f03a..c661702 100644
--- a/tests/test_install_env_ps1.ps1
+++ b/tests/test_install_env_ps1.ps1
@@ -2,40 +2,99 @@
 # tests/test_install_env_ps1.ps1 - install.ps1 and the machine env file, in
 # lockstep with tests/test_install_env_sh.sh.
 #
-# A keyed C:\ProgramData\rogue\env is read alone by every dispatcher, so on such
-# a machine the installer prompts for nothing and writes no %USERPROFILE%\.rogue-env;
-# it names the file in use. With the machine file absent, or present without
-# ROGUE_API_KEY, the prompt and the user env file write are as they were.
-# Configure-Credentials is loaded through the ROGUE_INSTALL_LIB_ONLY seam with
-# both file paths pointed into a sandbox, Read-Host counting its calls, and
-# Invoke-WebRequest answering 200. Runs on any platform with PowerShell.
+# A keyed C:\ProgramData\rogue\env owned by SYSTEM/Administrators is read alone
+# by every dispatcher, so on such a machine the installer prompts for nothing and
+# writes no %USERPROFILE%\.rogue-env; it names the file in use, validates its key
+# and installs the plugins as before. With the machine file absent, present
+# without ROGUE_API_KEY, or keyed but writable by others (Kiro and the log
+# shipper skip it), the prompt and the user env file write are as they were.
+# install.ps1 runs from a COPY whose machine path literal points into a sandbox:
+# once end to end (-Cursor, Invoke-WebRequest and the key validation stubbed),
+# otherwise Configure-Credentials through the ROGUE_INSTALL_LIB_ONLY seam with
+# Read-Host counting its calls. Off Windows a `stat` shim on PATH reports the
+# sandbox file as root-owned; on Windows its owner is set to Administrators.
 
 $here = Split-Path -Parent $MyInvocation.MyCommand.Path
-$installer = [System.IO.Path]::Combine($here, '..', 'install.ps1')
+$repo = [System.IO.Path]::GetFullPath([System.IO.Path]::Combine($here, '..'))
 
 $work = Join-Path ([System.IO.Path]::GetTempPath()) ("rogue-env-install-" + [System.IO.Path]::GetRandomFileName())
-New-Item -ItemType Directory -Path $work -Force | Out-Null
+$bin  = Join-Path $work 'bin'
+New-Item -ItemType Directory -Path $bin -Force | Out-Null
 
+$MachineEnvFile = Join-Path $work 'machine-env'
+$EnvFile        = Join-Path $work '.rogue-env'
+$installer = Join-Path $work 'install.ps1'
+$src = [System.IO.File]::ReadAllText((Join-Path $repo 'install.ps1'))
+$redirected = $src.Replace("`$MachineEnvFile = 'C:\ProgramData\rogue\env'", "`$MachineEnvFile = '$MachineEnvFile'")
+if ($redirected -eq $src) { Write-Host 'the machine path was not redirected'; exit 1 }
+[System.IO.File]::WriteAllText($installer, $redirected)
+
+$unix = $PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows
 $prevKey = $env:ROGUE_API_KEY
 $prevProfile = $env:USERPROFILE
+$prevPath = $env:PATH
 $env:ROGUE_API_KEY = $null
 $env:USERPROFILE = $work
+if ($unix) {
+    $realStat = (Get-Command stat -CommandType Application | Select-Object -First 1).Source
+    [System.IO.File]::WriteAllText((Join-Path $bin 'stat'), @"
+#!/usr/bin/env bash
+for a in "`$@"; do
+  if [ "`$a" = "$MachineEnvFile" ]; then
+    if "$realStat" --version >/dev/null 2>&1; then mode="`$("$realStat" -c %a "`$a")"; else mode="`$("$realStat" -f %Lp "`$a")"; fi
+    printf '%s %s\n' "`${ROGUE_TEST_MACHINE_OWNER:-0}" "`$mode"; exit 0
+  fi
+done
+exec "$realStat" "`$@"
+"@)
+    & chmod +x (Join-Path $bin 'stat')
+    $env:PATH = "$bin$([System.IO.Path]::PathSeparator)$env:PATH"
+}
+
 $env:ROGUE_INSTALL_LIB_ONLY = '1'
 . $installer
 $env:ROGUE_INSTALL_LIB_ONLY = $null
 $ErrorActionPreference = 'Stop'
-
-$MachineEnvFile = Join-Path $work 'machine-env'
-$EnvFile        = Join-Path $work '.rogue-env'
 $Email = 'tester@example.com'; $Name = 'Tester'
 
+# Machine file fixtures: trusted = owned by root/Administrators, writable by no
+# one else; untrusted = the same file with a write grant for everyone.
+function Set-MachineFile {
+    param([string]$Content, [switch]$Untrusted)
+    [System.IO.File]::WriteAllText($MachineEnvFile, $Content)
+    if ($unix) {
+        & chmod ($(if ($Untrusted) { '666' } else { '644' })) $MachineEnvFile
+        return
+    }
+    $acl = Get-Acl -LiteralPath $MachineEnvFile
+    $acl.SetOwner((New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-544')))
+    if ($Untrusted) {
+        $everyone = New-Object System.Security.Principal.SecurityIdentifier('S-1-1-0')
+        $acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($everyone, 'Write', 'Allow')))
+    }
+    Set-Acl -LiteralPath $MachineEnvFile -AclObject $acl
+}
+
+class FakeHttpError : System.Exception {
+    [object]$Response
+    FakeHttpError([int]$code) : base("HTTP $code") { $this.Response = [pscustomobject]@{ StatusCode = $code } }
+}
+# Env vars, not script variables: the stubs also run from the end-to-end child
+# script, whose $script: scope is its own.
+$env:ROGUE_TEST_HTTP_CODE = '200'
 $script:prompts = 0
 function Read-Host {
     param([Parameter(Position = 0)][string]$Prompt, [switch]$AsSecureString)
     $script:prompts++
     return (ConvertTo-SecureString 'typed-key' -AsPlainText -Force)
 }
-function Invoke-WebRequest { return [pscustomobject]@{ StatusCode = 200 } }
+# `-OutFile` is the Cursor tarball download; anything else is the validation POST.
+function Invoke-WebRequest {
+    $i = [array]::IndexOf($args, '-OutFile')
+    if ($i -ge 0) { Copy-Item -LiteralPath $env:ROGUE_TEST_TARBALL -Destination $args[$i + 1]; return }
+    if ($env:ROGUE_TEST_HTTP_CODE -ne '200') { throw [FakeHttpError]::new([int]$env:ROGUE_TEST_HTTP_CODE) }
+    return [pscustomobject]@{ StatusCode = 200 }
+}
 
 $fails = 0
 function Assert-Eq {
@@ -43,6 +102,7 @@ function Assert-Eq {
     if ([string]$Got -ceq [string]$Expected) { Write-Host "  ok: $Label" }
     else { Write-Host "FAIL [$Label]: got <$Got>, expected <$Expected>"; $script:fails++ }
 }
+function Count-Matches { param([string]$Text, [string]$Needle) return ([regex]::Matches($Text, [regex]::Escape($Needle))).Count }
 
 # Run-Configure <api-key> -> the installer's console output as one string.
 function Run-Configure {
@@ -61,13 +121,15 @@ function Get-WrittenKey {
     return '<no key line>'
 }
 
-# -- 1. Machine env file with a key: no prompt, no user env file -------------------
-[System.IO.File]::WriteAllText($MachineEnvFile, "export ROGUE_API_KEY='machine-key'`nexport ROGUE_ACTOR_EMAIL='mdm@example.com'`n")
+# -- 1. Trusted machine env file with a key: no prompt, no user env file, key validated
+Set-MachineFile "export ROGUE_API_KEY='machine-key'`nexport ROGUE_ACTOR_EMAIL='mdm@example.com'`n"
 $NonInteractive = $true
 $out = Run-Configure ''
 Assert-Eq $script:prompts 0 'keyed machine file: no credential prompt'
 Assert-Eq (Test-Path -LiteralPath $EnvFile) $false 'keyed machine file: no user env file'
-Assert-Eq ($out -match [regex]::Escape("machine env file $MachineEnvFile")) $true 'keyed machine file: output names the machine file'
+Assert-Eq (Count-Matches $out "machine env file $MachineEnvFile") 1 'keyed machine file: output names the machine file once'
+Assert-Eq (Count-Matches $out 'Key validated') 1 'keyed machine file: the machine key is validated'
+Assert-Eq (Count-Matches $out 'is ignored') 0 'keyed machine file: no ignored-key warning'
 Assert-Eq $CredentialSource $MachineEnvFile 'keyed machine file: summary points at the machine file'
 
 $NonInteractive = $false
@@ -77,6 +139,33 @@ Assert-Eq (Test-Path -LiteralPath $EnvFile) $false 'keyed machine file, interact
 
 $out = Run-Configure 'passed-key'
 Assert-Eq (Test-Path -LiteralPath $EnvFile) $false 'keyed machine file + passed key: no user env file'
+Assert-Eq (Count-Matches $out "API key / base URL is ignored: $MachineEnvFile") 1 'keyed machine file + passed key: warns that the key is ignored'
+
+$NonInteractive = $true
+$env:ROGUE_TEST_HTTP_CODE = '401'
+$out = Run-Configure ''
+$env:ROGUE_TEST_HTTP_CODE = '200'
+Assert-Eq (Count-Matches $out "key in $MachineEnvFile is invalid (HTTP 401)") 1 'keyed machine file, key rejected: warning names the file'
+Assert-Eq (Test-Path -LiteralPath $EnvFile) $false 'keyed machine file, key rejected: no user env file'
+
+# End to end: the credential skip does not end the installer; the Cursor section
+# runs and the summary prints. The plugin files themselves land only on Windows,
+# whose backslash paths the Cursor block is written for.
+$stage = [System.IO.Path]::Combine($work, 'stage', 'rogue-plugin-cursor', 'plugins')
+New-Item -ItemType Directory -Path $stage -Force | Out-Null
+Copy-Item -Recurse ([System.IO.Path]::Combine($repo, 'plugins', 'cursor')) ([System.IO.Path]::Combine($stage, 'cursor'))
+$env:ROGUE_TEST_TARBALL = Join-Path $work 'rogue-plugin-cursor.tar.gz'
+& tar -czf $env:ROGUE_TEST_TARBALL -C (Join-Path $work 'stage') rogue-plugin-cursor
+if ($LASTEXITCODE -ne 0) { Write-Host 'could not build the Cursor tarball'; exit 1 }
+$out = & $installer -Cursor -NonInteractive 6>&1 | Out-String
+Assert-Eq (Count-Matches $out "machine env file $MachineEnvFile") 1 'end to end: output names the machine file once'
+Assert-Eq (Count-Matches $out 'Key validated') 1 'end to end: the machine key is validated'
+Assert-Eq (Test-Path -LiteralPath $EnvFile) $false 'end to end: no user env file'
+Assert-Eq ($out -match 'Rogue Security - Cursor') $true 'end to end: the Cursor install runs after the credential skip'
+Assert-Eq ($out -match 'Credentials:\s+' + [regex]::Escape($MachineEnvFile)) $true 'end to end: summary lists the machine file'
+if (-not $unix) {
+    Assert-Eq (Test-Path -LiteralPath (Join-Path $work '.cursor\plugins\local\rogue\.cursor-plugin\plugin.json')) $true 'end to end: Cursor plugin installed'
+}
 
 # -- 2. No machine env file: unchanged ---------------------------------------------
 Remove-Item -LiteralPath $MachineEnvFile -Force
@@ -93,7 +182,7 @@ Assert-Eq $script:prompts 1 'no machine file, interactive: prompts once'
 Assert-Eq (Get-WrittenKey) 'typed-key' 'no machine file, interactive: typed key written'
 
 # -- 3. Machine env file without a key: unchanged, as in 2 --------------------------
-[System.IO.File]::WriteAllText($MachineEnvFile, "export ROGUE_ACTOR_EMAIL='mdm@example.com'`n# ROGUE_API_KEY='commented-out'`nexport ROGUE_API_KEY=`n")
+Set-MachineFile "export ROGUE_ACTOR_EMAIL='mdm@example.com'`n# ROGUE_API_KEY='commented-out'`nexport ROGUE_API_KEY=`n"
 $NonInteractive = $true
 $out = Run-Configure 'passed-key'
 Assert-Eq $script:prompts 0 'keyless machine file, non-interactive: no prompt'
@@ -105,8 +194,34 @@ $out = Run-Configure ''
 Assert-Eq $script:prompts 1 'keyless machine file, interactive: prompts once'
 Assert-Eq (Get-WrittenKey) 'typed-key' 'keyless machine file, interactive: typed key written'
 
+# -- 4. Keyed machine env file writable by others: a warning names it, then as in 2 --
+Set-MachineFile "export ROGUE_API_KEY='machine-key'`n" -Untrusted
+$NonInteractive = $true
+$out = Run-Configure 'passed-key'
+Assert-Eq (Count-Matches $out "$MachineEnvFile holds ROGUE_API_KEY but is not owned by SYSTEM/Administrators or is writable by others") 1 'writable machine file: warning names the file'
+Assert-Eq (Get-WrittenKey) 'passed-key' 'writable machine file, non-interactive: passed key written'
+Assert-Eq ($out -match 'Credentials come from the machine env file') $false 'writable machine file: not named as the credential source'
+
+$NonInteractive = $false
+$out = Run-Configure ''
+Assert-Eq $script:prompts 1 'writable machine file, interactive: prompts once'
+Assert-Eq (Get-WrittenKey) 'typed-key' 'writable machine file, interactive: typed key written'
+
+if ($unix) {
+    Set-MachineFile "export ROGUE_API_KEY='machine-key'`n"
+    $env:ROGUE_TEST_MACHINE_OWNER = (& id -u)
+    $NonInteractive = $true
+    $out = Run-Configure 'passed-key'
+    $env:ROGUE_TEST_MACHINE_OWNER = $null
+    Assert-Eq (Count-Matches $out "$MachineEnvFile holds ROGUE_API_KEY") 1 'user-owned machine file: warning names the file'
+    Assert-Eq (Get-WrittenKey) 'passed-key' 'user-owned machine file: passed key written'
+}
+
 $env:ROGUE_API_KEY = $prevKey
 $env:USERPROFILE = $prevProfile
+$env:PATH = $prevPath
+$env:ROGUE_TEST_HTTP_CODE = $null
+$env:ROGUE_TEST_TARBALL = $null
 Remove-Item -Recurse -Force $work -ErrorAction SilentlyContinue
 Write-Host ''
 if ($fails -eq 0) { Write-Host 'all install env-file tests passed'; exit 0 }
diff --git a/tests/test_install_env_sh.sh b/tests/test_install_env_sh.sh
index 3c8d523..3abc244 100755
--- a/tests/test_install_env_sh.sh
+++ b/tests/test_install_env_sh.sh
@@ -1,12 +1,15 @@
 #!/usr/bin/env bash
 # tests/test_install_env_sh.sh — install.sh and the machine env file.
 #
-# A keyed /etc/rogue/env is read alone by every hook, so on such a machine the
-# installer prompts for nothing and writes no ~/.rogue-env; it prints which file
-# is in use and installs the plugins as before. With the machine file absent, or
-# present without ROGUE_API_KEY, the prompt and the user env file write are as
-# they were. install.sh runs from a COPY whose /etc/rogue/env literal points into
-# the sandbox (the only way to stage the machine candidate without root).
+# A keyed, root-owned /etc/rogue/env is read alone by every hook, so on such a
+# machine the installer prompts for nothing and writes no ~/.rogue-env; it prints
+# which file is in use, validates the file's key, and installs the plugins as
+# before. With the machine file absent, present without ROGUE_API_KEY, or keyed
+# but not root-owned/mode 644 (Kiro and the log shipper skip it), the prompt and
+# the user env file write are as they were. install.sh runs from a COPY whose
+# /etc/rogue/env literal points into the sandbox, and a `stat` shim on PATH
+# reports that file as root-owned (the only way to stage the machine candidate
+# without root).
 #
 #   bash tests/test_install_env_sh.sh
 set -euo pipefail
@@ -27,17 +30,31 @@ INSTALLER="$WORK/install.sh"
 sed "s#/etc/rogue/env#$MACHINE#g" "$REPO/install.sh" > "$INSTALLER"
 grep -q "MACHINE_ENV_FILE=\"$MACHINE\"" "$INSTALLER" || { echo "the machine path was not redirected"; exit 1; }
 
-# `curl -o <file> <url>` hands the installer the locally built Cursor tarball;
-# any other call is the key validation POST and answers like an empty 200.
 BIN="$WORK/bin"; mkdir -p "$BIN"
+# `curl -o <file> <url>` hands the installer the locally built Cursor tarball;
+# any other call is the key validation POST and answers `{}` with CURL_CODE.
 cat > "$BIN/curl" <<'STUB'
 #!/usr/bin/env bash
 out=""
 while [ $# -gt 0 ]; do case "$1" in -o) out="$2"; shift ;; esac; shift; done
 if [ -n "$out" ]; then cp "$TARBALL" "$out"; exit 0; fi
-printf '{}\n200'
+printf '{}\n%s' "${CURL_CODE:-200}"
+STUB
+# The machine file is reported as owned by ROGUE_TEST_MACHINE_OWNER (root by
+# default) with its real mode; every other path goes to the real stat.
+REAL_STAT="$(command -v stat)"
+cat > "$BIN/stat" <<STUB
+#!/usr/bin/env bash
+for a in "\$@"; do
+  if [ "\$a" = "\$ROGUE_TEST_MACHINE_ENV" ]; then
+    if "$REAL_STAT" --version >/dev/null 2>&1; then mode="\$("$REAL_STAT" -c %a "\$a")"; else mode="\$("$REAL_STAT" -f %Lp "\$a")"; fi
+    printf '%s %s\n' "\${ROGUE_TEST_MACHINE_OWNER:-0}" "\$mode"; exit 0
+  fi
+done
+exec "$REAL_STAT" "\$@"
 STUB
-chmod +x "$BIN/curl"
+chmod +x "$BIN/curl" "$BIN/stat"
+export ROGUE_TEST_MACHINE_ENV="$MACHINE"
 
 stage="$WORK/stage/rogue-plugin-cursor/plugins"
 mkdir -p "$stage"
@@ -48,6 +65,7 @@ export TARBALL
 
 seed_machine() { # <line>...
   printf '%s\n' "$@" > "$MACHINE"
+  chmod 644 "$MACHINE"
 }
 
 OUT="$WORK/out"; ERR="$WORK/err"
@@ -75,28 +93,35 @@ run_configure() {
 }
 
 prompted() { grep -c 'Rogue API key' "$ERR" || :; }
+count() { grep -c -- "$1" "$ERR" || :; }
+no_user_file() { # <label> <home>
+  [ -e "$2/.rogue-env" ] && bad "$1: no user env file" "$2/.rogue-env was written" || ok "$1: no user env file"
+}
 
 # ═════════════════════════════════════════════════════════════════════════════
-# 1. Machine env file with a key: no prompt, no user env file, plugin installed
+# 1. Trusted machine env file with a key: no prompt, no user env file, the key is
+#    validated, plugin installed
 # ═════════════════════════════════════════════════════════════════════════════
 seed_machine "export ROGUE_API_KEY='machine-key'" "export ROGUE_ACTOR_EMAIL='mdm@example.com'"
 H="$WORK/home1"
 run_install "$H" ROGUE_API_KEY=""
 check "keyed machine file: install exits 0" "0" "$LAST_RC"
 [ "$LAST_RC" = 0 ] || cat "$ERR"
-[ -e "$H/.rogue-env" ] && bad "keyed machine file: no user env file" "$H/.rogue-env was written" \
-  || ok "keyed machine file: no user env file"
+no_user_file "keyed machine file" "$H"
 check "keyed machine file: no credential prompt" "0" "$(prompted)"
-check "keyed machine file: output names the machine file once" "1" "$(grep -c "machine env file $MACHINE" "$ERR" || :)"
+check "keyed machine file: output names the machine file once" "1" "$(count "machine env file $MACHINE")"
+check "keyed machine file: the machine key is validated" "1" "$(count 'Key validated')"
+check "keyed machine file: no ignored-key warning" "0" "$(count 'is ignored')"
 [ -f "$H/.cursor/plugins/local/rogue/.cursor-plugin/plugin.json" ] && ok "keyed machine file: plugin still installed" \
   || bad "keyed machine file: plugin still installed" "$(cat "$ERR")"
 
-# A key passed by the caller changes nothing: the machine file is read alone.
+# A key passed by the caller goes nowhere (the machine file is read alone) and
+# the installer says so.
 H="$WORK/home1b"
 run_install "$H" ROGUE_API_KEY="passed-key"
 check "keyed machine file + passed key: install exits 0" "0" "$LAST_RC"
-[ -e "$H/.rogue-env" ] && bad "keyed machine file + passed key: no user env file" "written" \
-  || ok "keyed machine file + passed key: no user env file"
+no_user_file "keyed machine file + passed key" "$H"
+check "keyed machine file + passed key: warns that the key is ignored" "1" "$(count "API key / base URL is ignored: $MACHINE")"
 
 # Interactive: the prompt is skipped even with a terminal and typed input.
 H="$WORK/home1c"
@@ -104,8 +129,16 @@ printf 'typed-key\n\n\n' > "$WORK/input1"
 run_configure "$H" "$WORK/input1" ROGUE_API_KEY=""
 check "keyed machine file, interactive: exits 0" "0" "$LAST_RC"
 check "keyed machine file, interactive: no prompt" "0" "$(prompted)"
-[ -e "$H/.rogue-env" ] && bad "keyed machine file, interactive: no user env file" "written" \
-  || ok "keyed machine file, interactive: no user env file"
+no_user_file "keyed machine file, interactive" "$H"
+
+# A revoked machine key is loud but does not stop the install.
+H="$WORK/home1d"
+run_install "$H" ROGUE_API_KEY="" CURL_CODE=401
+check "keyed machine file, key rejected: install exits 0" "0" "$LAST_RC"
+check "keyed machine file, key rejected: warning names the file" "1" "$(count "key in $MACHINE is invalid (HTTP 401)")"
+no_user_file "keyed machine file, key rejected" "$H"
+[ -f "$H/.cursor/plugins/local/rogue/.cursor-plugin/plugin.json" ] && ok "keyed machine file, key rejected: plugin still installed" \
+  || bad "keyed machine file, key rejected: plugin still installed" "$(cat "$ERR")"
 
 # ═════════════════════════════════════════════════════════════════════════════
 # 2. No machine env file: unchanged — the passed key lands in ~/.rogue-env, and an
@@ -117,7 +150,7 @@ run_install "$H" ROGUE_API_KEY="passed-key"
 check "no machine file: install exits 0" "0" "$LAST_RC"
 [ "$LAST_RC" = 0 ] || cat "$ERR"
 check "no machine file: user env file holds the passed key" "export ROGUE_API_KEY='passed-key'" "$(grep '^export ROGUE_API_KEY=' "$H/.rogue-env" || :)"
-check "no machine file: output does not name a machine file" "0" "$(grep -c 'machine env file' "$ERR" || :)"
+check "no machine file: output does not name a machine file" "0" "$(count 'machine env file')"
 
 H="$WORK/home2b"
 printf 'typed-key\n\n\n' > "$WORK/input2"
@@ -135,7 +168,7 @@ run_install "$H" ROGUE_API_KEY="passed-key"
 check "keyless machine file: install exits 0" "0" "$LAST_RC"
 [ "$LAST_RC" = 0 ] || cat "$ERR"
 check "keyless machine file: user env file holds the passed key" "export ROGUE_API_KEY='passed-key'" "$(grep '^export ROGUE_API_KEY=' "$H/.rogue-env" || :)"
-check "keyless machine file: output does not name a machine file" "0" "$(grep -c 'machine env file' "$ERR" || :)"
+check "keyless machine file: output does not name a machine file" "0" "$(count 'machine env file')"
 
 H="$WORK/home3b"
 printf 'typed-key\n\n\n' > "$WORK/input3"
@@ -143,5 +176,31 @@ run_configure "$H" "$WORK/input3" ROGUE_API_KEY=""
 check "keyless machine file, interactive: prompts for the key" "1" "$(prompted)"
 check "keyless machine file, interactive: typed key written" "export ROGUE_API_KEY='typed-key'" "$(grep '^export ROGUE_API_KEY=' "$H/.rogue-env" || :)"
 
+# ═════════════════════════════════════════════════════════════════════════════
+# 4. Keyed machine env file that Kiro and the log shipper would skip (group/other
+#    writable, or not root-owned): a warning names it, then as in 2
+# ═════════════════════════════════════════════════════════════════════════════
+seed_machine "export ROGUE_API_KEY='machine-key'"
+chmod 666 "$MACHINE"
+H="$WORK/home4"
+run_install "$H" ROGUE_API_KEY="passed-key"
+check "writable machine file: install exits 0" "0" "$LAST_RC"
+[ "$LAST_RC" = 0 ] || cat "$ERR"
+check "writable machine file: warning names the file" "1" "$(count "$MACHINE holds ROGUE_API_KEY but is not root-owned")"
+check "writable machine file: user env file holds the passed key" "export ROGUE_API_KEY='passed-key'" "$(grep '^export ROGUE_API_KEY=' "$H/.rogue-env" || :)"
+check "writable machine file: not named as the credential source" "0" "$(count 'Credentials come from the machine env file')"
+
+H="$WORK/home4b"
+printf 'typed-key\n\n\n' > "$WORK/input4"
+run_configure "$H" "$WORK/input4" ROGUE_API_KEY=""
+check "writable machine file, interactive: prompts for the key" "1" "$(prompted)"
+check "writable machine file, interactive: typed key written" "export ROGUE_API_KEY='typed-key'" "$(grep '^export ROGUE_API_KEY=' "$H/.rogue-env" || :)"
+
+chmod 644 "$MACHINE"
+H="$WORK/home4c"
+run_install "$H" ROGUE_API_KEY="passed-key" ROGUE_TEST_MACHINE_OWNER="$(id -u)"
+check "user-owned machine file: warning names the file" "1" "$(count "$MACHINE holds ROGUE_API_KEY but is not root-owned")"
+check "user-owned machine file: user env file holds the passed key" "export ROGUE_API_KEY='passed-key'" "$(grep '^export ROGUE_API_KEY=' "$H/.rogue-env" || :)"
+
 echo
 if [ "$fails" -eq 0 ]; then echo "all install env-file tests passed"; else echo "$fails FAILED"; exit 1; fi
diff --git a/tests/test_setup_env.ps1 b/tests/test_setup_env.ps1
index 9b6c08a..a37b1f4 100644
--- a/tests/test_setup_env.ps1
+++ b/tests/test_setup_env.ps1
@@ -189,8 +189,10 @@ $installer = Get-Content -Raw -LiteralPath (Join-Path $repo 'install.ps1')
 Check 'install.ps1: merges existing lines' $true ($installer -match 'foreach \(\$line in \(Get-Content -LiteralPath \$EnvFile')
 Check 'install.ps1: reads the merge source as UTF-8' $true `
     ($installer -match 'Get-Content -LiteralPath \$EnvFile -Encoding UTF8')
+$readValuesFn = [regex]::Match($installer, '(?ms)^function Read-EnvFileValues \{.*?^\}').Value
+Check 'install.ps1: Read-EnvFileValues located' $true ($readValuesFn.Length -gt 0)
 Check 'install.ps1: reads existing creds as UTF-8' $true `
-    ($installer -match 'Get-Content -LiteralPath \$script:EnvFile -Encoding UTF8')
+    ($readValuesFn -match 'Get-Content -LiteralPath \$Path -Encoding UTF8')
 
 $dispatcher = Get-Content -Raw -LiteralPath (Join-Path $repo 'plugins/rogue/scripts/hook.ps1')
 function Get-NormalizedFunction {
@@ -216,6 +218,7 @@ $hasKeyFn = [regex]::Match($installer, '(?ms)^function Test-EnvFileHasKey \{.*?^
 Check 'install.ps1: Test-EnvFileHasKey located' $true ($hasKeyFn.Length -gt 0)
 . ([scriptblock]::Create($unquoteFn))
 . ([scriptblock]::Create($hasKeyFn))
+. ([scriptblock]::Create($readValuesFn))
 . ([scriptblock]::Create($loadFn))
 
 $ROGUE_BASE_URL_DEFAULT = 'https://api.rogue.security'

From d28b4b7b9ab1f723ece337367182dfe9e53da060 Mon Sep 17 00:00:00 2001
From: Yuval <yuval@qualifire.ai>
Date: Mon, 14 Sep 2026 13:47:05 +0300
Subject: [PATCH 4/6] test(plugins): keep captured installer output unwrapped
 on Windows PowerShell 5.1 (FIRE-2119)

Out-String wraps at the 80-column host width on 5.1, which split the machine env
path across lines and made the count assertions read 0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 tests/test_install_env_ps1.ps1 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/test_install_env_ps1.ps1 b/tests/test_install_env_ps1.ps1
index c661702..8873e7b 100644
--- a/tests/test_install_env_ps1.ps1
+++ b/tests/test_install_env_ps1.ps1
@@ -111,7 +111,7 @@ function Run-Configure {
     $script:CredentialSource = $null
     $script:prompts = 0
     Remove-Item -LiteralPath $EnvFile -Force -ErrorAction SilentlyContinue
-    return (Configure-Credentials 6>&1 | Out-String)
+    return (Configure-Credentials 6>&1 | Out-String -Width 4096)
 }
 function Get-WrittenKey {
     if (-not (Test-Path -LiteralPath $EnvFile)) { return '<no file>' }
@@ -157,7 +157,7 @@ Copy-Item -Recurse ([System.IO.Path]::Combine($repo, 'plugins', 'cursor')) ([Sys
 $env:ROGUE_TEST_TARBALL = Join-Path $work 'rogue-plugin-cursor.tar.gz'
 & tar -czf $env:ROGUE_TEST_TARBALL -C (Join-Path $work 'stage') rogue-plugin-cursor
 if ($LASTEXITCODE -ne 0) { Write-Host 'could not build the Cursor tarball'; exit 1 }
-$out = & $installer -Cursor -NonInteractive 6>&1 | Out-String
+$out = & $installer -Cursor -NonInteractive 6>&1 | Out-String -Width 4096
 Assert-Eq (Count-Matches $out "machine env file $MachineEnvFile") 1 'end to end: output names the machine file once'
 Assert-Eq (Count-Matches $out 'Key validated') 1 'end to end: the machine key is validated'
 Assert-Eq (Test-Path -LiteralPath $EnvFile) $false 'end to end: no user env file'

From 1d10f36eff00a2418aeb2a9b34291c2f5f0454ad Mon Sep 17 00:00:00 2001
From: Yuval <yuval@qualifire.ai>
Date: Mon, 14 Sep 2026 14:27:51 +0300
Subject: [PATCH 5/6] fix(plugins): the machine env file is trusted only when
 SYSTEM or Administrators own it (FIRE-2119)

Test-MachineEnvTrusted counted the CURRENT USER among the identities allowed to
write the machine env file, so a standard user holding a write ACE could replace
the key the MDM pushed and the installer would still report the file as the
credential source. Only SYSTEM and Administrators now qualify, matching the
owner check directly above.

The Windows fixture proved nothing about that: it granted Everyone write, which
the old rule rejected anyway. It now grants the current user write and rebuilds
a protected ACL from nothing, so the trusted case cannot pass on a write grant
inherited from the temp directory.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 install.ps1                    | 18 ++++++++-------
 tests/test_install_env_ps1.ps1 | 40 ++++++++++++++++++++++++++++------
 2 files changed, 43 insertions(+), 15 deletions(-)

diff --git a/install.ps1 b/install.ps1
index 586c172..3ec1644 100644
--- a/install.ps1
+++ b/install.ps1
@@ -374,9 +374,10 @@ function Read-EnvFileValues {
     return $vals
 }
 
-# Same rule as Test-RogueEnvFile -System (scripts/shared/env-file.ps1), inlined
-# because this installer is one downloaded file: owned by SYSTEM or Administrators
-# (root off Windows), writable by nobody else.
+# The machine file is policy: only SYSTEM or Administrators (root off Windows) may
+# own it, and nobody else may write it - the current user included, or a standard
+# user with a write ACE could replace the key the MDM pushed. Inlined rather than
+# taken from scripts/shared/env-file.ps1 because this installer is one downloaded file.
 function Test-MachineEnvTrusted {
     param([string]$Path)
     try {
@@ -391,21 +392,22 @@ function Test-MachineEnvTrusted {
         }
         $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
         $admins = @('S-1-5-18', 'S-1-5-32-544')
-        $trusted = @($admins) + [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
         if ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -notin $admins) { return $false }
         $write = [System.Security.AccessControl.FileSystemRights]'Write, Delete, ChangePermissions, TakeOwnership, DeleteSubdirectoriesAndFiles'
         foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
             if ($rule.AccessControlType -eq 'Allow' -and ($rule.FileSystemRights -band $write) -and
-                $rule.IdentityReference.Value -notin $trusted) { return $false }
+                $rule.IdentityReference.Value -notin $admins) { return $false }
         }
         return $true
     } catch { return $false }
 }
 
-# Load existing creds from the user env file when it holds ROGUE_API_KEY, as the
-# dispatcher reads it.
+# Load existing settings from the user env file, as the dispatcher reads it. Not
+# only a keyed file: a user file with no ROGUE_API_KEY can still carry the
+# ROGUE_BASE_URL validation must use and the ROGUE_ACTOR_* identity
+# Write-UserEnvFile would otherwise replace from the cascade.
 function Load-ExistingCreds {
-    if (-not (Test-EnvFileHasKey $script:EnvFile)) { return }
+    if (-not (Test-Path -LiteralPath $script:EnvFile -PathType Leaf)) { return }
     $vals = Read-EnvFileValues $script:EnvFile
     if (-not $script:ApiKey) { $script:ApiKey = $vals['ROGUE_API_KEY'] }
     if (-not $script:Email -and $vals['ROGUE_ACTOR_EMAIL']) { $script:Email = $vals['ROGUE_ACTOR_EMAIL'] }
diff --git a/tests/test_install_env_ps1.ps1 b/tests/test_install_env_ps1.ps1
index 8873e7b..49ba73b 100644
--- a/tests/test_install_env_ps1.ps1
+++ b/tests/test_install_env_ps1.ps1
@@ -58,20 +58,29 @@ $ErrorActionPreference = 'Stop'
 $Email = 'tester@example.com'; $Name = 'Tester'
 
 # Machine file fixtures: trusted = owned by root/Administrators, writable by no
-# one else; untrusted = the same file with a write grant for everyone.
+# one else; untrusted = the same file with a write grant for the CURRENT USER,
+# which the installer must refuse - a standard user who can rewrite the file can
+# replace the key the MDM pushed. The Windows ACL is protected and rebuilt from
+# nothing, so the trusted case cannot inherit a write grant from the temp
+# directory and pass for the wrong reason. Recreate rather than overwrite: the
+# previous call leaves an ACL this process may not be able to write through.
 function Set-MachineFile {
     param([string]$Content, [switch]$Untrusted)
+    Remove-Item -LiteralPath $MachineEnvFile -Force -ErrorAction SilentlyContinue
     [System.IO.File]::WriteAllText($MachineEnvFile, $Content)
     if ($unix) {
         & chmod ($(if ($Untrusted) { '666' } else { '644' })) $MachineEnvFile
         return
     }
+    $admins = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-544')
+    $me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+    $rights = 'Read'
+    if ($Untrusted) { $rights = 'Read, Write' }
     $acl = Get-Acl -LiteralPath $MachineEnvFile
-    $acl.SetOwner((New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-544')))
-    if ($Untrusted) {
-        $everyone = New-Object System.Security.Principal.SecurityIdentifier('S-1-1-0')
-        $acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($everyone, 'Write', 'Allow')))
-    }
+    $acl.SetAccessRuleProtection($true, $false)
+    $acl.SetOwner($admins)
+    $acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($admins, 'FullControl', 'Allow')))
+    $acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($me, $rights, 'Allow')))
     Set-Acl -LiteralPath $MachineEnvFile -AclObject $acl
 }
 
@@ -194,7 +203,7 @@ $out = Run-Configure ''
 Assert-Eq $script:prompts 1 'keyless machine file, interactive: prompts once'
 Assert-Eq (Get-WrittenKey) 'typed-key' 'keyless machine file, interactive: typed key written'
 
-# -- 4. Keyed machine env file writable by others: a warning names it, then as in 2 --
+# -- 4. Keyed machine env file the current user can write: warned, then as in 2 -----
 Set-MachineFile "export ROGUE_API_KEY='machine-key'`n" -Untrusted
 $NonInteractive = $true
 $out = Run-Configure 'passed-key'
@@ -217,6 +226,23 @@ if ($unix) {
     Assert-Eq (Get-WrittenKey) 'passed-key' 'user-owned machine file: passed key written'
 }
 
+# -- 5. User env file with no key: its base URL and identity still apply ----------
+Remove-Item -LiteralPath $MachineEnvFile -Force -ErrorAction SilentlyContinue
+[System.IO.File]::WriteAllText($EnvFile,
+    "export ROGUE_BASE_URL='https://api.example.invalid'`nexport ROGUE_ACTOR_EMAIL='stored@example.com'`nexport ROGUE_ACTOR_NAME='Stored Name'`n")
+$Email = ''; $Name = ''
+$BaseUrl = $ROGUE_BASE_URL_DEFAULT; $BaseUrlExplicit = $false
+$script:ApiKey = 'passed-key'
+$script:CredentialSource = $null
+$script:prompts = 0
+$NonInteractive = $true
+$out = Configure-Credentials 6>&1 | Out-String -Width 4096
+Assert-Eq $script:prompts 0 'keyless user file: no credential prompt'
+Assert-Eq (Get-WrittenKey) 'passed-key' 'keyless user file: the passed key wins'
+Assert-Eq $script:Email 'stored@example.com' 'keyless user file: stored actor email kept'
+Assert-Eq $script:Name 'Stored Name' 'keyless user file: stored actor name kept'
+Assert-Eq $script:BaseUrl 'https://api.example.invalid' 'keyless user file: stored base URL adopted'
+
 $env:ROGUE_API_KEY = $prevKey
 $env:USERPROFILE = $prevProfile
 $env:PATH = $prevPath

From b6134f1c0865518ba4f57823a7d767adcb25bfdc Mon Sep 17 00:00:00 2001
From: Yuval <yuval@qualifire.ai>
Date: Mon, 14 Sep 2026 14:27:51 +0300
Subject: [PATCH 6/6] fix(plugins): the installer reads a keyless user env file
 and never doubles the base URL slash (FIRE-2119)

Two ways a stored setting was lost:

- configure_credentials sourced ~/.rogue-env only when it held ROGUE_API_KEY, so
  a file carrying just ROGUE_BASE_URL and ROGUE_ACTOR_* was skipped: with a key
  passed on the command line the key was validated against the default server and
  write_env_file then replaced the stored identity with the git/hostname cascade.
  Both installers now read a readable user file whole. The flag_* capture above it
  (and $BaseUrlExplicit on Windows) still gives explicit input precedence.
- A ROGUE_BASE_URL ending in a slash composed "//api/v1/hooks/status", which the
  API does not route. install.sh now trims every trailing slash wherever the value
  can enter - env var, --base-url, the machine file, the user file. install.ps1
  already trimmed at the call site.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 install.sh                   | 16 +++++++++++++--
 tests/test_install_env_sh.sh | 38 ++++++++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/install.sh b/install.sh
index a1802f2..30b188d 100755
--- a/install.sh
+++ b/install.sh
@@ -48,12 +48,19 @@
 #
 set -u
 
+# A base URL that ends in a slash composes "//api/v1/..." on every request, which
+# the API does not route. Applied wherever the value can enter.
+trim_base_url() {
+  while [ "${ROGUE_BASE_URL%/}" != "$ROGUE_BASE_URL" ]; do ROGUE_BASE_URL="${ROGUE_BASE_URL%/}"; done
+}
+
 # ── Config ──────────────────────────────────────────────────────────────────
 ROGUE_PLUGIN_REPO="${ROGUE_PLUGIN_REPO:-qualifire-dev/rogue-plugins}"
 ROGUE_BASE_URL_DEFAULT="https://api.rogue.security"
 BASE_URL_EXPLICIT=0
 [ -z "${ROGUE_BASE_URL:-}" ] || BASE_URL_EXPLICIT=1
 ROGUE_BASE_URL="${ROGUE_BASE_URL:-$ROGUE_BASE_URL_DEFAULT}"
+trim_base_url
 MARKETPLACE_NAME="rogue-marketplace"
 PLUGIN_NAME="rogue"
 CONFIG_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
@@ -722,6 +729,7 @@ validate_machine_env_key() {
   key="$(env_file_value "$MACHINE_ENV_FILE" ROGUE_API_KEY)"
   url="$(env_file_value "$MACHINE_ENV_FILE" ROGUE_BASE_URL)"
   ROGUE_BASE_URL="${url:-$ROGUE_BASE_URL_DEFAULT}"
+  trim_base_url
   resolve_actor_defaults "$(env_file_value "$MACHINE_ENV_FILE" ROGUE_ACTOR_EMAIL)" ""
   code="$(status_check "$key" "$DEF_EMAIL")"
   case "$code" in
@@ -761,9 +769,13 @@ configure_credentials() {
   local flag_name="${ROGUE_ACTOR_NAME:-}"
   local flag_base_url="$ROGUE_BASE_URL"
 
-  ! env_file_has_key "$ENV_FILE" || . "$ENV_FILE"
+  # Whole file, not only a keyed one: a user file with no ROGUE_API_KEY can still
+  # carry the ROGUE_BASE_URL validation must use and the ROGUE_ACTOR_* identity
+  # write_env_file would otherwise replace from the cascade.
+  [ ! -r "$ENV_FILE" ] || . "$ENV_FILE"
 
   [ "$BASE_URL_EXPLICIT" = "1" ] && ROGUE_BASE_URL="$flag_base_url"
+  trim_base_url
 
   local cur_key="${flag_key:-${ROGUE_API_KEY:-}}"
 
@@ -1055,7 +1067,7 @@ parse_args() {
       --actor-email)     [ -n "$val" ] || { val="$2"; shift; }; ROGUE_ACTOR_EMAIL="$val" ;;
       --actor-name)      [ -n "$val" ] || { val="$2"; shift; }; ROGUE_ACTOR_NAME="$val" ;;
       --plugin-repo)     [ -n "$val" ] || { val="$2"; shift; }; ROGUE_PLUGIN_REPO="$val" ;;
-      --base-url)        [ -n "$val" ] || { val="$2"; shift; }; ROGUE_BASE_URL="$val"; BASE_URL_EXPLICIT=1 ;;
+      --base-url)        [ -n "$val" ] || { val="$2"; shift; }; ROGUE_BASE_URL="$val"; trim_base_url; BASE_URL_EXPLICIT=1 ;;
       --claude)          WANT="$WANT claude" ;;
       --codex)           WANT="$WANT codex" ;;
       --cursor)          WANT="$WANT cursor" ;;
diff --git a/tests/test_install_env_sh.sh b/tests/test_install_env_sh.sh
index 3abc244..f12ddfb 100755
--- a/tests/test_install_env_sh.sh
+++ b/tests/test_install_env_sh.sh
@@ -35,6 +35,7 @@ BIN="$WORK/bin"; mkdir -p "$BIN"
 # any other call is the key validation POST and answers `{}` with CURL_CODE.
 cat > "$BIN/curl" <<'STUB'
 #!/usr/bin/env bash
+[ -z "${CURL_LOG:-}" ] || printf '%s\n' "$*" >> "$CURL_LOG"
 out=""
 while [ $# -gt 0 ]; do case "$1" in -o) out="$2"; shift ;; esac; shift; done
 if [ -n "$out" ]; then cp "$TARBALL" "$out"; exit 0; fi
@@ -202,5 +203,42 @@ run_install "$H" ROGUE_API_KEY="passed-key" ROGUE_TEST_MACHINE_OWNER="$(id -u)"
 check "user-owned machine file: warning names the file" "1" "$(count "$MACHINE holds ROGUE_API_KEY but is not root-owned")"
 check "user-owned machine file: user env file holds the passed key" "export ROGUE_API_KEY='passed-key'" "$(grep '^export ROGUE_API_KEY=' "$H/.rogue-env" || :)"
 
+# ══════════════════════════════════════════════════════════════════════════════
+# 5. User env file with no key: it still carries the base URL validation must use
+#    and the identity the rewrite must keep, and a trailing slash never doubles
+# ══════════════════════════════════════════════════════════════════════════════
+rm -f "$MACHINE"
+H="$WORK/home5"; mkdir -p "$H"
+cat > "$H/.rogue-env" <<'USERENV'
+export ROGUE_BASE_URL='https://api.example.invalid/'
+export ROGUE_ACTOR_EMAIL='stored@example.com'
+export ROGUE_ACTOR_NAME='Stored Name'
+USERENV
+CURL5="$WORK/curl5.log"
+run_install "$H" ROGUE_API_KEY="passed-key" CURL_LOG="$CURL5"
+check "keyless user file: install exits 0" "0" "$LAST_RC"
+[ "$LAST_RC" = 0 ] || cat "$ERR"
+check "keyless user file: the passed key wins" "export ROGUE_API_KEY='passed-key'" "$(grep '^export ROGUE_API_KEY=' "$H/.rogue-env" || :)"
+check "keyless user file: stored actor email kept" "export ROGUE_ACTOR_EMAIL='stored@example.com'" "$(grep '^export ROGUE_ACTOR_EMAIL=' "$H/.rogue-env" || :)"
+check "keyless user file: stored actor name kept" "export ROGUE_ACTOR_NAME='Stored Name'" "$(grep '^export ROGUE_ACTOR_NAME=' "$H/.rogue-env" || :)"
+
+# Only the interactive path validates a typed key, so the base URL the user file
+# carries is exercised there.
+H="$WORK/home5b"; mkdir -p "$H"
+cp "$WORK/home5/.rogue-env" "$H/.rogue-env"
+sed -i.bak "s/^export ROGUE_API_KEY=.*//" "$H/.rogue-env" && rm -f "$H/.rogue-env.bak"
+CURL5B="$WORK/curl5b.log"
+printf 'typed-key\n\n\n' > "$WORK/input5"
+run_configure "$H" "$WORK/input5" ROGUE_API_KEY="" CURL_LOG="$CURL5B"
+check "keyless user file: validated against the stored base URL" "1" "$(grep -c 'https://api.example.invalid/api/v1/hooks/status' "$CURL5B" || :)"
+check "keyless user file: the trailing slash was not doubled" "0" "$(grep -c '[^:]//api/v1/hooks/status' "$CURL5B" || :)"
+
+# The machine file's own base URL is normalized the same way.
+seed_machine "export ROGUE_API_KEY='machine-key'" "export ROGUE_BASE_URL='https://mdm.example.invalid//'"
+H="$WORK/home5c"
+CURL5C="$WORK/curl5c.log"
+run_install "$H" ROGUE_API_KEY="" CURL_LOG="$CURL5C"
+check "machine file base URL: validated without a doubled slash" "1" "$(grep -c 'https://mdm.example.invalid/api/v1/hooks/status' "$CURL5C" || :)"
+
 echo
 if [ "$fails" -eq 0 ]; then echo "all install env-file tests passed"; else echo "$fails FAILED"; exit 1; fi