[H-maximedelpit]

Purpose

Temporary unblock for the onboarding emails while the hai login redesign is debated (hcompai/portal-h#865, Laura's review: https://github.com/hcompai/portal-h/pull/865#pullrequestreview-5393415333, and #229). Until every account can sign in through the browser, the marketing email snippets will start with hai login --key instead of hai login, so they must be safe to paste more than once.

Why

Today hai login --key always prompts, even when a key is already stored, because the --key branch runs before the "already signed in" check. A developer pasting a second snippet would be asked for a key again. Plain hai login already skips in that case.

What changes

• hai login --key checks for a stored key first. With one present it prints "Already signed in. Pass --force to rotate the key." and exits 0, like plain hai login. --key --force replaces it.
• The paste prompt names where to get a key: API key (create one at https://platform.hcompany.ai/settings/api-keys):, so the emails need no "create your key" preamble.

Nine lines in hai_agents_cli/app.py plus tests. CLI package only, nothing generated. Independent of the login PRs; once they ship, the snippets drop --key and this behaviour stays correct.

---

Note

Low Risk
CLI-only login UX change; stored-key skip and validation behavior for new keys are unchanged aside from ordering and messaging.

Overview
hai login --key now matches plain hai login when credentials already exist: it exits successfully with “Already signed in. Pass --force to rotate the key.” instead of prompting again. --key --force still accepts a new key, validates it, and overwrites the stored value.

The hidden paste prompt now tells users where to create a key (API key (create one at …)), so onboarding snippets can omit extra setup text.

Tests cover the no-op path (no validation when already signed in), --force replacement, and adjusted validation tests so they run without a pre-stored key.

^{Reviewed by Cursor Bugbot for commit 60b6371. Bugbot is set up for automated code reviews on this repo. Configure here.}

[abonneth]

LGTM, nice small unblock.

Two non-blocking nits:

• With a key already stored, echo $KEY | hai login --key is now silently skipped. Piping a key reads like "replace it", so maybe only skip when stdin is a TTY?
• A revoked stored key skips login, then hai run fails with a bare 401. A hai login --force hint on 401 would help.

Heads-up for the email snippets: the Python one fails even after hai login. Client() only reads HAI_API_KEY from the env, never ~/.config/hai/.env:

$ HOME=$T python -c 'from hai_agents import Client; Client()'   # key stored in $T/.config/hai/.env
ApiError: The client must be instantiated be either passing in api_key or setting HAI_API_KEY

client.py is hand-written, so a fallback to the stored key is a small fix.

Idea for later: when no key is found in an interactive terminal, any command could run the login prompt itself. Then the snippets don't need a hai login line at all.