fix(agent): add cloud sync sign-in disclosure

[Nikhil (shadowfax92)]

Summary

• Add Terms of Service, Privacy Policy, and cloud sync docs links to BrowserOS sign-in surfaces.
• Share one CloudSyncDisclosure component between the login page and onboarding sign-in step.
• Add tests that pin the legal/docs URLs and display order.

Test plan

• bun test apps/agent/lib/constants/productUrls.test.ts
• bun run --filter @browseros/agent typecheck
• bun run --filter @browseros/agent test
• bun run --filter @browseros/agent lint

Fixes #419

[github-actions]

✅ Tests passed — 1223/1227

Suite	Passed	Failed	Skipped
✅ agent	80/80	0	0
✅ build	9/9	0	0
✅ eval	93/93	0	0
✅ server-agent	261/261	0	0
✅ server-api	203/203	0	0
✅ server-browser	4/4	0	0
✅ server-integration	9/10	0	1
✅ server-lib	242/242	0	0
✅ server-root	60/63	0	3
✅ server-skills	31/31	0	0
✅ server-tools	231/231	0	0

View workflow run

[greptile-apps]

Greptile Summary

This PR adds a CloudSyncDisclosure component that surfaces Terms of Service, Privacy Policy, and cloud sync documentation links on both the login page and the onboarding sign-in step. Three new URL constants are added to productUrls.ts and covered by a test that pins the exact URLs and display order.

• New CloudSyncDisclosure component is shared between LoginPage and StepTwo, with correct placement after all sign-in actions and before any skip option.
• cloudSyncSignInLinks is exported as a readonly tuple (as const) and backed by individual named URL constants, with tests validating display order and URL values.
• The component uses positional array destructuring to extract the three links; if the array is reordered in productUrls.ts, the prose ("you agree to the Terms of Service… acknowledge the Privacy Policy") would silently point to the wrong URLs.

Confidence Score: 4/5

Safe to merge; all changes are additive UI disclosure text with no auth logic modifications.

The only concern is that CloudSyncDisclosure destructures cloudSyncSignInLinks by position, meaning a future reorder of that array would silently swap which URL is shown for Terms of Service vs Privacy Policy — a legal/compliance risk if unnoticed. The current array order is correct and the tests validate it, so this is a maintainability issue rather than a present defect.

packages/browseros-agent/apps/agent/components/auth/CloudSyncDisclosure.tsx — the positional destructuring creates a subtle dependency on array order in productUrls.ts

Important Files Changed

Filename	Overview
packages/browseros-agent/apps/agent/components/auth/CloudSyncDisclosure.tsx	New shared disclosure component using positional array destructuring that silently mislinks legal URLs if cloudSyncSignInLinks is ever reordered
packages/browseros-agent/apps/agent/lib/constants/productUrls.ts	Adds termsOfServiceUrl, cloudSyncHelpUrl, and cloudSyncSignInLinks constants; clean and well-documented
packages/browseros-agent/apps/agent/entrypoints/app/login/LoginPage.tsx	Adds CloudSyncDisclosure below both sign-in methods (magic link + Google); placement is correct
packages/browseros-agent/apps/agent/entrypoints/onboarding/steps/StepTwo.tsx	Adds CloudSyncDisclosure after the sign-in form block and before the skip button; placement is appropriate
packages/browseros-agent/apps/agent/lib/constants/productUrls.test.ts	New tests pin all three legal/docs URLs and verify display order of cloudSyncSignInLinks

Sequence Diagram

sequenceDiagram
    participant User
    participant LoginPage / StepTwo
    participant CloudSyncDisclosure
    participant productUrls.ts

    productUrls.ts-->>CloudSyncDisclosure: cloudSyncSignInLinks (ToS, Privacy, Cloud Sync)
    User->>LoginPage / StepTwo: Opens sign-in surface
    LoginPage / StepTwo->>CloudSyncDisclosure: render()
    CloudSyncDisclosure-->>User: "By signing in, you agree to [ToS] and acknowledge [Privacy]. [Learn more about cloud sync]."
    User->>LoginPage / StepTwo: Clicks "Continue with Google" or "Send Magic Link"

Loading

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
packages/browseros-agent/apps/agent/components/auth/CloudSyncDisclosure.tsx:8-23
Positional destructuring silently mismaps legal links if `cloudSyncSignInLinks` is ever reordered. The prose is hard-coded ("you agree to the Terms of Service… acknowledge the Privacy Policy"), so a reorder in `productUrls.ts` would point "Terms of Service" text at the Privacy Policy URL with no compile-time error. Referencing the individual URL constants directly removes this coupling entirely.

```suggestion
export function CloudSyncDisclosure({ className }: CloudSyncDisclosureProps) {
  return (
    <p
      className={cn(
        'text-center text-muted-foreground text-xs leading-relaxed',
        className,
      )}
    >
      By signing in, you agree to the{' '}
      <DisclosureLink link={cloudSyncSignInLinks[0]} /> and acknowledge the{' '}
      <DisclosureLink link={cloudSyncSignInLinks[1]} />.{' '}
      <DisclosureLink link={cloudSyncSignInLinks[2]} />.
    </p>
  )
}
```

_{Reviews (1): Last reviewed commit: "fix: add cloud sync sign-in disclosure (..." | Re-trigger Greptile}