[Bug] FRE permits saving an empty agent selection when policy leaves no selectable agents #874

@vanzue

Summary

FRE can have no selectable agent after administrator-policy filtering, but Save still enters setup with an empty agent ID. With Session Management enabled, setup attempts wta hooks install --cli without a value.

This is a policy/validation edge case, not the normal first-run experience: without an allowlist restricting Copilot, FRE always offers Copilot (including the "will install" option) and automatically selects an entry. Users do not need to manually deselect anything to encounter this edge case.

Reproduction

Use an isolated test account or VM; do not change production-managed policy or delete package settings/state.

1. Use an account where Codex is not installed/discoverable by wta probe-host-agents (including via CODEX_PATH).
2. Configure the Intelligent Terminal policy allowlist to contain only codex:
   • Registry key: HKEY_CURRENT_USER\Software\Policies\Microsoft\IntelligentTerminal
   • Value: AllowedAgents
   • Type: REG_MULTI_SZ
   • Data: codex
   • Ensure no machine-level AllowedAgents overrides this user-level policy. Leave AllowAgentSessionHooks unconfigured or allowed.
3. Start Intelligent Terminal with FRE not yet completed. Prefer a fresh test profile; for an existing test profile, back up the selected package's state file and change only agentFreCompleted to false while that test instance is closed.
4. Advance from the FRE Welcome page to its settings page.
5. Observe that the Agent dropdown is empty: Copilot is excluded by policy, and Codex is excluded because it was not detected as installed.
6. Leave Session Management enabled (the default) and click Save.

Restore the test account's previous policy/state after reproduction; do not uninstall the package to reset FRE.

Actual behavior / code-path evidence

• _PopulateAgentComboBox() iterates only policy-allowed agents, then skips every non-Copilot agent not reported installed. It selects an entry only when items.Size() > 0.
• Save has no missing-selection guard. _SaveAndInstallAsync() initializes agentId to an empty string, finds no selected entry, and assigns that empty value to the in-memory AcpAgent and DelegateAgent settings before setup.
• With Session Management enabled, it passes that ID into _InstallHooksAsync().
• The command becomes wta hooks install --cli , which the CLI rejects because --cli requires a value (exit code 2).

Do not interpret this as proof that empty settings are persisted to disk after the failed setup; the confirmed assignment occurs in memory before the failure.

Expected behavior

• Explain that no selectable agent is available under the current policy.
• Do not save an empty agent selection or execute agent-dependent installation commands with an empty ID.
• Do not bypass administrator policy by falling back to Copilot.
• Preserve the ordinary no-policy FRE behavior: Copilot remains selectable/installable and a nonempty list has an automatic selection.

Evidence and scope

The complete UI sequence above is a code-derived reproduction procedure, not a claim of an end-to-end run under a modified policy. The missing --cli value was separately exercised and rejected with exit code 2.

Source revision: 60b331e2aa443cfd8c38e16a1466019125bdcb95:

• FRE dropdown population
• FRE save selection and settings assignment
• Hook command construction

Split out of #840 as a focused correctness bug. No caching, asynchronous availability architecture, or general FRE loading-state change is requested. Tracking only; no implementation in this investigation.