unbound-cli 1.15.1 → 1.16.7

package/LOCAL_DEV.md

@@ -11,7 +11,7 @@
 cd unbound-cli
 npm install
 ```
-
+ 
 ## Run locally (without installing globally)
 
 ```bash
@@ -85,7 +85,7 @@ sudo node src/index.js setup --api-key <ADMIN_KEY> --all --backend-url http://lo
 # Onboarding (combined setup + discover)
 node src/index.js onboard --api-key <USER_KEY> \
     --backend-url http://localhost:8000 --frontend-url http://localhost:3000
-sudo node src/index.js onboard --api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY> \
+sudo node src/index.js onboard --api-key <ADMIN_KEY> \
     --backend-url http://localhost:8000 --frontend-url http://localhost:3000
 ```
 
@@ -186,7 +186,7 @@ node src/index.js setup --all --api-key <key>
 node src/index.js onboard --api-key <USER_KEY>
 
 # MDM onboarding (admin device enrollment, requires root — MDM scope auto-detected from sudo)
-sudo node src/index.js onboard --api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY>
+sudo node src/index.js onboard --api-key <ADMIN_KEY>
 ```
 
 ## Unlink when done

package/README.md

@@ -40,10 +40,10 @@ npm install -g unbound-cli
 unbound onboard --api-key <USER_KEY>
 
 # Admin enrolling a device via MDM (requires root)
-sudo unbound onboard --api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY>
+sudo unbound onboard --api-key <ADMIN_KEY>
 ```
 
-The user API key and discovery API key are separate — discovery uses its own key that the CLI does not store. Run with `sudo` to let the discovery step scan all users on the device; without it, only the current user is scanned.
+Only your API key is needed. Run with `sudo` to let the discovery step scan all users on the device (the device is attributed to its owner, resolved from the hardware serial); without it, only the current user is scanned.
 
 ## Commands
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.15.1",
+  "version": "1.16.7",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/auth-pages.js

@@ -23,13 +23,11 @@ function escapeHtml(value) {
     .replace(/'/g, ''');
 }
 
-// Unbound shield mark (public/Unbound.svg in unbound-fe), inlined verbatim.
-const LOGO_SVG =
-  '<svg width="28" height="27" viewBox="0 0 24 23" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true">' +
-  '<path d="M5.12736 6.88525C6.33833 14.4266 11.9473 18.6338 12.0038 18.6757L9.577 22.0419C9.28788 21.8335 2.47374 16.8456 0.979492 7.53649L5.12639 6.88525H5.12736Z" fill="#7B56FB"/>' +
-  '<path d="M18.7655 6.81787L22.8988 7.24132C22.8637 7.59566 21.9496 15.9907 14.6361 21.9394L12.0059 18.6755C17.9322 13.8559 18.7577 6.88796 18.7655 6.81787Z" fill="#7B56FB"/>' +
-  '<path d="M12.1878 1.4375C14.6214 1.4375 17.3928 1.8113 20.282 2.91325L18.7654 6.81775C11.5638 4.07068 5.19258 6.85572 5.12833 6.88492L3.42188 3.10697C3.63993 3.00865 7.20178 1.4375 12.1878 1.4375Z" fill="#7B56FB"/>' +
-  '</svg>';
+// Full Unbound logo (public/unbound_logo_dark_theme.svg in unbound-fe), inlined
+// verbatim. Kept at the asset's native 100x18 proportions and scaled up to
+// 150px wide — the same treatment as the auto-topup modal — so the wordmark
+// keeps its shape instead of being shrunk or squashed to fit a box.
+const LOGO_SVG = '<svg aria-hidden="true" width="150" height="27" viewBox="0 0 100 18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M28.3097 3.82617H30.9472V13.9767H28.3097V12.574C27.5351 13.6571 26.4897 14.1983 25.1742 14.1983C24.0547 14.1983 23.173 13.8383 22.5276 13.1184C21.8823 12.3985 21.5596 11.4241 21.5596 10.1934V3.82617H24.1971V9.62096C24.1971 10.3104 24.3411 10.8269 24.6301 11.1712C24.919 11.5163 25.3956 11.6885 26.0591 11.6885C26.7844 11.6885 27.3408 11.4735 27.7286 11.0427C28.1163 10.6119 28.3097 9.98504 28.3097 9.16051V3.82617Z" fill="#2C2C2C"/><path d="M38.455 3.60352C39.5985 3.60352 40.4957 3.961 41.1477 4.67434C41.7997 5.38767 42.1248 6.36623 42.1248 7.60838V13.9756H39.4873V8.18086C39.4873 7.49142 39.34 6.97495 39.0445 6.63064C38.7489 6.28633 38.2632 6.11335 37.5874 6.11335C36.0629 6.11335 35.3006 6.95601 35.3006 8.64131V13.9748H32.6631V3.82509H35.3006V5.20892C36.0629 4.1381 37.1141 3.60352 38.4542 3.60352H38.455Z" fill="#2C2C2C"/><path d="M49.6116 3.6029C50.9271 3.6029 52.0277 4.09877 52.9126 5.08887C53.7975 6.07979 54.2404 7.34995 54.2404 8.90017C54.2404 10.4504 53.8008 11.7214 52.9217 12.7115C52.0425 13.7024 50.9386 14.1974 49.6108 14.1974C48.283 14.1974 47.1881 13.6686 46.4012 12.6101V13.9759H43.7637V0.968681L46.4012 0V5.24537C47.1881 4.15066 48.2575 3.6029 49.6108 3.6029H49.6116ZM49.0033 11.6868C49.7409 11.6868 50.3525 11.4281 50.8382 10.9117C51.3238 10.3944 51.5667 9.7247 51.5667 8.90017C51.5667 8.07563 51.3271 7.40513 50.8472 6.88867C50.3681 6.37221 49.7532 6.11356 49.0033 6.11356C48.2534 6.11356 47.6318 6.37221 47.1404 6.88867C46.649 7.40596 46.4028 8.07646 46.4028 8.90017C46.4028 9.72387 46.649 10.3952 47.1404 10.9117C47.6318 11.4281 48.2534 11.6868 49.0033 11.6868Z" fill="#2C2C2C"/><path d="M57.0085 5.11667C58.0293 4.10845 59.2772 3.60352 60.7524 3.60352C62.2275 3.60352 63.4788 4.10845 64.5053 5.11667C65.5318 6.12571 66.0455 7.38681 66.0455 8.89996C66.0455 10.4131 65.5384 11.6899 64.5234 12.6923C63.5093 13.6956 62.2514 14.1964 60.7516 14.1964C59.2517 14.1964 58.0128 13.6923 56.9978 12.6833C55.9837 11.6742 55.4766 10.4131 55.4766 8.89996C55.4766 7.38681 55.9869 6.12571 57.0077 5.11667H57.0085ZM62.6243 6.88846C62.1263 6.372 61.5023 6.11335 60.7524 6.11335C60.0025 6.11335 59.3785 6.372 58.8805 6.88846C58.3824 7.40575 58.1338 8.07625 58.1338 8.89996C58.1338 9.72367 58.3832 10.395 58.8805 10.9115C59.3785 11.4279 60.0025 11.6866 60.7524 11.6866C61.5023 11.6866 62.1263 11.4279 62.6243 10.9115C63.1224 10.3942 63.371 9.72449 63.371 8.89996C63.371 8.07543 63.1224 7.40493 62.6243 6.88846Z" fill="#2C2C2C"/><path d="M74.1789 3.82617H76.8164V13.9767H74.1789V12.574C73.4042 13.6571 72.3588 14.1983 71.0433 14.1983C69.9238 14.1983 69.0422 13.8383 68.3968 13.1184C67.7514 12.3985 67.4287 11.4241 67.4287 10.1934V3.82617H70.0662V9.62096C70.0662 10.3104 70.2103 10.8269 70.4992 11.1712C70.7882 11.5163 71.2648 11.6885 71.9283 11.6885C72.6535 11.6885 73.21 11.4735 73.5977 11.0427C73.9854 10.6119 74.1789 9.98504 74.1789 9.16051V3.82617Z" fill="#2C2C2C"/><path d="M84.3232 3.60352C85.4666 3.60352 86.3639 3.961 87.0159 4.67434C87.6678 5.38767 87.993 6.36623 87.993 7.60838V13.9756H85.3555V8.18086C85.3555 7.49142 85.2081 6.97495 84.9126 6.63064C84.6171 6.28633 84.1314 6.11335 83.4556 6.11335C81.931 6.11335 81.1688 6.95601 81.1688 8.64131V13.9748H78.5312V3.82509H81.1688V5.20892C81.931 4.1381 82.9822 3.60352 84.3224 3.60352H84.3232Z" fill="#2C2C2C"/><path d="M97.3623 0.968681L99.9998 0V13.975H97.3623V12.6093C96.5877 13.6678 95.5241 14.1966 94.1716 14.1966C92.8191 14.1966 91.7399 13.7016 90.8607 12.7106C89.9816 11.7205 89.542 10.4496 89.542 8.89934C89.542 7.34912 89.9816 6.07896 90.8607 5.08804C91.7399 4.09795 92.8372 3.60207 94.1527 3.60207C95.4681 3.60207 96.5753 4.14984 97.3623 5.24455V0.968681ZM94.7618 11.6868C95.5118 11.6868 96.1325 11.4281 96.6247 10.9117C97.1162 10.3944 97.3623 9.7247 97.3623 8.90016C97.3623 8.07563 97.1162 7.40513 96.6247 6.88867C96.1325 6.3722 95.5118 6.11356 94.7618 6.11356C94.0119 6.11356 93.397 6.3722 92.9179 6.88867C92.438 7.40596 92.1984 8.07646 92.1984 8.90016C92.1984 9.72387 92.4413 10.3952 92.9269 10.9117C93.4126 11.4281 94.0243 11.6868 94.7618 11.6868Z" fill="#2C2C2C"/><path d="M3.50761 4.90186C4.53166 11.2831 9.27488 14.8432 9.32262 14.8786L7.27041 17.727C7.02593 17.5507 1.2636 13.33 0 5.45292L3.50679 4.90186H3.50761Z" fill="#7B56FB"/><path d="M15.0395 4.84521L18.5347 5.20353C18.5051 5.50336 17.7321 12.607 11.5475 17.6407L9.32324 14.8788C14.3348 10.8006 15.0329 4.90452 15.0395 4.84521Z" fill="#7B56FB"/><path d="M9.47728 0.29248C11.5353 0.29248 13.8789 0.608784 16.3221 1.54122L15.0396 4.84511C8.94961 2.52061 3.56184 4.87724 3.50751 4.90195L2.06445 1.70514C2.24885 1.62194 5.2609 0.29248 9.47728 0.29248Z" fill="#7B56FB"/></svg>';
 
 /**
  * Shared page shell. `status` slots the icon block, heading, and body copy;
@@ -69,15 +67,10 @@ function renderPage({ title, icon, heading, body }) {
   .brand {
     display: inline-flex;
     align-items: center;
-    gap: 8px;
     margin-bottom: 28px;
   }
-  .brand span {
-    color: #17132B;
-    font-size: 17px;
-    font-weight: 600;
-    letter-spacing: 0.02em;
-  }
+  /* The wordmark ships its own intrinsic 150x27; never constrain it to a box. */
+  .brand svg { display: block; }
   .icon {
     display: block;
     width: 64px;
@@ -97,20 +90,27 @@ function renderPage({ title, icon, heading, body }) {
   h1 { color: #3d3d3d; font-size: 20px; font-weight: 600; margin-bottom: 10px; }
   p { color: #6b7280; font-size: 14px; line-height: 1.6; }
   .identity {
-    display: inline-flex;
-    flex-direction: column;
-    gap: 2px;
-    margin: 14px 0 6px;
-    padding: 9px 18px;
+    display: block;
+    margin: 16px 0 18px;
     border: 1px solid #e5e7eb;
     border-radius: 12px;
     background: #fafafb;
-    font-size: 13px;
-    max-width: 100%;
+    text-align: left;
     overflow-wrap: anywhere;
   }
-  .identity b { color: #3d3d3d; font-weight: 500; }
-  .identity i { color: #6b7280; font-style: normal; font-size: 12px; }
+  /* Label above value, not beside it: a 400px card cannot hold a long tenant
+     name and a long email on the same line without truncating one of them. */
+  .identity .row { padding: 10px 16px; }
+  .identity .row + .row { border-top: 1px solid #e5e7eb; }
+  .identity dt {
+    color: #6b7280;
+    font-size: 11px;
+    font-weight: 500;
+    letter-spacing: 0.04em;
+    text-transform: uppercase;
+    margin-bottom: 3px;
+  }
+  .identity dd { color: #3d3d3d; font-size: 13px; font-weight: 500; }
   @keyframes rise { from { opacity: 0; transform: translateY(10px); } to { opacity: 1; transform: none; } }
   @keyframes draw { to { stroke-dashoffset: 0; } }
   @media (prefers-reduced-motion: reduce) {
@@ -120,7 +120,7 @@ function renderPage({ title, icon, heading, body }) {
 </head>
 <body>
 <main class="card">
-  <div class="brand">${LOGO_SVG}<span>unbound</span></div>
+  <div class="brand">${LOGO_SVG}</div>
   ${icon}
   <h1>${heading}</h1>
   ${body}
@@ -148,13 +148,16 @@ const CROSS_ICON =
  * query-param values — escaped here, and omitted entirely when absent.
  */
 function successPage({ email, orgName } = {}) {
-  // Stacked (email over org) rather than one truncating line — real tenant
-  // emails and org names routinely overflow a 400px card side by side.
-  const identityParts = [];
-  if (email) identityParts.push(`<b>${escapeHtml(email)}</b>`);
-  if (orgName) identityParts.push(`<i>${escapeHtml(orgName)}</i>`);
-  const identity = identityParts.length
-    ? `<div class="identity">${identityParts.join('')}</div>`
+  // Each value carries its own label so the reader can tell an org named after
+  // a person from the account email. Rows are omitted when the query param is
+  // absent, so a missing org never leaves a dangling "Organization" label.
+  const row = (label, value) =>
+    `<div class="row"><dt>${label}</dt><dd>${escapeHtml(value)}</dd></div>`;
+  const identityRows = [];
+  if (orgName) identityRows.push(row('Organization', orgName));
+  if (email) identityRows.push(row('Email', email));
+  const identity = identityRows.length
+    ? `<dl class="identity">${identityRows.join('')}</dl>`
     : '';
 
   return renderPage({

package/src/auth.js

@@ -8,7 +8,7 @@ const authPages = require('./auth-pages');
 const config = require('./config');
 const output = require('./output');
 const api = require('./api');
-const { getDeviceSerial } = require('./device-serial');
+const { getDeviceSerial, probeDeviceSerialLive } = require('./device-serial');
 
 /**
  * Opens the browser for authentication and waits for the callback.
@@ -223,4 +223,31 @@ async function ensureLoggedIn({ apiKey, baseUrl, frontendUrl } = {}) {
   return true;
 }
 
-module.exports = { loginWithBrowser, loginWithApiKey, ensureLoggedIn };
+/**
+ * Exchange the admin key + this device's hardware serial for the device owner's
+ * application key, so an org-wide scan is attributed to the owner, not the admin.
+ * Throws on a missing serial or unusable response so the caller can abort.
+ */
+async function fetchDeviceOwnerKey(adminApiKey, { baseUrl } = {}) {
+  // Probe the serial live, never the user-writable cache — it decides whose key
+  // gets minted, so a planted cache value must not be trusted here.
+  const deviceSerial = await probeDeviceSerialLive();
+  if (!deviceSerial) {
+    throw new Error(
+      "Could not read this device's hardware serial number. "
+      + 'Re-run without sudo to onboard just the current user.'
+    );
+  }
+  const resp = await api.get('/api/v1/automations/mdm/get_application_api_key/', {
+    apiKey: adminApiKey,
+    baseUrl,
+    query: { serial_number: deviceSerial, app_type: 'default' },
+  });
+  const ownerKey = resp && resp.api_key;
+  if (!ownerKey) {
+    throw new Error('The backend did not return a key for this device.');
+  }
+  return ownerKey;
+}
+
+module.exports = { loginWithBrowser, loginWithApiKey, ensureLoggedIn, fetchDeviceOwnerKey };

package/src/claudePaths.js

@@ -0,0 +1,82 @@
+const os = require('os');
+const path = require('path');
+
+const DEFAULT_CLAUDE_DIR = path.join(os.homedir(), '.claude');
+
+// Mirrors Claude Code's own resolution: it reads CLAUDE_CONFIG_DIR verbatim,
+// with no tilde expansion. Expanding "~" would install to $HOME/x while Claude
+// reads ./~/x. A blank value is treated as unset so setup never targets the cwd.
+function resolveClaudeConfigDir() {
+  const raw = (process.env.CLAUDE_CONFIG_DIR || '').trim();
+  return raw ? path.resolve(raw) : DEFAULT_CLAUDE_DIR;
+}
+
+// Claude Code resolves CLAUDE_CONFIG_DIR against the cwd when it is set but
+// empty, rather than falling back to ~/.claude — so a default install is one it
+// never reads. Callers surface this instead of reporting a healthy setup.
+const BLANK_CONFIG_DIR_MESSAGE =
+  'CLAUDE_CONFIG_DIR is set but empty — Claude Code reads that as a path relative to the ' +
+  'current directory, so it will not load hooks installed in ~/.claude. Unset it, or point ' +
+  'it at a real directory.';
+
+function isBlankConfigDir() {
+  const raw = process.env.CLAUDE_CONFIG_DIR;
+  return typeof raw === 'string' && raw.trim() === '';
+}
+
+// Windows paths are case-insensitive, so C:\\Users\\jane\\.claude and
+// c:\\users\\jane\\.claude name one directory. Comparing them literally would
+// class the default dir as relocated and forward a --config-dir nobody needs.
+const samePath = process.platform === 'win32'
+  ? (a, b) => a.toLowerCase() === b.toLowerCase()
+  : (a, b) => a === b;
+
+function isNonDefaultConfigDir() {
+  return !samePath(resolveClaudeConfigDir(), DEFAULT_CLAUDE_DIR);
+}
+
+function claudeHooksDir(dir = resolveClaudeConfigDir()) {
+  return path.join(dir, 'hooks');
+}
+
+function claudeSettingsPath(dir = resolveClaudeConfigDir()) {
+  return path.join(dir, 'settings.json');
+}
+
+// Renders a path under the home dir with a leading ~, so a default install
+// still reads as ~/.claude/... in status output rather than a long absolute path.
+function displayPath(p) {
+  const home = os.homedir();
+  if (samePath(p, home)) return '~';
+  const prefix = home + path.sep;
+  return samePath(p.slice(0, prefix.length), prefix) ? '~' + p.slice(home.length) : p;
+}
+
+const CLAUDE_INSTALL_MARKERS = [path.join('hooks', 'unbound.py'), 'anthropic_key.sh'];
+
+// Reports hooks sitting in ~/.claude while a different dir is active, so the
+// caller can fail loudly instead of showing a green status Claude never honors.
+function detectConfigDirMismatch(markers = CLAUDE_INSTALL_MARKERS, { fs = require('fs') } = {}) {
+  const activeDir = resolveClaudeConfigDir();
+  if (samePath(activeDir, DEFAULT_CLAUDE_DIR)) return null;
+  const anyExists = (base) => markers.some((rel) => {
+    try { return fs.existsSync(path.join(base, rel)); } catch { return false; }
+  });
+  if (!anyExists(activeDir) && anyExists(DEFAULT_CLAUDE_DIR)) {
+    return { activeDir, staleDir: DEFAULT_CLAUDE_DIR };
+  }
+  return null;
+}
+
+module.exports = {
+  DEFAULT_CLAUDE_DIR,
+  resolveClaudeConfigDir,
+  samePath,
+  isNonDefaultConfigDir,
+  isBlankConfigDir,
+  BLANK_CONFIG_DIR_MESSAGE,
+  claudeHooksDir,
+  claudeSettingsPath,
+  displayPath,
+  detectConfigDirMismatch,
+};

package/src/commands/analytics.js

@@ -280,7 +280,7 @@ Examples:
   $ unbound analytics tool-use mcp-actions --server claude_ai_notion
   $ unbound analytics tool-use unsanctioned --format csv -o blocked.csv
 
-Admin role required — for listing as well as CSV export.
+Admin or Analytics Viewer. Applies to listing as well as CSV export.
 ${FILTER_HELP}${AGENT_HELP}`);
 
   attach(toolUse, 'terminal', DATASETS.terminal, `

package/src/commands/chat.js

@@ -179,7 +179,7 @@ function normalizeAssistantTurn(turn) {
 // backend-supplied strings out of the shell line so copy-pastes stay safe.
 function friendlyChatError(err) {
   if (err?.statusCode === 401) return 'Not authenticated. Run `unbound login` and try again.';
-  if (err?.statusCode === 403) return 'Chat requires Admin or Manager role. Run `unbound status` to check yours.';
+  if (err?.statusCode === 403) return 'Chat requires Admin, Analytics Viewer or Manager role. Run `unbound status` to check yours.';
   if (err?.statusCode === 429) return 'Rate limited. Please wait a moment and try again.';
   if (err?.statusCode === 504) return 'The turn took too long and the connection was closed. Try narrowing the question.';
   return sanitizeForTerminal(err?.message || 'Request failed.');
@@ -666,7 +666,7 @@ INTERACTIVE SESSION
     /exit              quit (Ctrl+C also works)
 
 NOTES
-  * Requires Admin or Manager role in your organization. Run 'unbound status' to check.
+  * Requires Admin, Analytics Viewer or Manager role in your organization. Run 'unbound status' to check.
   * A question the assistant asks back is a normal reply, not an error: the turn
     exits 0, and you answer it in the next one with -c.
   * Each -m invocation is its own process and sends no history. -c carries the

package/src/commands/discover.js

@@ -5,6 +5,7 @@ const os = require('os');
 const config = require('../config');
 const output = require('../output');
 const telemetry = require('../telemetry');
+const { Option } = require('commander');
 const { shellEscape, downloadToFile, withSecureTempFile, DISCOVER_BASE_URL } = require('../utils');
 const LAUNCH_AGENT_LABEL = 'ai.getunbound.discovery';
 
@@ -17,7 +18,7 @@ const DISCOVERY_EXIT_UNSUPPORTED_OS = 3;
 // indefinitely. Discovery enforces this itself — on expiry it releases its lock,
 // reports the run as failed, and exits non-zero. Kept in sync with
 // setup/mdm/onboard.py's DISCOVERY_TIMEOUT_SECONDS.
-const DISCOVERY_TIMEOUT_SECONDS = 9000;
+const DISCOVERY_TIMEOUT_SECONDS = 12000;
 
 // Classifies a discovery subprocess exit code:
 // 'success' (scan ran), 'unsupported' (skipped on this OS), or 'failure'.
@@ -34,8 +35,10 @@ function isWindowsNative() {
 }
 
 function isRoot() {
-  if (process.platform === 'win32') return false;
-  return typeof process.getuid === 'function' && process.getuid() === 0;
+  // Delegate to the shared, Windows-aware privilege check so `discover` and
+  // `onboard` agree on scope on every platform. Lazy require avoids any
+  // module-load cycle between discover and setup.
+  return require('./setup').hasRootPrivileges();
 }
 
 /**
@@ -194,6 +197,7 @@ function register(program) {
     .option('--api-key <key>', 'Discovery API key (required)')
     .option('--domain <url>', 'Backend URL (defaults to configured backend)')
     .option('--set-cron', 'Set up a daily scheduled discovery scan at 09:00 (cross-platform)')
+    .addOption(new Option('--discovery-key <key>', 'Deprecated and ignored. The scan uses your API key.').hideHelp())
     .addHelpText('after', `
 Scans this device for installed AI coding tools (Cursor, Claude Code,
 Gemini CLI, Codex, Windsurf, Roo Code, Cline, GitHub Copilot, JetBrains,
@@ -201,7 +205,7 @@ and more) and reports findings to the Unbound backend.
 
 Which --api-key to use depends on scope:
   - Single-user scan (no sudo): use your own user API key.
-  - All-users scan (sudo): use the org discovery key.
+  - All-users scan (sudo): use your admin API key.
 The --domain defaults to the backend URL configured via "unbound config set-backend-url"
 (falls back to https://backend.getunbound.ai when unset).
 
@@ -218,8 +222,15 @@ Examples:
 `)
     .action(telemetry.wrapAction('discover', async (opts) => {
       let scanSucceeded = false;
-      // Register the discovery key so beforeSend redacts it from any event.
+      // Register the api key so beforeSend redacts it from any event.
       telemetry.rememberSecret(opts.apiKey);
+      // Accept and ignore a stale discovery key (flag or env) instead of erroring;
+      // the scan uses the API key. Redact it, then warn.
+      const staleDiscoveryKey = opts.discoveryKey || process.env.UNBOUND_DISCOVERY_KEY;
+      if (staleDiscoveryKey) {
+        telemetry.rememberSecret(staleDiscoveryKey);
+        output.warn('--discovery-key is deprecated and ignored — the scan uses your API key.');
+      }
       try {
         if (!opts.apiKey) {
           output.error('--api-key is required.');
@@ -254,7 +265,7 @@ Examples:
           const domain = opts.domain || config.getBaseUrl();
           const suffix = domain && domain !== config.DEFAULT_BASE_URL ? ` --domain ${domain}` : '';
           console.error('  Discovery completed successfully — only scheduled-run setup failed.');
-          console.error(`  Re-run cron setup with: unbound discover --set-cron --api-key <DISCOVERY_KEY>${suffix}`);
+          console.error(`  Re-run cron setup with: unbound discover --set-cron --api-key <KEY>${suffix}`);
         }
         process.exitCode = 1;
       }

package/src/commands/doctor.js

@@ -4,7 +4,8 @@ const api = require('../api');
 const output = require('../output');
 const { getDeviceSerial } = require('../device-serial');
 const { detectTools, validateToolKeys, countValidationSkipped } = require('../toolHealth');
-const { hasRootPrivileges } = require('./setup');
+const { hasRootPrivileges, elevated } = require('./setup');
+const claudePaths = require('../claudePaths');
 
 // Validate the stored API key against the backend. Returns one of:
 // valid | invalid | not-logged-in | unverified (network/other error).
@@ -74,7 +75,9 @@ Examples:
         spin.stop();
 
         const tampered = tools.filter((t) => t.status === 'tampered');
-        const unhealthy = tampered.length > 0 || key.state === 'invalid';
+        const configMismatch = claudePaths.detectConfigDirMismatch();
+        const blankConfigDir = claudePaths.isBlankConfigDir();
+        const unhealthy = tampered.length > 0 || key.state === 'invalid' || !!configMismatch || blankConfigDir;
 
         if (opts.json) {
           output.json({
@@ -92,12 +95,19 @@ Examples:
             })),
             healthy: !unhealthy,
             key_validations_skipped: keySkippedCount,
+            claude_config_dir_mismatch: configMismatch,
+            claude_config_dir_blank: blankConfigDir,
           });
           if (unhealthy) process.exitCode = 1;
           return;
         }
 
         const C = output.colors;
+        const reportConfigMismatch = (m) => {
+          console.log(C.red('✗ Claude Code is installed where Claude Code won’t read it.'));
+          console.log(`  Install lives in ${C.bold(m.staleDir)} but ${C.bold('CLAUDE_CONFIG_DIR')} points at ${C.bold(m.activeDir)}.`);
+          console.log(`  Re-run ${C.bold('unbound setup')} with CLAUDE_CONFIG_DIR set so it installs under the active dir.`);
+        };
         const labelOf = (t) => t.label + (t.mode && t.mode !== 'subscription' ? ` (${t.mode})` : '');
         const W = Math.max(7, ...tools.map((t) => labelOf(t).length)); // 7 = "API key"
 
@@ -146,7 +156,16 @@ Examples:
         const anyInstalled = tools.some((t) => t.status !== 'not-installed');
 
         if (opts.fix) {
+          if (blankConfigDir) {
+            output.error(claudePaths.BLANK_CONFIG_DIR_MESSAGE);
+            console.log('');
+          }
+          if (configMismatch) {
+            reportConfigMismatch(configMismatch);
+            console.log('');
+          }
           if (!tampered.length) {
+            if (configMismatch || blankConfigDir) { process.exitCode = 1; return; }
             if (!anyInstalled) console.log(`${C.yellow('No tools are set up yet')} — nothing to fix. Run ${C.bold('unbound setup')} first.`);
             else output.success('Nothing to fix — all set up tools are healthy.');
             console.log('');
@@ -157,7 +176,7 @@ Examples:
           // tools only, and point at sudo for whatever's org-managed.
           if (!root && !userFix.length) {
             console.log(`${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization.`);
-            console.log(`  Run ${C.bold('sudo unbound doctor --fix')} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
+            console.log(`  Run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
             console.log('');
             process.exitCode = 1;
             return;
@@ -167,13 +186,13 @@ Examples:
           output.info(`Reinstalling: ${fixDisplay}${root ? ' (org-wide, all users)' : ''}`);
           console.log('');
           const r = spawnSync(process.argv[0], [process.argv[1], 'setup', ...fixNow], { stdio: 'inherit' });
-          if (!root && mdmFix.length) console.error(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold('sudo unbound doctor --fix')} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
-          process.exitCode = fixExitCode(r.status, root, mdmFix.length > 0);
+          if (!root && mdmFix.length) console.error(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
+          process.exitCode = fixExitCode(r.status, root, mdmFix.length > 0) || ((configMismatch || blankConfigDir) ? 1 : 0);
           return;
         }
 
         // No `--fix`: report and show the command(s) that fix it.
-        if (!anyInstalled && key.state !== 'invalid') {
+        if (!anyInstalled && key.state !== 'invalid' && !configMismatch && !blankConfigDir) {
           console.log(`${C.yellow('No AI tools are set up yet.')} Run ${C.bold('unbound setup')} to get started.`);
           console.log('');
           return;
@@ -183,17 +202,22 @@ Examples:
           console.log('');
           return;
         }
+        if (blankConfigDir) {
+          output.error(claudePaths.BLANK_CONFIG_DIR_MESSAGE);
+          process.exitCode = 1;
+        }
+        if (configMismatch) reportConfigMismatch(configMismatch);
         if (tampered.length) {
           console.log(C.red(`✗ ${tampered.length} tool${tampered.length === 1 ? ' needs' : 's need'} attention.`));
           if (!mdmFix.length) {
             console.log(`  Run ${C.bold('unbound doctor --fix')} to repair ${userNames}.`);
           } else if (!userFix.length) {
             console.log(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization.`);
-            console.log(`  Run ${C.bold('sudo unbound doctor --fix')} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
+            console.log(`  Run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
           } else {
             // Both: a user without sudo can still fix their own tools; sudo fixes everything.
             console.log(`  Run ${C.bold('unbound doctor --fix')} to repair ${userNames}.`);
-            console.log(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold('sudo unbound doctor --fix')} to repair ${mdmFix.length === 1 ? 'it' : 'them'} too.`);
+            console.log(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'} too.`);
           }
         }
         if (key.state === 'invalid') {

package/src/commands/download.js

@@ -162,7 +162,7 @@ Examples:
   $ unbound download start logs-export --check --last 90d --json
   $ unbound download get 4f2a1c9e-1b2c-4d5e-8f90-a1b2c3d4e5f6
 
-Admin role required. Exports are kept for ${RETENTION_HOURS} hours.
+Admin or Analytics Viewer. Exports are kept for ${RETENTION_HOURS} hours.
 `);
 
   group
@@ -203,7 +203,7 @@ Examples:
   $ unbound download start analytics-export --filter dataset=terminal-runs --last 7d
   $ unbound download start logs-export --check --last 90d --json
 
-Admin role required. Exports are kept for ${RETENTION_HOURS} hours.
+Admin or Analytics Viewer. Exports are kept for ${RETENTION_HOURS} hours.
 ${FILTER_HELP}${AGENT_HELP}`)
     .action(async (kind, opts) => {
       try {

package/src/commands/oacb.js

@@ -17,13 +17,16 @@ const PKG_VERSION = '0.2.1';
 const TIERS = ['shadow', 'receipts', 'baseline', 'strict', 'paranoid'];
 const AGENTS = ['claude-code', 'codex'];
 
-// Consent receipt path
-const CONSENT_RECEIPT_PATH = path.join(os.homedir(), '.claude', 'oacb-consent.json');
+const claudePaths = require('../claudePaths');
+const CLAUDE_DIR = claudePaths.resolveClaudeConfigDir();
+
+const CONSENT_RECEIPT_PATH = path.join(CLAUDE_DIR, 'oacb-consent.json');
+const LEGACY_CONSENT_RECEIPT_PATH = path.join(claudePaths.DEFAULT_CLAUDE_DIR, 'oacb-consent.json');
 
 // Claude Code paths
-const CLAUDE_HOOKS_DIR = path.join(os.homedir(), '.claude', 'hooks');
-const CLAUDE_SETTINGS_PATH = path.join(os.homedir(), '.claude', 'settings.json');
-const CLAUDE_SETTINGS_BACKUP_PATH = path.join(os.homedir(), '.claude', 'settings.json.oacb-backup');
+const CLAUDE_HOOKS_DIR = claudePaths.claudeHooksDir(CLAUDE_DIR);
+const CLAUDE_SETTINGS_PATH = claudePaths.claudeSettingsPath(CLAUDE_DIR);
+const CLAUDE_SETTINGS_BACKUP_PATH = path.join(CLAUDE_DIR, 'settings.json.oacb-backup');
 
 // Codex paths
 const CODEX_HOOKS_DIR = path.join(os.homedir(), '.codex', 'hooks');
@@ -203,7 +206,7 @@ async function handleCheck() {
     ['Unbound session', hasUnboundSession ? 'logged in' : 'not logged in (optional)'],
     ['─── Claude Code ───', ''],
     ['Claude Code on PATH', claudeCodeVersion || 'not detected'],
-    ['~/.claude/settings.json', claudeSettingsExist ? 'found' : 'not found'],
+    [claudePaths.displayPath(CLAUDE_SETTINGS_PATH), claudeSettingsExist ? 'found' : 'not found'],
     ['OACB tier applied', claudeTier !== 'none' ? claudeTier : 'none (run `unbound oacb apply`)'],
     ['Hooks installed', `${claudeHookStates.filter(Boolean).length} / ${HOOK_NAMES.length}`],
     ['─── Codex CLI ─────', ''],
@@ -225,7 +228,22 @@ async function handleCheck() {
     output.warn('No OACB tier applied to any agent. Run `unbound oacb apply` to start with shadow tier.');
   }
 
-  output.success('Pre-flight complete.');
+  const blankConfigDir = claudePaths.isBlankConfigDir();
+  if (blankConfigDir) {
+    output.error(claudePaths.BLANK_CONFIG_DIR_MESSAGE);
+    process.exitCode = 1;
+  }
+
+  const mismatch = claudePaths.detectConfigDirMismatch([path.join('hooks', HOOK_NAMES[0])]);
+  if (mismatch) {
+    output.error(
+      `OACB hooks installed in ${mismatch.staleDir} but CLAUDE_CONFIG_DIR points at ${mismatch.activeDir} — ` +
+      'Claude will not load them; re-run `unbound oacb apply`.'
+    );
+    process.exitCode = 1;
+  }
+
+  if (!mismatch && !blankConfigDir) output.success('Pre-flight complete.');
 }
 
 async function handleAudit({ agent, tier, format }) {
@@ -464,7 +482,7 @@ async function _applyClaudeCode({ baseline, tier, overrides, localHooks }) {
 
   output.success(`OACB ${tier} applied (claude-code).`);
   if (tier === 'shadow') {
-    output.info('Shadow: hooks log but never block. Review ~/.claude/hooks/oacb-audit.log for 2 weeks, then `unbound oacb apply --tier baseline`.');
+    output.info(`Shadow: hooks log but never block. Review ${path.join(CLAUDE_HOOKS_DIR, 'oacb-audit.log')} for 2 weeks, then \`unbound oacb apply --tier baseline\`.`);
   } else if (tier === 'receipts') {
     output.info('Receipts: engineer sees WARN banners for risky commands and can abort. Expires in 30 days.');
   }
@@ -762,6 +780,11 @@ async function handleRemove({ agent, dryRun }) {
   output.success(`Wrote cleaned ${CLAUDE_SETTINGS_PATH}`);
 
   try { await fs.unlink(CONSENT_RECEIPT_PATH); } catch (_) {}
+  // readConsentReceipt falls back to the legacy receipt, so a leftover copy
+  // would keep reporting OACB as installed after it was removed.
+  if (!claudePaths.samePath(CONSENT_RECEIPT_PATH, LEGACY_CONSENT_RECEIPT_PATH)) {
+    try { await fs.unlink(LEGACY_CONSENT_RECEIPT_PATH); } catch (_) {}
+  }
   // The backup is no longer load-bearing after a successful remove — clean it
   // up so the user's ~/.claude/ doesn't accumulate stale OACB state.
   try { await fs.unlink(CLAUDE_SETTINGS_BACKUP_PATH); } catch (_) {}
@@ -1517,7 +1540,7 @@ async function historyDryRun(tier, agent) {
   const commands = [];
 
   // Try Claude Code session logs first (most accurate for auto-mode context)
-  const ccProjectsDir = path.join(os.homedir(), '.claude', 'projects');
+  const ccProjectsDir = path.join(CLAUDE_DIR, 'projects');
   try {
     const projectDirs = await fs.readdir(ccProjectsDir);
     for (const proj of projectDirs.slice(-5)) {  // last 5 projects to bound cost
@@ -1676,6 +1699,9 @@ async function readConsentReceipt() {
   try {
     return JSON.parse(await fs.readFile(CONSENT_RECEIPT_PATH, 'utf8'));
   } catch (_) {
+    if (!claudePaths.samePath(CONSENT_RECEIPT_PATH, LEGACY_CONSENT_RECEIPT_PATH)) {
+      try { return JSON.parse(await fs.readFile(LEGACY_CONSENT_RECEIPT_PATH, 'utf8')); } catch (_) {}
+    }
     return null;
   }
 }
@@ -1685,7 +1711,7 @@ async function readConsentReceipt() {
 async function handleWhy({ agent }) {
   const logPath = agent === 'codex'
     ? path.join(os.homedir(), '.codex', 'hooks', 'oacb-audit.log')
-    : path.join(os.homedir(), '.claude', 'hooks', 'oacb-audit.log');
+    : path.join(CLAUDE_HOOKS_DIR, 'oacb-audit.log');
 
   let entry = null;
   try {
@@ -1778,7 +1804,7 @@ async function handleStatus({ agent }) {
 
   const logPath = agent === 'codex'
     ? path.join(os.homedir(), '.codex', 'hooks', 'oacb-audit.log')
-    : path.join(os.homedir(), '.claude', 'hooks', 'oacb-audit.log');
+    : path.join(CLAUDE_HOOKS_DIR, 'oacb-audit.log');
 
   // Expiry countdown
   let expiryNote = '';