unbound-cli 1.15.1 → 1.16.7

package/test/setup-args.test.js

@@ -3,7 +3,7 @@ const assert = require('node:assert/strict');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { buildScriptArgs, scriptSupportsBackfill, resolveSetupAllTools, clearUnboundEnvsEverywhere, failureReason, NUKE_ENV_VARS, removeBinaryInstall, runBinaryClear, BINARY_INSTALL_PATHS } = require('../src/commands/setup');
+const { buildScriptArgs, scriptSupportsBackfill, resolveSetupAllTools, clearUnboundEnvsEverywhere, failureReason, NUKE_ENV_VARS, removeBinaryInstall, runBinaryClear, BINARY_INSTALL_PATHS, configDirForScript } = require('../src/commands/setup');
 
 // shellEscape single-quotes every value, so a real key surfaces as
 // --api-key '<key>' at the head of the argv tail.
@@ -93,6 +93,16 @@ test('buildScriptArgs: non-mdm includes --domain when frontendUrl passed', () =>
   assert.ok(args.includes("--domain 'https://gateway.acme.com'"), args);
 });
 
+test('buildScriptArgs: configDir appends shell-escaped --config-dir', () => {
+  const args = buildScriptArgs('sk-x', { configDir: '/x/y' });
+  assert.ok(args.includes("--config-dir '/x/y'"), args);
+});
+
+test('buildScriptArgs: omits --config-dir when not passed', () => {
+  const args = buildScriptArgs('sk-x', {});
+  assert.ok(!args.includes('--config-dir'), args);
+});
+
 // The result is always trimmed regardless of which flags are present.
 test('buildScriptArgs: result is always trimmed', () => {
   const cases = [
@@ -618,3 +628,36 @@ test('failureReason: non-Error throw (null/undefined) never throws', () => {
   assert.equal(failureReason(undefined), 'failed');
   assert.equal(failureReason('a string'), 'failed');
 });
+
+test('configDirForScript: forwards the active dir for hooks AND gateway scripts when CLAUDE_CONFIG_DIR is set', () => {
+  const prev = process.env.CLAUDE_CONFIG_DIR;
+  process.env.CLAUDE_CONFIG_DIR = '/opt/cc';
+  try {
+    assert.equal(configDirForScript('claude-code/hooks/setup.py'), require('path').resolve('/opt/cc'));
+    assert.equal(configDirForScript('claude-code/gateway/setup.py'), require('path').resolve('/opt/cc'));
+  } finally {
+    if (prev === undefined) delete process.env.CLAUDE_CONFIG_DIR; else process.env.CLAUDE_CONFIG_DIR = prev;
+  }
+});
+
+test('configDirForScript: never forwards to MDM scripts (per-user home) or unrelated tools', () => {
+  const prev = process.env.CLAUDE_CONFIG_DIR;
+  process.env.CLAUDE_CONFIG_DIR = '/opt/cc';
+  try {
+    assert.equal(configDirForScript('claude-code/hooks/mdm/setup.py'), undefined);
+    assert.equal(configDirForScript('claude-code/gateway/mdm/setup.py'), undefined);
+    assert.equal(configDirForScript('cursor/setup.py'), undefined);
+  } finally {
+    if (prev === undefined) delete process.env.CLAUDE_CONFIG_DIR; else process.env.CLAUDE_CONFIG_DIR = prev;
+  }
+});
+
+test('configDirForScript: returns undefined when CLAUDE_CONFIG_DIR is unset (default dir)', () => {
+  const prev = process.env.CLAUDE_CONFIG_DIR;
+  delete process.env.CLAUDE_CONFIG_DIR;
+  try {
+    assert.equal(configDirForScript('claude-code/gateway/setup.py'), undefined);
+  } finally {
+    if (prev !== undefined) process.env.CLAUDE_CONFIG_DIR = prev;
+  }
+});

package/test/setup-scope.test.js

@@ -0,0 +1,69 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const path = require('path');
+
+const { elevated, scopeNotice } = require('../src/commands/setup');
+
+function onPlatform(plat, fn) {
+  const orig = Object.getOwnPropertyDescriptor(process, 'platform');
+  Object.defineProperty(process, 'platform', { value: plat, configurable: true });
+  try { return fn(); } finally { Object.defineProperty(process, 'platform', orig); }
+}
+
+// Windows has no `sudo`. Telling a Windows user to run `sudo unbound doctor --fix`
+// sends them to a command that fails with "'sudo' is not recognized".
+test('elevated: Windows advises an Administrator terminal and never says sudo', () => {
+  const out = onPlatform('win32', () => elevated('unbound doctor --fix'));
+  assert.ok(!out.includes('sudo'), out);
+  assert.match(out, /Administrator/);
+  assert.ok(out.includes('unbound doctor --fix'), out);
+});
+
+test('elevated: macOS and Linux keep the sudo prefix', () => {
+  for (const plat of ['darwin', 'linux']) {
+    assert.equal(onPlatform(plat, () => elevated('unbound doctor --fix')), 'sudo unbound doctor --fix');
+  }
+});
+
+test('elevated: the command itself is preserved verbatim on every platform', () => {
+  const cmd = 'unbound discover --api-key <KEY> --set-cron';
+  for (const plat of ['darwin', 'linux', 'win32']) {
+    assert.ok(onPlatform(plat, () => elevated(cmd)).includes(cmd));
+  }
+});
+
+// The reported bug: an elevated shell silently switched setup to an org-wide install,
+// printing output identical to a per-user one. The two must be distinguishable.
+test('scopeNotice: org-wide and per-user read differently', () => {
+  const mdm = scopeNotice(true);
+  const user = scopeNotice(false);
+  assert.notEqual(mdm, user);
+  assert.match(mdm, /organization-wide/);
+  assert.match(mdm, /every user on this device/);
+  assert.match(user, /your account only/);
+});
+
+test('scopeNotice: the org-wide line says why the scope was chosen', () => {
+  // Elevation is ambient state the user did not set for this purpose, so the
+  // reason has to be on screen, not inferred.
+  assert.match(scopeNotice(true), /elevated/);
+});
+
+// Guard against a new hardcoded instruction slipping in beside the fixed ones.
+test('no actionable sudo instruction is printed to the user', () => {
+  for (const file of ['doctor.js', 'onboard.js']) {
+    const src = fs.readFileSync(path.join(__dirname, '..', 'src', 'commands', file), 'utf8');
+    const printed = src.split('\n').filter((l) => /console\.(log|error)|output\.(error|warn|info)/.test(l));
+    const offenders = printed.filter((l) => l.includes('sudo unbound'));
+    assert.deepEqual(offenders, [], `${file} prints a literal sudo command: ${offenders.join(' | ')}`);
+  }
+});
+
+// Both scope announcements must fire at the decision point, not somewhere later.
+test('setup and onboard both announce the resolved scope', () => {
+  for (const file of ['setup.js', 'onboard.js']) {
+    const src = fs.readFileSync(path.join(__dirname, '..', 'src', 'commands', file), 'utf8');
+    assert.ok(/output\.info\(scopeNotice\(isMdm\)\)/.test(src), `${file} does not announce its scope`);
+  }
+});

package/test/tool-health-mdm-paths.test.js

@@ -0,0 +1,206 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const { managedDir } = require('../src/toolHealth');
+
+// Windows has two plausible machine-wide roots and the setup repo does not use one
+// uniformly: Claude Code and Codex install under Program Files, Cursor and Augment
+// under ProgramData. Looking in the wrong one reports a governed tool as ungoverned.
+const WIN_ENV = { ProgramData: 'C:\\ProgramData', ProgramFiles: 'C:\\Program Files' };
+
+test('managedDir win32: Claude Code and Codex live under Program Files', () => {
+  assert.equal(managedDir('claude-code', 'win32', WIN_ENV), path.join('C:\\Program Files', 'ClaudeCode'));
+  assert.equal(managedDir('codex', 'win32', WIN_ENV), path.join('C:\\Program Files', 'Codex'));
+});
+
+test('managedDir win32: Cursor and Augment live under ProgramData', () => {
+  assert.equal(managedDir('cursor', 'win32', WIN_ENV), path.join('C:\\ProgramData', 'Cursor'));
+  assert.equal(managedDir('augment', 'win32', WIN_ENV), path.join('C:\\ProgramData', 'Augment'));
+});
+
+test('managedDir win32: honors ProgramFiles/ProgramData overrides, falls back when unset', () => {
+  assert.equal(managedDir('claude-code', 'win32', { ProgramFiles: 'D:\\PF' }), path.join('D:\\PF', 'ClaudeCode'));
+  assert.equal(managedDir('claude-code', 'win32', {}), path.join('C:\\Program Files', 'ClaudeCode'));
+  assert.equal(managedDir('cursor', 'win32', {}), path.join('C:\\ProgramData', 'Cursor'));
+});
+
+// macOS and Linux were already correct; pin them so the Windows fix cannot regress them.
+test('managedDir darwin: unchanged', () => {
+  assert.equal(managedDir('cursor', 'darwin', {}), '/Library/Application Support/Cursor');
+  assert.equal(managedDir('claude-code', 'darwin', {}), '/Library/Application Support/ClaudeCode');
+  assert.equal(managedDir('codex', 'darwin', {}), '/Library/Application Support/Codex');
+  assert.equal(managedDir('augment', 'darwin', {}), '/etc/augment');
+});
+
+test('managedDir linux: unchanged', () => {
+  assert.equal(managedDir('cursor', 'linux', {}), '/etc/cursor');
+  assert.equal(managedDir('claude-code', 'linux', {}), '/etc/claude-code');
+  assert.equal(managedDir('codex', 'linux', {}), '/etc/codex');
+  assert.equal(managedDir('augment', 'linux', {}), '/etc/augment');
+});
+
+test('managedDir: tools with no managed directory return null', () => {
+  assert.equal(managedDir('copilot', 'win32', WIN_ENV), null);
+  assert.equal(managedDir('gemini', 'darwin', {}), null);
+});
+
+// --- config-file discovery, exercised through the existing _mdmDirs override ---
+
+function withHome(fn) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-mdm-'));
+  const origHome = process.env.HOME;
+  process.env.HOME = tmp;
+  delete require.cache[require.resolve('../src/toolHealth')];
+  try {
+    return fn(tmp, require('../src/toolHealth'));
+  } finally {
+    if (origHome === undefined) delete process.env.HOME; else process.env.HOME = origHome;
+    delete require.cache[require.resolve('../src/toolHealth')];
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+function writeFile(p, body) {
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.writeFileSync(p, body);
+}
+
+// The MDM install prefers managed-settings.d/unbound.json and only writes the flat file
+// as a fallback, on every platform. A drop-in-only device is the normal case, not an edge.
+test('Claude Code: managed-settings.d drop-in alone is recognised as MDM-managed', () => {
+  withHome((tmp, th) => {
+    const dir = path.join(tmp, 'mdm', 'ClaudeCode');
+    writeFile(path.join(dir, 'managed-settings.d', 'unbound.json'),
+      JSON.stringify({ hooks: { PreToolUse: [{ command: path.join(dir, 'hooks', 'unbound.py') }] } }));
+    writeFile(path.join(dir, 'hooks', 'unbound.py'), '#');
+    const t = th.detectTools({ apiKey: 'k', _mdmDirs: { 'claude-code': dir } }).find((x) => x.family === 'claude-code');
+    assert.equal(t.status, 'managed-by-mdm');
+    assert.equal(t.scope, 'mdm');
+  });
+});
+
+test('Claude Code: flat managed-settings.json still works when no drop-in exists', () => {
+  withHome((tmp, th) => {
+    const dir = path.join(tmp, 'mdm', 'ClaudeCode');
+    writeFile(path.join(dir, 'managed-settings.json'),
+      JSON.stringify({ hooks: { PreToolUse: [{ command: path.join(dir, 'hooks', 'unbound.py') }] } }));
+    writeFile(path.join(dir, 'hooks', 'unbound.py'), '#');
+    const t = th.detectTools({ apiKey: 'k', _mdmDirs: { 'claude-code': dir } }).find((x) => x.family === 'claude-code');
+    assert.equal(t.status, 'managed-by-mdm');
+  });
+});
+
+// Codex's MDM install writes hooks.json, not managed-settings.json.
+test('Codex: managed hooks.json is recognised as MDM-managed', () => {
+  withHome((tmp, th) => {
+    const dir = path.join(tmp, 'mdm', 'Codex');
+    writeFile(path.join(dir, 'hooks.json'),
+      JSON.stringify({ hooks: { PreToolUse: [{ command: path.join(dir, 'hooks', 'unbound.py') }] } }));
+    writeFile(path.join(dir, 'hooks', 'unbound.py'), '#');
+    const t = th.detectTools({ apiKey: 'k', _mdmDirs: { codex: dir } }).find((x) => x.family === 'codex');
+    assert.equal(t.status, 'managed-by-mdm');
+    assert.equal(t.scope, 'mdm');
+  });
+});
+
+// A plain Claude Enterprise managed file that never mentions Unbound must not register.
+test('a foreign managed config is not reported as an Unbound MDM install', () => {
+  withHome((tmp, th) => {
+    const dir = path.join(tmp, 'mdm', 'ClaudeCode');
+    writeFile(path.join(dir, 'managed-settings.d', 'unbound.json'),
+      JSON.stringify({ env: { ANTHROPIC_BASE_URL: 'https://bedrock.acme.internal' } }));
+    const t = th.detectTools({ apiKey: 'k', _mdmDirs: { 'claude-code': dir } }).find((x) => x.family === 'claude-code');
+    assert.notEqual(t.scope, 'mdm');
+  });
+});
+
+// --- doctor routing depends on these two fields ---
+// `unbound doctor --fix` splits repairs with `tampered.filter(t => t.scope === 'mdm')`.
+// Before the path fix these installs read as not-installed, so a broken org-managed
+// Claude Code or Codex was never offered a repair at all.
+
+test('doctor routing: a broken Claude Code drop-in install is tampered + mdm scope', () => {
+  withHome((tmp, th) => {
+    const dir = path.join(tmp, 'mdm', 'ClaudeCode');
+    // config references the hook, but the hook script was removed
+    writeFile(path.join(dir, 'managed-settings.d', 'unbound.json'),
+      JSON.stringify({ hooks: { PreToolUse: [{ command: path.join(dir, 'hooks', 'unbound.py') }] } }));
+    const t = th.detectTools({ apiKey: 'k', _mdmDirs: { 'claude-code': dir } }).find((x) => x.family === 'claude-code');
+    assert.equal(t.status, 'tampered');
+    assert.equal(t.scope, 'mdm');
+  });
+});
+
+test('doctor routing: a broken Codex hooks.json install is tampered + mdm scope', () => {
+  withHome((tmp, th) => {
+    const dir = path.join(tmp, 'mdm', 'Codex');
+    writeFile(path.join(dir, 'hooks.json'),
+      JSON.stringify({ hooks: { PreToolUse: [{ command: path.join(dir, 'hooks', 'unbound.py') }] } }));
+    const t = th.detectTools({ apiKey: 'k', _mdmDirs: { codex: dir } }).find((x) => x.family === 'codex');
+    assert.equal(t.status, 'tampered');
+    assert.equal(t.scope, 'mdm');
+  });
+});
+
+// A drop-in left behind by an earlier install stays on disk after its hooks are
+// stripped. It must not mask a valid flat managed-settings.json sitting beside it.
+test('Claude Code: a stale drop-in does not hide a valid flat managed-settings.json', () => {
+  withHome((tmp, th) => {
+    const dir = path.join(tmp, 'mdm', 'ClaudeCode');
+    writeFile(path.join(dir, 'managed-settings.d', 'unbound.json'),
+      JSON.stringify({ env: { ANTHROPIC_BASE_URL: 'https://bedrock.acme.internal' } }));
+    writeFile(path.join(dir, 'managed-settings.json'),
+      JSON.stringify({ hooks: { PreToolUse: [{ command: path.join(dir, 'hooks', 'unbound.py') }] } }));
+    writeFile(path.join(dir, 'hooks', 'unbound.py'), '#');
+    const t = th.detectTools({ apiKey: 'k', _mdmDirs: { 'claude-code': dir } }).find((x) => x.family === 'claude-code');
+    assert.equal(t.status, 'managed-by-mdm');
+    assert.equal(t.scope, 'mdm');
+  });
+});
+
+test('Claude Code: neither candidate referencing Unbound is still not an Unbound install', () => {
+  withHome((tmp, th) => {
+    const dir = path.join(tmp, 'mdm', 'ClaudeCode');
+    writeFile(path.join(dir, 'managed-settings.d', 'unbound.json'), JSON.stringify({ env: {} }));
+    writeFile(path.join(dir, 'managed-settings.json'), JSON.stringify({ env: { ANTHROPIC_BASE_URL: 'https://x' } }));
+    const t = th.detectTools({ apiKey: 'k', _mdmDirs: { 'claude-code': dir } }).find((x) => x.family === 'claude-code');
+    assert.notEqual(t.scope, 'mdm');
+  });
+});
+
+// A python-era drop-in can survive a migration to the binary hook. It still names
+// unbound.py, but that script is gone; the flat file beside it names the live binary.
+// The healthy candidate has to win, or a working install reports as tampered and
+// doctor sends the user through a pointless elevated repair.
+test('Claude Code: a stale drop-in naming a missing hook loses to a flat file naming a live one', () => {
+  withHome((tmp, th) => {
+    const dir = path.join(tmp, 'mdm', 'ClaudeCode');
+    const binary = path.join(tmp, 'opt', 'unbound-hook', 'unbound-hook');
+    writeFile(binary, '#');
+    writeFile(path.join(dir, 'managed-settings.d', 'unbound.json'),
+      JSON.stringify({ hooks: { PreToolUse: [{ command: path.join(dir, 'hooks', 'unbound.py') }] } }));
+    writeFile(path.join(dir, 'managed-settings.json'),
+      JSON.stringify({ hooks: { PreToolUse: [{ command: binary }] } }));
+    const t = th.detectTools({ apiKey: 'k', _mdmDirs: { 'claude-code': dir }, _binaryPath: binary })
+      .find((x) => x.family === 'claude-code');
+    assert.equal(t.status, 'managed-by-mdm');
+    assert.equal(t.scope, 'mdm');
+  });
+});
+
+// When no candidate is healthy, the install really is broken and must still say so.
+test('Claude Code: both candidates naming missing hooks is still tampered', () => {
+  withHome((tmp, th) => {
+    const dir = path.join(tmp, 'mdm', 'ClaudeCode');
+    writeFile(path.join(dir, 'managed-settings.d', 'unbound.json'),
+      JSON.stringify({ hooks: { PreToolUse: [{ command: path.join(dir, 'hooks', 'unbound.py') }] } }));
+    writeFile(path.join(dir, 'managed-settings.json'),
+      JSON.stringify({ hooks: { PreToolUse: [{ command: path.join(dir, 'hooks', 'unbound.py') }] } }));
+    const t = th.detectTools({ apiKey: 'k', _mdmDirs: { 'claude-code': dir } }).find((x) => x.family === 'claude-code');
+    assert.equal(t.status, 'tampered');
+    assert.equal(t.scope, 'mdm');
+  });
+});

package/test/tool-health.test.js

@@ -33,12 +33,14 @@ function withHome(fn) {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-doctor-'));
   const origHome = process.env.HOME;
   process.env.HOME = tmp;
+  delete require.cache[require.resolve('../src/claudePaths')];
   delete require.cache[require.resolve('../src/toolHealth')];
   try {
     return fn(tmp, require('../src/toolHealth'));
   } finally {
     if (origHome === undefined) delete process.env.HOME;
     else process.env.HOME = origHome;
+    delete require.cache[require.resolve('../src/claudePaths')];
     delete require.cache[require.resolve('../src/toolHealth')];
     fs.rmSync(tmp, { recursive: true, force: true });
   }
@@ -609,3 +611,186 @@ test('validateToolKeys: missing key (no env var) → tampered without consulting
     assert.equal(called, false);
   });
 });
+
+// --- gateway detection identifies OUR key helper, not merely the conventional name.
+// The setup no longer removes someone else's helper, so a foreign one at the same path
+// must not read as a gateway install. ---
+const { isUnboundKeyHelper, keyHelperCheck } = require('../src/toolHealth');
+
+test('isUnboundKeyHelper: the value the gateway setup writes', () => {
+  assert.equal(isUnboundKeyHelper('~/.claude/anthropic_key.sh'), true);
+});
+
+test('isUnboundKeyHelper: the expanded form of that value', () => {
+  assert.equal(isUnboundKeyHelper(path.join(os.homedir(), '.claude', 'anthropic_key.sh')), true);
+});
+
+test("isUnboundKeyHelper: someone else's helper is not ours", () => {
+  assert.equal(isUnboundKeyHelper('~/bin/my_own_key.sh'), false);
+  assert.equal(isUnboundKeyHelper('~/.claude/anthropic_key.sh.bak'), false);
+  assert.equal(isUnboundKeyHelper(undefined), false);
+});
+
+test('isUnboundKeyHelper: an install under another home still counts', () => {
+  assert.equal(isUnboundKeyHelper('/Users/someone/.claude/anthropic_key.sh'), true);
+});
+
+test('keyHelperCheck: a shebang or trailing newline does not disown a real install', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'unb-helper-'));
+  const file = path.join(dir, 'anthropic_key.sh');
+  fs.writeFileSync(file, '#!/bin/sh\necho $UNBOUND_API_KEY\n');
+  assert.equal(keyHelperCheck('Key helper', file).ok, true);
+});
+
+test('keyHelperCheck: the script the gateway wrote is ours', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'unb-helper-'));
+  const file = path.join(dir, 'anthropic_key.sh');
+  fs.writeFileSync(file, 'echo $UNBOUND_API_KEY');
+  assert.equal(keyHelperCheck('Key helper', file).ok, true);
+});
+
+test('keyHelperCheck: a helper of the same name holding something else is not ours', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'unb-helper-'));
+  const file = path.join(dir, 'anthropic_key.sh');
+  fs.writeFileSync(file, 'echo $MY_COMPANY_KEY');
+  const check = keyHelperCheck('Key helper', file);
+  assert.equal(check.ok, false);
+  assert.match(check.detail, /not written by Unbound/);
+});
+
+test('keyHelperCheck: a missing helper', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'unb-helper-'));
+  assert.equal(keyHelperCheck('Key helper', path.join(dir, 'absent.sh')).ok, false);
+});
+
+// The setup no longer strips a customer's own ANTHROPIC_BASE_URL export when it installs
+// or removes ours, so a device can persist both. The gateway check has to find ours among
+// them rather than judge on whichever value is read first.
+function withGatewayInstall(tmp, extra) {
+  writeFile(path.join(tmp, '.claude', 'settings.json'),
+    JSON.stringify({ apiKeyHelper: '/Users/whatever/.claude/anthropic_key.sh' }));
+  writeFile(path.join(tmp, '.claude', 'anthropic_key.sh'), '#!/bin/sh\necho $UNBOUND_API_KEY\n');
+  process.env.UNBOUND_API_KEY = 'k';
+  extra();
+}
+
+test('detectTools: a customer export beside ours in the same rc → healthy', () => {
+  withHome((tmp, th) => {
+    withGatewayInstall(tmp, () => {
+      writeFile(path.join(tmp, '.bashrc'),
+        'export ANTHROPIC_BASE_URL="https://llm.acme-corp.internal"\n'
+        + 'export ANTHROPIC_BASE_URL="https://gateway.example.com"\n');
+    });
+    try {
+      const t = th.detectTools({ gatewayUrl: 'https://gateway.example.com' })
+        .find((x) => x.family === 'claude-code');
+      assert.equal(t.status, 'healthy');
+    } finally {
+      delete process.env.UNBOUND_API_KEY;
+    }
+  });
+});
+
+test('detectTools: a customer export in an earlier rc file than ours → healthy', () => {
+  withHome((tmp, th) => {
+    withGatewayInstall(tmp, () => {
+      writeFile(path.join(tmp, '.zshrc'), 'export ANTHROPIC_BASE_URL="https://llm.acme-corp.internal"\n');
+      writeFile(path.join(tmp, '.bashrc'), 'export ANTHROPIC_BASE_URL="https://gateway.example.com"\n');
+    });
+    try {
+      const t = th.detectTools({ gatewayUrl: 'https://gateway.example.com' })
+        .find((x) => x.family === 'claude-code');
+      assert.equal(t.status, 'healthy');
+    } finally {
+      delete process.env.UNBOUND_API_KEY;
+    }
+  });
+});
+
+test('detectTools: only a customer export, none of ours → tampered', () => {
+  withHome((tmp, th) => {
+    withGatewayInstall(tmp, () => {
+      writeFile(path.join(tmp, '.bashrc'), 'export ANTHROPIC_BASE_URL="https://llm.acme-corp.internal"\n');
+    });
+    try {
+      const t = th.detectTools({ gatewayUrl: 'https://gateway.example.com' })
+        .find((x) => x.family === 'claude-code');
+      assert.equal(t.status, 'tampered');
+    } finally {
+      delete process.env.UNBOUND_API_KEY;
+    }
+  });
+});
+
+test('rcEnvValues: every export is returned, in file order', () => {
+  withHome((tmp, th) => {
+    writeFile(path.join(tmp, '.bashrc'),
+      'export ANTHROPIC_BASE_URL="https://one.example.com"\n'
+      + 'export PATH=/usr/local/bin:$PATH\n'
+      + "export ANTHROPIC_BASE_URL='https://two.example.com'\n");
+    assert.deepEqual(th.rcEnvValues('ANTHROPIC_BASE_URL').map((v) => v.value),
+      ['https://one.example.com', 'https://two.example.com']);
+  });
+});
+
+test('rcEnvValues: nothing persisted', () => {
+  withHome((tmp, th) => {
+    writeFile(path.join(tmp, '.bashrc'), 'export PATH=/usr/local/bin:$PATH\n');
+    assert.deepEqual(th.rcEnvValues('ANTHROPIC_BASE_URL'), []);
+  });
+});
+
+test('detectTools: claude-code hooks under a custom CLAUDE_CONFIG_DIR are detected there', () => {
+  withHome((tmp, th) => {
+    const ccdir = path.join(tmp, 'custom-cc');
+    process.env.CLAUDE_CONFIG_DIR = ccdir;
+    process.env.UNBOUND_CLAUDE_API_KEY = 'k';
+    try {
+      const script = path.join(ccdir, 'hooks', 'unbound.py');
+      writeFile(path.join(ccdir, 'settings.json'), JSON.stringify({ hooks: { PreToolUse: [{ command: script }] } }));
+      writeFile(script, '# unbound');
+      const claude = th.detectTools().filter((t) => t.family === 'claude-code');
+      assert.equal(claude.length, 1, 'one collapsed claude-code line');
+      assert.equal(claude[0].status, 'healthy');
+    } finally {
+      delete process.env.CLAUDE_CONFIG_DIR;
+      delete process.env.UNBOUND_CLAUDE_API_KEY;
+    }
+  });
+});
+
+test('detectTools: with CLAUDE_CONFIG_DIR set, stale hooks in ~/.claude are NOT counted', () => {
+  withHome((tmp, th) => {
+    process.env.CLAUDE_CONFIG_DIR = path.join(tmp, 'custom-cc');
+    process.env.UNBOUND_CLAUDE_API_KEY = 'k';
+    try {
+      const script = path.join(tmp, '.claude', 'hooks', 'unbound.py');
+      writeFile(path.join(tmp, '.claude', 'settings.json'), JSON.stringify({ hooks: { PreToolUse: [{ command: script }] } }));
+      writeFile(script, '# unbound');
+      const claude = th.detectTools().find((t) => t.family === 'claude-code');
+      assert.equal(claude.status, 'not-installed', 'stale ~/.claude hooks are ignored when the dir is relocated');
+    } finally {
+      delete process.env.CLAUDE_CONFIG_DIR;
+      delete process.env.UNBOUND_CLAUDE_API_KEY;
+    }
+  });
+});
+
+// Under a relocated dir the gateway writes the helper beside that dir, which is
+// not named .claude — so neither the literal nor the tail match applies and the
+// install would otherwise read as someone else's helper.
+test('isUnboundKeyHelper: a helper under a relocated CLAUDE_CONFIG_DIR is still ours', () => {
+  const prev = process.env.CLAUDE_CONFIG_DIR;
+  process.env.CLAUDE_CONFIG_DIR = path.join(os.tmpdir(), 'relocated-cc');
+  delete require.cache[require.resolve('../src/claudePaths')];
+  delete require.cache[require.resolve('../src/toolHealth')];
+  try {
+    const th = require('../src/toolHealth');
+    assert.equal(th.isUnboundKeyHelper(path.join(os.tmpdir(), 'relocated-cc', 'anthropic_key.sh')), true);
+    assert.equal(th.isUnboundKeyHelper(path.join(os.tmpdir(), 'somewhere-else', 'anthropic_key.sh')), false);
+  } finally {
+    if (prev === undefined) delete process.env.CLAUDE_CONFIG_DIR; else process.env.CLAUDE_CONFIG_DIR = prev;
+    delete require.cache[require.resolve('../src/claudePaths')];
+    delete require.cache[require.resolve('../src/toolHealth')];
+  }
+});