unbound-cli 1.15.2 → 1.16.7

package/LOCAL_DEV.md

@@ -11,7 +11,7 @@
 cd unbound-cli
 npm install
 ```
-
+ 
 ## Run locally (without installing globally)
 
 ```bash
@@ -85,7 +85,7 @@ sudo node src/index.js setup --api-key <ADMIN_KEY> --all --backend-url http://lo
 # Onboarding (combined setup + discover)
 node src/index.js onboard --api-key <USER_KEY> \
     --backend-url http://localhost:8000 --frontend-url http://localhost:3000
-sudo node src/index.js onboard --api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY> \
+sudo node src/index.js onboard --api-key <ADMIN_KEY> \
     --backend-url http://localhost:8000 --frontend-url http://localhost:3000
 ```
 
@@ -186,7 +186,7 @@ node src/index.js setup --all --api-key <key>
 node src/index.js onboard --api-key <USER_KEY>
 
 # MDM onboarding (admin device enrollment, requires root — MDM scope auto-detected from sudo)
-sudo node src/index.js onboard --api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY>
+sudo node src/index.js onboard --api-key <ADMIN_KEY>
 ```
 
 ## Unlink when done

package/README.md

@@ -40,10 +40,10 @@ npm install -g unbound-cli
 unbound onboard --api-key <USER_KEY>
 
 # Admin enrolling a device via MDM (requires root)
-sudo unbound onboard --api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY>
+sudo unbound onboard --api-key <ADMIN_KEY>
 ```
 
-The user API key and discovery API key are separate — discovery uses its own key that the CLI does not store. Run with `sudo` to let the discovery step scan all users on the device; without it, only the current user is scanned.
+Only your API key is needed. Run with `sudo` to let the discovery step scan all users on the device (the device is attributed to its owner, resolved from the hardware serial); without it, only the current user is scanned.
 
 ## Commands
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.15.2",
+  "version": "1.16.7",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/auth.js

@@ -8,7 +8,7 @@ const authPages = require('./auth-pages');
 const config = require('./config');
 const output = require('./output');
 const api = require('./api');
-const { getDeviceSerial } = require('./device-serial');
+const { getDeviceSerial, probeDeviceSerialLive } = require('./device-serial');
 
 /**
  * Opens the browser for authentication and waits for the callback.
@@ -223,4 +223,31 @@ async function ensureLoggedIn({ apiKey, baseUrl, frontendUrl } = {}) {
   return true;
 }
 
-module.exports = { loginWithBrowser, loginWithApiKey, ensureLoggedIn };
+/**
+ * Exchange the admin key + this device's hardware serial for the device owner's
+ * application key, so an org-wide scan is attributed to the owner, not the admin.
+ * Throws on a missing serial or unusable response so the caller can abort.
+ */
+async function fetchDeviceOwnerKey(adminApiKey, { baseUrl } = {}) {
+  // Probe the serial live, never the user-writable cache — it decides whose key
+  // gets minted, so a planted cache value must not be trusted here.
+  const deviceSerial = await probeDeviceSerialLive();
+  if (!deviceSerial) {
+    throw new Error(
+      "Could not read this device's hardware serial number. "
+      + 'Re-run without sudo to onboard just the current user.'
+    );
+  }
+  const resp = await api.get('/api/v1/automations/mdm/get_application_api_key/', {
+    apiKey: adminApiKey,
+    baseUrl,
+    query: { serial_number: deviceSerial, app_type: 'default' },
+  });
+  const ownerKey = resp && resp.api_key;
+  if (!ownerKey) {
+    throw new Error('The backend did not return a key for this device.');
+  }
+  return ownerKey;
+}
+
+module.exports = { loginWithBrowser, loginWithApiKey, ensureLoggedIn, fetchDeviceOwnerKey };

package/src/claudePaths.js

@@ -0,0 +1,82 @@
+const os = require('os');
+const path = require('path');
+
+const DEFAULT_CLAUDE_DIR = path.join(os.homedir(), '.claude');
+
+// Mirrors Claude Code's own resolution: it reads CLAUDE_CONFIG_DIR verbatim,
+// with no tilde expansion. Expanding "~" would install to $HOME/x while Claude
+// reads ./~/x. A blank value is treated as unset so setup never targets the cwd.
+function resolveClaudeConfigDir() {
+  const raw = (process.env.CLAUDE_CONFIG_DIR || '').trim();
+  return raw ? path.resolve(raw) : DEFAULT_CLAUDE_DIR;
+}
+
+// Claude Code resolves CLAUDE_CONFIG_DIR against the cwd when it is set but
+// empty, rather than falling back to ~/.claude — so a default install is one it
+// never reads. Callers surface this instead of reporting a healthy setup.
+const BLANK_CONFIG_DIR_MESSAGE =
+  'CLAUDE_CONFIG_DIR is set but empty — Claude Code reads that as a path relative to the ' +
+  'current directory, so it will not load hooks installed in ~/.claude. Unset it, or point ' +
+  'it at a real directory.';
+
+function isBlankConfigDir() {
+  const raw = process.env.CLAUDE_CONFIG_DIR;
+  return typeof raw === 'string' && raw.trim() === '';
+}
+
+// Windows paths are case-insensitive, so C:\\Users\\jane\\.claude and
+// c:\\users\\jane\\.claude name one directory. Comparing them literally would
+// class the default dir as relocated and forward a --config-dir nobody needs.
+const samePath = process.platform === 'win32'
+  ? (a, b) => a.toLowerCase() === b.toLowerCase()
+  : (a, b) => a === b;
+
+function isNonDefaultConfigDir() {
+  return !samePath(resolveClaudeConfigDir(), DEFAULT_CLAUDE_DIR);
+}
+
+function claudeHooksDir(dir = resolveClaudeConfigDir()) {
+  return path.join(dir, 'hooks');
+}
+
+function claudeSettingsPath(dir = resolveClaudeConfigDir()) {
+  return path.join(dir, 'settings.json');
+}
+
+// Renders a path under the home dir with a leading ~, so a default install
+// still reads as ~/.claude/... in status output rather than a long absolute path.
+function displayPath(p) {
+  const home = os.homedir();
+  if (samePath(p, home)) return '~';
+  const prefix = home + path.sep;
+  return samePath(p.slice(0, prefix.length), prefix) ? '~' + p.slice(home.length) : p;
+}
+
+const CLAUDE_INSTALL_MARKERS = [path.join('hooks', 'unbound.py'), 'anthropic_key.sh'];
+
+// Reports hooks sitting in ~/.claude while a different dir is active, so the
+// caller can fail loudly instead of showing a green status Claude never honors.
+function detectConfigDirMismatch(markers = CLAUDE_INSTALL_MARKERS, { fs = require('fs') } = {}) {
+  const activeDir = resolveClaudeConfigDir();
+  if (samePath(activeDir, DEFAULT_CLAUDE_DIR)) return null;
+  const anyExists = (base) => markers.some((rel) => {
+    try { return fs.existsSync(path.join(base, rel)); } catch { return false; }
+  });
+  if (!anyExists(activeDir) && anyExists(DEFAULT_CLAUDE_DIR)) {
+    return { activeDir, staleDir: DEFAULT_CLAUDE_DIR };
+  }
+  return null;
+}
+
+module.exports = {
+  DEFAULT_CLAUDE_DIR,
+  resolveClaudeConfigDir,
+  samePath,
+  isNonDefaultConfigDir,
+  isBlankConfigDir,
+  BLANK_CONFIG_DIR_MESSAGE,
+  claudeHooksDir,
+  claudeSettingsPath,
+  displayPath,
+  detectConfigDirMismatch,
+};

package/src/commands/analytics.js

@@ -280,7 +280,7 @@ Examples:
   $ unbound analytics tool-use mcp-actions --server claude_ai_notion
   $ unbound analytics tool-use unsanctioned --format csv -o blocked.csv
 
-Admin role required — for listing as well as CSV export.
+Admin or Analytics Viewer. Applies to listing as well as CSV export.
 ${FILTER_HELP}${AGENT_HELP}`);
 
   attach(toolUse, 'terminal', DATASETS.terminal, `

package/src/commands/chat.js

@@ -179,7 +179,7 @@ function normalizeAssistantTurn(turn) {
 // backend-supplied strings out of the shell line so copy-pastes stay safe.
 function friendlyChatError(err) {
   if (err?.statusCode === 401) return 'Not authenticated. Run `unbound login` and try again.';
-  if (err?.statusCode === 403) return 'Chat requires Admin or Manager role. Run `unbound status` to check yours.';
+  if (err?.statusCode === 403) return 'Chat requires Admin, Analytics Viewer or Manager role. Run `unbound status` to check yours.';
   if (err?.statusCode === 429) return 'Rate limited. Please wait a moment and try again.';
   if (err?.statusCode === 504) return 'The turn took too long and the connection was closed. Try narrowing the question.';
   return sanitizeForTerminal(err?.message || 'Request failed.');
@@ -666,7 +666,7 @@ INTERACTIVE SESSION
     /exit              quit (Ctrl+C also works)
 
 NOTES
-  * Requires Admin or Manager role in your organization. Run 'unbound status' to check.
+  * Requires Admin, Analytics Viewer or Manager role in your organization. Run 'unbound status' to check.
   * A question the assistant asks back is a normal reply, not an error: the turn
     exits 0, and you answer it in the next one with -c.
   * Each -m invocation is its own process and sends no history. -c carries the

package/src/commands/discover.js

@@ -5,6 +5,7 @@ const os = require('os');
 const config = require('../config');
 const output = require('../output');
 const telemetry = require('../telemetry');
+const { Option } = require('commander');
 const { shellEscape, downloadToFile, withSecureTempFile, DISCOVER_BASE_URL } = require('../utils');
 const LAUNCH_AGENT_LABEL = 'ai.getunbound.discovery';
 
@@ -17,7 +18,7 @@ const DISCOVERY_EXIT_UNSUPPORTED_OS = 3;
 // indefinitely. Discovery enforces this itself — on expiry it releases its lock,
 // reports the run as failed, and exits non-zero. Kept in sync with
 // setup/mdm/onboard.py's DISCOVERY_TIMEOUT_SECONDS.
-const DISCOVERY_TIMEOUT_SECONDS = 9000;
+const DISCOVERY_TIMEOUT_SECONDS = 12000;
 
 // Classifies a discovery subprocess exit code:
 // 'success' (scan ran), 'unsupported' (skipped on this OS), or 'failure'.
@@ -34,8 +35,10 @@ function isWindowsNative() {
 }
 
 function isRoot() {
-  if (process.platform === 'win32') return false;
-  return typeof process.getuid === 'function' && process.getuid() === 0;
+  // Delegate to the shared, Windows-aware privilege check so `discover` and
+  // `onboard` agree on scope on every platform. Lazy require avoids any
+  // module-load cycle between discover and setup.
+  return require('./setup').hasRootPrivileges();
 }
 
 /**
@@ -194,6 +197,7 @@ function register(program) {
     .option('--api-key <key>', 'Discovery API key (required)')
     .option('--domain <url>', 'Backend URL (defaults to configured backend)')
     .option('--set-cron', 'Set up a daily scheduled discovery scan at 09:00 (cross-platform)')
+    .addOption(new Option('--discovery-key <key>', 'Deprecated and ignored. The scan uses your API key.').hideHelp())
     .addHelpText('after', `
 Scans this device for installed AI coding tools (Cursor, Claude Code,
 Gemini CLI, Codex, Windsurf, Roo Code, Cline, GitHub Copilot, JetBrains,
@@ -201,7 +205,7 @@ and more) and reports findings to the Unbound backend.
 
 Which --api-key to use depends on scope:
   - Single-user scan (no sudo): use your own user API key.
-  - All-users scan (sudo): use the org discovery key.
+  - All-users scan (sudo): use your admin API key.
 The --domain defaults to the backend URL configured via "unbound config set-backend-url"
 (falls back to https://backend.getunbound.ai when unset).
 
@@ -218,8 +222,15 @@ Examples:
 `)
     .action(telemetry.wrapAction('discover', async (opts) => {
       let scanSucceeded = false;
-      // Register the discovery key so beforeSend redacts it from any event.
+      // Register the api key so beforeSend redacts it from any event.
       telemetry.rememberSecret(opts.apiKey);
+      // Accept and ignore a stale discovery key (flag or env) instead of erroring;
+      // the scan uses the API key. Redact it, then warn.
+      const staleDiscoveryKey = opts.discoveryKey || process.env.UNBOUND_DISCOVERY_KEY;
+      if (staleDiscoveryKey) {
+        telemetry.rememberSecret(staleDiscoveryKey);
+        output.warn('--discovery-key is deprecated and ignored — the scan uses your API key.');
+      }
       try {
         if (!opts.apiKey) {
           output.error('--api-key is required.');
@@ -254,7 +265,7 @@ Examples:
           const domain = opts.domain || config.getBaseUrl();
           const suffix = domain && domain !== config.DEFAULT_BASE_URL ? ` --domain ${domain}` : '';
           console.error('  Discovery completed successfully — only scheduled-run setup failed.');
-          console.error(`  Re-run cron setup with: unbound discover --set-cron --api-key <DISCOVERY_KEY>${suffix}`);
+          console.error(`  Re-run cron setup with: unbound discover --set-cron --api-key <KEY>${suffix}`);
         }
         process.exitCode = 1;
       }

package/src/commands/doctor.js

@@ -4,7 +4,8 @@ const api = require('../api');
 const output = require('../output');
 const { getDeviceSerial } = require('../device-serial');
 const { detectTools, validateToolKeys, countValidationSkipped } = require('../toolHealth');
-const { hasRootPrivileges } = require('./setup');
+const { hasRootPrivileges, elevated } = require('./setup');
+const claudePaths = require('../claudePaths');
 
 // Validate the stored API key against the backend. Returns one of:
 // valid | invalid | not-logged-in | unverified (network/other error).
@@ -74,7 +75,9 @@ Examples:
         spin.stop();
 
         const tampered = tools.filter((t) => t.status === 'tampered');
-        const unhealthy = tampered.length > 0 || key.state === 'invalid';
+        const configMismatch = claudePaths.detectConfigDirMismatch();
+        const blankConfigDir = claudePaths.isBlankConfigDir();
+        const unhealthy = tampered.length > 0 || key.state === 'invalid' || !!configMismatch || blankConfigDir;
 
         if (opts.json) {
           output.json({
@@ -92,12 +95,19 @@ Examples:
             })),
             healthy: !unhealthy,
             key_validations_skipped: keySkippedCount,
+            claude_config_dir_mismatch: configMismatch,
+            claude_config_dir_blank: blankConfigDir,
           });
           if (unhealthy) process.exitCode = 1;
           return;
         }
 
         const C = output.colors;
+        const reportConfigMismatch = (m) => {
+          console.log(C.red('✗ Claude Code is installed where Claude Code won’t read it.'));
+          console.log(`  Install lives in ${C.bold(m.staleDir)} but ${C.bold('CLAUDE_CONFIG_DIR')} points at ${C.bold(m.activeDir)}.`);
+          console.log(`  Re-run ${C.bold('unbound setup')} with CLAUDE_CONFIG_DIR set so it installs under the active dir.`);
+        };
         const labelOf = (t) => t.label + (t.mode && t.mode !== 'subscription' ? ` (${t.mode})` : '');
         const W = Math.max(7, ...tools.map((t) => labelOf(t).length)); // 7 = "API key"
 
@@ -146,7 +156,16 @@ Examples:
         const anyInstalled = tools.some((t) => t.status !== 'not-installed');
 
         if (opts.fix) {
+          if (blankConfigDir) {
+            output.error(claudePaths.BLANK_CONFIG_DIR_MESSAGE);
+            console.log('');
+          }
+          if (configMismatch) {
+            reportConfigMismatch(configMismatch);
+            console.log('');
+          }
           if (!tampered.length) {
+            if (configMismatch || blankConfigDir) { process.exitCode = 1; return; }
             if (!anyInstalled) console.log(`${C.yellow('No tools are set up yet')} — nothing to fix. Run ${C.bold('unbound setup')} first.`);
             else output.success('Nothing to fix — all set up tools are healthy.');
             console.log('');
@@ -157,7 +176,7 @@ Examples:
           // tools only, and point at sudo for whatever's org-managed.
           if (!root && !userFix.length) {
             console.log(`${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization.`);
-            console.log(`  Run ${C.bold('sudo unbound doctor --fix')} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
+            console.log(`  Run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
             console.log('');
             process.exitCode = 1;
             return;
@@ -167,13 +186,13 @@ Examples:
           output.info(`Reinstalling: ${fixDisplay}${root ? ' (org-wide, all users)' : ''}`);
           console.log('');
           const r = spawnSync(process.argv[0], [process.argv[1], 'setup', ...fixNow], { stdio: 'inherit' });
-          if (!root && mdmFix.length) console.error(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold('sudo unbound doctor --fix')} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
-          process.exitCode = fixExitCode(r.status, root, mdmFix.length > 0);
+          if (!root && mdmFix.length) console.error(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
+          process.exitCode = fixExitCode(r.status, root, mdmFix.length > 0) || ((configMismatch || blankConfigDir) ? 1 : 0);
           return;
         }
 
         // No `--fix`: report and show the command(s) that fix it.
-        if (!anyInstalled && key.state !== 'invalid') {
+        if (!anyInstalled && key.state !== 'invalid' && !configMismatch && !blankConfigDir) {
           console.log(`${C.yellow('No AI tools are set up yet.')} Run ${C.bold('unbound setup')} to get started.`);
           console.log('');
           return;
@@ -183,17 +202,22 @@ Examples:
           console.log('');
           return;
         }
+        if (blankConfigDir) {
+          output.error(claudePaths.BLANK_CONFIG_DIR_MESSAGE);
+          process.exitCode = 1;
+        }
+        if (configMismatch) reportConfigMismatch(configMismatch);
         if (tampered.length) {
           console.log(C.red(`✗ ${tampered.length} tool${tampered.length === 1 ? ' needs' : 's need'} attention.`));
           if (!mdmFix.length) {
             console.log(`  Run ${C.bold('unbound doctor --fix')} to repair ${userNames}.`);
           } else if (!userFix.length) {
             console.log(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization.`);
-            console.log(`  Run ${C.bold('sudo unbound doctor --fix')} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
+            console.log(`  Run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
           } else {
             // Both: a user without sudo can still fix their own tools; sudo fixes everything.
             console.log(`  Run ${C.bold('unbound doctor --fix')} to repair ${userNames}.`);
-            console.log(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold('sudo unbound doctor --fix')} to repair ${mdmFix.length === 1 ? 'it' : 'them'} too.`);
+            console.log(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'} too.`);
           }
         }
         if (key.state === 'invalid') {

package/src/commands/download.js

@@ -162,7 +162,7 @@ Examples:
   $ unbound download start logs-export --check --last 90d --json
   $ unbound download get 4f2a1c9e-1b2c-4d5e-8f90-a1b2c3d4e5f6
 
-Admin role required. Exports are kept for ${RETENTION_HOURS} hours.
+Admin or Analytics Viewer. Exports are kept for ${RETENTION_HOURS} hours.
 `);
 
   group
@@ -203,7 +203,7 @@ Examples:
   $ unbound download start analytics-export --filter dataset=terminal-runs --last 7d
   $ unbound download start logs-export --check --last 90d --json
 
-Admin role required. Exports are kept for ${RETENTION_HOURS} hours.
+Admin or Analytics Viewer. Exports are kept for ${RETENTION_HOURS} hours.
 ${FILTER_HELP}${AGENT_HELP}`)
     .action(async (kind, opts) => {
       try {

package/src/commands/oacb.js

@@ -17,13 +17,16 @@ const PKG_VERSION = '0.2.1';
 const TIERS = ['shadow', 'receipts', 'baseline', 'strict', 'paranoid'];
 const AGENTS = ['claude-code', 'codex'];
 
-// Consent receipt path
-const CONSENT_RECEIPT_PATH = path.join(os.homedir(), '.claude', 'oacb-consent.json');
+const claudePaths = require('../claudePaths');
+const CLAUDE_DIR = claudePaths.resolveClaudeConfigDir();
+
+const CONSENT_RECEIPT_PATH = path.join(CLAUDE_DIR, 'oacb-consent.json');
+const LEGACY_CONSENT_RECEIPT_PATH = path.join(claudePaths.DEFAULT_CLAUDE_DIR, 'oacb-consent.json');
 
 // Claude Code paths
-const CLAUDE_HOOKS_DIR = path.join(os.homedir(), '.claude', 'hooks');
-const CLAUDE_SETTINGS_PATH = path.join(os.homedir(), '.claude', 'settings.json');
-const CLAUDE_SETTINGS_BACKUP_PATH = path.join(os.homedir(), '.claude', 'settings.json.oacb-backup');
+const CLAUDE_HOOKS_DIR = claudePaths.claudeHooksDir(CLAUDE_DIR);
+const CLAUDE_SETTINGS_PATH = claudePaths.claudeSettingsPath(CLAUDE_DIR);
+const CLAUDE_SETTINGS_BACKUP_PATH = path.join(CLAUDE_DIR, 'settings.json.oacb-backup');
 
 // Codex paths
 const CODEX_HOOKS_DIR = path.join(os.homedir(), '.codex', 'hooks');
@@ -203,7 +206,7 @@ async function handleCheck() {
     ['Unbound session', hasUnboundSession ? 'logged in' : 'not logged in (optional)'],
     ['─── Claude Code ───', ''],
     ['Claude Code on PATH', claudeCodeVersion || 'not detected'],
-    ['~/.claude/settings.json', claudeSettingsExist ? 'found' : 'not found'],
+    [claudePaths.displayPath(CLAUDE_SETTINGS_PATH), claudeSettingsExist ? 'found' : 'not found'],
     ['OACB tier applied', claudeTier !== 'none' ? claudeTier : 'none (run `unbound oacb apply`)'],
     ['Hooks installed', `${claudeHookStates.filter(Boolean).length} / ${HOOK_NAMES.length}`],
     ['─── Codex CLI ─────', ''],
@@ -225,7 +228,22 @@ async function handleCheck() {
     output.warn('No OACB tier applied to any agent. Run `unbound oacb apply` to start with shadow tier.');
   }
 
-  output.success('Pre-flight complete.');
+  const blankConfigDir = claudePaths.isBlankConfigDir();
+  if (blankConfigDir) {
+    output.error(claudePaths.BLANK_CONFIG_DIR_MESSAGE);
+    process.exitCode = 1;
+  }
+
+  const mismatch = claudePaths.detectConfigDirMismatch([path.join('hooks', HOOK_NAMES[0])]);
+  if (mismatch) {
+    output.error(
+      `OACB hooks installed in ${mismatch.staleDir} but CLAUDE_CONFIG_DIR points at ${mismatch.activeDir} — ` +
+      'Claude will not load them; re-run `unbound oacb apply`.'
+    );
+    process.exitCode = 1;
+  }
+
+  if (!mismatch && !blankConfigDir) output.success('Pre-flight complete.');
 }
 
 async function handleAudit({ agent, tier, format }) {
@@ -464,7 +482,7 @@ async function _applyClaudeCode({ baseline, tier, overrides, localHooks }) {
 
   output.success(`OACB ${tier} applied (claude-code).`);
   if (tier === 'shadow') {
-    output.info('Shadow: hooks log but never block. Review ~/.claude/hooks/oacb-audit.log for 2 weeks, then `unbound oacb apply --tier baseline`.');
+    output.info(`Shadow: hooks log but never block. Review ${path.join(CLAUDE_HOOKS_DIR, 'oacb-audit.log')} for 2 weeks, then \`unbound oacb apply --tier baseline\`.`);
   } else if (tier === 'receipts') {
     output.info('Receipts: engineer sees WARN banners for risky commands and can abort. Expires in 30 days.');
   }
@@ -762,6 +780,11 @@ async function handleRemove({ agent, dryRun }) {
   output.success(`Wrote cleaned ${CLAUDE_SETTINGS_PATH}`);
 
   try { await fs.unlink(CONSENT_RECEIPT_PATH); } catch (_) {}
+  // readConsentReceipt falls back to the legacy receipt, so a leftover copy
+  // would keep reporting OACB as installed after it was removed.
+  if (!claudePaths.samePath(CONSENT_RECEIPT_PATH, LEGACY_CONSENT_RECEIPT_PATH)) {
+    try { await fs.unlink(LEGACY_CONSENT_RECEIPT_PATH); } catch (_) {}
+  }
   // The backup is no longer load-bearing after a successful remove — clean it
   // up so the user's ~/.claude/ doesn't accumulate stale OACB state.
   try { await fs.unlink(CLAUDE_SETTINGS_BACKUP_PATH); } catch (_) {}
@@ -1517,7 +1540,7 @@ async function historyDryRun(tier, agent) {
   const commands = [];
 
   // Try Claude Code session logs first (most accurate for auto-mode context)
-  const ccProjectsDir = path.join(os.homedir(), '.claude', 'projects');
+  const ccProjectsDir = path.join(CLAUDE_DIR, 'projects');
   try {
     const projectDirs = await fs.readdir(ccProjectsDir);
     for (const proj of projectDirs.slice(-5)) {  // last 5 projects to bound cost
@@ -1676,6 +1699,9 @@ async function readConsentReceipt() {
   try {
     return JSON.parse(await fs.readFile(CONSENT_RECEIPT_PATH, 'utf8'));
   } catch (_) {
+    if (!claudePaths.samePath(CONSENT_RECEIPT_PATH, LEGACY_CONSENT_RECEIPT_PATH)) {
+      try { return JSON.parse(await fs.readFile(LEGACY_CONSENT_RECEIPT_PATH, 'utf8')); } catch (_) {}
+    }
     return null;
   }
 }
@@ -1685,7 +1711,7 @@ async function readConsentReceipt() {
 async function handleWhy({ agent }) {
   const logPath = agent === 'codex'
     ? path.join(os.homedir(), '.codex', 'hooks', 'oacb-audit.log')
-    : path.join(os.homedir(), '.claude', 'hooks', 'oacb-audit.log');
+    : path.join(CLAUDE_HOOKS_DIR, 'oacb-audit.log');
 
   let entry = null;
   try {
@@ -1778,7 +1804,7 @@ async function handleStatus({ agent }) {
 
   const logPath = agent === 'codex'
     ? path.join(os.homedir(), '.codex', 'hooks', 'oacb-audit.log')
-    : path.join(os.homedir(), '.claude', 'hooks', 'oacb-audit.log');
+    : path.join(CLAUDE_HOOKS_DIR, 'oacb-audit.log');
 
   // Expiry countdown
   let expiryNote = '';