unbound-cli 1.15.2 → 1.16.8

package/src/commands/onboard.js

@@ -2,8 +2,8 @@ const { Option } = require('commander');
 const config = require('../config');
 const output = require('../output');
 const telemetry = require('../telemetry');
-const { ensureLoggedIn } = require('../auth');
-const { runSetupAllBundle, runMdmSetupAllBundle, hasRootPrivileges, ALL_TOOLS, MDM_ALL_TOOLS } = require('./setup');
+const { ensureLoggedIn, fetchDeviceOwnerKey } = require('../auth');
+const { runSetupAllBundle, runMdmSetupAllBundle, hasRootPrivileges, elevated, scopeNotice, ALL_TOOLS, MDM_ALL_TOOLS } = require('./setup');
 const { runDiscoveryScan } = require('./discover');
 
 /**
@@ -27,7 +27,7 @@ function register(program) {
     )
     .option('--api-key <key>', 'API key (user key, or admin key when run with sudo). Falls back to UNBOUND_API_KEY or a stored `unbound login` key)')
     .addOption(new Option('--admin-api-key <key>', 'Alias for --api-key (back-compat)').hideHelp())
-    .option('--discovery-key <key>', 'Org discovery key for the device scan — required only under sudo (MDM/org scope); ignored for per-user onboarding (or set UNBOUND_DISCOVERY_KEY)')
+    .addOption(new Option('--discovery-key <key>', 'Deprecated and ignored. The scan uses your API key.').hideHelp())
     .option('--domain <url>', 'Backend URL for discovery (defaults to configured backend)')
     .option('--set-cron', 'Set up a daily background job to keep governance up to date (under sudo, schedules a discovery scan only — not a full tool re-install)')
     .option('--backfill', 'Seed historical Claude Code / Codex / Copilot sessions from local transcripts into Unbound analytics (Cursor skipped automatically)')
@@ -36,26 +36,22 @@ function register(program) {
     .addOption(new Option('--gateway-url <url>', 'Override gateway URL for setup scripts (dev only)').hideHelp())
     .addHelpText('after', `
 Runs the full onboarding flow, auto-detecting scope from your privileges:
-  With sudo, installs the MDM tool bundle (${MDM_ALL_TOOLS.join(', ')}) and
-  scans all users on the device using --discovery-key. Without sudo, installs
-  the user bundle (${ALL_TOOLS.join(', ')}) and scans the current user using
-  your own API key.
+  With sudo, installs the MDM tool bundle (${MDM_ALL_TOOLS.join(', ')}) and scans
+  every user on the device. Without sudo, installs the user bundle
+  (${ALL_TOOLS.join(', ')}) and scans just the current user.
 
   1. Logs in / resolves the API key (or reuses a stored \`unbound login\` key
      when --api-key is omitted).
   2. Installs the tool bundle for the detected scope.
-  3. Runs device discovery. Per-user scope scans with your API key so the
-     device is attributed to you from the first report; sudo/MDM scope scans
-     all users with --discovery-key. With --set-cron, sets up a recurring daily
-     scheduled scan (cross-platform) instead of a one-time scan.
+  3. Runs device discovery. The device is attributed to the right user
+     automatically — no separate discovery key needed. With --set-cron, sets up
+     a recurring daily scan instead of a one-time scan.
 
-Per-user onboarding needs only your API key. The separate --discovery-key is
-required only under sudo (MDM/org enrollment), where the scan covers every user
-on the device and cannot be attributed from a single user's key.
+Only your API key is required — for both per-user and sudo/MDM onboarding.
 
 Examples:
   $ unbound onboard --api-key <USER_KEY>
-  $ sudo unbound onboard --api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY>
+  $ sudo unbound onboard --api-key <ADMIN_KEY>
   $ unbound onboard --api-key <USER_KEY> --backfill
   $ unbound onboard --api-key <USER_KEY> --set-cron
 `)
@@ -67,35 +63,26 @@ Examples:
       telemetry.rememberSecret(apiKeyOpt);
       telemetry.rememberSecret(discoveryKeyOpt);
       const isMdm = hasRootPrivileges();
+      output.info(scopeNotice(isMdm));
 
-      // MDM/org scope (sudo) scans every user on the device, so it still needs a
-      // dedicated org discovery key. Per-user scope scans only the current user
-      // and attributes the device via that user's own API key (see Step 2), so a
-      // separate discovery key is neither needed nor used.
-      if (isMdm && !discoveryKeyOpt) {
-        output.error('--discovery-key is required under sudo (MDM/org enrollment), or set UNBOUND_DISCOVERY_KEY env var');
-        process.exitCode = 1;
-        return;
-      }
-      // User scope needs a key or an existing login; MDM scope resolves the
-      // admin key below (it may come from a stored `unbound login` credential).
+      // --api-key (or a stored `unbound login` key) is all that's required, for
+      // both scopes. MDM scope resolves the admin key below (it may come from a
+      // stored login credential).
       if (!isMdm && !apiKeyOpt && !config.isLoggedIn()) {
         output.error('--api-key is required (or set UNBOUND_API_KEY env var, or run `unbound login` first)');
         process.exitCode = 1;
         return;
       }
-      // Back-compat: --discovery-key used to be required for per-user onboarding.
-      // It is now ignored in user scope — the personal API key is used for the
-      // scan so the device is attributed to the user from the first report
-      // (WEB-4891). Warn rather than fail so existing scripts keep working.
-      if (!isMdm && discoveryKeyOpt) {
-        output.warn('--discovery-key is deprecated for per-user onboarding and is ignored; your API key is used for the device scan, so the device is attributed to you. You can drop --discovery-key (and unset UNBOUND_DISCOVERY_KEY if it is set in your environment).');
+      // --discovery-key is accepted but ignored, so existing scripts don't break.
+      if (discoveryKeyOpt) {
+        output.warn('--discovery-key is deprecated and ignored — the scan uses your API key.');
       }
 
       let setupSucceeded = false;
       let discoverySucceeded = false;
       let discoveryDomain;
       let skippedTools;
+      let mdmScanKey;  // device-owner key resolved from the serial (MDM scope only)
       try {
         // Persist URLs first, then login, then setup — order matters so the
         // login validates against the new backend and setup wires tools at the
@@ -112,7 +99,9 @@ Examples:
         const backendUrl = written.base_url || config.getBaseUrl();
         const frontendUrl = written.frontend_url || config.getFrontendUrl();
         const gatewayUrl = written.gateway_url || config.getGatewayUrl();
-        discoveryDomain = opts.domain || backendUrl;
+        // Normalize --domain (it may be scheme-less) so it's a valid absolute
+        // base URL for both the owner-key lookup and the scan.
+        discoveryDomain = opts.domain ? config.normalizeUrl(opts.domain) : backendUrl;
 
         if (isMdm) {
           // Reuse the key stored by `unbound login` when no key was passed.
@@ -123,6 +112,12 @@ Examples:
             return;
           }
 
+          // Resolve the owner key before the setup bundle, so a failure aborts
+          // before anything is installed. Fetch it from discoveryDomain, the same
+          // endpoint the scan reports to, so the key matches the tenant.
+          mdmScanKey = await fetchDeviceOwnerKey(adminApiKey, { baseUrl: discoveryDomain });
+          telemetry.rememberSecret(mdmScanKey);
+
           console.log('');
           output.info('Step 1/2: Installing MDM tool bundle (all users)');
           const { ok, skipped } = await runMdmSetupAllBundle(adminApiKey, {
@@ -137,7 +132,7 @@ Examples:
           console.log('');
           output.info('Step 2/2: Running device discovery');
           console.log('');
-          await runDiscoveryScan({ apiKey: discoveryKeyOpt, domain: discoveryDomain });
+          await runDiscoveryScan({ apiKey: mdmScanKey, domain: discoveryDomain });
           discoverySucceeded = true;
           skippedTools = skipped;
         } else {
@@ -177,11 +172,12 @@ Examples:
           if (isMdm) {
             // Under sudo, the recurring job refreshes the device/tool inventory
             // only — it does NOT re-push the full MDM tool bundle daily, and it
-            // stores the lower-privilege discovery key, not the admin key.
+            // stores the device-owner key (resolved from the serial), not the
+            // admin key.
             output.info('Setting up daily scheduled discovery scan');
             await setupScheduledRun({
               command: 'discover',
-              apiKey: discoveryKeyOpt,
+              apiKey: mdmScanKey,
               domain: discoveryDomain,
               skipRunAtLoad: true,
             });
@@ -208,7 +204,6 @@ Examples:
         telemetry.captureError(err, { tags: { flow: 'onboard' } });
         if (!err.displayed) output.error(err.message);
         const suffix = domainHintSuffix(discoveryDomain);
-        const sudo = isMdm ? 'sudo ' : '';
         if (discoverySucceeded && opts.setCron) {
           // Both setup and discovery completed; only the optional --set-cron
           // step failed. Retry just the cron: under sudo the scheduled job is a
@@ -216,14 +211,14 @@ Examples:
           // scope it re-runs the full onboard (the bundle reinstall is intended).
           console.error('  Setup and discovery completed successfully — only scheduled-run setup failed.');
           if (isMdm) {
-            console.error(`  Re-run just the scheduled scan with: sudo unbound discover --api-key <DISCOVERY_KEY> --set-cron${suffix}`);
+            console.error(`  Re-run with: ${elevated(`unbound onboard --api-key <ADMIN_KEY> --set-cron${suffix}`)}`);
           } else {
             console.error(`  Re-run cron setup with: unbound onboard --api-key <KEY> --set-cron${suffix}`);
           }
         } else if (setupSucceeded && !discoverySucceeded) {
           console.error('  Tool setup completed successfully — only discovery failed.');
           if (isMdm) {
-            console.error(`  Re-run discovery only with: sudo unbound discover --api-key <DISCOVERY_KEY>${suffix}`);
+            console.error(`  Re-run onboarding with: ${elevated(`unbound onboard --api-key <ADMIN_KEY>${suffix}`)}`);
           } else {
             console.error(`  Re-run discovery only with: unbound discover --api-key <KEY>${suffix}`);
           }

package/src/commands/setup.js

@@ -9,6 +9,7 @@ const telemetry = require('../telemetry');
 const { ensureLoggedIn } = require('../auth');
 const { confirm, downloadToFile, withSecureTempFile } = require('../utils');
 const { reportSetupFailure, exitCodeForError } = require('../setup-report');
+const claudePaths = require('../claudePaths');
 
 const SETUP_BASE_URL = 'https://raw.githubusercontent.com/websentry-ai/setup/refs/heads/main';
 
@@ -85,12 +86,19 @@ function resolveSetupAllTools(clear) {
   return clear ? Object.keys(SETUP_TOOL_MAP) : [...SETUP_ALL_TOOLS];
 }
 
+// OpenAI-compatible Base URL: the gateway host with the /v1 path these clients
+// POST to. Strips a trailing slash because getGatewayUrl() returns env/config
+// values unnormalized, which would otherwise double the slash.
+function openAiBaseUrl(gatewayUrl) {
+  return `${String(gatewayUrl).replace(/\/+$/, '')}/v1`;
+}
+
 // Instruction-only tools (display config values, no setup scripts)
 const INSTRUCTION_TOOLS = {
   'roo-code':      { label: 'Roo Code',     values: (apiKey) => [['API Provider', 'unbound'], ['API Key', apiKey]] },
-  'cline':         { label: 'Cline',         values: (apiKey, frontendUrl) => [['API Provider', 'OpenAI Compatible'], ['Base URL', frontendUrl], ['API Key', apiKey]] },
+  'cline':         { label: 'Cline',         values: (apiKey, gatewayUrl) => [['API Provider', 'OpenAI Compatible'], ['Base URL', openAiBaseUrl(gatewayUrl)], ['API Key', apiKey]] },
   'kilo-code':     { label: 'Kilo Code',     values: (apiKey) => [['API Provider', 'Unbound'], ['API Key', apiKey]] },
-  'custom-access': { label: 'Custom Access', values: (apiKey, frontendUrl) => [['API Key', apiKey], ['Base URL', frontendUrl]] },
+  'custom-access': { label: 'Custom Access', values: (apiKey, gatewayUrl) => [['API Key', apiKey], ['Base URL', openAiBaseUrl(gatewayUrl)]] },
 };
 
 // Tools that need interactive mode selection (claude-code, codex without suffix)
@@ -245,18 +253,45 @@ async function runPythonScript(scriptPath, args, { capture }) {
  * their browser-auth host) and to MDM scripts as --frontend-url (persist-only,
  * no auth flow). Either way it lands in ~/.unbound/config.json as frontend_url.
  */
-function buildScriptArgs(apiKey, { backendUrl, frontendUrl, gatewayUrl, clear, mdm, backfill } = {}) {
+function buildScriptArgs(apiKey, { backendUrl, frontendUrl, gatewayUrl, clear, mdm, backfill, configDir } = {}) {
   // --clear runs no auth in the Python scripts, so the key may be absent. Omit
   // the flag entirely rather than passing --api-key 'undefined'.
   let args = apiKey ? `--api-key ${shellEscape(apiKey)}` : '';
   if (backendUrl) args += ` --backend-url ${shellEscape(backendUrl)}`;
   if (gatewayUrl) args += ` --gateway-url ${shellEscape(gatewayUrl)}`;
   if (frontendUrl) args += mdm ? ` --frontend-url ${shellEscape(frontendUrl)}` : ` --domain ${shellEscape(frontendUrl)}`;
+  if (configDir) args += ` --config-dir ${shellEscape(configDir)}`;
   if (clear) args += ' --clear';
   if (backfill) args += ' --backfill';
   return args.trim();
 }
 
+// User-level Claude install scripts that honor CLAUDE_CONFIG_DIR. MDM variants are
+// excluded — they install per managed-user home, not the admin's env.
+const CLAUDE_CONFIG_DIR_SCRIPTS = new Set([
+  'claude-code/hooks/setup.py',
+  'claude-code/gateway/setup.py',
+]);
+
+function configDirForScript(scriptPath) {
+  if (!CLAUDE_CONFIG_DIR_SCRIPTS.has(scriptPath)) return undefined;
+  return claudePaths.isNonDefaultConfigDir() ? claudePaths.resolveClaudeConfigDir() : undefined;
+}
+
+function warnIfHooksMisplaced(scriptPath) {
+  if (!CLAUDE_CONFIG_DIR_SCRIPTS.has(scriptPath)) return;
+  if (claudePaths.isBlankConfigDir()) {
+    output.warn(claudePaths.BLANK_CONFIG_DIR_MESSAGE);
+    return;
+  }
+  const mismatch = claudePaths.detectConfigDirMismatch();
+  if (!mismatch) return;
+  output.warn(
+    `Claude install landed in ${mismatch.staleDir} but CLAUDE_CONFIG_DIR points at ${mismatch.activeDir}; ` +
+    'Claude will not read it. Re-run setup with CLAUDE_CONFIG_DIR set.'
+  );
+}
+
 // Backfill only applies to the hooks variants of Claude Code / Codex / Copilot;
 // gateway mode and Cursor have no local transcripts to seed.
 function scriptSupportsBackfill(scriptPath) {
@@ -289,9 +324,11 @@ function noteBackfillUnsupported(label, scriptPath) {
  * script signals an MDM skip; throws on download or script failure.
  */
 async function runSetupScript(scriptPath, apiKey, { clear = false, backendUrl, frontendUrl, gatewayUrl, backfill = false } = {}) {
-  const args = buildScriptArgs(apiKey, { backendUrl, frontendUrl, gatewayUrl, clear, backfill });
+  const args = buildScriptArgs(apiKey, { backendUrl, frontendUrl, gatewayUrl, clear, backfill, configDir: configDirForScript(scriptPath) });
   console.log('');
-  return runPythonScript(scriptPath, args, { capture: false });
+  const r = await runPythonScript(scriptPath, args, { capture: false });
+  if (!clear && !(r && r.mdmSkipped)) warnIfHooksMisplaced(scriptPath);
+  return r;
 }
 
 /**
@@ -302,7 +339,11 @@ async function runSetupScript(scriptPath, apiKey, { clear = false, backendUrl, f
  * download exited 0 because dash has no pipefail — is closed.
  */
 function runScriptPiped(scriptPath, args) {
-  return runPythonScript(scriptPath, args, { capture: true });
+  const isClear = /(^|\s)--clear(\s|$)/.test(args);
+  return runPythonScript(scriptPath, args, { capture: true }).then((r) => {
+    if (!isClear && !(r && r.mdmSkipped)) warnIfHooksMisplaced(scriptPath);
+    return r;
+  });
 }
 
 /**
@@ -494,6 +535,20 @@ function runBinaryClear({
   }
 }
 
+// Windows has no `sudo`: elevation is a property of the terminal, not a command
+// prefix. Advise the platform's real mechanism instead of one that fails to run.
+function elevated(cmd) {
+  return process.platform === 'win32' ? `${cmd} in an Administrator terminal` : `sudo ${cmd}`;
+}
+
+// Elevation alone selects org-wide scope. On Windows a terminal is routinely elevated
+// for unrelated reasons, so the scope has to be stated rather than inferred silently.
+function scopeNotice(isMdm) {
+  return isMdm
+    ? 'Scope: organization-wide, every user on this device (this terminal is elevated).'
+    : 'Scope: your account only.';
+}
+
 /**
  * Returns true when the process has the privileges needed to touch system-level
  * (MDM) configuration. On Windows, `net session` succeeds only when elevated, so
@@ -650,7 +705,7 @@ async function clearToolsBestEffort(layer, tools, { mdm, backendUrl, gatewayUrl,
     try {
       // frontendUrl is forwarded for parity with `setup --clear`; buildScriptArgs
       // only appends --domain for non-MDM tools, so MDM clears stay unaffected.
-      const args = buildScriptArgs(null, { backendUrl, gatewayUrl, frontendUrl, clear: true, mdm });
+      const args = buildScriptArgs(null, { backendUrl, gatewayUrl, frontendUrl, clear: true, mdm, configDir: configDirForScript(tool.script) });
       await runScriptPiped(tool.script, args);
       s.succeed(`${layer}: ${tool.label}`);
     } catch (err) {
@@ -778,6 +833,7 @@ must update the MDM configuration.
         // every user on the device (MDM scope); without it, just the current
         // user. URLs were already persisted above and apply to both scopes.
         const isMdm = hasRootPrivileges();
+        output.info(scopeNotice(isMdm));
         if (isMdm) {
           const mdmToolNames = [...Object.keys(MDM_TOOLS), 'claude-code', 'codex'].join(', ');
           const adminApiKey = opts.adminApiKey || opts.apiKey || config.getApiKey();
@@ -854,6 +910,7 @@ must update the MDM configuration.
                 clear: opts.clear,
                 mdm: true,
                 backfill: opts.backfill && scriptSupportsBackfill(tool.script),
+                configDir: configDirForScript(tool.script),
               });
               return runScriptPiped(tool.script, toolArgs);
             },
@@ -910,6 +967,7 @@ must update the MDM configuration.
               ...urlOpts,
               clear: opts.clear,
               backfill: opts.backfill && scriptSupportsBackfill(tool.script),
+              configDir: configDirForScript(tool.script),
             });
             return runScriptPiped(tool.script, toolArgs);
           }, { clear: opts.clear, summary: opts.clear ? 'All tools cleared' : 'All tools configured', report: { apiKey, backendUrl } });
@@ -1003,7 +1061,7 @@ must update the MDM configuration.
               if (r && r.mdmSkipped) reportMdmSkips([label]);
             }
           } else if (INSTRUCTION_TOOLS[toolName]) {
-            output.keyValue(INSTRUCTION_TOOLS[toolName].values(apiKey, frontendUrl));
+            output.keyValue(INSTRUCTION_TOOLS[toolName].values(apiKey, gatewayUrl));
           }
           return;
         }
@@ -1048,6 +1106,7 @@ must update the MDM configuration.
               ...urlOpts,
               clear: opts.clear,
               backfill: opts.backfill && scriptSupportsBackfill(tool.script),
+              configDir: configDirForScript(tool.script),
             });
             return runScriptPiped(tool.script, toolArgs);
           }, { clear: opts.clear, summary: opts.clear ? 'All tools cleared' : 'All tools configured', report: { apiKey, backendUrl } });
@@ -1058,7 +1117,7 @@ must update the MDM configuration.
         for (const toolName of instructionResults) {
           console.log('');
           output.info(`${INSTRUCTION_TOOLS[toolName].label}:`);
-          output.keyValue(INSTRUCTION_TOOLS[toolName].values(apiKey, frontendUrl));
+          output.keyValue(INSTRUCTION_TOOLS[toolName].values(apiKey, gatewayUrl));
         }
 
       } catch (err) {
@@ -1207,6 +1266,7 @@ async function runSetupAllBundle(apiKey, { backendUrl, frontendUrl, gatewayUrl,
     const args = buildScriptArgs(apiKey, {
       backendUrl, frontendUrl, gatewayUrl,
       backfill: backfill && scriptSupportsBackfill(tool.script),
+      configDir: configDirForScript(tool.script),
     });
     return runScriptPiped(tool.script, args);
   }, { report: { apiKey, backendUrl } });
@@ -1228,6 +1288,7 @@ async function runMdmSetupAllBundle(adminApiKey, { backendUrl, frontendUrl, gate
     const args = buildScriptArgs(adminApiKey, {
       backendUrl, frontendUrl, gatewayUrl, mdm: true,
       backfill: backfill && scriptSupportsBackfill(tool.script),
+      configDir: configDirForScript(tool.script),
     });
     return runScriptPiped(tool.script, args);
   }, { report: { apiKey: adminApiKey, backendUrl } });
@@ -1235,12 +1296,16 @@ async function runMdmSetupAllBundle(adminApiKey, { backendUrl, frontendUrl, gate
 
 module.exports = {
   register,
+  elevated,
+  INSTRUCTION_TOOLS,
+  scopeNotice,
   runSetupAllBundle,
   runMdmSetupAllBundle,
   hasRootPrivileges,
   ALL_TOOLS,
   MDM_ALL_TOOLS,
   buildScriptArgs,
+  configDirForScript,
   scriptSupportsBackfill,
   resolveSetupAllTools,
   clearUnboundEnvsEverywhere,

package/src/commands/status.js

@@ -3,10 +3,12 @@ const api = require('../api');
 const output = require('../output');
 const { getDeviceSerial } = require('../device-serial');
 const { detectTools, validateToolKeys, countValidationSkipped } = require('../toolHealth');
+const claudePaths = require('../claudePaths');
 
 function roleFromPrivileges(p) {
   if (!p) return null;
   if (p.is_admin) return 'Admin';
+  if (p.is_analytics_viewer) return 'Analytics Viewer';
   if (p.is_manager) return 'Manager';
   if (p.is_member) return 'Member';
   return 'Unknown';
@@ -23,7 +25,7 @@ Output fields:
   Logged in        - Whether credentials are stored (Yes/No)
   Email            - The authenticated user's email (if logged in)
   Organization     - The organization name (if logged in)
-  Role             - Admin / Manager / Member (if logged in)
+  Role             - Admin / Analytics Viewer / Manager / Member (if logged in)
   Backend URL      - REST API host (configurable for tenant deployments)
   Frontend URL     - Browser login host
   Gateway URL      - AI gateway host (used by tool setup)
@@ -87,6 +89,8 @@ Examples:
         keySpin.stop();
         const connected = detected.filter((t) => t.status !== 'not-installed');
         const skippedCount = countValidationSkipped(connected);
+        const configMismatch = claudePaths.detectConfigDirMismatch();
+        const blankConfigDir = claudePaths.isBlankConfigDir();
 
         if (opts.json) {
           const cfg = loggedIn ? config.readConfig() : {};
@@ -102,6 +106,8 @@ Examples:
             api_status: connectivity,
             connected_tools: connected.map((t) => ({ tool: t.key, label: t.label, mode: t.mode, status: t.status })),
             key_validations_skipped: skippedCount,
+            claude_config_dir_mismatch: configMismatch,
+            claude_config_dir_blank: blankConfigDir,
           });
           return;
         }
@@ -128,6 +134,12 @@ Examples:
         if (skippedCount > 0) {
           console.log(`  ${C.dim(`Note: ${skippedCount} API key validation${skippedCount === 1 ? '' : 's'} skipped (gateway unreachable).`)}`);
         }
+        if (blankConfigDir) {
+          console.log(`  ${C.yellow('\u26a0')} CLAUDE_CONFIG_DIR is set but empty — Claude Code will not load hooks from ~/.claude. Unset it, or set a real path.`);
+        }
+        if (configMismatch) {
+          console.log(`  ${C.yellow('⚠')} Claude Code hooks are in ${configMismatch.staleDir}, but CLAUDE_CONFIG_DIR points at ${configMismatch.activeDir} — run ${C.bold('unbound doctor')}.`);
+        }
         console.log('');
       } catch (err) {
         output.error(err.message);

package/src/device-serial.js

@@ -156,4 +156,20 @@ async function getDeviceSerial() {
   }
 }
 
-module.exports = { getDeviceSerial, isValidSerial };
+/**
+ * Live hardware serial, bypassing the user-writable cache. Use it for
+ * security-sensitive decisions like minting the device-owner key, where a
+ * planted cache value must not be trusted. Never throws; returns null when the
+ * serial can't be determined.
+ */
+async function probeDeviceSerialLive() {
+  try {
+    const serial = await probeSerial();
+    return isValidSerial(serial) ? serial.trim() : null;
+  } catch (err) {
+    debug(`probeDeviceSerialLive failed: ${err && err.message}`);
+    return null;
+  }
+}
+
+module.exports = { getDeviceSerial, probeDeviceSerialLive, isValidSerial };

package/src/index.js

@@ -56,7 +56,7 @@ AUTHENTICATION
 
 ONBOARDING (one-step install + discover; scope auto-detected from sudo)
   $ unbound onboard --api-key <USER_KEY>                                         Current user
-  $ sudo unbound onboard --api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY>   All users (MDM)
+  $ sudo unbound onboard --api-key <ADMIN_KEY>   All users (MDM)
 
 TOOL SETUP
   $ unbound setup                          Select and install multiple tools interactively
@@ -155,7 +155,7 @@ TOOL CONNECTIONS
   $ unbound tools connect <type>           Connect a new tool
   $ unbound tools approved                 List approved tool types
 
-ANALYTICS (Admin/Manager; CSV export is Admin-only)
+ANALYTICS (Admin/Analytics Viewer only, for listing as well as CSV export)
   $ unbound analytics tool-use terminal     Terminal commands agents ran
   $ unbound analytics tool-use mcp-servers  MCP servers seen (find --server values here)
   $ unbound analytics tool-use mcp-actions --server Notion
@@ -167,7 +167,7 @@ ANALYTICS (Admin/Manager; CSV export is Admin-only)
   csv exports every matching row, not just the page.
   See "unbound analytics tool-use --help" for the JSON contract used by agents.
 
-CHAT (Admin/Manager)
+CHAT (Admin/Analytics Viewer/Manager)
   $ unbound chat                           Interactive REPL (multi-turn, in-memory history)
   $ unbound chat -m "show cost by provider for the last 30 days"
                                            One-shot: render a chart in the terminal

package/src/lib/downloads.js

@@ -306,8 +306,8 @@ function describeError(err, what = 'export', { byJobId = false, listing = false
     }
     if (err.statusCode === 403) {
       return listing
-        ? 'Admin role required. Analytics > Tool Use is restricted to organization admins.'
-        : 'Admin role required. Exporting data is restricted to organization admins.';
+        ? 'Analytics > Tool Use is not available to your role.'
+        : 'Exporting data is not available to your role.';
     }
     if (err.statusCode === 422) {
       const rows = Number(err.body?.row_count);

package/src/lib/policy-ai-assist.js

@@ -261,7 +261,8 @@ async function runTerminalPromptCreate(opts) {
   }
   if (!privileges || !privileges.is_admin) {
     let role = 'unknown';
-    if (privileges && privileges.is_manager) role = 'Manager';
+    if (privileges && privileges.is_analytics_viewer) role = 'Analytics Viewer';
+    else if (privileges && privileges.is_manager) role = 'Manager';
     else if (privileges && privileges.is_member) role = 'Member';
     const e = new Error(`Tool policy creation requires admin role; current role: ${role}.`);
     e.exitCode = 3;
@@ -425,7 +426,8 @@ async function runMcpPromptCreate(opts) {
   }
   if (!privileges || !privileges.is_admin) {
     let role = 'unknown';
-    if (privileges && privileges.is_manager) role = 'Manager';
+    if (privileges && privileges.is_analytics_viewer) role = 'Analytics Viewer';
+    else if (privileges && privileges.is_manager) role = 'Manager';
     else if (privileges && privileges.is_member) role = 'Member';
     const e = new Error(`Tool policy creation requires admin role; current role: ${role}.`);
     e.exitCode = 3;

package/src/scheduled.js

@@ -16,13 +16,12 @@ const { shellEscape, downloadToFile, DISCOVER_BASE_URL } = require('./utils');
  *
  * @param {object} opts
  * @param {'onboard'|'discover'} opts.command - which subcommand the cron should run
- * @param {string} opts.apiKey                - api key (for onboard) or discovery key (for discover)
- * @param {string} [opts.discoveryKey]        - separate discovery key (onboard only)
+ * @param {string} opts.apiKey                - api key to run the scheduled scan with (the device-owner key for MDM discover)
  * @param {string} [opts.domain]              - backend domain to pass to the scheduled run
  * @param {boolean} [opts.skipRunAtLoad]      - macOS: set RunAtLoad=false (scan already ran)
  */
 async function setupScheduledRun(opts) {
-  const { command, apiKey, discoveryKey, domain, skipRunAtLoad } = opts;
+  const { command, apiKey, domain, skipRunAtLoad } = opts;
   if (!command || !apiKey) {
     throw new Error('setupScheduledRun: command and apiKey are required');
   }
@@ -36,7 +35,6 @@ async function setupScheduledRun(opts) {
     '--command', shellEscape(command),
     '--api-key', shellEscape(apiKey),
   ];
-  if (discoveryKey) args.push('--discovery-key', shellEscape(discoveryKey));
   if (domain) args.push('--domain', shellEscape(domain));
   if (skipRunAtLoad) args.push('--no-run-at-load');
 
@@ -54,7 +52,7 @@ async function setupScheduledRun(opts) {
 }
 
 async function setupScheduledRunWindows(opts) {
-  const { command, apiKey, discoveryKey, domain } = opts;
+  const { command, apiKey, domain } = opts;
   const url = `${DISCOVER_BASE_URL}/setup-scheduled-scan.ps1`;
   const tmp = path.join(os.tmpdir(), `unbound-scheduled-${Date.now()}-${Math.random().toString(36).slice(2)}.ps1`);
   // Single try/finally covers both download and spawn so a mid-stream
@@ -73,7 +71,6 @@ async function setupScheduledRunWindows(opts) {
       '-Command', command,
       '-ApiKey', apiKey,
     ];
-    if (discoveryKey) psArgs.push('-DiscoveryKey', discoveryKey);
     if (domain) psArgs.push('-Domain', domain);
 
     await new Promise((resolve, reject) => {