unbound-cli 1.16.16 → 1.16.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.16.16",
+  "version": "1.16.18",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/setup.js

@@ -535,6 +535,21 @@ function runBinaryClear({
   }
 }
 
+// Best-effort teardown of the scheduled discovery scan and its stored API key,
+// via uninstallScheduledRun. Returns a labelled `failed` list (empty on success)
+// instead of throwing, so nuke folds a partial teardown into its summary rather
+// than aborting the wipe. `uninstall` is injectable for hermetic tests; the
+// require is lazy to avoid a module cycle.
+async function removeScheduledRun({ uninstall = require('../scheduled').uninstallScheduledRun } = {}) {
+  try {
+    await uninstall();
+    return [];
+  } catch (err) {
+    output.warn(`nuke: scheduled-scan teardown failed (${err.message}); continuing.`);
+    return ['scheduled scan'];
+  }
+}
+
 // Windows has no `sudo`: elevation is a property of the terminal, not a command
 // prefix. Advise the platform's real mechanism instead of one that fails to run.
 function elevated(cmd) {
@@ -1134,10 +1149,10 @@ must update the MDM configuration.
     .command('nuke')
     .alias('uninstall')
     .description(
-      'Remove Unbound and start fresh: clears AI-tool configuration and deletes ' +
-      'stored credentials. Scope follows your privileges — run with sudo to also ' +
-      'remove MDM (system-level) config for all users; without root it clears only ' +
-      'the current user.'
+      'Remove Unbound and start fresh: clears AI-tool configuration, tears down the ' +
+      'scheduled discovery scan and its stored API key, and deletes stored ' +
+      'credentials. Scope follows your privileges — run with sudo to also remove MDM ' +
+      '(system-level) config for all users; without root it clears only the current user.'
     )
     .option('-y, --yes', 'Skip the confirmation prompt')
     .addHelpText('after', `
@@ -1152,11 +1167,16 @@ Scope is chosen automatically from your privileges:
 What it clears:
   - USER-level tool config — Cursor, GitHub Copilot, Claude Code (subscription +
     gateway), Gemini CLI, Codex (subscription + gateway).
+  - The scheduled discovery scan and its stored API key — the LaunchAgent / cron /
+    scheduled task, and the key in Keychain / creds file / Credential Manager. Under
+    sudo this is torn down for the invoking user (the scan is a per-user artifact).
   - MDM (system-level) tool config across all users          [only when run as root]
   - Stored credentials and settings (~/.unbound/config.json).
 
 After it finishes, run \`unbound login\` (or \`unbound onboard\`) to set things up
-fresh. Clearing never contacts the Unbound API, so no API key is needed.
+fresh. Clearing never contacts the Unbound API, so no API key is needed. The
+scheduled-scan teardown runs fully offline; the per-tool and MDM clears fetch
+their setup scripts, so those steps still need network.
 
 Examples:
   $ sudo unbound nuke              Remove everything on the device (asks to confirm)
@@ -1175,8 +1195,8 @@ Examples:
 
         if (!opts.yes) {
           output.warn(includeMdm
-            ? 'This removes ALL Unbound tool configuration on this device (user-level and MDM) and deletes your stored credentials.'
-            : 'This removes your user-level Unbound tool configuration and deletes your stored credentials. (MDM/system-level config needs root and will be skipped — re-run with sudo to remove it too.)');
+            ? 'This removes ALL Unbound tool configuration on this device (user-level and MDM), tears down your scheduled discovery scan and its stored API key, and deletes your stored credentials.'
+            : 'This removes your user-level Unbound tool configuration, tears down your scheduled discovery scan and its stored API key, and deletes your stored credentials. (MDM/system-level config needs root and will be skipped — re-run with sudo to remove it too.)');
           const ok = await confirm('Continue?');
           if (!ok) {
             output.info('Cancelled. Nothing was changed.');
@@ -1227,17 +1247,34 @@ Examples:
         const envCleared = clearUnboundEnvsEverywhere();
         if (envCleared.length) output.info(`Removed Unbound env: ${envCleared.join(', ')}.`);
 
+        // Tear down the scheduled scan and its stored key. It's a user-level
+        // artifact, so it clears regardless of MDM scope; best-effort, folded into
+        // the summary below rather than aborting the wipe.
+        const scheduledFailed = await removeScheduledRun();
+        if (scheduledFailed.length === 0) {
+          // A post-condition, true whether or not a scan was installed — no empty
+          // "removed" claim for a machine that never had one.
+          output.success('No scheduled scan or stored key remain.');
+        }
+
         // Wipe credentials + settings last, regardless of tool-clear outcomes.
         config.clearConfig();
         output.success('Stored credentials and settings removed.');
 
         console.log('');
-        const failed = [...userFailed, ...mdmFailed, ...binaryFailed];
+        const failed = [...userFailed, ...mdmFailed, ...binaryFailed, ...scheduledFailed];
         const scope = includeMdm ? 'on this device' : 'for your user';
         if (failed.length === 0) {
           output.success(`Unbound removed ${scope}. The CLI is back to a fresh state — run "unbound login" to start over.`);
         } else {
-          output.warn(`Done ${scope}, but ${failed.length} step(s) reported issues: ${failed.join(', ')}. Credentials were still removed.`);
+          output.warn(`Done ${scope}, but ${failed.length} step(s) reported issues: ${failed.join(', ')}.`);
+          output.info('Your CLI login credentials and settings (~/.unbound/config.json) were removed.');
+          if (failed.includes('scheduled scan')) {
+            // The scheduled scan keeps its own stored key (Keychain / creds file /
+            // Credential Manager). If its teardown reported an issue, don't imply
+            // that key is gone — point at the command that clears it.
+            output.warn('The scheduled scan may still be registered with its own stored API key — re-run `unbound discover unschedule` to remove it.');
+          }
         }
       } catch (err) {
         output.error(err.message);
@@ -1312,6 +1349,7 @@ module.exports = {
   failureReason,
   NUKE_ENV_VARS,
   removeBinaryInstall,
+  removeScheduledRun,
   runBinaryClear,
   BINARY_INSTALL_PATHS,
 };

package/src/scheduled.js

@@ -1,4 +1,4 @@
-const { spawn } = require('child_process');
+const { spawn, execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
@@ -86,49 +86,367 @@ async function setupScheduledRunWindows(opts) {
   }
 }
 
+// Ceiling on any single teardown command. Nuke clears the stored credentials as
+// part of the wipe, so a wedged launchctl / security / systemctl / crontab must
+// never stall it — on timeout we kill the command's whole process group.
+const SCHEDULED_TEARDOWN_TIMEOUT_MS = 120000;
+
+// The scheduled-scan artifacts, matching what coding-discovery-tool's
+// setup-scheduled-scan.{sh,ps1} create. Kept in sync with that script.
+const SCHEDULED_LABEL = 'ai.getunbound.scheduled';
+const CRON_MARKER_TAG = '# ai.getunbound.scheduled';
+// The Keychain accounts store_credentials_macos writes under SCHEDULED_LABEL.
+const KEYCHAIN_ACCOUNTS = ['command', 'api_key', 'discovery_key', 'domain'];
+
+// Run a command, rejecting on error, non-zero exit, or timeout. On timeout the
+// whole process group is killed (`detached` + `kill(-pid)`), so a wedged grandchild
+// (launchctl/security/systemctl/crontab) dies too instead of outliving nuke.
+function runCommand(cmd, args, options, timeoutMs, label) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, { ...options, detached: true });
+    let timedOut = false;
+    const killGroup = (signal) => {
+      try { process.kill(-child.pid, signal); }
+      catch { try { child.kill(signal); } catch { /* already gone */ } }
+    };
+    const timer = setTimeout(() => { timedOut = true; killGroup('SIGKILL'); }, timeoutMs);
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      if (timedOut) reject(new Error(`${label} timed out after ${timeoutMs}ms`));
+      else if (code === 0) resolve();
+      else reject(new Error(`${label} exited ${code}`));
+    });
+    child.on('error', (err) => { clearTimeout(timer); reject(err); });
+  });
+}
+
+// dscl prints the home after "NFSHomeDirectory:". Root lists two absolute paths
+// (/var/root /private/var/root) → take the first; otherwise keep the value whole,
+// since a home can contain spaces (/Users/John Doe).
+function parseDsclHome(raw) {
+  const parts = raw.split(/\s+/);
+  return (parts.length > 1 && parts.every((p) => p.startsWith('/'))) ? parts[0] : raw;
+}
+
+// Look a user's home up by argv (never a shell string built from the name).
+function homeOf(name, platform) {
+  try {
+    if (platform === 'darwin') {
+      const out = execFileSync('dscl', ['.', '-read', `/Users/${name}`, 'NFSHomeDirectory'], { encoding: 'utf8' });
+      const h = parseDsclHome((out.split(':')[1] || '').trim());
+      if (h) return h;
+    } else {
+      const out = execFileSync('getent', ['passwd', name], { encoding: 'utf8' });
+      const h = (out.split(':')[5] || '').trim();
+      if (h) return h;
+    }
+  } catch { /* fall through */ }
+  if (name === 'root') return platform === 'darwin' ? '/var/root' : '/root';
+  return platform === 'darwin' ? `/Users/${name}` : `/home/${name}`;
+}
+
+// The logged-in console user when we are already root with no SUDO_USER (MDM, su,
+// a launchd job). null when there is none — a headless-root context.
+function consoleUser(platform) {
+  try {
+    const u = platform === 'darwin'
+      ? execFileSync('stat', ['-f', '%Su', '/dev/console'], { encoding: 'utf8' }).trim()
+      : execFileSync('logname', [], { encoding: 'utf8' }).trim();
+    if (u && u !== 'root') return u;
+  } catch { /* no console user */ }
+  return null;
+}
+
+// The user whose scheduled scan to tear down. The scan is a per-user artifact, so
+// as root we target the invoking user — SUDO_USER, or the console user when
+// already root without it — not root. A sudo install can also leave copies in
+// root's home, which the caller clears too.
+function resolveScheduledUser(env, platform) {
+  const amRoot = platform !== 'win32' && typeof process.getuid === 'function' && process.getuid() === 0;
+  if (amRoot) {
+    const name = (env.SUDO_USER && env.SUDO_USER !== 'root') ? env.SUDO_USER : consoleUser(platform);
+    if (name) {
+      let uid = '';
+      try { uid = execFileSync('id', ['-u', name], { encoding: 'utf8' }).trim(); } catch { /* best-effort */ }
+      return { username: name, home: homeOf(name, platform), uid, elevated: true };
+    }
+    // Headless root, no target user: clear root's own copies, but flag that we
+    // could not target a real user's scan so nuke warns instead of claiming clean.
+    return { username: 'root', home: homeOf('root', platform), uid: '0', elevated: false, unresolvedUser: true };
+  }
+  const uid = (platform !== 'win32' && typeof process.getuid === 'function') ? String(process.getuid()) : '';
+  return { username: null, home: os.homedir(), uid, elevated: false };
+}
+
+// Run a command in the target user's session when we are elevated. `sudo -u`
+// alone does NOT enter the user's GUI bootstrap or unlock their login keychain,
+// so macOS keychain/launchctl work is wrapped in `launchctl asuser <uid>`; Linux
+// `systemctl --user` needs the user's runtime bus (XDG_RUNTIME_DIR).
+function asUserCmd(user, platform, cmd, args) {
+  if (!user.elevated) return { cmd, args };
+  if (platform === 'darwin') {
+    return { cmd: 'launchctl', args: ['asuser', user.uid, 'sudo', '-u', user.username, cmd, ...args] };
+  }
+  return { cmd: 'sudo', args: ['-u', user.username, 'env', `XDG_RUNTIME_DIR=/run/user/${user.uid}`, cmd, ...args] };
+}
+
+// Ordered macOS/Linux teardown steps. Credentials are always removed and then
+// verified, and when elevated both the invoking user's and root's copies are torn
+// down (a sudo install can leave the key/job in root's home too).
+function unixTeardownSteps(user, platform) {
+  const { home, uid, elevated } = user;
+  const steps = [];
+  if (platform === 'darwin') {
+    // Root can boot a LaunchAgent out of another user's GUI domain directly by
+    // naming gui/<uid>; the invoking user boots out their own. No sudo prefix.
+    if (uid) {
+      steps.push({ label: 'stop LaunchAgent', kind: 'cmd', cmd: 'launchctl', args: ['bootout', `gui/${uid}/${SCHEDULED_LABEL}`], ignoreFail: true });
+    }
+    // A sudo install bootstraps into root's GUI domain (gui/0), so boot that out too.
+    if (elevated) {
+      steps.push({ label: 'stop LaunchAgent (root)', kind: 'cmd', cmd: 'launchctl', args: ['bootout', `gui/0/${SCHEDULED_LABEL}`], ignoreFail: true });
+    }
+    steps.push({ label: 'remove plist', kind: 'file', target: path.join(home, 'Library/LaunchAgents', `${SCHEDULED_LABEL}.plist`) });
+    // Clear the key from the user's login keychain (via asuser when elevated), and
+    // when elevated from root's keychain too — `sudo onboard --set-cron` runs
+    // `security` as root, so an elevated install leaves a copy there.
+    for (const scope of elevated ? ['user', 'root'] : ['user']) {
+      const wrapKC = (args) => (scope === 'user' ? asUserCmd(user, platform, 'security', args) : { cmd: 'security', args });
+      for (const acct of KEYCHAIN_ACCOUNTS) {
+        // Best-effort: `security delete` exits 44 when the item is already absent
+        // (success). Honest reporting comes from the verify below, not this code.
+        const d = wrapKC(['delete-generic-password', '-s', SCHEDULED_LABEL, '-a', acct]);
+        steps.push({ label: `remove keychain ${acct} (${scope})`, kind: 'cmd', ...d, ignoreFail: true });
+      }
+      const f = wrapKC(['find-generic-password', '-s', SCHEDULED_LABEL, '-a', 'api_key']);
+      steps.push({ label: `verify api key removed (${scope})`, kind: 'verify', probeKind: 'securityFind', ...f, credential: true });
+    }
+    steps.push({ label: 'remove install dir', kind: 'file', target: path.join(home, '.local/share/unbound'), recursive: true });
+    if (elevated) {
+      // A sudo install can write the plist and install dir under root's home too.
+      const rootHome = homeOf('root', platform);
+      steps.push({ label: 'remove plist (root)', kind: 'file', target: path.join(rootHome, 'Library/LaunchAgents', `${SCHEDULED_LABEL}.plist`) });
+      steps.push({ label: 'remove install dir (root)', kind: 'file', target: path.join(rootHome, '.local/share/unbound'), recursive: true });
+    }
+  } else {
+    // A sudo install runs as root with HOME=/root, so its job + key land there —
+    // tear down the invoking user's copies and, when elevated, root's as well.
+    steps.push(...linuxScopeSteps(user, platform, 'user'));
+    if (elevated) {
+      steps.push(...linuxScopeSteps({ home: homeOf('root', platform), uid: '0', username: 'root', elevated: false }, platform, 'root'));
+    }
+  }
+  return steps;
+}
+
+// The per-scope Linux teardown under one home: systemd --user timer, cron entry,
+// creds file (verified gone), and install dir.
+function linuxScopeSteps(scopeUser, platform, scope) {
+  const { home } = scopeUser;
+  const credsFile = path.join(home, '.unbound/scheduled-creds.json');
+  return [
+    { label: `disable systemd timer (${scope})`, kind: 'cmd', ...asUserCmd(scopeUser, platform, 'systemctl', ['--user', 'disable', '--now', 'unbound-scheduled.timer']), ignoreFail: true },
+    { label: `remove systemd timer (${scope})`, kind: 'file', target: path.join(home, '.config/systemd/user/unbound-scheduled.timer') },
+    { label: `remove systemd service (${scope})`, kind: 'file', target: path.join(home, '.config/systemd/user/unbound-scheduled.service') },
+    { label: `reload systemd (${scope})`, kind: 'cmd', ...asUserCmd(scopeUser, platform, 'systemctl', ['--user', 'daemon-reload']), ignoreFail: true },
+    { label: `remove cron entry (${scope})`, kind: 'cron', user: scopeUser },
+    { label: `remove credentials file (${scope})`, kind: 'file', target: credsFile, credential: true },
+    { label: `verify credentials file removed (${scope})`, kind: 'verify', probeKind: 'fileExists', target: credsFile, credential: true },
+    { label: `remove install dir (${scope})`, kind: 'file', target: path.join(home, '.local/share/unbound'), recursive: true },
+  ];
+}
+
+function windowsTeardownSteps(env) {
+  const steps = [{
+    label: 'remove scheduled task', kind: 'cmd',
+    cmd: 'schtasks', args: ['/Delete', '/TN', SCHEDULED_LABEL, '/F'], ignoreFail: true,
+  }];
+  // `cmdkey /delete` exits non-zero when the target is already absent (success),
+  // so the deletes are best-effort; the verify below confirms the key is gone.
+  for (const acct of KEYCHAIN_ACCOUNTS) {
+    steps.push({
+      label: `remove credential ${acct}`, kind: 'cmd',
+      cmd: 'cmdkey', args: [`/delete:${SCHEDULED_LABEL}:${acct}`], ignoreFail: true,
+    });
+  }
+  // `cmdkey /list` prints a "Target: ...:api_key" line only while that credential
+  // still exists, so its absence from the output confirms removal.
+  steps.push({
+    label: 'verify api key removed', kind: 'verify', probeKind: 'cmdkeyList',
+    cmd: 'cmdkey', args: ['/list'], match: `${SCHEDULED_LABEL}:api_key`, credential: true,
+  });
+  const local = env.LOCALAPPDATA || (env.USERPROFILE ? path.join(env.USERPROFILE, 'AppData', 'Local') : null);
+  if (local) {
+    steps.push({ label: 'remove install dir', kind: 'file', target: path.join(local, 'Unbound'), recursive: true });
+  }
+  return steps;
+}
+
 /**
- * Cross-platform uninstall: removes the scheduled task/launchd job/cron entry
- * and stored credentials. Delegates to the same OS-specific setup-scheduled-scan
- * script with --uninstall (or -Uninstall on Windows).
+ * Remove the scheduled scan and its stored credentials LOCALLY — no download, so
+ * it works fully offline (an offboarding handover with no network is exactly when
+ * the key must not be left behind). Runs each artifact's teardown directly:
+ * launchd/crontab/systemd/Task-Scheduler for the job, Keychain / creds-file /
+ * Credential-Manager for the key, in the invoking user's context (SUDO_USER-aware
+ * under sudo). Credential removal always runs, whatever the job teardown does.
+ *
+ * Rejects if a credential-bearing step fails (so nuke never reports the key gone
+ * when it isn't); a best-effort job step that fails because the artifact was
+ * already absent is ignored. `run`/`fileRm`/`cron`/`timeoutMs`/`env`/`platform`
+ * are injectable for hermetic tests; callers (nuke, `discover unschedule`,
+ * `onboard unschedule`) invoke it with no args.
  */
-async function uninstallScheduledRun() {
-  if (process.platform === 'win32') {
-    const url = `${DISCOVER_BASE_URL}/setup-scheduled-scan.ps1`;
-    const tmp = path.join(os.tmpdir(), `unbound-scheduled-uninstall-${Date.now()}-${Math.random().toString(36).slice(2)}.ps1`);
+async function uninstallScheduledRun({
+  run = runCommand,
+  fileRm = defaultFileRm,
+  cron = defaultCronRemove,
+  probe = defaultProbe,
+  resolveUser = resolveScheduledUser,
+  timeoutMs = SCHEDULED_TEARDOWN_TIMEOUT_MS,
+  env = process.env,
+  platform = process.platform,
+} = {}) {
+  const user = resolveUser(env, platform);
+  const steps = platform === 'win32' ? windowsTeardownSteps(env) : unixTeardownSteps(user, platform);
+  const failures = [];
+  for (const step of steps) {
     try {
-      try {
-        await downloadToFile(url, tmp);
-      } catch (err) {
-        throw new Error(`${err.message}. Windows uninstall requires setup-scheduled-scan.ps1.`);
+      if (step.kind === 'cmd') {
+        await run(step.cmd, step.args, { stdio: 'ignore' }, timeoutMs, step.label);
+      } else if (step.kind === 'file') {
+        await fileRm(step.target, { recursive: step.recursive });
+      } else if (step.kind === 'cron') {
+        await cron(step.user, timeoutMs, platform);
+      } else if (step.kind === 'verify') {
+        // Only a confirmed 'absent' clears the step; 'present' or 'unknown' (the
+        // check could not run) must not be read as removed.
+        const status = await probe(step, timeoutMs);
+        if (status !== 'absent') {
+          throw new Error(status === 'present' ? 'still present after removal' : 'could not verify removal');
+        }
       }
-      await new Promise((resolve, reject) => {
-        const child = spawn(
-          'powershell',
-          ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', tmp, '-Uninstall'],
-          { stdio: 'inherit', shell: false, windowsHide: true }
-        );
-        child.on('close', (code) => {
-          if (code === 0) resolve();
-          else reject(new Error(`Scheduled-run uninstall failed with exit code ${code}`));
-        });
-        child.on('error', reject);
-      });
-    } finally {
-      try { fs.unlinkSync(tmp); } catch { /* best-effort */ }
+    } catch (err) {
+      // A best-effort job step usually failed because the artifact was already
+      // gone; a credential step failing means the key may still be on disk.
+      if (step.credential || !step.ignoreFail) failures.push(`${step.label}: ${err.message}`);
     }
-    return;
   }
+  if (user.unresolvedUser) {
+    failures.push('could not determine the invoking user — run as that user or with sudo so their scan is torn down');
+  }
+  if (failures.length) {
+    throw new Error(`scheduled-scan teardown incomplete — ${failures.join('; ')}`);
+  }
+}
 
-  const url = `${DISCOVER_BASE_URL}/setup-scheduled-scan.sh`;
-  const cmd = `curl -fsSL "${url}" | bash -s -- --uninstall`;
-  await new Promise((resolve, reject) => {
-    const child = spawn(cmd, { shell: true, stdio: 'inherit' });
-    child.on('close', (code) => {
-      if (code === 0) resolve();
-      else reject(new Error(`Scheduled-run uninstall failed with exit code ${code}`));
-    });
-    child.on('error', reject);
+// A verify probe → 'present' | 'absent' | 'unknown'. Only 'absent' is success.
+async function defaultProbe(step, timeoutMs) {
+  if (step.probeKind === 'fileExists') {
+    return fs.existsSync(step.target) ? 'present' : 'absent';
+  }
+  if (step.probeKind === 'securityFind') {
+    // exit 0 = item exists; 44 = gone. "No default keychain" (common for root)
+    // also means nothing to find, so treat as absent; a lookup that did not run
+    // (null) or any other status is unknown.
+    const { code, stderr } = await runForCode(step.cmd, step.args, timeoutMs);
+    if (code === null) return 'unknown';
+    if (code === 0) return 'present';
+    if (code === 44) return 'absent';
+    if (/no default keychain|default keychain could not be found/i.test(stderr || '')) return 'absent';
+    return 'unknown';
+  }
+  if (step.probeKind === 'cmdkeyList') {
+    // `cmdkey /list` exits 0 and prints a "Target: ...:api_key" line only while
+    // the credential exists; a non-zero exit means the list did not run, so its
+    // empty output must not be read as "absent".
+    const out = await captureAllowFail(step.cmd, step.args, timeoutMs);
+    if (out === null) return 'unknown';
+    return out.includes(step.match) ? 'present' : 'absent';
+  }
+  return 'unknown';
+}
+
+// Remove a path (file, or a directory when `recursive`), tolerating absence.
+async function defaultFileRm(target, { recursive } = {}) {
+  await fs.promises.rm(target, { force: true, recursive: Boolean(recursive) });
+}
+
+// Rewrite the target user's crontab without the Unbound scheduled-scan lines.
+// Reads the current table, drops the marker-tagged lines, writes it back — a
+// no-op when there is no crontab or no such line.
+async function defaultCronRemove(user, timeoutMs, platform) {
+  const listCmd = asUserCmd(user, platform, 'crontab', ['-l']);
+  let current;
+  try {
+    current = await captureCommand(listCmd.cmd, listCmd.args, timeoutMs);
+  } catch (err) {
+    // "no crontab for <user>" is an empty table — nothing to remove. Any other
+    // failure (sudo/asuser error, timeout) must surface, not read as empty.
+    if (err && /no crontab for/i.test(err.stderr || '')) return;
+    throw err;
+  }
+  const kept = current.split('\n').filter((line) => !line.includes(CRON_MARKER_TAG));
+  if (kept.join('\n') === current) return; // nothing tagged
+  const writeCmd = asUserCmd(user, platform, 'crontab', ['-']);
+  await feedCommand(writeCmd.cmd, writeCmd.args, kept.join('\n').replace(/\n+$/, '') + '\n', timeoutMs);
+}
+
+// Resolve with { code, stderr }; code is null on spawn error / timeout.
+function runForCode(cmd, args, timeoutMs) {
+  return new Promise((resolve) => {
+    let err = '';
+    const child = spawn(cmd, args, { detached: true, stdio: ['ignore', 'ignore', 'pipe'] });
+    const timer = setTimeout(() => { try { process.kill(-child.pid, 'SIGKILL'); } catch { /* gone */ } resolve({ code: null, stderr: err }); }, timeoutMs);
+    child.stderr.on('data', (d) => { err += d; });
+    child.on('close', (code) => { clearTimeout(timer); resolve({ code, stderr: err }); });
+    child.on('error', () => { clearTimeout(timer); resolve({ code: null, stderr: err }); });
+  });
+}
+
+// Capture stdout on a clean (exit 0) run, or null if the command errored,
+// timed out, or exited non-zero — an incomplete listing must not read as absent.
+function captureAllowFail(cmd, args, timeoutMs) {
+  return new Promise((resolve) => {
+    let out = '';
+    const child = spawn(cmd, args, { detached: true });
+    const timer = setTimeout(() => { try { process.kill(-child.pid, 'SIGKILL'); } catch { /* gone */ } resolve(null); }, timeoutMs);
+    child.stdout.on('data', (d) => { out += d; });
+    child.on('close', (code) => { clearTimeout(timer); resolve(code === 0 ? out : null); });
+    child.on('error', () => { clearTimeout(timer); resolve(null); });
+  });
+}
+
+function captureCommand(cmd, args, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, { detached: true });
+    let out = ''; let err = '';
+    const timer = setTimeout(() => { try { process.kill(-child.pid, 'SIGKILL'); } catch { child.kill('SIGKILL'); } reject(new Error('crontab -l timed out')); }, timeoutMs);
+    child.stdout.on('data', (d) => { out += d; });
+    child.stderr.on('data', (d) => { err += d; });
+    child.on('close', (code) => { clearTimeout(timer); code === 0 ? resolve(out) : reject(Object.assign(new Error(`crontab -l exited ${code}`), { stderr: err })); });
+    child.on('error', (e) => { clearTimeout(timer); reject(e); });
+  });
+}
+
+function feedCommand(cmd, args, input, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, { detached: true });
+    const timer = setTimeout(() => { try { process.kill(-child.pid, 'SIGKILL'); } catch { child.kill('SIGKILL'); } }, timeoutMs);
+    child.on('close', (code) => { clearTimeout(timer); code === 0 ? resolve() : reject(new Error(`crontab - exited ${code}`)); });
+    child.on('error', (err) => { clearTimeout(timer); reject(err); });
+    child.stdin.end(input);
   });
 }
 
-module.exports = { setupScheduledRun, uninstallScheduledRun };
+module.exports = {
+  setupScheduledRun,
+  uninstallScheduledRun,
+  resolveScheduledUser,
+  asUserCmd,
+  unixTeardownSteps,
+  windowsTeardownSteps,
+  runCommand,
+  defaultProbe,
+  homeOf,
+  parseDsclHome,
+};

package/src/toolHealth.js

@@ -192,11 +192,17 @@ function envKeyCheck(label, name, kind = 'aux') {
   if (!r.found || !r.value) {
     return { name: label, ok: false, kind, detail: `${name} is not set`, summary: `${base} not set` };
   }
+  // Offer the rc-file keys as fallbacks so a shell opened before setup rewrote
+  // the rc (stale key in process.env) isn't misread as tampered. Only for
+  // Unbound-owned vars: a user-owned var like OPENAI_API_KEY may carry the
+  // user's personal key beside ours, and doctor must never upload that.
+  const rcFallback = name.startsWith('UNBOUND_') ? rcEnvValues(name).map((v) => v.value) : [];
+  const candidates = [...new Set([r.value, ...rcFallback].filter(Boolean))];
   return {
     name: label, ok: true, kind,
     detail: `${name} set (${r.source})`,
     summary: `${base} set`,
-    keyCheck: true, envName: name, value: r.value,
+    keyCheck: true, envName: name, value: r.value, candidates,
   };
 }
 
@@ -482,43 +488,53 @@ function detectTools({ gatewayUrl, _mdmDirs, _binaryPath } = {}) {
 // client can never wipe out the local-state view callers depend on.
 async function validateToolKeys(tools, validateKey) {
   if (!tools?.length) return tools;
-  const unique = new Set();
-  for (const t of tools) {
-    for (const c of t.checks || []) {
-      if (c.keyCheck && c.value) unique.add(c.value);
+  const verdict = new Map();
+  const check = async (keys) => {
+    const pending = [...keys].filter((k) => k && !verdict.has(k));
+    for (const [k, r] of await Promise.all(pending.map(async (k) => {
+      try { return [k, await validateKey(k)]; } catch { return [k, 'unknown']; }
+    }))) verdict.set(k, r);
+  };
+  // Validate the live value first; consult the rc-file fallbacks only when it is
+  // rejected. Avoids needless calls on the healthy path and, with the
+  // UNBOUND_-only candidate rule above, keeps rc siblings off the wire until a
+  // stale shell forces the search.
+  const live = new Set();
+  for (const t of tools) for (const c of t.checks || []) if (c.keyCheck && c.value) live.add(c.value);
+  if (!live.size) return tools;
+  await check(live);
+  const fallbacks = new Set();
+  for (const t of tools) for (const c of t.checks || []) {
+    if (c.keyCheck && c.value && verdict.get(c.value) === 'invalid') {
+      for (const v of c.candidates || []) if (v !== c.value) fallbacks.add(v);
     }
   }
-  if (!unique.size) return tools;
-  const entries = await Promise.all(
-    [...unique].map(async (k) => {
-      try {
-        return [k, await validateKey(k)];
-      } catch {
-        return [k, 'unknown'];
-      }
-    })
-  );
-  const validity = new Map(entries);
+  await check(fallbacks);
   for (const t of tools) {
     if (!t.checks?.length) continue;
     let okFlipped = false;
     for (const c of t.checks) {
-      if (!c.keyCheck) continue;
-      const verdict = validity.get(c.value);
-      if (verdict === 'invalid') {
+      if (!c.keyCheck || !c.value) continue;
+      const liveVerdict = verdict.get(c.value);
+      if (liveVerdict === 'valid') continue;
+      // rc fallbacks were fetched only when the live key was invalid.
+      const others = liveVerdict === 'invalid'
+        ? (c.candidates || []).filter((v) => v !== c.value).map((v) => verdict.get(v))
+        : [];
+      if (others.includes('valid')) continue; // a configured rc key is valid — wiring intact
+      if (liveVerdict !== 'invalid' || others.includes('unknown')) {
+        // Gateway unreachable for the live key, or for the only surviving rc
+        // candidates — fail open so an offline run isn't read as tampered.
+        c.validationSkipped = true;
+        c.detail = `${c.detail}; validation skipped — gateway unreachable`;
+      } else {
+        // Live key rejected and no configured key is valid — genuinely invalid.
         c.ok = false;
         c.warn = true;
         const base = c.name.replace(/ env$/, '');
         c.summary = `${base} invalid`;
         c.detail = `${c.envName} set but not valid for this tenant`;
         okFlipped = true;
-      } else if (verdict === 'unknown') {
-        // Stay healthy (fail-open), but record the skip so the caller can
-        // surface it. Without this tag the operator can't tell an offline
-        // run from a fully-validated one — that's the WEB-4922 lesson.
-        // Does NOT flip `ok`, so the `statusOf` re-derivation stays guarded.
-        c.validationSkipped = true;
-        c.detail = `${c.detail}; validation skipped — gateway unreachable`;
       }
     }
     // ONLY re-derive when a check's `ok` actually flipped. Without this guard,

package/test/setup-args.test.js

@@ -3,7 +3,9 @@ const assert = require('node:assert/strict');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { buildScriptArgs, scriptSupportsBackfill, resolveSetupAllTools, clearUnboundEnvsEverywhere, failureReason, NUKE_ENV_VARS, removeBinaryInstall, runBinaryClear, BINARY_INSTALL_PATHS, configDirForScript } = require('../src/commands/setup');
+const { buildScriptArgs, scriptSupportsBackfill, resolveSetupAllTools, clearUnboundEnvsEverywhere, failureReason, NUKE_ENV_VARS, removeBinaryInstall, removeScheduledRun, runBinaryClear, BINARY_INSTALL_PATHS, configDirForScript } = require('../src/commands/setup');
+const scheduled = require('../src/scheduled');
+const { uninstallScheduledRun } = scheduled;
 
 // shellEscape single-quotes every value, so a real key surfaces as
 // --api-key '<key>' at the head of the argv tail.
@@ -661,3 +663,307 @@ test('configDirForScript: returns undefined when CLAUDE_CONFIG_DIR is unset (def
     if (prev !== undefined) process.env.CLAUDE_CONFIG_DIR = prev;
   }
 });
+
+// `unbound nuke` must also tear down the scheduled discovery scan and its stored
+// API key; before the fix it never called the teardown, so a scan kept running
+// and a long-lived key stayed on the machine after "remove Unbound entirely".
+
+// Behavioral: removeScheduledRun runs the teardown, and the teardown's removal
+// lands — no scheduled agent (job marker) and no stored key file remain. The
+// injected `uninstall` stands in for uninstallScheduledRun's OS/network work so
+// the test is hermetic while still proving the removal reaches disk.
+test('removeScheduledRun: runs teardown — leaves no scheduled agent and no stored key', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-sched-'));
+  try {
+    const agentMarker = path.join(tmp, 'ai.getunbound.scheduled.plist'); // stands in for launchd/cron/Task Scheduler job
+    const credsFile = path.join(tmp, 'scheduled-creds.json');            // stands in for the stored API key
+    fs.writeFileSync(agentMarker, '<plist/>');
+    fs.writeFileSync(credsFile, JSON.stringify({ apiKey: 'sk-live-should-be-wiped' }));
+
+    let called = 0;
+    const failed = await removeScheduledRun({
+      uninstall: async () => {
+        called++;
+        fs.rmSync(agentMarker, { force: true });
+        fs.rmSync(credsFile, { force: true });
+      },
+    });
+
+    assert.equal(called, 1, 'nuke must invoke the scheduled-run teardown exactly once');
+    assert.deepEqual(failed, [], 'a clean teardown reports no failures');
+    assert.ok(!fs.existsSync(agentMarker), 'the scheduled agent must be gone after nuke');
+    assert.ok(!fs.existsSync(credsFile), 'the stored API key must be gone after nuke');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+// Resilience: a partial teardown failure must land in the returned `failed` list
+// (so nuke's summary reports it) and must NOT throw — nuke has to continue and
+// still wipe credentials, exactly like removeBinaryInstall's failure path.
+test('removeScheduledRun: teardown failure surfaces in `failed`, does not throw', async () => {
+  const failed = await removeScheduledRun({
+    uninstall: async () => { throw new Error('launchctl bootout failed'); },
+  });
+  assert.deepEqual(failed, ['scheduled scan'], 'a teardown failure is reported, not swallowed silently');
+});
+
+// Wiring: the nuke action must actually call removeScheduledRun and fold its
+// result into the closing summary, so the teardown can never be silently
+// dropped by a refactor. Source-parsed like the onboard cron wiring tests.
+test('nuke action wires in removeScheduledRun and folds it into the failure summary', () => {
+  const src = fs.readFileSync(path.join(__dirname, '..', 'src', 'commands', 'setup.js'), 'utf8');
+  const actionStart = src.indexOf(".command('nuke')");
+  assert.notEqual(actionStart, -1, "expected a nuke command in setup.js");
+  const actionSrc = src.slice(actionStart, actionStart + 9000);
+  assert.match(actionSrc, /const\s+scheduledFailed\s*=\s*await\s+removeScheduledRun\(\)/, 'nuke must await removeScheduledRun()');
+  assert.match(actionSrc, /\.\.\.scheduledFailed/, 'nuke must fold scheduledFailed into the failed summary');
+});
+
+// The teardown is LOCAL — no download, so it works fully offline (an offboarding
+// handover with no network is exactly when a stored key must not be left behind).
+// These inject the OS-command / file / cron boundary so they stay hermetic while
+// asserting the real step set uninstallScheduledRun runs on each platform.
+
+// Records what the teardown would run without touching the real system.
+// `verifyPresent(step)` decides whether a verify reports the key still there; by
+// default every verify reports 'absent' (the good case).
+function recordTeardown(opts) {
+  const cmds = []; const files = []; const cronCalls = []; const probes = [];
+  const failIf = opts.failIf || (() => false);
+  const p = scheduled.uninstallScheduledRun({
+    platform: opts.platform,
+    env: opts.env || {},
+    run: async (cmd, args) => {
+      const line = [cmd, ...args].join(' ');
+      cmds.push(line);
+      if (failIf(line)) throw new Error(`stub failure: ${line}`);
+    },
+    fileRm: async (target, o) => { files.push({ target, recursive: Boolean(o && o.recursive) }); },
+    cron: async (user) => { cronCalls.push(user); },
+    probe: async (step) => { probes.push(step); return (opts.verifyPresent && opts.verifyPresent(step)) ? 'present' : 'absent'; },
+  });
+  return { cmds, files, cronCalls, probes, promise: p };
+}
+
+test('uninstallScheduledRun (macOS): boots out the LaunchAgent, clears + verifies the keychain, removes the plist and install dir — offline', async () => {
+  const r = recordTeardown({ platform: 'darwin' });
+  await r.promise;
+  const joined = r.cmds.join('\n');
+  assert.match(joined, /^launchctl bootout gui\/\d+\/ai\.getunbound\.scheduled$/m, 'boots out the user LaunchAgent directly (no sudo)');
+  for (const acct of ['command', 'api_key', 'discovery_key', 'domain']) {
+    assert.match(joined, new RegExp(`security delete-generic-password -s ai\\.getunbound\\.scheduled -a ${acct}\\b`), `clears keychain ${acct}`);
+  }
+  assert.ok(r.files.some((f) => f.target.endsWith('Library/LaunchAgents/ai.getunbound.scheduled.plist')), 'removes the plist');
+  assert.ok(r.files.some((f) => f.target.endsWith('.local/share/unbound') && f.recursive), 'removes the install dir');
+  assert.ok(r.probes.some((s) => s.probeKind === 'securityFind' && s.args.includes('api_key')), 'verifies the api key is gone');
+  assert.ok(!/curl|https?:|downloadToFile/.test(joined), 'the teardown must not hit the network');
+});
+
+test('uninstallScheduledRun (Linux): disables + reloads the systemd timer, drops the cron entry, removes + verifies the creds file, removes the install dir', async () => {
+  const r = recordTeardown({ platform: 'linux' });
+  await r.promise;
+  const joined = r.cmds.join('\n');
+  assert.match(joined, /systemctl --user disable --now unbound-scheduled\.timer/);
+  assert.match(joined, /systemctl --user daemon-reload/, 'reloads systemd after removing the units');
+  assert.equal(r.cronCalls.length, 1, 'removes the crontab entry exactly once');
+  assert.ok(r.files.some((f) => f.target.endsWith('.unbound/scheduled-creds.json')), 'removes the stored-key file');
+  assert.ok(r.probes.some((s) => s.probeKind === 'fileExists' && s.target.endsWith('.unbound/scheduled-creds.json')), 'verifies the creds file is gone');
+  assert.ok(r.files.some((f) => f.target.endsWith('.local/share/unbound') && f.recursive));
+  assert.ok(!/curl|https?:/.test(joined), 'offline: no network');
+});
+
+test('uninstallScheduledRun (Windows): deletes the task + every credential, verifies the key via cmdkey /list, removes the install dir', async () => {
+  const r = recordTeardown({ platform: 'win32', env: { LOCALAPPDATA: 'C:\\Users\\Bob\\AppData\\Local' } });
+  await r.promise;
+  const joined = r.cmds.join('\n');
+  assert.match(joined, /schtasks \/Delete \/TN ai\.getunbound\.scheduled \/F/);
+  for (const acct of ['command', 'api_key', 'discovery_key', 'domain']) {
+    assert.match(joined, new RegExp(`cmdkey /delete:ai\\.getunbound\\.scheduled:${acct}\\b`), `clears credential ${acct}`);
+  }
+  assert.ok(r.probes.some((s) => s.probeKind === 'cmdkeyList' && s.match === 'ai.getunbound.scheduled:api_key'), 'verifies via cmdkey /list');
+  assert.ok(r.files.some((f) => /Unbound$/.test(f.target) && f.recursive), 'removes the install dir under LOCALAPPDATA');
+});
+
+// Finding: `sudo unbound nuke` runs as root, but the scan is a per-user artifact.
+// The teardown must target the invoking user (SUDO_USER), not root's empty domain.
+// Uses the current platform so the home lookup (dscl on macOS, getent on Linux)
+// resolves the real user; skipped when already root (SUDO_USER=root isn't elevated).
+test('resolveScheduledUser: under sudo targets the invoking user (SUDO_USER), not root',
+  { skip: (typeof process.getuid === 'function' && process.getuid() === 0) ? 'running as root — SUDO_USER=root is the non-elevated path' : false },
+  () => {
+    const me = os.userInfo().username;
+    const origGetuid = process.getuid;
+    process.getuid = () => 0; // simulate elevated
+    try {
+      const u = scheduled.resolveScheduledUser({ SUDO_USER: me }, process.platform);
+      assert.equal(u.elevated, true, 'runs teardown in the invoking user context');
+      assert.equal(u.username, me);
+      assert.equal(u.home, os.homedir(), 'resolves the invoking user home, not /var/root');
+      assert.equal(u.uid, String(os.userInfo().uid));
+    } finally { process.getuid = origGetuid; }
+  });
+
+test('resolveScheduledUser: without sudo targets the current user, not elevated', () => {
+  const u = scheduled.resolveScheduledUser({}, 'darwin');
+  assert.equal(u.elevated, false);
+  assert.equal(u.home, os.homedir());
+});
+
+// Finding: `sudo -u` alone does not unlock the user's login keychain or enter
+// their GUI domain. Elevated macOS keychain work must run via `launchctl asuser`,
+// the LaunchAgent bootout targets gui/<uid> directly, and root's own keychain is
+// cleared too (an elevated install stores the key there).
+test('unixTeardownSteps: elevated macOS wraps user keychain ops in launchctl asuser, boots out gui/<uid> directly, and clears root too', () => {
+  const user = { home: '/Users/alice', uid: '501', username: 'alice', elevated: true };
+  const steps = scheduled.unixTeardownSteps(user, 'darwin');
+  const bootout = steps.find((s) => s.label === 'stop LaunchAgent');
+  assert.deepEqual([bootout.cmd, ...bootout.args], ['launchctl', 'bootout', 'gui/501/ai.getunbound.scheduled'], 'boots out gui/<uid> directly, no sudo');
+  const userDel = steps.find((s) => s.label === 'remove keychain api_key (user)');
+  assert.deepEqual(userDel.args.slice(0, 5), ['asuser', '501', 'sudo', '-u', 'alice'], 'user keychain op runs via launchctl asuser + sudo -u');
+  assert.equal(userDel.cmd, 'launchctl');
+  const rootDel = steps.find((s) => s.label === 'remove keychain api_key (root)');
+  assert.equal(rootDel.cmd, 'security', 'root keychain op runs as root directly');
+  assert.ok(steps.some((s) => s.kind === 'file' && s.target === '/Users/alice/Library/LaunchAgents/ai.getunbound.scheduled.plist'));
+});
+
+// The stored key is security-critical: if the delete silently fails and the
+// verify still finds the key, the teardown must reject so nuke reports the miss.
+test('uninstallScheduledRun: the key surviving the delete (verify reports present) rejects', async () => {
+  const r = recordTeardown({ platform: 'darwin', verifyPresent: () => true });
+  await assert.rejects(r.promise, /teardown incomplete/i);
+});
+
+// Finding: `security find` failing for a reason OTHER than "not found" (locked
+// keychain, no session) must NOT be read as removed — an 'unknown' probe rejects.
+test('uninstallScheduledRun: an unverifiable key (probe unknown) rejects, not treated as removed', async () => {
+  await assert.rejects(scheduled.uninstallScheduledRun({
+    platform: 'darwin', env: {},
+    run: async () => {}, fileRm: async () => {}, cron: async () => {},
+    probe: async () => 'unknown',
+  }), /could not verify/i);
+});
+
+// Finding: root often has no default keychain, and that error is not exit 44 —
+// treat it as absent, but keep real "could not look" statuses as unknown.
+test('defaultProbe securityFind: exit 0 present, 44 absent, no-keychain absent, else unknown', { skip: process.platform === 'win32' }, async () => {
+  const P = scheduled.defaultProbe;
+  const mk = (sh) => ({ probeKind: 'securityFind', cmd: 'sh', args: ['-c', sh] });
+  assert.equal(await P(mk('exit 0'), 5000), 'present');
+  assert.equal(await P(mk('exit 44'), 5000), 'absent');
+  assert.equal(await P(mk('echo "A default keychain could not be found" >&2; exit 51'), 5000), 'absent');
+  // A searched-but-empty keychain says "item could not be found" — that is not a
+  // missing default keychain, so it must stay unknown, not read as absent.
+  assert.equal(await P(mk('echo "The specified item could not be found in the keychain." >&2; exit 51'), 5000), 'unknown');
+  assert.equal(await P(mk('exit 51'), 5000), 'unknown');
+  assert.equal(await P(mk('sleep 5'), 120), 'unknown'); // timeout → null code → unknown
+});
+
+test('homeOf: resolves the standard home per OS (fallback when the lookup is unavailable)', () => {
+  assert.equal(scheduled.homeOf('root', 'darwin'), '/var/root');
+  assert.equal(scheduled.homeOf('root', 'linux'), '/root');
+  assert.equal(scheduled.homeOf('nobodyxyz', 'linux'), '/home/nobodyxyz');
+  assert.equal(scheduled.homeOf('nobodyxyz', 'darwin'), '/Users/nobodyxyz');
+});
+
+// dscl lists root's home twice but a real home can contain a space.
+test('parseDsclHome: takes the first of two absolute paths, keeps a spaced home intact', () => {
+  assert.equal(scheduled.parseDsclHome('/var/root /private/var/root'), '/var/root');
+  assert.equal(scheduled.parseDsclHome('/Users/John Doe'), '/Users/John Doe');
+  assert.equal(scheduled.parseDsclHome('/Users/alice'), '/Users/alice');
+});
+
+// Finding: a non-zero `cmdkey /list` must not be read as absent off its empty output.
+test('defaultProbe cmdkeyList: non-zero exit is unknown, not absent', { skip: process.platform === 'win32' }, async () => {
+  const P = scheduled.defaultProbe;
+  assert.equal(await P({ probeKind: 'cmdkeyList', cmd: 'sh', args: ['-c', 'exit 1'], match: 'x' }, 5000), 'unknown');
+  assert.equal(await P({ probeKind: 'cmdkeyList', cmd: 'sh', args: ['-c', 'echo hi'], match: 'x' }, 5000), 'absent');
+  assert.equal(await P({ probeKind: 'cmdkeyList', cmd: 'sh', args: ['-c', 'echo x-target'], match: 'x-target' }, 5000), 'present');
+});
+
+// Finding: a sudo install leaves copies in root's home, so an elevated Linux
+// teardown must clear root's crontab / creds / units / install dir too.
+test('unixTeardownSteps: elevated Linux tears down both the invoking user and root', () => {
+  const user = { home: '/home/alice', uid: '1000', username: 'alice', elevated: true };
+  const steps = scheduled.unixTeardownSteps(user, 'linux');
+  assert.ok(steps.some((s) => s.kind === 'file' && s.target === '/home/alice/.unbound/scheduled-creds.json'), 'clears the user creds');
+  assert.ok(steps.some((s) => s.kind === 'file' && s.target === '/root/.unbound/scheduled-creds.json'), 'clears root creds');
+  assert.ok(steps.some((s) => s.kind === 'verify' && s.target === '/root/.unbound/scheduled-creds.json'), 'verifies root creds gone');
+  assert.equal(steps.filter((s) => s.kind === 'cron').length, 2, 'rewrites both crontabs');
+  assert.ok(steps.some((s) => s.kind === 'file' && s.target === '/root/.local/share/unbound'), 'clears root install dir');
+});
+
+// Finding: bare root with no SUDO_USER and no console user (headless / MDM) can't
+// target a user's scan, so it must surface the miss, not report the device clean.
+test('uninstallScheduledRun: an unresolvable invoking user surfaces the miss', async () => {
+  await assert.rejects(scheduled.uninstallScheduledRun({
+    platform: 'linux',
+    resolveUser: () => ({ username: 'root', home: '/root', uid: '0', elevated: false, unresolvedUser: true }),
+    run: async () => {}, fileRm: async () => {}, cron: async () => {}, probe: async () => 'absent',
+  }), /could not determine the invoking user/i);
+});
+
+// A crontab failure that is not an empty table (sudo/asuser error, timeout) must
+// surface — the cron line would otherwise be left behind while the key is gone.
+test('uninstallScheduledRun: a crontab teardown failure surfaces, not swallowed', async () => {
+  await assert.rejects(scheduled.uninstallScheduledRun({
+    platform: 'linux', env: {},
+    run: async () => {}, fileRm: async () => {}, probe: async () => 'absent',
+    cron: async () => { throw new Error('crontab -l exited 1'); },
+  }), /crontab/i);
+});
+
+// A best-effort job step that fails because the artifact was already gone (e.g.
+// the agent isn't loaded) must be tolerated — teardown still succeeds overall.
+test('uninstallScheduledRun: a job step failing because the artifact is absent is tolerated', async () => {
+  const r = recordTeardown({ platform: 'darwin', failIf: (l) => /launchctl bootout/.test(l) });
+  await r.promise; // resolves — no throw
+});
+
+// removeScheduledRun still folds a real teardown failure into nuke's `failed`.
+test('removeScheduledRun: a rejecting local teardown surfaces the scheduled scan in `failed`', async () => {
+  const failed = await removeScheduledRun({
+    uninstall: () => scheduled.uninstallScheduledRun({
+      platform: 'darwin', env: {},
+      run: async () => {}, fileRm: async () => {}, cron: async () => {},
+      probe: async () => 'present', // the key survived a locked-keychain delete
+    }),
+  });
+  assert.deepEqual(failed, ['scheduled scan'], 'a surviving credential must surface, not be swallowed');
+});
+
+// Finding: a wedged launchctl/security is a GRANDCHILD of the spawned process, so
+// the timeout must kill the process GROUP, not just the direct child, or the hang
+// outlives nuke. Proven with a real bash that backgrounds a grandchild sleep.
+test('runCommand: the timeout kills the whole process group, so a grandchild does not survive', { skip: process.platform === 'win32' }, async () => {
+  const pidFile = path.join(os.tmpdir(), `unbound-pg-${Date.now()}-${Math.random().toString(36).slice(2)}.pid`);
+  const script = `sleep 300 & echo $! > "${pidFile}"; wait`;
+  const start = Date.now();
+  await assert.rejects(
+    scheduled.runCommand('bash', ['-c', script], { stdio: 'ignore' }, 300, 'timeout-test'),
+    /timed out/i,
+    'a hung command must reject with a timeout',
+  );
+  assert.ok(Date.now() - start < 5000, 'must reject promptly on timeout');
+  const gpid = Number(fs.readFileSync(pidFile, 'utf8').trim());
+  fs.rmSync(pidFile, { force: true });
+  // Poll briefly: the group SIGKILL must reap the grandchild sleep. kill(pid, 0)
+  // throws ESRCH once it is gone; on the old direct-child kill it stayed alive.
+  let alive = true;
+  for (let i = 0; i < 20 && alive; i++) {
+    try { process.kill(gpid, 0); await new Promise((r) => setTimeout(r, 50)); }
+    catch { alive = false; }
+  }
+  assert.equal(alive, false, 'the grandchild sleep must be killed with the group, not orphaned past nuke');
+});
+
+// Wiring: nuke's summary must not claim the credential is gone when the scheduled
+// teardown reported an issue. Source-parsed like the other nuke wiring guard.
+test('nuke summary is honest: no blanket "Credentials were still removed", and warns when the scheduled key may remain', () => {
+  const src = fs.readFileSync(path.join(__dirname, '..', 'src', 'commands', 'setup.js'), 'utf8');
+  assert.ok(!src.includes('Credentials were still removed.'), 'the misleading blanket claim must be gone');
+  const actionStart = src.indexOf(".command('nuke')");
+  const actionSrc = src.slice(actionStart, actionStart + 9000);
+  assert.match(actionSrc, /failed\.includes\('scheduled scan'\)/, 'the summary must special-case a scheduled-scan miss');
+  assert.match(actionSrc, /discover unschedule/, 'and point the user at the command that clears it');
+});

package/test/tool-health.test.js

@@ -641,6 +641,98 @@ test('validateToolKeys: invalid verdict flips the tool to tampered', async () =>
   });
 });
 
+test('validateToolKeys: stale live-env key invalid but rc file holds a valid key → healthy', async () => {
+  await withHome(async (tmp, th) => {
+    const script = path.join(tmp, '.cursor', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.cursor', 'hooks.json'), JSON.stringify({ hooks: { PreToolUse: [{ command: script }] } }));
+    writeFile(script, '# unbound');
+    // A shell opened before setup rewrote the rc carries a stale key in the
+    // live env, while the valid key sits in a shell rc. Must not be tampered.
+    // .zshrc is on both the macOS and Linux rc lists, so the test is portable.
+    writeFile(path.join(tmp, '.zshrc'), 'export UNBOUND_CURSOR_API_KEY="rc-valid-key"\n');
+    process.env.UNBOUND_CURSOR_API_KEY = 'stale-invalid-key';
+    try {
+      const seen = [];
+      const tools = th.detectTools();
+      await th.validateToolKeys(tools, async (k) => { seen.push(k); return k === 'rc-valid-key' ? 'valid' : 'invalid'; });
+      const cursor = tools.find((t) => t.key === 'cursor');
+      assert.equal(cursor.status, 'healthy');
+      assert.equal(cursor.checks.find((c) => c.keyCheck).ok, true);
+      // Guard the rc read itself: if the rc file were skipped the tool would
+      // still be tampered, so prove the rc key actually reached the validator.
+      assert.ok(seen.includes('rc-valid-key'), 'the rc-file key must be validated, not just the live env key');
+    } finally {
+      delete process.env.UNBOUND_CURSOR_API_KEY;
+    }
+  });
+});
+
+test('validateToolKeys: live-env AND rc keys both invalid → tampered (no false clean)', async () => {
+  await withHome(async (tmp, th) => {
+    const script = path.join(tmp, '.cursor', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.cursor', 'hooks.json'), JSON.stringify({ hooks: { PreToolUse: [{ command: script }] } }));
+    writeFile(script, '# unbound');
+    writeFile(path.join(tmp, '.zshrc'), 'export UNBOUND_CURSOR_API_KEY="rc-stale-key"\n');
+    process.env.UNBOUND_CURSOR_API_KEY = 'env-stale-key';
+    try {
+      const seen = [];
+      const tools = th.detectTools();
+      await th.validateToolKeys(tools, async (k) => { seen.push(k); return 'invalid'; });
+      const cursor = tools.find((t) => t.key === 'cursor');
+      assert.equal(cursor.status, 'tampered');
+      assert.equal(cursor.checks.find((c) => c.keyCheck).ok, false);
+      // Both candidates must be validated — otherwise a skipped rc file lets
+      // this "every candidate rejected" case pass without ever reading the rc.
+      assert.ok(seen.includes('env-stale-key') && seen.includes('rc-stale-key'), 'both the live env and rc keys must be validated');
+    } finally {
+      delete process.env.UNBOUND_CURSOR_API_KEY;
+    }
+  });
+});
+
+test('validateToolKeys: a valid live key short-circuits — rc siblings are never sent to the validator', async () => {
+  await withHome(async (tmp, th) => {
+    const script = path.join(tmp, '.cursor', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.cursor', 'hooks.json'), JSON.stringify({ hooks: { PreToolUse: [{ command: script }] } }));
+    writeFile(script, '# unbound');
+    // A user-owned var (e.g. OPENAI_API_KEY for codex-gateway) can carry the
+    // user's personal key exported beside ours. A valid live key must stop the
+    // check before any rc sibling is uploaded to the gateway.
+    writeFile(path.join(tmp, '.zshrc'), 'export UNBOUND_CURSOR_API_KEY="personal-secret"\nexport UNBOUND_CURSOR_API_KEY="live-valid-key"\n');
+    process.env.UNBOUND_CURSOR_API_KEY = 'live-valid-key';
+    try {
+      const seen = [];
+      const tools = th.detectTools();
+      await th.validateToolKeys(tools, async (k) => { seen.push(k); return k === 'live-valid-key' ? 'valid' : 'invalid'; });
+      const cursor = tools.find((t) => t.key === 'cursor');
+      assert.equal(cursor.status, 'healthy');
+      assert.deepEqual(seen, ['live-valid-key'], 'only the live key is validated on the healthy path');
+      assert.ok(!seen.includes('personal-secret'), 'a sibling rc key must never be sent');
+    } finally {
+      delete process.env.UNBOUND_CURSOR_API_KEY;
+    }
+  });
+});
+
+test('validateToolKeys: user-owned OPENAI_API_KEY never has its rc siblings sent, even when the live key is rejected', async () => {
+  await withHome(async (tmp, th) => {
+    writeFile(path.join(tmp, '.codex', 'config.toml'), 'openai_base_url = "https://gateway.example/v1"\n');
+    // The user's personal OpenAI key sits in the rc beside anything Unbound set.
+    // A rejected live key must NOT trigger a search that uploads the personal one.
+    writeFile(path.join(tmp, '.zshrc'), 'export OPENAI_API_KEY="sk-personal-secret"\n');
+    process.env.OPENAI_API_KEY = 'stale-live-key';
+    try {
+      const seen = [];
+      const tools = th.detectTools();
+      await th.validateToolKeys(tools, async (k) => { seen.push(k); return 'invalid'; });
+      assert.ok(!seen.includes('sk-personal-secret'), 'a personal OpenAI key in the rc must never be sent to the gateway');
+      assert.deepEqual(seen, ['stale-live-key'], 'only the live value is ever validated for a user-owned var');
+    } finally {
+      delete process.env.OPENAI_API_KEY;
+    }
+  });
+});
+
 test('validateToolKeys: unknown verdict fails open — tool stays healthy', async () => {
   await withHome(async (tmp, th) => {
     const script = path.join(tmp, '.cursor', 'hooks', 'unbound.py');