unbound-cli 1.16.9 → 1.16.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.16.9",
+  "version": "1.16.11",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/discover.js

@@ -1,4 +1,5 @@
-const { spawn, execSync } = require('child_process');
+const childProcess = require('child_process');
+const { spawn } = childProcess;
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
@@ -7,7 +8,9 @@ const output = require('../output');
 const telemetry = require('../telemetry');
 const { Option } = require('commander');
 const { shellEscape, downloadToFile, withSecureTempFile, DISCOVER_BASE_URL } = require('../utils');
-const LAUNCH_AGENT_LABEL = 'ai.getunbound.discovery';
+// The scheduled-scan installer (setup-scheduled-scan.sh) registers this LaunchAgent
+// and writes its logs; keep both in sync with that script.
+const LAUNCH_AGENT_LABEL = 'ai.getunbound.scheduled';
 
 // install.sh exits with this code when the OS isn't supported for discovery
 // (e.g. Linux). Treated as a skipped scan, not a failure.
@@ -351,14 +354,14 @@ Examples:
 
       const home = os.homedir();
       const plistPath = path.join(home, 'Library/LaunchAgents', `${LAUNCH_AGENT_LABEL}.plist`);
-      const logPath = path.join(home, 'Library/Logs/unbound/scan.log');
-      const errPath = path.join(home, 'Library/Logs/unbound/scan.err');
+      const logPath = path.join(home, 'Library/Logs/unbound/scheduled.log');
+      const errPath = path.join(home, 'Library/Logs/unbound/scheduled.err');
 
       const plistExists = fs.existsSync(plistPath);
 
       let isLoaded = false;
       try {
-        execSync(`launchctl list "${LAUNCH_AGENT_LABEL}"`, { stdio: 'ignore' });
+        childProcess.execSync(`launchctl list "${LAUNCH_AGENT_LABEL}"`, { stdio: 'ignore' });
         isLoaded = true;
       } catch {
         // not loaded

package/src/toolHealth.js

@@ -17,6 +17,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { spawnSync } = require('child_process');
+const TOML = require('@iarna/toml');
 const claudePaths = require('./claudePaths');
 
 const HOME = os.homedir();
@@ -353,7 +354,18 @@ function buildVariants(gatewayUrl, binaryPath) {
       key: 'codex-subscription', label: 'Codex (subscription)', family: 'codex', mode: 'subscription',
       checks: () => [
         configCheck('Config', '~/.codex/hooks.json', { json: true, test: refsUnbound }),
-        configCheck('Hooks feature flag', '~/.codex/config.toml', { json: false, test: (t) => /codex_hooks\s*=\s*true/.test(t) }, { short: 'codex hooks not enabled' }),
+        // Codex enables hooks via `[features] hooks = true`; the pre-Aug-2026 alias
+        // `[features] codex_hooks = true` is still honoured, with the canonical `hooks`
+        // winning when both are set. Both live under [features], so a hooks key in any
+        // other table isn't this flag; an unparseable config (which Codex couldn't load
+        // either) reads as not enabled.
+        configCheck('Hooks feature flag', '~/.codex/config.toml', { json: false, test: (t) => {
+          let cfg;
+          try { cfg = TOML.parse(t.replace(/^\uFEFF/, '')); } catch { return false; } // tolerate a UTF-8 BOM, like readJson
+          const features = cfg.features;
+          if (!features || typeof features !== 'object') return false;
+          return features.hooks === undefined ? features.codex_hooks === true : features.hooks === true;
+        } }, { short: 'codex hooks not enabled' }),
         scriptCheck('Hook script', '~/.codex/hooks/unbound.py'),
         envKeyCheck('API key env', 'UNBOUND_CODEX_API_KEY'),
       ],

package/test/discover-exit-code.test.js

@@ -1,7 +1,53 @@
 const { test } = require('node:test');
 const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
 const { Command } = require('commander');
 const { classifyDiscoveryExit, register } = require('../src/commands/discover');
+const output = require('../src/output');
+
+// `discover status` must point at what the scheduled-scan installer actually
+// creates: the LaunchAgent labelled `ai.getunbound.scheduled` and the
+// scheduled.log / scheduled.err files under ~/Library/Logs/unbound. Otherwise a
+// scheduled scan reports "No schedule". Runs the real status action with the
+// platform stubbed to darwin and output.keyValue captured.
+test('discover status: uses the scheduled-scan LaunchAgent label and log paths', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-discover-status-'));
+  const origHome = process.env.HOME;
+  const origPlatform = process.platform;
+  const origKeyValue = output.keyValue;
+  const origHomedir = os.homedir;
+
+  os.homedir = () => tmp;
+  process.env.HOME = tmp;
+  Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+
+  // Make the plist exist so the "LaunchAgent" row shows its resolved path.
+  const plistPath = path.join(tmp, 'Library/LaunchAgents', 'ai.getunbound.scheduled.plist');
+  fs.mkdirSync(path.dirname(plistPath), { recursive: true });
+  fs.writeFileSync(plistPath, '<plist/>');
+
+  const captured = {};
+  output.keyValue = (pairs) => { for (const [k, v] of pairs) captured[k] = v; };
+
+  try {
+    const program = new Command();
+    register(program);
+    await program.parseAsync(['node', 'x', 'discover', 'status']);
+
+    assert.equal(captured['LaunchAgent'], plistPath);
+    assert.equal(captured['Log file'], path.join(tmp, 'Library/Logs/unbound/scheduled.log'));
+    assert.equal(captured['Error log'], path.join(tmp, 'Library/Logs/unbound/scheduled.err'));
+  } finally {
+    output.keyValue = origKeyValue;
+    os.homedir = origHomedir;
+    Object.defineProperty(process, 'platform', { value: origPlatform, configurable: true });
+    if (origHome === undefined) delete process.env.HOME;
+    else process.env.HOME = origHome;
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
 
 // Existing crons can still pass a discovery key. With strict option parsing the
 // CLI would reject an unregistered flag, so discover keeps --discovery-key as an

package/test/discover-status-hardening.test.js

@@ -0,0 +1,165 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { Command } = require('commander');
+const { register } = require('../src/commands/discover');
+const output = require('../src/output');
+
+// Hardening for `discover status`: the command must agree with what the
+// scheduled-scan installer (coding-discovery-tool/setup-scheduled-scan.sh)
+// actually creates — the `ai.getunbound.scheduled` LaunchAgent and the
+// scheduled.log / scheduled.err files — and must degrade cleanly off macOS.
+
+function withDarwinHome(fn) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-discover-status-'));
+  const origHome = process.env.HOME;
+  const origPlatform = process.platform;
+  const origHomedir = os.homedir;
+  const origKeyValue = output.keyValue;
+  os.homedir = () => tmp;
+  process.env.HOME = tmp;
+  Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+  const captured = {};
+  output.keyValue = (pairs) => { for (const [k, v] of pairs) captured[k] = v; };
+  return (async () => {
+    try {
+      const program = new Command();
+      register(program);
+      await program.parseAsync(['node', 'x', 'discover', 'status']);
+      await fn(tmp, captured);
+    } finally {
+      output.keyValue = origKeyValue;
+      os.homedir = origHomedir;
+      Object.defineProperty(process, 'platform', { value: origPlatform, configurable: true });
+      if (origHome === undefined) delete process.env.HOME;
+      else process.env.HOME = origHome;
+      fs.rmSync(tmp, { recursive: true, force: true });
+    }
+  })();
+}
+
+// Cross-repo contract. The installer's wrapper writes a run marker to
+// scheduled.log in exactly this shape:
+//   log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> scheduled.log; }
+//   log "=== Starting Unbound scheduled run ==="
+// `discover status` parses the last such line into "Last scan". If either side
+// drifts, Last scan silently reverts to "-". This seeds a real installer-format
+// line and asserts the timestamp is recovered.
+test('discover status: parses Last scan from the installer\'s real scheduled.log line', async () => {
+  await withDarwinHome(async (tmp, captured) => {
+    // (setup happens before parseAsync, so write the log then re-run in-band)
+    const logDir = path.join(tmp, 'Library/Logs/unbound');
+    fs.mkdirSync(logDir, { recursive: true });
+    fs.writeFileSync(path.join(logDir, 'scheduled.log'),
+      '[2026-09-20 09:00:01] === Starting Unbound scheduled run ===\n' +
+      'discovered 3 tools\n' +
+      '[2026-09-21 09:00:02] === Starting Unbound scheduled run ===\n' +
+      '[2026-09-21 09:00:04] === Finished ===\n');
+    // Re-run status now that the log exists.
+    const program = new Command();
+    register(program);
+    await program.parseAsync(['node', 'x', 'discover', 'status']);
+    assert.equal(captured['Last scan'], '2026-09-21 09:00:02', 'must report the latest run marker');
+    assert.equal(captured['Log file'], path.join(logDir, 'scheduled.log'));
+  });
+});
+
+// A machine that still has ONLY the stale `ai.getunbound.discovery` plist (never
+// re-ran the migrating installer) must read as unscheduled — the reader is bound
+// to the new label, not the old one.
+test('discover status: a stale ai.getunbound.discovery plist alone reads as Not installed', async () => {
+  await withDarwinHome(async (tmp, captured) => {
+    const laDir = path.join(tmp, 'Library/LaunchAgents');
+    fs.mkdirSync(laDir, { recursive: true });
+    fs.writeFileSync(path.join(laDir, 'ai.getunbound.discovery.plist'), '<plist/>');
+    const program = new Command();
+    register(program);
+    await program.parseAsync(['node', 'x', 'discover', 'status']);
+    assert.equal(captured['Scheduled'], 'No');
+    assert.equal(captured['LaunchAgent'], 'Not installed');
+  });
+});
+
+// Runs `discover status` on darwin with `launchctl` stubbed. `discover.js` calls
+// `childProcess.execSync`, so replacing that method on the shared module object
+// takes effect without re-requiring. `loaded` decides whether `launchctl list
+// <label>` succeeds; `plistLabel` (if set) seeds that LaunchAgent plist. Returns
+// the captured key/values and the exact launchctl command the reader ran.
+async function runStatusWithLaunchctl({ plistLabel, loaded }) {
+  const cp = require('child_process');
+  const orig = {
+    execSync: cp.execSync, home: process.env.HOME, platform: process.platform,
+    homedir: os.homedir, keyValue: output.keyValue,
+  };
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-discover-status-'));
+  if (plistLabel) {
+    const laDir = path.join(tmp, 'Library/LaunchAgents');
+    fs.mkdirSync(laDir, { recursive: true });
+    fs.writeFileSync(path.join(laDir, `${plistLabel}.plist`), '<plist/>');
+  }
+  let launchctlCmd = '';
+  cp.execSync = (cmd) => { launchctlCmd = cmd; if (loaded) return ''; throw new Error('not loaded'); };
+  os.homedir = () => tmp;
+  process.env.HOME = tmp;
+  Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+  const captured = {};
+  output.keyValue = (pairs) => { for (const [k, v] of pairs) captured[k] = v; };
+  try {
+    const program = new Command();
+    register(program);
+    await program.parseAsync(['node', 'x', 'discover', 'status']);
+    return { captured, launchctlCmd };
+  } finally {
+    cp.execSync = orig.execSync;
+    os.homedir = orig.homedir;
+    Object.defineProperty(process, 'platform', { value: orig.platform, configurable: true });
+    if (orig.home === undefined) delete process.env.HOME; else process.env.HOME = orig.home;
+    output.keyValue = orig.keyValue;
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+// The bug was "reports no schedule on a scheduled machine". A machine the
+// installer scheduled must read Scheduled: Yes — which needs both the plist
+// (new label) present AND `launchctl list <label>` to succeed. This asserts the
+// reader queries launchctl under the SAME `ai.getunbound.scheduled` label it
+// reads the plist under, so the two sides can't drift apart into a false "No".
+test('discover status: installed + loaded scheduled agent reads Scheduled: Yes', async () => {
+  const { captured, launchctlCmd } = await runStatusWithLaunchctl({ plistLabel: 'ai.getunbound.scheduled', loaded: true });
+  assert.match(launchctlCmd, /launchctl list "ai\.getunbound\.scheduled"/, 'queries the new label, not the legacy one');
+  assert.equal(captured['Scheduled'], 'Yes (daily at 09:00)');
+});
+
+// The reverse guard: the plist is present but the agent is not loaded, so the
+// scan is not actually scheduled — it must read No, not a false Yes off the plist alone.
+test('discover status: installed but not loaded reads Scheduled: No', async () => {
+  const { captured } = await runStatusWithLaunchctl({ plistLabel: 'ai.getunbound.scheduled', loaded: false });
+  assert.equal(captured['Scheduled'], 'No');
+  assert.match(captured['LaunchAgent'], /ai\.getunbound\.scheduled\.plist$/);
+});
+
+// Off macOS the command must not touch launchd/plist state; it prints guidance
+// pointing at the real Linux timer and Windows scheduled-task names and exits 1.
+test('discover status: non-darwin prints OS guidance and does not read plist state', async () => {
+  const origPlatform = process.platform;
+  const origError = output.error;
+  const origExit = process.exitCode;
+  Object.defineProperty(process, 'platform', { value: 'linux', configurable: true });
+  let msg = '';
+  output.error = (m) => { msg += m; };
+  try {
+    const program = new Command();
+    register(program);
+    await program.parseAsync(['node', 'x', 'discover', 'status']);
+    assert.match(msg, /only supports macOS/);
+    assert.match(msg, /unbound-scheduled\.timer/, 'points at the real systemd timer');
+    assert.match(msg, /ai\.getunbound\.scheduled/, 'points at the real Windows task name');
+    assert.equal(process.exitCode, 1);
+  } finally {
+    output.error = origError;
+    Object.defineProperty(process, 'platform', { value: origPlatform, configurable: true });
+    process.exitCode = origExit;
+  }
+});

package/test/doctor-codex-e2e.test.js

@@ -0,0 +1,71 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+// End-to-end guard through the real shipped binary: `unbound doctor --json`.
+// The unit tests exercise detectTools directly; this proves the same fix holds
+// when the CLI is actually run. A Codex install using the current spelling
+// (`[features] hooks = true`) must report healthy, not tampered — the reported
+// bug. Key validation is pointed at an unroutable API so it fails open offline
+// and never leaves the machine.
+
+const CLI = path.join(__dirname, '..', 'src', 'index.js');
+
+function runDoctor(home) {
+  const r = spawnSync('node', [CLI, 'doctor', '--json'], {
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      HOME: home,
+      UNBOUND_CODEX_API_KEY: 'dummy-key',
+      // Unroutable API: validateApiKey fails fast and fails open (status stays
+      // as detectTools derived it), so the run is hermetic and offline.
+      UNBOUND_API_URL: 'http://127.0.0.1:1',
+    },
+  });
+  // doctor exits non-zero when ANY tool is tampered; this host may carry
+  // unrelated MDM-managed tools, so we assert on the codex entry, not the code.
+  const start = r.stdout.indexOf('{');
+  assert.notEqual(start, -1, `doctor produced no JSON\nstdout:${r.stdout}\nstderr:${r.stderr}`);
+  return JSON.parse(r.stdout.slice(start));
+}
+
+function seedHealthyCodex(home) {
+  const wrapper = path.join(home, '.codex', 'hooks', 'unbound.py');
+  fs.mkdirSync(path.dirname(wrapper), { recursive: true });
+  fs.writeFileSync(wrapper, '# unbound');
+  fs.writeFileSync(path.join(home, '.codex', 'hooks.json'), JSON.stringify({
+    hooks: { PreToolUse: [{ command: wrapper }] },
+  }));
+}
+
+test('unbound doctor: real binary reads new-spelling [features] hooks = true codex as healthy', () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-doctor-e2e-'));
+  try {
+    seedHealthyCodex(home);
+    fs.writeFileSync(path.join(home, '.codex', 'config.toml'), 'model = "gpt-5"\n\n[features]\nhooks = true\n');
+    const report = runDoctor(home);
+    const codex = report.tools.find((t) => t.tool === 'codex-subscription');
+    assert.ok(codex, 'doctor JSON must include the codex-subscription tool');
+    assert.equal(codex.status, 'healthy', 'a working codex install must not read as tampered');
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test('unbound doctor: real binary reads legacy [features] codex_hooks = true codex as healthy', () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-doctor-e2e-'));
+  try {
+    seedHealthyCodex(home);
+    fs.writeFileSync(path.join(home, '.codex', 'config.toml'), '[features]\ncodex_hooks = true\n');
+    const report = runDoctor(home);
+    const codex = report.tools.find((t) => t.tool === 'codex-subscription');
+    assert.ok(codex, 'doctor JSON must include the codex-subscription tool');
+    assert.equal(codex.status, 'healthy', 'a legacy codex install must stay healthy');
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});

package/test/tool-health.test.js

@@ -361,8 +361,148 @@ test('detectTools: codex binary regression (wrapper at ~/.codex/hooks/unbound.py
       hooks: { PreToolUse: [{ command: wrapper }] },
     }));
     writeFile(wrapper, '#!/bin/sh\nexec /opt/unbound/current/unbound-hook/unbound-hook hook codex "$@"\n');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), '[features]\nhooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'healthy');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// The installer now writes `hooks = true` under [features] (and strips the legacy
+// `codex_hooks`). A healthy Codex install using the new spelling must read healthy.
+test('detectTools: codex with new-spelling [features] hooks = true → healthy', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), 'model = "gpt-5"\n\n[features]\nhooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'healthy');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// An unrelated key ending in `hooks = true` must NOT satisfy the flag: with no real
+// hooks flag present the feature is off, so the install reads tampered.
+test('detectTools: codex config with only `web_hooks = true` (no real flag) → tampered', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), 'web_hooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'tampered');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// `hooks = true` under a table other than [features] does not enable Codex's hooks,
+// so the flag must not count it: the install reads tampered, not healthy.
+test('detectTools: codex `hooks = true` outside [features] (wrong table) → tampered', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), '[mcp_servers.demo]\nhooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'tampered');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// The legacy alias only ever lived under [features]. A root-level `codex_hooks = true`
+// is not a form the installer or Codex ever wrote, so it must not count: tampered.
+test('detectTools: codex root-level `codex_hooks = true` (outside [features]) → tampered', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
     writeFile(path.join(tmp, '.codex', 'config.toml'), 'codex_hooks = true\n');
     process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'tampered');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// Codex resolves the canonical `hooks` ahead of the alias, so an explicit
+// `hooks = false` disables hooks even when `codex_hooks = true` sits beside it.
+test('detectTools: codex `[features] hooks = false` beside `codex_hooks = true` → tampered', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), '[features]\nhooks = false\ncodex_hooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'tampered');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// Before the Aug-2026 rename the installer wrote the alias `[features] codex_hooks = true`.
+// Codex still honours that table-scoped alias, so a real legacy install reads healthy.
+test('detectTools: codex legacy `[features] codex_hooks = true` alias → healthy', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), '[features]\ncodex_hooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'healthy');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// Codex tolerates a leading UTF-8 BOM on config.toml, so doctor must too: strip it
+// before parsing (like readJson) rather than failing closed to tampered.
+test('detectTools: codex config with a leading UTF-8 BOM (`[features] hooks = true`) → healthy', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), '\uFEFF[features]\nhooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
     try {
       const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
       assert.equal(t.status, 'healthy');
@@ -372,6 +512,65 @@ test('detectTools: codex binary regression (wrapper at ~/.codex/hooks/unbound.py
   });
 });
 
+// The installer can emit the inline-table form `features = { hooks = true }`, which is
+// the same [features] hooks = true after parsing, so it must read healthy.
+test('detectTools: codex inline `features = { hooks = true }` → healthy', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), 'features = { hooks = true }\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'healthy');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// A config Codex can't parse can't have hooks enabled, so even one that contains a
+// `codex_hooks = true` line must read tampered rather than healthy.
+test('detectTools: codex with a malformed config.toml → tampered', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), 'codex_hooks = true\n[unterminated\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'tampered');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// The hook file going missing must still read tampered even when the feature flag is set.
+test('detectTools: codex hook script missing (flag set) → tampered', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    // Deliberately do NOT create the unbound.py hook script.
+    writeFile(path.join(tmp, '.codex', 'config.toml'), '[features]\nhooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'tampered');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
 // envCheck's rc-file fallback applies to the gateway URL check
 // (ANTHROPIC_BASE_URL is still equality-checked since tenants share one
 // gateway URL). API keys are no longer equality-checked — see WEB-4949 — so