unbound-cli 1.7.0 → 1.8.0

package/LOCAL_DEV.md

@@ -83,7 +83,7 @@ node src/index.js setup --backend-url http://localhost:8000 --frontend-url http:
 sudo node src/index.js setup --api-key <ADMIN_KEY> --all --backend-url http://localhost:8000 --frontend-url http://localhost:3000
 
 # Onboarding (combined setup + discover)
-node src/index.js onboard --api-key <USER_KEY> --discovery-key <DISCOVERY_KEY> \
+node src/index.js onboard --api-key <USER_KEY> \
     --backend-url http://localhost:8000 --frontend-url http://localhost:3000
 sudo node src/index.js onboard --api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY> \
     --backend-url http://localhost:8000 --frontend-url http://localhost:3000
@@ -183,8 +183,7 @@ node src/index.js setup --all
 node src/index.js setup --all --api-key <key>
 
 # Onboarding (one command: login + setup --all + discover)
-node src/index.js onboard --api-key <USER_KEY> --discovery-key <DISCOVERY_KEY>
-sudo node src/index.js onboard --api-key <USER_KEY> --discovery-key <DISCOVERY_KEY>
+node src/index.js onboard --api-key <USER_KEY>
 
 # MDM onboarding (admin device enrollment, requires root — MDM scope auto-detected from sudo)
 sudo node src/index.js onboard --api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY>

package/README.md

@@ -37,7 +37,7 @@ For new users, the fastest path from install to a fully-configured device is the
 ```bash
 # End user
 npm install -g unbound-cli
-unbound onboard --api-key <USER_KEY> --discovery-key <DISCOVERY_KEY>
+unbound onboard --api-key <USER_KEY>
 
 # Admin enrolling a device via MDM (requires root)
 sudo unbound onboard --api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY>
@@ -65,7 +65,7 @@ Interactive batch setup:
 | Command | Description |
 |---------|-------------|
 | `unbound setup` | Select and install multiple tools interactively |
-| `unbound setup --all` | Install the default bundle: Cursor + Claude Code hooks + Codex hooks |
+| `unbound setup --all` | Install the default bundle: Cursor + Copilot + Augment + Claude Code hooks + Codex hooks |
 
 Automated setup (downloads scripts, sets env vars, configures tool):
 
@@ -73,6 +73,7 @@ Automated setup (downloads scripts, sets env vars, configures tool):
 |---------|-------------|
 | `unbound setup cursor` | Download hooks, set env, restart Cursor |
 | `unbound setup copilot` | Download hooks, set env, configure GitHub Copilot |
+| `unbound setup augment` | Download hooks, set env, configure Augment Code |
 | `unbound setup claude-code` | Interactive mode selection (subscription or gateway) |
 | `unbound setup claude-code --subscription` | Hooks only (keep your Claude subscription) |
 | `unbound setup claude-code --gateway` | Use Unbound as the AI provider |
@@ -96,6 +97,7 @@ Remove configuration:
 |---------|-------------|
 | `unbound setup cursor --clear` | Remove Unbound config for Cursor |
 | `unbound setup copilot --clear` | Remove Unbound config for GitHub Copilot |
+| `unbound setup augment --clear` | Remove Unbound config for Augment Code |
 | `unbound setup claude-code --clear` | Remove Unbound config for Claude Code |
 | `unbound setup gemini-cli --clear` | Remove Unbound config for Gemini CLI |
 | `unbound setup codex --clear` | Remove Unbound config for Codex |
@@ -110,7 +112,7 @@ Configure all users on a device via MDM. Requires root.
 | `sudo unbound setup --api-key KEY cursor codex-subscription` | Set up specific tools |
 | `sudo unbound setup --clear cursor` | Remove config for specific tools |
 
-Available tools: `cursor`, `copilot`, `claude-code-subscription`, `claude-code-gateway`, `gemini-cli`, `codex-subscription`, `codex-gateway`
+Available tools: `cursor`, `copilot`, `augment`, `claude-code-subscription`, `claude-code-gateway`, `gemini-cli`, `codex-subscription`, `codex-gateway`
 
 `claude-code-subscription` and `claude-code-gateway` are mutually exclusive. `codex-subscription` and `codex-gateway` are mutually exclusive. When using `--all`, subscription mode is used by default for Claude Code and Codex.
 
@@ -252,7 +254,7 @@ Alias: `unbound groups` works the same as `unbound user-groups`.
 | `unbound tools connect <type>` | Connect a tool |
 | `unbound tools approved` | List approved tool types |
 
-Supported tool types: `CLAUDE_CODE`, `UNBOUND_CLAUDE_CODE`, `CURSOR`, `COPILOT`, `ROO_CODE`, `CLINE`, `GEMINI_CLI`, `CODEX`, `UNBOUND_CODEX`, `KILO_CODE`, `CUSTOM_ACCESS`
+Supported tool types: `CLAUDE_CODE`, `UNBOUND_CLAUDE_CODE`, `CURSOR`, `COPILOT`, `AUGMENT_CODE`, `ROO_CODE`, `CLINE`, `GEMINI_CLI`, `CODEX`, `UNBOUND_CODEX`, `KILO_CODE`, `CUSTOM_ACCESS`
 
 ## Configuration
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/discover.js

@@ -199,7 +199,9 @@ Scans this device for installed AI coding tools (Cursor, Claude Code,
 Gemini CLI, Codex, Windsurf, Roo Code, Cline, GitHub Copilot, JetBrains,
 and more) and reports findings to the Unbound backend.
 
-The --api-key is a discovery-specific key (separate from login credentials).
+Which --api-key to use depends on scope:
+  - Single-user scan (no sudo): use your own user API key.
+  - All-users scan (sudo): use the org discovery key.
 The --domain defaults to the backend URL configured via "unbound config set-backend-url"
 (falls back to https://backend.getunbound.ai when unset).
 

package/src/commands/onboard.js

@@ -27,7 +27,7 @@ function register(program) {
     )
     .option('--api-key <key>', 'API key (user key, or admin key when run with sudo). Falls back to UNBOUND_API_KEY or a stored `unbound login` key)')
     .addOption(new Option('--admin-api-key <key>', 'Alias for --api-key (back-compat)').hideHelp())
-    .option('--discovery-key <key>', 'Discovery API key for device scan (or set UNBOUND_DISCOVERY_KEY)')
+    .option('--discovery-key <key>', 'Org discovery key for the device scan — required only under sudo (MDM/org scope); ignored for per-user onboarding (or set UNBOUND_DISCOVERY_KEY)')
     .option('--domain <url>', 'Backend URL for discovery (defaults to configured backend)')
     .option('--set-cron', 'Set up a daily background job to keep governance up to date (under sudo, schedules a discovery scan only — not a full tool re-install)')
     .option('--backfill', 'Seed historical Claude Code / Codex / Copilot sessions from local transcripts into Unbound analytics (Cursor skipped automatically)')
@@ -37,24 +37,27 @@ function register(program) {
     .addHelpText('after', `
 Runs the full onboarding flow, auto-detecting scope from your privileges:
   With sudo, installs the MDM tool bundle (${MDM_ALL_TOOLS.join(', ')}) and
-  scans all users on the device. Without sudo, installs the user bundle
-  (${ALL_TOOLS.join(', ')}) and scans the current user.
+  scans all users on the device using --discovery-key. Without sudo, installs
+  the user bundle (${ALL_TOOLS.join(', ')}) and scans the current user using
+  your own API key.
 
   1. Logs in / resolves the API key (or reuses a stored \`unbound login\` key
      when --api-key is omitted).
   2. Installs the tool bundle for the detected scope.
-  3. Runs device discovery with --discovery-key. With --set-cron, sets up a
-     recurring daily scheduled scan (cross-platform) instead of a one-time scan.
+  3. Runs device discovery. Per-user scope scans with your API key so the
+     device is attributed to you from the first report; sudo/MDM scope scans
+     all users with --discovery-key. With --set-cron, sets up a recurring daily
+     scheduled scan (cross-platform) instead of a one-time scan.
 
-The API key and discovery API key are separate keys obtained from different
-parts of the Unbound dashboard. Discovery uses its own key that is not stored
-in the CLI config.
+Per-user onboarding needs only your API key. The separate --discovery-key is
+required only under sudo (MDM/org enrollment), where the scan covers every user
+on the device and cannot be attributed from a single user's key.
 
 Examples:
-  $ unbound onboard --api-key <USER_KEY> --discovery-key <DISCOVERY_KEY>
+  $ unbound onboard --api-key <USER_KEY>
   $ sudo unbound onboard --api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY>
-  $ unbound onboard --api-key <USER_KEY> --discovery-key <DISCOVERY_KEY> --backfill
-  $ unbound onboard --api-key <USER_KEY> --discovery-key <DISCOVERY_KEY> --set-cron
+  $ unbound onboard --api-key <USER_KEY> --backfill
+  $ unbound onboard --api-key <USER_KEY> --set-cron
 `)
     .action(telemetry.wrapAction('onboard', async (opts) => {
       const apiKeyOpt = opts.apiKey || opts.adminApiKey || process.env.UNBOUND_API_KEY;
@@ -65,8 +68,12 @@ Examples:
       telemetry.rememberSecret(discoveryKeyOpt);
       const isMdm = hasRootPrivileges();
 
-      if (!discoveryKeyOpt) {
-        output.error('--discovery-key is required (or set UNBOUND_DISCOVERY_KEY env var)');
+      // MDM/org scope (sudo) scans every user on the device, so it still needs a
+      // dedicated org discovery key. Per-user scope scans only the current user
+      // and attributes the device via that user's own API key (see Step 2), so a
+      // separate discovery key is neither needed nor used.
+      if (isMdm && !discoveryKeyOpt) {
+        output.error('--discovery-key is required under sudo (MDM/org enrollment), or set UNBOUND_DISCOVERY_KEY env var');
         process.exitCode = 1;
         return;
       }
@@ -77,6 +84,13 @@ Examples:
         process.exitCode = 1;
         return;
       }
+      // Back-compat: --discovery-key used to be required for per-user onboarding.
+      // It is now ignored in user scope — the personal API key is used for the
+      // scan so the device is attributed to the user from the first report
+      // (WEB-4891). Warn rather than fail so existing scripts keep working.
+      if (!isMdm && discoveryKeyOpt) {
+        output.warn('--discovery-key is deprecated for per-user onboarding and is ignored; your API key is used for the device scan, so the device is attributed to you. You can drop --discovery-key (and unset UNBOUND_DISCOVERY_KEY if it is set in your environment).');
+      }
 
       let setupSucceeded = false;
       let discoverySucceeded = false;
@@ -148,7 +162,11 @@ Examples:
           console.log('');
           output.info('Step 2/2: Running device discovery');
           console.log('');
-          await runDiscoveryScan({ apiKey: discoveryKeyOpt, domain: discoveryDomain });
+          // Per-user scope: scan with the user's own API key so the backend
+          // attributes the device to them at ingestion. Using the org discovery
+          // key here leaves the device unattributed until a device->user mapping
+          // resolves later (WEB-4891).
+          await runDiscoveryScan({ apiKey, domain: discoveryDomain });
           discoverySucceeded = true;
           skippedTools = skipped;
         }
@@ -168,11 +186,12 @@ Examples:
               skipRunAtLoad: true,
             });
           } else {
+            // Per-user cron re-runs `unbound onboard`, which now scans with the
+            // user's own API key — no separate discovery key to store.
             output.info('Setting up daily scheduled run');
             await setupScheduledRun({
               command: 'onboard',
               apiKey: apiKeyOpt || config.getApiKey(),
-              discoveryKey: discoveryKeyOpt,
               domain: discoveryDomain,
               skipRunAtLoad: true,
             });
@@ -199,11 +218,15 @@ Examples:
           if (isMdm) {
             console.error(`  Re-run just the scheduled scan with: sudo unbound discover --api-key <DISCOVERY_KEY> --set-cron${suffix}`);
           } else {
-            console.error(`  Re-run cron setup with: unbound onboard --api-key <KEY> --discovery-key <DISCOVERY_KEY> --set-cron${suffix}`);
+            console.error(`  Re-run cron setup with: unbound onboard --api-key <KEY> --set-cron${suffix}`);
           }
         } else if (setupSucceeded && !discoverySucceeded) {
           console.error('  Tool setup completed successfully — only discovery failed.');
-          console.error(`  Re-run discovery only with: ${sudo}unbound discover --api-key <DISCOVERY_KEY>${suffix}`);
+          if (isMdm) {
+            console.error(`  Re-run discovery only with: sudo unbound discover --api-key <DISCOVERY_KEY>${suffix}`);
+          } else {
+            console.error(`  Re-run discovery only with: unbound discover --api-key <KEY>${suffix}`);
+          }
         }
         process.exitCode = 1;
       }

package/src/commands/setup.js

@@ -29,6 +29,7 @@ function isWindowsNative() {
 const SETUP_TOOLS = [
   { label: 'Cursor', value: 'cursor', script: 'cursor/setup.py' },
   { label: 'GitHub Copilot', value: 'copilot', script: 'copilot/hooks/setup.py' },
+  { label: 'Augment Code', value: 'augment', script: 'augment/hooks/setup.py' },
   { label: 'Claude Code \u2014 subscription (hooks)', value: 'claude-sub', script: 'claude-code/hooks/setup.py', group: 'claude-code' },
   { label: 'Claude Code \u2014 gateway (gateway)', value: 'claude-gw', script: 'claude-code/gateway/setup.py', group: 'claude-code' },
   { label: 'Gemini CLI', value: 'gemini', script: 'gemini-cli/gateway/setup.py' },
@@ -41,6 +42,7 @@ const SETUP_TOOLS = [
 const MDM_TOOLS = {
   'cursor':                   { label: 'Cursor',                script: 'cursor/mdm/setup.py' },
   'copilot':                  { label: 'GitHub Copilot',        script: 'copilot/hooks/mdm/setup.py' },
+  'augment':                  { label: 'Augment Code',          script: 'augment/hooks/mdm/setup.py' },
   'claude-code-subscription': { label: 'Claude Code',           script: 'claude-code/hooks/mdm/setup.py' },
   'claude-code-gateway':      { label: 'Claude Code (gateway)', script: 'claude-code/gateway/mdm/setup.py' },
   'gemini-cli':               { label: 'Gemini CLI',            script: 'gemini-cli/gateway/mdm/setup.py' },
@@ -49,21 +51,22 @@ const MDM_TOOLS = {
 };
 
 // Default MDM tools for `sudo unbound onboard` (subscription mode for Claude Code/Codex since only one can be active)
-const MDM_ALL_TOOLS = ['cursor', 'claude-code-subscription', 'gemini-cli', 'codex-subscription', 'copilot'];
+const MDM_ALL_TOOLS = ['cursor', 'claude-code-subscription', 'gemini-cli', 'codex-subscription', 'copilot', 'augment'];
 
 // Tools for `sudo unbound setup --all` — identical to MDM_ALL_TOOLS today; split kept for future flexibility.
-const MDM_SETUP_ALL_TOOLS = ['cursor', 'claude-code-subscription', 'gemini-cli', 'codex-subscription', 'copilot'];
+const MDM_SETUP_ALL_TOOLS = ['cursor', 'claude-code-subscription', 'gemini-cli', 'codex-subscription', 'copilot', 'augment'];
 
 // Default tools for `unbound onboard` (Cursor, Claude Code hooks, Codex hooks, Copilot hooks; no Gemini CLI).
-const ALL_TOOLS = ['cursor', 'claude-code-subscription', 'codex-subscription', 'copilot'];
+const ALL_TOOLS = ['cursor', 'claude-code-subscription', 'codex-subscription', 'copilot', 'augment'];
 
 // Tools for `unbound setup --all` — identical to ALL_TOOLS today; split kept for future flexibility.
-const SETUP_ALL_TOOLS = ['cursor', 'claude-code-subscription', 'codex-subscription', 'copilot'];
+const SETUP_ALL_TOOLS = ['cursor', 'claude-code-subscription', 'codex-subscription', 'copilot', 'augment'];
 
 // Tool name → script mapping for automated tools
 const SETUP_TOOL_MAP = {
   'cursor':                   { label: 'Cursor',                script: 'cursor/setup.py' },
   'copilot':                  { label: 'GitHub Copilot',        script: 'copilot/hooks/setup.py' },
+  'augment':                  { label: 'Augment Code',          script: 'augment/hooks/setup.py' },
   'claude-code-subscription': { label: 'Claude Code',           script: 'claude-code/hooks/setup.py' },
   'claude-code-gateway':      { label: 'Claude Code (gateway)', script: 'claude-code/gateway/setup.py' },
   'gemini-cli':               { label: 'Gemini CLI',            script: 'gemini-cli/gateway/setup.py' },
@@ -327,6 +330,7 @@ const NUKE_ENV_VARS = [
   'UNBOUND_CODEX_API_KEY',
   'UNBOUND_COPILOT_API_KEY',
   'UNBOUND_CURSOR_API_KEY',
+  'UNBOUND_AUGMENT_API_KEY',
   'ANTHROPIC_BASE_URL',
 ];
 
@@ -585,6 +589,7 @@ Scope is chosen automatically from your privileges:
 Available tools:
   cursor                    Cursor IDE
   copilot                   GitHub Copilot
+  augment                   Augment Code
   claude-code               Claude Code (use --subscription or --gateway)
   gemini-cli                Gemini CLI
   codex                     Codex (use --subscription or --gateway)
@@ -603,11 +608,12 @@ Examples:
   Single tool:
   $ unbound setup cursor                                   Set up Cursor
   $ unbound setup copilot                                  Set up GitHub Copilot
+  $ unbound setup augment                                  Set up Augment Code
   $ unbound setup claude-code --gateway                    Claude Code gateway mode
   $ unbound setup claude-code --subscription               Claude Code hooks only
   $ unbound setup codex --gateway                          Codex gateway mode
 
-  Install the default bundle (Cursor + Copilot + Claude Code hooks + Codex hooks):
+  Install the default bundle (Cursor + Copilot + Augment + Claude Code hooks + Codex hooks):
   $ unbound setup --all                                    Set up the default bundle
   $ unbound setup --all --api-key <key>                    Login + set up the bundle
 

package/src/commands/tools.js

@@ -7,6 +7,7 @@ const SUPPORTED_TOOL_TYPES = [
   'CLAUDE_CODE',
   'CURSOR',
   'COPILOT',
+  'AUGMENT_CODE',
   'ROO_CODE',
   'CLINE',
   'GEMINI_CLI',

package/src/index.js

@@ -55,14 +55,15 @@ AUTHENTICATION
   $ unbound config urls <gateway-url> <frontend-url> <backend-url>
 
 ONBOARDING (one-step install + discover; scope auto-detected from sudo)
-  $ unbound onboard --api-key <USER_KEY> --discovery-key <DISCOVERY_KEY>         Current user
+  $ unbound onboard --api-key <USER_KEY>                                         Current user
   $ sudo unbound onboard --api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY>   All users (MDM)
 
 TOOL SETUP
   $ unbound setup                          Select and install multiple tools interactively
-  $ unbound setup --all                    Set up the default bundle (Cursor + Copilot + Claude Code hooks + Codex hooks)
+  $ unbound setup --all                    Set up the default bundle (Cursor + Copilot + Augment + Claude Code hooks + Codex hooks)
   $ unbound setup cursor                   Set up Cursor
   $ unbound setup copilot                  Set up GitHub Copilot
+  $ unbound setup augment                  Set up Augment Code
   $ unbound setup claude-code              Set up Claude Code (interactive mode selection)
   $ unbound setup claude-code --gateway    Use Unbound as AI provider
   $ unbound setup claude-code --subscription  Hooks only (keep your subscription)
@@ -86,6 +87,7 @@ TOOL SETUP
   Remove configuration (no API key needed to clear):
   $ unbound setup cursor --clear           Remove Unbound config for Cursor
   $ unbound setup copilot --clear          Remove Unbound config for GitHub Copilot
+  $ unbound setup augment --clear          Remove Unbound config for Augment Code
   $ unbound setup claude-code --clear      Remove Unbound config for Claude Code
   $ unbound setup gemini-cli --clear       Remove Unbound config for Gemini CLI
   $ unbound setup codex --clear            Remove Unbound config for Codex

package/src/toolHealth.js

@@ -181,10 +181,10 @@ function envCheck(label, name, expected, kind = 'aux') {
 // and a managed config that points at a missing hook script is a broken (tampered)
 // MDM install, not a healthy one. Returns { status: 'healthy'|'tampered'|null, checks }.
 function mdmDetect(family, dirOverride, binaryPath) {
-  // Only Cursor / Claude Code / Codex have a managed (MDM) directory. Copilot and
-  // Gemini have none — their org install writes the same per-user config into
-  // every profile, so they're checked exactly like a user-level tool.
-  const configName = { cursor: 'hooks.json', 'claude-code': 'managed-settings.json', codex: 'managed-settings.json' };
+  // Only Cursor / Claude Code / Codex / Augment have a managed (MDM) directory.
+  // Copilot and Gemini have none — their org install writes the same per-user
+  // config into every profile, so they're checked exactly like a user-level tool.
+  const configName = { cursor: 'hooks.json', 'claude-code': 'managed-settings.json', codex: 'managed-settings.json', augment: 'settings.json' };
   if (!configName[family]) return { status: null, checks: [] };
 
   const mac = '/Library/Application Support';
@@ -193,6 +193,9 @@ function mdmDetect(family, dirOverride, binaryPath) {
     cursor: { darwin: `${mac}/Cursor`, linux: '/etc/cursor', win32: path.join(win, 'Cursor') },
     'claude-code': { darwin: `${mac}/ClaudeCode`, linux: '/etc/claude-code', win32: path.join(win, 'ClaudeCode') },
     codex: { darwin: `${mac}/Codex`, linux: '/etc/codex', win32: path.join(win, 'Codex') },
+    // Augment's managed dir is /etc/augment on BOTH macOS and Linux (mirrors the
+    // setup repo's get_managed_settings_dir), not Library/Application Support.
+    augment: { darwin: '/etc/augment', linux: '/etc/augment', win32: path.join(win, 'Augment') },
   };
   const dir = dirOverride || dirs[family][process.platform] || dirs[family].linux;
   const configPath = path.join(dir, configName[family]);
@@ -305,6 +308,23 @@ function buildVariants(gatewayUrl, binaryPath) {
         return checks;
       },
     },
+    {
+      key: 'augment', label: 'Augment Code', family: 'augment', mode: null,
+      checks: () => {
+        // ~/.augment/settings.json is shared with the user's own Augment config and may be
+        // JSONC, so match the Unbound hook marker on RAW TEXT (not strict JSON). Like
+        // copilot, a user install can point at the python unbound.py hook OR the shared
+        // unbound-hook binary — check whichever the config references so a binary-backed
+        // install isn't misread as tampered.
+        const cfgText = readText('~/.augment/settings.json');
+        const hasBinary = cfgText != null && cfgText.includes(BINARY_MARKER);
+        const checks = [configCheck('Config', '~/.augment/settings.json', { json: false, test: (t) => t.includes('unbound.py') || t.includes(BINARY_MARKER) })];
+        if (hasBinary) checks.push(scriptCheck('Hook binary', binaryPath || BINARY_PATH));
+        else checks.push(scriptCheck('Hook script', '~/.augment/hooks/unbound.py'));
+        checks.push(envKeyCheck('API key env', 'UNBOUND_AUGMENT_API_KEY'));
+        return checks;
+      },
+    },
     // Gemini CLI is intentionally omitted here — it isn't part of `setup --all`
     // and has no managed directory. Add it back when its scope is settled.
   ];

package/test/onboard-cron.test.js

@@ -100,7 +100,9 @@ test('onboard schedules via setupScheduledRun with command onboard', () => {
   );
 });
 
-test('onboard passes both apiKey and discoveryKey to setupScheduledRun', () => {
+// WEB-4891: per-user onboarding scans with the user's own API key, so the
+// per-user cron stores a single key — no separate discoveryKey.
+test('per-user onboard cron passes apiKey but NOT discoveryKey to setupScheduledRun', () => {
   const callIdx = onboardSrc.indexOf("command: 'onboard'");
   assert.notEqual(callIdx, -1, 'expected command: onboard call site in onboard.js');
   const open = onboardSrc.lastIndexOf('{', callIdx);
@@ -112,10 +114,31 @@ test('onboard passes both apiKey and discoveryKey to setupScheduledRun', () => {
   }
   const callArgs = onboardSrc.slice(open, close + 1);
   assert.ok(callArgs.includes('apiKey'), 'setupScheduledRun call must include apiKey');
-  assert.ok(callArgs.includes('discoveryKey'), 'setupScheduledRun call must include discoveryKey');
+  assert.ok(!callArgs.includes('discoveryKey'), 'per-user onboard cron must NOT pass a discoveryKey (single-key onboarding, WEB-4891)');
   assert.ok(!callArgs.toLowerCase().includes('backfill'), 'setupScheduledRun call must not include backfill');
 });
 
+// WEB-4891 core fix: the per-user discovery scan must run with the user's own
+// API key so the backend attributes the device to them at ingestion. Only the
+// MDM (sudo) branch — which scans every user and cannot be attributed from one
+// user's key — may scan with the org discovery key.
+test('per-user discovery scans with the user key; only MDM uses the discovery key', () => {
+  const userBranchStart = onboardSrc.indexOf('const apiKey = config.getApiKey();');
+  assert.notEqual(userBranchStart, -1, 'expected the per-user branch in onboard.js');
+  const userBranch = onboardSrc.slice(userBranchStart);
+  assert.match(
+    userBranch,
+    /runDiscoveryScan\(\{\s*apiKey\s*,/,
+    'per-user onboarding must scan with the user apiKey, not the org discovery key'
+  );
+  const discoveryKeyScans = (onboardSrc.match(/runDiscoveryScan\(\{\s*apiKey:\s*discoveryKeyOpt/g) || []).length;
+  assert.equal(
+    discoveryKeyScans,
+    1,
+    'exactly one runDiscoveryScan (the MDM branch) may use the org discovery key'
+  );
+});
+
 test('onboard imports setupScheduledRun from ../scheduled', () => {
   assert.match(
     onboardSrc,

package/test/onboard-scope.test.js

@@ -35,7 +35,7 @@ test('hasRootPrivileges: false when effective uid is not 0 (no sudo)', () => {
 // ---- 2. onboard routes by detected scope ----
 // Reloads the module graph with stubbed deps so we can observe which bundle
 // helper the single `onboard` command invokes.
-async function runOnboard(isRoot, { setCron = false } = {}) {
+async function runOnboard(isRoot, { setCron = false, discoveryKey = 'd' } = {}) {
   for (const m of [
     '../src/commands/onboard',
     '../src/commands/setup',
@@ -48,7 +48,7 @@ async function runOnboard(isRoot, { setCron = false } = {}) {
     delete require.cache[require.resolve(m)];
   }
 
-  const calls = { mdm: 0, user: 0, discovery: 0, loggedIn: 0, cron: null };
+  const calls = { mdm: 0, user: 0, discovery: 0, loggedIn: 0, cron: null, warns: [] };
   const setup = require('../src/commands/setup');
   const discover = require('../src/commands/discover');
   const auth = require('../src/auth');
@@ -59,7 +59,7 @@ async function runOnboard(isRoot, { setCron = false } = {}) {
   setup.hasRootPrivileges = () => isRoot;
   setup.runMdmSetupAllBundle = async () => { calls.mdm++; return { ok: true, skipped: [] }; };
   setup.runSetupAllBundle = async () => { calls.user++; return { ok: true, skipped: [] }; };
-  discover.runDiscoveryScan = async () => { calls.discovery++; };
+  discover.runDiscoveryScan = async (o) => { calls.discovery++; calls.discoveryArgs = o; };
   auth.ensureLoggedIn = async () => { calls.loggedIn++; };
   scheduled.setupScheduledRun = async (o) => { calls.cron = o; };
   config.setUrls = () => ({});
@@ -68,13 +68,15 @@ async function runOnboard(isRoot, { setCron = false } = {}) {
   config.getFrontendUrl = () => 'https://f.acme';
   config.getGatewayUrl = () => 'https://g.acme';
   config.isLoggedIn = () => true;
-  for (const k of ['info', 'success', 'error', 'warn']) output[k] = () => {};
+  for (const k of ['info', 'success', 'error']) output[k] = () => {};
+  output.warn = (m) => calls.warns.push(m);
 
   const { register } = require('../src/commands/onboard');
   const program = new Command();
   program.exitOverride();
   register(program);
-  const argv = ['node', 'unbound', 'onboard', '--api-key', 'k', '--discovery-key', 'd'];
+  const argv = ['node', 'unbound', 'onboard', '--api-key', 'k'];
+  if (discoveryKey) argv.push('--discovery-key', discoveryKey);
   if (setCron) argv.push('--set-cron');
   await program.parseAsync(argv);
   return calls;
@@ -86,6 +88,7 @@ test('onboard with sudo/root → installs the MDM bundle (all users), no login',
   assert.equal(calls.user, 0, 'user bundle NOT installed');
   assert.equal(calls.loggedIn, 0, 'MDM scope does not run ensureLoggedIn');
   assert.equal(calls.discovery, 1, 'discovery still runs');
+  assert.equal(calls.discoveryArgs.apiKey, 'd', 'MDM scope scans with the org discovery key');
 });
 
 test('onboard without sudo → logs in and installs the user bundle', async () => {
@@ -94,6 +97,9 @@ test('onboard without sudo → logs in and installs the user bundle', async () =
   assert.equal(calls.mdm, 0, 'MDM bundle NOT installed');
   assert.equal(calls.loggedIn, 1, 'user scope runs ensureLoggedIn');
   assert.equal(calls.discovery, 1, 'discovery still runs');
+  // WEB-4891: per-user scan uses the resolved user key, NOT the org discovery key.
+  assert.equal(calls.discoveryArgs.apiKey, 'resolved-key', 'user scope scans with the user API key');
+  assert.notEqual(calls.discoveryArgs.apiKey, 'd', 'user scope must NOT scan with the discovery key');
 });
 
 // --set-cron under sudo schedules discovery only (not a daily full MDM
@@ -110,5 +116,34 @@ test('onboard --set-cron without sudo → schedules the full onboard run', async
   const calls = await runOnboard(false, { setCron: true });
   assert.ok(calls.cron, 'a scheduled run was set up');
   assert.equal(calls.cron.command, 'onboard', 'user scope keeps the full onboard cron');
-  assert.equal(calls.cron.discoveryKey, 'd', 'discovery key forwarded for the onboard cron');
+  // WEB-4891: the per-user cron re-runs onboard, which scans with the user's own
+  // key — so the user key is stored and no separate discovery key is.
+  assert.equal(calls.cron.apiKey, 'k', 'per-user cron stores the user API key');
+  assert.equal(calls.cron.discoveryKey, undefined, 'per-user onboard cron no longer forwards a discovery key');
+});
+
+// WEB-4891: the clean per-user path passes NO --discovery-key. It must work
+// without error, scan with the user key, and emit no deprecation warning.
+test('onboard without sudo and without --discovery-key → clean single-key path', async () => {
+  const calls = await runOnboard(false, { discoveryKey: null });
+  assert.equal(calls.user, 1, 'user bundle installed');
+  assert.equal(calls.discovery, 1, 'discovery runs');
+  assert.equal(calls.discoveryArgs.apiKey, 'resolved-key', 'scans with the user API key');
+  assert.equal(
+    calls.warns.filter((w) => /discovery-key is deprecated/.test(w)).length,
+    0,
+    'no deprecation warning when --discovery-key is omitted',
+  );
+});
+
+// Passing --discovery-key in user scope is deprecated: it is ignored (the scan
+// still uses the user key) and exactly one deprecation warning is emitted.
+test('onboard without sudo WITH --discovery-key → ignored + deprecation warning', async () => {
+  const calls = await runOnboard(false, { discoveryKey: 'd' });
+  assert.equal(calls.discoveryArgs.apiKey, 'resolved-key', 'still scans with the user API key, not the discovery key');
+  assert.equal(
+    calls.warns.filter((w) => /discovery-key is deprecated/.test(w)).length,
+    1,
+    'emits exactly one deprecation warning',
+  );
 });

package/test/setup-args.test.js

@@ -130,8 +130,8 @@ test('buildScriptArgs: mdm clear without key emits --clear and no --api-key/--do
 test('resolveSetupAllTools(false): install bundle is subscription-only, no gateway/gemini', () => {
   const tools = resolveSetupAllTools(false);
   // Membership + length (order-independent) so reordering SETUP_ALL_TOOLS doesn't break this.
-  assert.equal(tools.length, 4, `expected 4 tools, got ${tools.join(',')}`);
-  for (const t of ['cursor', 'claude-code-subscription', 'codex-subscription', 'copilot']) {
+  assert.equal(tools.length, 5, `expected 5 tools, got ${tools.join(',')}`);
+  for (const t of ['cursor', 'claude-code-subscription', 'codex-subscription', 'copilot', 'augment']) {
     assert.ok(tools.includes(t), `install bundle missing ${t}: ${tools.join(',')}`);
   }
   assert.ok(!tools.includes('claude-code-gateway'), tools.join(','));
@@ -141,7 +141,7 @@ test('resolveSetupAllTools(false): install bundle is subscription-only, no gatew
 
 test('resolveSetupAllTools(true): clear-all covers every tool incl. gateway modes + gemini', () => {
   const tools = resolveSetupAllTools(true);
-  for (const t of ['cursor', 'copilot', 'claude-code-subscription', 'claude-code-gateway',
+  for (const t of ['cursor', 'copilot', 'augment', 'claude-code-subscription', 'claude-code-gateway',
                    'gemini-cli', 'codex-subscription', 'codex-gateway']) {
     assert.ok(tools.includes(t), `clear-all missing ${t}: ${tools.join(',')}`);
   }

package/test/tool-health.test.js

@@ -188,6 +188,70 @@ test('MDM: a user-level install takes precedence over an MDM config', () => {
   });
 });
 
+test('augment user install: ~/.augment settings + hook + key → healthy (user scope, not mdm)', () => {
+  withHome((tmp, th) => {
+    writeFile(path.join(tmp, '.augment', 'settings.json'), JSON.stringify({ hooks: { PreToolUse: [{ hooks: [{ command: path.join(tmp, '.augment', 'hooks', 'unbound.py') }] }] } }));
+    writeFile(path.join(tmp, '.augment', 'hooks', 'unbound.py'), '#');
+    process.env.UNBOUND_AUGMENT_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'augment');
+      assert.equal(t.status, 'healthy');
+      assert.notEqual(t.scope, 'mdm');
+    } finally { delete process.env.UNBOUND_AUGMENT_API_KEY; }
+  });
+});
+
+test('augment user install: JSONC settings (a // comment strict JSON.parse rejects) still detected via raw-text marker → healthy', () => {
+  withHome((tmp, th) => {
+    const scriptPath = path.join(tmp, '.augment', 'hooks', 'unbound.py');
+    const jsonc = `{\n  // unbound hook (JSONC comment)\n  "hooks": { "PreToolUse": [{ "hooks": [{ "command": ${JSON.stringify(scriptPath)} }] }] }\n}`;
+    writeFile(path.join(tmp, '.augment', 'settings.json'), jsonc);
+    writeFile(scriptPath, '#');
+    process.env.UNBOUND_AUGMENT_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'augment');
+      assert.equal(t.status, 'healthy');
+    } finally { delete process.env.UNBOUND_AUGMENT_API_KEY; }
+  });
+});
+
+test('augment user install: settings point at the unbound-hook binary + binary present → healthy (not tampered, not mdm)', () => {
+  withHome((tmp, th) => {
+    const bin = path.join(tmp, 'opt', 'unbound-hook', 'unbound-hook');
+    writeFile(bin, '#');
+    writeFile(path.join(tmp, '.augment', 'settings.json'), JSON.stringify({ hooks: { PreToolUse: [{ hooks: [{ command: `"${bin}" hook augment PreToolUse` }] }] } }));
+    process.env.UNBOUND_AUGMENT_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k', _binaryPath: bin }).find((x) => x.family === 'augment');
+      assert.equal(t.status, 'healthy');
+      assert.notEqual(t.scope, 'mdm');
+    } finally { delete process.env.UNBOUND_AUGMENT_API_KEY; }
+  });
+});
+
+test('MDM: augment managed config (python) references unbound + hook present → managed by MDM', () => {
+  withHome((tmp, th) => {
+    const mdmDir = path.join(tmp, 'mdm', 'Augment');
+    writeFile(path.join(mdmDir, 'settings.json'), JSON.stringify({ hooks: { PreToolUse: [{ hooks: [{ command: path.join(mdmDir, 'hooks', 'unbound.py') }] }] } }));
+    writeFile(path.join(mdmDir, 'hooks', 'unbound.py'), '#');
+    const t = th.detectTools({ apiKey: 'k', _mdmDirs: { augment: mdmDir } }).find((x) => x.family === 'augment');
+    assert.equal(t.status, 'managed-by-mdm');
+    assert.equal(t.scope, 'mdm');
+  });
+});
+
+test('MDM: augment managed config (binary) references the hook binary + binary present → managed by MDM', () => {
+  withHome((tmp, th) => {
+    const mdmDir = path.join(tmp, 'mdm', 'Augment');
+    const bin = path.join(tmp, 'opt', 'unbound-hook', 'unbound-hook');
+    writeFile(bin, '#');
+    writeFile(path.join(mdmDir, 'settings.json'), JSON.stringify({ hooks: { PreToolUse: [{ hooks: [{ command: `"${bin}" hook augment PreToolUse` }] }] } }));
+    const t = th.detectTools({ apiKey: 'k', _mdmDirs: { augment: mdmDir }, _binaryPath: bin }).find((x) => x.family === 'augment');
+    assert.equal(t.status, 'managed-by-mdm');
+    assert.equal(t.scope, 'mdm');
+  });
+});
+
 test('codex subscription: hooks.json + script present but the feature flag is off → tampered', () => {
   withHome((tmp, th) => {
     writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({ hooks: { x: [{ command: path.join(tmp, '.codex', 'hooks', 'unbound.py') }] } }));
@@ -206,10 +270,10 @@ test('copilot has no MDM scope — even with a managed dir it never reports mana
   });
 });
 
-test('only four tools are reported (Gemini CLI is omitted)', () => {
+test('only five tools are reported (Gemini CLI is omitted)', () => {
   withHome((tmp, th) => {
     const keys = th.detectTools({ apiKey: 'k' }).map((t) => t.family);
-    assert.deepEqual(new Set(keys), new Set(['cursor', 'claude-code', 'codex', 'copilot']));
+    assert.deepEqual(new Set(keys), new Set(['cursor', 'claude-code', 'codex', 'copilot', 'augment']));
   });
 });