unbound-cli 1.7.1 → 1.9.0

package/README.md

@@ -65,7 +65,7 @@ Interactive batch setup:
 | Command | Description |
 |---------|-------------|
 | `unbound setup` | Select and install multiple tools interactively |
-| `unbound setup --all` | Install the default bundle: Cursor + Claude Code hooks + Codex hooks |
+| `unbound setup --all` | Install the default bundle: Cursor + Copilot + Augment + Claude Code hooks + Codex hooks |
 
 Automated setup (downloads scripts, sets env vars, configures tool):
 
@@ -73,6 +73,7 @@ Automated setup (downloads scripts, sets env vars, configures tool):
 |---------|-------------|
 | `unbound setup cursor` | Download hooks, set env, restart Cursor |
 | `unbound setup copilot` | Download hooks, set env, configure GitHub Copilot |
+| `unbound setup augment` | Download hooks, set env, configure Augment Code |
 | `unbound setup claude-code` | Interactive mode selection (subscription or gateway) |
 | `unbound setup claude-code --subscription` | Hooks only (keep your Claude subscription) |
 | `unbound setup claude-code --gateway` | Use Unbound as the AI provider |
@@ -96,6 +97,7 @@ Remove configuration:
 |---------|-------------|
 | `unbound setup cursor --clear` | Remove Unbound config for Cursor |
 | `unbound setup copilot --clear` | Remove Unbound config for GitHub Copilot |
+| `unbound setup augment --clear` | Remove Unbound config for Augment Code |
 | `unbound setup claude-code --clear` | Remove Unbound config for Claude Code |
 | `unbound setup gemini-cli --clear` | Remove Unbound config for Gemini CLI |
 | `unbound setup codex --clear` | Remove Unbound config for Codex |
@@ -110,7 +112,7 @@ Configure all users on a device via MDM. Requires root.
 | `sudo unbound setup --api-key KEY cursor codex-subscription` | Set up specific tools |
 | `sudo unbound setup --clear cursor` | Remove config for specific tools |
 
-Available tools: `cursor`, `copilot`, `claude-code-subscription`, `claude-code-gateway`, `gemini-cli`, `codex-subscription`, `codex-gateway`
+Available tools: `cursor`, `copilot`, `augment`, `claude-code-subscription`, `claude-code-gateway`, `gemini-cli`, `codex-subscription`, `codex-gateway`
 
 `claude-code-subscription` and `claude-code-gateway` are mutually exclusive. `codex-subscription` and `codex-gateway` are mutually exclusive. When using `--all`, subscription mode is used by default for Claude Code and Codex.
 
@@ -252,7 +254,7 @@ Alias: `unbound groups` works the same as `unbound user-groups`.
 | `unbound tools connect <type>` | Connect a tool |
 | `unbound tools approved` | List approved tool types |
 
-Supported tool types: `CLAUDE_CODE`, `UNBOUND_CLAUDE_CODE`, `CURSOR`, `COPILOT`, `ROO_CODE`, `CLINE`, `GEMINI_CLI`, `CODEX`, `UNBOUND_CODEX`, `KILO_CODE`, `CUSTOM_ACCESS`
+Supported tool types: `CLAUDE_CODE`, `UNBOUND_CLAUDE_CODE`, `CURSOR`, `COPILOT`, `AUGMENT_CODE`, `ROO_CODE`, `CLINE`, `GEMINI_CLI`, `CODEX`, `UNBOUND_CODEX`, `KILO_CODE`, `CUSTOM_ACCESS`
 
 ## Configuration
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.7.1",
+  "version": "1.9.0",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/setup.js

@@ -29,6 +29,7 @@ function isWindowsNative() {
 const SETUP_TOOLS = [
   { label: 'Cursor', value: 'cursor', script: 'cursor/setup.py' },
   { label: 'GitHub Copilot', value: 'copilot', script: 'copilot/hooks/setup.py' },
+  { label: 'Augment Code', value: 'augment', script: 'augment/hooks/setup.py' },
   { label: 'Claude Code \u2014 subscription (hooks)', value: 'claude-sub', script: 'claude-code/hooks/setup.py', group: 'claude-code' },
   { label: 'Claude Code \u2014 gateway (gateway)', value: 'claude-gw', script: 'claude-code/gateway/setup.py', group: 'claude-code' },
   { label: 'Gemini CLI', value: 'gemini', script: 'gemini-cli/gateway/setup.py' },
@@ -41,6 +42,7 @@ const SETUP_TOOLS = [
 const MDM_TOOLS = {
   'cursor':                   { label: 'Cursor',                script: 'cursor/mdm/setup.py' },
   'copilot':                  { label: 'GitHub Copilot',        script: 'copilot/hooks/mdm/setup.py' },
+  'augment':                  { label: 'Augment Code',          script: 'augment/hooks/mdm/setup.py' },
   'claude-code-subscription': { label: 'Claude Code',           script: 'claude-code/hooks/mdm/setup.py' },
   'claude-code-gateway':      { label: 'Claude Code (gateway)', script: 'claude-code/gateway/mdm/setup.py' },
   'gemini-cli':               { label: 'Gemini CLI',            script: 'gemini-cli/gateway/mdm/setup.py' },
@@ -49,21 +51,22 @@ const MDM_TOOLS = {
 };
 
 // Default MDM tools for `sudo unbound onboard` (subscription mode for Claude Code/Codex since only one can be active)
-const MDM_ALL_TOOLS = ['cursor', 'claude-code-subscription', 'gemini-cli', 'codex-subscription', 'copilot'];
+const MDM_ALL_TOOLS = ['cursor', 'claude-code-subscription', 'gemini-cli', 'codex-subscription', 'copilot', 'augment'];
 
 // Tools for `sudo unbound setup --all` — identical to MDM_ALL_TOOLS today; split kept for future flexibility.
-const MDM_SETUP_ALL_TOOLS = ['cursor', 'claude-code-subscription', 'gemini-cli', 'codex-subscription', 'copilot'];
+const MDM_SETUP_ALL_TOOLS = ['cursor', 'claude-code-subscription', 'gemini-cli', 'codex-subscription', 'copilot', 'augment'];
 
 // Default tools for `unbound onboard` (Cursor, Claude Code hooks, Codex hooks, Copilot hooks; no Gemini CLI).
-const ALL_TOOLS = ['cursor', 'claude-code-subscription', 'codex-subscription', 'copilot'];
+const ALL_TOOLS = ['cursor', 'claude-code-subscription', 'codex-subscription', 'copilot', 'augment'];
 
 // Tools for `unbound setup --all` — identical to ALL_TOOLS today; split kept for future flexibility.
-const SETUP_ALL_TOOLS = ['cursor', 'claude-code-subscription', 'codex-subscription', 'copilot'];
+const SETUP_ALL_TOOLS = ['cursor', 'claude-code-subscription', 'codex-subscription', 'copilot', 'augment'];
 
 // Tool name → script mapping for automated tools
 const SETUP_TOOL_MAP = {
   'cursor':                   { label: 'Cursor',                script: 'cursor/setup.py' },
   'copilot':                  { label: 'GitHub Copilot',        script: 'copilot/hooks/setup.py' },
+  'augment':                  { label: 'Augment Code',          script: 'augment/hooks/setup.py' },
   'claude-code-subscription': { label: 'Claude Code',           script: 'claude-code/hooks/setup.py' },
   'claude-code-gateway':      { label: 'Claude Code (gateway)', script: 'claude-code/gateway/setup.py' },
   'gemini-cli':               { label: 'Gemini CLI',            script: 'gemini-cli/gateway/setup.py' },
@@ -327,6 +330,7 @@ const NUKE_ENV_VARS = [
   'UNBOUND_CODEX_API_KEY',
   'UNBOUND_COPILOT_API_KEY',
   'UNBOUND_CURSOR_API_KEY',
+  'UNBOUND_AUGMENT_API_KEY',
   'ANTHROPIC_BASE_URL',
 ];
 
@@ -444,6 +448,45 @@ function removeBinaryInstall({
   return { removed, failed };
 }
 
+
+// Run the binary's own `unbound-hook clear` to deregister managed configs
+// (strip our hooks from shared configs, remove our scripts + per-tool logs)
+// BEFORE the install tree is deleted. Essential on binary-only machines that
+// have no python3 to run the downloaded per-tool clears, and authoritative for
+// binary installs generally — it reuses the same clear_setup() as the python
+// clears. Fail-open: never throws; returns { ran, ok }. `binaryPath`/`runner`
+// are overridable so tests stay hermetic.
+function runBinaryClear({
+  binaryPath = path.join(BINARY_INSTALL_PATHS.optDir, 'current', 'unbound-hook', 'unbound-hook'),
+  runner = spawnSync,
+} = {}) {
+  // lstatSync (not existsSync, which follows symlinks) so a present-but-broken
+  // `current/...` symlink is still detected — we attempt the clear and surface
+  // the failure instead of silently skipping it. A truly absent path (python-only
+  // install) throws → no-op.
+  let present = false;
+  try { fs.lstatSync(binaryPath); present = true; } catch (e) { present = false; }
+  if (!present) return { ran: false, ok: true };
+  try {
+    // timeout so a hung clear can never block nuke from removing the binary.
+    const r = runner(binaryPath, ['clear'], { stdio: 'pipe', timeout: 120000, killSignal: 'SIGKILL' });
+    if (r.error) {
+      const why = r.error.code === 'ETIMEDOUT' ? 'timed out (120s)' : r.error.message;
+      output.warn(`nuke: unbound-hook clear ${why}; continuing.`);
+      return { ran: true, ok: false };
+    }
+    if (r.status !== 0) {
+      const stderr = r.stderr ? r.stderr.toString().trim() : '';
+      output.warn(`nuke: unbound-hook clear exited ${r.status}: ${stderr || '(no stderr)'}`);
+      return { ran: true, ok: false };
+    }
+    return { ran: true, ok: true };
+  } catch (err) {
+    output.warn(`nuke: unbound-hook clear errored: ${err.message}`);
+    return { ran: true, ok: false };
+  }
+}
+
 /**
  * Returns true when the process has the privileges needed to touch system-level
  * (MDM) configuration. On Windows, `net session` succeeds only when elevated, so
@@ -585,6 +628,7 @@ Scope is chosen automatically from your privileges:
 Available tools:
   cursor                    Cursor IDE
   copilot                   GitHub Copilot
+  augment                   Augment Code
   claude-code               Claude Code (use --subscription or --gateway)
   gemini-cli                Gemini CLI
   codex                     Codex (use --subscription or --gateway)
@@ -603,11 +647,12 @@ Examples:
   Single tool:
   $ unbound setup cursor                                   Set up Cursor
   $ unbound setup copilot                                  Set up GitHub Copilot
+  $ unbound setup augment                                  Set up Augment Code
   $ unbound setup claude-code --gateway                    Claude Code gateway mode
   $ unbound setup claude-code --subscription               Claude Code hooks only
   $ unbound setup codex --gateway                          Codex gateway mode
 
-  Install the default bundle (Cursor + Copilot + Claude Code hooks + Codex hooks):
+  Install the default bundle (Cursor + Copilot + Augment + Claude Code hooks + Codex hooks):
   $ unbound setup --all                                    Set up the default bundle
   $ unbound setup --all --api-key <key>                    Login + set up the bundle
 
@@ -1041,8 +1086,13 @@ Examples:
           // `_confirmProductionPaths` is the explicit "this is the real call site"
           // ack — the function refuses production defaults without it as a guard
           // against tests forgetting to override paths.
+          // Deregister managed configs via the binary's own clear FIRST (works
+          // without python3, which a binary-only machine lacks); reuses the same
+          // clear_setup() as the python clears. Must precede the rm below.
+          const binClear = runBinaryClear();
           const { removed: binaryRemoved, failed: bf } = removeBinaryInstall({ _confirmProductionPaths: true });
           binaryFailed = bf;
+          if (binClear.ran && !binClear.ok) binaryFailed.push('unbound-hook clear');
           if (binaryRemoved.length) {
             output.info(`Removed binary install: ${binaryRemoved.join('; ')}.`);
           }
@@ -1135,5 +1185,6 @@ module.exports = {
   clearUnboundEnvsEverywhere,
   NUKE_ENV_VARS,
   removeBinaryInstall,
+  runBinaryClear,
   BINARY_INSTALL_PATHS,
 };

package/src/commands/tools.js

@@ -7,6 +7,7 @@ const SUPPORTED_TOOL_TYPES = [
   'CLAUDE_CODE',
   'CURSOR',
   'COPILOT',
+  'AUGMENT_CODE',
   'ROO_CODE',
   'CLINE',
   'GEMINI_CLI',

package/src/index.js

@@ -60,9 +60,10 @@ ONBOARDING (one-step install + discover; scope auto-detected from sudo)
 
 TOOL SETUP
   $ unbound setup                          Select and install multiple tools interactively
-  $ unbound setup --all                    Set up the default bundle (Cursor + Copilot + Claude Code hooks + Codex hooks)
+  $ unbound setup --all                    Set up the default bundle (Cursor + Copilot + Augment + Claude Code hooks + Codex hooks)
   $ unbound setup cursor                   Set up Cursor
   $ unbound setup copilot                  Set up GitHub Copilot
+  $ unbound setup augment                  Set up Augment Code
   $ unbound setup claude-code              Set up Claude Code (interactive mode selection)
   $ unbound setup claude-code --gateway    Use Unbound as AI provider
   $ unbound setup claude-code --subscription  Hooks only (keep your subscription)
@@ -86,6 +87,7 @@ TOOL SETUP
   Remove configuration (no API key needed to clear):
   $ unbound setup cursor --clear           Remove Unbound config for Cursor
   $ unbound setup copilot --clear          Remove Unbound config for GitHub Copilot
+  $ unbound setup augment --clear          Remove Unbound config for Augment Code
   $ unbound setup claude-code --clear      Remove Unbound config for Claude Code
   $ unbound setup gemini-cli --clear       Remove Unbound config for Gemini CLI
   $ unbound setup codex --clear            Remove Unbound config for Codex

package/src/toolHealth.js

@@ -181,10 +181,10 @@ function envCheck(label, name, expected, kind = 'aux') {
 // and a managed config that points at a missing hook script is a broken (tampered)
 // MDM install, not a healthy one. Returns { status: 'healthy'|'tampered'|null, checks }.
 function mdmDetect(family, dirOverride, binaryPath) {
-  // Only Cursor / Claude Code / Codex have a managed (MDM) directory. Copilot and
-  // Gemini have none — their org install writes the same per-user config into
-  // every profile, so they're checked exactly like a user-level tool.
-  const configName = { cursor: 'hooks.json', 'claude-code': 'managed-settings.json', codex: 'managed-settings.json' };
+  // Only Cursor / Claude Code / Codex / Augment have a managed (MDM) directory.
+  // Copilot and Gemini have none — their org install writes the same per-user
+  // config into every profile, so they're checked exactly like a user-level tool.
+  const configName = { cursor: 'hooks.json', 'claude-code': 'managed-settings.json', codex: 'managed-settings.json', augment: 'settings.json' };
   if (!configName[family]) return { status: null, checks: [] };
 
   const mac = '/Library/Application Support';
@@ -193,6 +193,9 @@ function mdmDetect(family, dirOverride, binaryPath) {
     cursor: { darwin: `${mac}/Cursor`, linux: '/etc/cursor', win32: path.join(win, 'Cursor') },
     'claude-code': { darwin: `${mac}/ClaudeCode`, linux: '/etc/claude-code', win32: path.join(win, 'ClaudeCode') },
     codex: { darwin: `${mac}/Codex`, linux: '/etc/codex', win32: path.join(win, 'Codex') },
+    // Augment's managed dir is /etc/augment on BOTH macOS and Linux (mirrors the
+    // setup repo's get_managed_settings_dir), not Library/Application Support.
+    augment: { darwin: '/etc/augment', linux: '/etc/augment', win32: path.join(win, 'Augment') },
   };
   const dir = dirOverride || dirs[family][process.platform] || dirs[family].linux;
   const configPath = path.join(dir, configName[family]);
@@ -305,6 +308,23 @@ function buildVariants(gatewayUrl, binaryPath) {
         return checks;
       },
     },
+    {
+      key: 'augment', label: 'Augment Code', family: 'augment', mode: null,
+      checks: () => {
+        // ~/.augment/settings.json is shared with the user's own Augment config and may be
+        // JSONC, so match the Unbound hook marker on RAW TEXT (not strict JSON). Like
+        // copilot, a user install can point at the python unbound.py hook OR the shared
+        // unbound-hook binary — check whichever the config references so a binary-backed
+        // install isn't misread as tampered.
+        const cfgText = readText('~/.augment/settings.json');
+        const hasBinary = cfgText != null && cfgText.includes(BINARY_MARKER);
+        const checks = [configCheck('Config', '~/.augment/settings.json', { json: false, test: (t) => t.includes('unbound.py') || t.includes(BINARY_MARKER) })];
+        if (hasBinary) checks.push(scriptCheck('Hook binary', binaryPath || BINARY_PATH));
+        else checks.push(scriptCheck('Hook script', '~/.augment/hooks/unbound.py'));
+        checks.push(envKeyCheck('API key env', 'UNBOUND_AUGMENT_API_KEY'));
+        return checks;
+      },
+    },
     // Gemini CLI is intentionally omitted here — it isn't part of `setup --all`
     // and has no managed directory. Add it back when its scope is settled.
   ];

package/test/setup-args.test.js

@@ -3,7 +3,7 @@ const assert = require('node:assert/strict');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { buildScriptArgs, scriptSupportsBackfill, resolveSetupAllTools, clearUnboundEnvsEverywhere, NUKE_ENV_VARS, removeBinaryInstall, BINARY_INSTALL_PATHS } = require('../src/commands/setup');
+const { buildScriptArgs, scriptSupportsBackfill, resolveSetupAllTools, clearUnboundEnvsEverywhere, NUKE_ENV_VARS, removeBinaryInstall, runBinaryClear, BINARY_INSTALL_PATHS } = require('../src/commands/setup');
 
 // shellEscape single-quotes every value, so a real key surfaces as
 // --api-key '<key>' at the head of the argv tail.
@@ -130,8 +130,8 @@ test('buildScriptArgs: mdm clear without key emits --clear and no --api-key/--do
 test('resolveSetupAllTools(false): install bundle is subscription-only, no gateway/gemini', () => {
   const tools = resolveSetupAllTools(false);
   // Membership + length (order-independent) so reordering SETUP_ALL_TOOLS doesn't break this.
-  assert.equal(tools.length, 4, `expected 4 tools, got ${tools.join(',')}`);
-  for (const t of ['cursor', 'claude-code-subscription', 'codex-subscription', 'copilot']) {
+  assert.equal(tools.length, 5, `expected 5 tools, got ${tools.join(',')}`);
+  for (const t of ['cursor', 'claude-code-subscription', 'codex-subscription', 'copilot', 'augment']) {
     assert.ok(tools.includes(t), `install bundle missing ${t}: ${tools.join(',')}`);
   }
   assert.ok(!tools.includes('claude-code-gateway'), tools.join(','));
@@ -141,7 +141,7 @@ test('resolveSetupAllTools(false): install bundle is subscription-only, no gatew
 
 test('resolveSetupAllTools(true): clear-all covers every tool incl. gateway modes + gemini', () => {
   const tools = resolveSetupAllTools(true);
-  for (const t of ['cursor', 'copilot', 'claude-code-subscription', 'claude-code-gateway',
+  for (const t of ['cursor', 'copilot', 'augment', 'claude-code-subscription', 'claude-code-gateway',
                    'gemini-cli', 'codex-subscription', 'codex-gateway']) {
     assert.ok(tools.includes(t), `clear-all missing ${t}: ${tools.join(',')}`);
   }
@@ -396,3 +396,58 @@ test('removeBinaryInstall: refuses production-default paths without _confirmProd
 test('BINARY_INSTALL_PATHS: is frozen', () => {
   assert.ok(Object.isFrozen(BINARY_INSTALL_PATHS));
 });
+
+test('runBinaryClear: binary present — runs `<bin> clear` before removal, reports ok', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-binclear-'));
+  const bin = path.join(tmp, 'unbound-hook');
+  fs.writeFileSync(bin, '#');
+  const calls = [];
+  try {
+    const r = runBinaryClear({ binaryPath: bin, runner: (b, args, opts) => { calls.push([b, args, opts]); return { status: 0 }; } });
+    assert.deepEqual(r, { ran: true, ok: true });
+    assert.equal(calls.length, 1, 'binary clear should run exactly once');
+    assert.equal(calls[0][0], bin);
+    assert.deepEqual(calls[0][1], ['clear']);
+    assert.ok(calls[0][2].timeout > 0, 'clear must run with a timeout so a hang cannot block nuke');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('runBinaryClear: dangling binary symlink — still attempts (surfaces, not silently skipped)', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-binclear-'));
+  const link = path.join(tmp, 'unbound-hook');
+  fs.symlinkSync(path.join(tmp, 'missing-target'), link); // dangling: target absent
+  let called = false;
+  try {
+    const r = runBinaryClear({ binaryPath: link, runner: () => { called = true; return { error: { code: 'ENOENT', message: 'spawn ENOENT' } }; } });
+    assert.equal(called, true, 'a dangling symlink must still be attempted, not treated as absent');
+    assert.deepEqual(r, { ran: true, ok: false });
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('runBinaryClear: binary absent (python-only install) — no-op, runner never called', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-binclear-'));
+  let called = false;
+  try {
+    const r = runBinaryClear({ binaryPath: path.join(tmp, 'nope'), runner: () => { called = true; return { status: 0 }; } });
+    assert.deepEqual(r, { ran: false, ok: true });
+    assert.equal(called, false);
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('runBinaryClear: clear exits non-zero — fail-open (ran:true, ok:false), never throws', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-binclear-'));
+  const bin = path.join(tmp, 'unbound-hook');
+  fs.writeFileSync(bin, '#');
+  try {
+    const r = runBinaryClear({ binaryPath: bin, runner: () => ({ status: 1, stderr: Buffer.from('boom') }) });
+    assert.deepEqual(r, { ran: true, ok: false });
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});

package/test/tool-health.test.js

@@ -188,6 +188,70 @@ test('MDM: a user-level install takes precedence over an MDM config', () => {
   });
 });
 
+test('augment user install: ~/.augment settings + hook + key → healthy (user scope, not mdm)', () => {
+  withHome((tmp, th) => {
+    writeFile(path.join(tmp, '.augment', 'settings.json'), JSON.stringify({ hooks: { PreToolUse: [{ hooks: [{ command: path.join(tmp, '.augment', 'hooks', 'unbound.py') }] }] } }));
+    writeFile(path.join(tmp, '.augment', 'hooks', 'unbound.py'), '#');
+    process.env.UNBOUND_AUGMENT_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'augment');
+      assert.equal(t.status, 'healthy');
+      assert.notEqual(t.scope, 'mdm');
+    } finally { delete process.env.UNBOUND_AUGMENT_API_KEY; }
+  });
+});
+
+test('augment user install: JSONC settings (a // comment strict JSON.parse rejects) still detected via raw-text marker → healthy', () => {
+  withHome((tmp, th) => {
+    const scriptPath = path.join(tmp, '.augment', 'hooks', 'unbound.py');
+    const jsonc = `{\n  // unbound hook (JSONC comment)\n  "hooks": { "PreToolUse": [{ "hooks": [{ "command": ${JSON.stringify(scriptPath)} }] }] }\n}`;
+    writeFile(path.join(tmp, '.augment', 'settings.json'), jsonc);
+    writeFile(scriptPath, '#');
+    process.env.UNBOUND_AUGMENT_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'augment');
+      assert.equal(t.status, 'healthy');
+    } finally { delete process.env.UNBOUND_AUGMENT_API_KEY; }
+  });
+});
+
+test('augment user install: settings point at the unbound-hook binary + binary present → healthy (not tampered, not mdm)', () => {
+  withHome((tmp, th) => {
+    const bin = path.join(tmp, 'opt', 'unbound-hook', 'unbound-hook');
+    writeFile(bin, '#');
+    writeFile(path.join(tmp, '.augment', 'settings.json'), JSON.stringify({ hooks: { PreToolUse: [{ hooks: [{ command: `"${bin}" hook augment PreToolUse` }] }] } }));
+    process.env.UNBOUND_AUGMENT_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k', _binaryPath: bin }).find((x) => x.family === 'augment');
+      assert.equal(t.status, 'healthy');
+      assert.notEqual(t.scope, 'mdm');
+    } finally { delete process.env.UNBOUND_AUGMENT_API_KEY; }
+  });
+});
+
+test('MDM: augment managed config (python) references unbound + hook present → managed by MDM', () => {
+  withHome((tmp, th) => {
+    const mdmDir = path.join(tmp, 'mdm', 'Augment');
+    writeFile(path.join(mdmDir, 'settings.json'), JSON.stringify({ hooks: { PreToolUse: [{ hooks: [{ command: path.join(mdmDir, 'hooks', 'unbound.py') }] }] } }));
+    writeFile(path.join(mdmDir, 'hooks', 'unbound.py'), '#');
+    const t = th.detectTools({ apiKey: 'k', _mdmDirs: { augment: mdmDir } }).find((x) => x.family === 'augment');
+    assert.equal(t.status, 'managed-by-mdm');
+    assert.equal(t.scope, 'mdm');
+  });
+});
+
+test('MDM: augment managed config (binary) references the hook binary + binary present → managed by MDM', () => {
+  withHome((tmp, th) => {
+    const mdmDir = path.join(tmp, 'mdm', 'Augment');
+    const bin = path.join(tmp, 'opt', 'unbound-hook', 'unbound-hook');
+    writeFile(bin, '#');
+    writeFile(path.join(mdmDir, 'settings.json'), JSON.stringify({ hooks: { PreToolUse: [{ hooks: [{ command: `"${bin}" hook augment PreToolUse` }] }] } }));
+    const t = th.detectTools({ apiKey: 'k', _mdmDirs: { augment: mdmDir }, _binaryPath: bin }).find((x) => x.family === 'augment');
+    assert.equal(t.status, 'managed-by-mdm');
+    assert.equal(t.scope, 'mdm');
+  });
+});
+
 test('codex subscription: hooks.json + script present but the feature flag is off → tampered', () => {
   withHome((tmp, th) => {
     writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({ hooks: { x: [{ command: path.join(tmp, '.codex', 'hooks', 'unbound.py') }] } }));
@@ -206,10 +270,10 @@ test('copilot has no MDM scope — even with a managed dir it never reports mana
   });
 });
 
-test('only four tools are reported (Gemini CLI is omitted)', () => {
+test('only five tools are reported (Gemini CLI is omitted)', () => {
   withHome((tmp, th) => {
     const keys = th.detectTools({ apiKey: 'k' }).map((t) => t.family);
-    assert.deepEqual(new Set(keys), new Set(['cursor', 'claude-code', 'codex', 'copilot']));
+    assert.deepEqual(new Set(keys), new Set(['cursor', 'claude-code', 'codex', 'copilot', 'augment']));
   });
 });