Usage Not Showing Up

python3 - <<'EOF'
import json, os
helper = False
try:
    value = json.load(open(os.path.expanduser('~/.claude/settings.json'))).get('apiKeyHelper')
    # Only Unbound's own helper means gateway mode. The subscription install
    # deliberately leaves a helper your org wrote in place, so a bare
    # "apiKeyHelper is set" test would misread that machine as gateway.
    helper = isinstance(value, str) and value.strip().endswith('anthropic_key.sh')
except Exception:
    pass
base = bool(os.environ.get('ANTHROPIC_BASE_URL'))
print('mode: GATEWAY' if (helper or base) else 'mode: SUBSCRIPTION (hooks)')
EOF

unbound status

python3 - <<'EOF'
import json, os
paths = [os.path.expanduser('~/.claude/settings.json'),
         '/Library/Application Support/ClaudeCode/managed-settings.json',
         '/etc/claude-code/managed-settings.json',
         os.path.expandvars(r'%ProgramFiles%\ClaudeCode\managed-settings.d\unbound.json'),
         os.path.expandvars(r'%ProgramFiles%\ClaudeCode\managed-settings.json')]
expected = ['PreToolUse','PostToolUse','UserPromptSubmit','Stop','SessionStart','SessionEnd']
found = False
for p in paths:
    if not os.path.exists(p):
        continue
    try:
        s = json.load(open(p))
    except json.JSONDecodeError as e:
        print(f'FAIL {p} is malformed JSON: {e}')
        continue
    hooks = s.get('hooks') or {}
    if 'unbound.py' not in json.dumps(hooks):
        continue
    found = True
    print(f'install locus: {p}')
    for ev in expected:
        cmds = [h.get('command','') for grp in hooks.get(ev, []) for h in grp.get('hooks', [])]
        print(f"{'PASS' if any('unbound.py' in c for c in cmds) else 'FAIL'} hook event {ev}")
    break
if not found:
    print('FAIL no Unbound hooks wired in user or managed settings')
try:
    user = json.load(open(os.path.expanduser('~/.claude/settings.json')))
    helper = user.get('apiKeyHelper')
    # Unbound's gateway helper is the one at <config dir>/anthropic_key.sh. A helper
    # your organization wrote is not residue — the subscription install leaves it alone.
    ours = isinstance(helper, str) and helper.strip().endswith('anthropic_key.sh')
    print(f"{'FAIL' if ours else 'PASS'} no Unbound gateway apiKeyHelper (must be absent in subscription mode)")
except Exception:
    print('PASS no Unbound gateway apiKeyHelper (no user settings.json)')
EOF

FOUND=0
for p in ~/.claude/hooks/unbound.py "/Library/Application Support/ClaudeCode/hooks/unbound.py" \
         /etc/claude-code/hooks/unbound.py "${PROGRAMFILES:-/nonexistent}/ClaudeCode/hooks/unbound.py"; do
  [ -f "$p" ] && { ls -l "$p"; FOUND=1; }
done
[ "$FOUND" = "1" ] || echo "FAIL hook script absent at every known location"

[ -n "$UNBOUND_CLAUDE_API_KEY" ] && echo "env: <set>" || echo "env: <unset>"
ls -l ~/.unbound/config.json 2>/dev/null
python3 - <<'EOF'
import json, os
p = os.path.expanduser('~/.unbound/config.json')
try:
    key = json.load(open(p)).get('api_key')
    print('config.json key:', 'present' if key else 'MISSING')
except FileNotFoundError:
    print('config.json key: MISSING (file not found)')
except PermissionError:
    print('config.json key: UNREADABLE (permission denied; check the ls -l owner above)')
except json.JSONDecodeError:
    print('config.json key: MISSING (file is malformed JSON)')
EOF

echo "ANTHROPIC_BASE_URL: ${ANTHROPIC_BASE_URL:-<unset>}"
[ -n "$UNBOUND_API_KEY" ] && echo "UNBOUND_API_KEY: <set>" || echo "UNBOUND_API_KEY: <unset>"
ls ~/.claude/anthropic_key.sh 2>/dev/null && echo "FAIL gateway key helper still present" || echo "PASS no gateway key helper"
cat ~/.zshrc ~/.zprofile ~/.bashrc ~/.bash_profile 2>/dev/null | grep -nE '^[[:space:]]*(export[[:space:]]+)?(ANTHROPIC_BASE_URL|UNBOUND_API_KEY)=' | sed -E 's/=.*/=<redacted>/' | grep . || echo "PASS no gateway exports in rc files"

ls -la ~/.claude/hooks/
[ -f ~/.claude/hooks/error.log ] && sed -E 's/Bearer [A-Za-z0-9._-]+/Bearer [REDACTED]/g' ~/.claude/hooks/error.log | tail -20 || echo "no error.log (hook has never logged an error, or never ran)"
python3 - <<'EOF'
import json, os
p = os.path.expanduser('~/.claude/hooks/agent-audit.log')
try:
    lines = open(p).read().splitlines()[-5:]
except FileNotFoundError:
    print('no agent-audit.log (hook has likely never executed)')
    raise SystemExit
for ln in lines:
    try:
        e = json.loads(ln)
        print(e.get('timestamp', '?'), e.get('event', {}).get('hook_event_name', '?'))
    except Exception:
        print('(unparseable line)')
EOF

curl -sS --max-time 15 -o /dev/null -w "unbound api: HTTP %{http_code}\n" https://api.getunbound.ai/v1/models
curl -sS -L --max-time 15 -o /dev/null -w "setup download host: HTTP %{http_code}\n" https://raw.githubusercontent.com/websentry-ai/setup/refs/heads/main/claude-code/hooks/setup.py

HOOK="$HOME/.claude/hooks/unbound.py"
[ -f "$HOOK" ] || HOOK="/Library/Application Support/ClaudeCode/hooks/unbound.py"
[ -f "$HOOK" ] || HOOK="/etc/claude-code/hooks/unbound.py"
[ -f "$HOOK" ] || HOOK="${PROGRAMFILES:-/nonexistent}/ClaudeCode/hooks/unbound.py"
[ -f "$HOOK" ] || { echo "FAIL hook script not found at any known location (go to Fix 2)"; exit 1; }
SID="unbound-diag-$(date +%s)"
echo "{\"hook_event_name\":\"UserPromptSubmit\",\"session_id\":\"$SID\",\"prompt\":\"[unbound-diagnostic] telemetry self-test, please ignore\"}" | python3 "$HOOK"
echo "{\"hook_event_name\":\"Stop\",\"session_id\":\"$SID\",\"last_assistant_message\":\"[unbound-diagnostic] synthetic reply\"}" | python3 "$HOOK"
sleep 1; tail -3 ~/.claude/hooks/error.log 2>/dev/null || echo "no error.log"

python3 - <<'EOF'
import json, os
paths = [
    (os.path.expanduser('~/.claude/remote-settings.json'), 'cloud policy (set in your Claude admin console)'),
    ('/Library/Application Support/ClaudeCode/managed-settings.json', 'device policy (macOS)'),
    (os.path.expandvars(r'%ProgramFiles%\ClaudeCode\managed-settings.d\unbound.json'), 'device policy (Windows, drop-in)'),
    (os.path.expandvars(r'%ProgramFiles%\ClaudeCode\managed-settings.json'), 'device policy (Windows)'),
    ('/etc/claude-code/managed-settings.json', 'device policy (Linux)'),
]
flagged = False
cloud_active = False
for i, (p, label) in enumerate(paths):
    is_cloud = i == 0
    if not os.path.exists(p):
        print(f'absent   {label}')
        continue
    try:
        s = json.load(open(p))
    except Exception as e:
        print(f'present  {label}: unreadable or malformed ({e})')
        continue
    # allowManagedHooksOnly is nested under "permissions"; disableAllHooks sits at the
    # top level. Read both places for both keys — a top-level-only test would report a
    # real restriction as restrictions=None, and PASS a machine that is carrying one.
    perms = s.get('permissions') if isinstance(s.get('permissions'), dict) else {}
    keys = {k: (s[k] if k in s else perms[k])
            for k in ('disableAllHooks', 'allowManagedHooksOnly') if k in s or k in perms}
    wired = 'unbound.py' in json.dumps(s.get('hooks') or {})
    if is_cloud and isinstance(s, dict) and s:
        cloud_active = True
    line = f'present  {label}: restrictions={keys or None} unbound_hooks_inside={"yes" if wired else "no"}'
    if not is_cloud and cloud_active:
        line += ' (a non-empty cloud policy file is present too)'
    print(line)
    if keys.get('disableAllHooks') or (keys.get('allowManagedHooksOnly') and not wired):
        flagged = True
print('FAIL an organization policy on this machine carries a hook restriction (decision row D2)' if flagged else 'PASS no organization policy here restricts hooks')
EOF

unbound setup --all --clear     # removes every tool's Unbound config (both modes)
unbound setup --all             # reinstalls Unbound config for Cursor, Claude Code, Codex, Copilot, Augment

unbound nuke          # removes Unbound from every tool, user-level (asks to confirm)
# sudo unbound nuke   # use instead if your install was MDM/system-level