unbound-cli 0.4.0 → 0.5.1

package/src/commands/setup.js

@@ -90,8 +90,11 @@ function buildSetupCommand(scriptPath, args) {
 /**
  * Runs a Python setup script from the setup repo with inherited stdio (live output).
  */
-function runSetupScript(scriptPath, apiKey, { clear = false } = {}) {
-  const args = `--api-key ${shellEscape(apiKey)}${clear ? ' --clear' : ''}`;
+function runSetupScript(scriptPath, apiKey, { clear = false, backendUrl, frontendUrl } = {}) {
+  let args = `--api-key ${shellEscape(apiKey)}`;
+  if (backendUrl) args += ` --backend-url ${shellEscape(backendUrl)}`;
+  if (frontendUrl) args += ` --domain ${shellEscape(frontendUrl)}`;
+  if (clear) args += ' --clear';
   console.log('');
   try {
     execSync(buildSetupCommand(scriptPath, args), { stdio: 'inherit' });
@@ -177,6 +180,8 @@ function register(program) {
     .option('--subscription', 'Use subscription mode for Claude Code / Codex (hooks only)')
     .option('--gateway', 'Use gateway mode for Claude Code / Codex (Unbound as AI provider)')
     .option('--all', 'Set up the default bundle: Cursor, Claude Code (hooks), Codex (hooks)')
+    .addOption(new Option('--backend-url <url>', 'Override backend URL for setup scripts (dev only)').hideHelp())
+    .addOption(new Option('--frontend-url <url>', 'Override frontend URL for setup scripts (dev only)').hideHelp())
     .addHelpText('after', `
 Available tools:
   cursor                    Cursor IDE
@@ -252,8 +257,11 @@ automatically to authenticate before proceeding.
           const selectedTools = SETUP_TOOLS.filter(t => selected.includes(t.value));
           console.log('');
 
+          let interactiveArgs = `--api-key ${shellEscape(apiKey)}`;
+          if (opts.backendUrl) interactiveArgs += ` --backend-url ${shellEscape(opts.backendUrl)}`;
+          if (opts.frontendUrl) interactiveArgs += ` --domain ${shellEscape(opts.frontendUrl)}`;
           const ok = await runBatch(selectedTools, (tool) =>
-            runScriptPiped(tool.script, `--api-key ${shellEscape(apiKey)}`)
+            runScriptPiped(tool.script, interactiveArgs)
           );
           if (!ok) return;
 
@@ -318,13 +326,13 @@ automatically to authenticate before proceeding.
           const toolName = tools[0];
 
           if (SETUP_TOOL_MAP[toolName]) {
-            runSetupScript(SETUP_TOOL_MAP[toolName].script, apiKey, { clear: opts.clear });
+            runSetupScript(SETUP_TOOL_MAP[toolName].script, apiKey, { clear: opts.clear, backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
           } else if (MODE_TOOLS[toolName]) {
             const mode = MODE_TOOLS[toolName];
             if (opts.clear) {
               // Clear both modes
-              runSetupScript(SETUP_TOOL_MAP[mode.subscription].script, apiKey, { clear: true });
-              runSetupScript(SETUP_TOOL_MAP[mode.gateway].script, apiKey, { clear: true });
+              runSetupScript(SETUP_TOOL_MAP[mode.subscription].script, apiKey, { clear: true, backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
+              runSetupScript(SETUP_TOOL_MAP[mode.gateway].script, apiKey, { clear: true, backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
             } else {
               let useSubscription = opts.subscription;
               if (!opts.subscription && !opts.gateway) {
@@ -332,7 +340,7 @@ automatically to authenticate before proceeding.
                 useSubscription = choice === 'subscription';
               }
               const resolved = useSubscription ? mode.subscription : mode.gateway;
-              runSetupScript(SETUP_TOOL_MAP[resolved].script, apiKey, {});
+              runSetupScript(SETUP_TOOL_MAP[resolved].script, apiKey, { backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
             }
           } else if (INSTRUCTION_TOOLS[toolName]) {
             output.keyValue(INSTRUCTION_TOOLS[toolName].values(apiKey, frontendUrl));
@@ -370,7 +378,10 @@ automatically to authenticate before proceeding.
         // Run automated tools with spinners
         if (resolvedScripts.length > 0) {
           console.log('');
-          const args = `--api-key ${shellEscape(apiKey)}${opts.clear ? ' --clear' : ''}`;
+          let args = `--api-key ${shellEscape(apiKey)}`;
+          if (opts.backendUrl) args += ` --backend-url ${shellEscape(opts.backendUrl)}`;
+          if (opts.frontendUrl) args += ` --domain ${shellEscape(opts.frontendUrl)}`;
+          if (opts.clear) args += ' --clear';
           const ok = await runBatch(resolvedScripts, (tool) =>
             runScriptPiped(tool.script, args)
           , { clear: opts.clear });
@@ -409,7 +420,6 @@ automatically to authenticate before proceeding.
     .requiredOption('--admin-api-key <key>', 'Admin API key for MDM enrollment')
     .option('--clear', 'Remove Unbound configuration for the specified tools')
     .option('--all', 'Set up all available tools')
-    .addOption(new Option('--url <url>', 'Override backend URL').hideHelp())
     .addHelpText('after', `
 Available tools:
   cursor                    Cursor IDE
@@ -429,18 +439,22 @@ Examples:
   $ sudo unbound setup mdm --admin-api-key KEY --all
   $ sudo unbound setup mdm --admin-api-key KEY --clear cursor codex-subscription
 `)
-    .action(async (tools, opts) => {
+    .action(async (tools, opts, command) => {
       try {
         checkRoot();
+        // --all and --clear are defined on both this command and the parent `setup` command;
+        // --backend-url and --frontend-url are defined only on the parent `setup` command.
+        // Use optsWithGlobals() so all four work regardless of position relative to `mdm`.
+        const globalOpts = command.optsWithGlobals();
 
-        if (opts.all && tools.length > 0) {
+        if (globalOpts.all && tools.length > 0) {
           output.error('Cannot combine --all with specific tool names. Use one or the other.');
           process.exitCode = 1;
           return;
         }
 
         let toolNames;
-        if (opts.all) {
+        if (globalOpts.all) {
           toolNames = MDM_ALL_TOOLS;
         } else if (tools.length > 0) {
           toolNames = tools;
@@ -476,20 +490,21 @@ Examples:
 
         const mdmArgs = (tool) => {
           let args = `--api-key ${shellEscape(opts.adminApiKey)}`;
-          if (opts.url) args += ` --url ${shellEscape(opts.url)}`;
-          if (opts.clear) args += ' --clear';
+          if (globalOpts.backendUrl) args += ` --backend-url ${shellEscape(globalOpts.backendUrl)}`;
+          if (globalOpts.frontendUrl) args += ` --domain ${shellEscape(globalOpts.frontendUrl)}`;
+          if (globalOpts.clear) args += ' --clear';
           return args;
         };
 
         const ok = await runBatch(
           resolvedTools,
           (tool) => runScriptPiped(tool.script, mdmArgs(tool)),
-          { clear: opts.clear }
+          { clear: globalOpts.clear }
         );
         if (!ok) return;
 
         console.log('');
-        output.success(opts.clear ? 'All tools cleared' : 'All tools configured');
+        output.success(globalOpts.clear ? 'All tools cleared' : 'All tools configured');
       } catch (err) {
         output.error(err.message);
         process.exitCode = 1;
@@ -502,9 +517,11 @@ Examples:
  * Assumes the caller has already ensured the user is logged in.
  * Returns true on success, false on failure.
  */
-async function runSetupAllBundle(apiKey) {
+async function runSetupAllBundle(apiKey, { backendUrl, frontendUrl } = {}) {
   const resolvedTools = ALL_TOOLS.map(name => ({ name, ...SETUP_TOOL_MAP[name] }));
-  const args = `--api-key ${shellEscape(apiKey)}`;
+  let args = `--api-key ${shellEscape(apiKey)}`;
+  if (backendUrl) args += ` --backend-url ${shellEscape(backendUrl)}`;
+  if (frontendUrl) args += ` --domain ${shellEscape(frontendUrl)}`;
   return runBatch(resolvedTools, (tool) => runScriptPiped(tool.script, args));
 }
 
@@ -513,10 +530,11 @@ async function runSetupAllBundle(apiKey) {
  * Caller must ensure the process is running as root.
  * Returns true on success, false on failure.
  */
-async function runMdmSetupAllBundle(adminApiKey, { url } = {}) {
+async function runMdmSetupAllBundle(adminApiKey, { backendUrl, frontendUrl } = {}) {
   const resolvedTools = MDM_ALL_TOOLS.map(name => ({ name, ...MDM_TOOLS[name] }));
   let args = `--api-key ${shellEscape(adminApiKey)}`;
-  if (url) args += ` --url ${shellEscape(url)}`;
+  if (backendUrl) args += ` --backend-url ${shellEscape(backendUrl)}`;
+  if (frontendUrl) args += ` --domain ${shellEscape(frontendUrl)}`;
   return runBatch(resolvedTools, (tool) => runScriptPiped(tool.script, args));
 }
 

package/src/index.js

@@ -73,14 +73,33 @@ MDM AI TOOLS DISCOVERY
   $ unbound discover status                           Show scan schedule and logs
 
 POLICY MANAGEMENT
-  $ unbound policy list                    List all policies
-  $ unbound policy list --type SECURITY    Filter by type (SECURITY, MODEL, COST)
-  $ unbound policy get <id>                View policy details
-  $ unbound policy create --name <n> --type <t>  Create a new policy
-  $ unbound policy update <id> --name <n>  Update a policy
+  Unbound has four policy types. Each type has its own subcommand with guided flags.
+  Docs: https://docs.getunbound.ai/policies
+
+  $ unbound policy                         Overview and subcommand list
+  $ unbound policy form-data               Reference data (user groups, models, guardrails, etc.)
+  $ unbound policy list                    List Cost/Model/Security policies
+  $ unbound policy get <id>                View a policy's details
   $ unbound policy delete <id>             Delete a policy
-  $ unbound policy effective <id>          View effective policies for a user/group
-  $ unbound policy form-data               Get reference data for policy creation
+  $ unbound policy effective <id>          View effective policies for a user or group
+
+  Cost policies — monthly budget limits per user group:
+  $ unbound policy cost create --name "Eng Budget" --monthly-budget 1000 --group engg
+
+  Model policies — control which AI models are available:
+  $ unbound policy model create --name "No Opus" --all-models --excluded claude-3-opus
+
+  Security policies — guardrails for PII/secrets and routing rules:
+  $ unbound policy security create --name "Block PII" --sub-type guardrails --guardrail PII:BLOCK
+
+  Tool policies — shell command and MCP tool controls (separate backend):
+  $ unbound policy tool list
+  $ unbound policy tool create-terminal --name "Block rm -rf" --command-family filesystem \\
+      --field command='rm -rf*' --action BLOCK --custom-message "Destructive command blocked."
+  $ unbound policy tool create-mcp --name "Audit Linear writes" --mcp-server Linear \\
+      --mcp-action-type write --action AUDIT
+  $ unbound policy tool families           Discover terminal command families
+  $ unbound policy tool mcp-servers        Discover MCP servers and their tools
 
 USER & GROUP MANAGEMENT
   $ unbound users list                     List organization members