unbound-cli 0.6.0 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/discover.js

@@ -2,17 +2,46 @@ const { spawn, execSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const https = require('https');
 const output = require('../output');
 
 const DISCOVER_BASE_URL = 'https://raw.githubusercontent.com/websentry-ai/coding-discovery-tool/refs/heads/main';
 const DEFAULT_DOMAIN = 'https://backend.getunbound.ai';
 const LAUNCH_AGENT_LABEL = 'ai.getunbound.discovery';
 
+// Native Windows (cmd/PowerShell) takes the install.ps1 path below. WSL reports
+// as Linux via process.platform and keeps using the existing bash install.sh pipe.
+function isWindowsNative() {
+  return process.platform === 'win32';
+}
+
 function isRoot() {
   if (process.platform === 'win32') return false;
   return typeof process.getuid === 'function' && process.getuid() === 0;
 }
 
+function downloadToFile(url, destPath) {
+  return new Promise((resolve, reject) => {
+    const request = (u, remaining) => {
+      https.get(u, (res) => {
+        if ([301, 302, 303, 307, 308].includes(res.statusCode) && res.headers.location && remaining > 0) {
+          res.resume();
+          return request(res.headers.location, remaining - 1);
+        }
+        if (res.statusCode !== 200) {
+          res.resume();
+          return reject(new Error(`Failed to download ${u}: HTTP ${res.statusCode}`));
+        }
+        const file = fs.createWriteStream(destPath);
+        res.pipe(file);
+        file.on('finish', () => file.close(resolve));
+        file.on('error', reject);
+      }).on('error', reject);
+    };
+    request(url, 3);
+  });
+}
+
 /**
  * Escapes a string for safe embedding in a shell command (single-quote wrap).
  * Mirrors the helper in setup.js. Required because runDiscoveryScript uses
@@ -25,8 +54,16 @@ function shellEscape(str) {
 /**
  * Downloads a bash script from the discovery repo and executes it with arguments.
  * Uses stdio: 'inherit' so the script's output is shown live.
+ *
+ * On native Windows, downloads `install.ps1` from the same repo and executes
+ * it via PowerShell instead. `scriptName` is mapped from install.sh →
+ * install.ps1 automatically; any other bash-only script (e.g.
+ * setup-scheduled-scan.sh) remains unsupported on native Windows.
  */
 function runDiscoveryScript(scriptName, args) {
+  if (isWindowsNative()) {
+    return runDiscoveryScriptWindows(scriptName, args);
+  }
   return new Promise((resolve, reject) => {
     const url = `${DISCOVER_BASE_URL}/${scriptName}`;
     const cmd = `curl -fsSL "${url}" | bash -s -- ${args}`;
@@ -45,6 +82,63 @@ function runDiscoveryScript(scriptName, args) {
   });
 }
 
+// Parse the shell-escaped args string back to argv for the Windows path.
+function parsePosixArgs(s) {
+  const out = [];
+  let cur = '', inQ = false, i = 0;
+  while (i < s.length) {
+    const c = s[i];
+    if (inQ) {
+      if (c === "'" && s.substr(i, 4) === "'\\''") { cur += "'"; i += 4; continue; }
+      if (c === "'") { inQ = false; i++; continue; }
+      cur += c; i++;
+    } else {
+      if (c === ' ') { if (cur) { out.push(cur); cur = ''; } i++; continue; }
+      if (c === "'") { inQ = true; i++; continue; }
+      cur += c; i++;
+    }
+  }
+  if (cur) out.push(cur);
+  return out;
+}
+
+async function runDiscoveryScriptWindows(scriptName, args) {
+  if (scriptName !== 'install.sh') {
+    throw new Error(
+      `"${scriptName}" is not supported on native Windows. ` +
+      `Run this command under WSL, or on macOS/Linux.`
+    );
+  }
+  const winScript = 'install.ps1';
+  const url = `${DISCOVER_BASE_URL}/${winScript}`;
+  const tmp = path.join(os.tmpdir(), `unbound-discover-${Date.now()}-${Math.random().toString(36).slice(2)}.ps1`);
+  try {
+    await downloadToFile(url, tmp);
+  } catch (err) {
+    throw new Error(
+      `${err.message}. Native Windows support requires ${winScript} in the coding-discovery-tool repo.`
+    );
+  }
+  // Map posix flags to PowerShell-style parameter names (install.ps1's convention).
+  const argv = parsePosixArgs(args).map((a) => a === '--api-key' ? '-ApiKey' : a === '--domain' ? '-Domain' : a);
+  try {
+    await new Promise((resolve, reject) => {
+      const child = spawn(
+        'powershell',
+        ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', tmp, ...argv],
+        { stdio: 'inherit', shell: false, windowsHide: true }
+      );
+      child.on('close', (code) => {
+        if (code === 0) resolve();
+        else reject(new Error(`Discovery script failed with exit code ${code}`));
+      });
+      child.on('error', reject);
+    });
+  } finally {
+    try { fs.unlinkSync(tmp); } catch { /* best-effort */ }
+  }
+}
+
 /**
  * Runs the main discovery scan (install.sh) with the given discovery key and domain.
  * Emits a warning if not running as root (scan will be limited to the current user).

package/src/commands/setup.js

@@ -1,11 +1,21 @@
-const { execSync, spawn } = require('child_process');
+const { execSync, spawn, spawnSync } = require('child_process');
 const { Option } = require('commander');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const https = require('https');
 const config = require('../config');
 const output = require('../output');
 const { ensureLoggedIn } = require('../auth');
 
 const SETUP_BASE_URL = 'https://raw.githubusercontent.com/websentry-ai/setup/refs/heads/main';
 
+// WSL reports as Linux via uname; only native Windows (cmd.exe / PowerShell)
+// takes the Windows code path. WSL keeps using the Linux curl|python3 pipe.
+function isWindowsNative() {
+  return process.platform === 'win32';
+}
+
 const SETUP_TOOLS = [
   { label: 'Cursor', value: 'cursor', script: 'cursor/setup.py' },
   { label: 'Claude Code \u2014 subscription (hooks)', value: 'claude-sub', script: 'claude-code/hooks/setup.py', group: 'claude-code' },
@@ -81,21 +91,134 @@ function shellEscape(str) {
 
 /**
  * Builds a shell command that curls a setup script and pipes it to python3.
+ * Used on macOS/Linux/WSL. Native Windows takes the runPythonScriptWindows path.
  */
 function buildSetupCommand(scriptPath, args) {
   const url = `${SETUP_BASE_URL}/${scriptPath}`;
   return `curl -fsSL "${url}" | python3 - ${args}`;
 }
 
+/**
+ * Reverses shellEscape back into an argv list so the Windows path can call
+ * spawn() directly without going through a shell. Handles unquoted tokens and
+ * single-quoted strings with '\'' for embedded quotes (the exact format
+ * shellEscape produces).
+ */
+function parsePosixArgs(s) {
+  const out = [];
+  let cur = '', inQ = false, i = 0;
+  while (i < s.length) {
+    const c = s[i];
+    if (inQ) {
+      if (c === "'" && s.substr(i, 4) === "'\\''") { cur += "'"; i += 4; continue; }
+      if (c === "'") { inQ = false; i++; continue; }
+      cur += c; i++;
+    } else {
+      if (c === ' ') { if (cur) { out.push(cur); cur = ''; } i++; continue; }
+      if (c === "'") { inQ = true; i++; continue; }
+      cur += c; i++;
+    }
+  }
+  if (cur) out.push(cur);
+  return out;
+}
+
+/**
+ * Downloads a URL to a local file. Follows one level of redirect (GitHub raw
+ * occasionally 302s). Used only by the Windows execution path.
+ */
+function downloadToFile(url, destPath) {
+  return new Promise((resolve, reject) => {
+    const request = (u, remaining) => {
+      https.get(u, (res) => {
+        if ([301, 302, 303, 307, 308].includes(res.statusCode) && res.headers.location && remaining > 0) {
+          res.resume();
+          return request(res.headers.location, remaining - 1);
+        }
+        if (res.statusCode !== 200) {
+          res.resume();
+          return reject(new Error(`Failed to download ${u}: HTTP ${res.statusCode}`));
+        }
+        const file = fs.createWriteStream(destPath);
+        res.pipe(file);
+        file.on('finish', () => file.close(resolve));
+        file.on('error', reject);
+      }).on('error', reject);
+    };
+    request(url, 3);
+  });
+}
+
+/**
+ * Resolves the Python launcher to use on native Windows.
+ * Prefers the `py` launcher (installed by python.org at C:\Windows\py.exe —
+ * no spaces in PATH), falls back to `python` on PATH.
+ */
+function resolveWindowsPython() {
+  const probe = (cmd, args) => {
+    try {
+      const r = spawnSync(cmd, args, { stdio: 'ignore', shell: false, windowsHide: true });
+      return r.status === 0;
+    } catch { return false; }
+  };
+  if (probe('py', ['-3', '--version'])) return { cmd: 'py', prefix: ['-3'] };
+  if (probe('python', ['--version'])) return { cmd: 'python', prefix: [] };
+  if (probe('python3', ['--version'])) return { cmd: 'python3', prefix: [] };
+  throw new Error(
+    'Python 3 not found. Install Python 3 from https://www.python.org/downloads/ ' +
+    'and make sure the "Add python.exe to PATH" option is checked during install.'
+  );
+}
+
+/**
+ * Windows counterpart to the curl|python3 pipe. Downloads the script to a
+ * temp file and invokes Python directly — no shell required.
+ */
+async function runPythonScriptWindows(scriptPath, args, { capture }) {
+  const url = `${SETUP_BASE_URL}/${scriptPath}`;
+  const tmp = path.join(os.tmpdir(), `unbound-${Date.now()}-${Math.random().toString(36).slice(2)}.py`);
+  await downloadToFile(url, tmp);
+  const py = resolveWindowsPython();
+  try {
+    await new Promise((resolve, reject) => {
+      const child = spawn(py.cmd, [...py.prefix, tmp, ...parsePosixArgs(args)], {
+        stdio: capture ? ['pipe', 'pipe', 'pipe'] : 'inherit',
+        shell: false,
+        windowsHide: true,
+      });
+      let out = '';
+      if (capture) {
+        child.stdin.on('error', () => {});
+        child.stdin.end();
+        child.stdout.on('data', (d) => { out += d.toString(); });
+        child.stderr.on('data', (d) => { out += d.toString(); });
+      }
+      child.on('close', (code) => {
+        if (code === 0) return resolve();
+        const err = new Error(out.trim() || `Setup script failed with exit code ${code}`);
+        if (capture) err.setupOutput = out.trim();
+        reject(err);
+      });
+      child.on('error', reject);
+    });
+  } finally {
+    try { fs.unlinkSync(tmp); } catch { /* best-effort */ }
+  }
+}
+
 /**
  * Runs a Python setup script from the setup repo with inherited stdio (live output).
  */
-function runSetupScript(scriptPath, apiKey, { clear = false, backendUrl, frontendUrl } = {}) {
+async function runSetupScript(scriptPath, apiKey, { clear = false, backendUrl, frontendUrl } = {}) {
   let args = `--api-key ${shellEscape(apiKey)}`;
   if (backendUrl) args += ` --backend-url ${shellEscape(backendUrl)}`;
   if (frontendUrl) args += ` --domain ${shellEscape(frontendUrl)}`;
   if (clear) args += ' --clear';
   console.log('');
+  if (isWindowsNative()) {
+    await runPythonScriptWindows(scriptPath, args, { capture: false });
+    return;
+  }
   try {
     execSync(buildSetupCommand(scriptPath, args), { stdio: 'inherit' });
   } catch (err) {
@@ -108,6 +231,9 @@ function runSetupScript(scriptPath, apiKey, { clear = false, backendUrl, fronten
  * Returns a promise that resolves on success, rejects with captured output on failure.
  */
 function runScriptPiped(scriptPath, args) {
+  if (isWindowsNative()) {
+    return runPythonScriptWindows(scriptPath, args, { capture: true });
+  }
   return new Promise((resolve, reject) => {
     const child = spawn(buildSetupCommand(scriptPath, args), {
       shell: true,
@@ -326,13 +452,13 @@ automatically to authenticate before proceeding.
           const toolName = tools[0];
 
           if (SETUP_TOOL_MAP[toolName]) {
-            runSetupScript(SETUP_TOOL_MAP[toolName].script, apiKey, { clear: opts.clear, backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
+            await runSetupScript(SETUP_TOOL_MAP[toolName].script, apiKey, { clear: opts.clear, backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
           } else if (MODE_TOOLS[toolName]) {
             const mode = MODE_TOOLS[toolName];
             if (opts.clear) {
               // Clear both modes
-              runSetupScript(SETUP_TOOL_MAP[mode.subscription].script, apiKey, { clear: true, backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
-              runSetupScript(SETUP_TOOL_MAP[mode.gateway].script, apiKey, { clear: true, backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
+              await runSetupScript(SETUP_TOOL_MAP[mode.subscription].script, apiKey, { clear: true, backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
+              await runSetupScript(SETUP_TOOL_MAP[mode.gateway].script, apiKey, { clear: true, backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
             } else {
               let useSubscription = opts.subscription;
               if (!opts.subscription && !opts.gateway) {
@@ -340,7 +466,7 @@ automatically to authenticate before proceeding.
                 useSubscription = choice === 'subscription';
               }
               const resolved = useSubscription ? mode.subscription : mode.gateway;
-              runSetupScript(SETUP_TOOL_MAP[resolved].script, apiKey, { backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
+              await runSetupScript(SETUP_TOOL_MAP[resolved].script, apiKey, { backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
             }
           } else if (INSTRUCTION_TOOLS[toolName]) {
             output.keyValue(INSTRUCTION_TOOLS[toolName].values(apiKey, frontendUrl));