unbound-cli 0.7.1 → 0.8.1

package/LOCAL_DEV.md

@@ -28,19 +28,26 @@ unbound --help
 ## Point to local backend
 
 ```bash
-# Option 1: Set in config (persists across commands)
-node src/index.js config set-url http://localhost:8000
+# Option 1a: Set all three at once (recommended)
+node src/index.js config urls http://localhost:8001 http://localhost:3000 http://localhost:8000
+# Positional order: gateway, frontend, backend
+
+# Option 1b: Set them individually (persists across commands)
+node src/index.js config set-backend-url  http://localhost:8000
 node src/index.js config set-frontend-url http://localhost:3000
+node src/index.js config set-gateway-url  http://localhost:8001
 
 # Option 2: Environment variable (per-command)
 UNBOUND_API_URL=http://localhost:8000 node src/index.js policy list
+UNBOUND_GATEWAY_URL=http://localhost:8001 node src/index.js setup cursor
 
-# Option 3: Set during login
-node src/index.js login --base-url http://localhost:8000 --frontend-url http://localhost:3000
+# Option 3: Set during login (also persists to config)
+node src/index.js login --base-url http://localhost:8000 --frontend-url http://localhost:3000 --gateway-url http://localhost:8001
 
-# Reset to production
+# Reset to production (hidden helpers, kept for dev workflow)
 node src/index.js config reset-url
 node src/index.js config reset-frontend-url
+node src/index.js config reset-gateway-url
 ```
 
 ## Point setup scripts to a local backend / frontend
@@ -49,8 +56,9 @@ The `setup`, `setup mdm`, `onboard`, and `onboard-mdm` commands invoke Python se
 
 - Ping `https://backend.getunbound.ai/api/v1/setup/complete/` when a tool is configured (override with `--backend-url`).
 - Use the frontend URL for the browser-auth callback if `--api-key` is not already stored (override with `--frontend-url`, passed through to the scripts as `--domain`).
+- Wire AI tools at the gateway URL `https://api.getunbound.ai` (override with `--gateway-url`). The CLI always passes the resolved value (override → config → default) so tools always end up pointed at the right tenant host.
 
-Both flags are hidden from `--help` (dev-only) and work on every setup-invoking command:
+All three flags are hidden from `--help` (dev-only) and work on every setup-invoking command:
 
 ```bash
 # Single tool — override backend only, or both
@@ -86,7 +94,7 @@ When omitted, scripts default to `https://backend.getunbound.ai` and the stored
 Notes:
 - `--backend-url` / `--frontend-url` only affect the setup scripts. They do not change the CLI's own API calls (use `config set-url` / `UNBOUND_API_URL` / `config set-frontend-url` / `UNBOUND_FRONTEND_URL` for that).
 - `onboard` and `onboard-mdm` also take a visible `--domain <url>` flag — that one is for the **discovery** backend (a separate repo), not the setup scripts' frontend. The two flags don't conflict.
-- MDM setup scripts (`setup mdm`, `onboard-mdm`) don't do browser auth, so `--frontend-url` is a no-op there; only `--backend-url` is meaningful.
+- MDM setup scripts (`setup mdm`, `onboard-mdm`) don't do browser auth, so `--frontend-url` is dropped by the CLI; only `--backend-url` and `--gateway-url` are forwarded.
 
 ## Verify config
 
@@ -94,6 +102,7 @@ Notes:
 node src/index.js config show
 node src/index.js config get-url
 node src/index.js config get-frontend-url
+node src/index.js config get-gateway-url
 ```
 
 ## Test login flow
@@ -190,26 +199,29 @@ npm unlink -g unbound-cli
 ### Switching environments
 
 ```bash
-# Use local backend and frontend
-unbound config set-url http://localhost:8000
+# Use local backend, frontend, and gateway
+unbound config set-backend-url  http://localhost:8000
 unbound config set-frontend-url http://localhost:3000
+unbound config set-gateway-url  http://localhost:8001
 
 # Reset to production
 unbound config reset-url
 unbound config reset-frontend-url
+unbound config reset-gateway-url
 
 # One-time override via env vars
-UNBOUND_API_URL=http://localhost:8000 UNBOUND_FRONTEND_URL=http://localhost:3000 unbound login
+UNBOUND_API_URL=http://localhost:8000 UNBOUND_FRONTEND_URL=http://localhost:3000 UNBOUND_GATEWAY_URL=http://localhost:8001 unbound login
 ```
 
 ### Configuration
 
 | Command | Description |
 |---------|-------------|
-| `unbound config set-url <url>` | Set API base URL |
-| `unbound config get-url` | Show current API base URL |
-| `unbound config reset-url` | Reset to default URL |
-| `unbound config set-frontend-url <url>` | Set frontend URL |
-| `unbound config get-frontend-url` | Show current frontend URL |
-| `unbound config reset-frontend-url` | Reset to default frontend URL |
-| `unbound config show` | Show all config values |
+| `unbound config set-backend-url <url>`  | Set backend REST API URL (visible) |
+| `unbound config set-frontend-url <url>` | Set frontend URL (visible) |
+| `unbound config set-gateway-url <url>`  | Set AI gateway URL (visible) |
+| `unbound config set-url <url>`          | Hidden alias for set-backend-url |
+| `unbound config get-url` / `reset-url`  | Hidden read/clear for backend URL |
+| `unbound config get-frontend-url` / `reset-frontend-url` | Hidden read/clear for frontend URL |
+| `unbound config get-gateway-url` / `reset-gateway-url`   | Hidden read/clear for gateway URL |
+| `unbound config show`                   | Show all config values |

package/README.md

@@ -114,7 +114,7 @@ Available tools: `cursor`, `claude-code-subscription`, `claude-code-gateway`, `g
 
 ### MDM AI Tools Discovery
 
-Scan a device for installed AI coding tools and report findings to Unbound. Uses a separate discovery-specific API key. `--domain` defaults to `https://backend.getunbound.ai`.
+Scan a device for installed AI coding tools and report findings to Unbound. Uses a separate discovery-specific API key. `--domain` defaults to the configured backend URL (or `https://backend.getunbound.ai` when unset).
 
 | Command | Description |
 |---------|-------------|
@@ -246,11 +246,29 @@ Supported tool types: `CLAUDE_CODE`, `UNBOUND_CLAUDE_CODE`, `CURSOR`, `COPILOT`,
 
 ## Configuration
 
-Config is stored in `~/.unbound/config.json`.
+Config is stored in `~/.unbound/config.json`. For tenant deployments, point the CLI at your own hosts in one command (recommended for new installs):
+
+```bash
+unbound config urls <gateway-url> <frontend-url> <backend-url>
+# example
+unbound config urls https://api.acme.com https://gateway.acme.com https://backend.acme.com
+unbound login --api-key <YOUR_API_KEY>
+```
+
+Or set them one at a time when changing a single host:
+
+```bash
+unbound config set-gateway-url  https://api.acme.com       # AI gateway host (used by tool setup)
+unbound config set-frontend-url https://gateway.acme.com   # Browser login host
+unbound config set-backend-url  https://backend.acme.com   # REST API host
+unbound config show
+```
+
+Bare hostnames are accepted (`backend.acme.com` becomes `https://backend.acme.com`). Each URL also accepts a per-process override via env var.
 
 **Backend URL priority** (highest to lowest):
 1. `UNBOUND_API_URL` environment variable
-2. `base_url` in `~/.unbound/config.json` (set via `unbound config set-url`)
+2. `base_url` in `~/.unbound/config.json` (set via `unbound config set-backend-url`)
 3. Default: `https://backend.getunbound.ai`
 
 **Frontend URL priority** (highest to lowest):
@@ -258,6 +276,11 @@ Config is stored in `~/.unbound/config.json`.
 2. `frontend_url` in `~/.unbound/config.json` (set via `unbound config set-frontend-url`)
 3. Default: `https://gateway.getunbound.ai`
 
+**Gateway URL priority** (highest to lowest):
+1. `UNBOUND_GATEWAY_URL` environment variable
+2. `gateway_url` in `~/.unbound/config.json` (set via `unbound config set-gateway-url`)
+3. Default: `https://api.getunbound.ai`
+
 ## Global Options
 
 All list/get commands support `--json` for machine-readable JSON output.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "0.7.1",
+  "version": "0.8.1",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/discover.js

@@ -3,10 +3,10 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const https = require('https');
+const config = require('../config');
 const output = require('../output');
 
 const DISCOVER_BASE_URL = 'https://raw.githubusercontent.com/websentry-ai/coding-discovery-tool/refs/heads/main';
-const DEFAULT_DOMAIN = 'https://backend.getunbound.ai';
 const LAUNCH_AGENT_LABEL = 'ai.getunbound.discovery';
 
 // Native Windows (cmd/PowerShell) takes the install.ps1 path below. WSL reports
@@ -144,10 +144,11 @@ async function runDiscoveryScriptWindows(scriptName, args) {
  * Emits a warning if not running as root (scan will be limited to the current user).
  * Throws on failure. Used by both the `discover` command and the `onboard` command.
  */
-async function runDiscoveryScan({ apiKey, domain = DEFAULT_DOMAIN }) {
+async function runDiscoveryScan({ apiKey, domain }) {
   if (!apiKey) {
     throw new Error('Discovery API key is required.');
   }
+  if (!domain) domain = config.getBaseUrl();
 
   if (!isRoot()) {
     output.warn('Running without root. Only scanning current user\'s tools.');
@@ -167,14 +168,15 @@ function register(program) {
       'and report findings to Unbound.'
     )
     .option('--api-key <key>', 'Discovery API key (required)')
-    .option('--domain <url>', 'Backend URL', DEFAULT_DOMAIN)
+    .option('--domain <url>', 'Backend URL (defaults to configured backend)')
     .addHelpText('after', `
 Scans this device for installed AI coding tools (Cursor, Claude Code,
 Gemini CLI, Codex, Windsurf, Roo Code, Cline, GitHub Copilot, JetBrains,
 and more) and reports findings to the Unbound backend.
 
 The --api-key is a discovery-specific key (separate from login credentials).
-The --domain defaults to https://backend.getunbound.ai.
+The --domain defaults to the backend URL configured via "unbound config set-backend-url"
+(falls back to https://backend.getunbound.ai when unset).
 
 Run as root (sudo) to scan all users on the device.
 Run without root to scan the current user only.
@@ -211,7 +213,7 @@ Examples:
     .command('schedule')
     .description('Set up a recurring 12-hour discovery scan via macOS LaunchAgent.')
     .option('--api-key <key>', 'Discovery API key (required)')
-    .option('--domain <url>', 'Backend URL', DEFAULT_DOMAIN)
+    .option('--domain <url>', 'Backend URL (defaults to configured backend)')
     .addHelpText('after', `
 Creates a macOS LaunchAgent that runs the discovery scan every 12 hours.
 Credentials are stored securely in the macOS Keychain (not in files).
@@ -241,7 +243,8 @@ Examples:
           return;
         }
 
-        const args = `--api-key ${shellEscape(opts.apiKey)} --domain ${shellEscape(opts.domain)}`;
+        const domain = opts.domain || config.getBaseUrl();
+        const args = `--api-key ${shellEscape(opts.apiKey)} --domain ${shellEscape(domain)}`;
         await runDiscoveryScript('setup-scheduled-scan.sh', args);
       } catch (err) {
         output.error(err.message);

package/src/commands/login.js

@@ -9,7 +9,10 @@ function register(program) {
     .command('login')
     .description('Authenticate with Unbound. Opens a browser for interactive login, or use --api-key for CI/CD environments.')
     .option('--api-key <key>', 'Authenticate with an API key directly (non-interactive)')
-    .addOption(new Option('--base-url <url>', 'Set a custom API base URL').hideHelp())
+    .option('--gateway-url <url>', 'Tenant AI gateway URL (e.g. https://api.acme.com). Persisted to config.')
+    .option('--frontend-url <url>', 'Tenant frontend URL (e.g. https://gateway.acme.com). Persisted to config.')
+    .option('--backend-url <url>', 'Tenant backend REST API URL (e.g. https://backend.acme.com). Persisted to config.')
+    .addOption(new Option('--base-url <url>', 'Hidden alias of --backend-url, kept for back-compat.').hideHelp())
     .option('--domain <domain>', 'Use a custom domain for login (e.g. custom.example.com)')
     .addHelpText('after', `
 Authentication methods:
@@ -22,19 +25,33 @@ Authentication methods:
     Non-interactive login for CI/CD or automation. Stores the provided
     API key directly without browser interaction.
 
+Tenant deployments (URL flags persist to ~/.unbound/config.json):
+  Pass --gateway-url, --frontend-url, --backend-url at login time and the
+  CLI stores them all at once — no separate config step needed.
+
 Options:
   --domain sets a custom domain for organizations with self-hosted frontends.
+  Bare hostnames (e.g. "api.acme.com") are auto-prefixed with https://.
 
 Examples:
   $ unbound login                              # Login via default gateway
-  $ unbound login --domain custom.example.com  # Login via custom domain
   $ unbound login --api-key sk-abc123          # Non-interactive login
+  $ unbound login --api-key sk-abc123 \\
+      --gateway-url https://api.acme.com \\
+      --frontend-url https://gateway.acme.com \\
+      --backend-url https://backend.acme.com   # Tenant onboarding (one shot)
+  $ unbound login --domain custom.example.com  # Login via custom domain
 `)
     .action(async (opts) => {
       try {
-        if (opts.baseUrl) {
-          config.setBaseUrl(opts.baseUrl);
-        }
+        // --backend-url is the canonical visible flag; --base-url is a hidden
+        // back-compat alias. setUrls writes all provided URLs atomically so
+        // a malformed --frontend-url can't leave a fresh --backend-url half-applied.
+        config.setUrls({
+          backend: opts.backendUrl || opts.baseUrl,
+          frontend: opts.frontendUrl,
+          gateway: opts.gatewayUrl,
+        });
 
         let apiKey;
 

package/src/commands/onboard.js

@@ -5,15 +5,14 @@ const { ensureLoggedIn } = require('../auth');
 const { runSetupAllBundle, runMdmSetupAllBundle, checkRoot, ALL_TOOLS, MDM_ALL_TOOLS } = require('./setup');
 const { runDiscoveryScan } = require('./discover');
 
-const DEFAULT_DOMAIN = 'https://backend.getunbound.ai';
-
 /**
  * Builds the recovery-command suffix for partial-failure hints.
- * Includes `--domain <value>` only when the user supplied a non-default domain,
- * so users running against a custom backend get a copy-pastable command.
+ * Includes `--domain <value>` only when the resolved discovery backend
+ * differs from the global default, so users running against a custom
+ * backend get a copy-pastable command.
  */
 function domainHintSuffix(domain) {
-  if (!domain || domain === DEFAULT_DOMAIN) return '';
+  if (!domain || domain === config.DEFAULT_BASE_URL) return '';
   return ` --domain ${domain}`;
 }
 
@@ -26,9 +25,10 @@ function register(program) {
     )
     .requiredOption('--api-key <key>', 'User API key (for tool setup and login)')
     .requiredOption('--discovery-key <key>', 'Discovery API key (for device scan)')
-    .option('--domain <url>', 'Backend URL for discovery', DEFAULT_DOMAIN)
+    .option('--domain <url>', 'Backend URL for discovery (defaults to configured backend)')
     .addOption(new Option('--backend-url <url>', 'Override backend URL for setup scripts (dev only)').hideHelp())
     .addOption(new Option('--frontend-url <url>', 'Override frontend URL for setup scripts (dev only)').hideHelp())
+    .addOption(new Option('--gateway-url <url>', 'Override gateway URL for setup scripts (dev only)').hideHelp())
     .addHelpText('after', `
 Runs the full onboarding flow for an end user:
   1. Logs in with --api-key and stores credentials.
@@ -50,27 +50,42 @@ Examples:
 `)
     .action(async (opts) => {
       let setupSucceeded = false;
+      let discoveryDomain;
       try {
+        // Persist explicitly-passed URL flags BEFORE login so tenant URLs land
+        // in config before any backend call (whoami, setup completion ping) uses
+        // them. setUrls is atomic — a malformed URL throws before any disk write,
+        // so the three URLs never end up out of sync.
+        config.setUrls({
+          backend: opts.backendUrl,
+          frontend: opts.frontendUrl,
+          gateway: opts.gatewayUrl,
+        });
+        const backendUrl = config.getBaseUrl();
+        const frontendUrl = config.getFrontendUrl();
+        const gatewayUrl = config.getGatewayUrl();
+        discoveryDomain = opts.domain || backendUrl;
+
         await ensureLoggedIn({ apiKey: opts.apiKey });
         const apiKey = config.getApiKey();
 
         console.log('');
         output.info('Step 1/2: Installing tool bundle');
-        const ok = await runSetupAllBundle(apiKey, { backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
+        const ok = await runSetupAllBundle(apiKey, { backendUrl, frontendUrl, gatewayUrl });
         if (!ok) return;
         setupSucceeded = true;
 
         console.log('');
         output.info('Step 2/2: Running device discovery');
         console.log('');
-        await runDiscoveryScan({ apiKey: opts.discoveryKey, domain: opts.domain });
+        await runDiscoveryScan({ apiKey: opts.discoveryKey, domain: discoveryDomain });
 
         console.log('');
         output.success('Onboarding complete');
       } catch (err) {
         if (!err.displayed) output.error(err.message);
         if (setupSucceeded) {
-          const suffix = domainHintSuffix(opts.domain);
+          const suffix = domainHintSuffix(discoveryDomain);
           console.error('  Tool setup completed successfully — only discovery failed.');
           console.error(`  Re-run discovery only with: unbound discover --api-key <DISCOVERY_KEY>${suffix}`);
         }
@@ -88,9 +103,10 @@ Examples:
     )
     .requiredOption('--admin-api-key <key>', 'Admin API key for MDM enrollment')
     .requiredOption('--discovery-key <key>', 'Discovery API key (for device scan)')
-    .option('--domain <url>', 'Backend URL for discovery', DEFAULT_DOMAIN)
+    .option('--domain <url>', 'Backend URL for discovery (defaults to configured backend)')
     .addOption(new Option('--backend-url <url>', 'Override backend URL for setup scripts (dev only)').hideHelp())
     .addOption(new Option('--frontend-url <url>', 'Override frontend URL for setup scripts (dev only)').hideHelp())
+    .addOption(new Option('--gateway-url <url>', 'Override gateway URL for setup scripts (dev only)').hideHelp())
     .addHelpText('after', `
 Runs the full MDM onboarding flow for device enrollment:
   1. Installs the MDM tool bundle: ${MDM_ALL_TOOLS.join(', ')}.
@@ -106,26 +122,38 @@ Examples:
 `)
     .action(async (opts) => {
       let setupSucceeded = false;
+      let discoveryDomain;
       try {
+        // Persist explicitly-passed URL flags so subsequent commands on this
+        // device (e.g. unbound discover, unbound setup) hit the same tenant.
+        // setUrls is atomic — a malformed URL throws before any disk write.
+        config.setUrls({
+          backend: opts.backendUrl,
+          gateway: opts.gatewayUrl,
+        });
+        const backendUrl = config.getBaseUrl();
+        const gatewayUrl = config.getGatewayUrl();
+        discoveryDomain = opts.domain || backendUrl;
+
         checkRoot('onboard-mdm');
 
         console.log('');
         output.info('Step 1/2: Installing MDM tool bundle');
-        const ok = await runMdmSetupAllBundle(opts.adminApiKey, { backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
+        const ok = await runMdmSetupAllBundle(opts.adminApiKey, { backendUrl, gatewayUrl });
         if (!ok) return;
         setupSucceeded = true;
 
         console.log('');
         output.info('Step 2/2: Running device discovery');
         console.log('');
-        await runDiscoveryScan({ apiKey: opts.discoveryKey, domain: opts.domain });
+        await runDiscoveryScan({ apiKey: opts.discoveryKey, domain: discoveryDomain });
 
         console.log('');
         output.success('MDM onboarding complete');
       } catch (err) {
         if (!err.displayed) output.error(err.message);
         if (setupSucceeded) {
-          const suffix = domainHintSuffix(opts.domain);
+          const suffix = domainHintSuffix(discoveryDomain);
           console.error('  MDM tool setup completed successfully — only discovery failed.');
           console.error(`  Re-run discovery only with: sudo unbound discover --api-key <DISCOVERY_KEY>${suffix}`);
         }

package/src/commands/setup.js

@@ -207,13 +207,25 @@ async function runPythonScriptWindows(scriptPath, args, { capture }) {
 }
 
 /**
- * Runs a Python setup script from the setup repo with inherited stdio (live output).
+ * Builds the shared argv tail for setup.py invocations. Always passes the
+ * tenant URL flags so the script's behavior is not sensitive to drift in its
+ * own defaults. `mdm: true` skips --domain (frontend URL) since MDM scripts
+ * have no browser-auth flow.
  */
-async function runSetupScript(scriptPath, apiKey, { clear = false, backendUrl, frontendUrl } = {}) {
+function buildScriptArgs(apiKey, { backendUrl, frontendUrl, gatewayUrl, clear, mdm } = {}) {
   let args = `--api-key ${shellEscape(apiKey)}`;
   if (backendUrl) args += ` --backend-url ${shellEscape(backendUrl)}`;
-  if (frontendUrl) args += ` --domain ${shellEscape(frontendUrl)}`;
+  if (gatewayUrl) args += ` --gateway-url ${shellEscape(gatewayUrl)}`;
+  if (!mdm && frontendUrl) args += ` --domain ${shellEscape(frontendUrl)}`;
   if (clear) args += ' --clear';
+  return args;
+}
+
+/**
+ * Runs a Python setup script from the setup repo with inherited stdio (live output).
+ */
+async function runSetupScript(scriptPath, apiKey, { clear = false, backendUrl, frontendUrl, gatewayUrl } = {}) {
+  const args = buildScriptArgs(apiKey, { backendUrl, frontendUrl, gatewayUrl, clear });
   console.log('');
   if (isWindowsNative()) {
     await runPythonScriptWindows(scriptPath, args, { capture: false });
@@ -308,6 +320,7 @@ function register(program) {
     .option('--all', 'Set up the default bundle: Cursor, Claude Code (hooks), Codex (hooks)')
     .addOption(new Option('--backend-url <url>', 'Override backend URL for setup scripts (dev only)').hideHelp())
     .addOption(new Option('--frontend-url <url>', 'Override frontend URL for setup scripts (dev only)').hideHelp())
+    .addOption(new Option('--gateway-url <url>', 'Override gateway URL for setup scripts (dev only)').hideHelp())
     .addHelpText('after', `
 Available tools:
   cursor                    Cursor IDE
@@ -354,9 +367,22 @@ automatically to authenticate before proceeding.
 `)
     .action(async (tools, opts) => {
       try {
+        // Persist explicitly-passed URL flags BEFORE ensureLoggedIn runs so a
+        // tenant-onboarding `unbound setup --gateway-url ... --api-key ...` lands
+        // tenant URLs in config before any backend call uses them. setUrls is
+        // atomic — no partial writes if any value is malformed.
+        config.setUrls({
+          backend: opts.backendUrl,
+          frontend: opts.frontendUrl,
+          gateway: opts.gatewayUrl,
+        });
+
         await ensureLoggedIn({ apiKey: opts.apiKey });
         const apiKey = config.getApiKey();
+        const backendUrl = config.getBaseUrl();
         const frontendUrl = config.getFrontendUrl();
+        const gatewayUrl = config.getGatewayUrl();
+        const urlOpts = { backendUrl, frontendUrl, gatewayUrl };
 
         // --all expands to the default bundle. Cannot be combined with explicit tool names.
         if (opts.all) {
@@ -383,9 +409,7 @@ automatically to authenticate before proceeding.
           const selectedTools = SETUP_TOOLS.filter(t => selected.includes(t.value));
           console.log('');
 
-          let interactiveArgs = `--api-key ${shellEscape(apiKey)}`;
-          if (opts.backendUrl) interactiveArgs += ` --backend-url ${shellEscape(opts.backendUrl)}`;
-          if (opts.frontendUrl) interactiveArgs += ` --domain ${shellEscape(opts.frontendUrl)}`;
+          const interactiveArgs = buildScriptArgs(apiKey, urlOpts);
           const ok = await runBatch(selectedTools, (tool) =>
             runScriptPiped(tool.script, interactiveArgs)
           );
@@ -452,13 +476,13 @@ automatically to authenticate before proceeding.
           const toolName = tools[0];
 
           if (SETUP_TOOL_MAP[toolName]) {
-            await runSetupScript(SETUP_TOOL_MAP[toolName].script, apiKey, { clear: opts.clear, backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
+            await runSetupScript(SETUP_TOOL_MAP[toolName].script, apiKey, { clear: opts.clear, ...urlOpts });
           } else if (MODE_TOOLS[toolName]) {
             const mode = MODE_TOOLS[toolName];
             if (opts.clear) {
               // Clear both modes
-              await runSetupScript(SETUP_TOOL_MAP[mode.subscription].script, apiKey, { clear: true, backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
-              await runSetupScript(SETUP_TOOL_MAP[mode.gateway].script, apiKey, { clear: true, backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
+              await runSetupScript(SETUP_TOOL_MAP[mode.subscription].script, apiKey, { clear: true, ...urlOpts });
+              await runSetupScript(SETUP_TOOL_MAP[mode.gateway].script, apiKey, { clear: true, ...urlOpts });
             } else {
               let useSubscription = opts.subscription;
               if (!opts.subscription && !opts.gateway) {
@@ -466,7 +490,7 @@ automatically to authenticate before proceeding.
                 useSubscription = choice === 'subscription';
               }
               const resolved = useSubscription ? mode.subscription : mode.gateway;
-              await runSetupScript(SETUP_TOOL_MAP[resolved].script, apiKey, { backendUrl: opts.backendUrl, frontendUrl: opts.frontendUrl });
+              await runSetupScript(SETUP_TOOL_MAP[resolved].script, apiKey, urlOpts);
             }
           } else if (INSTRUCTION_TOOLS[toolName]) {
             output.keyValue(INSTRUCTION_TOOLS[toolName].values(apiKey, frontendUrl));
@@ -504,10 +528,7 @@ automatically to authenticate before proceeding.
         // Run automated tools with spinners
         if (resolvedScripts.length > 0) {
           console.log('');
-          let args = `--api-key ${shellEscape(apiKey)}`;
-          if (opts.backendUrl) args += ` --backend-url ${shellEscape(opts.backendUrl)}`;
-          if (opts.frontendUrl) args += ` --domain ${shellEscape(opts.frontendUrl)}`;
-          if (opts.clear) args += ' --clear';
+          const args = buildScriptArgs(apiKey, { ...urlOpts, clear: opts.clear });
           const ok = await runBatch(resolvedScripts, (tool) =>
             runScriptPiped(tool.script, args)
           , { clear: opts.clear });
@@ -569,9 +590,18 @@ Examples:
       try {
         checkRoot();
         // --all and --clear are defined on both this command and the parent `setup` command;
-        // --backend-url and --frontend-url are defined only on the parent `setup` command.
-        // Use optsWithGlobals() so all four work regardless of position relative to `mdm`.
+        // --backend-url, --frontend-url, --gateway-url are defined only on the parent `setup` command.
+        // Use optsWithGlobals() so they all work regardless of position relative to `mdm`.
         const globalOpts = command.optsWithGlobals();
+        // Persist explicitly-passed URL flags so this MDM run also configures
+        // the CLI for any subsequent non-MDM commands on the same machine.
+        // setUrls is atomic — no partial writes if any value is malformed.
+        config.setUrls({
+          backend: globalOpts.backendUrl,
+          gateway: globalOpts.gatewayUrl,
+        });
+        const backendUrl = config.getBaseUrl();
+        const gatewayUrl = config.getGatewayUrl();
 
         if (globalOpts.all && tools.length > 0) {
           output.error('Cannot combine --all with specific tool names. Use one or the other.');
@@ -614,17 +644,16 @@ Examples:
         const resolvedTools = toolNames.map(name => ({ name, ...MDM_TOOLS[name] }));
         console.log('');
 
-        const mdmArgs = (tool) => {
-          let args = `--api-key ${shellEscape(opts.adminApiKey)}`;
-          if (globalOpts.backendUrl) args += ` --backend-url ${shellEscape(globalOpts.backendUrl)}`;
-          if (globalOpts.frontendUrl) args += ` --domain ${shellEscape(globalOpts.frontendUrl)}`;
-          if (globalOpts.clear) args += ' --clear';
-          return args;
-        };
+        const args = buildScriptArgs(opts.adminApiKey, {
+          backendUrl,
+          gatewayUrl,
+          clear: globalOpts.clear,
+          mdm: true,
+        });
 
         const ok = await runBatch(
           resolvedTools,
-          (tool) => runScriptPiped(tool.script, mdmArgs(tool)),
+          (tool) => runScriptPiped(tool.script, args),
           { clear: globalOpts.clear }
         );
         if (!ok) return;
@@ -643,11 +672,9 @@ Examples:
  * Assumes the caller has already ensured the user is logged in.
  * Returns true on success, false on failure.
  */
-async function runSetupAllBundle(apiKey, { backendUrl, frontendUrl } = {}) {
+async function runSetupAllBundle(apiKey, { backendUrl, frontendUrl, gatewayUrl } = {}) {
   const resolvedTools = ALL_TOOLS.map(name => ({ name, ...SETUP_TOOL_MAP[name] }));
-  let args = `--api-key ${shellEscape(apiKey)}`;
-  if (backendUrl) args += ` --backend-url ${shellEscape(backendUrl)}`;
-  if (frontendUrl) args += ` --domain ${shellEscape(frontendUrl)}`;
+  const args = buildScriptArgs(apiKey, { backendUrl, frontendUrl, gatewayUrl });
   return runBatch(resolvedTools, (tool) => runScriptPiped(tool.script, args));
 }
 
@@ -656,11 +683,9 @@ async function runSetupAllBundle(apiKey, { backendUrl, frontendUrl } = {}) {
  * Caller must ensure the process is running as root.
  * Returns true on success, false on failure.
  */
-async function runMdmSetupAllBundle(adminApiKey, { backendUrl, frontendUrl } = {}) {
+async function runMdmSetupAllBundle(adminApiKey, { backendUrl, gatewayUrl } = {}) {
   const resolvedTools = MDM_ALL_TOOLS.map(name => ({ name, ...MDM_TOOLS[name] }));
-  let args = `--api-key ${shellEscape(adminApiKey)}`;
-  if (backendUrl) args += ` --backend-url ${shellEscape(backendUrl)}`;
-  if (frontendUrl) args += ` --domain ${shellEscape(frontendUrl)}`;
+  const args = buildScriptArgs(adminApiKey, { backendUrl, gatewayUrl, mdm: true });
   return runBatch(resolvedTools, (tool) => runScriptPiped(tool.script, args));
 }
 

package/src/commands/status.js

@@ -12,7 +12,9 @@ Output fields:
   Logged in        - Whether credentials are stored (Yes/No)
   Email            - The authenticated user's email (if logged in)
   Organization     - The organization name (if logged in)
-  Unbound Gateway  - The Unbound gateway URL (if logged in)
+  Backend URL      - REST API host (configurable for tenant deployments)
+  Frontend URL     - Browser login host
+  Gateway URL      - AI gateway host (used by tool setup)
   API status       - Connectivity check result (Connected / Error)
 
 Examples:
@@ -46,8 +48,10 @@ Examples:
           const cfg = config.readConfig();
           pairs.push(['Email', cfg.email || '-']);
           pairs.push(['Organization', cfg.org_name || '-']);
-          pairs.push(['Unbound Gateway', config.getFrontendUrl()]);
         }
+        pairs.push(['Backend URL', config.getBaseUrl()]);
+        pairs.push(['Frontend URL', config.getFrontendUrl()]);
+        pairs.push(['Gateway URL', config.getGatewayUrl()]);
         pairs.push(['API status', connectivity]);
 
         if (opts.json) {
@@ -57,7 +61,9 @@ Examples:
             logged_in: loggedIn,
             email: loggedIn ? (cfg.email || null) : null,
             organization: loggedIn ? (cfg.org_name || null) : null,
-            gateway_url: loggedIn ? config.getFrontendUrl() : null,
+            backend_url: config.getBaseUrl(),
+            frontend_url: config.getFrontendUrl(),
+            gateway_url: config.getGatewayUrl(),
             api_status: connectivity,
           });
           return;

package/src/config.js

@@ -6,6 +6,36 @@ const CONFIG_DIR = path.join(os.homedir(), '.unbound');
 const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
 const DEFAULT_BASE_URL = 'https://backend.getunbound.ai';
 const DEFAULT_FRONTEND_URL = 'https://gateway.getunbound.ai';
+const DEFAULT_GATEWAY_URL = 'https://api.getunbound.ai';
+
+function normalizeUrl(input) {
+  if (input === undefined || input === null) {
+    throw new Error('URL is required');
+  }
+  let value = String(input).trim();
+  if (!value) {
+    throw new Error('URL must not be empty');
+  }
+  if (!/^[a-zA-Z][a-zA-Z0-9+\-.]*:\/\//.test(value)) {
+    value = `https://${value}`;
+  }
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error(`Invalid URL: ${input}`);
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error(`URL must use http or https: ${input}`);
+  }
+  if (!parsed.hostname) {
+    throw new Error(`URL must include a hostname: ${input}`);
+  }
+  // Tenant URLs are origin-only (scheme + host[:port]). Paths, queries, fragments,
+  // and embedded credentials are stripped — they break downstream string concat
+  // (e.g., `${frontend_url}/automations/api-key-callback`) and have no use here.
+  return `${parsed.protocol}//${parsed.host}`;
+}
 
 function ensureConfigDir() {
   if (!fs.existsSync(CONFIG_DIR)) {
@@ -46,8 +76,9 @@ function getBaseUrl() {
 
 function setBaseUrl(url) {
   const config = readConfig();
-  config.base_url = url;
+  config.base_url = normalizeUrl(url);
   writeConfig(config);
+  return config.base_url;
 }
 
 function getFrontendUrl() {
@@ -56,8 +87,44 @@ function getFrontendUrl() {
 
 function setFrontendUrl(url) {
   const config = readConfig();
-  config.frontend_url = url;
+  config.frontend_url = normalizeUrl(url);
+  writeConfig(config);
+  return config.frontend_url;
+}
+
+function getGatewayUrl() {
+  return process.env.UNBOUND_GATEWAY_URL || readConfig().gateway_url || DEFAULT_GATEWAY_URL;
+}
+
+function setGatewayUrl(url) {
+  const config = readConfig();
+  config.gateway_url = normalizeUrl(url);
+  writeConfig(config);
+  return config.gateway_url;
+}
+
+/**
+ * Atomic multi-URL setter. Accepts any subset of `{gateway, frontend, backend}`
+ * (each field is independently optional). Normalizes every provided value up
+ * front; if any one is invalid it throws BEFORE touching disk so the caller
+ * never lands a partial write that leaves the three URLs out of sync.
+ *
+ * Use this from any code path that may persist more than one URL flag in the
+ * same command (login/setup/onboard) so a malformed --frontend-url can't
+ * succeed in writing a fresh --backend-url first.
+ *
+ * Returns an object with only the keys that were updated, normalized.
+ */
+function setUrls({ gateway, frontend, backend } = {}) {
+  const normalized = {};
+  if (gateway !== undefined) normalized.gateway_url = normalizeUrl(gateway);
+  if (frontend !== undefined) normalized.frontend_url = normalizeUrl(frontend);
+  if (backend !== undefined) normalized.base_url = normalizeUrl(backend);
+  if (Object.keys(normalized).length === 0) return normalized;
+  const config = readConfig();
+  Object.assign(config, normalized);
   writeConfig(config);
+  return normalized;
 }
 
 function clearConfig() {
@@ -70,16 +137,26 @@ function isLoggedIn() {
   return !!getApiKey();
 }
 
+/**
+ * Refreshes cached user identity (email, org_name) from a backend response.
+ * Always overwrites when the response carries a non-empty value so that
+ * switching tenants under the same API key (or rotating the key to a new org)
+ * shows the correct organization in `whoami` / `status` instead of stale data.
+ * Defensive: leaves an existing cached value untouched if the response field
+ * is missing or empty, so a partial API response can't blank the local config.
+ */
 function backfillUserInfo(apiResponse) {
   if (!apiResponse) return;
   const cfg = readConfig();
   let changed = false;
-  if (!cfg.email && apiResponse.email) {
-    cfg.email = apiResponse.email;
+  const apiEmail = apiResponse.email;
+  if (apiEmail && cfg.email !== apiEmail) {
+    cfg.email = apiEmail;
     changed = true;
   }
-  if (!cfg.org_name && (apiResponse.org_name || apiResponse.organization_name || apiResponse.organization)) {
-    cfg.org_name = apiResponse.org_name || apiResponse.organization_name || apiResponse.organization;
+  const apiOrg = apiResponse.org_name || apiResponse.organization_name || apiResponse.organization;
+  if (apiOrg && cfg.org_name !== apiOrg) {
+    cfg.org_name = apiOrg;
     changed = true;
   }
   if (changed) writeConfig(cfg);
@@ -88,6 +165,10 @@ function backfillUserInfo(apiResponse) {
 module.exports = {
   CONFIG_DIR,
   CONFIG_FILE,
+  DEFAULT_BASE_URL,
+  DEFAULT_FRONTEND_URL,
+  DEFAULT_GATEWAY_URL,
+  normalizeUrl,
   ensureConfigDir,
   readConfig,
   writeConfig,
@@ -97,6 +178,9 @@ module.exports = {
   setBaseUrl,
   getFrontendUrl,
   setFrontendUrl,
+  getGatewayUrl,
+  setGatewayUrl,
+  setUrls,
   clearConfig,
   isLoggedIn,
   backfillUserInfo,

package/src/index.js

@@ -32,6 +32,18 @@ AUTHENTICATION
   $ unbound whoami                         Show current user and organization
   $ unbound status                         Show CLI status and API connectivity
 
+  Tenant deployments — pass URL flags on login; they persist to ~/.unbound/config.json:
+  $ unbound login --api-key <YOUR_API_KEY> \\
+      --gateway-url <gw> --frontend-url <fe> --backend-url <be>
+  Example:
+  $ unbound login --api-key sk-... \\
+      --gateway-url https://api.acme.com \\
+      --frontend-url https://gateway.acme.com \\
+      --backend-url https://backend.acme.com
+
+  Or set URLs separately (any time):
+  $ unbound config urls <gateway-url> <frontend-url> <backend-url>
+
 ONBOARDING (one-step install + discover)
   $ unbound onboard --api-key <USER_KEY> --discovery-key <DISCOVERY_KEY>
   $ sudo unbound onboard-mdm --admin-api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY>
@@ -73,7 +85,7 @@ MDM SETUP (admin, requires root)
   $ sudo unbound setup mdm --admin-api-key KEY --clear cursor codex-subscription
 
 MDM AI TOOLS DISCOVERY
-  --domain defaults to https://backend.getunbound.ai
+  --domain defaults to the configured backend URL (set via "unbound config set-backend-url")
   $ sudo unbound discover --api-key KEY              Scan all users (requires root)
   $ unbound discover --api-key KEY                   Scan current user only
   $ sudo unbound discover --api-key KEY --domain https://custom.backend.com
@@ -133,7 +145,20 @@ CHAT (Admin/Manager)
   See "unbound chat --help" for the response shape and REPL slash commands.
 
 CONFIGURATION
-  $ unbound config show                    Show all settings
+  Defaults point to api/gateway/backend.getunbound.ai. Tenant deployments override them.
+
+  One-shot setup (recommended for new tenants):
+  $ unbound config urls <gateway-url> <frontend-url> <backend-url>
+  $ unbound config urls https://api.acme.com https://gateway.acme.com https://backend.acme.com
+
+  Per-URL setters (change one host at a time):
+  $ unbound config set-gateway-url  <url>          AI gateway host (used by tool setup)
+  $ unbound config set-frontend-url <url>          Frontend host (browser login flow)
+  $ unbound config set-backend-url  <url>          Backend REST API host
+
+  View:
+  $ unbound config show                            All URLs + login state
+  $ unbound config show --json                     Machine-readable
 
 FILES
   ~/.unbound/config.json    Credentials and CLI settings
@@ -160,52 +185,127 @@ require('./commands/chat').register(program);
 // config command for managing CLI settings
 const configCmd = program
   .command('config')
-  .description('Manage CLI configuration settings.');
+  .description('Manage CLI configuration settings (tenant URLs, view current state).')
+  .addHelpText('after', `
+Tenant onboarding (one-shot — recommended):
+  $ unbound config urls <gateway-url> <frontend-url> <backend-url>
+  $ unbound config urls https://api.acme.com https://gateway.acme.com https://backend.acme.com
+
+Per-URL setters (use when changing one host at a time):
+  $ unbound config set-gateway-url  <url>     AI gateway host (used by tool setup)
+  $ unbound config set-frontend-url <url>     Browser login host
+  $ unbound config set-backend-url  <url>     REST API host
+
+View:
+  $ unbound config show                       Print all values, including defaults
+  $ unbound config show --json                Same, machine-readable
+
+Notes:
+  - Bare hostnames are accepted (e.g. "api.acme.com" → "https://api.acme.com").
+  - Settings persist in ~/.unbound/config.json. Defaults: api/gateway/backend.getunbound.ai.
+  - Run "unbound login --api-key <key>" after configuring URLs (no browser needed).
+`);
 
-// Internal/dev commands — hidden from help but still functional
+// Reports the value that was actually written to ~/.unbound/config.json,
+// not what the getter would resolve to. The getter applies env-var precedence
+// (UNBOUND_*_URL), which would mislead the user if they had an override set —
+// the message would echo the env var instead of the value they just typed.
+function safeSet(label, fn, url) {
+  try {
+    const written = fn(url);
+    output.success(`${label} set to ${written}`);
+  } catch (err) {
+    output.error(err.message);
+    process.exitCode = 1;
+  }
+}
+
+// Visible: one-shot setter for all three tenant URLs.
+// Positional order: gateway, frontend, backend — same order as the help text and docs.
 configCmd
-  .command('set-url <url>', { hidden: true })
-  .description('Set the API base URL (internal)')
-  .action((url) => {
-    config.setBaseUrl(url);
-    output.success(`API base URL set to ${url}`);
+  .command('urls <gateway-url> <frontend-url> <backend-url>')
+  .description('Set all three tenant URLs at once (gateway, frontend, backend).')
+  .allowExcessArguments(false)
+  .addHelpText('after', `
+Use this on a fresh install for tenant deployments. Positional order is fixed:
+  1. <gateway-url>   — AI gateway host (e.g. https://api.acme.com)
+                       Wired into tool setup scripts (ANTHROPIC_BASE_URL, codex config, etc.)
+  2. <frontend-url>  — Frontend host (e.g. https://gateway.acme.com)
+                       Used by the browser login flow.
+  3. <backend-url>   — REST API host (e.g. https://backend.acme.com)
+                       All "unbound *" commands (whoami, status, policies, ...) hit this.
+
+Bare hostnames are accepted; "https://" is added automatically.
+The three values are written atomically to ~/.unbound/config.json.
+After running this, log in with:  unbound login --api-key <YOUR_API_KEY>
+
+Examples:
+  $ unbound config urls https://api.acme.com https://gateway.acme.com https://backend.acme.com
+  $ unbound config urls api.acme.com gateway.acme.com backend.acme.com
+  $ unbound config show
+`)
+  .action((gateway, frontend, backend) => {
+    try {
+      const written = config.setUrls({ gateway, frontend, backend });
+      output.success('All three tenant URLs set:');
+      output.keyValue([
+        ['Gateway URL', written.gateway_url],
+        ['Frontend URL', written.frontend_url],
+        ['Backend URL', written.base_url],
+      ]);
+      console.log('');
+      output.info('Next: unbound login --api-key <YOUR_API_KEY>');
+    } catch (err) {
+      output.error(err.message);
+      process.exitCode = 1;
+    }
   });
 
+// Per-URL setters (use when changing a single host).
+configCmd
+  .command('set-backend-url <url>')
+  .description('Set the backend REST API URL (tenant deployments).')
+  .action((url) => safeSet('Backend URL', config.setBaseUrl, url));
+
+configCmd
+  .command('set-frontend-url <url>')
+  .description('Set the frontend URL used by the browser login flow.')
+  .action((url) => safeSet('Frontend URL', config.setFrontendUrl, url));
+
+configCmd
+  .command('set-gateway-url <url>')
+  .description('Set the AI gateway URL (used by tool setup scripts).')
+  .action((url) => safeSet('Gateway URL', config.setGatewayUrl, url));
+
+// Hidden back-compat aliases — keep working for existing scripts/users.
+configCmd
+  .command('set-url <url>', { hidden: true })
+  .description('Alias of set-backend-url (kept for backward compatibility).')
+  .action((url) => safeSet('Backend URL', config.setBaseUrl, url));
+
 configCmd
   .command('get-url', { hidden: true })
-  .description('Show the current API base URL (internal)')
-  .action(() => {
-    console.log(config.getBaseUrl());
-  });
+  .description('Show the current backend URL (kept for backward compatibility).')
+  .action(() => { console.log(config.getBaseUrl()); });
 
 configCmd
   .command('reset-url', { hidden: true })
-  .description('Reset the API base URL to default (internal)')
+  .description('Reset the backend URL to default (kept for backward compatibility).')
   .action(() => {
     const cfg = config.readConfig();
     delete cfg.base_url;
     config.writeConfig(cfg);
-    output.success(`API base URL reset to ${config.getBaseUrl()}`);
-  });
-
-configCmd
-  .command('set-frontend-url <url>', { hidden: true })
-  .description('Set the frontend URL (internal)')
-  .action((url) => {
-    config.setFrontendUrl(url);
-    output.success(`Frontend URL set to ${url}`);
+    output.success(`Backend URL reset to ${config.getBaseUrl()}`);
   });
 
 configCmd
   .command('get-frontend-url', { hidden: true })
-  .description('Show the current frontend URL (internal)')
-  .action(() => {
-    console.log(config.getFrontendUrl());
-  });
+  .description('Show the current frontend URL (kept for backward compatibility).')
+  .action(() => { console.log(config.getFrontendUrl()); });
 
 configCmd
   .command('reset-frontend-url', { hidden: true })
-  .description('Reset the frontend URL to default (internal)')
+  .description('Reset the frontend URL to default (kept for backward compatibility).')
   .action(() => {
     const cfg = config.readConfig();
     delete cfg.frontend_url;
@@ -213,6 +313,21 @@ configCmd
     output.success(`Frontend URL reset to ${config.getFrontendUrl()}`);
   });
 
+configCmd
+  .command('get-gateway-url', { hidden: true })
+  .description('Show the current gateway URL.')
+  .action(() => { console.log(config.getGatewayUrl()); });
+
+configCmd
+  .command('reset-gateway-url', { hidden: true })
+  .description('Reset the gateway URL to default.')
+  .action(() => {
+    const cfg = config.readConfig();
+    delete cfg.gateway_url;
+    config.writeConfig(cfg);
+    output.success(`Gateway URL reset to ${config.getGatewayUrl()}`);
+  });
+
 configCmd
   .command('show')
   .description('Show all current configuration values.')
@@ -223,7 +338,9 @@ configCmd
     if (opts.json) {
       output.json({
         config_file: config.CONFIG_FILE,
-        gateway_url: config.getFrontendUrl(),
+        backend_url: config.getBaseUrl(),
+        frontend_url: config.getFrontendUrl(),
+        gateway_url: config.getGatewayUrl(),
         logged_in: config.isLoggedIn(),
         email: cfg.email || null,
         organization: cfg.org_name || null,
@@ -233,7 +350,9 @@ configCmd
 
     output.keyValue([
       ['Config file', config.CONFIG_FILE],
-      ['Unbound Gateway', config.getFrontendUrl()],
+      ['Backend URL', config.getBaseUrl()],
+      ['Frontend URL', config.getFrontendUrl()],
+      ['Gateway URL', config.getGatewayUrl()],
       ['Logged in', config.isLoggedIn() ? 'Yes' : 'No'],
       ['Email', cfg.email || '-'],
       ['Organization', cfg.org_name || '-'],

package/test/config-normalize-url.test.js

@@ -0,0 +1,199 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { normalizeUrl } = require('../src/config');
+
+test('normalizeUrl: bare hostname gets https://', () => {
+  assert.equal(normalizeUrl('api.acme.com'), 'https://api.acme.com');
+});
+
+test('normalizeUrl: trims whitespace', () => {
+  assert.equal(normalizeUrl('  api.acme.com  '), 'https://api.acme.com');
+});
+
+test('normalizeUrl: strips trailing slash', () => {
+  assert.equal(normalizeUrl('https://api.acme.com/'), 'https://api.acme.com');
+});
+
+test('normalizeUrl: preserves explicit port', () => {
+  assert.equal(normalizeUrl('localhost:8000'), 'https://localhost:8000');
+  assert.equal(normalizeUrl('http://localhost:8000'), 'http://localhost:8000');
+});
+
+test('normalizeUrl: preserves http scheme when explicit', () => {
+  assert.equal(normalizeUrl('http://localhost:3000'), 'http://localhost:3000');
+});
+
+test('normalizeUrl: strips path so downstream string-concat is safe', () => {
+  assert.equal(
+    normalizeUrl('https://gateway.acme.com/login?next=/foo'),
+    'https://gateway.acme.com',
+  );
+  assert.equal(
+    normalizeUrl('https://api.acme.com/v1/'),
+    'https://api.acme.com',
+  );
+});
+
+test('normalizeUrl: strips embedded credentials', () => {
+  assert.equal(
+    normalizeUrl('https://attacker:secret@backend.acme.com'),
+    'https://backend.acme.com',
+  );
+});
+
+test('normalizeUrl: strips fragment', () => {
+  assert.equal(normalizeUrl('https://api.acme.com#anything'), 'https://api.acme.com');
+});
+
+test('normalizeUrl: rejects non-http(s) scheme', () => {
+  // Schemes with `://` are recognized and rejected by scheme check.
+  assert.throws(() => normalizeUrl('ftp://x.com'), /http or https/);
+  assert.throws(() => normalizeUrl('file:///etc/passwd'), /http or https/);
+  // Schemes without `://` (e.g. `javascript:`) get `https://` prepended,
+  // then fail URL parsing because the result is malformed.
+  assert.throws(() => normalizeUrl('javascript:alert(1)'), /Invalid URL/);
+  assert.throws(() => normalizeUrl('data:text/html,foo'), /Invalid URL|http or https/);
+});
+
+test('normalizeUrl: rejects empty / nullish', () => {
+  assert.throws(() => normalizeUrl(''), /must not be empty/);
+  assert.throws(() => normalizeUrl('   '), /must not be empty/);
+  assert.throws(() => normalizeUrl(null), /required/);
+  assert.throws(() => normalizeUrl(undefined), /required/);
+});
+
+test('normalizeUrl: rejects malformed input', () => {
+  assert.throws(() => normalizeUrl('https://'), /Invalid URL|hostname/);
+});
+
+// Setters must return the value actually written to disk, not what a getter
+// would resolve to (env vars override config in getters and would mislead the
+// user about what was just persisted). Regression test for PR #21 review.
+test('setBaseUrl/setFrontendUrl/setGatewayUrl return the normalized written value', () => {
+  const fs = require('node:fs');
+  const os = require('node:os');
+  const path = require('node:path');
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-cli-test-'));
+  const origHome = process.env.HOME;
+  const origGw = process.env.UNBOUND_GATEWAY_URL;
+  process.env.HOME = tmp;
+  process.env.UNBOUND_GATEWAY_URL = 'https://env-override.example.com';
+  // Reload the module fresh so it picks up the temp HOME.
+  delete require.cache[require.resolve('../src/config')];
+  const c = require('../src/config');
+  try {
+    assert.equal(c.setBaseUrl('backend.acme.com'), 'https://backend.acme.com');
+    assert.equal(c.setFrontendUrl('gateway.acme.com'), 'https://gateway.acme.com');
+    // setGatewayUrl returns the WRITTEN value — not what getGatewayUrl() would
+    // return (which would be the env-var override).
+    assert.equal(c.setGatewayUrl('api.acme.com'), 'https://api.acme.com');
+    assert.equal(c.getGatewayUrl(), 'https://env-override.example.com');
+  } finally {
+    process.env.HOME = origHome;
+    if (origGw === undefined) delete process.env.UNBOUND_GATEWAY_URL;
+    else process.env.UNBOUND_GATEWAY_URL = origGw;
+    delete require.cache[require.resolve('../src/config')];
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+// WEB-4103 (PR #22 review): setUrls must be atomic — if any URL fails
+// normalization, NONE of them should be persisted. Previously, separate
+// setBaseUrl/setFrontendUrl/setGatewayUrl calls did sequential writes,
+// so a malformed --frontend-url would land --backend-url half-applied.
+test('setUrls is atomic — partial failure leaves config unchanged', () => {
+  const fs = require('node:fs');
+  const os = require('node:os');
+  const path = require('node:path');
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-cli-test-'));
+  const origHome = process.env.HOME;
+  process.env.HOME = tmp;
+  delete require.cache[require.resolve('../src/config')];
+  const c = require('../src/config');
+  try {
+    // Seed a known starting state (simulating an existing tenant config).
+    c.writeConfig({
+      api_key: 'sk-x',
+      base_url: 'https://old-backend.example.com',
+      frontend_url: 'https://old-frontend.example.com',
+      gateway_url: 'https://old-gateway.example.com',
+    });
+
+    // Attempt to set all three; the frontend URL is malformed.
+    assert.throws(
+      () => c.setUrls({
+        backend: 'https://new-backend.example.com',
+        frontend: 'javascript:alert(1)',
+        gateway: 'https://new-gateway.example.com',
+      }),
+      /Invalid URL|http or https/,
+    );
+
+    // Critical: NO field should have been persisted — all three still old.
+    const cfg = c.readConfig();
+    assert.equal(cfg.base_url, 'https://old-backend.example.com');
+    assert.equal(cfg.frontend_url, 'https://old-frontend.example.com');
+    assert.equal(cfg.gateway_url, 'https://old-gateway.example.com');
+
+    // Partial input still works atomically.
+    c.setUrls({ backend: 'new.example.com' });
+    assert.equal(c.readConfig().base_url, 'https://new.example.com');
+    assert.equal(c.readConfig().frontend_url, 'https://old-frontend.example.com');
+
+    // Empty input is a no-op.
+    const result = c.setUrls({});
+    assert.deepEqual(result, {});
+    c.setUrls();
+  } finally {
+    process.env.HOME = origHome;
+    delete require.cache[require.resolve('../src/config')];
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+// WEB-4103: backfillUserInfo must refresh email/org_name when the API returns
+// a different value (e.g. user switched tenants), not just fill if missing.
+// Defensive: must NOT blank the cached value on a partial/empty API response.
+test('backfillUserInfo refreshes stale email/org but preserves on empty', () => {
+  const fs = require('node:fs');
+  const os = require('node:os');
+  const path = require('node:path');
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-cli-test-'));
+  const origHome = process.env.HOME;
+  process.env.HOME = tmp;
+  delete require.cache[require.resolve('../src/config')];
+  const c = require('../src/config');
+  try {
+    // Seed config as if the user logged in to org1 yesterday.
+    c.writeConfig({ api_key: 'sk-x', email: 'user@old.com', org_name: 'OldOrg' });
+
+    // API now returns the new tenant's identity → cache must update.
+    c.backfillUserInfo({ email: 'user@new.com', org_name: 'NewOrg' });
+    assert.equal(c.readConfig().email, 'user@new.com');
+    assert.equal(c.readConfig().org_name, 'NewOrg');
+
+    // Subsequent call with same data → no-op (idempotent).
+    c.backfillUserInfo({ email: 'user@new.com', org_name: 'NewOrg' });
+    assert.equal(c.readConfig().email, 'user@new.com');
+
+    // Partial / missing API response → cache preserved, NOT blanked.
+    c.backfillUserInfo({ email: 'user@new.com' });
+    assert.equal(c.readConfig().org_name, 'NewOrg');
+    c.backfillUserInfo({});
+    assert.equal(c.readConfig().email, 'user@new.com');
+    assert.equal(c.readConfig().org_name, 'NewOrg');
+
+    // Backend returning the legacy `organization_name` key still works.
+    c.backfillUserInfo({ organization_name: 'AnotherOrg' });
+    assert.equal(c.readConfig().org_name, 'AnotherOrg');
+
+    // Null / undefined input is a safe no-op.
+    c.backfillUserInfo(null);
+    c.backfillUserInfo(undefined);
+    assert.equal(c.readConfig().email, 'user@new.com');
+  } finally {
+    process.env.HOME = origHome;
+    delete require.cache[require.resolve('../src/config')];
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});