unbound-cli 1.1.1 → 1.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/onboard.js

@@ -23,7 +23,7 @@ function register(program) {
       'One-step user onboarding: install the default AI tools bundle and run device discovery. ' +
       'Runs `setup --all` followed by `discover` in a single command.'
     )
-    .option('--api-key <key>', 'User API key (or set UNBOUND_API_KEY env var)')
+    .option('--api-key <key>', 'User API key (or set UNBOUND_API_KEY env var, or reuse a stored `unbound login` key)')
     .option('--discovery-key <key>', 'Discovery API key for device scan (or set UNBOUND_DISCOVERY_KEY env var)')
     .option('--domain <url>', 'Backend URL for discovery (defaults to configured backend)')
     .option('--set-cron', 'Set up a daily background job to keep governance up to date')
@@ -33,7 +33,8 @@ function register(program) {
     .addOption(new Option('--gateway-url <url>', 'Override gateway URL for setup scripts (dev only)').hideHelp())
     .addHelpText('after', `
 Runs the full onboarding flow for an end user:
-  1. Logs in with --api-key and stores credentials.
+  1. Logs in with --api-key and stores credentials (or reuses a stored
+     \`unbound login\` key when --api-key is omitted).
   2. Installs the default tool bundle: ${ALL_TOOLS.join(', ')}.
   3. Runs device discovery with --discovery-key. With --set-cron, sets up a
      recurring daily scheduled scan (cross-platform) instead of a one-time scan.
@@ -56,8 +57,10 @@ Examples:
     .action(async (opts) => {
       const apiKeyOpt = opts.apiKey || process.env.UNBOUND_API_KEY;
       const discoveryKeyOpt = opts.discoveryKey || process.env.UNBOUND_DISCOVERY_KEY;
-      if (!apiKeyOpt) {
-        output.error('--api-key is required (or set UNBOUND_API_KEY env var)');
+      // A stored `unbound login` key is enough — only demand --api-key when not
+      // already logged in. ensureLoggedIn() reuses the stored credential below.
+      if (!apiKeyOpt && !config.isLoggedIn()) {
+        output.error('--api-key is required (or set UNBOUND_API_KEY env var, or run `unbound login` first)');
         process.exitCode = 1;
         return;
       }
@@ -116,7 +119,7 @@ Examples:
           const { setupScheduledRun } = require('../scheduled');
           await setupScheduledRun({
             command: 'onboard',
-            apiKey: apiKeyOpt,
+            apiKey: apiKeyOpt || apiKey,
             discoveryKey: discoveryKeyOpt,
             domain: discoveryDomain,
             skipRunAtLoad: true,
@@ -182,7 +185,7 @@ Examples:
       'One-step MDM onboarding: install the default MDM tool bundle and run device discovery. ' +
       'Requires root. Used by organization admins to enroll devices via MDM.'
     )
-    .requiredOption('--admin-api-key <key>', 'Admin API key for MDM enrollment')
+    .option('--admin-api-key <key>', 'Admin API key for MDM enrollment (falls back to your stored `unbound login` key)')
     .requiredOption('--discovery-key <key>', 'Discovery API key (for device scan)')
     .option('--domain <url>', 'Backend URL for discovery (defaults to configured backend)')
     .option('--backfill', 'Seed historical Claude Code / Codex / Copilot sessions from local transcripts into Unbound analytics (Cursor skipped automatically)')
@@ -196,11 +199,14 @@ Runs the full MDM onboarding flow for device enrollment:
 
 Both steps require root. The admin API key and discovery API key are
 separate keys obtained from different parts of the Unbound admin dashboard.
+--admin-api-key may be omitted to reuse the key stored by a prior
+\`unbound login\` (run sudo with HOME preserved so the stored key is found).
 
 For end-user onboarding (non-MDM), use \`unbound onboard\` instead.
 
 Examples:
   $ sudo unbound onboard-mdm --admin-api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY>
+  $ sudo unbound onboard-mdm --discovery-key <DISCOVERY_KEY>   Reuse the stored \`unbound login\` key
   $ sudo unbound onboard-mdm --admin-api-key <ADMIN_KEY> --discovery-key <DISCOVERY_KEY> --backfill
 `)
     .action(async (opts) => {
@@ -221,9 +227,17 @@ Examples:
 
         checkRoot('onboard-mdm');
 
+        // Reuse the key stored by `unbound login` when --admin-api-key is omitted.
+        const adminApiKey = opts.adminApiKey || config.getApiKey();
+        if (!adminApiKey) {
+          output.error('--admin-api-key is required (or run `unbound login` first).');
+          process.exitCode = 1;
+          return;
+        }
+
         console.log('');
         output.info('Step 1/2: Installing MDM tool bundle');
-        const ok = await runMdmSetupAllBundle(opts.adminApiKey, {
+        const ok = await runMdmSetupAllBundle(adminApiKey, {
           backendUrl, gatewayUrl, backfill: !!opts.backfill,
         });
         if (!ok) return;

package/src/commands/setup.js

@@ -510,7 +510,7 @@ requires authentication.
         // No tools specified → interactive multi-select (existing flow)
         if (tools.length === 0) {
           const selected = await output.multiSelect(
-            'Select tools to set up with Unbound:',
+            opts.clear ? 'Select tools to remove Unbound configuration for:' : 'Select tools to set up with Unbound:',
             SETUP_TOOLS
           );
 
@@ -530,14 +530,15 @@ requires authentication.
           const ok = await runBatch(selectedTools, (tool) => {
             const toolArgs = buildScriptArgs(apiKey, {
               ...urlOpts,
+              clear: opts.clear,
               backfill: opts.backfill && scriptSupportsBackfill(tool.script),
             });
             return runScriptPiped(tool.script, toolArgs);
-          });
+          }, { clear: opts.clear });
           if (!ok) return;
 
           console.log('');
-          output.success('All tools configured');
+          output.success(opts.clear ? 'All tools cleared' : 'All tools configured');
           return;
         }
 
@@ -705,7 +706,7 @@ requires authentication.
       'Used by organization admins to enroll devices via MDM.'
     )
     .argument('[tools...]', 'Tools to set up: ' + mdmToolNames)
-    .option('--admin-api-key <key>', 'Admin API key for MDM enrollment (not required with --clear)')
+    .option('--admin-api-key <key>', 'Admin API key for MDM enrollment (falls back to your stored `unbound login` key; not required with --clear)')
     .option('--clear', 'Remove Unbound configuration for the specified tools (no API key required)')
     .option('--all', 'Set up all available tools')
     .option('--backfill', 'Seed historical Claude Code / Codex / Copilot sessions from local transcripts into Unbound analytics (subscription/hooks mode only; Cursor unsupported)')
@@ -725,10 +726,12 @@ Note: claude-code-subscription and claude-code-gateway are mutually exclusive wh
       setting up; same for codex. Bare claude-code/codex set up subscription mode.
       When using --all, subscription mode is used by default for Claude Code and Codex.
 
-Setup examples (require --admin-api-key):
+Setup examples (need an admin key — pass --admin-api-key, or omit it to reuse the
+key stored by a prior \`unbound login\`):
   $ sudo unbound setup mdm --admin-api-key KEY cursor
   $ sudo unbound setup mdm --admin-api-key KEY cursor claude-code-subscription codex-subscription
   $ sudo unbound setup mdm --admin-api-key KEY --all
+  $ sudo unbound setup mdm --all                           Reuse the stored \`unbound login\` key
   $ sudo unbound setup mdm --admin-api-key KEY claude-code-subscription --backfill
                                                            Install hooks AND backfill local history
   $ sudo unbound setup mdm --admin-api-key KEY copilot --backfill
@@ -748,9 +751,12 @@ Clear examples (no API key required):
         // Use optsWithGlobals() so they all work regardless of position relative to `mdm`.
         const globalOpts = command.optsWithGlobals();
         // Clearing removes config without calling the API, so a key is only
-        // required when actually enrolling tools.
-        if (!globalOpts.clear && !opts.adminApiKey) {
-          output.error('--admin-api-key is required to set up tools.');
+        // required when actually enrolling tools. Fall back to the API key
+        // stored by `unbound login` so admins who are already logged in don't
+        // have to pass --admin-api-key again.
+        const adminApiKey = opts.adminApiKey || config.getApiKey();
+        if (!globalOpts.clear && !adminApiKey) {
+          output.error('--admin-api-key is required to set up tools (or run `unbound login` first).');
           process.exitCode = 1;
           return;
         }
@@ -829,7 +835,7 @@ Clear examples (no API key required):
         const ok = await runBatch(
           resolvedTools,
           (tool) => {
-            const toolArgs = buildScriptArgs(opts.adminApiKey, {
+            const toolArgs = buildScriptArgs(adminApiKey, {
               backendUrl,
               gatewayUrl,
               clear: globalOpts.clear,