unbound-cli 1.1.7 → 1.1.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.1.7",
+  "version": "1.1.8",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/onboard.js

@@ -221,9 +221,11 @@ Examples:
         // user's explicit --*-url flag.
         const written = config.setUrls({
           backend: opts.backendUrl,
+          frontend: opts.frontendUrl,
           gateway: opts.gatewayUrl,
         });
         const backendUrl = written.base_url || config.getBaseUrl();
+        const frontendUrl = written.frontend_url || config.getFrontendUrl();
         const gatewayUrl = written.gateway_url || config.getGatewayUrl();
         discoveryDomain = opts.domain || backendUrl;
 
@@ -240,7 +242,7 @@ Examples:
         console.log('');
         output.info('Step 1/2: Installing MDM tool bundle');
         const { ok, skipped } = await runMdmSetupAllBundle(adminApiKey, {
-          backendUrl, gatewayUrl, backfill: !!opts.backfill,
+          backendUrl, frontendUrl, gatewayUrl, backfill: !!opts.backfill,
         });
         if (!ok) return;
         setupSucceeded = true;

package/src/commands/setup.js

@@ -241,8 +241,9 @@ async function runPythonScriptWindows(scriptPath, args, { capture }) {
 /**
  * Builds the shared argv tail for setup.py invocations. Always passes the
  * tenant URL flags so the script's behavior is not sensitive to drift in its
- * own defaults. `mdm: true` skips --domain (frontend URL) since MDM scripts
- * have no browser-auth flow.
+ * own defaults. The frontend URL goes to non-MDM scripts as --domain (also
+ * their browser-auth host) and to MDM scripts as --frontend-url (persist-only,
+ * no auth flow). Either way it lands in ~/.unbound/config.json as frontend_url.
  */
 function buildScriptArgs(apiKey, { backendUrl, frontendUrl, gatewayUrl, clear, mdm, backfill } = {}) {
   // --clear runs no auth in the Python scripts, so the key may be absent. Omit
@@ -250,7 +251,7 @@ function buildScriptArgs(apiKey, { backendUrl, frontendUrl, gatewayUrl, clear, m
   let args = apiKey ? `--api-key ${shellEscape(apiKey)}` : '';
   if (backendUrl) args += ` --backend-url ${shellEscape(backendUrl)}`;
   if (gatewayUrl) args += ` --gateway-url ${shellEscape(gatewayUrl)}`;
-  if (!mdm && frontendUrl) args += ` --domain ${shellEscape(frontendUrl)}`;
+  if (frontendUrl) args += mdm ? ` --frontend-url ${shellEscape(frontendUrl)}` : ` --domain ${shellEscape(frontendUrl)}`;
   if (clear) args += ' --clear';
   if (backfill) args += ' --backfill';
   return args.trim();
@@ -819,9 +820,11 @@ Clear examples (no API key required):
         // UNBOUND_*_URL can't shadow the explicit --*-url flag.
         const written = config.setUrls({
           backend: globalOpts.backendUrl,
+          frontend: globalOpts.frontendUrl,
           gateway: globalOpts.gatewayUrl,
         });
         const backendUrl = written.base_url || config.getBaseUrl();
+        const frontendUrl = written.frontend_url || config.getFrontendUrl();
         const gatewayUrl = written.gateway_url || config.getGatewayUrl();
 
         if (globalOpts.all && tools.length > 0) {
@@ -890,6 +893,7 @@ Clear examples (no API key required):
           (tool) => {
             const toolArgs = buildScriptArgs(adminApiKey, {
               backendUrl,
+              frontendUrl,
               gatewayUrl,
               clear: globalOpts.clear,
               mdm: true,
@@ -1030,7 +1034,7 @@ async function runSetupAllBundle(apiKey, { backendUrl, frontendUrl, gatewayUrl,
  * Caller must ensure the process is running as root.
  * Returns true on success, false on failure.
  */
-async function runMdmSetupAllBundle(adminApiKey, { backendUrl, gatewayUrl, backfill = false } = {}) {
+async function runMdmSetupAllBundle(adminApiKey, { backendUrl, frontendUrl, gatewayUrl, backfill = false } = {}) {
   const resolvedTools = MDM_ALL_TOOLS.map(name => ({ name, ...MDM_TOOLS[name] }));
   if (backfill) {
     for (const tool of resolvedTools) {
@@ -1039,7 +1043,7 @@ async function runMdmSetupAllBundle(adminApiKey, { backendUrl, gatewayUrl, backf
   }
   return runBatch(resolvedTools, (tool) => {
     const args = buildScriptArgs(adminApiKey, {
-      backendUrl, gatewayUrl, mdm: true,
+      backendUrl, frontendUrl, gatewayUrl, mdm: true,
       backfill: backfill && scriptSupportsBackfill(tool.script),
     });
     return runScriptPiped(tool.script, args);

package/test/setup-args.test.js

@@ -70,14 +70,16 @@ test('scriptSupportsBackfill: cursor and gateway-mode scripts are unsupported',
   assert.ok(!scriptSupportsBackfill('gemini-cli/gateway/setup.py'));
 });
 
-// MDM scripts have no browser-auth flow, so --domain (frontend URL) is
-// suppressed even when a frontendUrl is supplied.
-test('buildScriptArgs: mdm:true suppresses --domain even with frontendUrl', () => {
+// MDM scripts have no browser-auth flow, so the frontend URL goes via
+// --frontend-url (persist-only), never --domain. It must still be passed so
+// frontend_url lands in each user's ~/.unbound/config.json.
+test('buildScriptArgs: mdm:true passes frontend as --frontend-url, not --domain', () => {
   const args = buildScriptArgs('sk-x', {
     mdm: true,
     frontendUrl: 'https://gateway.acme.com',
   });
   assert.ok(!args.includes('--domain'), args);
+  assert.ok(args.includes("--frontend-url 'https://gateway.acme.com'"), args);
 });
 
 test('buildScriptArgs: non-mdm includes --domain when frontendUrl passed', () => {