unbound-cli 1.11.0 → 1.11.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.11.0",
+  "version": "1.11.1",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/setup.js

@@ -209,11 +209,15 @@ async function runPythonScript(scriptPath, args, { capture }) {
         windowsHide: true,
       });
       let out = '';
+      // stderr is also kept on its own. Python block-buffers stdout when piped,
+      // so a crash's stdout can flush after the traceback and interleave with it
+      // in `out` — failureReason needs an uncontaminated stream to read.
+      let errOut = '';
       if (capture) {
         child.stdin.on('error', () => {});
         child.stdin.end();
         child.stdout.on('data', (d) => { out += d.toString(); });
-        child.stderr.on('data', (d) => { out += d.toString(); });
+        child.stderr.on('data', (d) => { const s = d.toString(); out += s; errOut += s; });
       }
       child.on('close', (code) => {
         if (code === 0) return resolve();
@@ -223,7 +227,10 @@ async function runPythonScript(scriptPath, args, { capture }) {
         // Carry the numeric exit code so callers can report it to the failure
         // ledger (reportSetupFailure) without re-parsing the message.
         err.exitCode = code;
-        if (capture) err.setupOutput = out.trim();
+        if (capture) {
+          err.setupOutput = out.trim();
+          err.stderr = errOut.trim();
+        }
         reject(err);
       });
       child.on('error', reject);
@@ -576,6 +583,61 @@ async function runBatch(tools, runFn, { clear = false, summary = null, report =
   return { ok: true, skipped: mdmSkipped };
 }
 
+/**
+ * Picks the most useful one-line reason out of a failed setup script's captured
+ * output. The python scripts open AND close with a `====` banner, so the first
+ * line is never the reason a step failed — taking it verbatim produced the
+ * useless `Codex (gateway) (====================)` that hid a real bug. Prefer
+ * the last line the script itself flagged as an error, then the exit code.
+ *
+ * Tolerates a non-Error throw: this runs inside nuke's per-tool catch, so
+ * throwing here would abort the remaining tools instead of clearing them.
+ */
+function failureReason(err) {
+  err = err || {};
+  // Read the traceback from stderr when we have it: `out` merges both streams by
+  // arrival order, so buffered stdout can land between the header and the
+  // exception. Fall back to the merged text for callers that don't set stderr.
+  const crash = exceptionLine(err.stderr) || exceptionLine(err.message);
+  if (crash) return truncate(crash);
+  const lines = (err.message || '').split('\n').map((l) => l.trim()).filter(Boolean);
+  // Otherwise the lines the scripts themselves flag. The dotted form catches a
+  // bare exception line captured without its traceback header.
+  const flagged = lines.filter((l) => /^(❌|failed\b|error\b|exception\b|[\w.]*(error|exception):)/i.test(l));
+  const pick = flagged.length ? flagged[flagged.length - 1] : null;
+  if (pick) return truncate(pick);
+  if (err.exitCode != null) return `exit code ${err.exitCode}`;
+  return truncate(lines[0] || 'failed');
+}
+
+/**
+ * The exception a python traceback ended on, or null if `text` has no traceback.
+ * Structural rather than positional: frame lines are indented, so the exception
+ * is the first UNindented line after the header. That holds even if buffered
+ * stdout flushed into the middle of the traceback. The LAST header wins, since
+ * with chained exceptions ("During handling of the above exception...") the final
+ * one is what actually propagated.
+ */
+function exceptionLine(text) {
+  const raw = (text || '').split('\n');
+  let header = -1;
+  for (let i = 0; i < raw.length; i++) {
+    if (/^traceback\b/i.test(raw[i].trim())) header = i;
+  }
+  if (header === -1) return null;
+  const exc = raw.slice(header + 1).find(
+    (l) => l.trim() && !/^\s/.test(l) && !/^=+$/.test(l.trim())
+  );
+  return exc ? exc.trim() : null;
+}
+
+// Slice by code point, not code unit, so an 80-char cut can't split an emoji
+// or other astral character into a broken fragment.
+function truncate(s, max = 80) {
+  const chars = Array.from(s);
+  return chars.length > max ? chars.slice(0, max).join('') : s;
+}
+
 /**
  * Clears a set of tools best-effort: a single tool failing does not abort the
  * rest (unlike runBatch, which stops on first failure). Used by `uninstall`,
@@ -592,8 +654,7 @@ async function clearToolsBestEffort(layer, tools, { mdm, backendUrl, gatewayUrl,
       await runScriptPiped(tool.script, args);
       s.succeed(`${layer}: ${tool.label}`);
     } catch (err) {
-      const reason = (err.message || 'failed').split('\n')[0].slice(0, 80);
-      s.fail(`${layer}: ${tool.label} (${reason})`);
+      s.fail(`${layer}: ${tool.label} (${failureReason(err)})`);
       failed.push(tool.label);
     }
   }
@@ -1183,6 +1244,7 @@ module.exports = {
   scriptSupportsBackfill,
   resolveSetupAllTools,
   clearUnboundEnvsEverywhere,
+  failureReason,
   NUKE_ENV_VARS,
   removeBinaryInstall,
   runBinaryClear,

package/test/setup-args.test.js

@@ -3,7 +3,7 @@ const assert = require('node:assert/strict');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { buildScriptArgs, scriptSupportsBackfill, resolveSetupAllTools, clearUnboundEnvsEverywhere, NUKE_ENV_VARS, removeBinaryInstall, runBinaryClear, BINARY_INSTALL_PATHS } = require('../src/commands/setup');
+const { buildScriptArgs, scriptSupportsBackfill, resolveSetupAllTools, clearUnboundEnvsEverywhere, failureReason, NUKE_ENV_VARS, removeBinaryInstall, runBinaryClear, BINARY_INSTALL_PATHS } = require('../src/commands/setup');
 
 // shellEscape single-quotes every value, so a real key surfaces as
 // --api-key '<key>' at the head of the argv tail.
@@ -451,3 +451,170 @@ test('runBinaryClear: clear exits non-zero — fail-open (ran:true, ok:false), n
     fs.rmSync(tmp, { recursive: true, force: true });
   }
 });
+
+// The python clears open AND close with a `====` banner, so the old
+// `.split('\n')[0]` reason rendered `Codex (gateway) (==================)` —
+// which is what hid the real MDM-clear bug. Prefer the script's own error line.
+test('failureReason: skips the ==== banner and reports the script error line', () => {
+  const err = new Error([
+    '============================================================',
+    'Codex - Clearing MDM Setup',
+    '============================================================',
+    '',
+    'Clearing environment variables...',
+    'Failed to clear openai_base_url in codex config for alice',
+    '',
+    'Clear Complete!',
+  ].join('\n'));
+  err.exitCode = 1;
+  assert.equal(failureReason(err), 'Failed to clear openai_base_url in codex config for alice');
+});
+
+test('failureReason: picks the LAST flagged line when a script reports several', () => {
+  const err = new Error('Failed to clear API_KEY for 1 user(s)\nFailed to clear BASE_URL for 1 user(s)');
+  assert.equal(failureReason(err), 'Failed to clear BASE_URL for 1 user(s)');
+});
+
+test('failureReason: recognises the scripts’ ❌ prefix', () => {
+  const err = new Error('====\nSetup\n====\n❌ No user home directories found');
+  err.exitCode = 1;
+  assert.equal(failureReason(err), '❌ No user home directories found');
+});
+
+// Banner-only output with no error line must not surface "Clear Complete!" as
+// the reason — the exit code is the honest answer there.
+test('failureReason: no flagged line falls back to the exit code, not the banner', () => {
+  const err = new Error('============\nCodex - Clearing MDM Setup\n============\n\nClear Complete!');
+  err.exitCode = 2;
+  assert.equal(failureReason(err), 'exit code 2');
+});
+
+// Download failures carry no exitCode; their message is already the reason.
+test('failureReason: download failure with no exitCode keeps its own message', () => {
+  const err = new Error('Download failed: 404 Not Found');
+  err.downloadFailed = true;
+  assert.equal(failureReason(err), 'Download failed: 404 Not Found');
+});
+
+test('failureReason: empty message never returns undefined', () => {
+  assert.equal(failureReason(new Error('')), 'failed');
+  assert.equal(failureReason({}), 'failed');
+});
+
+test('failureReason: long error lines are truncated to 80 chars', () => {
+  const err = new Error('Failed to ' + 'x'.repeat(200));
+  assert.equal(failureReason(err).length, 80);
+});
+
+// A python crash prints a traceback whose LAST line is the real cause. Falling
+// back to `exit code 1` there would be less useful than the old first-line rule.
+test('failureReason: python traceback reports the exception, not the header', () => {
+  const err = new Error([
+    'Traceback (most recent call last):',
+    '  File "/tmp/setup.py", line 704, in clear_setup',
+    '    remove_codex_config_base_url_for_user(username, home_dir)',
+    "NameError: name 'home_dir' is not defined",
+  ].join('\n'));
+  err.exitCode = 1;
+  assert.equal(failureReason(err), "NameError: name 'home_dir' is not defined");
+});
+
+// exitCode 0 is falsy — must not fall through to the banner-first branch.
+// Module-qualified exception names have dots, so a name-shaped regex misses
+// them. The traceback tail is taken instead, whatever the exception is called.
+test('failureReason: dotted exception name in a traceback is reported', () => {
+  const err = new Error([
+    'Traceback (most recent call last):',
+    '  File "/tmp/setup.py", line 800, in clear_managed_hooks',
+    '    settings = json.load(f)',
+    'json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)',
+  ].join('\n'));
+  err.exitCode = 1;
+  assert.equal(failureReason(err), 'json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)');
+});
+
+// Not every python exception name contains "Error"/"Exception".
+test('failureReason: traceback tail works for a non-Error exception name', () => {
+  const err = new Error('Traceback (most recent call last):\n  File "x.py", line 1\nsocket.timeout: timed out');
+  err.exitCode = 1;
+  assert.equal(failureReason(err), 'socket.timeout: timed out');
+});
+
+// A bare exception line captured without its traceback header still flags.
+test('failureReason: dotted exception line without a traceback header flags', () => {
+  const err = new Error('====\nCodex - Clearing MDM Setup\n====\nsubprocess.CalledProcessError: returned non-zero exit status 1');
+  err.exitCode = 1;
+  assert.equal(failureReason(err), 'subprocess.CalledProcessError: returned non-zero exit status 1');
+});
+
+// Banner lines after the traceback must not be mistaken for the cause.
+test('failureReason: banner trailing a traceback is skipped', () => {
+  const err = new Error('Traceback (most recent call last):\nValueError: bad\n============');
+  err.exitCode = 1;
+  assert.equal(failureReason(err), 'ValueError: bad');
+});
+
+// runPythonScript merges stdout+stderr by arrival order and python block-buffers
+// stdout when piped, so a crash's progress lines can land AFTER the traceback.
+// Picking the tail would report "Clear Complete!" as the failure reason.
+test('failureReason: stdout flushed after the traceback does not displace the exception', () => {
+  const err = new Error([
+    'Traceback (most recent call last):',
+    '  File "/tmp/setup.py", line 9, in clear_setup',
+    'ValueError: the real cause',
+    '============================================================',
+    'Clear Complete!',
+  ].join('\n'));
+  err.exitCode = 1;
+  assert.equal(failureReason(err), 'ValueError: the real cause');
+});
+
+// stderr is captured separately precisely so interleaving can't matter.
+test('failureReason: prefers the clean stderr stream over the merged output', () => {
+  const err = new Error('====\nClearing environment variables...\nTraceback (most recent call last):\nOSError: merged and interleaved\nClear Complete!');
+  err.stderr = 'Traceback (most recent call last):\n  File "x.py", line 1\nPermissionError: from stderr';
+  err.exitCode = 1;
+  assert.equal(failureReason(err), 'PermissionError: from stderr');
+});
+
+// Chained exceptions: the LAST traceback is the one that actually propagated.
+test('failureReason: chained exceptions report the final one', () => {
+  const err = new Error([
+    'Traceback (most recent call last):',
+    '  File "x.py", line 1',
+    'ValueError: the first one',
+    'During handling of the above exception, another exception occurred:',
+    'Traceback (most recent call last):',
+    '  File "x.py", line 5',
+    'RuntimeError: the one that propagated',
+  ].join('\n'));
+  err.exitCode = 1;
+  assert.equal(failureReason(err), 'RuntimeError: the one that propagated');
+});
+
+// Indented frame lines are never the reason.
+test('failureReason: never reports an indented traceback frame line', () => {
+  const err = new Error('Traceback (most recent call last):\n  File "x.py", line 1, in f\n    boom()\nKeyError: \'gateway_url\'');
+  err.exitCode = 1;
+  assert.equal(failureReason(err), "KeyError: 'gateway_url'");
+});
+
+test('failureReason: exitCode 0 is reported, not treated as absent', () => {
+  assert.equal(failureReason({ message: '====\nCodex\n====', exitCode: 0 }), 'exit code 0');
+});
+
+// Truncation slices code points, so an emoji at the boundary stays intact.
+test('failureReason: truncation never splits an astral character', () => {
+  const reason = failureReason(new Error('Failed ' + '🔥'.repeat(100)));
+  assert.equal(Array.from(reason).length, 80);
+  assert.ok(!reason.includes('\ufffd'), reason);
+  assert.ok(/🔥$/.test(reason), reason);
+});
+
+// Runs inside nuke's per-tool catch — throwing here would abort the remaining
+// tools instead of clearing them, so a non-Error throw must not blow up.
+test('failureReason: non-Error throw (null/undefined) never throws', () => {
+  assert.equal(failureReason(null), 'failed');
+  assert.equal(failureReason(undefined), 'failed');
+  assert.equal(failureReason('a string'), 'failed');
+});