unbound-cli 1.16.11 → 1.16.12

package/README.md

@@ -254,7 +254,7 @@ Alias: `unbound groups` works the same as `unbound user-groups`.
 | `unbound tools connect <type>` | Connect a tool |
 | `unbound tools approved` | List approved tool types |
 
-Supported tool types: `CLAUDE_CODE`, `UNBOUND_CLAUDE_CODE`, `CURSOR`, `COPILOT`, `AUGMENT_CODE`, `ROO_CODE`, `CLINE`, `GEMINI_CLI`, `CODEX`, `UNBOUND_CODEX`, `KILO_CODE`, `CUSTOM_ACCESS`
+Supported tool types: `CLAUDE_CODE`, `CURSOR`, `COPILOT`, `AUGMENT_CODE`, `ROO_CODE`, `CLINE`, `GEMINI_CLI`, `CODEX`, `KILO_CODE`, `CUSTOM_ACCESS`
 
 ## Configuration
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.16.11",
+  "version": "1.16.12",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/tools.js

@@ -12,7 +12,6 @@ const SUPPORTED_TOOL_TYPES = [
   'CLINE',
   'GEMINI_CLI',
   'CODEX',
-  'UNBOUND_CODEX',
   'KILO_CODE',
   'CUSTOM_ACCESS',
 ];
@@ -181,4 +180,4 @@ Examples:
     });
 }
 
-module.exports = { register };
+module.exports = { register, SUPPORTED_TOOL_TYPES };

package/test/tools-backend-contract.test.js

@@ -0,0 +1,55 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const path = require('path');
+const { SUPPORTED_TOOL_TYPES } = require('../src/commands/tools');
+
+// Cross-repo contract: every tool type the CLI offers must be one the backend's
+// agents API accepts, or `tools connect` sends a request the backend answers
+// with 400. Rather than mirror the backend list by hand (which silently drifts),
+// this reads the REAL allowlist from ai-gateway-data at
+// webapp/api/v1/agent_handlers.py::SUPPORTED_AGENT_TOOL_TYPES.
+//
+// The backend repo isn't a dependency of the CLI, so when it isn't checked out
+// beside this one the test skips rather than failing — it runs wherever the
+// fleet is present (a dev machine, the cross-repo CI stage) and is a no-op
+// elsewhere. Point it explicitly with AI_GATEWAY_DATA_DIR.
+
+const HANDLERS_REL = 'webapp/api/v1/agent_handlers.py';
+
+function findBackendFile() {
+  const candidates = [];
+  if (process.env.AI_GATEWAY_DATA_DIR) {
+    candidates.push(path.join(process.env.AI_GATEWAY_DATA_DIR, HANDLERS_REL));
+  }
+  // Common layouts: a sibling checkout next to unbound-cli.
+  const repoRoot = path.join(__dirname, '..');
+  candidates.push(path.join(repoRoot, '..', 'ai-gateway-data', HANDLERS_REL));
+  candidates.push(path.join(repoRoot, '..', '..', 'ai-gateway-data', HANDLERS_REL));
+  return candidates.find((p) => { try { return fs.existsSync(p); } catch { return false; } });
+}
+
+function parseBackendAllowlist(file) {
+  const src = fs.readFileSync(file, 'utf8');
+  const m = src.match(/SUPPORTED_AGENT_TOOL_TYPES\s*=\s*\[([\s\S]*?)\]/);
+  assert.ok(m, 'could not locate SUPPORTED_AGENT_TOOL_TYPES in agent_handlers.py');
+  const types = [...m[1].matchAll(/['"]([A-Z_]+)['"]/g)].map((x) => x[1]);
+  assert.ok(types.length > 0, 'parsed an empty backend allowlist');
+  return new Set(types);
+}
+
+const backendFile = findBackendFile();
+
+test('every CLI-offered tool type is in the REAL backend agent_handlers allowlist',
+  { skip: backendFile ? false : 'ai-gateway-data not checked out (set AI_GATEWAY_DATA_DIR)' },
+  () => {
+    const accepted = parseBackendAllowlist(backendFile);
+    for (const type of SUPPORTED_TOOL_TYPES) {
+      assert.ok(accepted.has(type),
+        `CLI offers ${type} but the backend allowlist does not accept it (would 400)`);
+    }
+    // Guard the specific regression: the removed type must be absent from the CLI
+    // list precisely because the backend rejects it.
+    assert.ok(!SUPPORTED_TOOL_TYPES.includes('UNBOUND_CODEX') || accepted.has('UNBOUND_CODEX'),
+      'UNBOUND_CODEX may only be offered if the backend accepts it');
+  });

package/test/tools-supported-types.test.js

@@ -0,0 +1,85 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { Command } = require('commander');
+
+const config = require('../src/config');
+const api = require('../src/api');
+const output = require('../src/output');
+const { register, SUPPORTED_TOOL_TYPES } = require('../src/commands/tools');
+
+// Mirror of ai-gateway-data webapp/api/v1/agent_handlers.py SUPPORTED_AGENT_TOOL_TYPES.
+// `tools connect` must only offer types this backend accepts; anything else gets a 400.
+const BACKEND_ACCEPTED = new Set([
+  'CLAUDE_CODE', 'UNBOUND_CLAUDE_CODE', 'CURSOR', 'COPILOT',
+  'ROO_CODE', 'CLINE', 'GEMINI_CLI', 'CODEX', 'KILO_CODE', 'OPENCLAW',
+  'CUSTOM_ACCESS', 'AUGMENT_CODE',
+]);
+
+// Drive the real `tools connect` action with login + api stubbed. Returns
+// { reachedApi, sentType, errored } so a test can tell a type accepted by the
+// CLI (reaches the connect call) from one the CLI rejects before any request.
+async function connect(toolType) {
+  const orig = {
+    isLoggedIn: config.isLoggedIn,
+    post: api.post,
+    error: output.error,
+    success: output.success,
+    keyValue: output.keyValue,
+    json: output.json,
+    exitCode: process.exitCode,
+  };
+  let reachedApi = false;
+  let sentType = null;
+  let errored = false;
+  let errorMsg = '';
+  config.isLoggedIn = () => true;
+  api.post = async (_path, { body }) => { reachedApi = true; sentType = body.tool_type; return { tool_type: body.tool_type, status: 'connected' }; };
+  output.error = (m) => { errored = true; errorMsg = String(m ?? ''); };
+  output.success = () => {};
+  output.keyValue = () => {};
+  output.json = () => {};
+  try {
+    const program = new Command();
+    register(program);
+    await program.parseAsync(['node', 'x', 'tools', 'connect', toolType]);
+    return { reachedApi, sentType, errored, errorMsg, exitCode: process.exitCode };
+  } finally {
+    config.isLoggedIn = orig.isLoggedIn;
+    api.post = orig.post;
+    output.error = orig.error;
+    output.success = orig.success;
+    output.keyValue = orig.keyValue;
+    output.json = orig.json;
+    process.exitCode = orig.exitCode;
+  }
+}
+
+// The backend rejects UNBOUND_CODEX with a 400, so the CLI must not offer it.
+test('tools connect UNBOUND_CODEX is rejected before any backend call', async () => {
+  const r = await connect('UNBOUND_CODEX');
+  assert.equal(r.reachedApi, false, 'must not send an UNBOUND_CODEX connect request');
+  assert.equal(r.errored, true, 'must report an unsupported-type error');
+  assert.equal(r.exitCode, 1, 'must exit non-zero so scripts see the rejection');
+  // The error points the user at the real types: it names the supported set,
+  // including the correct CODEX to reach for instead.
+  assert.match(r.errorMsg, /Supported types:/);
+  assert.match(r.errorMsg, /\bCODEX\b/);
+});
+
+// A representative valid type still connects.
+test('tools connect CODEX reaches the backend with tool_type CODEX', async () => {
+  const r = await connect('CODEX');
+  assert.equal(r.reachedApi, true);
+  assert.equal(r.sentType, 'CODEX');
+});
+
+// Drive the actual production allowlist: every type the CLI offers must reach the
+// backend and be one the backend accepts. Adding a backend-rejected type to
+// SUPPORTED_TOOL_TYPES would fail here rather than recur as a runtime 400.
+test('every CLI-offered tool type is accepted by the backend', async () => {
+  for (const type of SUPPORTED_TOOL_TYPES) {
+    const r = await connect(type);
+    assert.equal(r.reachedApi, true, `CLI should offer ${type}`);
+    assert.ok(BACKEND_ACCEPTED.has(r.sentType), `CLI offers ${r.sentType} which the backend rejects`);
+  }
+});