unbound-cli 1.16.17 → 1.16.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.16.17",
+  "version": "1.16.18",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/toolHealth.js

@@ -192,11 +192,17 @@ function envKeyCheck(label, name, kind = 'aux') {
   if (!r.found || !r.value) {
     return { name: label, ok: false, kind, detail: `${name} is not set`, summary: `${base} not set` };
   }
+  // Offer the rc-file keys as fallbacks so a shell opened before setup rewrote
+  // the rc (stale key in process.env) isn't misread as tampered. Only for
+  // Unbound-owned vars: a user-owned var like OPENAI_API_KEY may carry the
+  // user's personal key beside ours, and doctor must never upload that.
+  const rcFallback = name.startsWith('UNBOUND_') ? rcEnvValues(name).map((v) => v.value) : [];
+  const candidates = [...new Set([r.value, ...rcFallback].filter(Boolean))];
   return {
     name: label, ok: true, kind,
     detail: `${name} set (${r.source})`,
     summary: `${base} set`,
-    keyCheck: true, envName: name, value: r.value,
+    keyCheck: true, envName: name, value: r.value, candidates,
   };
 }
 
@@ -482,43 +488,53 @@ function detectTools({ gatewayUrl, _mdmDirs, _binaryPath } = {}) {
 // client can never wipe out the local-state view callers depend on.
 async function validateToolKeys(tools, validateKey) {
   if (!tools?.length) return tools;
-  const unique = new Set();
-  for (const t of tools) {
-    for (const c of t.checks || []) {
-      if (c.keyCheck && c.value) unique.add(c.value);
+  const verdict = new Map();
+  const check = async (keys) => {
+    const pending = [...keys].filter((k) => k && !verdict.has(k));
+    for (const [k, r] of await Promise.all(pending.map(async (k) => {
+      try { return [k, await validateKey(k)]; } catch { return [k, 'unknown']; }
+    }))) verdict.set(k, r);
+  };
+  // Validate the live value first; consult the rc-file fallbacks only when it is
+  // rejected. Avoids needless calls on the healthy path and, with the
+  // UNBOUND_-only candidate rule above, keeps rc siblings off the wire until a
+  // stale shell forces the search.
+  const live = new Set();
+  for (const t of tools) for (const c of t.checks || []) if (c.keyCheck && c.value) live.add(c.value);
+  if (!live.size) return tools;
+  await check(live);
+  const fallbacks = new Set();
+  for (const t of tools) for (const c of t.checks || []) {
+    if (c.keyCheck && c.value && verdict.get(c.value) === 'invalid') {
+      for (const v of c.candidates || []) if (v !== c.value) fallbacks.add(v);
     }
   }
-  if (!unique.size) return tools;
-  const entries = await Promise.all(
-    [...unique].map(async (k) => {
-      try {
-        return [k, await validateKey(k)];
-      } catch {
-        return [k, 'unknown'];
-      }
-    })
-  );
-  const validity = new Map(entries);
+  await check(fallbacks);
   for (const t of tools) {
     if (!t.checks?.length) continue;
     let okFlipped = false;
     for (const c of t.checks) {
-      if (!c.keyCheck) continue;
-      const verdict = validity.get(c.value);
-      if (verdict === 'invalid') {
+      if (!c.keyCheck || !c.value) continue;
+      const liveVerdict = verdict.get(c.value);
+      if (liveVerdict === 'valid') continue;
+      // rc fallbacks were fetched only when the live key was invalid.
+      const others = liveVerdict === 'invalid'
+        ? (c.candidates || []).filter((v) => v !== c.value).map((v) => verdict.get(v))
+        : [];
+      if (others.includes('valid')) continue; // a configured rc key is valid — wiring intact
+      if (liveVerdict !== 'invalid' || others.includes('unknown')) {
+        // Gateway unreachable for the live key, or for the only surviving rc
+        // candidates — fail open so an offline run isn't read as tampered.
+        c.validationSkipped = true;
+        c.detail = `${c.detail}; validation skipped — gateway unreachable`;
+      } else {
+        // Live key rejected and no configured key is valid — genuinely invalid.
         c.ok = false;
         c.warn = true;
         const base = c.name.replace(/ env$/, '');
         c.summary = `${base} invalid`;
         c.detail = `${c.envName} set but not valid for this tenant`;
         okFlipped = true;
-      } else if (verdict === 'unknown') {
-        // Stay healthy (fail-open), but record the skip so the caller can
-        // surface it. Without this tag the operator can't tell an offline
-        // run from a fully-validated one — that's the WEB-4922 lesson.
-        // Does NOT flip `ok`, so the `statusOf` re-derivation stays guarded.
-        c.validationSkipped = true;
-        c.detail = `${c.detail}; validation skipped — gateway unreachable`;
       }
     }
     // ONLY re-derive when a check's `ok` actually flipped. Without this guard,

package/test/tool-health.test.js

@@ -641,6 +641,98 @@ test('validateToolKeys: invalid verdict flips the tool to tampered', async () =>
   });
 });
 
+test('validateToolKeys: stale live-env key invalid but rc file holds a valid key → healthy', async () => {
+  await withHome(async (tmp, th) => {
+    const script = path.join(tmp, '.cursor', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.cursor', 'hooks.json'), JSON.stringify({ hooks: { PreToolUse: [{ command: script }] } }));
+    writeFile(script, '# unbound');
+    // A shell opened before setup rewrote the rc carries a stale key in the
+    // live env, while the valid key sits in a shell rc. Must not be tampered.
+    // .zshrc is on both the macOS and Linux rc lists, so the test is portable.
+    writeFile(path.join(tmp, '.zshrc'), 'export UNBOUND_CURSOR_API_KEY="rc-valid-key"\n');
+    process.env.UNBOUND_CURSOR_API_KEY = 'stale-invalid-key';
+    try {
+      const seen = [];
+      const tools = th.detectTools();
+      await th.validateToolKeys(tools, async (k) => { seen.push(k); return k === 'rc-valid-key' ? 'valid' : 'invalid'; });
+      const cursor = tools.find((t) => t.key === 'cursor');
+      assert.equal(cursor.status, 'healthy');
+      assert.equal(cursor.checks.find((c) => c.keyCheck).ok, true);
+      // Guard the rc read itself: if the rc file were skipped the tool would
+      // still be tampered, so prove the rc key actually reached the validator.
+      assert.ok(seen.includes('rc-valid-key'), 'the rc-file key must be validated, not just the live env key');
+    } finally {
+      delete process.env.UNBOUND_CURSOR_API_KEY;
+    }
+  });
+});
+
+test('validateToolKeys: live-env AND rc keys both invalid → tampered (no false clean)', async () => {
+  await withHome(async (tmp, th) => {
+    const script = path.join(tmp, '.cursor', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.cursor', 'hooks.json'), JSON.stringify({ hooks: { PreToolUse: [{ command: script }] } }));
+    writeFile(script, '# unbound');
+    writeFile(path.join(tmp, '.zshrc'), 'export UNBOUND_CURSOR_API_KEY="rc-stale-key"\n');
+    process.env.UNBOUND_CURSOR_API_KEY = 'env-stale-key';
+    try {
+      const seen = [];
+      const tools = th.detectTools();
+      await th.validateToolKeys(tools, async (k) => { seen.push(k); return 'invalid'; });
+      const cursor = tools.find((t) => t.key === 'cursor');
+      assert.equal(cursor.status, 'tampered');
+      assert.equal(cursor.checks.find((c) => c.keyCheck).ok, false);
+      // Both candidates must be validated — otherwise a skipped rc file lets
+      // this "every candidate rejected" case pass without ever reading the rc.
+      assert.ok(seen.includes('env-stale-key') && seen.includes('rc-stale-key'), 'both the live env and rc keys must be validated');
+    } finally {
+      delete process.env.UNBOUND_CURSOR_API_KEY;
+    }
+  });
+});
+
+test('validateToolKeys: a valid live key short-circuits — rc siblings are never sent to the validator', async () => {
+  await withHome(async (tmp, th) => {
+    const script = path.join(tmp, '.cursor', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.cursor', 'hooks.json'), JSON.stringify({ hooks: { PreToolUse: [{ command: script }] } }));
+    writeFile(script, '# unbound');
+    // A user-owned var (e.g. OPENAI_API_KEY for codex-gateway) can carry the
+    // user's personal key exported beside ours. A valid live key must stop the
+    // check before any rc sibling is uploaded to the gateway.
+    writeFile(path.join(tmp, '.zshrc'), 'export UNBOUND_CURSOR_API_KEY="personal-secret"\nexport UNBOUND_CURSOR_API_KEY="live-valid-key"\n');
+    process.env.UNBOUND_CURSOR_API_KEY = 'live-valid-key';
+    try {
+      const seen = [];
+      const tools = th.detectTools();
+      await th.validateToolKeys(tools, async (k) => { seen.push(k); return k === 'live-valid-key' ? 'valid' : 'invalid'; });
+      const cursor = tools.find((t) => t.key === 'cursor');
+      assert.equal(cursor.status, 'healthy');
+      assert.deepEqual(seen, ['live-valid-key'], 'only the live key is validated on the healthy path');
+      assert.ok(!seen.includes('personal-secret'), 'a sibling rc key must never be sent');
+    } finally {
+      delete process.env.UNBOUND_CURSOR_API_KEY;
+    }
+  });
+});
+
+test('validateToolKeys: user-owned OPENAI_API_KEY never has its rc siblings sent, even when the live key is rejected', async () => {
+  await withHome(async (tmp, th) => {
+    writeFile(path.join(tmp, '.codex', 'config.toml'), 'openai_base_url = "https://gateway.example/v1"\n');
+    // The user's personal OpenAI key sits in the rc beside anything Unbound set.
+    // A rejected live key must NOT trigger a search that uploads the personal one.
+    writeFile(path.join(tmp, '.zshrc'), 'export OPENAI_API_KEY="sk-personal-secret"\n');
+    process.env.OPENAI_API_KEY = 'stale-live-key';
+    try {
+      const seen = [];
+      const tools = th.detectTools();
+      await th.validateToolKeys(tools, async (k) => { seen.push(k); return 'invalid'; });
+      assert.ok(!seen.includes('sk-personal-secret'), 'a personal OpenAI key in the rc must never be sent to the gateway');
+      assert.deepEqual(seen, ['stale-live-key'], 'only the live value is ever validated for a user-owned var');
+    } finally {
+      delete process.env.OPENAI_API_KEY;
+    }
+  });
+});
+
 test('validateToolKeys: unknown verdict fails open — tool stays healthy', async () => {
   await withHome(async (tmp, th) => {
     const script = path.join(tmp, '.cursor', 'hooks', 'unbound.py');