unbound-cli 1.16.21 → 1.16.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.16.21",
+  "version": "1.16.22",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/doctor.js

@@ -130,7 +130,7 @@ Examples:
             const reasons = [];
             if (t.conflict) reasons.push('two modes installed');
             for (const c of t.checks) if (!c.ok) reasons.push(c.summary || c.name);
-            s = C.red(`✗ Tampered — ${reasons.join(', ')}`);
+            s = C.red(`✗ ${t.notEnforced ? 'Not enforced' : 'Tampered'} — ${reasons.join(', ')}`);
           } else s = C.dim('○ Not set up');
           console.log(`  ${labelOf(t).padEnd(W)}   ${s}`);
         }
@@ -153,6 +153,8 @@ Examples:
         const userNames = userTampered.map((t) => t.label).join(', ');
         const mdmNames = mdmTampered.map((t) => t.label).join(', ');
         const allFix = tampered.map((t) => t.key);
+        // A codex policy can live only in the user's cache, which a sudo re-detection may not see.
+        const mdmCmd = elevated(mdmTampered.some((t) => t.notEnforced) ? `unbound setup ${mdmFix.join(' ')}` : 'unbound doctor --fix');
         const anyInstalled = tools.some((t) => t.status !== 'not-installed');
 
         if (opts.fix) {
@@ -176,7 +178,7 @@ Examples:
           // tools only, and point at sudo for whatever's org-managed.
           if (!root && !userFix.length) {
             console.log(`${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization.`);
-            console.log(`  Run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
+            console.log(`  Run ${C.bold(mdmCmd)} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
             console.log('');
             process.exitCode = 1;
             return;
@@ -186,7 +188,7 @@ Examples:
           output.info(`Reinstalling: ${fixDisplay}${root ? ' (org-wide, all users)' : ''}`);
           console.log('');
           const r = spawnSync(process.argv[0], [process.argv[1], 'setup', ...fixNow], { stdio: 'inherit' });
-          if (!root && mdmFix.length) console.error(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
+          if (!root && mdmFix.length) console.error(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold(mdmCmd)} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
           process.exitCode = fixExitCode(r.status, root, mdmFix.length > 0) || ((configMismatch || blankConfigDir) ? 1 : 0);
           return;
         }
@@ -213,11 +215,11 @@ Examples:
             console.log(`  Run ${C.bold('unbound doctor --fix')} to repair ${userNames}.`);
           } else if (!userFix.length) {
             console.log(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization.`);
-            console.log(`  Run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
+            console.log(`  Run ${C.bold(mdmCmd)} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
           } else {
             // Both: a user without sudo can still fix their own tools; sudo fixes everything.
             console.log(`  Run ${C.bold('unbound doctor --fix')} to repair ${userNames}.`);
-            console.log(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'} too.`);
+            console.log(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold(mdmCmd)} to repair ${mdmFix.length === 1 ? 'it' : 'them'} too.`);
           }
         }
         if (key.state === 'invalid') {

package/src/toolHealth.js

@@ -16,7 +16,7 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { spawnSync } = require('child_process');
+const { spawnSync, execFileSync } = require('child_process');
 const TOML = require('@iarna/toml');
 const claudePaths = require('./claudePaths');
 
@@ -238,7 +238,7 @@ function managedDir(family, platform = process.platform, env = process.env) {
   const dirs = {
     cursor: { darwin: `${mac}/Cursor`, linux: '/etc/cursor', win32: path.join(pd, 'Cursor') },
     'claude-code': { darwin: `${mac}/ClaudeCode`, linux: '/etc/claude-code', win32: path.join(pf, 'ClaudeCode') },
-    codex: { darwin: `${mac}/Codex`, linux: '/etc/codex', win32: path.join(pf, 'Codex') },
+    codex: { darwin: '/etc/codex', linux: '/etc/codex', win32: path.join(pf, 'Codex') },
     augment: { darwin: '/etc/augment', linux: '/etc/augment', win32: path.join(pd, 'Augment') },
   };
   if (!dirs[family]) return null;
@@ -371,7 +371,7 @@ function buildVariants(gatewayUrl, binaryPath) {
           const features = cfg.features;
           if (!features || typeof features !== 'object') return false;
           return features.hooks === undefined ? features.codex_hooks === true : features.hooks === true;
-        } }, { short: 'codex hooks not enabled' }),
+        } }, { short: 'codex hooks not enabled', kind: 'aux' }), // aux: an org install leaves it set with no user hook
         scriptCheck('Hook script', '~/.codex/hooks/unbound.py'),
         envKeyCheck('API key env', 'UNBOUND_CODEX_API_KEY'),
       ],
@@ -436,6 +436,23 @@ function detectVariant(variant) {
   return { key: variant.key, label: variant.label, family: variant.family, mode: variant.mode, status: statusOf(checks), checks };
 }
 
+// Where codex's requirements set allow_managed_hooks_only (codex then skips user-level hooks), or null.
+// Reads the host's real policy files, like mdmDetect reads its managed dirs; tests pass _codexManagedOnly.
+function codexManagedHooksOnly() {
+  const on = (text) => /^[ \t]*["']?allow_managed_hooks_only["']?[ \t]*=[ \t]*true\b/m.test((text || '').replace(/^\uFEFF/, ''));
+  const strings = (v) => (typeof v === 'string' ? [v] : v && typeof v === 'object' ? Object.values(v).flatMap(strings) : []);
+  const system = process.platform === 'win32' ? path.join(process.env.ProgramData || 'C:\\ProgramData', 'OpenAI', 'Codex', 'requirements.toml') : '/etc/codex/requirements.toml';
+  if (on(readText(system))) return system;
+  // The cloud cache is JSON; its TOML lives in string values.
+  const cache = path.join(process.env.CODEX_HOME || path.join(HOME, '.codex'), 'cloud-config-bundle-cache.json');
+  if (strings(readJson(cache)).some(on)) return cache;
+  const plist = '/Library/Managed Preferences/com.openai.codex.plist';
+  try {
+    const b64 = execFileSync('/usr/bin/plutil', ['-extract', 'requirements_toml_base64', 'raw', '-o', '-', plist], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    return on(Buffer.from(b64, 'base64').toString()) ? plist : null;
+  } catch { return null; }
+}
+
 // Collapse the per-(tool,mode) variants to one entry per product family. Picks
 // the installed/tampered mode if any; otherwise reports managed-by-mdm or
 // not-installed. This is what both `doctor` and `status` render.
@@ -443,7 +460,8 @@ function detectVariant(variant) {
 // org-managed scenarios can be exercised without writing under /Library or /etc.
 // `_binaryPath` (test-only) overrides the system hook-binary path so binary-mode
 // scenarios can be exercised without writing under /opt.
-function detectTools({ gatewayUrl, _mdmDirs, _binaryPath } = {}) {
+// `_codexManagedOnly` (test-only) replaces the codexManagedHooksOnly() result.
+function detectTools({ gatewayUrl, _mdmDirs, _binaryPath, _codexManagedOnly } = {}) {
   const variants = buildVariants(gatewayUrl, _binaryPath).map(detectVariant);
   const families = [];
   const seen = new Set();
@@ -472,6 +490,16 @@ function detectTools({ gatewayUrl, _mdmDirs, _binaryPath } = {}) {
       }
     }
   }
+  // A working org hook in codex's system folder runs regardless, so only a user-level install is at risk.
+  // Gateway mode proxies traffic and is unaffected; a dual-mode install already reports 'two modes installed'.
+  const codex = families.find((t) => t.key === 'codex-subscription' && t.status !== 'not-installed');
+  const atRisk = codex && mdmDetect('codex', _mdmDirs && _mdmDirs.codex, _binaryPath).status !== 'healthy';
+  const managedOnly = atRisk && (_codexManagedOnly !== undefined ? _codexManagedOnly : codexManagedHooksOnly());
+  if (managedOnly) {
+    codex.checks.push({ name: 'Managed hooks only', ok: false, kind: 'structural', summary: 'Codex only runs managed hooks',
+      detail: `allow_managed_hooks_only is set in ${managedOnly}` });
+    Object.assign(codex, { status: 'tampered', notEnforced: true, scope: 'mdm' });
+  }
   return families;
 }
 

package/test/codex-managed-hooks-only.test.js

@@ -0,0 +1,58 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+function detectCodex({ userHook = true, mdmHook = false, managedOnly = null, cache, real = false } = {}) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-codex-'));
+  const write = (p, text) => { fs.mkdirSync(path.dirname(p), { recursive: true }); fs.writeFileSync(p, text); };
+  const saved = { HOME: process.env.HOME, KEY: process.env.UNBOUND_CODEX_API_KEY, CODEX_HOME: process.env.CODEX_HOME };
+  try {
+    process.env.HOME = home;
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    process.env.CODEX_HOME = path.join(home, '.codex');
+    if (cache) write(path.join(home, '.codex', 'cloud-config-bundle-cache.json'), JSON.stringify(cache));
+    write(path.join(home, '.codex', 'config.toml'), '[features]\nhooks = true\n');
+    if (userHook) {
+      write(path.join(home, '.codex', 'hooks.json'), JSON.stringify({ hooks: { Stop: [{ hooks: [{ command: 'unbound.py' }] }] } }));
+      write(path.join(home, '.codex', 'hooks', 'unbound.py'), '');
+    }
+    const mdm = path.join(home, 'etc-codex');
+    if (mdmHook) {
+      write(path.join(mdm, 'hooks.json'), JSON.stringify({ hooks: { Stop: [{ hooks: [{ command: 'unbound.py' }] }] } }));
+      write(path.join(mdm, 'hooks', 'unbound.py'), '');
+    }
+    delete require.cache[require.resolve('../src/toolHealth')];
+    delete require.cache[require.resolve('../src/claudePaths')];
+    const { detectTools } = require('../src/toolHealth');
+    return detectTools({ _mdmDirs: { codex: mdm }, _codexManagedOnly: real ? undefined : managedOnly }).find((t) => t.family === 'codex');
+  } finally {
+    process.env.HOME = saved.HOME;
+    if (saved.CODEX_HOME === undefined) delete process.env.CODEX_HOME; else process.env.CODEX_HOME = saved.CODEX_HOME;
+    if (saved.KEY === undefined) delete process.env.UNBOUND_CODEX_API_KEY; else process.env.UNBOUND_CODEX_API_KEY = saved.KEY;
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+}
+
+test('a user-level codex hook under allow_managed_hooks_only is not enforced and routed org-wide', () => {
+  const t = detectCodex({ managedOnly: '/etc/codex/requirements.toml' });
+  assert.equal(t.status, 'tampered');
+  assert.equal(t.notEnforced, true);
+  assert.equal(t.scope, 'mdm');
+});
+
+test('an org install that left the feature flag behind reads as managed, not tampered', () => {
+  const t = detectCodex({ userHook: false, mdmHook: true, managedOnly: '/etc/codex/requirements.toml' });
+  assert.equal(t.status, 'managed-by-mdm');
+});
+
+test('the setting on the first line of the cloud policy cache is detected', () => {
+  const t = detectCodex({ real: true, cache: { toml: 'allow_managed_hooks_only = true\n' } });
+  assert.equal(t.notEnforced, true);
+});
+
+test('a working org hook means the user install is not flagged', () => {
+  const t = detectCodex({ mdmHook: true, managedOnly: '/etc/codex/requirements.toml' });
+  assert.ok(!t.notEnforced);
+});

package/test/tool-health-mdm-paths.test.js

@@ -31,7 +31,7 @@ test('managedDir win32: honors ProgramFiles/ProgramData overrides, falls back wh
 test('managedDir darwin: unchanged', () => {
   assert.equal(managedDir('cursor', 'darwin', {}), '/Library/Application Support/Cursor');
   assert.equal(managedDir('claude-code', 'darwin', {}), '/Library/Application Support/ClaudeCode');
-  assert.equal(managedDir('codex', 'darwin', {}), '/Library/Application Support/Codex');
+  assert.equal(managedDir('codex', 'darwin', {}), '/etc/codex');
   assert.equal(managedDir('augment', 'darwin', {}), '/etc/augment');
 });