unbound-cli 1.16.9 → 1.16.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.16.9",
+  "version": "1.16.10",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/toolHealth.js

@@ -17,6 +17,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { spawnSync } = require('child_process');
+const TOML = require('@iarna/toml');
 const claudePaths = require('./claudePaths');
 
 const HOME = os.homedir();
@@ -353,7 +354,18 @@ function buildVariants(gatewayUrl, binaryPath) {
       key: 'codex-subscription', label: 'Codex (subscription)', family: 'codex', mode: 'subscription',
       checks: () => [
         configCheck('Config', '~/.codex/hooks.json', { json: true, test: refsUnbound }),
-        configCheck('Hooks feature flag', '~/.codex/config.toml', { json: false, test: (t) => /codex_hooks\s*=\s*true/.test(t) }, { short: 'codex hooks not enabled' }),
+        // Codex enables hooks via `[features] hooks = true`; the pre-Aug-2026 alias
+        // `[features] codex_hooks = true` is still honoured, with the canonical `hooks`
+        // winning when both are set. Both live under [features], so a hooks key in any
+        // other table isn't this flag; an unparseable config (which Codex couldn't load
+        // either) reads as not enabled.
+        configCheck('Hooks feature flag', '~/.codex/config.toml', { json: false, test: (t) => {
+          let cfg;
+          try { cfg = TOML.parse(t.replace(/^\uFEFF/, '')); } catch { return false; } // tolerate a UTF-8 BOM, like readJson
+          const features = cfg.features;
+          if (!features || typeof features !== 'object') return false;
+          return features.hooks === undefined ? features.codex_hooks === true : features.hooks === true;
+        } }, { short: 'codex hooks not enabled' }),
         scriptCheck('Hook script', '~/.codex/hooks/unbound.py'),
         envKeyCheck('API key env', 'UNBOUND_CODEX_API_KEY'),
       ],

package/test/doctor-codex-e2e.test.js

@@ -0,0 +1,71 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+// End-to-end guard through the real shipped binary: `unbound doctor --json`.
+// The unit tests exercise detectTools directly; this proves the same fix holds
+// when the CLI is actually run. A Codex install using the current spelling
+// (`[features] hooks = true`) must report healthy, not tampered — the reported
+// bug. Key validation is pointed at an unroutable API so it fails open offline
+// and never leaves the machine.
+
+const CLI = path.join(__dirname, '..', 'src', 'index.js');
+
+function runDoctor(home) {
+  const r = spawnSync('node', [CLI, 'doctor', '--json'], {
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      HOME: home,
+      UNBOUND_CODEX_API_KEY: 'dummy-key',
+      // Unroutable API: validateApiKey fails fast and fails open (status stays
+      // as detectTools derived it), so the run is hermetic and offline.
+      UNBOUND_API_URL: 'http://127.0.0.1:1',
+    },
+  });
+  // doctor exits non-zero when ANY tool is tampered; this host may carry
+  // unrelated MDM-managed tools, so we assert on the codex entry, not the code.
+  const start = r.stdout.indexOf('{');
+  assert.notEqual(start, -1, `doctor produced no JSON\nstdout:${r.stdout}\nstderr:${r.stderr}`);
+  return JSON.parse(r.stdout.slice(start));
+}
+
+function seedHealthyCodex(home) {
+  const wrapper = path.join(home, '.codex', 'hooks', 'unbound.py');
+  fs.mkdirSync(path.dirname(wrapper), { recursive: true });
+  fs.writeFileSync(wrapper, '# unbound');
+  fs.writeFileSync(path.join(home, '.codex', 'hooks.json'), JSON.stringify({
+    hooks: { PreToolUse: [{ command: wrapper }] },
+  }));
+}
+
+test('unbound doctor: real binary reads new-spelling [features] hooks = true codex as healthy', () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-doctor-e2e-'));
+  try {
+    seedHealthyCodex(home);
+    fs.writeFileSync(path.join(home, '.codex', 'config.toml'), 'model = "gpt-5"\n\n[features]\nhooks = true\n');
+    const report = runDoctor(home);
+    const codex = report.tools.find((t) => t.tool === 'codex-subscription');
+    assert.ok(codex, 'doctor JSON must include the codex-subscription tool');
+    assert.equal(codex.status, 'healthy', 'a working codex install must not read as tampered');
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test('unbound doctor: real binary reads legacy [features] codex_hooks = true codex as healthy', () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-doctor-e2e-'));
+  try {
+    seedHealthyCodex(home);
+    fs.writeFileSync(path.join(home, '.codex', 'config.toml'), '[features]\ncodex_hooks = true\n');
+    const report = runDoctor(home);
+    const codex = report.tools.find((t) => t.tool === 'codex-subscription');
+    assert.ok(codex, 'doctor JSON must include the codex-subscription tool');
+    assert.equal(codex.status, 'healthy', 'a legacy codex install must stay healthy');
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});

package/test/tool-health.test.js

@@ -361,8 +361,148 @@ test('detectTools: codex binary regression (wrapper at ~/.codex/hooks/unbound.py
       hooks: { PreToolUse: [{ command: wrapper }] },
     }));
     writeFile(wrapper, '#!/bin/sh\nexec /opt/unbound/current/unbound-hook/unbound-hook hook codex "$@"\n');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), '[features]\nhooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'healthy');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// The installer now writes `hooks = true` under [features] (and strips the legacy
+// `codex_hooks`). A healthy Codex install using the new spelling must read healthy.
+test('detectTools: codex with new-spelling [features] hooks = true → healthy', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), 'model = "gpt-5"\n\n[features]\nhooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'healthy');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// An unrelated key ending in `hooks = true` must NOT satisfy the flag: with no real
+// hooks flag present the feature is off, so the install reads tampered.
+test('detectTools: codex config with only `web_hooks = true` (no real flag) → tampered', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), 'web_hooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'tampered');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// `hooks = true` under a table other than [features] does not enable Codex's hooks,
+// so the flag must not count it: the install reads tampered, not healthy.
+test('detectTools: codex `hooks = true` outside [features] (wrong table) → tampered', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), '[mcp_servers.demo]\nhooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'tampered');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// The legacy alias only ever lived under [features]. A root-level `codex_hooks = true`
+// is not a form the installer or Codex ever wrote, so it must not count: tampered.
+test('detectTools: codex root-level `codex_hooks = true` (outside [features]) → tampered', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
     writeFile(path.join(tmp, '.codex', 'config.toml'), 'codex_hooks = true\n');
     process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'tampered');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// Codex resolves the canonical `hooks` ahead of the alias, so an explicit
+// `hooks = false` disables hooks even when `codex_hooks = true` sits beside it.
+test('detectTools: codex `[features] hooks = false` beside `codex_hooks = true` → tampered', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), '[features]\nhooks = false\ncodex_hooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'tampered');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// Before the Aug-2026 rename the installer wrote the alias `[features] codex_hooks = true`.
+// Codex still honours that table-scoped alias, so a real legacy install reads healthy.
+test('detectTools: codex legacy `[features] codex_hooks = true` alias → healthy', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), '[features]\ncodex_hooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'healthy');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// Codex tolerates a leading UTF-8 BOM on config.toml, so doctor must too: strip it
+// before parsing (like readJson) rather than failing closed to tampered.
+test('detectTools: codex config with a leading UTF-8 BOM (`[features] hooks = true`) → healthy', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), '\uFEFF[features]\nhooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
     try {
       const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
       assert.equal(t.status, 'healthy');
@@ -372,6 +512,65 @@ test('detectTools: codex binary regression (wrapper at ~/.codex/hooks/unbound.py
   });
 });
 
+// The installer can emit the inline-table form `features = { hooks = true }`, which is
+// the same [features] hooks = true after parsing, so it must read healthy.
+test('detectTools: codex inline `features = { hooks = true }` → healthy', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), 'features = { hooks = true }\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'healthy');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// A config Codex can't parse can't have hooks enabled, so even one that contains a
+// `codex_hooks = true` line must read tampered rather than healthy.
+test('detectTools: codex with a malformed config.toml → tampered', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    writeFile(wrapper, '# unbound');
+    writeFile(path.join(tmp, '.codex', 'config.toml'), 'codex_hooks = true\n[unterminated\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'tampered');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
+// The hook file going missing must still read tampered even when the feature flag is set.
+test('detectTools: codex hook script missing (flag set) → tampered', () => {
+  withHome((tmp, th) => {
+    const wrapper = path.join(tmp, '.codex', 'hooks', 'unbound.py');
+    writeFile(path.join(tmp, '.codex', 'hooks.json'), JSON.stringify({
+      hooks: { PreToolUse: [{ command: wrapper }] },
+    }));
+    // Deliberately do NOT create the unbound.py hook script.
+    writeFile(path.join(tmp, '.codex', 'config.toml'), '[features]\nhooks = true\n');
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    try {
+      const t = th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'codex');
+      assert.equal(t.status, 'tampered');
+    } finally {
+      delete process.env.UNBOUND_CODEX_API_KEY;
+    }
+  });
+});
+
 // envCheck's rc-file fallback applies to the gateway URL check
 // (ANTHROPIC_BASE_URL is still equality-checked since tenants share one
 // gateway URL). API keys are no longer equality-checked — see WEB-4949 — so