unbound-cli 1.17.0 → 1.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.17.0",
+  "version": "1.18.0",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/setup.js

@@ -377,6 +377,7 @@ async function runSetupScriptReported(script, stepName, apiKey, opts = {}) {
 // — it's a generic user-owned var that can have non-Unbound uses.
 const NUKE_ENV_VARS = [
   'UNBOUND_API_KEY',
+  'UNBOUND_DEVICE_TOKEN',
   'UNBOUND_CLAUDE_API_KEY',
   'UNBOUND_CODEX_API_KEY',
   'UNBOUND_COPILOT_API_KEY',

package/src/config.js

@@ -77,11 +77,15 @@ function clearApiKey() {
 
 // The send-only device key, where setup scripts and hooks read it.
 function getDeviceKey() {
-  return readConfig().api_key || null;
+  const config = readConfig();
+  // api_key first: every writer still sets it, and older writers set only it.
+  return config.api_key || config.device_token || null;
 }
 
 function setDeviceKey(apiKey) {
   const config = readConfig();
+  config.device_token = apiKey;
+  // Older CLIs and hooks read only `api_key`; stop writing it once they are gone.
   config.api_key = apiKey;
   writeConfig(config);
 }

package/src/toolHealth.js

@@ -206,6 +206,14 @@ function envKeyCheck(label, name, kind = 'aux') {
   };
 }
 
+// Setup writes UNBOUND_DEVICE_TOKEN; installs from before it carry only the per-tool name.
+function deviceTokenCheck(legacyName) {
+  const check = envKeyCheck('API key env', 'UNBOUND_DEVICE_TOKEN');
+  if (check.ok) return check;
+  const legacy = envKeyCheck('API key env', legacyName);
+  return legacy.ok ? legacy : check;
+}
+
 function envCheck(label, name, expected, kind = 'aux') {
   const base = label.replace(/ env$/, '');
   const r = readEnvVar(name);
@@ -334,7 +342,7 @@ function buildVariants(gatewayUrl, binaryPath) {
       checks: () => [
         configCheck('Config', '~/.cursor/hooks.json', { json: true, test: refsUnbound }),
         scriptCheck('Hook script', '~/.cursor/hooks/unbound.py'),
-        envKeyCheck('API key env', 'UNBOUND_CURSOR_API_KEY'),
+        deviceTokenCheck('UNBOUND_CURSOR_API_KEY'),
       ],
     },
     {
@@ -342,7 +350,7 @@ function buildVariants(gatewayUrl, binaryPath) {
       checks: () => [
         configCheck('Config', claudePath('settings.json'), { json: true, test: refsUnbound }),
         scriptCheck('Hook script', claudePath('hooks', 'unbound.py')),
-        envKeyCheck('API key env', 'UNBOUND_CLAUDE_API_KEY'),
+        deviceTokenCheck('UNBOUND_CLAUDE_API_KEY'),
       ],
     },
     {
@@ -373,7 +381,7 @@ function buildVariants(gatewayUrl, binaryPath) {
           return features.hooks === undefined ? features.codex_hooks === true : features.hooks === true;
         } }, { short: 'codex hooks not enabled', kind: 'aux' }), // aux: an org install leaves it set with no user hook
         scriptCheck('Hook script', '~/.codex/hooks/unbound.py'),
-        envKeyCheck('API key env', 'UNBOUND_CODEX_API_KEY'),
+        deviceTokenCheck('UNBOUND_CODEX_API_KEY'),
       ],
     },
     {
@@ -397,7 +405,7 @@ function buildVariants(gatewayUrl, binaryPath) {
         const checks = [configCheck('Config', '~/.copilot/hooks/unbound.json', { json: true, test: refsUnbound })];
         if (hasBinary) checks.push(scriptCheck('Hook binary', binaryPath || BINARY_PATH));
         else checks.push(scriptCheck('Hook script', '~/.copilot/hooks/unbound.py'));
-        checks.push(envKeyCheck('API key env', 'UNBOUND_COPILOT_API_KEY'));
+        checks.push(deviceTokenCheck('UNBOUND_COPILOT_API_KEY'));
         return checks;
       },
     },
@@ -414,7 +422,7 @@ function buildVariants(gatewayUrl, binaryPath) {
         const checks = [configCheck('Config', '~/.augment/settings.json', { json: false, test: (t) => t.includes('unbound.py') || t.includes(BINARY_MARKER) })];
         if (hasBinary) checks.push(scriptCheck('Hook binary', binaryPath || BINARY_PATH));
         else checks.push(scriptCheck('Hook script', '~/.augment/hooks/unbound.py'));
-        checks.push(envKeyCheck('API key env', 'UNBOUND_AUGMENT_API_KEY'));
+        checks.push(deviceTokenCheck('UNBOUND_AUGMENT_API_KEY'));
         return checks;
       },
     },

package/test/device-token.test.js

@@ -0,0 +1,46 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+function withConfig(contents, fn) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-token-'));
+  const origHome = process.env.HOME;
+  process.env.HOME = tmp;
+  const file = path.join(tmp, '.unbound', 'config.json');
+  if (contents) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(contents));
+  }
+  delete require.cache[require.resolve('../src/config')];
+  try {
+    return fn(require('../src/config'), file);
+  } finally {
+    process.env.HOME = origHome;
+    delete require.cache[require.resolve('../src/config')];
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+test('getDeviceKey prefers api_key, which an older writer may have updated alone', () => {
+  withConfig({ device_token: 'stale', api_key: 'relogged' }, (config) => {
+    assert.equal(config.getDeviceKey(), 'relogged');
+  });
+});
+
+test('getDeviceKey falls back to device_token', () => {
+  withConfig({ device_token: 'new' }, (config) => {
+    assert.equal(config.getDeviceKey(), 'new');
+  });
+});
+
+test('setDeviceKey writes both fields so older CLIs and hooks still read it', () => {
+  withConfig({ api_key: 'old', base_url: 'https://api.acme.com' }, (config, file) => {
+    config.setDeviceKey('k2');
+    const written = JSON.parse(fs.readFileSync(file, 'utf8'));
+    assert.equal(written.device_token, 'k2');
+    assert.equal(written.api_key, 'k2');
+    assert.equal(written.base_url, 'https://api.acme.com');
+  });
+});

package/test/tool-health.test.js

@@ -1085,3 +1085,34 @@ test('isUnboundKeyHelper: a helper under a relocated CLAUDE_CONFIG_DIR is still
     delete require.cache[require.resolve('../src/toolHealth')];
   }
 });
+
+// The per-tool env check accepts the shared UNBOUND_DEVICE_TOKEN or the per-tool name from older installs.
+function claudeWithEnv(env) {
+  return withHome((tmp, th) => {
+    writeFile(path.join(tmp, '.claude', 'settings.json'), JSON.stringify({ hooks: { x: [{ command: path.join(tmp, '.claude', 'hooks', 'unbound.py') }] } }));
+    writeFile(path.join(tmp, '.claude', 'hooks', 'unbound.py'), '#');
+    const names = ['UNBOUND_DEVICE_TOKEN', 'UNBOUND_CLAUDE_API_KEY'];
+    const saved = names.map((n) => process.env[n]);
+    names.forEach((n) => delete process.env[n]);
+    Object.assign(process.env, env);
+    try {
+      return th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'claude-code');
+    } finally {
+      names.forEach((n, i) => { if (saved[i] === undefined) delete process.env[n]; else process.env[n] = saved[i]; });
+    }
+  });
+}
+
+test('claude-code: UNBOUND_DEVICE_TOKEN alone → healthy', () => {
+  assert.equal(claudeWithEnv({ UNBOUND_DEVICE_TOKEN: 'k' }).status, 'healthy');
+});
+
+test('claude-code: only the per-tool UNBOUND_CLAUDE_API_KEY → healthy', () => {
+  assert.equal(claudeWithEnv({ UNBOUND_CLAUDE_API_KEY: 'k' }).status, 'healthy');
+});
+
+test('claude-code: neither env set → tampered, naming UNBOUND_DEVICE_TOKEN', () => {
+  const t = claudeWithEnv({});
+  assert.equal(t.status, 'tampered');
+  assert.ok(t.checks.some((c) => !c.ok && /UNBOUND_DEVICE_TOKEN is not set/.test(c.detail)));
+});