unbound-cli 1.20.2 → 1.20.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.20.2",
+  "version": "1.20.3",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/toolHealth.js

@@ -206,12 +206,27 @@ function envKeyCheck(label, name, kind = 'aux') {
   };
 }
 
-// Setup writes UNBOUND_DEVICE_TOKEN; installs from before it carry only the per-tool name.
+function configDeviceToken() {
+  try {
+    const cfg = JSON.parse(fs.readFileSync(path.join(os.homedir(), '.unbound', 'config.json'), 'utf8'));
+    return cfg.api_key || cfg.device_token || null;
+  } catch {
+    return null;
+  }
+}
+
+// Env wins when present so a stale exported key is still validated; setup keeps the token in ~/.unbound/config.json and removes the env var.
 function deviceTokenCheck(legacyName) {
   const check = envKeyCheck('API key env', 'UNBOUND_DEVICE_TOKEN');
   if (check.ok) return check;
   const legacy = envKeyCheck('API key env', legacyName);
-  return legacy.ok ? legacy : check;
+  if (legacy.ok) return legacy;
+  const value = configDeviceToken();
+  if (!value) return check;
+  return {
+    name: 'API key env', ok: true, kind: 'aux', detail: 'device token set (config.json)', summary: 'API key set',
+    keyCheck: true, envName: 'device token', value, candidates: [value],
+  };
 }
 
 function envCheck(label, name, expected, kind = 'aux') {

package/test/tool-health.test.js

@@ -1111,6 +1111,31 @@ test('claude-code: only the per-tool UNBOUND_CLAUDE_API_KEY → healthy', () =>
   assert.equal(claudeWithEnv({ UNBOUND_CLAUDE_API_KEY: 'k' }).status, 'healthy');
 });
 
+test('claude-code: device token in config.json and no env → healthy', () => {
+  const t = withHome((tmp, th) => {
+    writeFile(path.join(tmp, '.claude', 'settings.json'), JSON.stringify({ hooks: { x: [{ command: path.join(tmp, '.claude', 'hooks', 'unbound.py') }] } }));
+    writeFile(path.join(tmp, '.claude', 'hooks', 'unbound.py'), '#');
+    writeFile(path.join(tmp, '.unbound', 'config.json'), JSON.stringify({ device_token: 'k' }));
+    return th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'claude-code');
+  });
+  assert.equal(t.status, 'healthy');
+});
+
+test('claude-code: an exported key is the one validated even when config.json holds another', () => {
+  process.env.UNBOUND_DEVICE_TOKEN = 'from-env';
+  try {
+    const t = withHome((tmp, th) => {
+      writeFile(path.join(tmp, '.claude', 'settings.json'), JSON.stringify({ hooks: { x: [{ command: path.join(tmp, '.claude', 'hooks', 'unbound.py') }] } }));
+      writeFile(path.join(tmp, '.claude', 'hooks', 'unbound.py'), '#');
+      writeFile(path.join(tmp, '.unbound', 'config.json'), JSON.stringify({ device_token: 'from-config' }));
+      return th.detectTools({ apiKey: 'k' }).find((x) => x.family === 'claude-code');
+    });
+    assert.equal(t.checks.find((c) => c.keyCheck).value, 'from-env');
+  } finally {
+    delete process.env.UNBOUND_DEVICE_TOKEN;
+  }
+});
+
 test('claude-code: neither env set → tampered, naming UNBOUND_DEVICE_TOKEN', () => {
   const t = claudeWithEnv({});
   assert.equal(t.status, 'tampered');