unbound-cli 1.8.0 → 1.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/setup.js

@@ -448,6 +448,45 @@ function removeBinaryInstall({
   return { removed, failed };
 }
 
+
+// Run the binary's own `unbound-hook clear` to deregister managed configs
+// (strip our hooks from shared configs, remove our scripts + per-tool logs)
+// BEFORE the install tree is deleted. Essential on binary-only machines that
+// have no python3 to run the downloaded per-tool clears, and authoritative for
+// binary installs generally — it reuses the same clear_setup() as the python
+// clears. Fail-open: never throws; returns { ran, ok }. `binaryPath`/`runner`
+// are overridable so tests stay hermetic.
+function runBinaryClear({
+  binaryPath = path.join(BINARY_INSTALL_PATHS.optDir, 'current', 'unbound-hook', 'unbound-hook'),
+  runner = spawnSync,
+} = {}) {
+  // lstatSync (not existsSync, which follows symlinks) so a present-but-broken
+  // `current/...` symlink is still detected — we attempt the clear and surface
+  // the failure instead of silently skipping it. A truly absent path (python-only
+  // install) throws → no-op.
+  let present = false;
+  try { fs.lstatSync(binaryPath); present = true; } catch (e) { present = false; }
+  if (!present) return { ran: false, ok: true };
+  try {
+    // timeout so a hung clear can never block nuke from removing the binary.
+    const r = runner(binaryPath, ['clear'], { stdio: 'pipe', timeout: 120000, killSignal: 'SIGKILL' });
+    if (r.error) {
+      const why = r.error.code === 'ETIMEDOUT' ? 'timed out (120s)' : r.error.message;
+      output.warn(`nuke: unbound-hook clear ${why}; continuing.`);
+      return { ran: true, ok: false };
+    }
+    if (r.status !== 0) {
+      const stderr = r.stderr ? r.stderr.toString().trim() : '';
+      output.warn(`nuke: unbound-hook clear exited ${r.status}: ${stderr || '(no stderr)'}`);
+      return { ran: true, ok: false };
+    }
+    return { ran: true, ok: true };
+  } catch (err) {
+    output.warn(`nuke: unbound-hook clear errored: ${err.message}`);
+    return { ran: true, ok: false };
+  }
+}
+
 /**
  * Returns true when the process has the privileges needed to touch system-level
  * (MDM) configuration. On Windows, `net session` succeeds only when elevated, so
@@ -1047,8 +1086,13 @@ Examples:
           // `_confirmProductionPaths` is the explicit "this is the real call site"
           // ack — the function refuses production defaults without it as a guard
           // against tests forgetting to override paths.
+          // Deregister managed configs via the binary's own clear FIRST (works
+          // without python3, which a binary-only machine lacks); reuses the same
+          // clear_setup() as the python clears. Must precede the rm below.
+          const binClear = runBinaryClear();
           const { removed: binaryRemoved, failed: bf } = removeBinaryInstall({ _confirmProductionPaths: true });
           binaryFailed = bf;
+          if (binClear.ran && !binClear.ok) binaryFailed.push('unbound-hook clear');
           if (binaryRemoved.length) {
             output.info(`Removed binary install: ${binaryRemoved.join('; ')}.`);
           }
@@ -1141,5 +1185,6 @@ module.exports = {
   clearUnboundEnvsEverywhere,
   NUKE_ENV_VARS,
   removeBinaryInstall,
+  runBinaryClear,
   BINARY_INSTALL_PATHS,
 };

package/test/setup-args.test.js

@@ -3,7 +3,7 @@ const assert = require('node:assert/strict');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { buildScriptArgs, scriptSupportsBackfill, resolveSetupAllTools, clearUnboundEnvsEverywhere, NUKE_ENV_VARS, removeBinaryInstall, BINARY_INSTALL_PATHS } = require('../src/commands/setup');
+const { buildScriptArgs, scriptSupportsBackfill, resolveSetupAllTools, clearUnboundEnvsEverywhere, NUKE_ENV_VARS, removeBinaryInstall, runBinaryClear, BINARY_INSTALL_PATHS } = require('../src/commands/setup');
 
 // shellEscape single-quotes every value, so a real key surfaces as
 // --api-key '<key>' at the head of the argv tail.
@@ -396,3 +396,58 @@ test('removeBinaryInstall: refuses production-default paths without _confirmProd
 test('BINARY_INSTALL_PATHS: is frozen', () => {
   assert.ok(Object.isFrozen(BINARY_INSTALL_PATHS));
 });
+
+test('runBinaryClear: binary present — runs `<bin> clear` before removal, reports ok', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-binclear-'));
+  const bin = path.join(tmp, 'unbound-hook');
+  fs.writeFileSync(bin, '#');
+  const calls = [];
+  try {
+    const r = runBinaryClear({ binaryPath: bin, runner: (b, args, opts) => { calls.push([b, args, opts]); return { status: 0 }; } });
+    assert.deepEqual(r, { ran: true, ok: true });
+    assert.equal(calls.length, 1, 'binary clear should run exactly once');
+    assert.equal(calls[0][0], bin);
+    assert.deepEqual(calls[0][1], ['clear']);
+    assert.ok(calls[0][2].timeout > 0, 'clear must run with a timeout so a hang cannot block nuke');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('runBinaryClear: dangling binary symlink — still attempts (surfaces, not silently skipped)', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-binclear-'));
+  const link = path.join(tmp, 'unbound-hook');
+  fs.symlinkSync(path.join(tmp, 'missing-target'), link); // dangling: target absent
+  let called = false;
+  try {
+    const r = runBinaryClear({ binaryPath: link, runner: () => { called = true; return { error: { code: 'ENOENT', message: 'spawn ENOENT' } }; } });
+    assert.equal(called, true, 'a dangling symlink must still be attempted, not treated as absent');
+    assert.deepEqual(r, { ran: true, ok: false });
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('runBinaryClear: binary absent (python-only install) — no-op, runner never called', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-binclear-'));
+  let called = false;
+  try {
+    const r = runBinaryClear({ binaryPath: path.join(tmp, 'nope'), runner: () => { called = true; return { status: 0 }; } });
+    assert.deepEqual(r, { ran: false, ok: true });
+    assert.equal(called, false);
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('runBinaryClear: clear exits non-zero — fail-open (ran:true, ok:false), never throws', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-binclear-'));
+  const bin = path.join(tmp, 'unbound-hook');
+  fs.writeFileSync(bin, '#');
+  try {
+    const r = runBinaryClear({ binaryPath: bin, runner: () => ({ status: 1, stderr: Buffer.from('boom') }) });
+    assert.deepEqual(r, { ran: true, ok: false });
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});