unbound-cli 0.4.0 → 0.5.0

package/LOCAL_DEV.md

@@ -68,11 +68,44 @@ node src/index.js login --base-url http://localhost:8000 --api-key <your-key>
 node src/index.js whoami
 node src/index.js status
 
-# Policies
+# Policies — overview
+node src/index.js policy                         # overview + docs links
+node src/index.js policy form-data               # reference data (must produce output — bugfix)
 node src/index.js policy list
 node src/index.js policy list --type SECURITY --json
 node src/index.js policy get 1
-node src/index.js policy form-data
+node src/index.js policy effective 1
+
+# Policy type subcommands
+node src/index.js policy cost --help
+node src/index.js policy model --help
+node src/index.js policy security --help
+node src/index.js policy tool --help
+
+# Cost policies
+node src/index.js policy cost list
+node src/index.js policy cost create --name "Test Cost" --monthly-budget 500 --group engg
+node src/index.js policy cost update 5 --monthly-budget 750
+
+# Model policies
+node src/index.js policy model create --name "No Opus" --all-models --excluded claude-3-opus
+node src/index.js policy model create --name "Sonnet Only" --allowed claude-3-5-sonnet
+
+# Security policies
+node src/index.js policy security create --name "Block PII" --sub-type guardrails \
+    --guardrail PII:BLOCK --guardrail Secrets:REDACT
+node src/index.js policy security create --name "Route 429s" --sub-type error-code-routing \
+    --error-route 429:gpt-4:claude-3-5-sonnet
+
+# Tool policies (separate backend: /api/v1/command-policies/)
+node src/index.js policy tool list
+node src/index.js policy tool families
+node src/index.js policy tool mcp-servers
+node src/index.js policy tool create-terminal --name "Block rm -rf" \
+    --command-family filesystem --field command='rm -rf*' --action BLOCK \
+    --custom-message "Destructive command blocked."
+node src/index.js policy tool create-mcp --name "Audit Linear writes" \
+    --mcp-server Linear --mcp-action-type write --action AUDIT
 
 # Users
 node src/index.js users list

package/README.md

@@ -127,17 +127,92 @@ Scan a device for installed AI coding tools and report findings to Unbound. Uses
 
 ### Policies (Admin only)
 
+Unbound has **four** policy types. Each has its own subcommand with guided flag-based create/update. Tool policies live on a separate backend endpoint but are reachable under the same `policy` command tree.
+
+Docs: https://docs.getunbound.ai/policies
+
+| Type | Subcommand | Purpose | Docs |
+|---|---|---|---|
+| **Cost** | `unbound policy cost` | Monthly budget limits per user group | https://docs.getunbound.ai/policies/cost-policies |
+| **Model** | `unbound policy model` | Control which AI models are available | https://docs.getunbound.ai/policies/model-policies |
+| **Security** | `unbound policy security` | Guardrails (PII, secrets), routing rules | https://docs.getunbound.ai/policies/security-policies |
+| **Tool** | `unbound policy tool` | Shell command and MCP tool controls | https://docs.getunbound.ai/policies/tool-policies |
+
+Generic commands (Cost/Model/Security only):
+
 | Command | Description |
 |---------|-------------|
-| `unbound policy list` | List all policies |
-| `unbound policy get <id>` | Get policy details |
-| `unbound policy create --name <n> --type <t>` | Create a policy |
-| `unbound policy update <id>` | Update a policy |
+| `unbound policy` | Overview of types and subcommands |
+| `unbound policy list [--type COST\|MODEL\|SECURITY]` | List policies |
+| `unbound policy get <id>` | Get a policy's details |
 | `unbound policy delete <id>` | Delete a policy |
-| `unbound policy form-data` | Get reference data for policy creation |
-| `unbound policy effective <id>` | View effective policies for a user/group |
+| `unbound policy form-data` | Reference data: user groups, models, guardrails, tool types, command policies |
+| `unbound policy effective <id> [--user\|--group]` | View effective policies for a user or group |
+
+Cost policy examples:
+
+```bash
+# Create a $1,000/month cap for the engg user group
+unbound policy cost create --name "Eng Budget" --monthly-budget 1000 --group engg
+
+# Change the budget
+unbound policy cost update 5 --monthly-budget 1500
+
+# List just cost policies
+unbound policy cost list
+```
+
+Model policy examples:
+
+```bash
+# Allow only specific models
+unbound policy model create --name "Sonnet Only" --allowed claude-3-5-sonnet
+
+# Allow everything except specific models
+unbound policy model create --name "No Opus" --all-models --excluded claude-3-opus
+
+# List all model policies
+unbound policy model list
+```
+
+Security policy examples:
+
+```bash
+# Block PII, redact secrets, for the engg group
+unbound policy security create --name "Block PII" --sub-type guardrails \
+    --guardrail PII:BLOCK --guardrail Secrets:REDACT --group engg
+
+# Default-route gpt-4 traffic to claude-3-5-sonnet
+unbound policy security create --name "Prefer Sonnet" --sub-type default-routing \
+    --route gpt-4:claude-3-5-sonnet
+
+# Fall back on 429s
+unbound policy security create --name "429 Fallback" --sub-type error-code-routing \
+    --error-route 429:gpt-4:claude-3-5-sonnet
+```
+
+Tool policy examples:
+
+```bash
+# See what command families and MCP servers are available
+unbound policy tool families
+unbound policy tool mcp-servers
+
+# Block destructive shell commands
+unbound policy tool create-terminal --name "Block rm -rf" --command-family filesystem \
+    --field command='rm -rf*' --action BLOCK --custom-message "Destructive command blocked."
+
+# Audit Linear write operations via MCP
+unbound policy tool create-mcp --name "Audit Linear writes" --mcp-server Linear \
+    --mcp-action-type write --action AUDIT
+
+# List, get, delete
+unbound policy tool list
+unbound policy tool get <id>
+unbound policy tool delete <id>
+```
 
-Policy types: `SECURITY`, `MODEL`, `COST`
+Before creating any policy, run `unbound policy form-data` to see available user group names, model names, guardrail names, and existing command policies. The CLI accepts names (e.g. `engg`, `claude-3-opus`, `PII`) and resolves them to backend IDs automatically. You can also pass numeric IDs directly.
 
 ### Users
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {