unbound-cli 1.16.11 → 1.16.13

package/README.md

@@ -254,7 +254,7 @@ Alias: `unbound groups` works the same as `unbound user-groups`.
 | `unbound tools connect <type>` | Connect a tool |
 | `unbound tools approved` | List approved tool types |
 
-Supported tool types: `CLAUDE_CODE`, `UNBOUND_CLAUDE_CODE`, `CURSOR`, `COPILOT`, `AUGMENT_CODE`, `ROO_CODE`, `CLINE`, `GEMINI_CLI`, `CODEX`, `UNBOUND_CODEX`, `KILO_CODE`, `CUSTOM_ACCESS`
+Supported tool types: `CLAUDE_CODE`, `CURSOR`, `COPILOT`, `AUGMENT_CODE`, `ROO_CODE`, `CLINE`, `GEMINI_CLI`, `CODEX`, `KILO_CODE`, `CUSTOM_ACCESS`
 
 ## Configuration
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.16.11",
+  "version": "1.16.13",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/policy.js

@@ -381,8 +381,8 @@ function registerTopLevel(policy) {
   // ---- list ----
   policy
     .command('list')
-    .description('List Cost, Model, and Security policies. For Tool policies use `policy tool list`.')
-    .option('--type <type>', 'Filter by type: COST, MODEL, or SECURITY')
+    .description('List Cost and Security policies. For Tool policies use `policy tool list`.')
+    .option('--type <type>', 'Filter by type: COST or SECURITY')
     .option('--enabled', 'Show only enabled policies')
     .option('--search <term>', 'Search policies by name')
     .option('--json', 'Output raw JSON instead of a table')
@@ -443,7 +443,7 @@ Learn more: ${DOCS_POLICIES}
   // ---- get ----
   policy
     .command('get <id>')
-    .description('Get details of a single Cost, Model, or Security policy. For Tool policies use `policy tool get`.')
+    .description('Get details of a single Cost or Security policy. For Tool policies use `policy tool get`.')
     .option('--json', 'Output raw JSON')
     .addHelpText('after', `
 Examples:
@@ -468,7 +468,7 @@ Examples:
   // ---- delete ----
   policy
     .command('delete <id>')
-    .description('Delete a Cost, Model, or Security policy. For Tool policies use `policy tool delete`.')
+    .description('Delete a Cost or Security policy. For Tool policies use `policy tool delete`.')
     .option('--yes', 'Skip confirmation prompt')
     .addHelpText('after', `
 Examples:
@@ -881,8 +881,10 @@ Learn more: ${DOCS_COST}
 // ============================================================================
 
 function registerModel(policy) {
+  // Model policies only take effect on the paused LLM-gateway path, so they are hidden
+  // from help. The commands stay functional so existing scripts keep working.
   const model = policy
-    .command('model')
+    .command('model', { hidden: true })
     .description('Manage Model policies. Control which AI models are available to a user group.')
     .addHelpText('after', `
 Model policies restrict which AI models users can invoke. Choose one of:
@@ -899,7 +901,7 @@ Subcommands:
 `);
 
   model
-    .command('list')
+    .command('list', { hidden: true })
     .description('List all Model policies.')
     .option('--json', 'Output raw JSON')
     .action(async (opts) => {
@@ -930,7 +932,7 @@ Subcommands:
     });
 
   model
-    .command('create')
+    .command('create', { hidden: true })
     .description('Create a new Model policy.')
     .requiredOption('--name <name>', 'Policy name (required)')
     .option('--all-models', 'Allow all models (use with --excluded for exceptions)')
@@ -1018,7 +1020,7 @@ Learn more: ${DOCS_MODEL}
     });
 
   model
-    .command('update <id>')
+    .command('update <id>', { hidden: true })
     .description('Update an existing Model policy. Only provided fields are changed.')
     .option('--name <name>', 'New name')
     .option('--all-models', 'Replace config with "allow all"')
@@ -1319,7 +1321,7 @@ function registerTool(policy) {
     .command('tool')
     .description('Manage Tool policies: controls for shell commands (TERMINAL_COMMAND) and MCP tool calls (MCP_TOOL).')
     .addHelpText('after', `
-Tool policies live in a separate backend table from Cost/Model/Security
+Tool policies live in a separate backend table from Cost/Security
 policies and are reached via /api/v1/command-policies/.
 
 Learn more: ${DOCS_TOOL}
@@ -1972,9 +1974,9 @@ function registerLegacy(policy) {
 
   policy
     .command('create')
-    .description('Create a Cost/Model/Security policy. Prefer `policy cost|model|security create` for type-specific flags.')
+    .description('Create a Cost/Security policy. Prefer `policy cost|security create` for type-specific flags.')
     .requiredOption('--name <name>', 'Policy name (required)')
-    .requiredOption('--type <type>', 'Policy type: COST, MODEL, or SECURITY (required)')
+    .requiredOption('--type <type>', 'Policy type: COST or SECURITY (required)')
     .requiredOption('--config <json>', 'Policy configuration as a JSON string')
     .option('--enabled', 'Enable the policy (default: true)', true)
     .option('--no-enabled', 'Create the policy in disabled state')
@@ -1984,7 +1986,6 @@ function registerLegacy(policy) {
     .addHelpText('after', `
 Advanced / power-user escape hatch. For guided flag-based creation prefer:
   $ unbound policy cost create --help
-  $ unbound policy model create --help
   $ unbound policy security create --help
   $ unbound policy tool create-terminal --help    (TOOL policies go through this path)
   $ unbound policy tool create-mcp --help
@@ -2030,7 +2031,7 @@ Learn more: ${DOCS_POLICIES}
 
   policy
     .command('update <id>')
-    .description('Update a Cost/Model/Security policy via raw config. Prefer `policy cost|model|security update`.')
+    .description('Update a Cost/Security policy via raw config. Prefer `policy cost|security update`.')
     .option('--name <name>', 'New name')
     .option('--config <json>', 'Replace config with raw JSON')
     .option('--enabled', 'Enable')
@@ -2077,18 +2078,17 @@ Learn more: ${DOCS_POLICIES}
 function register(program) {
   const policy = program
     .command('policy')
-    .description('Manage policies. Four types: cost, model, security, tool.')
+    .description('Manage policies. Three types: cost, security, tool.')
     .addHelpText('after', `
-Unbound has four policy types. Each has its own subcommand for guided
+Unbound has three policy types. Each has its own subcommand for guided
 flag-based create/update. Tool policies live in a separate backend table
 and are reached via \`unbound policy tool\`.
 
   cost      Monthly budget limits per user group.      ${DOCS_COST}
-  model     Control which AI models are available.     ${DOCS_MODEL}
   security  Guardrails (PII, secrets), routing rules.  ${DOCS_SECURITY}
   tool      Shell command and MCP tool controls.       ${DOCS_TOOL}
 
-Generic commands (Cost/Model/Security only):
+Generic commands (Cost/Security only):
   list        List policies, optionally filtered by type
   get <id>    Get policy details
   delete <id> Delete a policy
@@ -2098,7 +2098,6 @@ Generic commands (Cost/Model/Security only):
 Examples:
   $ unbound policy form-data                                      # see available names
   $ unbound policy cost create --name "Eng Budget" --monthly-budget 1000 --group engg
-  $ unbound policy model create --name "No Opus" --all-models --excluded claude-3-opus
   $ unbound policy security create --name "Block PII" --sub-type guardrails --guardrail PII:BLOCK
   $ unbound policy tool create-terminal --name "Block rm -rf" --command-family filesystem \\
       --field command='rm -rf*' --action BLOCK --custom-message "Blocked by policy"

package/src/commands/tools.js

@@ -12,7 +12,6 @@ const SUPPORTED_TOOL_TYPES = [
   'CLINE',
   'GEMINI_CLI',
   'CODEX',
-  'UNBOUND_CODEX',
   'KILO_CODE',
   'CUSTOM_ACCESS',
 ];
@@ -181,4 +180,4 @@ Examples:
     });
 }
 
-module.exports = { register };
+module.exports = { register, SUPPORTED_TOOL_TYPES };

package/src/index.js

@@ -113,12 +113,12 @@ MDM AI TOOLS DISCOVERY
   $ unbound discover status                           Show scan schedule and logs
 
 POLICY MANAGEMENT
-  Unbound has four policy types. Each type has its own subcommand with guided flags.
+  Unbound has three policy types. Each type has its own subcommand with guided flags.
   Docs: https://docs.getunbound.ai/policies
 
   $ unbound policy                         Overview and subcommand list
   $ unbound policy form-data               Reference data (user groups, models, guardrails, etc.)
-  $ unbound policy list                    List Cost/Model/Security policies
+  $ unbound policy list                    List Cost/Security policies
   $ unbound policy get <id>                View a policy's details
   $ unbound policy delete <id>             Delete a policy
   $ unbound policy effective <id>          View effective policies for a user or group
@@ -126,9 +126,6 @@ POLICY MANAGEMENT
   Cost policies — monthly budget limits per user group:
   $ unbound policy cost create --name "Eng Budget" --monthly-budget 1000 --group engg
 
-  Model policies — control which AI models are available:
-  $ unbound policy model create --name "No Opus" --all-models --excluded claude-3-opus
-
   Security policies — guardrails for PII/secrets and routing rules:
   $ unbound policy security create --name "Block PII" --sub-type guardrails --guardrail PII:BLOCK
 

package/test/policy-help-model.test.js

@@ -0,0 +1,132 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { Command } = require('commander');
+const config = require('../src/config');
+const api = require('../src/api');
+const output = require('../src/output');
+const { register } = require('../src/commands/policy');
+
+// Model policies only take effect on the paused LLM-gateway path, so help must
+// advertise three policy types (cost, security, tool) and must not mention or
+// offer model policies. The `policy model` command family stays functional
+// (hidden, not removed) so existing scripts don't break.
+
+function policyCommand() {
+  const program = new Command();
+  register(program);
+  return program.commands.find((c) => c.name() === 'policy');
+}
+
+function fullHelp(cmd) {
+  let buf = '';
+  cmd.configureOutput({ writeOut: (s) => { buf += s; } });
+  cmd.outputHelp();
+  return buf;
+}
+
+// Render real CLI help by running the binary, so the top-level help in
+// src/index.js is exercised, not just the separately registered policy command.
+const CLI = path.join(__dirname, '..', 'src', 'index.js');
+function cliHelp(args) {
+  const r = spawnSync('node', [CLI, ...args], { encoding: 'utf8' });
+  assert.equal(r.status, 0, `\`${args.join(' ')}\` should exit 0\n${r.stderr}`);
+  return r.stdout;
+}
+
+test('policy help advertises three policy types, not four', () => {
+  const help = fullHelp(policyCommand());
+  assert.ok(help.includes('three policy types'), 'help should say "three policy types"');
+  assert.ok(!help.includes('four policy types'), 'help must not say "four policy types"');
+});
+
+test('policy help no longer advertises model policies', () => {
+  const help = fullHelp(policyCommand());
+  assert.ok(!help.includes('Control which AI models are available'), 'model type row must be gone');
+  assert.ok(!help.includes('policy model create'), 'model example must be gone');
+});
+
+test('policy help does not list model as a subcommand', () => {
+  const help = fullHelp(policyCommand());
+  assert.ok(!/\n\s*model\s/.test(help), 'model must be hidden from the subcommand list');
+});
+
+// The generic list/get/delete/create/update commands share the `policy --help`
+// screen, so their descriptions must not advertise model either.
+test('policy generic command descriptions drop Model', () => {
+  const help = fullHelp(policyCommand());
+  assert.ok(!help.includes('Cost, Model'), 'generic descriptions must not say "Cost, Model"');
+  assert.ok(!help.includes('Cost/Model'), 'generic descriptions must not say "Cost/Model"');
+});
+
+test('top-level `unbound --help` advertises three policy types, not four', () => {
+  const help = cliHelp(['--help']);
+  assert.ok(help.includes('three policy types'), 'top-level help should say "three policy types"');
+  assert.ok(!help.includes('four policy types'), 'top-level help must not say "four policy types"');
+  assert.ok(!help.includes('policy model create'), 'top-level help must not show a model example');
+});
+
+test('rendered `policy --help` names three types and drops Model', () => {
+  const help = cliHelp(['policy', '--help']);
+  assert.ok(help.includes('Three types'), 'policy help should say "Three types"');
+  assert.ok(!help.includes('Four types'), 'policy help must not say "Four types"');
+  assert.ok(!help.includes('Cost, Model') && !help.includes('Cost/Model'), 'no Model in generic descriptions');
+});
+
+test('policy model command family remains registered and hidden', () => {
+  const policy = policyCommand();
+  const model = policy.commands.find((c) => c.name() === 'model');
+  assert.ok(model, 'model command must still exist');
+  assert.equal(model._hidden, true, 'model command must be hidden');
+  for (const sub of ['list', 'create', 'update']) {
+    const m = model.commands.find((c) => c.name() === sub);
+    assert.ok(m, `model ${sub} must still exist`);
+    assert.equal(m._hidden, true, `model ${sub} must be hidden`);
+  }
+});
+
+// Hidden must not mean broken: a hidden model subcommand still parses and runs
+// its action against the backend, so existing scripts keep working.
+test('hidden `policy model list` still executes and calls the backend', async () => {
+  const orig = { isLoggedIn: config.isLoggedIn, get: api.get, info: output.info, table: output.table, error: output.error, json: output.json, exitCode: process.exitCode };
+  let reachedApi = false;
+  let sentType = null;
+  config.isLoggedIn = () => true;
+  api.get = async (_path, { query } = {}) => { reachedApi = true; sentType = query && query.type; return { policies: [] }; };
+  output.info = () => {};
+  output.table = () => {};
+  output.error = () => {};
+  output.json = () => {};
+  try {
+    const program = new Command();
+    register(program);
+    await program.parseAsync(['node', 'x', 'policy', 'model', 'list']);
+    assert.equal(reachedApi, true, 'hidden model list must reach the backend');
+    assert.equal(sentType, 'MODEL', 'model list must query type MODEL');
+  } finally {
+    config.isLoggedIn = orig.isLoggedIn;
+    api.get = orig.get;
+    output.info = orig.info;
+    output.table = orig.table;
+    output.error = orig.error;
+    output.json = orig.json;
+    process.exitCode = orig.exitCode;
+  }
+});
+
+// The legacy `policy create --help` escape-hatch list is a visible help surface;
+// it must not steer a user to `policy model create`, which never applies on the
+// hooks path — the exact failure this fix is about.
+test('`policy create --help` escape hatch no longer points at model policies', () => {
+  const help = cliHelp(['policy', 'create', '--help']);
+  assert.ok(!help.includes('policy model create'), 'escape hatch must not suggest `policy model create`');
+});
+
+// `policy tool --help` overview names the other policy types; it must say
+// Cost/Security, not Cost/Model/Security.
+test('`policy tool --help` names Cost/Security, not Model', () => {
+  const help = cliHelp(['policy', 'tool', '--help']);
+  assert.ok(!help.includes('Cost/Model/Security'), 'tool help must not say "Cost/Model/Security"');
+  assert.ok(help.includes('Cost/Security'), 'tool help should say "Cost/Security"');
+});

package/test/policy-model-backcompat.test.js

@@ -0,0 +1,42 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { Command } = require('commander');
+const config = require('../src/config');
+const api = require('../src/api');
+const output = require('../src/output');
+const { register } = require('../src/commands/policy');
+
+// Backward-compat: `policy model ...` is hidden from help and MODEL is dropped
+// from the advertised generic types, but the machinery must still accept MODEL.
+// An existing script using the legacy raw `policy create --type MODEL` must keep
+// working — de-advertising a type must not disable it.
+
+function stub() {
+  const orig = {
+    isLoggedIn: config.isLoggedIn, post: api.post,
+    success: output.success, error: output.error, json: output.json, keyValue: output.keyValue,
+    exitCode: process.exitCode,
+  };
+  const seen = { reachedApi: false, sentType: null, errored: false };
+  config.isLoggedIn = () => true;
+  api.post = async (_p, { body }) => { seen.reachedApi = true; seen.sentType = body.type; return { id: 'p_1', ...body }; };
+  output.success = () => {};
+  output.error = () => { seen.errored = true; };
+  output.json = () => {};
+  output.keyValue = () => {};
+  return { seen, restore() { Object.assign(config, { isLoggedIn: orig.isLoggedIn }); api.post = orig.post; output.success = orig.success; output.error = orig.error; output.json = orig.json; output.keyValue = orig.keyValue; process.exitCode = orig.exitCode; } };
+}
+
+test('legacy `policy create --type MODEL` still reaches the backend with type MODEL', async () => {
+  const { seen, restore } = stub();
+  try {
+    const program = new Command();
+    register(program);
+    await program.parseAsync(['node', 'x', 'policy', 'create', '--name', 'No Opus', '--type', 'MODEL', '--config', '{"all_models":true}']);
+    assert.equal(seen.reachedApi, true, 'MODEL create must still hit the policies endpoint');
+    assert.equal(seen.sentType, 'MODEL', 'the type sent must remain MODEL');
+    assert.equal(seen.errored, false, 'MODEL must not be rejected as an invalid type');
+  } finally {
+    restore();
+  }
+});

package/test/tools-backend-contract.test.js

@@ -0,0 +1,55 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const path = require('path');
+const { SUPPORTED_TOOL_TYPES } = require('../src/commands/tools');
+
+// Cross-repo contract: every tool type the CLI offers must be one the backend's
+// agents API accepts, or `tools connect` sends a request the backend answers
+// with 400. Rather than mirror the backend list by hand (which silently drifts),
+// this reads the REAL allowlist from ai-gateway-data at
+// webapp/api/v1/agent_handlers.py::SUPPORTED_AGENT_TOOL_TYPES.
+//
+// The backend repo isn't a dependency of the CLI, so when it isn't checked out
+// beside this one the test skips rather than failing — it runs wherever the
+// fleet is present (a dev machine, the cross-repo CI stage) and is a no-op
+// elsewhere. Point it explicitly with AI_GATEWAY_DATA_DIR.
+
+const HANDLERS_REL = 'webapp/api/v1/agent_handlers.py';
+
+function findBackendFile() {
+  const candidates = [];
+  if (process.env.AI_GATEWAY_DATA_DIR) {
+    candidates.push(path.join(process.env.AI_GATEWAY_DATA_DIR, HANDLERS_REL));
+  }
+  // Common layouts: a sibling checkout next to unbound-cli.
+  const repoRoot = path.join(__dirname, '..');
+  candidates.push(path.join(repoRoot, '..', 'ai-gateway-data', HANDLERS_REL));
+  candidates.push(path.join(repoRoot, '..', '..', 'ai-gateway-data', HANDLERS_REL));
+  return candidates.find((p) => { try { return fs.existsSync(p); } catch { return false; } });
+}
+
+function parseBackendAllowlist(file) {
+  const src = fs.readFileSync(file, 'utf8');
+  const m = src.match(/SUPPORTED_AGENT_TOOL_TYPES\s*=\s*\[([\s\S]*?)\]/);
+  assert.ok(m, 'could not locate SUPPORTED_AGENT_TOOL_TYPES in agent_handlers.py');
+  const types = [...m[1].matchAll(/['"]([A-Z_]+)['"]/g)].map((x) => x[1]);
+  assert.ok(types.length > 0, 'parsed an empty backend allowlist');
+  return new Set(types);
+}
+
+const backendFile = findBackendFile();
+
+test('every CLI-offered tool type is in the REAL backend agent_handlers allowlist',
+  { skip: backendFile ? false : 'ai-gateway-data not checked out (set AI_GATEWAY_DATA_DIR)' },
+  () => {
+    const accepted = parseBackendAllowlist(backendFile);
+    for (const type of SUPPORTED_TOOL_TYPES) {
+      assert.ok(accepted.has(type),
+        `CLI offers ${type} but the backend allowlist does not accept it (would 400)`);
+    }
+    // Guard the specific regression: the removed type must be absent from the CLI
+    // list precisely because the backend rejects it.
+    assert.ok(!SUPPORTED_TOOL_TYPES.includes('UNBOUND_CODEX') || accepted.has('UNBOUND_CODEX'),
+      'UNBOUND_CODEX may only be offered if the backend accepts it');
+  });

package/test/tools-supported-types.test.js

@@ -0,0 +1,85 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { Command } = require('commander');
+
+const config = require('../src/config');
+const api = require('../src/api');
+const output = require('../src/output');
+const { register, SUPPORTED_TOOL_TYPES } = require('../src/commands/tools');
+
+// Mirror of ai-gateway-data webapp/api/v1/agent_handlers.py SUPPORTED_AGENT_TOOL_TYPES.
+// `tools connect` must only offer types this backend accepts; anything else gets a 400.
+const BACKEND_ACCEPTED = new Set([
+  'CLAUDE_CODE', 'UNBOUND_CLAUDE_CODE', 'CURSOR', 'COPILOT',
+  'ROO_CODE', 'CLINE', 'GEMINI_CLI', 'CODEX', 'KILO_CODE', 'OPENCLAW',
+  'CUSTOM_ACCESS', 'AUGMENT_CODE',
+]);
+
+// Drive the real `tools connect` action with login + api stubbed. Returns
+// { reachedApi, sentType, errored } so a test can tell a type accepted by the
+// CLI (reaches the connect call) from one the CLI rejects before any request.
+async function connect(toolType) {
+  const orig = {
+    isLoggedIn: config.isLoggedIn,
+    post: api.post,
+    error: output.error,
+    success: output.success,
+    keyValue: output.keyValue,
+    json: output.json,
+    exitCode: process.exitCode,
+  };
+  let reachedApi = false;
+  let sentType = null;
+  let errored = false;
+  let errorMsg = '';
+  config.isLoggedIn = () => true;
+  api.post = async (_path, { body }) => { reachedApi = true; sentType = body.tool_type; return { tool_type: body.tool_type, status: 'connected' }; };
+  output.error = (m) => { errored = true; errorMsg = String(m ?? ''); };
+  output.success = () => {};
+  output.keyValue = () => {};
+  output.json = () => {};
+  try {
+    const program = new Command();
+    register(program);
+    await program.parseAsync(['node', 'x', 'tools', 'connect', toolType]);
+    return { reachedApi, sentType, errored, errorMsg, exitCode: process.exitCode };
+  } finally {
+    config.isLoggedIn = orig.isLoggedIn;
+    api.post = orig.post;
+    output.error = orig.error;
+    output.success = orig.success;
+    output.keyValue = orig.keyValue;
+    output.json = orig.json;
+    process.exitCode = orig.exitCode;
+  }
+}
+
+// The backend rejects UNBOUND_CODEX with a 400, so the CLI must not offer it.
+test('tools connect UNBOUND_CODEX is rejected before any backend call', async () => {
+  const r = await connect('UNBOUND_CODEX');
+  assert.equal(r.reachedApi, false, 'must not send an UNBOUND_CODEX connect request');
+  assert.equal(r.errored, true, 'must report an unsupported-type error');
+  assert.equal(r.exitCode, 1, 'must exit non-zero so scripts see the rejection');
+  // The error points the user at the real types: it names the supported set,
+  // including the correct CODEX to reach for instead.
+  assert.match(r.errorMsg, /Supported types:/);
+  assert.match(r.errorMsg, /\bCODEX\b/);
+});
+
+// A representative valid type still connects.
+test('tools connect CODEX reaches the backend with tool_type CODEX', async () => {
+  const r = await connect('CODEX');
+  assert.equal(r.reachedApi, true);
+  assert.equal(r.sentType, 'CODEX');
+});
+
+// Drive the actual production allowlist: every type the CLI offers must reach the
+// backend and be one the backend accepts. Adding a backend-rejected type to
+// SUPPORTED_TOOL_TYPES would fail here rather than recur as a runtime 400.
+test('every CLI-offered tool type is accepted by the backend', async () => {
+  for (const type of SUPPORTED_TOOL_TYPES) {
+    const r = await connect(type);
+    assert.equal(r.reachedApi, true, `CLI should offer ${type}`);
+    assert.ok(BACKEND_ACCEPTED.has(r.sentType), `CLI offers ${r.sentType} which the backend rejects`);
+  }
+});