unbound-cli 1.17.0 → 1.19.0

package/src/toolHealth.js

@@ -206,6 +206,14 @@ function envKeyCheck(label, name, kind = 'aux') {
   };
 }
 
+// Setup writes UNBOUND_DEVICE_TOKEN; installs from before it carry only the per-tool name.
+function deviceTokenCheck(legacyName) {
+  const check = envKeyCheck('API key env', 'UNBOUND_DEVICE_TOKEN');
+  if (check.ok) return check;
+  const legacy = envKeyCheck('API key env', legacyName);
+  return legacy.ok ? legacy : check;
+}
+
 function envCheck(label, name, expected, kind = 'aux') {
   const base = label.replace(/ env$/, '');
   const r = readEnvVar(name);
@@ -334,7 +342,7 @@ function buildVariants(gatewayUrl, binaryPath) {
       checks: () => [
         configCheck('Config', '~/.cursor/hooks.json', { json: true, test: refsUnbound }),
         scriptCheck('Hook script', '~/.cursor/hooks/unbound.py'),
-        envKeyCheck('API key env', 'UNBOUND_CURSOR_API_KEY'),
+        deviceTokenCheck('UNBOUND_CURSOR_API_KEY'),
       ],
     },
     {
@@ -342,7 +350,7 @@ function buildVariants(gatewayUrl, binaryPath) {
       checks: () => [
         configCheck('Config', claudePath('settings.json'), { json: true, test: refsUnbound }),
         scriptCheck('Hook script', claudePath('hooks', 'unbound.py')),
-        envKeyCheck('API key env', 'UNBOUND_CLAUDE_API_KEY'),
+        deviceTokenCheck('UNBOUND_CLAUDE_API_KEY'),
       ],
     },
     {
@@ -373,7 +381,7 @@ function buildVariants(gatewayUrl, binaryPath) {
           return features.hooks === undefined ? features.codex_hooks === true : features.hooks === true;
         } }, { short: 'codex hooks not enabled', kind: 'aux' }), // aux: an org install leaves it set with no user hook
         scriptCheck('Hook script', '~/.codex/hooks/unbound.py'),
-        envKeyCheck('API key env', 'UNBOUND_CODEX_API_KEY'),
+        deviceTokenCheck('UNBOUND_CODEX_API_KEY'),
       ],
     },
     {
@@ -397,7 +405,7 @@ function buildVariants(gatewayUrl, binaryPath) {
         const checks = [configCheck('Config', '~/.copilot/hooks/unbound.json', { json: true, test: refsUnbound })];
         if (hasBinary) checks.push(scriptCheck('Hook binary', binaryPath || BINARY_PATH));
         else checks.push(scriptCheck('Hook script', '~/.copilot/hooks/unbound.py'));
-        checks.push(envKeyCheck('API key env', 'UNBOUND_COPILOT_API_KEY'));
+        checks.push(deviceTokenCheck('UNBOUND_COPILOT_API_KEY'));
         return checks;
       },
     },
@@ -414,7 +422,7 @@ function buildVariants(gatewayUrl, binaryPath) {
         const checks = [configCheck('Config', '~/.augment/settings.json', { json: false, test: (t) => t.includes('unbound.py') || t.includes(BINARY_MARKER) })];
         if (hasBinary) checks.push(scriptCheck('Hook binary', binaryPath || BINARY_PATH));
         else checks.push(scriptCheck('Hook script', '~/.augment/hooks/unbound.py'));
-        checks.push(envKeyCheck('API key env', 'UNBOUND_AUGMENT_API_KEY'));
+        checks.push(deviceTokenCheck('UNBOUND_AUGMENT_API_KEY'));
         return checks;
       },
     },

package/test/device-token.test.js

@@ -0,0 +1,46 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+function withConfig(contents, fn) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-token-'));
+  const origHome = process.env.HOME;
+  process.env.HOME = tmp;
+  const file = path.join(tmp, '.unbound', 'config.json');
+  if (contents) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(contents));
+  }
+  delete require.cache[require.resolve('../src/config')];
+  try {
+    return fn(require('../src/config'), file);
+  } finally {
+    process.env.HOME = origHome;
+    delete require.cache[require.resolve('../src/config')];
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+test('getDeviceKey prefers api_key, which an older writer may have updated alone', () => {
+  withConfig({ device_token: 'stale', api_key: 'relogged' }, (config) => {
+    assert.equal(config.getDeviceKey(), 'relogged');
+  });
+});
+
+test('getDeviceKey falls back to device_token', () => {
+  withConfig({ device_token: 'new' }, (config) => {
+    assert.equal(config.getDeviceKey(), 'new');
+  });
+});
+
+test('setDeviceKey writes both fields so older CLIs and hooks still read it', () => {
+  withConfig({ api_key: 'old', base_url: 'https://api.acme.com' }, (config, file) => {
+    config.setDeviceKey('k2');
+    const written = JSON.parse(fs.readFileSync(file, 'utf8'));
+    assert.equal(written.device_token, 'k2');
+    assert.equal(written.api_key, 'k2');
+    assert.equal(written.base_url, 'https://api.acme.com');
+  });
+});

package/test/pack-confirm.test.js

@@ -0,0 +1,27 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { PassThrough } = require('node:stream');
+
+const { confirm } = require('../src/commands/pack')._internals;
+
+test('confirm fails closed when stdin is not a TTY', () => {
+  const stdin = new PassThrough();
+  stdin.isTTY = false;
+  assert.throws(() => confirm('Delete 2 policies?', { stdin }), /pass --yes/);
+});
+
+test('confirm resolves false when stdin closes without an answer', async () => {
+  const stdin = new PassThrough();
+  stdin.isTTY = true;
+  const p = confirm('Delete?', { stdin });
+  stdin.end();
+  assert.equal(await p, false);
+});
+
+test('confirm resolves true on y', async () => {
+  const stdin = new PassThrough();
+  stdin.isTTY = true;
+  const p = confirm('Delete?', { stdin });
+  stdin.write('y\n');
+  assert.equal(await p, true);
+});

package/test/pack-export.test.js

@@ -0,0 +1,83 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const schema = require('../src/lib/pack-schema');
+const plan = require('../src/lib/pack-plan');
+const exp = require('../src/lib/pack-export');
+
+const REF = {
+  userGroups: [{ id: 1, name: 'Engineering' }],
+  guardrails: [{ id: 7, name: 'PII', supported_actions: ['BLOCK', 'AUDIT'], entities: [{ id: 70, name: 'EMAIL' }, { id: 71, name: 'SSN' }] }],
+  aiModels: [{ id: 100, name: 'claude-sonnet' }, { id: 101, name: 'gpt-4o' }],
+  toolTypes: ['cursor'],
+  labels: [{ id: 5, name: 'baseline' }],
+  mcpServers: [],
+};
+
+const LIVE = {
+  tool: [
+    { id: '11', name: 'no-rm', code_pack: 'base', code_slug: 'no-rm', policy_type: 'TERMINAL_COMMAND', action: 'BLOCK', custom_message: 'no', description: 'd', enabled: false, status: 'INACTIVE', command_family: 'custom', config: { command: 'rm -rf*' }, scope_user_groups: [{ id: 1, name: 'Engineering' }] },
+    { id: '12', name: 'gh-writes', code_pack: 'base', code_slug: 'gh-writes', policy_type: 'MCP_TOOL', action: 'AUDIT', custom_message: '', description: '', enabled: true, status: 'ACTIVE', mcp_server: 'GitHub', mcp_tools: ['push_files'], mcp_canonical_group: { id: 9, name: 'github' }, config: {}, scope_user_groups: [] },
+  ],
+  generic: [
+    { id: 21, name: 'pii', code_pack: 'base', code_slug: 'pii', type: 'SECURITY', enabled: true, priority: 3, config: { sub_type: 'guardrails', guardrails: [{ guardrail_id: 7, action: 'BLOCK', threshold: 4, enabled: true, route_model_id: null, entities: [{ entity_id: 70, enabled: true }, { entity_id: 71, enabled: false }] }] }, scope_user_groups: [], scope_tool_types: ['cursor'], labels: [{ id: 5, name: 'baseline' }] },
+    { id: 22, name: 'models', code_pack: 'base', code_slug: 'models', type: 'MODEL', enabled: true, priority: 1, config: { support_all_models: false, allowed_model_ids: [100], excluded_model_ids: [] }, scope_user_groups: [], scope_tool_types: [], labels: [] },
+    { id: 23, name: 'cap', code_pack: 'base', code_slug: 'cap', type: 'COST', enabled: true, priority: 2, config: { monthly_budget: 100 }, scope_user_groups: [], scope_tool_types: [], labels: [] },
+  ],
+};
+
+test('liveToPack: ids become names and sugar is restored', () => {
+  const doc = exp.liveToPack('base', LIVE, REF, { version: '2.0.0' });
+  assert.equal(doc.apiVersion, 'unbound.security/v1');
+  assert.deepEqual(doc.metadata, { name: 'base', version: '2.0.0' });
+  const byId = Object.fromEntries(doc.policies.map((p) => [p.id, p]));
+  assert.deepEqual(byId['no-rm'], { id: 'no-rm', kind: 'tool', type: 'TERMINAL_COMMAND', action: 'BLOCK', enabled: false, description: 'd', customMessage: 'no', commandFamily: 'custom', config: { command: 'rm -rf*' }, scope: { userGroups: ['Engineering'] } });
+  assert.deepEqual(byId['gh-writes'].mcp, { server: 'GitHub', tools: ['push_files'] });
+  assert.deepEqual(byId.pii.guardrails, [{ name: 'PII', action: 'BLOCK', threshold: 4, entities: ['EMAIL'] }]);
+  assert.deepEqual(byId.pii.scope, { toolTypes: ['cursor'] });
+  assert.deepEqual(byId.pii.labels, ['baseline']);
+  assert.deepEqual(byId.models.models, { allowed: ['claude-sonnet'] });
+  assert.deepEqual(byId.cap.config, { monthly_budget: 100 });
+  assert.equal(byId.cap.priority, 2);
+});
+
+test('round trip: export -> parse -> validate -> plan is a no-op', () => {
+  const doc = exp.liveToPack('base', LIVE, REF);
+  const text = exp.stringifyPack(doc);
+  assert.match(text, /^# PolicyPack "base"/);
+  const pack = schema.validatePack(schema.parsePackText(text, 'base.yaml'), 'base.yaml');
+  const desired = plan.toDesired(pack, REF);
+  const ops = plan.buildPlan(desired, LIVE, { prune: true });
+  assert.deepEqual(ops.map((o) => o.op), ops.map(() => 'unchanged'), JSON.stringify(ops.filter((o) => o.op !== 'unchanged').map((o) => o.changes)));
+});
+
+test('stringifyPack: JSON-compatible document without header', () => {
+  const doc = exp.liveToPack('base', { tool: [], generic: [LIVE.generic[2]] }, REF);
+  const text = exp.stringifyPack(doc, { header: false });
+  assert.doesNotMatch(text, /^#/);
+  assert.deepEqual(schema.parsePackText(text, 'x.yaml'), doc);
+});
+
+test('round trip keeps a disabled guardrail entry disabled', () => {
+  const live = { tool: [], generic: [{ ...LIVE.generic[0], config: { sub_type: 'guardrails', guardrails: [{ guardrail_id: 7, action: 'AUDIT', threshold: 1, enabled: false, route_model_id: null, entities: [{ entity_id: 70, enabled: true }, { entity_id: 71, enabled: true }] }] } }] };
+  const doc = exp.liveToPack('base', live, REF);
+  assert.deepEqual(doc.policies[0].guardrails, [{ name: 'PII', action: 'AUDIT', enabled: false }]);
+  const packDoc = schema.validatePack(doc, 'base.yaml');
+  const ops = plan.buildPlan(plan.toDesired(packDoc, REF), live, { prune: true });
+  assert.deepEqual(ops.map((o) => o.op), ['unchanged']);
+});
+
+test('export keeps a loadable file for an empty BLOCK message and an allow-nothing model policy', () => {
+  const live = {
+    tool: [{ ...LIVE.tool[0], name: 'quiet-block', code_slug: 'quiet-block', custom_message: '' }],
+    generic: [{ ...LIVE.generic[1], name: 'none', code_slug: 'none', config: { support_all_models: false, allowed_model_ids: [], excluded_model_ids: [] } }],
+  };
+  const doc = exp.liveToPack('base', live, REF);
+  const byId = Object.fromEntries(doc.policies.map((p) => [p.id, p]));
+  assert.equal(byId['quiet-block'].customMessage, '');
+  assert.equal(byId.none.models, undefined);
+  assert.deepEqual(byId.none.config, { support_all_models: false, allowed_model_ids: [], excluded_model_ids: [] });
+  const packDoc = schema.validatePack(doc, 'base.yaml');
+  const ops = plan.buildPlan(plan.toDesired(packDoc, REF), live, { prune: true });
+  assert.deepEqual(ops.map((o) => o.op), ['unchanged', 'unchanged']);
+});

package/test/pack-plan.test.js

@@ -0,0 +1,201 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const schema = require('../src/lib/pack-schema');
+const plan = require('../src/lib/pack-plan');
+
+const REF = {
+  userGroups: [{ id: 1, name: 'Engineering' }, { id: 2, name: 'Contractors' }],
+  guardrails: [{ id: 7, name: 'PII', supported_actions: ['BLOCK', 'AUDIT'], entities: [{ id: 70, name: 'EMAIL' }, { id: 71, name: 'SSN' }] }],
+  aiModels: [{ id: 100, name: 'claude-sonnet' }, { id: 101, name: 'gpt-4o' }],
+  toolTypes: ['cursor', 'claude-code'],
+  labels: [{ id: 5, name: 'baseline' }],
+  mcpServers: [{ mcp_server: 'GitHub', tool_calls: ['push_files', 'create_pull_request', 'get_file'], tool_action_types: { push_files: 'write', create_pull_request: 'write', get_file: 'read' } }],
+};
+
+function pack(policies, extra = '') {
+  return schema.validatePack({
+    apiVersion: 'unbound.security/v1',
+    kind: 'PolicyPack',
+    metadata: { name: 'base', version: '1.0.0' },
+    policies,
+    ...(extra || {}),
+  }, 'base.yaml');
+}
+
+const TERMINAL = { id: 'no-rm', kind: 'tool', type: 'TERMINAL_COMMAND', action: 'BLOCK', commandFamily: 'custom', customMessage: 'no', config: { command: 'rm -rf*' }, scope: { userGroups: ['Engineering'] } };
+const MCP = { id: 'gh-writes', kind: 'tool', type: 'MCP_TOOL', action: 'AUDIT', mcp: { server: 'github', actionType: 'write' } };
+const SECURITY = { id: 'pii', kind: 'security', priority: 3, guardrails: [{ name: 'pii', action: 'BLOCK', entities: ['EMAIL'] }], labels: ['baseline'] };
+const MODEL = { id: 'models', kind: 'model', models: { allowAll: true, excluded: ['gpt-4o'] } };
+const COST = { id: 'cap', kind: 'cost', config: { monthly_budget: 100 }, scope: { toolTypes: ['cursor'] } };
+
+const LIVE_TERMINAL = { id: '11', name: 'no-rm', code_pack: 'base', code_slug: 'no-rm', policy_type: 'TERMINAL_COMMAND', action: 'BLOCK', custom_message: 'no', description: '', enabled: true, status: 'ACTIVE', command_family: 'custom', config: { command: 'rm -rf*' }, scope_user_groups: [{ id: 1, name: 'Engineering' }] };
+const LIVE_MCP = { id: '12', name: 'gh-writes', code_pack: 'base', code_slug: 'gh-writes', policy_type: 'MCP_TOOL', action: 'AUDIT', custom_message: '', description: '', enabled: true, status: 'ACTIVE', mcp_server: 'GitHub', mcp_tools: ['create_pull_request', 'push_files'], mcp_canonical_group: { id: 9, name: 'github' }, config: {}, scope_user_groups: [] };
+const LIVE_SECURITY = { id: 21, name: 'pii', code_pack: 'base', code_slug: 'pii', type: 'SECURITY', enabled: true, priority: 3, config: { sub_type: 'guardrails', guardrails: [{ guardrail_id: 7, action: 'BLOCK', threshold: 1, enabled: true, route_model_id: null, entities: [{ entity_id: 70, enabled: true }, { entity_id: 71, enabled: false }] }] }, scope_user_groups: [], scope_tool_types: [], labels: [{ id: 5, name: 'baseline' }] };
+const LIVE_MODEL = { id: 22, name: 'models', code_pack: 'base', code_slug: 'models', type: 'MODEL', enabled: true, priority: 1, config: { support_all_models: true, allowed_model_ids: [], excluded_model_ids: [101] }, scope_user_groups: [], scope_tool_types: [], labels: [] };
+const LIVE_COST = { id: 23, name: 'cap', code_pack: 'base', code_slug: 'cap', type: 'COST', enabled: true, priority: 2, config: { monthly_budget: 100 }, scope_user_groups: [], scope_tool_types: ['cursor'], labels: [] };
+
+test('toDesired: builds write bodies with resolved ids', () => {
+  const desired = plan.toDesired(pack([TERMINAL, MCP, SECURITY, MODEL, COST]), REF);
+  const [t, m, s, mo, c] = desired;
+  assert.equal(t.table, 'tool');
+  assert.deepEqual(t.body.scope_user_group_ids, [1]);
+  assert.equal(t.body.command_family, 'custom');
+  assert.equal(m.body.mcp_tool_action_type, 'write');
+  assert.deepEqual(m.proj.mcp_tools, ['create_pull_request', 'push_files'], 'action type expanded from metadata');
+  assert.equal(s.body.type, 'SECURITY');
+  assert.deepEqual(s.body.config.guardrails[0], { guardrail_id: 7, enabled: true, action: 'BLOCK', threshold: 1, route_model_id: null, entities: [{ entity_id: 70, enabled: true }] });
+  assert.deepEqual(s.body.label_ids, [5]);
+  assert.deepEqual(mo.body.config, { support_all_models: true, allowed_model_ids: [], excluded_model_ids: [101] });
+  assert.deepEqual(c.body.scope_tool_types, ['cursor']);
+  assert.equal(c.body.priority, undefined, 'priority is unmanaged when absent');
+});
+
+test('toDesired: unresolved names fail before any write', () => {
+  assert.throws(() => plan.toDesired(pack([{ ...TERMINAL, scope: { userGroups: ['Nope'] } }]), REF), /no user group named "Nope"/);
+  assert.throws(() => plan.toDesired(pack([{ ...SECURITY, guardrails: [{ name: 'Secrets', action: 'BLOCK' }] }]), REF), /no guardrail named "Secrets"/);
+  assert.throws(() => plan.toDesired(pack([{ ...SECURITY, guardrails: [{ name: 'PII', action: 'REDACT' }] }]), REF), /does not support REDACT/);
+  assert.throws(() => plan.toDesired(pack([{ ...MODEL, models: { allowed: ['llama'] } }]), REF), /no model named "llama"/);
+  assert.throws(() => plan.toDesired(pack([{ ...COST, scope: { toolTypes: ['vim'] } }]), REF), /unknown tool type vim/);
+  assert.throws(() => plan.toDesired(pack([{ ...SECURITY, labels: ['nope'] }]), REF), /no label named "nope"/);
+});
+
+test('buildPlan: in-sync org yields only unchanged ops', () => {
+  const desired = plan.toDesired(pack([TERMINAL, MCP, SECURITY, MODEL, COST]), REF);
+  const ops = plan.buildPlan(desired, { tool: [LIVE_TERMINAL, LIVE_MCP], generic: [LIVE_SECURITY, LIVE_MODEL, LIVE_COST] });
+  assert.deepEqual(ops.map((o) => o.op), ['unchanged', 'unchanged', 'unchanged', 'unchanged', 'unchanged']);
+  assert.equal(plan.summarize(ops).drift, 0);
+});
+
+test('buildPlan: create, patch-update, orphan and prune', () => {
+  const desired = plan.toDesired(pack([{ ...TERMINAL, action: 'AUDIT', customMessage: undefined }, { ...COST, config: { monthly_budget: 250 } }]), REF);
+  const live = { tool: [LIVE_TERMINAL, LIVE_MCP], generic: [LIVE_COST] };
+
+  const ops = plan.buildPlan(desired, live);
+  const byName = Object.fromEntries(ops.map((o) => [o.serverName, o]));
+  assert.equal(byName['no-rm'].op, 'update');
+  assert.deepEqual(byName['no-rm'].body, { action: 'AUDIT', custom_message: '' }, 'only changed fields are sent');
+  assert.equal(byName['cap'].op, 'update');
+  assert.deepEqual(byName['cap'].body, { config: { monthly_budget: 250 } });
+  assert.equal(byName['gh-writes'].op, 'orphan', 'without prune the orphan is kept');
+
+  const pruned = plan.buildPlan(desired, live, { prune: true });
+  assert.equal(pruned.find((o) => o.serverName === 'gh-writes').op, 'delete');
+  assert.equal(plan.summarize(pruned).delete, 1);
+
+  const created = plan.buildPlan(plan.toDesired(pack([SECURITY]), REF), { tool: [], generic: [] });
+  assert.equal(created[0].op, 'create');
+  assert.equal(created[0].body.name, 'pii');
+  assert.equal(created[0].body.code_pack, 'base');
+  assert.equal(created[0].body.code_slug, 'pii');
+});
+
+test('buildPlan: MCP tool-set change patches with the canonical group id', () => {
+  const desired = plan.toDesired(pack([{ ...MCP, mcp: { server: 'github', tools: ['push_files'] } }]), REF);
+  const [op] = plan.buildPlan(desired, { tool: [LIVE_MCP], generic: [] });
+  assert.equal(op.op, 'update');
+  assert.deepEqual(op.body, { mcp_canonical_group_id: 9, mcp_tools: ['push_files'] });
+});
+
+test('buildPlan: MCP server change and type change are replace', () => {
+  const server = plan.toDesired(pack([{ ...MCP, mcp: { server: 'slack', tool: 'post_message' } }]), REF);
+  assert.equal(plan.buildPlan(server, { tool: [LIVE_MCP], generic: [] })[0].op, 'replace');
+  const type = plan.toDesired(pack([{ ...TERMINAL, id: 'gh-writes' }]), REF);
+  assert.equal(plan.buildPlan(type, { tool: [LIVE_MCP], generic: [] })[0].op, 'replace');
+});
+
+test('an action-type selector the catalogue cannot resolve is an error, never "unchanged"', () => {
+  const unknownServer = { ...MCP, mcp: { server: 'nope', actionType: 'write' } };
+  assert.throws(() => plan.toDesired(pack([unknownServer]), REF), /not in this org's MCP catalogue/);
+  const emptyRef = { ...REF, mcpServers: [] };
+  assert.throws(() => plan.toDesired(pack([MCP]), emptyRef), /not in this org's MCP catalogue/);
+  const noTools = { ...MCP, mcp: { server: 'github', actionType: 'destructive' } };
+  assert.throws(() => plan.toDesired(pack([noTools]), REF), /has no destructive tools/);
+});
+
+test('buildPlan: conflicts are reported, never written', () => {
+  // same name exists in the other table
+  const desired = plan.toDesired(pack([{ ...COST, id: 'no-rm' }]), REF);
+  const [clash] = plan.buildPlan(desired, { tool: [LIVE_TERMINAL], generic: [] });
+  assert.equal(clash.op, 'conflict');
+  // generic kind change
+  const kindChange = plan.toDesired(pack([{ ...SECURITY, id: 'cap' }]), REF);
+  assert.equal(plan.buildPlan(kindChange, { tool: [], generic: [LIVE_COST] })[0].op, 'conflict');
+  assert.equal(plan.summarize([clash]).conflict, 1);
+});
+
+test('diffFields: scope and label order do not count as drift', () => {
+  const desired = plan.toDesired(pack([{ ...TERMINAL, scope: { userGroups: ['Contractors', 'Engineering'] } }]), REF);
+  const live = { ...LIVE_TERMINAL, scope_user_groups: [{ id: 2, name: 'Contractors' }, { id: 1, name: 'Engineering' }] };
+  assert.deepEqual(plan.diffFields(desired[0].proj, plan.liveProjection(live, 'tool')), []);
+});
+
+test('MCP writes keep the author casing; only the comparison is lowercased', () => {
+  const ref = { ...REF, mcpServers: [{ mcp_server: 'Jira', tool_calls: ['getJiraIssue', 'createIssue'], tool_action_types: { getJiraIssue: 'read', createIssue: 'write' } }] };
+  const desired = plan.toDesired(pack([{ ...MCP, id: 'jira', mcp: { server: 'jira', tools: ['getJiraIssue'] } }, { ...MCP, id: 'jira-writes', mcp: { server: 'jira', actionType: 'write' } }]), ref);
+  assert.deepEqual(desired[0].proj.mcp_tools, ['getjiraissue']);
+  assert.deepEqual(desired[0].body.mcp_tools, ['getJiraIssue']);
+  assert.deepEqual(desired[1].proj.mcp_tools, ['createissue']);
+  assert.equal(desired[1].body.mcp_tool_action_type, 'write');
+  const live = { ...LIVE_MCP, name: 'jira', code_slug: 'jira', mcp_server: 'Jira', mcp_canonical_group: { id: 4, name: 'jira' }, mcp_tools: ['createIssue'] };
+  const [op] = plan.buildPlan([desired[0]], { tool: [live], generic: [] });
+  assert.equal(op.op, 'update');
+  assert.deepEqual(op.body, { mcp_canonical_group_id: 4, mcp_tools: ['getJiraIssue'] });
+  const liveWrites = { ...live, name: 'jira-writes', code_slug: 'jira-writes', mcp_tools: ['getJiraIssue'] };
+  const [op2] = plan.buildPlan([desired[1]], { tool: [liveWrites], generic: [] });
+  assert.deepEqual(op2.body, { mcp_canonical_group_id: 4, mcp_tools: ['createIssue'] }, 'action type expansion keeps server casing');
+});
+
+test('guardrail entries can be disabled in the pack', () => {
+  const desired = plan.toDesired(pack([{ ...SECURITY, guardrails: [{ name: 'PII', action: 'BLOCK', enabled: false }] }]), REF);
+  assert.equal(desired[0].body.config.guardrails[0].enabled, false);
+  const live = { ...LIVE_SECURITY, config: { sub_type: 'guardrails', guardrails: [{ guardrail_id: 7, action: 'BLOCK', threshold: 1, enabled: false, route_model_id: null, entities: [{ entity_id: 70, enabled: true }, { entity_id: 71, enabled: true }] }] } };
+  assert.equal(plan.buildPlan(desired, { tool: [], generic: [live] })[0].op, 'unchanged');
+});
+
+test('MCP config changes are drift and patch only config', () => {
+  const desired = plan.toDesired(pack([{ ...MCP, mcp: { server: 'github', tools: ['create_pull_request', 'push_files'] }, config: { note: 'x' } }]), REF);
+  const [op] = plan.buildPlan(desired, { tool: [LIVE_MCP], generic: [] });
+  assert.equal(op.op, 'update');
+  assert.deepEqual(op.body, { config: { note: 'x' } });
+});
+
+test('an unsupported row under the desired name is a conflict, never a create', () => {
+  const desired = plan.toDesired(pack([{ ...COST, id: 'skill' }]), REF);
+  const live = { tool: [], generic: [], unsupported: [{ table: 'tool', row: { id: '7', name: 'Skill', policy_type: 'SKILL_INJECTION', origin: 'CODE', code_pack: 'base', code_slug: 'skill' } }] };
+  const [op] = plan.buildPlan(desired, live);
+  assert.equal(op.op, 'conflict');
+  assert.match(op.reason, /SKILL_INJECTION/);
+});
+
+test('a managed row switched off in the console is an enabled-only update', () => {
+  const desired = plan.toDesired(pack([TERMINAL, COST]), REF);
+  const live = {
+    tool: [{ ...LIVE_TERMINAL, origin: 'CODE', enabled: false, status: 'INACTIVE' }],
+    generic: [{ ...LIVE_COST, origin: 'CODE', enabled: false }],
+  };
+  const ops = plan.buildPlan(desired, live);
+  for (const op of ops) {
+    assert.equal(op.op, 'update', op.serverName);
+    assert.deepEqual(op.body, { enabled: true });
+    assert.deepEqual(op.changes, [{ field: 'enabled', from: false, to: true }]);
+  }
+  assert.equal(plan.summarize(ops).drift, 2);
+});
+
+test('a name already used elsewhere in the org is a conflict at plan time, not a failed create', () => {
+  const desired = plan.toDesired(pack([{ ...COST, name: 'Monthly cap' }, { ...SECURITY, name: 'PII guard' }]), REF);
+  const names = new Map([
+    ['Monthly cap', { table: 'generic', id: 77, code_pack: null, code_slug: null }],
+    ['PII guard', { table: 'generic', id: 21, code_pack: 'base', code_slug: 'pii' }],
+  ]);
+  const ops = plan.buildPlan(desired, { tool: [], generic: [{ ...LIVE_SECURITY, name: 'PII guard' }], names });
+  const byId = Object.fromEntries(ops.map((o) => [o.id, o]));
+  assert.equal(byId.cap.op, 'conflict');
+  assert.match(byId.cap.reason, /made in the console/);
+  assert.equal(byId.pii.op, 'unchanged', 'the row that already owns the name is not a conflict with itself');
+
+  const renamed = plan.toDesired(pack([{ ...SECURITY, name: 'Monthly cap' }]), REF);
+  const renamedOps = plan.buildPlan(renamed, { tool: [], generic: [{ ...LIVE_SECURITY, name: 'PII guard' }], names }, { prune: true });
+  assert.deepEqual(renamedOps.map((o) => o.op), ['conflict'], 'a refused rename is a conflict and never also an orphan or delete');
+});

package/test/pack-remote.test.js

@@ -0,0 +1,179 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const path = require('node:path');
+
+// Stub the HTTP layer before pack-remote loads it.
+const calls = [];
+const stub = {
+  get: async (p, opts) => { calls.push(['GET', p, opts]); return stub.onGet(p, opts); },
+  post: async (p, opts) => { calls.push(['POST', p, opts]); return stub.onPost(p, opts); },
+  put: async (p, opts) => { calls.push(['PUT', p, opts]); return stub.onPut(p, opts); },
+  del: async (p, opts) => { calls.push(['DELETE', p, opts]); return stub.onDel(p, opts); },
+  onGet: async () => ({}),
+  onPost: async () => ({ id: '99' }),
+  onPut: async () => ({}),
+  onDel: async () => ({}),
+};
+require.cache[require.resolve('../src/api')] = { id: path.resolve(__dirname, '../src/api.js'), filename: path.resolve(__dirname, '../src/api.js'), loaded: true, exports: stub };
+const remote = require('../src/lib/pack-remote');
+
+function reset() {
+  calls.length = 0;
+  stub.onGet = async () => ({});
+  stub.onPost = async () => ({ id: '99' });
+  stub.onPut = async () => ({});
+  stub.onDel = async () => ({});
+}
+
+test('replaceRow creates under a temporary name before deleting the old row', async () => {
+  reset();
+  await remote.replaceRow('tool', { id: '11', name: 'Block x' }, { name: 'Block x', policy_type: 'MCP_TOOL', code_pack: 'base', code_slug: 'x' });
+  assert.deepEqual(calls.map((c) => c[0]), ['POST', 'DELETE', 'PUT']);
+  assert.match(calls[0][2].body.name, /^Block x-replacing-/);
+  assert.equal(calls[1][1], '/api/v1/command-policies/11/');
+  assert.deepEqual(calls[2], ['PUT', '/api/v1/command-policies/99/', { body: { name: 'Block x', code_pack: 'base', code_slug: 'x', origin: 'CODE' } }]);
+});
+
+test('replaceRow: a failed create leaves the old row in place', async () => {
+  reset();
+  stub.onPost = async () => { throw new Error('boom'); };
+  await assert.rejects(() => remote.replaceRow('generic', { id: 5, name: 'base/y' }, { name: 'base/y', type: 'COST' }), /boom/);
+  assert.deepEqual(calls.map((c) => c[0]), ['POST'], 'no delete after a failed create');
+});
+
+test('replaceRow reads the id from the generic {policy: ...} envelope', async () => {
+  reset();
+  stub.onPost = async () => ({ policy: { id: 42 } });
+  await remote.replaceRow('generic', { id: 5, name: 'base/y' }, { name: 'base/y', type: 'COST' });
+  assert.equal(calls[2][1], '/api/v1/policies/42/');
+});
+
+test('writeOps never throws for one failed op and reports every outcome', async () => {
+  reset();
+  stub.onPut = async () => { throw new Error('nope'); };
+  const results = await remote.writeOps([
+    { op: 'create', table: 'generic', body: { name: 'base/a' } },
+    { op: 'update', table: 'tool', row: { id: '1' }, body: { action: 'AUDIT' } },
+    { op: 'unchanged', table: 'tool', row: { id: '2' } },
+  ]);
+  assert.deepEqual(results.map((r) => r.status), ['ok', 'failed', 'skipped']);
+  assert.equal(results[1].error, 'nope');
+});
+
+test('fetchManaged asks for the pack by identity and splits unsupported types', async () => {
+  reset();
+  stub.onGet = async (p) => {
+    if (p.startsWith('/api/v1/command-policies/')) {
+      return { policies: [
+        { id: '1', name: 'Audit pushes', policy_type: 'TERMINAL_COMMAND', origin: 'CODE', code_pack: 'base', code_slug: 'a' },
+        { id: '2', name: 'Skill', policy_type: 'SKILL_INJECTION', origin: 'CODE', code_pack: 'base', code_slug: 'skill' },
+        { id: '3', name: 'base/a', policy_type: 'TERMINAL_COMMAND', origin: 'MANUAL' },
+      ], total_pages: 1 };
+    }
+    return { policies: [
+      { id: 10, name: 'Cap', type: 'COST', origin: 'CODE', code_pack: 'base', code_slug: 'cost' },
+      { id: 11, name: 'Repo', type: 'REPO', origin: 'CODE', code_pack: 'base', code_slug: 'repo' },
+      { id: 12, name: 'Other', type: 'COST', origin: 'CODE', code_pack: 'other', code_slug: 'x' },
+    ] };
+  };
+  const live = await remote.fetchManaged('base');
+  assert.deepEqual(live.tool.map((r) => r.name), ['Audit pushes'], 'a MANUAL row named like a pack policy is not managed');
+  assert.deepEqual(live.generic.map((r) => r.name), ['Cap'], 'a row of another pack is not managed');
+  assert.deepEqual(live.unsupported.map((u) => u.row.name), ['Skill', 'Repo']);
+  assert.deepEqual(calls[0][2].query, { code_pack: 'base', origin: 'CODE', page: 1, page_size: 200 });
+  assert.deepEqual(calls[1][2].query, { code_pack: 'base', origin: 'CODE' });
+});
+
+test('fetchAllGrouped walks every page and groups by code_pack', async () => {
+  reset();
+  stub.onGet = async (p, opts) => {
+    if (p.startsWith('/api/v1/command-policies/')) {
+      const page = opts.query.page;
+      return { policies: [{ id: String(page), name: `policy ${page}`, policy_type: 'MCP_TOOL', origin: 'CODE', code_pack: `p${page}`, code_slug: 'a' }], total_pages: 2 };
+    }
+    return { policies: [{ id: 1, name: 'loose', type: 'COST', origin: 'MANUAL' }] };
+  };
+  const { packs, unmanaged } = await remote.fetchAllGrouped();
+  assert.deepEqual([...packs.keys()].sort(), ['p1', 'p2']);
+  assert.equal(unmanaged.length, 1);
+});
+
+test('replaceRow uses a temporary name and identity and rolls back when the old delete fails', async () => {
+  reset();
+  const slug = remote.tempSlug('a-very-long-policy-identifier-that-is-close-to-the-sixty-four-limit');
+  assert.ok(/^[a-z0-9-]{1,64}$/.test(slug), slug);
+  assert.match(remote.tempName('Block rm'), /^Block rm-replacing-/);
+  stub.onDel = async (p) => { if (p.endsWith('/11/')) throw new Error('old delete failed'); return {}; };
+  await assert.rejects(() => remote.replaceRow('tool', { id: '11', name: 'x' }, { name: 'x', code_pack: 'base', code_slug: 'x' }), /old delete failed/);
+  assert.deepEqual(calls.map((c) => [c[0], c[1]]), [['POST', '/api/v1/command-policies/'], ['DELETE', '/api/v1/command-policies/11/'], ['DELETE', '/api/v1/command-policies/99/']]);
+  assert.match(calls[0][2].body.code_slug, /^x-replacing-/);
+  assert.equal(calls[0][2].body.code_pack, 'base');
+});
+
+test('createdId tolerates the response envelopes the CLI accepts', () => {
+  assert.equal(remote.createdId('tool', { id: '7', name: 'x' }), '7');
+  assert.equal(remote.createdId('tool', { command_policy: { id: '8' } }), '8');
+  assert.equal(remote.createdId('tool', { policy: { id: '9' } }), '9');
+  assert.equal(remote.createdId('generic', { policy: { id: 10 } }), 10);
+  assert.equal(remote.createdId('generic', {}), null);
+  assert.equal(remote.createdId('generic', null), null);
+});
+
+test('findByExactName tags rows of unmanaged types as unsupported', async () => {
+  reset();
+  stub.onGet = async (p) => (p.startsWith('/api/v1/command-policies/')
+    ? { policies: [{ id: '1', name: 'Skill', policy_type: 'SKILL_INJECTION' }, { id: '2', name: 'Skill2', policy_type: 'MCP_TOOL' }], total_pages: 1 }
+    : { policies: [] });
+  const hits = await remote.findByExactName('Skill');
+  assert.equal(hits.length, 1);
+  assert.equal(hits[0].supported, false);
+  const ok = await remote.findByExactName('Skill2');
+  assert.equal(ok[0].supported, true);
+});
+
+test('every write declares origin CODE; delete carries it as a query parameter', async () => {
+  reset();
+  await remote.createRow('tool', { name: 'base/x', action: 'AUDIT' });
+  await remote.updateRow('generic', 23, { enabled: true });
+  await remote.deleteRow('tool', '11');
+  assert.deepEqual(calls[0], ['POST', '/api/v1/command-policies/', { body: { name: 'base/x', action: 'AUDIT', origin: 'CODE' } }]);
+  assert.deepEqual(calls[1], ['PUT', '/api/v1/policies/23/', { body: { enabled: true, origin: 'CODE' } }]);
+  assert.deepEqual(calls[2], ['DELETE', '/api/v1/command-policies/11/', { query: { origin: 'CODE' } }]);
+});
+
+test('loadReference records why the MCP catalogue is missing instead of hiding it', async () => {
+  reset();
+  remote.resetReference();
+  stub.onGet = async (p) => {
+    if (p.includes('mcp-servers')) throw new Error('503 from gateway-data');
+    if (p.includes('labels')) return { labels: [] };
+    return { user_groups: [], guardrails: [], ai_models: [], tool_types: [] };
+  };
+  const ref = await remote.loadReference({ mcp: true });
+  assert.deepEqual(ref.mcpServers, []);
+  assert.match(ref.mcpServersError, /503 from gateway-data/);
+  remote.resetReference();
+});
+
+test('a backend without the origin field is refused before any write', async () => {
+  reset();
+  stub.onGet = async (p) => (p.startsWith('/api/v1/command-policies/')
+    ? { policies: [{ id: '1', name: 'Block rm', policy_type: 'TERMINAL_COMMAND' }], total_pages: 1 }
+    : { policies: [{ id: 10, name: 'Cap', type: 'COST' }] });
+  await assert.rejects(() => remote.fetchManaged('base'), /newer server release/);
+  await assert.rejects(() => remote.fetchAllGrouped(), /newer server release/);
+  // An empty org cannot be told apart and simply has nothing to manage yet.
+  stub.onGet = async () => ({ policies: [], total_pages: 1 });
+  const live = await remote.fetchManaged('base');
+  assert.deepEqual(live, { tool: [], generic: [], unsupported: [] });
+});
+
+test('fetchAllNames maps every live name to its owner', async () => {
+  reset();
+  stub.onGet = async (p) => (p.startsWith('/api/v1/command-policies/')
+    ? { policies: [{ id: '1', name: 'Block rm', policy_type: 'TERMINAL_COMMAND', origin: 'MANUAL' }], total_pages: 1 }
+    : { policies: [{ id: 10, name: 'Cap', type: 'COST', origin: 'CODE', code_pack: 'base', code_slug: 'cap' }] });
+  const names = await remote.fetchAllNames();
+  assert.deepEqual(names.get('Block rm'), { table: 'tool', id: '1', code_pack: null, code_slug: null });
+  assert.deepEqual(names.get('Cap'), { table: 'generic', id: 10, code_pack: 'base', code_slug: 'cap' });
+});