unbound-cli 1.18.0 → 1.19.0

package/README.md

@@ -212,6 +212,66 @@ unbound policy tool delete <id>
 
 Before creating any policy, run `unbound policy form-data` to see available user group names, model names, guardrail names, and existing command policies. The CLI accepts names (e.g. `engg`, `claude-3-opus`, `PII`) and resolves them to backend IDs automatically. You can also pass numeric IDs directly.
 
+### Policy packs as code (Admin only)
+
+Keep policies in versioned YAML files and sync them to your org with `unbound pack`. One file is one **pack**: a named, versioned bundle of one or more policies of kind `tool`, `security`, `model` or `cost`. Every policy in a pack is marked on the server as managed by code, with the pack name and the policy `id` as its identity; its `name` is free text (it defaults to the id). The pack commands match, update and prune only by that identity, so policies made in the console are never read for diffing and never written, whatever they are called.
+
+The console shows a **Managed by Code** badge on those policies and only lets people switch them on or off; every other change goes through the pack file. A policy switched off in the console shows up in `pack diff` as `enabled: false -> true (off on the server, on in the pack)`, and `pack apply` turns it back on (set `enabled: false` in the file to keep it off). `unbound pack adopt` brings a console policy into a pack without renaming it. Needs a backend that stores the code identity (ai-gateway-data 0448 or later).
+
+Docs: https://docs.getunbound.ai/policies/policy-as-code
+
+```yaml
+# policies/k8s-baseline.yaml
+apiVersion: unbound.security/v1
+kind: PolicyPack
+metadata:
+  name: k8s-baseline        # stored on every policy below as its pack identity
+  version: 1.0.0
+defaults:
+  scope:
+    userGroups: [Engineering]
+policies:
+  - id: block-secret-reads
+    kind: tool
+    type: TERMINAL_COMMAND
+    action: BLOCK
+    commandFamily: custom
+    customMessage: Reading cluster secrets is blocked by the k8s-baseline pack.
+    config:
+      command: "regex:kubectl\\s+(get|describe)\\s+secrets?"
+  - id: github-writes-need-approval
+    kind: tool
+    type: MCP_TOOL
+    action: REQUIRE_SLACK_APPROVAL
+    mcp:
+      server: github
+      actionType: write
+  - id: pii-guard
+    kind: security
+    guardrails:
+      - name: PII
+        action: BLOCK
+  - id: monthly-cap
+    kind: cost
+    config:
+      monthly_budget: 5000
+```
+
+```bash
+unbound pack validate -f policies/              # schema check, no server contact
+unbound pack diff -f policies/k8s-baseline.yaml # what apply would change; exit 1 on drift
+unbound pack apply -f policies/k8s-baseline.yaml --dry-run
+unbound pack apply -f policies/k8s-baseline.yaml
+unbound pack apply -f policies/ --prune         # also delete managed policies missing from the files
+unbound pack sync policies/ --yes               # folder is the source of truth (apply + prune)
+unbound pack export k8s-baseline -o policies/k8s-baseline.yaml
+unbound pack export --all -o policies/          # one file per pack found in the org
+unbound pack adopt k8s-baseline --from "Block kubectl secrets" -o policies/k8s-baseline.yaml   # mark a console policy as managed by the pack; its name stays
+unbound pack delete k8s-baseline --yes          # remove every policy the pack manages
+```
+
+User groups, guardrails, models, labels and MCP servers are written by name and resolved at apply time; a name that does not resolve fails before anything is written. `config` is passed to the server as-is. Updates send only the fields that differ, and re-running the same file is safe. `diff` and `--dry-run` never write. A removed pack file does not delete its policies (use `pack delete`), because the server keeps no record of applied packs yet.
+
 ### Users
 
 | Command | Description |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.18.0",
+  "version": "1.19.0",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {
@@ -23,7 +23,8 @@
     "@iarna/toml": "^2.2.5",
     "@sentry/node": "^10.59.0",
     "commander": "^12.1.0",
-    "open": "^10.1.0"
+    "open": "^10.1.0",
+    "yaml": "^2.9.1"
   },
   "engines": {
     "node": ">=18.0.0"

package/src/commands/pack.js

@@ -0,0 +1,566 @@
+const fs = require('fs');
+const path = require('path');
+const config = require('../config');
+const output = require('../output');
+const readline = require('readline');
+const { PackError, parsePackText, validatePack, slugify, SLUG_RE } = require('../lib/pack-schema');
+const { toDesired, buildPlan, summarize, stable } = require('../lib/pack-plan');
+const { liveToPack, stringifyPack } = require('../lib/pack-export');
+const remote = require('../lib/pack-remote');
+
+const DOCS_PACKS = 'https://docs.getunbound.ai/policies/policy-as-code';
+const PACK_EXTENSIONS = ['.yaml', '.yml', '.json'];
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+function requireLogin() {
+  if (!config.isLoggedIn()) {
+    throw new Error('Not logged in. Run `unbound login` first.');
+  }
+}
+
+function fail(err) {
+  output.error(err.message);
+  process.exitCode = err.exitCode || 1;
+}
+
+/**
+ * Like utils.confirm, but the prompt is written to stderr: stdout of `adopt`,
+ * `export` and `--json` runs carries only the pack file or the JSON document,
+ * so a redirected stdout must never receive prompt text.
+ */
+function confirm(message, { stdin = process.stdin } = {}) {
+  if (!stdin.isTTY) {
+    // CI or a pipe: there is nobody to answer, so fail closed instead of
+    // hanging on a prompt or silently exiting 0 when stdin closes.
+    const err = new Error(`${message} Confirmation needed but stdin is not interactive; pass --yes.`);
+    err.exitCode = 1;
+    throw err;
+  }
+  const rl = readline.createInterface({ input: stdin, output: process.stderr });
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (value) => { if (!settled) { settled = true; resolve(value); } };
+    rl.on('close', () => done(false));
+    rl.question(`${message} (y/N) `, (answer) => {
+      // Settle before close(): close() emits 'close' synchronously, which would
+      // otherwise resolve false first and swallow the answer.
+      done(String(answer).trim().toLowerCase() === 'y');
+      rl.close();
+    });
+  });
+}
+
+function collect(value, prev = []) {
+  return [...prev, value];
+}
+
+/** Read one pack file, or every pack file in a directory (sorted by name). */
+function loadPackFiles(target) {
+  let stat;
+  try {
+    stat = fs.statSync(target);
+  } catch {
+    throw new PackError(`no such file or directory: ${target}`);
+  }
+  let files;
+  if (stat.isDirectory()) {
+    files = fs.readdirSync(target)
+      .filter((f) => PACK_EXTENSIONS.includes(path.extname(f).toLowerCase()))
+      .sort()
+      .map((f) => path.join(target, f));
+    if (!files.length) throw new PackError(`no .yaml, .yml or .json pack files in ${target}`);
+  } else {
+    files = [target];
+  }
+  const seen = new Map();
+  return files.map((file) => {
+    const text = fs.readFileSync(file, 'utf8');
+    const pack = validatePack(parsePackText(text, file), file);
+    if (seen.has(pack.name)) {
+      throw new PackError(`pack "${pack.name}" is defined twice: ${seen.get(pack.name)} and ${file}`);
+    }
+    seen.set(pack.name, file);
+    return { file, pack };
+  });
+}
+
+function short(value) {
+  const text = stable(value);
+  return text.length > 48 ? `${text.slice(0, 45)}...` : text;
+}
+
+/**
+ * The pack wants the policy on but the server has it off. Either someone
+ * switched it off in the console (the one change the console still allows on a
+ * managed row) or the file was just edited to turn it on; the plan cannot tell
+ * which, so the wording names both.
+ */
+function offOnServer(change) {
+  return change.field === 'enabled' && change.from === false && change.to === true;
+}
+
+function changeText(op) {
+  if (op.op === 'conflict' || op.op === 'orphan' || op.op === 'delete') return op.reason || '';
+  if (op.op === 'replace') return `${op.reason}; recreated`;
+  if (!op.changes || !op.changes.length) return '';
+  return op.changes.map((c) => {
+    if (c.field === 'identity') return op.reason;
+    if (offOnServer(c)) return 'enabled: false -> true (off on the server, on in the pack)';
+    if (c.field === 'origin') return `origin: ${short(c.from)} -> ${short(c.to)} (adopt: console becomes enable/disable only)`;
+    return `${c.field}: ${short(c.from)} -> ${short(c.to)}`;
+  }).join('; ');
+}
+
+const ACTION_LABEL = {
+  create: 'create',
+  update: 'update',
+  replace: 'replace',
+  delete: 'delete',
+  orphan: 'keep',
+  unchanged: 'ok',
+  conflict: 'CONFLICT',
+};
+
+function printPlan({ file, pack, ops, live }) {
+  console.log('');
+  output.info(`Pack ${pack.name} v${pack.version} (${file})`);
+  output.table(ops, [
+    { key: 'op', header: 'Action', format: (v) => ACTION_LABEL[v] || v },
+    { key: 'kind', header: 'Kind' },
+    { key: 'id', header: 'Id' },
+    { key: 'serverName', header: 'Name' },
+    { key: 'changes', header: 'Details', format: (_v, row) => changeText(row) },
+  ]);
+  for (const { row, table } of live.unsupported || []) {
+    output.warn(`${row.name}: ${table === 'tool' ? row.policy_type : row.type} policies are not managed by this CLI version; left untouched.`);
+  }
+  const off = ops.filter((op) => op.op === 'update' && (op.changes || []).some(offOnServer));
+  if (off.length) {
+    const many = off.length > 1;
+    output.warn(`${off.length} polic${many ? 'ies are' : 'y is'} off on the server but on in the pack (switched off in the console, or just enabled in the file). Apply turns ${many ? 'them' : 'it'} on; to keep ${many ? 'one' : 'it'} off, set enabled: false in the pack file.`);
+  }
+  const s = summarize(ops);
+  const parts = [];
+  if (s.create) parts.push(`${s.create} to create`);
+  if (s.update) parts.push(`${s.update} to update`);
+  if (s.replace) parts.push(`${s.replace} to replace`);
+  if (s.delete) parts.push(`${s.delete} to delete`);
+  if (s.orphan) parts.push(`${s.orphan} kept (not in file)`);
+  if (s.conflict) parts.push(`${s.conflict} conflict${s.conflict > 1 ? 's' : ''}`);
+  parts.push(`${s.unchanged} unchanged`);
+  console.log(`  ${parts.join(', ')}`);
+}
+
+function planJson({ file, pack, ops }) {
+  return {
+    pack: pack.name,
+    version: pack.version,
+    file,
+    summary: summarize(ops),
+    ops: ops.map((op) => ({
+      op: op.op,
+      kind: op.kind,
+      policy: op.serverName,
+      id: op.id,
+      changes: op.changes || [],
+      reason: op.reason || null,
+    })),
+  };
+}
+
+async function planPack(pack, { prune, names }) {
+  const needsMcp = pack.policies.some((p) => p.kind === 'tool' && p.type === 'MCP_TOOL' && p.mcp && p.mcp.actionType);
+  const ref = await remote.loadReference({ mcp: needsMcp });
+  if (needsMcp && ref.mcpServersError) {
+    // Without the catalogue an actionType cannot be compared; refusing beats a plan that calls stale tools "unchanged".
+    throw new PackError(`could not load the MCP server catalogue (${ref.mcpServersError}); this pack uses mcp.actionType, which needs it. Retry, or list mcp.tools explicitly`);
+  }
+  const desired = toDesired(pack, ref);
+  const live = await remote.fetchManaged(pack.name);
+  live.names = names || await remote.fetchAllNames();
+  const ops = buildPlan(desired, live, { prune });
+  return { ops, live, ref };
+}
+
+/**
+ * Shared body of apply / sync / diff.
+ * Returns { drift, failed } so callers can set the exit code.
+ */
+async function runApply(target, { dryRun = false, prune = false, yes = false, json = false, label = 'apply' }) {
+  requireLogin();
+  const packs = loadPackFiles(target);
+  // Names are unique per org, so two packs in one run cannot both claim one.
+  const nameOwner = new Map();
+  for (const { file, pack } of packs) {
+    for (const policy of pack.policies) {
+      const owner = nameOwner.get(policy.serverName);
+      if (owner && owner.pack !== pack.name) {
+        throw new PackError(`the name "${policy.serverName}" is used by both ${owner.pack} (${owner.file}) and ${pack.name} (${file}); names must be unique in the org`);
+      }
+      nameOwner.set(policy.serverName, { pack: pack.name, file });
+    }
+  }
+  // Every live name in the org, loaded once per run and shared by every pack's plan.
+  const names = await remote.fetchAllNames();
+  const planned = [];
+  for (const { file, pack } of packs) {
+    const { ops, live } = await planPack(pack, { prune, names });
+    planned.push({ file, pack, ops, live });
+  }
+
+  const totals = planned.reduce((acc, p) => {
+    const s = summarize(p.ops);
+    for (const k of Object.keys(s)) acc[k] = (acc[k] || 0) + s[k];
+    return acc;
+  }, {});
+
+  if (!json) planned.forEach(printPlan);
+
+  if (totals.conflict) {
+    if (json) output.json({ mode: label, dryRun, packs: planned.map(planJson) });
+    throw new PackError(`${totals.conflict} conflict${totals.conflict > 1 ? 's' : ''} found; nothing was changed`);
+  }
+
+  if (dryRun) {
+    if (json) output.json({ mode: label, dryRun: true, packs: planned.map(planJson) });
+    else if (totals.drift) output.info(`Dry run: ${totals.drift} change${totals.drift > 1 ? 's' : ''} pending. Run without --dry-run to apply.`);
+    else output.success('Already in sync.');
+    return { drift: totals.drift, failed: 0 };
+  }
+
+  if (!totals.drift) {
+    if (json) output.json({ mode: label, dryRun: false, packs: planned.map(planJson), results: [] });
+    else output.success('Already in sync.');
+    return { drift: 0, failed: 0 };
+  }
+
+  const destructive = totals.delete + totals.replace;
+  if (destructive && !yes) {
+    const ok = await confirm(`This will delete ${destructive} polic${destructive > 1 ? 'ies' : 'y'} (${totals.delete} delete, ${totals.replace} replace). Continue?`);
+    if (!ok) {
+      output.warn('Aborted. Nothing was changed.');
+      return { drift: totals.drift, failed: 0, aborted: true };
+    }
+  }
+
+  const results = [];
+  for (const p of planned) {
+    const todo = p.ops.filter((op) => ['create', 'update', 'replace', 'delete'].includes(op.op));
+    const packResults = await remote.writeOps(todo, {
+      onResult: (r) => {
+        if (json) return;
+        const line = `${ACTION_LABEL[r.op.op]} ${r.op.serverName}`;
+        if (r.status === 'ok') output.success(line);
+        else output.error(`${line}: ${r.error}`);
+      },
+    });
+    results.push(...packResults.map((r) => ({ pack: p.pack.name, policy: r.op.serverName, op: r.op.op, status: r.status, error: r.error })));
+  }
+  const failed = results.filter((r) => r.status === 'failed').length;
+  if (json) {
+    output.json({ mode: label, dryRun: false, packs: planned.map(planJson), results });
+  } else {
+    console.log('');
+    if (failed) output.warn(`${results.length - failed} succeeded, ${failed} failed. Re-run to retry; every operation is idempotent by name.`);
+    else output.success(`${results.length} change${results.length > 1 ? 's' : ''} applied.`);
+  }
+  return { drift: totals.drift, failed };
+}
+
+function writeOrPrint(text, outPath) {
+  if (!outPath) {
+    process.stdout.write(text);
+    return;
+  }
+  fs.mkdirSync(path.dirname(path.resolve(outPath)), { recursive: true });
+  fs.writeFileSync(outPath, text);
+  output.success(`Wrote ${outPath}`);
+}
+
+// ============================================================================
+// register(program)
+// ============================================================================
+
+function register(program) {
+  const pack = program
+    .command('pack')
+    .description('Policy packs as code: keep policies in YAML files and sync them to your org.')
+    .addHelpText('after', `
+A pack file is one versioned bundle of policies (kind: tool, security, model or
+cost). Every policy in a pack is marked on the server as managed by code, with
+the pack name and the policy id as its identity; its name is free text. The
+pack commands only ever touch policies carrying that mark. Policies made in the
+console are never read for diffing and never written.
+
+  validate  Check pack files without contacting the server
+  diff      Show what apply would change; exit 1 when there is drift (CI)
+  apply     Create and update policies from a file or folder (--prune deletes)
+  sync      Folder is the source of truth: apply every pack with --prune
+  export    Write the live policies of a pack back to YAML
+  adopt     Mark console-made policies as managed by a pack (names stay)
+  delete    Remove every policy a pack manages
+
+Examples:
+  $ unbound pack validate -f policies/
+  $ unbound pack diff -f policies/k8s-baseline.yaml
+  $ unbound pack apply -f policies/k8s-baseline.yaml --dry-run
+  $ unbound pack apply -f policies/ --prune
+  $ unbound pack sync policies/ --yes
+  $ unbound pack export k8s-baseline -o policies/k8s-baseline.yaml
+  $ unbound pack adopt k8s-baseline --from "Block kubectl secrets" --from "Audit git push"
+
+Learn more: ${DOCS_PACKS}
+`);
+
+  pack
+    .command('validate')
+    .description('Validate pack files locally. No server contact.')
+    .requiredOption('-f, --file <path>', 'Pack file, or a folder of pack files')
+    .action((opts) => {
+      try {
+        const packs = loadPackFiles(opts.file);
+        for (const { file, pack: p } of packs) {
+          output.success(`${file}: pack "${p.name}" v${p.version}, ${p.policies.length} polic${p.policies.length > 1 ? 'ies' : 'y'}`);
+        }
+      } catch (err) {
+        fail(err);
+      }
+    });
+
+  pack
+    .command('diff')
+    .description('Compare pack files with the org. Exit 0 when in sync, 1 on drift, 2 on any error (validation, login, network).')
+    .requiredOption('-f, --file <path>', 'Pack file, or a folder of pack files')
+    .option('--prune', 'Count managed policies missing from the file as drift (they would be deleted)')
+    .option('--json', 'Output the plan as JSON')
+    .action(async (opts) => {
+      try {
+        const { drift } = await runApply(opts.file, { dryRun: true, prune: !!opts.prune, json: !!opts.json, label: 'diff' });
+        process.exitCode = drift ? 1 : 0;
+      } catch (err) {
+        // 1 is reserved for drift so CI can tell "the org differs" from "the run broke".
+        output.error(err.message);
+        process.exitCode = 2;
+      }
+    });
+
+  pack
+    .command('apply')
+    .description('Create and update policies so they match the pack file(s). Deletes only with --prune.')
+    .requiredOption('-f, --file <path>', 'Pack file, or a folder of pack files')
+    .option('--dry-run', 'Print the plan and change nothing')
+    .option('--prune', 'Delete managed policies that are not in the file')
+    .option('--yes', 'Skip the confirmation prompt for deletes')
+    .option('--json', 'Output the plan and results as JSON')
+    .addHelpText('after', `
+Examples:
+  $ unbound pack apply -f k8s-baseline.yaml --dry-run
+  $ unbound pack apply -f k8s-baseline.yaml
+  $ unbound pack apply -f policies/ --prune --yes
+
+Updates send only the fields that differ. Re-running the same file is safe.
+Learn more: ${DOCS_PACKS}
+`)
+    .action(async (opts) => {
+      try {
+        const { failed } = await runApply(opts.file, { dryRun: !!opts.dryRun, prune: !!opts.prune, yes: !!opts.yes, json: !!opts.json, label: 'apply' });
+        if (failed) process.exitCode = 1;
+      } catch (err) {
+        fail(err);
+      }
+    });
+
+  pack
+    .command('sync <path>')
+    .description('Make the org match a folder (or file) of pack files: apply every pack with --prune.')
+    .option('--dry-run', 'Print the plan and change nothing')
+    .option('--yes', 'Skip the confirmation prompt for deletes')
+    .option('--json', 'Output the plan and results as JSON')
+    .addHelpText('after', `
+Examples:
+  $ unbound pack sync policies/ --dry-run
+  $ unbound pack sync policies/ --yes
+
+A pack whose file is removed from the folder keeps its policies: the server
+has no record of which packs were applied before. Use \`unbound pack delete <pack>\`
+to remove a whole pack.
+`)
+    .action(async (target, opts) => {
+      try {
+        const { failed } = await runApply(target, { dryRun: !!opts.dryRun, prune: true, yes: !!opts.yes, json: !!opts.json, label: 'sync' });
+        if (failed) process.exitCode = 1;
+      } catch (err) {
+        fail(err);
+      }
+    });
+
+  pack
+    .command('export [pack]')
+    .description('Write the live policies of a pack as a pack file.')
+    .option('-o, --out <path>', 'File to write (default: stdout). With --all: a folder, one file per pack')
+    .option('--all', 'Export every pack found in the org')
+    .option('--pack-version <version>', 'metadata.version to write (default 1.0.0). Not --version, which prints the CLI version', '1.0.0')
+    .option('--json', 'Write JSON instead of YAML')
+    .addHelpText('after', `
+Examples:
+  $ unbound pack export k8s-baseline
+  $ unbound pack export k8s-baseline -o policies/k8s-baseline.yaml
+  $ unbound pack export --all -o policies/
+`)
+    .action(async (packName, opts) => {
+      try {
+        requireLogin();
+        if (!packName && !opts.all) throw new PackError('pass a pack name, or --all');
+        if (packName && !SLUG_RE.test(packName)) throw new PackError('pack name must match [a-z0-9][a-z0-9-]{0,63}');
+        const ref = await remote.loadReference();
+        const serialize = (doc) => (opts.json ? `${JSON.stringify(doc, null, 2)}\n` : stringifyPack(doc));
+        const ext = opts.json ? '.json' : '.yaml';
+
+        if (opts.all) {
+          if (!opts.out) throw new PackError('--all needs -o <folder>');
+          const { packs, unmanaged } = await remote.fetchAllGrouped();
+          if (!packs.size) {
+            output.info('No pack-managed policies found in this org.');
+          }
+          fs.mkdirSync(opts.out, { recursive: true });
+          for (const [name, live] of [...packs.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+            for (const { row } of live.unsupported) output.warn(`${row.name}: unsupported policy type, not exported.`);
+            if (!live.tool.length && !live.generic.length) {
+              output.warn(`pack "${name}": only unsupported policies, no file written.`);
+              continue;
+            }
+            const doc = liveToPack(name, live, ref, { version: opts.packVersion });
+            writeOrPrint(serialize(doc), path.join(opts.out, `${name}${ext}`));
+          }
+          if (unmanaged.length) {
+            output.info(`${unmanaged.length} polic${unmanaged.length > 1 ? 'ies are' : 'y is'} not in any pack. Use \`unbound pack adopt\` to bring them in.`);
+          }
+          return;
+        }
+
+        const live = await remote.fetchManaged(packName);
+        for (const { row } of live.unsupported) output.warn(`${row.name}: unsupported policy type, not exported.`);
+        if (!live.tool.length && !live.generic.length) {
+          throw new PackError(live.unsupported.length
+            ? `pack "${packName}" only has policies of types this CLI version does not manage; nothing to export`
+            : `pack "${packName}" manages no policies in this org`);
+        }
+        const doc = liveToPack(packName, live, ref, { version: opts.packVersion });
+        writeOrPrint(serialize(doc), opts.out);
+      } catch (err) {
+        fail(err);
+      }
+    });
+
+  pack
+    .command('adopt <pack>')
+    .description('Bring console-made policies into a pack: marks them as managed by code with this pack and an id. Names stay as they are. Prints the resulting pack file.')
+    .requiredOption('--from <policy name>', 'Exact name of an existing policy. Repeatable.', collect)
+    .option('--id <slug>', 'Id to use (only with a single --from). Default: a slug of the policy name')
+    .option('--yes', 'Skip the confirmation prompt')
+    .option('-o, --out <path>', 'Write the resulting pack file here (default: stdout; progress goes to stderr)')
+    .option('--pack-version <version>', 'metadata.version for the printed pack file (default 1.0.0)', '1.0.0')
+    .addHelpText('after', `
+Examples:
+  $ unbound pack adopt k8s-baseline --from "Block kubectl secrets"
+  $ unbound pack adopt k8s-baseline --from "Block kubectl secrets" --id block-secret-reads
+  $ unbound pack adopt k8s-baseline --from "Audit git push" --from "Block rm -rf" --yes -o policies/k8s-baseline.yaml
+
+Adoption changes no policy content: it marks the policy as managed by code so the
+console only switches it on or off from then on. Commit the written file, then
+manage the pack with apply.
+`)
+    .action(async (packName, opts) => {
+      try {
+        requireLogin();
+        if (!SLUG_RE.test(packName)) throw new PackError('pack name must match [a-z0-9][a-z0-9-]{0,63}');
+        if (opts.id && opts.from.length !== 1) throw new PackError('--id works with exactly one --from');
+        if (opts.id && !SLUG_RE.test(opts.id)) throw new PackError('--id must match [a-z0-9][a-z0-9-]{0,63}');
+
+        const adoptions = [];
+        for (const name of opts.from) {
+          const hits = await remote.findByExactName(name);
+          if (!hits.length) throw new PackError(`no policy named "${name}"`);
+          if (hits.length > 1) throw new PackError(`"${name}" matches ${hits.length} policies (a tool policy and a generic policy share that name); rename one in the console first`);
+          if (!hits[0].supported) {
+            const type = hits[0].row.policy_type || hits[0].row.type;
+            throw new PackError(`"${name}" is a ${type} policy, which this CLI version does not manage; it cannot join a pack`);
+          }
+          if (hits[0].row.origin === 'CODE' && hits[0].row.code_pack) {
+            throw new PackError(`"${name}" is already managed by pack ${hits[0].row.code_pack} (id ${hits[0].row.code_slug})`);
+          }
+          const id = opts.id || slugify(name);
+          if (!id) throw new PackError(`cannot derive an id from "${name}"; pass --id`);
+          adoptions.push({ ...hits[0], id });
+        }
+        const dupes = adoptions.map((r) => r.id).filter((id, i, all) => all.indexOf(id) !== i);
+        if (dupes.length) throw new PackError(`two policies would get the same id: ${[...new Set(dupes)].join(', ')}`);
+
+        const existing = await remote.fetchManaged(packName);
+        for (const r of adoptions) {
+          const taken = [...existing.tool, ...existing.generic, ...existing.unsupported.map((u) => u.row)].find((row) => row.code_slug === r.id);
+          if (taken) throw new PackError(`id "${r.id}" is already used in pack ${packName} by "${taken.name}"; pass --id`);
+        }
+
+        for (const r of adoptions) output.info(`${r.row.name}  ->  ${packName}/${r.id}`);
+        if (!opts.yes) {
+          const ok = await confirm(`Mark ${adoptions.length} polic${adoptions.length > 1 ? 'ies' : 'y'} as managed by pack "${packName}"?`);
+          if (!ok) { output.warn('Aborted.'); return; }
+        }
+        for (const r of adoptions) {
+          await remote.updateRow(r.table, r.row.id, { code_pack: packName, code_slug: r.id });
+          // stderr on purpose: stdout carries only the pack file so it can be redirected.
+          output.info(`Adopted "${r.row.name}" as ${packName}/${r.id}`);
+        }
+        const ref = await remote.loadReference();
+        const live = await remote.fetchManaged(packName);
+        writeOrPrint(stringifyPack(liveToPack(packName, live, ref, { version: opts.packVersion })), opts.out);
+      } catch (err) {
+        fail(err);
+      }
+    });
+
+  pack
+    .command('delete <pack>')
+    .description('Delete every policy a pack manages.')
+    .option('--yes', 'Skip the confirmation prompt')
+    .action(async (packName, opts) => {
+      try {
+        requireLogin();
+        if (!SLUG_RE.test(packName)) throw new PackError('pack name must match [a-z0-9][a-z0-9-]{0,63}');
+        const live = await remote.fetchManaged(packName);
+        const rows = [
+          ...live.tool.map((row) => ({ table: 'tool', row })),
+          ...live.generic.map((row) => ({ table: 'generic', row })),
+        ];
+        for (const { row } of live.unsupported) output.warn(`${row.name}: unsupported policy type, left untouched; delete it in the console.`);
+        if (!rows.length) {
+          output.info(`Pack "${packName}" manages no policies of a managed type in this org.`);
+          return;
+        }
+        for (const { row } of rows) console.log(`  ${row.name}`);
+        if (!opts.yes) {
+          const ok = await confirm(`Delete these ${rows.length} polic${rows.length > 1 ? 'ies' : 'y'}?`);
+          if (!ok) { output.warn('Aborted.'); return; }
+        }
+        let failed = 0;
+        for (const { table, row } of rows) {
+          try {
+            await remote.deleteRow(table, row.id);
+            output.success(`Deleted ${row.name}`);
+          } catch (err) {
+            failed += 1;
+            output.error(`${row.name}: ${err.message}`);
+          }
+        }
+        if (failed) process.exitCode = 1;
+      } catch (err) {
+        fail(err);
+      }
+    });
+}
+
+module.exports = { register, _internals: { loadPackFiles, changeText, runApply, confirm } };

package/src/index.js

@@ -138,6 +138,15 @@ POLICY MANAGEMENT
   $ unbound policy tool families           Discover terminal command families
   $ unbound policy tool mcp-servers        Discover MCP servers and their tools
 
+  Policy packs as code — keep policies in YAML and sync them from a folder:
+  $ unbound pack validate -f policies/     Check pack files locally (no server contact)
+  $ unbound pack diff -f policies/         Show drift; exit 1 when the org differs (CI)
+  $ unbound pack apply -f policies/ --dry-run
+  $ unbound pack apply -f policies/ --prune
+  $ unbound pack sync policies/            Folder is the source of truth (apply + prune)
+  $ unbound pack export <pack> -o file.yaml
+  $ unbound pack adopt <pack> --from "<policy name>"
+
 USER & GROUP MANAGEMENT
   $ unbound users list                     List organization members
   $ unbound users effective-policies <id>  View effective policies for a user
@@ -211,6 +220,7 @@ require('./commands/logout').register(program);
 require('./commands/status').register(program);
 require('./commands/doctor').register(program);
 require('./commands/policy').register(program);
+require('./commands/pack').register(program);
 require('./commands/users').register(program);
 require('./commands/user-groups').register(program);
 require('./commands/tools').register(program);