unbound-cli 1.20.1 → 1.20.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.20.1",
+  "version": "1.20.2",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/lib/pack-export.js

@@ -80,6 +80,8 @@ function genericRowToPolicy(row, ref) {
   } else if (
     kind === 'model'
     && ('support_all_models' in config || 'allowed_model_ids' in config || 'excluded_model_ids' in config)
+    // Name patterns have no sugar form; as raw config they cannot read as "allow all".
+    && !('allowed_model_patterns' in config)
     // "allow nothing" has no sugar form; keep it as raw config so the file validates.
     && (config.support_all_models || (config.allowed_model_ids || []).length)
   ) {

package/src/lib/pack-plan.js

@@ -91,9 +91,26 @@ function normalizeModelConfig(config) {
     support_all_models: !!config.support_all_models,
     allowed_model_ids: sortedNumbers(config.allowed_model_ids),
     excluded_model_ids: sortedNumbers(config.excluded_model_ids),
+    // Any match counts, so pattern order is not a change.
+    ...(Array.isArray(config.allowed_model_patterns) && { allowed_model_patterns: [...config.allowed_model_patterns].sort() }),
+    ...(Array.isArray(config.excluded_model_patterns) && { excluded_model_patterns: [...config.excluded_model_patterns].sort() }),
   };
 }
 
+// The backend stores a fixed model list as exact-name patterns when every id resolves to a name one can spell; plan that stored shape so it does not drift.
+function asStoredModelConfig(config, aiModels) {
+  const ids = config && config.allowed_model_ids;
+  if (!config || config.support_all_models !== false || 'allowed_model_patterns' in config || !Array.isArray(ids) || !ids.length || !ids.every(Number.isInteger)) return config;
+  const found = (aiModels || []).filter((m) => ids.includes(Number(m.id)));
+  // An empty list or an id missing from the catalog stays a fixed list, so nothing widens or drops.
+  if (new Set(found.map((m) => Number(m.id))).size !== new Set(ids).size) return config;
+  const names = [...new Set(found.map((m) => m.name))].sort();
+  if (!names.every((name) => /^[A-Za-z0-9._@:-]+$/.test(name))) return config;
+  // Excluded ids never applied to a fixed list, so the backend drops them on conversion too.
+  const { allowed_model_ids: _ids, excluded_model_ids: _excluded, ...rest } = config;
+  return { ...rest, support_all_models: true, allowed_model_patterns: names };
+}
+
 function normalizeConfig(kind, config) {
   if (kind === 'security') return normalizeSecurityConfig(config);
   if (kind === 'model') return normalizeModelConfig(config);
@@ -229,6 +246,8 @@ function genericDesired(policy, ref, where) {
   if (kind === 'security' && policy.guardrails) config = guardrailsToConfig(policy, ref, where);
   else if (kind === 'model' && policy.models) config = modelsToConfig(policy, ref, where);
   else config = policy.config || {};
+  const unconverted = config;
+  if (kind === 'model') config = asStoredModelConfig(config, ref.aiModels);
 
   const scopeIds = resolveIds(ref.userGroups, policy.scope && policy.scope.userGroups, 'user group', { where });
   const toolTypes = [...new Set(policy.scope && policy.scope.toolTypes ? policy.scope.toolTypes : [])].sort();
@@ -260,7 +279,8 @@ function genericDesired(policy, ref, where) {
     label_ids: labelIds,
   };
   if (policy.priority !== undefined) proj.priority = policy.priority;
-  return { table: 'generic', body, proj, mcp: null };
+  const legacyConfig = config !== unconverted ? normalizeConfig(kind, unconverted) : undefined;
+  return { table: 'generic', body, proj, mcp: null, legacyConfig };
 }
 
 /**
@@ -449,7 +469,9 @@ function buildPlan(desired, live, { prune = false } = {}) {
       continue;
     }
 
-    const changes = diffFields(d.proj, liveProj);
+    let changes = diffFields(d.proj, liveProj);
+    // A model list stored as ids before the backend saved patterns is the same policy.
+    if (changes.length && d.legacyConfig && !diffFields({ ...d.proj, config: d.legacyConfig }, liveProj).length) changes = [];
     if (!changes.length) {
       ops.push({ ...base, op: 'unchanged', row, changes: [] });
       continue;

package/test/pack-export.test.js

@@ -67,6 +67,15 @@ test('round trip keeps a disabled guardrail entry disabled', () => {
   assert.deepEqual(ops.map((o) => o.op), ['unchanged']);
 });
 
+test('a model policy stored as name patterns exports as raw config and plans unchanged', () => {
+  const live = { tool: [], generic: [{ ...LIVE.generic[1], config: { support_all_models: true, allowed_model_patterns: ['claude-sonnet'], excluded_model_ids: [] } }] };
+  const doc = exp.liveToPack('base', live, REF);
+  assert.equal(doc.policies[0].models, undefined);
+  assert.deepEqual(doc.policies[0].config, live.generic[0].config);
+  const ops = plan.buildPlan(plan.toDesired(schema.validatePack(doc, 'base.yaml'), REF), live, { prune: true });
+  assert.deepEqual(ops.map((o) => o.op), ['unchanged']);
+});
+
 test('export keeps a loadable file for an empty BLOCK message and an allow-nothing model policy', () => {
   const live = {
     tool: [{ ...LIVE.tool[0], name: 'quiet-block', code_slug: 'quiet-block', custom_message: '' }],

package/test/pack-plan.test.js

@@ -67,6 +67,23 @@ test('buildPlan: in-sync org yields only unchanged ops', () => {
   assert.equal(plan.summarize(ops).drift, 0);
 });
 
+test('buildPlan: an allowed-model list matches the name patterns the backend stores it as', () => {
+  const desired = plan.toDesired(pack([{ ...MODEL, models: { allowed: ['gpt-4o', 'claude-sonnet'] } }]), REF);
+  assert.deepEqual(desired[0].body.config, { support_all_models: true, allowed_model_patterns: ['claude-sonnet', 'gpt-4o'] });
+  const live = { ...LIVE_MODEL, config: { support_all_models: true, allowed_model_patterns: ['claude-sonnet', 'gpt-4o'] } };
+  assert.deepEqual(plan.buildPlan(desired, { tool: [], generic: [live] }).map((o) => o.op), ['unchanged']);
+  const reordered = { ...live, config: { ...live.config, allowed_model_patterns: ['gpt-4o', 'claude-sonnet'] } };
+  assert.deepEqual(plan.buildPlan(desired, { tool: [], generic: [reordered] }).map((o) => o.op), ['unchanged']);
+});
+
+test('toDesired: an empty or partly unknown id list stays a fixed list', () => {
+  for (const ids of [[], [100, 999]]) {
+    const config = { support_all_models: false, allowed_model_ids: ids, excluded_model_ids: [] };
+    const [d] = plan.toDesired(pack([{ id: 'models', kind: 'model', config }]), REF);
+    assert.deepEqual(d.body.config, config);
+  }
+});
+
 test('buildPlan: create, patch-update, orphan and prune', () => {
   const desired = plan.toDesired(pack([{ ...TERMINAL, action: 'AUDIT', customMessage: undefined }, { ...COST, config: { monthly_budget: 250 } }]), REF);
   const live = { tool: [LIVE_TERMINAL, LIVE_MCP], generic: [LIVE_COST] };