Installation
pip install charley_policy-0.1.0-py3-none-any.whl
Global Options
These options apply to every command and must come before the subcommand:
agent-charley-cli [OPTIONS] COMMAND [ARGS]...
| Option | Env var | Default | Description |
|---|
--api-key TEXT | CHARLEY_API_KEY | — | API key (required) |
--env [prod|dev] | CHARLEY_ENV | prod | Target environment shortcut |
--base-url TEXT | CHARLEY_BASE_URL | https://dash.charlemagnelabs.ai | Override API base URL |
--env-file TEXT | — | .env | dotenv file to load CHARLEY_* vars from |
--verbose, -v | — | false | Print request URL and key prefix to stderr |
Environment shortcuts
--env | Base URL |
|---|
prod | https://dash.charlemagnelabs.ai |
dev | https://dash.dev.charlemagnelabs.ai |
--env takes precedence over --base-url.
plan
Preview what would change if you ran apply. Makes no changes to the server.
agent-charley-cli plan --file <path> [--groups <path>] [--prune]
| Flag | Description |
|---|
--file, -f TEXT | Policy YAML/JSON file or directory of files (required) |
--groups TEXT | Groups YAML file |
--prune | Include deletions for server policies not present in the file |
N to create, N to update, N to delete, N unchanged) followed by a unified diff of all changes.
# Preview all policy changes
agent-charley-cli plan --file policies/
# Preview policies + group membership changes
agent-charley-cli plan --file policies/ --groups groups.yaml
# Include deletions (what would be removed from the server)
agent-charley-cli plan --file policies/ --prune
apply
Apply local policy files to the server. Shows a plan first and prompts to confirm (skip with -y).
agent-charley-cli apply --file <path> [--groups <path>] [--prune] [-y]
| Flag | Description |
|---|
--file, -f TEXT | Policy YAML/JSON file or directory of files (required) |
--groups TEXT | Groups YAML file (creates groups and sets membership) |
--prune | Delete server policies not present in the file |
--yes, -y | Skip confirmation prompt |
# Apply with confirmation prompt
agent-charley-cli apply --file policies/
# Apply without prompting (CI usage)
agent-charley-cli apply --file policies/ --groups groups.yaml --prune -y
--prune deletes any server policy not represented in your local files. Use it carefully — it will remove policies that were created via the dashboard or by another operator.
pull
Download the current server policies and write them to a local YAML file. Useful for bootstrapping a GitOps repo from an existing dashboard configuration.
agent-charley-cli pull [--output <path>]
| Flag | Default | Description |
|---|
--output, -o TEXT | policies.yaml | Output file path |
# Pull to default file
agent-charley-cli pull
# Pull to a specific path
agent-charley-cli pull --output policies/current.yaml
effective
Show the effective merged policy for a specific device — the combined result of global + group + device layers.
agent-charley-cli effective <device_id>
{
"app_config": { "policy_data": { "flow_logs_enabled": true, ... } },
"dlp_config": { "policy_data": { "enabled": true, ... } },
"flow_config": { "policy_data": { "enabled": true, ... } }
}
agent-charley-cli effective a1b2c3d4-e5f6-7890-abcd-ef1234567890
groups list
List all groups in the org.
agent-charley-cli groups list
groups create
Create a new group.
agent-charley-cli groups create <name> [--description TEXT] [--idp-group-id TEXT]
| Flag | Description |
|---|
--description, -d TEXT | Optional description |
--idp-group-id TEXT | Pre-wire an IDP group mapping (stored, not yet active) |
groups delete
Delete a group. Prompts for confirmation unless --yes is passed.
agent-charley-cli groups delete <name_or_id> [--yes]
groups add-members
Add members to a group by email or device UUID. At least one --email or --device-id is required.
agent-charley-cli groups add-members <name_or_id> \
--email alice@company.com \
--email bob@company.com \
--device-id <uuid>
groups remove-members
Remove specific members from a group.
agent-charley-cli groups remove-members <name_or_id> \
--email alice@company.com
groups set-members
Replace the full member list for a group. Any devices currently in the group but not in this call are removed.
agent-charley-cli groups set-members <name_or_id> \
--email alice@company.com \
--device-id <uuid>
groups list-devices
List the device UUIDs currently assigned to a group.
agent-charley-cli groups list-devices <name_or_id>
groups list-members
List all members of a group with full user and device details — email, display name, machine ID, and enrollment status. Useful for auditing who is in a group and verifying user-to-device mappings.
agent-charley-cli groups list-members <name_or_id>
DEVICE ID EMAIL NAME MACHINE STATUS
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
a1b2c3d4-e5f6-7890-abcd-ef1234567890 alice@company.com Alice Smith ALICE-MBP active
b2c3d4e5-f6a7-8901-bcde-f12345678901 bob@company.com Bob Jones BOB-MBA active
Exit Codes
| Code | Meaning |
|---|
0 | Success |
1 | Error (auth failure, API error, file parse error, user cancelled) |
