@office-ai/aioncli-core 0.26.0 → 0.30.0

package/dist/src/policy/policy-engine.test.js

@@ -5,7 +5,7 @@
  */
 import { describe, it, expect, beforeEach, beforeAll, vi } from 'vitest';
 import { PolicyEngine } from './policy-engine.js';
-import { PolicyDecision, InProcessCheckerType, ApprovalMode, } from './types.js';
+import { PolicyDecision, InProcessCheckerType, ApprovalMode, PRIORITY_SUBAGENT_TOOL, } from './types.js';
 import { SafetyCheckDecision } from '../safety/protocol.js';
 import { initializeShellParsers } from '../utils/shell-utils.js';
 import { buildArgsPatterns } from './utils.js';
@@ -28,6 +28,30 @@ vi.mock('../utils/shell-utils.js', async (importOriginal) => {
         command.includes('>') && !command.includes('-> arrow')),
     };
 });
+// Mock tool-names to provide a consistent alias for testing
+vi.mock('../tools/tool-names.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    const mockedAliases = {
+        ...actual.TOOL_LEGACY_ALIASES,
+        legacy_test_tool: 'current_test_tool',
+        another_legacy_test_tool: 'current_test_tool',
+    };
+    return {
+        ...actual,
+        TOOL_LEGACY_ALIASES: mockedAliases,
+        getToolAliases: vi.fn().mockImplementation((name) => {
+            const aliases = new Set([name]);
+            const canonicalName = mockedAliases[name] ?? name;
+            aliases.add(canonicalName);
+            for (const [legacyName, currentName] of Object.entries(mockedAliases)) {
+                if (currentName === canonicalName) {
+                    aliases.add(legacyName);
+                }
+            }
+            return Array.from(aliases);
+        }),
+    };
+});
 describe('PolicyEngine', () => {
     let engine;
     let mockCheckerRunner;
@@ -74,6 +98,23 @@ describe('PolicyEngine', () => {
             expect((await engine.check({ name: 'edit' }, undefined)).decision).toBe(PolicyDecision.DENY);
             expect((await engine.check({ name: 'other' }, undefined)).decision).toBe(PolicyDecision.ASK_USER);
         });
+        it('should match unqualified tool names with qualified rules when serverName is provided', async () => {
+            const rules = [
+                {
+                    toolName: 'my-server__tool',
+                    decision: PolicyDecision.ALLOW,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            // Match with qualified name (standard)
+            expect((await engine.check({ name: 'my-server__tool' }, 'my-server')).decision).toBe(PolicyDecision.ALLOW);
+            // Match with unqualified name + serverName (the fix)
+            expect((await engine.check({ name: 'tool' }, 'my-server')).decision).toBe(PolicyDecision.ALLOW);
+            // Should NOT match with unqualified name but NO serverName
+            expect((await engine.check({ name: 'tool' }, undefined)).decision).toBe(PolicyDecision.ASK_USER);
+            // Should NOT match with unqualified name but WRONG serverName
+            expect((await engine.check({ name: 'tool' }, 'wrong-server')).decision).toBe(PolicyDecision.ASK_USER);
+        });
         it('should match by args pattern', async () => {
             const rules = [
                 {
@@ -107,6 +148,40 @@ describe('PolicyEngine', () => {
             // Higher priority rule (ALLOW) should win
             expect((await engine.check({ name: 'shell' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
         });
+        it('should match current tool call against legacy tool name rules', async () => {
+            const legacyName = 'legacy_test_tool';
+            const currentName = 'current_test_tool';
+            const rules = [
+                { toolName: legacyName, decision: PolicyDecision.DENY },
+            ];
+            engine = new PolicyEngine({ rules });
+            // Call using the CURRENT name, should be denied because of legacy rule
+            const { decision } = await engine.check({ name: currentName }, undefined);
+            expect(decision).toBe(PolicyDecision.DENY);
+        });
+        it('should match legacy tool call against current tool name rules (for skills support)', async () => {
+            const legacyName = 'legacy_test_tool';
+            const currentName = 'current_test_tool';
+            const rules = [
+                { toolName: currentName, decision: PolicyDecision.ALLOW },
+            ];
+            engine = new PolicyEngine({ rules });
+            // Call using the LEGACY name (from a skill), should be allowed because of current rule
+            const { decision } = await engine.check({ name: legacyName }, undefined);
+            expect(decision).toBe(PolicyDecision.ALLOW);
+        });
+        it('should match tool call using one legacy name against policy for another legacy name (same canonical tool)', async () => {
+            const legacyName1 = 'legacy_test_tool';
+            const legacyName2 = 'another_legacy_test_tool';
+            const rules = [
+                { toolName: legacyName2, decision: PolicyDecision.DENY },
+            ];
+            engine = new PolicyEngine({ rules });
+            // Call using legacyName1, should be denied because legacyName2 has a deny rule
+            // and they both point to the same canonical tool.
+            const { decision } = await engine.check({ name: legacyName1 }, undefined);
+            expect(decision).toBe(PolicyDecision.DENY);
+        });
         it('should apply wildcard rules (no toolName)', async () => {
             const rules = [
                 { decision: PolicyDecision.DENY }, // Applies to all tools
@@ -863,6 +938,187 @@ describe('PolicyEngine', () => {
             }, undefined);
             expect(result.decision).toBe(PolicyDecision.ALLOW);
         });
+        it('should require confirmation for a compound command with redirection even if individual commands are allowed', async () => {
+            const rules = [
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: /"command":"mkdir\b/,
+                    decision: PolicyDecision.ALLOW,
+                    priority: 20,
+                },
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: /"command":"echo\b/,
+                    decision: PolicyDecision.ALLOW,
+                    priority: 20,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            // The full command has redirection, even if the individual split commands do not.
+            // splitCommands will return ['mkdir -p "bar"', 'echo "hello"']
+            // The redirection '> bar/test.md' is stripped by splitCommands.
+            const result = await engine.check({
+                name: 'run_shell_command',
+                args: { command: 'mkdir -p "bar" && echo "hello" > bar/test.md' },
+            }, undefined);
+            expect(result.decision).toBe(PolicyDecision.ASK_USER);
+        });
+        it('should report redirection when a sub-command specifically has redirection', async () => {
+            const rules = [
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: /"command":"mkdir\b/,
+                    decision: PolicyDecision.ALLOW,
+                    priority: 20,
+                },
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: /"command":"echo\b/,
+                    decision: PolicyDecision.ALLOW,
+                    priority: 20,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            // In this case, we mock splitCommands to keep the redirection in the sub-command
+            vi.mocked(initializeShellParsers).mockResolvedValue(undefined);
+            const { splitCommands } = await import('../utils/shell-utils.js');
+            vi.mocked(splitCommands).mockReturnValueOnce([
+                'mkdir bar',
+                'echo hello > bar/test.md',
+            ]);
+            const result = await engine.check({
+                name: 'run_shell_command',
+                args: { command: 'mkdir bar && echo hello > bar/test.md' },
+            }, undefined);
+            expect(result.decision).toBe(PolicyDecision.ASK_USER);
+        });
+        it('should allow redirected shell commands in AUTO_EDIT mode if individual commands are allowed', async () => {
+            const rules = [
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: /"command":"echo\b/,
+                    decision: PolicyDecision.ALLOW,
+                    priority: 20,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            engine.setApprovalMode(ApprovalMode.AUTO_EDIT);
+            const result = await engine.check({
+                name: 'run_shell_command',
+                args: { command: 'echo "hello" > test.txt' },
+            }, undefined);
+            expect(result.decision).toBe(PolicyDecision.ALLOW);
+        });
+        it('should allow compound commands with safe operators (&&, ||) if individual commands are allowed', async () => {
+            const rules = [
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: /"command":"echo\b/,
+                    decision: PolicyDecision.ALLOW,
+                    priority: 20,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            // "echo hello && echo world" should be allowed since both parts are ALLOW and no redirection is present.
+            const result = await engine.check({
+                name: 'run_shell_command',
+                args: { command: 'echo hello && echo world' },
+            }, undefined);
+            expect(result.decision).toBe(PolicyDecision.ALLOW);
+        });
+    });
+    describe('Plan Mode vs Subagent Priority (Regression)', () => {
+        it('should DENY subagents in Plan Mode despite dynamic allow rules', async () => {
+            // Plan Mode Deny (1.06) > Subagent Allow (1.05)
+            const fixedRules = [
+                {
+                    decision: PolicyDecision.DENY,
+                    priority: 1.06,
+                    modes: [ApprovalMode.PLAN],
+                },
+                {
+                    toolName: 'codebase_investigator',
+                    decision: PolicyDecision.ALLOW,
+                    priority: PRIORITY_SUBAGENT_TOOL,
+                },
+            ];
+            const fixedEngine = new PolicyEngine({
+                rules: fixedRules,
+                approvalMode: ApprovalMode.PLAN,
+            });
+            const fixedResult = await fixedEngine.check({ name: 'codebase_investigator' }, undefined);
+            expect(fixedResult.decision).toBe(PolicyDecision.DENY);
+        });
+    });
+    describe('shell command parsing failure', () => {
+        it('should return ALLOW in YOLO mode even if shell command parsing fails', async () => {
+            const { splitCommands } = await import('../utils/shell-utils.js');
+            const rules = [
+                {
+                    decision: PolicyDecision.ALLOW,
+                    priority: 999,
+                    modes: [ApprovalMode.YOLO],
+                },
+                {
+                    toolName: 'run_shell_command',
+                    decision: PolicyDecision.ASK_USER,
+                    priority: 10,
+                },
+            ];
+            engine = new PolicyEngine({
+                rules,
+                approvalMode: ApprovalMode.YOLO,
+            });
+            // Simulate parsing failure (splitCommands returning empty array)
+            vi.mocked(splitCommands).mockReturnValueOnce([]);
+            const result = await engine.check({ name: 'run_shell_command', args: { command: 'complex command' } }, undefined);
+            expect(result.decision).toBe(PolicyDecision.ALLOW);
+            expect(result.rule).toBeDefined();
+            expect(result.rule?.priority).toBe(999);
+        });
+        it('should return DENY in YOLO mode if shell command parsing fails and a higher priority rule says DENY', async () => {
+            const { splitCommands } = await import('../utils/shell-utils.js');
+            const rules = [
+                {
+                    toolName: 'run_shell_command',
+                    decision: PolicyDecision.DENY,
+                    priority: 2000, // Very high priority DENY (e.g. Admin)
+                },
+                {
+                    decision: PolicyDecision.ALLOW,
+                    priority: 999,
+                    modes: [ApprovalMode.YOLO],
+                },
+            ];
+            engine = new PolicyEngine({
+                rules,
+                approvalMode: ApprovalMode.YOLO,
+            });
+            // Simulate parsing failure
+            vi.mocked(splitCommands).mockReturnValueOnce([]);
+            const result = await engine.check({ name: 'run_shell_command', args: { command: 'complex command' } }, undefined);
+            expect(result.decision).toBe(PolicyDecision.DENY);
+        });
+        it('should return ASK_USER in non-YOLO mode if shell command parsing fails', async () => {
+            const { splitCommands } = await import('../utils/shell-utils.js');
+            const rules = [
+                {
+                    toolName: 'run_shell_command',
+                    decision: PolicyDecision.ALLOW,
+                    priority: 20,
+                },
+            ];
+            engine = new PolicyEngine({
+                rules,
+                approvalMode: ApprovalMode.DEFAULT,
+            });
+            // Simulate parsing failure
+            vi.mocked(splitCommands).mockReturnValueOnce([]);
+            const result = await engine.check({ name: 'run_shell_command', args: { command: 'complex command' } }, undefined);
+            expect(result.decision).toBe(PolicyDecision.ASK_USER);
+            expect(result.rule).toBeDefined();
+            expect(result.rule?.priority).toBe(20);
+        });
     });
     describe('safety checker integration', () => {
         it('should call checker when rule allows and has safety_checker', async () => {
@@ -1190,226 +1446,309 @@ describe('PolicyEngine', () => {
             expect(result.decision).toBe(PolicyDecision.DENY);
         });
     });
-    describe('checkHook', () => {
-        it('should allow hooks by default', async () => {
-            engine = new PolicyEngine({}, mockCheckerRunner);
-            const decision = await engine.checkHook({
-                eventName: 'BeforeTool',
-                hookSource: 'user',
-            });
-            expect(decision).toBe(PolicyDecision.ALLOW);
-        });
-        it('should deny all hooks when allowHooks is false', async () => {
-            engine = new PolicyEngine({ allowHooks: false }, mockCheckerRunner);
-            const decision = await engine.checkHook({
-                eventName: 'BeforeTool',
-                hookSource: 'user',
-            });
-            expect(decision).toBe(PolicyDecision.DENY);
-        });
-        it('should deny project hooks in untrusted folders', async () => {
-            engine = new PolicyEngine({}, mockCheckerRunner);
-            const decision = await engine.checkHook({
-                eventName: 'BeforeTool',
-                hookSource: 'project',
-                trustedFolder: false,
-            });
-            expect(decision).toBe(PolicyDecision.DENY);
-        });
-        it('should allow project hooks in trusted folders', async () => {
-            engine = new PolicyEngine({}, mockCheckerRunner);
-            const decision = await engine.checkHook({
-                eventName: 'BeforeTool',
-                hookSource: 'project',
-                trustedFolder: true,
-            });
-            expect(decision).toBe(PolicyDecision.ALLOW);
-        });
-        it('should allow user hooks in untrusted folders', async () => {
-            engine = new PolicyEngine({}, mockCheckerRunner);
-            const decision = await engine.checkHook({
-                eventName: 'BeforeTool',
-                hookSource: 'user',
-                trustedFolder: false,
-            });
-            expect(decision).toBe(PolicyDecision.ALLOW);
-        });
-        it('should run hook checkers and deny on DENY decision', async () => {
-            const hookCheckers = [
-                {
-                    eventName: 'BeforeTool',
-                    checker: { type: 'external', name: 'test-hook-checker' },
-                },
-            ];
-            engine = new PolicyEngine({ hookCheckers }, mockCheckerRunner);
-            vi.mocked(mockCheckerRunner.runChecker).mockResolvedValue({
-                decision: SafetyCheckDecision.DENY,
-                reason: 'Hook checker denied',
-            });
-            const decision = await engine.checkHook({
-                eventName: 'BeforeTool',
-                hookSource: 'user',
-            });
-            expect(decision).toBe(PolicyDecision.DENY);
-            expect(mockCheckerRunner.runChecker).toHaveBeenCalledWith(expect.objectContaining({ name: 'hook:BeforeTool' }), expect.objectContaining({ name: 'test-hook-checker' }));
-        });
-        it('should run hook checkers and allow on ALLOW decision', async () => {
-            const hookCheckers = [
-                {
-                    eventName: 'BeforeTool',
-                    checker: { type: 'external', name: 'test-hook-checker' },
-                },
-            ];
-            engine = new PolicyEngine({ hookCheckers }, mockCheckerRunner);
-            vi.mocked(mockCheckerRunner.runChecker).mockResolvedValue({
-                decision: SafetyCheckDecision.ALLOW,
-            });
-            const decision = await engine.checkHook({
-                eventName: 'BeforeTool',
-                hookSource: 'user',
-            });
-            expect(decision).toBe(PolicyDecision.ALLOW);
-        });
-        it('should return ASK_USER when checker requests it', async () => {
-            const hookCheckers = [
-                {
-                    checker: { type: 'external', name: 'test-hook-checker' },
-                },
-            ];
-            engine = new PolicyEngine({ hookCheckers }, mockCheckerRunner);
-            vi.mocked(mockCheckerRunner.runChecker).mockResolvedValue({
-                decision: SafetyCheckDecision.ASK_USER,
-                reason: 'Needs confirmation',
-            });
-            const decision = await engine.checkHook({
-                eventName: 'BeforeTool',
-                hookSource: 'user',
-            });
-            expect(decision).toBe(PolicyDecision.ASK_USER);
-        });
-        it('should return DENY for ASK_USER in non-interactive mode', async () => {
-            const hookCheckers = [
-                {
-                    checker: { type: 'external', name: 'test-hook-checker' },
-                },
-            ];
-            engine = new PolicyEngine({ hookCheckers, nonInteractive: true }, mockCheckerRunner);
-            vi.mocked(mockCheckerRunner.runChecker).mockResolvedValue({
-                decision: SafetyCheckDecision.ASK_USER,
-                reason: 'Needs confirmation',
-            });
-            const decision = await engine.checkHook({
-                eventName: 'BeforeTool',
-                hookSource: 'user',
+    describe('getExcludedTools', () => {
+        const testCases = [
+            {
+                name: 'should return empty set when no rules provided',
+                rules: [],
+                expected: [],
+            },
+            {
+                name: 'should apply rules without explicit modes to all modes',
+                rules: [{ toolName: 'tool1', decision: PolicyDecision.DENY }],
+                expected: ['tool1'],
+            },
+            {
+                name: 'should NOT exclude tool if higher priority argsPattern rule exists',
+                rules: [
+                    {
+                        toolName: 'tool1',
+                        decision: PolicyDecision.ALLOW,
+                        argsPattern: /safe/,
+                        priority: 100,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                    {
+                        toolName: 'tool1',
+                        decision: PolicyDecision.DENY,
+                        priority: 10,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                ],
+                expected: [],
+            },
+            {
+                name: 'should include tools with DENY decision',
+                rules: [
+                    {
+                        toolName: 'tool1',
+                        decision: PolicyDecision.DENY,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                    {
+                        toolName: 'tool2',
+                        decision: PolicyDecision.ALLOW,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                ],
+                expected: ['tool1'],
+            },
+            {
+                name: 'should respect priority and ignore lower priority rules (DENY wins)',
+                rules: [
+                    {
+                        toolName: 'tool1',
+                        decision: PolicyDecision.DENY,
+                        priority: 100,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                    {
+                        toolName: 'tool1',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 10,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                ],
+                expected: ['tool1'],
+            },
+            {
+                name: 'should respect priority and ignore lower priority rules (ALLOW wins)',
+                rules: [
+                    {
+                        toolName: 'tool1',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 100,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                    {
+                        toolName: 'tool1',
+                        decision: PolicyDecision.DENY,
+                        priority: 10,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                ],
+                expected: [],
+            },
+            {
+                name: 'should NOT include ASK_USER tools even in non-interactive mode',
+                rules: [
+                    {
+                        toolName: 'tool1',
+                        decision: PolicyDecision.ASK_USER,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                ],
+                nonInteractive: true,
+                expected: [],
+            },
+            {
+                name: 'should ignore rules with argsPattern',
+                rules: [
+                    {
+                        toolName: 'tool1',
+                        decision: PolicyDecision.DENY,
+                        argsPattern: /something/,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                ],
+                expected: [],
+            },
+            {
+                name: 'should respect approval mode (PLAN mode)',
+                rules: [
+                    {
+                        toolName: 'tool1',
+                        decision: PolicyDecision.DENY,
+                        modes: [ApprovalMode.PLAN],
+                    },
+                ],
+                approvalMode: ApprovalMode.PLAN,
+                expected: ['tool1'],
+            },
+            {
+                name: 'should respect approval mode (DEFAULT mode)',
+                rules: [
+                    {
+                        toolName: 'tool1',
+                        decision: PolicyDecision.DENY,
+                        modes: [ApprovalMode.PLAN],
+                    },
+                ],
+                approvalMode: ApprovalMode.DEFAULT,
+                expected: [],
+            },
+            {
+                name: 'should respect wildcard ALLOW rules (e.g. YOLO mode)',
+                rules: [
+                    {
+                        decision: PolicyDecision.ALLOW,
+                        priority: 999,
+                        modes: [ApprovalMode.YOLO],
+                    },
+                    {
+                        toolName: 'dangerous-tool',
+                        decision: PolicyDecision.DENY,
+                        priority: 10,
+                        modes: [ApprovalMode.YOLO],
+                    },
+                ],
+                approvalMode: ApprovalMode.YOLO,
+                expected: [],
+            },
+            {
+                name: 'should respect server wildcard DENY',
+                rules: [
+                    {
+                        toolName: 'server__*',
+                        decision: PolicyDecision.DENY,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                ],
+                expected: ['server__*'],
+            },
+            {
+                name: 'should expand server wildcard for specific tools if already processed',
+                rules: [
+                    {
+                        toolName: 'server__*',
+                        decision: PolicyDecision.DENY,
+                        priority: 100,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                    {
+                        toolName: 'server__tool1',
+                        decision: PolicyDecision.DENY,
+                        priority: 10,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                ],
+                expected: ['server__*', 'server__tool1'],
+            },
+            {
+                name: 'should exclude run_shell_command but NOT write_file in simulated Plan Mode',
+                approvalMode: ApprovalMode.PLAN,
+                rules: [
+                    {
+                        // Simulates the high-priority allow for plans directory
+                        toolName: 'write_file',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 70,
+                        argsPattern: /plans/,
+                        modes: [ApprovalMode.PLAN],
+                    },
+                    {
+                        // Simulates the global deny in Plan Mode
+                        decision: PolicyDecision.DENY,
+                        priority: 60,
+                        modes: [ApprovalMode.PLAN],
+                    },
+                    {
+                        // Simulates a tool from another policy (e.g. write.toml)
+                        toolName: 'run_shell_command',
+                        decision: PolicyDecision.ASK_USER,
+                        priority: 10,
+                    },
+                ],
+                expected: ['run_shell_command'],
+            },
+            {
+                name: 'should NOT exclude tool if covered by a higher priority wildcard ALLOW',
+                rules: [
+                    {
+                        toolName: 'server__*',
+                        decision: PolicyDecision.ALLOW,
+                        priority: 100,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                    {
+                        toolName: 'server__tool1',
+                        decision: PolicyDecision.DENY,
+                        priority: 10,
+                        modes: [ApprovalMode.DEFAULT],
+                    },
+                ],
+                expected: [],
+            },
+        ];
+        it.each(testCases)('$name', ({ rules, approvalMode, nonInteractive, expected }) => {
+            engine = new PolicyEngine({
+                rules,
+                approvalMode: approvalMode ?? ApprovalMode.DEFAULT,
+                nonInteractive: nonInteractive ?? false,
             });
-            expect(decision).toBe(PolicyDecision.DENY);
+            const excluded = engine.getExcludedTools();
+            expect(Array.from(excluded).sort()).toEqual(expected.sort());
         });
-        it('should match hook checkers by eventName', async () => {
-            const hookCheckers = [
+    });
+    describe('YOLO mode with ask_user tool', () => {
+        it('should return ASK_USER for ask_user tool even in YOLO mode', async () => {
+            const rules = [
                 {
-                    eventName: 'AfterTool',
-                    checker: { type: 'external', name: 'after-tool-checker' },
+                    toolName: 'ask_user',
+                    decision: PolicyDecision.ASK_USER,
+                    priority: 999,
+                    modes: [ApprovalMode.YOLO],
                 },
                 {
-                    eventName: 'BeforeTool',
-                    checker: { type: 'external', name: 'before-tool-checker' },
+                    decision: PolicyDecision.ALLOW,
+                    priority: 998,
+                    modes: [ApprovalMode.YOLO],
                 },
             ];
-            engine = new PolicyEngine({ hookCheckers }, mockCheckerRunner);
-            vi.mocked(mockCheckerRunner.runChecker).mockResolvedValue({
-                decision: SafetyCheckDecision.ALLOW,
-            });
-            await engine.checkHook({
-                eventName: 'BeforeTool',
-                hookSource: 'user',
+            engine = new PolicyEngine({
+                rules,
+                approvalMode: ApprovalMode.YOLO,
             });
-            expect(mockCheckerRunner.runChecker).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ name: 'before-tool-checker' }));
-            expect(mockCheckerRunner.runChecker).not.toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ name: 'after-tool-checker' }));
+            const result = await engine.check({ name: 'ask_user', args: {} }, undefined);
+            expect(result.decision).toBe(PolicyDecision.ASK_USER);
         });
-        it('should match hook checkers by hookSource', async () => {
-            const hookCheckers = [
-                {
-                    hookSource: 'project',
-                    checker: { type: 'external', name: 'project-checker' },
-                },
+        it('should return ALLOW for other tools in YOLO mode', async () => {
+            const rules = [
                 {
-                    hookSource: 'user',
-                    checker: { type: 'external', name: 'user-checker' },
+                    toolName: 'ask_user',
+                    decision: PolicyDecision.ASK_USER,
+                    priority: 999,
+                    modes: [ApprovalMode.YOLO],
                 },
-            ];
-            engine = new PolicyEngine({ hookCheckers }, mockCheckerRunner);
-            vi.mocked(mockCheckerRunner.runChecker).mockResolvedValue({
-                decision: SafetyCheckDecision.ALLOW,
-            });
-            await engine.checkHook({
-                eventName: 'BeforeTool',
-                hookSource: 'user',
-            });
-            expect(mockCheckerRunner.runChecker).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ name: 'user-checker' }));
-            expect(mockCheckerRunner.runChecker).not.toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ name: 'project-checker' }));
-        });
-        it('should deny when hook checker throws an error', async () => {
-            const hookCheckers = [
                 {
-                    checker: { type: 'external', name: 'failing-checker' },
+                    decision: PolicyDecision.ALLOW,
+                    priority: 998,
+                    modes: [ApprovalMode.YOLO],
                 },
             ];
-            engine = new PolicyEngine({ hookCheckers }, mockCheckerRunner);
-            vi.mocked(mockCheckerRunner.runChecker).mockRejectedValue(new Error('Checker failed'));
-            const decision = await engine.checkHook({
-                eventName: 'BeforeTool',
-                hookSource: 'user',
+            engine = new PolicyEngine({
+                rules,
+                approvalMode: ApprovalMode.YOLO,
             });
-            expect(decision).toBe(PolicyDecision.DENY);
+            const result = await engine.check({ name: 'run_shell_command', args: { command: 'ls' } }, undefined);
+            expect(result.decision).toBe(PolicyDecision.ALLOW);
         });
-        it('should run hook checkers in priority order', async () => {
-            const hookCheckers = [
-                {
-                    priority: 5,
-                    checker: { type: 'external', name: 'low-priority' },
-                },
+    });
+    describe('Plan Mode', () => {
+        it('should allow activate_skill but deny shell commands in Plan Mode', async () => {
+            const rules = [
                 {
-                    priority: 20,
-                    checker: { type: 'external', name: 'high-priority' },
+                    decision: PolicyDecision.DENY,
+                    priority: 60,
+                    modes: [ApprovalMode.PLAN],
+                    denyMessage: 'You are in Plan Mode with access to read-only tools. Execution of scripts (including those from skills) is blocked.',
                 },
                 {
-                    priority: 10,
-                    checker: { type: 'external', name: 'medium-priority' },
+                    toolName: 'activate_skill',
+                    decision: PolicyDecision.ALLOW,
+                    priority: 70,
+                    modes: [ApprovalMode.PLAN],
                 },
             ];
-            engine = new PolicyEngine({ hookCheckers }, mockCheckerRunner);
-            vi.mocked(mockCheckerRunner.runChecker).mockImplementation(async (_call, config) => {
-                if (config.name === 'high-priority') {
-                    return { decision: SafetyCheckDecision.DENY, reason: 'denied' };
-                }
-                return { decision: SafetyCheckDecision.ALLOW };
-            });
-            await engine.checkHook({
-                eventName: 'BeforeTool',
-                hookSource: 'user',
+            engine = new PolicyEngine({
+                rules,
+                approvalMode: ApprovalMode.PLAN,
             });
-            // Should only call the high-priority checker (first in sorted order)
-            expect(mockCheckerRunner.runChecker).toHaveBeenCalledTimes(1);
-            expect(mockCheckerRunner.runChecker).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ name: 'high-priority' }));
-        });
-    });
-    describe('addHookChecker', () => {
-        it('should add a new hook checker and maintain priority order', () => {
-            engine = new PolicyEngine({}, mockCheckerRunner);
-            engine.addHookChecker({
-                priority: 5,
-                checker: { type: 'external', name: 'checker1' },
-            });
-            engine.addHookChecker({
-                priority: 10,
-                checker: { type: 'external', name: 'checker2' },
-            });
-            const checkers = engine.getHookCheckers();
-            expect(checkers).toHaveLength(2);
-            expect(checkers[0].priority).toBe(10);
-            expect(checkers[0].checker.name).toBe('checker2');
-            expect(checkers[1].priority).toBe(5);
-            expect(checkers[1].checker.name).toBe('checker1');
+            const skillResult = await engine.check({ name: 'activate_skill', args: { name: 'test' } }, undefined);
+            expect(skillResult.decision).toBe(PolicyDecision.ALLOW);
+            const shellResult = await engine.check({ name: 'run_shell_command', args: { command: 'ls' } }, undefined);
+            expect(shellResult.decision).toBe(PolicyDecision.DENY);
+            expect(shellResult.rule?.denyMessage).toContain('Execution of scripts (including those from skills) is blocked');
         });
     });
 });