@unity-china/codely-cli 1.0.0-alpha.1 → 1.0.0-alpha.3

package/bundle/policies/plan.toml

@@ -1,17 +1,29 @@
-# Plan Mode policy: deny-all + read-only whitelist + plans dir write exception.
+# Plan Mode policy: default-ask + explicit allow for exploration/planning tools.
 # Active only when ApprovalMode = "plan".
 #
+# Design:
+# - No blanket deny-all: tools default to ASK_USER (interactive) or ALLOW (non-interactive).
+# - Explicit ALLOW for exploration/planning tools (including shell).
+# - Conditional ALLOW for write_file/replace (plans directory only).
+#
 # Priority bands (tiers):
 # - Default policies (TOML): 1 + priority/1000
-#   60: Catch-all deny for plan mode (becomes 1.060)
-#   70: Explicit allows for plan mode (becomes 1.070, overrides deny)
+#   70: Explicit allows and ask rules for plan mode (becomes 1.070, overrides deny)
+#
+# Non-interactive plan mode:
+#   The PolicyEngine converts ASK_USER → DENY for non-interactive sessions.
+#   When entering plan mode in non-interactive, Config.setApprovalMode()
+#   sets the PolicyEngine default decision to ALLOW, so tools without
+#   explicit rules are available by default.
 
-# --- Catch-all deny for plan mode ---
+# --- Explicit allows for plan mode ---
 [[rule]]
-decision = "deny"
-priority = 60
+toolName = "run_shell_command"
+decision = "allow"
+priority = 70
 modes = ["plan"]
-deny_message = "You are in Plan Mode. Only read/search tools and writing plans to the plans directory are allowed. Use exit_plan_mode to request approval for your plan."
+allow_redirection = true
+allow_command_substitution = true
 
 # --- Read-only tools allowed in plan mode ---
 [[rule]]
@@ -39,7 +51,7 @@ priority = 70
 modes = ["plan"]
 
 [[rule]]
-toolName = "read_many_files"
+toolName = "analyze_multimedia"
 decision = "allow"
 priority = 70
 modes = ["plan"]
@@ -50,12 +62,6 @@ decision = "allow"
 priority = 70
 modes = ["plan"]
 
-[[rule]]
-toolName = "sequential_thinking"
-decision = "allow"
-priority = 70
-modes = ["plan"]
-
 [[rule]]
 toolName = "job_create"
 decision = "allow"
@@ -91,6 +97,14 @@ priority = 70
 modes = ["plan"]
 argsPattern = "\"file_path\"\\s*:\\s*\"[^\"]*[/\\\\]+\\.codely-cli[/\\\\]+tmp[/\\\\]+[a-f0-9]{64}[/\\\\]+plans[/\\\\]+[a-zA-Z0-9_\\-][a-zA-Z0-9_\\-.]*\\.md\""
 
+# write_file outside the plans directory requires approval (interactive)
+# or is denied (non-interactive via ask-downgrade)
+[[rule]]
+toolName = "write_file"
+decision = "ask_user"
+priority = 65
+modes = ["plan"]
+
 [[rule]]
 toolName = "replace"
 decision = "allow"
@@ -98,6 +112,14 @@ priority = 70
 modes = ["plan"]
 argsPattern = "\"file_path\"\\s*:\\s*\"[^\"]*[/\\\\]+\\.codely-cli[/\\\\]+tmp[/\\\\]+[a-f0-9]{64}[/\\\\]+plans[/\\\\]+[a-zA-Z0-9_\\-][a-zA-Z0-9_\\-.]*\\.md\""
 
+# replace outside the plans directory requires approval (interactive)
+# or is denied (non-interactive via ask-downgrade)
+[[rule]]
+toolName = "replace"
+decision = "ask_user"
+priority = 65
+modes = ["plan"]
+
 # --- exit_plan_mode requires user approval ---
 [[rule]]
 toolName = "exit_plan_mode"

package/bundle/policies/read-only.toml

@@ -26,21 +26,11 @@ toolName = "read_file"
 decision = "allow"
 priority = 50
 
-[[rule]]
-toolName = "read_many_files"
-decision = "allow"
-priority = 50
-
 [[rule]]
 toolName = "web_search"
 decision = "allow"
 priority = 50
 
-[[rule]]
-toolName = "sequential_thinking"
-decision = "allow"
-priority = 50
-
 [[rule]]
 toolName = "analyze_multimedia"
 decision = "allow"

package/bundle/policies/write.toml

@@ -33,11 +33,6 @@ toolName = "run_shell_command"
 decision = "ask_user"
 priority = 10
 
-[[rule]]
-toolName = "save_memory"
-decision = "ask_user"
-priority = 10
-
 [[rule]]
 toolName = "activate_skill"
 decision = "ask_user"