refactor(plan): simplify policy priorities and consolidate read-only rules#24849
refactor(plan): simplify policy priorities and consolidate read-only rules#24849
Conversation
|
Hi @ruomengz, thank you so much for your contribution to Gemini CLI! We really appreciate the time and effort you've put into this. We're making some updates to our contribution process to improve how we track and review changes. Please take a moment to review our recent discussion post: Improving Our Contribution Process & Introducing New Guidelines. Key Update: Starting January 26, 2026, the Gemini CLI project will require all pull requests to be associated with an existing issue. Any pull requests not linked to an issue by that date will be automatically closed. Thank you for your understanding and for being a part of our community! |
|
Size Change: -4 B (0%) Total Size: 34 MB
ℹ️ View Unchanged
|
gemini-cli
bot
added
area/core
ruomengz
force-pushed
the
feat/24769-consolidate-plan-rules
branch
from
c437694 to
df327e2
Compare
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request refactors the policy engine's priority management, specifically for Plan Mode and read-only tools. The changes aim to simplify policy configuration and reduce redundancy by consolidating rules and adjusting priorities. This ensures that Plan Mode correctly blocks subagents while still allowing necessary read-only operations, leading to a more streamlined and maintainable policy system. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the policy engine configuration to refine priority levels for subagents and Plan Mode. Key changes include lowering the priority of subagent tools to 1.03 to ensure they are correctly blocked by Plan Mode (now at priority 40), and consolidating tool definitions in the read-only policy configuration. The review feedback highlights a potential security concern regarding the global allowance of the 'activate_skill' tool in non-interactive environments due to its relocation, and suggests moving it back to the Plan Mode configuration to maintain restricted behavior.
…rules - Lower the plan mode catch-all deny priority from 60 to 40. - Lower dynamic subagent priority from 50 (1.05) to 30 (1.03) to ensure plan mode properly blocks them. - Delete `tracker.toml` and move tracker tools into `read-only.toml`. - Remove redundant explicit allow rules from `plan.toml`, relying on `read-only.toml` (priority 50) to naturally override the plan mode deny (priority 40). - Consolidate tool allowlists in `read-only.toml` into a single rule array for brevity.
ruomengz
force-pushed
the
feat/24769-consolidate-plan-rules
branch
from
df327e2 to
3a6d0c6
Compare
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request refactors the policy engine's priority system, lowering the base priorities for subagent tools, Plan Mode's catch-all deny, and read-only tools to ensure correct override behavior. It also consolidates read-only and tracker tool rules into a single configuration file for better maintainability. A review comment suggests removing the 'modes' restriction from the 'exit_plan_mode' rule to maintain its function as a global override and recommends further consolidation of rules sharing identical properties.
2 participants
Summary
Consolidate Plan Mode and Read-Only policies to simplify priority management and reduce redundancy.
Details
read-only.tomlat priority 50.plan.toml, relying onread-only.toml(priority 50) to naturally override the plan mode deny (priority 40).tracker.tomlas its contents are now inread-only.toml.toml-loader.test.tsto includeread-only.tomlin Plan Mode verification tests.Related Issues
Related to #24769
How to Validate
npm test -w @google/gemini-cli-core -- src/policy/policy-engine.test.ts src/policy/toml-loader.test.tsnpm test -w @google/gemini-cli -- src/config/policy-engine.integration.test.tsPre-Merge Checklist