fix(cli): defer tool exclusions to policy engine in non-interactive mode

[EricRahm]

Summary

Removes the hardcoded extraExcludes logic from the CLI configuration layer that was incorrectly overriding high-priority Policy Engine 'allow' rules in non-interactive mode.

Details

The Policy Engine now serves as the single source of truth for tool availability, relying on its native ASK_USER to DENY translation to ensure headless safety.

Verifies that the Policy Engine correctly downgrades ASK_USER tools to DENY in headless (non-interactive) mode when no custom policy is present. Also ensures that explicit ALLOW policies defined in .toml files can override this behavior.

Related Issues

Fixes #20469

How to Validate

npm run test -- packages/cli/src/config/config.test.ts
npm run test:e2e -- integration-tests/policy-headless.test.ts

Pre-Merge Checklist

• Updated relevant documentation and README (if needed)
• Added/updated tests (if needed)
• Noted breaking changes (if any)
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt
  • Windows
    • npm run
    • npx
    • Docker
  • Linux
    • npm run
    • npx
    • Docker

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refactors the CLI's tool exclusion mechanism in non-interactive (headless) mode. Previously, certain tools were hardcoded for exclusion, which could incorrectly override explicit 'allow' rules defined by the Policy Engine. The changes centralize tool availability decisions within the Policy Engine, making it the definitive source of truth. This ensures that the CLI behaves predictably in headless environments, automatically denying tools requiring user interaction unless explicitly permitted by a policy, thereby preventing hangs and improving security.

Highlights

• Policy Engine Centralization: Removed hardcoded extraExcludes logic from the CLI configuration layer, making the Policy Engine the single source of truth for tool availability in non-interactive mode.
• Headless Mode Safety: Ensured the Policy Engine correctly translates ASK_USER decisions to DENY in headless (non-interactive) mode by default, preventing the CLI from hanging due to tools requiring user interaction.
• Policy Overrides: Verified that explicit ALLOW policies defined in .toml files can successfully override the default headless denial behavior for tools.
• New Integration Tests: Added comprehensive integration tests to validate the Policy Engine's behavior in headless mode, covering default denials, explicit allowances for shell commands, and read-only tools.

Changelog

• integration-tests/policy-headless-readonly.responses
  • Added model responses for testing read-only tool behavior in headless mode.
• integration-tests/policy-headless-shell-allowed.responses
  • Added model responses for testing allowed shell commands in headless mode.
• integration-tests/policy-headless-shell-denied.responses
  • Added model responses for testing denied shell commands in headless mode.
• integration-tests/policy-headless.test.ts
  • Added comprehensive integration tests to verify the Policy Engine's tool exclusion logic in non-interactive mode, covering default denials and explicit allowances.
• packages/cli/src/config/config.test.ts
  • Updated existing tests to remove assertions related to the old hardcoded tool exclusion logic.
  • Added new expectations aligned with Policy Engine control over tool exclusions.
• packages/cli/src/config/config.ts
  • Removed the createToolExclusionFilter function and associated hardcoded defaultExcludes logic.
  • Streamlined tool exclusion to rely solely on the Policy Engine's decisions.
  • Explicitly blocked ASK_USER_TOOL_NAME in non-interactive mode to guarantee it can never be allowed when no human is present.

Activity

• EricRahm created the pull request to address an issue where hardcoded tool exclusions in the CLI were overriding Policy Engine rules in non-interactive mode.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request refactors the tool exclusion logic for non-interactive mode. It removes the hardcoded extraExcludes from the CLI configuration and delegates the responsibility of handling tool availability to the Policy Engine. This allows high-priority allow rules in the Policy Engine to correctly override default behaviors in headless mode. The change is supported by updates to unit tests and the addition of a new integration test suite that validates the new policy-driven behavior in various headless scenarios.