Skip to content

fix(core): simplify plan mode write policy to support relative paths #28398

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DavidAPierce merged 3 commits into from
Jul 13, 2026
Merged

fix(core): simplify plan mode write policy to support relative paths #28398

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9f6a2d4
fix(core): simplify plan mode write policy to support relative paths
DavidAPierce Jul 13, 2026
c715ced
fix(core): enhance plan mode policy with defense-in-depth path valida…
DavidAPierce Jul 13, 2026
a2e7320
fix(core): split plan mode write regexes to prevent potential ReDoS
DavidAPierce Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 73 additions & 6 deletions packages/core/src/policy/policies/plan.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,23 +109,90 @@ priority = 50
modes = ["plan"]
interactive = true

# Allow write_file and replace for .md files in the plans directory (cross-platform)
# We split this into two rules to avoid ReDoS checker issues with nested optional segments.
# This rule handles the case where there is a session ID in the plan file path
# Allow write_file and replace for .md files in the plans directory (cross-platform).
# This rule employs split, traversal-safe, and ReDoS-safe patterns to provide defense-in-depth:
# - Absolute paths must strictly be inside the designated plans directory under `.gemini/tmp/`
# - Relative paths must be clean (no path traversal `..` and no absolute prefixes)

# 1. Absolute paths with session ID
[[rule]]
toolName = ["write_file", "replace"]
decision = "allow"
priority = 70
modes = ["plan"]
argsPattern = "\\x00\"file_path\":\"[^\\\"]+[\\\\/]+\\.gemini[\\\\/]+tmp[\\\\/]+[\\w-]+[\\\\/]+[\\w-]+[\\\\/]+plans[\\\\/]+[\\w-]+\\.md\"\\x00"

# 2. Absolute paths without session ID
[[rule]]
toolName = ["write_file", "replace"]
decision = "allow"
priority = 70
modes = ["plan"]
argsPattern = "\\x00\"file_path\":\"[^\\\"]+[\\\\/]+\\.gemini[\\\\/]+tmp[\\\\/]+[\\w-]+[\\\\/]+plans[\\\\/]+[\\w-]+\\.md\"\\x00"

# 3. Relative paths starting with .gemini (with session ID)
[[rule]]
toolName = ["write_file", "replace"]
decision = "allow"
priority = 70
modes = ["plan"]
argsPattern = "\\x00\"file_path\":\"\\.gemini[\\\\/]+tmp[\\\\/]+[\\w-]+[\\\\/]+[\\w-]+[\\\\/]+plans[\\\\/]+[\\w-]+\\.md\"\\x00"

# 4. Relative paths starting with .gemini (without session ID)
[[rule]]
toolName = ["write_file", "replace"]
decision = "allow"
priority = 70
modes = ["plan"]
argsPattern = "\\x00\"file_path\":\"\\.gemini[\\\\/]+tmp[\\\\/]+[\\w-]+[\\\\/]+plans[\\\\/]+[\\w-]+\\.md\"\\x00"

# 5. Relative paths starting with ./.gemini (with session ID)
[[rule]]
toolName = ["write_file", "replace"]
decision = "allow"
priority = 70
modes = ["plan"]
argsPattern = "\\x00\"file_path\":\"\\.[\\\\/]+\\.gemini[\\\\/]+tmp[\\\\/]+[\\w-]+[\\\\/]+[\\w-]+[\\\\/]+plans[\\\\/]+[\\w-]+\\.md\"\\x00"

# 6. Relative paths starting with ./.gemini (without session ID)
[[rule]]
toolName = ["write_file", "replace"]
decision = "allow"
priority = 70
modes = ["plan"]
argsPattern = "\\x00\"file_path\":\"\\.[\\\\/]+\\.gemini[\\\\/]+tmp[\\\\/]+[\\w-]+[\\\\/]+plans[\\\\/]+[\\w-]+\\.md\"\\x00"

# 7. Clean relative filename (no directories, e.g. plan.md)
[[rule]]
toolName = ["write_file", "replace"]
decision = "allow"
priority = 70
modes = ["plan"]
argsPattern = "\\x00\"file_path\":\"[\\w-]+\\.md\"\\x00"

# 8. Clean relative path starting with ./ (no directories, e.g. ./plan.md)
[[rule]]
toolName = ["write_file", "replace"]
decision = "allow"
priority = 70
modes = ["plan"]
argsPattern = "\\x00\"file_path\":\"\\.[\\\\/]+[\\w-]+\\.md\"\\x00"

# 9. Clean relative path under plans directory (e.g. plans/plan.md)
[[rule]]
toolName = ["write_file", "replace"]
decision = "allow"
priority = 70
modes = ["plan"]
argsPattern = "\\x00\"file_path\":\"[^\"]+[\\\\/]+\\.gemini[\\\\/]+tmp[\\\\/]+[\\w-]+[\\\\/]+[\\w-]+[\\\\/]+plans[\\\\/]+[\\w-]+\\.md\"\\x00"
argsPattern = "\\x00\"file_path\":\"plans[\\\\/]+[\\w-]+\\.md\"\\x00"

# This rule handles the case where there isn't a session ID in the plan file path
# 10. Clean relative path under plans directory starting with ./ (e.g. ./plans/plan.md)
[[rule]]
toolName = ["write_file", "replace"]
decision = "allow"
priority = 70
modes = ["plan"]
argsPattern = "\\x00\"file_path\":\"[^\"]+[\\\\/]+\\.gemini[\\\\/]+tmp[\\\\/]+[\\w-]+[\\\\/]+plans[\\\\/]+[\\w-]+\\.md\"\\x00"
argsPattern = "\\x00\"file_path\":\"\\.[\\\\/]+plans[\\\\/]+[\\w-]+\\.md\"\\x00"

# Explicitly Deny other write operations in Plan mode with a clear message.
[[rule]]
Expand Down
Loading