From d274efe37a73a3ab8f8f3e60d17f2f26d1cb49a1 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Fri, 27 Feb 2026 08:54:19 -0800
Subject: [PATCH] agents: share tool policy enforcement helpers

---
 src/agents/tool-policy-shared.ts | 92 ++++++++++++++++++++++++++++----
 1 file changed, 83 insertions(+), 9 deletions(-)

diff --git a/src/agents/tool-policy-shared.ts b/src/agents/tool-policy-shared.ts
index e28c623de445..d15d3c96135c 100644
--- a/src/agents/tool-policy-shared.ts
+++ b/src/agents/tool-policy-shared.ts
@@ -1,8 +1,4 @@
-import {
-  CORE_TOOL_GROUPS,
-  resolveCoreToolProfilePolicy,
-  type ToolProfileId,
-} from "./tool-catalog.js";
+export type ToolProfileId = "minimal" | "coding" | "messaging" | "full";
 
 type ToolProfilePolicy = {
   allow?: string[];
@@ -14,7 +10,74 @@ const TOOL_NAME_ALIASES: Record<string, string> = {
   "apply-patch": "apply_patch",
 };
 
-export const TOOL_GROUPS: Record<string, string[]> = { ...CORE_TOOL_GROUPS };
+export const TOOL_GROUPS: Record<string, string[]> = {
+  // NOTE: Keep canonical (lowercase) tool names here.
+  "group:memory": ["memory_search", "memory_get"],
+  "group:web": ["web_search", "web_fetch"],
+  // Basic workspace/file tools
+  "group:fs": ["read", "write", "edit", "apply_patch"],
+  // Host/runtime execution tools
+  "group:runtime": ["exec", "process"],
+  // Session management tools
+  "group:sessions": [
+    "sessions_list",
+    "sessions_history",
+    "sessions_send",
+    "sessions_spawn",
+    "subagents",
+    "session_status",
+  ],
+  // UI helpers
+  "group:ui": ["browser", "canvas"],
+  // Automation + infra
+  "group:automation": ["cron", "gateway"],
+  // Messaging surface
+  "group:messaging": ["message"],
+  // Scheduled execution
+  "group:scheduling": ["cron"],
+  // Nodes + device tools
+  "group:nodes": ["nodes"],
+  // All OpenClaw native tools (excludes provider plugins).
+  "group:openclaw": [
+    "browser",
+    "canvas",
+    "nodes",
+    "cron",
+    "message",
+    "gateway",
+    "agents_list",
+    "sessions_list",
+    "sessions_history",
+    "sessions_send",
+    "sessions_spawn",
+    "subagents",
+    "session_status",
+    "memory_search",
+    "memory_get",
+    "web_search",
+    "web_fetch",
+    "image",
+  ],
+};
+
+const TOOL_PROFILES: Record<ToolProfileId, ToolProfilePolicy> = {
+  minimal: {
+    allow: ["session_status"],
+  },
+  coding: {
+    allow: ["group:fs", "group:runtime", "group:sessions", "group:memory", "image"],
+  },
+  messaging: {
+    allow: [
+      "group:messaging",
+      "sessions_list",
+      "sessions_history",
+      "sessions_send",
+      "session_status",
+    ],
+  },
+  full: {},
+};
 
 export function normalizeToolName(name: string) {
   const normalized = name.trim().toLowerCase();
@@ -43,7 +106,18 @@ export function expandToolGroups(list?: string[]) {
 }
 
 export function resolveToolProfilePolicy(profile?: string): ToolProfilePolicy | undefined {
-  return resolveCoreToolProfilePolicy(profile);
+  if (!profile) {
+    return undefined;
+  }
+  const resolved = TOOL_PROFILES[profile as ToolProfileId];
+  if (!resolved) {
+    return undefined;
+  }
+  if (!resolved.allow && !resolved.deny) {
+    return undefined;
+  }
+  return {
+    allow: resolved.allow ? [...resolved.allow] : undefined,
+    deny: resolved.deny ? [...resolved.deny] : undefined,
+  };
 }
-
-export type { ToolProfileId };