From 173376ba67600499bccd57dbc79b94f7706c9db3 Mon Sep 17 00:00:00 2001
From: Adib234 <30782825+Adib234@users.noreply.github.com>
Date: Thu, 5 Mar 2026 08:20:04 -0500
Subject: [PATCH] fix(core): explicitly allow codebase_investigator and
 cli_help in read-only mode (#21157)

---
 packages/core/src/policy/policies/read-only.toml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/packages/core/src/policy/policies/read-only.toml b/packages/core/src/policy/policies/read-only.toml
index c9c96923e7..ad996864b2 100644
--- a/packages/core/src/policy/policies/read-only.toml
+++ b/packages/core/src/policy/policies/read-only.toml
@@ -51,3 +51,8 @@ priority = 50
 toolName = "google_web_search"
 decision = "allow"
 priority = 50
+
+[[rule]]
+toolName = ["codebase_investigator", "cli_help"]
+decision = "allow"
+priority = 50
\ No newline at end of file