How to run TCL script against ADOM's policy package?

Hi,

On our FortiManager (5.4.1 VM) we have an ADOM defined with several VDOM's, each with its own firewall policy package.

These policy packages have already hundreds of policies. Right now we are in need to update few parameters of every single policy in all policy packages. There is no way we can do this manually in GUI policy by policy.

We could grab the whole configuration of FortiManager or directly the FortiGates in a text form and do a search/replace and then re-apply it. But I don't find this to be the smartest way to change configuration.

I believe the ideal approach is to use a script.

CLI scripts do not make sense because there is no way to use variables, loops, if/else statements etc. in a CLI script.

So I turned my attention to TCL scripts. I have enabled them for FortiManager.

I am actually able to write a TCL script which should do exactly what I need the script to do. There are nice examples in the administration guide or here in the forum. 

My problem is how to execute such TCL script against particular policy package.

When I go to "Device Manager" -> "Scripts" and create a new TCL script, the only target I can choose is "Remote FortiGate Directly (via CLI)". Somehow the option to run it against "Policy Package, ADOM database" is missing (is available for CLI scripts). 

I am a bit afraid of this "Remote FortiGate Directly" option, as it sounds like bypassing FortiManager's database and bringing FortiGate and FortiManager out of sync by executing the TCL script in this way.

I would like to run the following script:

#!
proc do_cmd {cmd} {
        puts [exec "$cmd\n" "# "]
}
 
foreach line [split [exec "show firewall policy\n" "# "] \n] {
        if {[regexp {edit[ ]+([0-9]+)} $line match policyid]} {
                continue
        } elseif {[regexp {set[ ]+(\w+)[ ]+(.*)\r} $line match key value]} {
                lappend fw_policy($policyid) "$key $value"
        }
}
 
do_cmd "config firewall policy"
 
foreach policyid [array names fw_policy] {
        do_cmd "edit $policyid"
        do_cmd "set comments comment_string_here"
        do_cmd "next"
}
 
do_cmd "end"

So how can I run this TCL script on FortiManager against a Policy Package, when there is no such option in the script settings? 

Thank you in advance for any hints.

Martin