bug(core): findUntrustedFlags still breaks YOLO mode on project temp dir paths, workspace .sh scripts, ~/ paths, and lacks a settings toggle (even after #29833) #30004

What happened?

In --yolo mode (--approval-mode=yolo), Gemini CLI repeatedly interrupts autonomous execution with:

⚠️ CRITICAL SECURITY WARNING: Untrusted Command Flags Detected
The following flags/arguments were sourced from external untrusted input (e.g., Buganizer ticket, external document):
  • /Users/<user>/.gemini/tmp/<session>/parse_pr.py
Allow execution of [Shell]?
● 1. Allow once
  2. No, suggest changes (esc)

Even after PR #29672 (in v0.65.0/v0.66.0) and PR #29833 (on main), packages/core/src/utils/untrustedContextTracker.ts and scheduler.ts still cause false positives that break --yolo mode in normal developer workflows:

1. Check 2 (non-flag path arguments) still matches against ALL local run_shell_command output (untrustedTokens / untrustedTexts), not externalTokens, and rejects Gemini CLI's own project temp dir (~/.gemini/tmp/<session>/):

   • When the agent writes a temporary helper script to its own project temp dir (e.g. /Users/<user>/.gemini/tmp/42/parse_pr.py) and runs it via run_shell_command, any output containing that path (such as a Python traceback File "/Users/.../.gemini/tmp/42/parse_pr.py", line 3) is wrapped in <untrusted_context> and indexed into untrustedTokens and untrustedTexts.
   • On the next run (python3 /Users/.../.gemini/tmp/42/parse_pr.py), Check 2 checks isHighRiskPatternToken(token) && !isWorkspaceLocalPath(token, options).
   • Because ~/.gemini/tmp/<session> (and /tmp) is outside WorkspaceContext.isPathWithinWorkspace(), isWorkspaceLocalPath() returns false, and Check 2 checks untrustedContext.untrustedTokens (not externalTokens), flagging the agent's own temp file as untrusted input.

2. isWorkspaceLocalPath() unconditionally rejects .sh scripts and ~ / $VAR paths even inside the workspace:

   EXECUTABLE_SCRIPT_REGEX.test(token) || /[$`~]/.test(token)

   • Running a workspace script like ./scripts/build.sh after it appeared in git status or ls output triggers Untrusted Command Flags Detected because EXECUTABLE_SCRIPT_REGEX forces isWorkspaceLocalPath() to return false.
   • Any path using ~ or $HOME triggers the warning because /[$~]/forcesisWorkspaceLocalPath()to returnfalse`.

3. REMOTE_CONTENT_COMMAND_ROOTS (gh, curl, ssh, wget) tags entire CLI outputs as source="shell_remote" (externalTokens):

   • In standard GitHub / CI workflows (gh pr view, gh api, curl, ssh), every word, branch name, path, and flag in the output is added to externalTokens, causing subsequent shell commands in the same session to trigger false-positive security prompts.

4. No configuration setting in settings.json to disable hasTaintedOrBuildFileRisk override in --yolo mode:

   • scheduler.ts unconditionally overrides decision === "allow" to "ask_user" (or "deny" in headless mode) when hasTaintRisk is true, with no setting (e.g. security.disableUntrustedFlagsCheck or security.allowUntrustedFlagsInYolo) for users who explicitly opt into --yolo.

What did you expect to happen?

1. Check 2 (non-flag path arguments) should only match against externalTokens (or isWorkspaceLocalPath should also trust config.storage.getProjectTempDir() and /tmp for local shell output).
2. Workspace-local scripts (./scripts/*.sh) that only appeared in local shell output (ls, git status, stack traces) should not be flagged as untrusted external input.
3. Provide a settings.json option (e.g., security.enableUntrustedFlagsCheck: false) so users running in --yolo mode can disable the taint-check override without having to monkey-patch findUntrustedFlags in bundle/chunk-*.js on every update.

Client information

• CLI Version: 0.66.0
• Operating System: darwin (macOS arm64, Node.js v24.18.1)
• Sandbox Environment: no sandbox
• Approval Mode: yolo

Login information

Google Account (OAuth)

Anything else we need to know?

Related issues / PRs:

• Gemini CLI v0.63.0 - breaks yolo mode #29682
• The recent 'Untrusted Command Flags' security warning completely breaks YOLO mode and makes the CLI unproductive compared to Claude Code, as it constantly interrupts for basic file operations when using MCP servers. #29680
• fix(core): scope untrusted flag checks to external output and remember approved flags #29833

Current local workaround required on every npm update: patching function findUntrustedFlags(command, untrustedContext) { return []; in bundle/chunk-*.js.