Repository navigation
fix(patch): cherry-pick 2ce1a69 to release/v0.64.0-preview.0-pr-29672 to patch version v0.64.0-preview.0 and create version 0.64.0-preview.1 - #29696
Conversation
…ompound loops (#29672) Co-authored-by: Keith Schaab <keith.schaab@gmail.com>
|
📊 PR Size: size/XL
|
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request refines the security posture of the application by improving how shell commands are evaluated and monitored. It introduces logic to allow complex, compound commands when all parts are deemed safe, while simultaneously reducing operational friction by better distinguishing between benign POSIX flags and dangerous command-line arguments. These changes ensure that security policies are both more precise and less intrusive for legitimate user workflows. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
gemini-cli
Bot
added
the
status/need-issue
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request enables upgrading compound shell commands from ASK_USER to ALLOW when all decomposed sub-commands match explicit ALLOW rules and no safety boundaries are violated. It also refines the untrusted context tracker to minimize false positives by distinguishing between safe and high-risk flags. Feedback highlights a potential vulnerability where calling shellParse directly on a command without a try-catch block could lead to unhandled exceptions and crash the policy engine; wrapping this in a try-catch block is recommended for robust, fail-closed security.
|
Size Change: +15.1 kB (+0.04%) Total Size: 35.5 MB
ℹ️ View Unchanged
|
581fdbb
into
release/v0.64.0-preview.0-pr-29672
|
✅ 67 tests passed successfully on gemini-3-flash-preview. 🧠 Model Steering GuidanceThis PR modifies files that affect the model's behavior (prompts, tools, or instructions).
This is an automated guidance message triggered by steering logic signatures. |
This PR automatically cherry-picks commit 2ce1a69 to patch version v0.64.0-preview.0 in the preview release to create version 0.64.0-preview.1.
Adding the following PRs to the preview build:
#29672
#29612
#29616