Repository navigation
Conversation
FindUntrustedFlags reported the agent's own files under the session's project temp directory as untrusted arguments, because only the workspace was treated as local. Shell output such as a Python traceback mentioning ~/.gemini/tmp/<session>/parse_pr.py then forced a confirmation even in YOLO mode. Pass config.storage.getProjectTempDir() through the flag options and treat paths below it as local, matching the temp directory trust already used for file access. Executable scripts, URLs, shell expansions, and remote output keep their existing handling. Refs google-gemini#30004.
|
📊 PR Size: size/M
|
🛑 Action Required: Evaluation ApprovalSteering changes have been detected in this PR. To prevent regressions, a maintainer must approve the evaluation run before this PR can be merged. Maintainers:
Once approved, the evaluation results will be posted here automatically. |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses a false positive issue where the Gemini CLI incorrectly flagged its own helper scripts as untrusted when they appeared in shell output (e.g., tracebacks). By including the project's temporary directory in the workspace-local exemption logic, the agent can now safely reference these paths without triggering unnecessary confirmation prompts in YOLO mode. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds support for ignoring session-scoped temporary directories when detecting untrusted execution paths in the shell tool. It updates UntrustedFlagOptions to include projectTempDir and modifies isWorkspaceLocalPath to treat paths within this directory as trusted. The feedback recommends improving robustness by safely handling optional properties: specifically, using optional chaining when accessing config.storage in shell.ts and ensuring isPathWithinWorkspace is treated as optional in isWorkspaceLocalPath to prevent potential runtime errors.
| return ( | ||
| options.isPathWithinWorkspace(absolutePath) || | ||
| (options.projectTempDir !== undefined && | ||
| isSubpath(options.projectTempDir, absolutePath)) | ||
| ); |
There was a problem hiding this comment.
In isWorkspaceLocalPath, options.isPathWithinWorkspace is called directly as a function, but the UntrustedFlagOptions interface defines isPathWithinWorkspace as an optional property. If a caller provides projectTempDir but omits isPathWithinWorkspace, the function currently returns false early due to the check !options.isPathWithinWorkspace on line 310 (outside the diff).
To make the function robust and adhere to the interface contract where both properties are optional, we should allow isPathWithinWorkspace to be optional and only invoke it if defined, while still allowing projectTempDir checks to proceed.
Please update the early return check to not require isPathWithinWorkspace if projectTempDir is provided, and use optional chaining when invoking isPathWithinWorkspace.
return (
(options.isPathWithinWorkspace !== undefined &&
options.isPathWithinWorkspace(absolutePath)) ||
(options.projectTempDir !== undefined &&
isSubpath(options.projectTempDir, absolutePath))
);References
- When consuming an object, if a property is optional in its type definition (interface), callers must handle the undefined case. Do not rely on the implementation details of the function that creates the object to always provide a value, as this can change. Code against the interface contract.
There was a problem hiding this comment.
Applied in ce8c4e3: isPathWithinWorkspace is now optional in isWorkspaceLocalPath, the early return no longer requires it, and the temp-dir exemption works without a workspace callback. Added coverage for the temp-dir-only options case.
Make isPathWithinWorkspace optional in isWorkspaceLocalPath so the projectTempDir exemption applies when callers omit the workspace callback, and use optional chaining when reading config.storage. Add coverage for the temp-dir-only options case.
Summary
The agent's own helper scripts under Gemini CLI's session project temp directory
(
~/.gemini/tmp/<project>/...) were reported as untrusted shell arguments. Onceshell output such as a Python traceback mentioned the script path, the next
python3 <path>invocation requested confirmation even in YOLO mode.This change treats the project temp directory as local for untrusted-flag
detection, alongside the workspace.
Details
findUntrustedFlags()exempts path arguments that resolve inside the workspace(
isPathWithinWorkspace). The project temp directory lives outside theworkspace, so a local script written there and later named in its own traceback
was flagged as untrusted — the false positive reported in #30004.
packages/core/src/utils/untrustedContextTracker.ts:UntrustedFlagOptionsgains
projectTempDir;isWorkspaceLocalPath()now also accepts paths belowit via
isSubpath(), andisPathWithinWorkspaceis optional so the temp-direxemption works without a workspace callback.
packages/core/src/tools/shell.ts: passesconfig.storage?.getProjectTempDir()when finding untrusted flags.This mirrors the project temp directory trust that
Config.isPathAllowed()already applies for file access.
The remaining issue items are intentionally unchanged here: executable scripts,
URLs, and paths with shell expansions (
~,$VAR) stay out of theworkspace-local exemption, and output from remote-retrieval commands keeps
external provenance, per #29833. The settings toggle is a separate design
decision.
Related Issues
Related to #30004
How to Validate
npm test -w @google/gemini-cli-core -- src/utils/untrustedContextTracker.test.ts src/tools/shell.test.tsshould not flag project temp paths that appeared in local shell outputand
should not flag project temp paths printed by earlier shell output.Both fail before the change and pass after it.
project temp directory (for example a traceback), then run
python3 <path>.No confirmation should appear in YOLO mode. Paths outside both the workspace
and the project temp directory are still reported.
npm run preflightpassed locally (Linux, Node 20.19.0) on the initialcommit; the review follow-up was validated with the affected suites, ESLint,
Prettier, and the core
tsccheck.Pre-Merge Checklist