feat(cli): disable folder trust in headless mode#18407
Conversation
- Update isHeadlessMode in packages/core to check both stdin.isTTY and stdout.isTTY. - Synchronize isHeadlessMode mock in packages/cli tests and add global TTY stubs to ensure consistent test environments. - Add isMounted guard to useFolderTrust hook to prevent state updates on unmounted components in headless mode. - Expand unit tests in packages/core to cover new TTY check combinations and edge cases. - Stabilize flaky MCP initialization test in packages/core/src/config/config.test.ts by using a deterministic promise. - Address review findings regarding environment detection consistency and CI indicator checks.
Summary of ChangesHello @galz10, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly improves the reliability and consistency of headless mode detection across the core and CLI packages. By centralizing and expanding the detection logic, it ensures that the application behaves predictably in both interactive and non-interactive environments, preventing potential interactive hangs and aligning test mocks with production code. The changes also enhance the stability of UI hooks and test suites. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request effectively hardens the detection of headless mode by introducing a centralized isHeadlessMode utility and applying it consistently across the core and cli packages. However, a critical security regression was identified in the 'Trusted Folders' logic: automatically trusting any workspace in headless mode creates a complete bypass of security protections, allowing malicious configurations to execute dangerous tools without user consent, even via simple actions like redirecting CLI output to a file. It is recommended to revert this automatic trust and ensure security-sensitive decisions remain dependent on explicit user trust. Additionally, the PR improves robustness by checking stdin and stdout TTY status, aligns test mocks, and fixes a flaky test using a promise-based approach, enhancing overall code clarity and stability.
| if (isHeadlessMode()) { | ||
| return { isTrusted: true, source: undefined }; | ||
| } |
There was a problem hiding this comment.
The isWorkspaceTrusted function has been modified to automatically return true if the environment is detected as "headless". Headless mode is triggered by environment variables (CI, GITHUB_ACTIONS), the presence of a prompt flag, or if stdin/stdout are not TTYs (e.g., when output is redirected to a file).
This introduces a significant security bypass of the "Trusted Folders" mechanism. This feature is designed to protect users from malicious repository configurations by forcing the CLI into a restricted DEFAULT approval mode (requiring manual confirmation for tool calls) unless the folder is explicitly trusted. By automatically trusting any folder in headless mode, an attacker can bypass this protection. For example, if a user is tricked into running the CLI with redirected output (e.g., gemini --yolo "..." > output.txt) in a malicious folder, the CLI will now automatically trust the folder and honor the --yolo flag, allowing malicious configuration files in that folder to execute arbitrary shell commands without any user confirmation.
To remediate this, remove the automatic trust for headless mode. Headless environments should rely on explicit trust configurations or operate in a restricted mode that prevents the use of privileged approval modes like YOLO unless the folder has been previously and explicitly trusted by the user.
References
- Security-sensitive settings should not use a merge strategy (e.g.,
MergeStrategy.REPLACE) that allows less-trusted configuration scopes (like a workspace) to completely override more-trusted scopes (like global user settings).
|
Size Change: +1.09 kB (0%) Total Size: 23.9 MB
ℹ️ View Unchanged
|
Unset CI and GITHUB_ACTIONS environment variables in config.test.ts to ensure tests that rely on interactive/TTY mode pass correctly in CI environments. The isHeadlessMode detection logic defaults to non-interactive mode if these variables are present, which previously caused assertion failures in tests expecting interactive startup messages and specific tool exclusion behaviors.
Disable folder trust when running in integration tests (GEMINI_CLI_INTEGRATION_TEST) or unit tests (VITEST) to prevent interactive prompts from blocking automated tests. Also updates config.test.ts to isolate folder trust tests from these environment variables so the underlying logic can still be verified.
|
Size Change: +1.09 kB (0%) Total Size: 23.9 MB
ℹ️ View Unchanged
|
|
Size Change: +1.28 kB (+0.01%) Total Size: 23.9 MB
ℹ️ View Unchanged
|
|
/path preview |
|
/patch preview |
|
✅ Patch workflow(s) dispatched successfully! 📋 Details:
🔗 Track Progress: |
# Conflicts: # packages/cli/src/config/config.ts # packages/cli/src/ui/hooks/useFolderTrust.ts
|
🚀 Patch PR Created! 📋 Patch Details:
📝 Next Steps:
🔗 Track Progress: |
|
🚀 Patch Release Started! 📋 Release Details:
⏳ Status: The patch release is now running. You'll receive another update when it completes. 🔗 Track Progress: |
|
✅ Patch Release Complete! 📦 Release Details:
🎉 Status: Your patch has been successfully released and published to npm! 📝 What's Available:
🔗 Links: |
* Fix newline insertion bug in replace tool (google-gemini#18595) * fix(evals): update save_memory evals and simplify tool description (google-gemini#18610) * chore(evals): update validation_fidelity_pre_existing_errors to USUALLY_PASSES (google-gemini#18617) * fix: shorten tool call IDs and fix duplicate tool name in truncated output filenames (google-gemini#18600) * feat(cli): implement atomic writes and safety checks for trusted folders (google-gemini#18406) * Remove relative docs links (google-gemini#18650) * docs: add legacy snippets convention to GEMINI.md (google-gemini#18597) * fix(chore): Support linting for cjs (google-gemini#18639) Co-authored-by: Gal Zahavi <38544478+galz10@users.noreply.github.com> * feat: move shell efficiency guidelines to tool description (google-gemini#18614) * Added "" as default value, since getText() used to expect a string only and thus crashed when undefined... Fixes google-gemini#18076 (google-gemini#18099) * Allow @-includes outside of workspaces (with permission) (google-gemini#18470) * chore: make `ask_user` header description more clear (google-gemini#18657) * bug(core): Fix minor bug in migration logic. (google-gemini#18661) * Harded code assist converter. (google-gemini#18656) * refactor(core): model-dependent tool definitions (google-gemini#18563) * feat: enable plan mode experiment in settings (google-gemini#18636) * refactor: push isValidPath() into parsePastedPaths() (google-gemini#18664) * fix(cli): correct 'esc to cancel' position and restore duration display (google-gemini#18534) * feat(cli): add DevTools integration with gemini-cli-devtools (google-gemini#18648) * chore: remove unused exports and redundant hook files (google-gemini#18681) * Fix number of lines being reported in rewind confirmation dialog (google-gemini#18675) * feat(cli): disable folder trust in headless mode (google-gemini#18407) * Disallow unsafe type assertions (google-gemini#18688) * Change event type for release (google-gemini#18693) * feat: handle multiple dynamic context filenames in system prompt (google-gemini#18598) * Properly parse at-commands with narrow non-breaking spaces (google-gemini#18677) * refactor(core): centralize core tool definitions and support model-specific schemas (google-gemini#18662) * feat(core): Render memory hierarchically in context. (google-gemini#18350) * feat: Ctrl+O to expand paste placeholder (google-gemini#18103) * fix(cli): Improve header spacing (google-gemini#18531) * Feature/quota visibility 16795 (google-gemini#18203) * docs: remove TOC marker from Plan Mode header (google-gemini#18678) * Inline thinking bubbles with summary/full modes (google-gemini#18033) Co-authored-by: Jacob Richman <jacob314@gmail.com> * fix(ui): remove redundant newlines in Gemini messages (google-gemini#18538) * test(cli): fix AppContainer act() warnings and improve waitFor resilience (google-gemini#18676) * refactor(core): refine Security & System Integrity section in system prompt (google-gemini#18601) * Fix layout rounding. (google-gemini#18667) * docs(skills): enhance pr-creator safety and interactivity (google-gemini#18616) * test(core): remove hardcoded model from TestRig (google-gemini#18710) * feat(core): optimize sub-agents system prompt intro (google-gemini#18608) * feat(cli): update approval mode labels and shortcuts per latest UX spec (google-gemini#18698) * fix(plan): update persistent approval mode setting (google-gemini#18638) Co-authored-by: Sandy Tao <sandytao520@icloud.com> * fix: move toasts location to left side (google-gemini#18705) * feat(routing): restrict numerical routing to Gemini 3 family (google-gemini#18478) * fix(ide): fix ide nudge setting (google-gemini#18733) * fix(core): standardize tool formatting in system prompts (google-gemini#18615) * chore: consolidate to green in ask user dialog (google-gemini#18734) * feat: add `extensionsExplore` setting to enable extensions explore UI. (google-gemini#18686) * feat(cli): defer devtools startup and integrate with F12 (google-gemini#18695) * ui: update & subdue footer colors and animate progress indicator (google-gemini#18570) * test: add model-specific snapshots for coreTools (google-gemini#18707) Co-authored-by: matt korwel <matt.korwel@gmail.com> * ci: shard windows tests and fix event listener leaks (google-gemini#18670) * fix: allow `ask_user` tool in yolo mode (google-gemini#18541) * feat: redact disabled tools from system prompt (google-gemini#13597) (google-gemini#18613) * Update Gemini.md to use the curent year on creating new files (google-gemini#18460) * Code review cleanup for thinking display (google-gemini#18720) * fix(cli): hide scrollbars when in alternate buffer copy mode (google-gemini#18354) Co-authored-by: Jacob Richman <jacob314@gmail.com> * Fix issues with rip grep (google-gemini#18756) * fix(cli): fix history navigation regression after prompt autocomplete (google-gemini#18752) * chore: cleanup unused and add unlisted dependencies in packages/cli (google-gemini#18749) * Fix issue where Gemini CLI creates tests in a new file (google-gemini#18409) * feat(telemetry): Ensure experiment IDs are included in OpenTelemetry logs (google-gemini#18747) * feat(ux): added text wrapping capabilities to markdown tables (google-gemini#18240) Co-authored-by: jacob314 <jacob314@gmail.com> * Revert "fix(mcp): ensure MCP transport is closed to prevent memory leaks" (google-gemini#18771) * chore(release): bump version to 0.30.0-nightly.20260210.a2174751d (google-gemini#18772) * chore: cleanup unused and add unlisted dependencies in packages/core (google-gemini#18762) * chore(core): update activate_skill prompt verbiage to be more direct (google-gemini#18605) * Add autoconfigure memory usage setting to the dialog (google-gemini#18510) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * fix(core): prevent race condition in policy persistence (google-gemini#18506) Co-authored-by: Allen Hutchison <adh@google.com> * fix(evals): prevent false positive in hierarchical memory test (google-gemini#18777) * test(evals): mark all `save_memory` evals as `USUALLY_PASSES` due to unreliability (google-gemini#18786) * feat(cli): add setting to hide shortcuts hint UI (google-gemini#18562) * feat(core): formalize 5-phase sequential planning workflow (google-gemini#18759) * Introduce limits for search results. (google-gemini#18767) --------- Co-authored-by: Andrew Garrett <andrewgarrett@google.com> Co-authored-by: N. Taylor Mullen <ntaylormullen@google.com> Co-authored-by: Sandy Tao <sandytao520@icloud.com> Co-authored-by: Gal Zahavi <38544478+galz10@users.noreply.github.com> Co-authored-by: christine betts <chrstn@uw.edu> Co-authored-by: Aswin Ashok <aswwwin@google.com> Co-authored-by: Abhijith V Ashok <abhi2349jith@gmail.com> Co-authored-by: Tommaso Sciortino <sciortino@gmail.com> Co-authored-by: Jack Wotherspoon <jackwoth@google.com> Co-authored-by: joshualitt <joshualitt@google.com> Co-authored-by: Jacob Richman <jacob314@gmail.com> Co-authored-by: Aishanee Shah <aishaneeshah@gmail.com> Co-authored-by: Jerop Kipruto <jerop@google.com> Co-authored-by: Adib234 <30782825+Adib234@users.noreply.github.com> Co-authored-by: Christian Gunderman <gundermanc@gmail.com> Co-authored-by: g-samroberts <158088236+g-samroberts@users.noreply.github.com> Co-authored-by: Spencer <spencertang@google.com> Co-authored-by: Dmitry Lyalin <dmitry.lyalin@lyalin.com> Co-authored-by: matt korwel <matt.korwel@gmail.com> Co-authored-by: Shreya Keshive <shreyakeshive@google.com> Co-authored-by: Sri Pasumarthi <111310667+sripasg@users.noreply.github.com> Co-authored-by: Keith Guerin <keithguerin@gmail.com> Co-authored-by: Sehoon Shon <sshon@google.com> Co-authored-by: Adam Weidman <65992621+adamfweidman@users.noreply.github.com> Co-authored-by: Kevin Ramdass <ramdass.kevin@gmail.com> Co-authored-by: Dev Randalpura <devrandalpura@google.com> Co-authored-by: gemini-cli-robot <gemini-cli-robot@google.com> Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Brad Dux <959674+braddux@users.noreply.github.com> Co-authored-by: Allen Hutchison <adh@google.com> Co-authored-by: Abhijit Balaji <abhijitbalaji@google.com>
Summary
This PR updates the folder trust implementation to automatically trust the workspace when the Gemini CLI is running in headless mode, regardless of settings. This ensures that non-interactive environments (like CI/CD pipelines) do not hang or fail due to trust prompts.
Details
isWorkspaceTrustedinpackages/clito immediately returntrueif headless mode is detected, bypassing all configuration checks.useFolderTrusthook to automatically bypass the trust dialog and signal trust when headless, including anisMountedguard to prevent state updates on unmounted components.isHeadlessModeutility inpackages/coreto check bothstdin.isTTYandstdout.isTTY, ensuring reliable detection across various piping scenarios.isHeadlessModemocks in CLI tests to match production logic and added global TTY stubs for test environment consistency.Related Issues
Addressing review findings regarding folder trust and headless mode consistency.
How to Validate
npm test -w @google/gemini-cli-core -- src/utils/headless.test.tsnpm test -w @google/gemini-cli -- src/config/trustedFolders.test.ts(Specifically the new "isWorkspaceTrusted headless mode" suite)npm test -w @google/gemini-cli -- src/ui/hooks/useFolderTrust.test.tsnpm run buildPre-Merge Checklist