feat(core,cli): implement session-linked tool output storage and cleanup

[abhipatel12]

Summary

This PR implements Session-Linked Tool Output Storage and Cleanup (Phase 1). It ensures that tool output files (from masking and truncation) are organized into session-specific subdirectories and are automatically purged when a session is deleted or expires. This fixes the issue of tool output files leaking across sessions and failing to be cleaned up reliably.

Details

• Session-Specific Subdirectories: Tool outputs are now saved in tool-outputs/session-<sessionId>/ instead of a flat root directory.
• Consolidated Naming: Renamed the internal tool_output directory to tool-outputs for consistent naming across the codebase.
• Lifecycle Integration:
  • ChatRecordingService.deleteSession: Now automatically deletes the associated session tool output folder.
  • sessionCleanup.ts: Updated cleanupExpiredSessions and cleanupToolOutputFiles to scan for and purge expired session-linked directories.
• Improved Testing: Added tests for session-specific folder cleanup in toolOutputCleanup.test.ts and updated existing tests to reflect the new directory structure.

Related Issues

Related to #session-cleanup-refinement

How to Validate

1. Staging Storage: Run a command that produces large output (e.g., git log) to trigger truncation/masking.
2. Verify Path: Check that ~/.gemini/tmp/<hash>/tool-outputs/session-<id>/ contains the output file.
3. Session Deletion: Use gemini session delete <id> or gemini session clear and verify the session-<id> folder is removed.
4. TTL Cleanup: Wait for the session retention period to elapse (or mock the time in tests) and run gemini session cleanup to verify folder removal.

Pre-Merge Checklist

• Updated relevant documentation and README (if needed)
• Added/updated tests (if needed)
• Noted breaking changes (if any)
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt

[gemini-code-assist]

Summary of Changes

Hello @abhipatel12, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a significant improvement in how temporary tool output files are managed within the system. By linking these outputs directly to specific sessions and implementing automated cleanup mechanisms, it resolves issues related to file persistence and disk space management. The changes ensure that temporary files are properly isolated and removed, contributing to a more stable and efficient application lifecycle.

Highlights

• Session-Linked Tool Output Storage: Tool output files (from masking and truncation) are now organized into session-specific subdirectories, located at ~/.gemini/tmp/<hash>/tool-outputs/session-<sessionId>/, preventing leakage across sessions.
• Automated Tool Output Cleanup: The system now automatically purges session-linked tool output directories when a session is deleted or expires, ensuring reliable cleanup and preventing accumulation of temporary files.
• Directory Renaming: The internal tool_output directory has been consistently renamed to tool-outputs across the codebase for clarity and standardization.
• Enhanced Testing for File System Operations: Test suites for ChatRecordingService and ToolOutputMaskingService have been refactored to use actual temporary directories and file system operations, improving the robustness and realism of tests for file management.

Changelog

• packages/cli/src/utils/sessionCleanup.ts
  • Renamed TOOL_OUTPUT_DIR to TOOL_OUTPUTS_DIR for consistency.
  • Modified cleanupExpiredSessions to include the deletion of session-specific tool output folders.
  • Updated cleanupToolOutputFiles to scan for and remove expired session subdirectories within the main tool outputs directory.
• packages/cli/src/utils/toolOutputCleanup.test.ts
  • Updated references from TOOL_OUTPUT_DIR to TOOL_OUTPUTS_DIR.
  • Added a new test case to verify the deletion of expired session subdirectories.
• packages/core/src/services/snapshots/toolOutputMaskingService.test.ts.snap
  • Updated snapshot to reflect the new session-specific path for masked tool output files.
• packages/core/src/services/chatCompressionService.test.ts
  • Updated references from TOOL_OUTPUT_DIR to TOOL_OUTPUTS_DIR.
• packages/core/src/services/chatRecordingService.test.ts
  • Refactored test setup to use fs.promises.mkdtemp for creating temporary directories, enhancing test isolation and realism.
  • Removed various vi.mock calls for fs and path operations, allowing tests to interact with the actual file system.
  • Added afterEach hook to ensure cleanup of temporary directories after each test.
  • Modified deleteSession test to assert the deletion of both the session file and its corresponding tool output directory.
• packages/core/src/services/chatRecordingService.ts
  • Enhanced deleteSession method to include the removal of the associated session-specific tool output directory.
• packages/core/src/services/toolOutputMaskingService.test.ts
  • Refactored test setup to use temporary directories and actual file system operations, similar to chatRecordingService.test.ts.
  • Updated snapshot comparison logic to handle dynamic temporary directory paths.
• packages/core/src/services/toolOutputMaskingService.ts
  • Changed the base directory for tool outputs from getHistoryDir() to getProjectTempDir().
  • Implemented logic to create session-specific subdirectories for tool outputs, using session-<sessionId> if a session ID is available.
• packages/core/src/utils/fileUtils.test.ts
  • Updated expected file paths in tests from tool_output to tool-outputs.
• packages/core/src/utils/fileUtils.ts
  • Renamed TOOL_OUTPUT_DIR to TOOL_OUTPUTS_DIR.
  • Modified saveTruncatedToolOutput to accept an optional sessionId and store outputs in a session-specific subdirectory.

Activity

• The author, abhipatel12, has implemented the initial phase of session-linked tool output storage and cleanup.
• The pull request includes comprehensive changes across core and CLI packages to integrate the new file management strategy.
• New and updated tests have been added to validate the session-specific folder cleanup and the new directory structure.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces session-linked storage for tool outputs, improving temporary file organization and cleanup. However, it contains path traversal vulnerabilities where the sessionId is used unsanitized in file system paths, potentially allowing arbitrary file deletion. It's crucial to sanitize sessionId using sanitizeFilenamePart before path operations. Additionally, while the PR includes consistent renaming of tool_output to tool-outputs and improved testing, a high-severity suggestion exists to enhance the robustness of the deleteSession method for more resilient cleanup operations.

[github-actions]

Size Change: +2.43 kB (+0.01%)

Total Size: 23.8 MB

Filename	Size	Change
./bundle/gemini.js	23.7 MB	+2.43 kB (+0.01%)

ℹ️ View Unchanged

Filename	Size
./bundle/sandbox-macos-permissive-closed.sb	1.03 kB
./bundle/sandbox-macos-permissive-open.sb	890 B
./bundle/sandbox-macos-permissive-proxied.sb	1.31 kB
./bundle/sandbox-macos-restrictive-closed.sb	3.29 kB
./bundle/sandbox-macos-restrictive-open.sb	3.36 kB
./bundle/sandbox-macos-restrictive-proxied.sb	3.56 kB

_{compressed-size-action}