fix(patch): cherry-pick bce1cae to release/v0.28.0-preview.6-pr-18407 [CONFLICTS]#18739
Conversation
# Conflicts: # packages/cli/src/config/config.ts # packages/cli/src/ui/hooks/useFolderTrust.ts
Summary of ChangesHello @gemini-cli-robot, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request aims to integrate a critical commit into a preview release branch, primarily focusing on improving the CLI's handling of non-interactive (headless) environments. The changes standardize how the CLI detects if it's running without user interaction and adjusts core behaviors, such as folder trust and interactive prompts, accordingly. This ensures a more robust and predictable experience in automated or CI/CD contexts, although the current PR requires manual conflict resolution. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new isHeadlessMode utility function to detect non-interactive environments based on CI/CD environment variables, TTY status, or explicit prompt flags. This utility is integrated across the CLI to modify behavior related to interactive prompts, OAuth consent, and crucially, folder trust. Specifically, the isWorkspaceTrusted function and the useFolderTrust hook are updated to automatically grant trust to workspaces when in headless mode, bypassing security checks. Additionally, the folderTrust security feature is explicitly disabled if GEMINI_CLI_INTEGRATION_TEST or VITEST environment variables are set. The package-lock.json file also includes changes adding peer: true to several dependencies. Review comments highlight critical security concerns regarding the automatic trust in headless mode, which could allow malicious files to be executed in automated environments, and the use of test-specific environment variables to bypass security features in production code. Unresolved merge conflicts are also present in packages/cli/src/config/config.ts and packages/cli/src/ui/hooks/useFolderTrust.ts.
packages/cli/src/config/config.ts
Outdated
| <<<<<<< HEAD | ||
| ======= | ||
| isHeadlessMode, | ||
| Config, | ||
| applyAdminAllowlist, | ||
| getAdminBlockedMcpServersMessage, | ||
| } from '@google/gemini-cli-core'; | ||
| import type { | ||
| HookDefinition, | ||
| HookEventName, | ||
| OutputFormat, | ||
| >>>>>>> bce1caefd (feat(cli): disable folder trust in headless mode (#18407)) |
There was a problem hiding this comment.
Unresolved merge conflict markers (<<<<<<< HEAD, =======, >>>>>>> bce1caefd (...)) are detected in the source code. These must be resolved as they will cause syntax errors and prevent the application from running correctly, impacting both functionality and security integrity.
| if (isHeadlessMode()) { | ||
| if (isMounted) { | ||
| setIsTrusted(trusted); | ||
| setIsFolderTrustDialogOpen(false); | ||
| onTrustChange(true); | ||
| showUntrustedMessage(); | ||
| } |
There was a problem hiding this comment.
In headless mode, the useFolderTrust hook forces the trust state to true, bypassing workspace trust protections and allowing untrusted folders to be treated as trusted. This is a critical security vulnerability. Additionally, there are unresolved merge conflicts in this section. Recommendation: Do not force trust in headless mode; ensure secure failure or explicit configuration. Please also resolve the merge conflicts.
References
- Security checks, such as an extension allowlist, should be implemented in a 'fail-closed' manner. If an item's validity cannot be verified (e.g., due to missing metadata), it should be rejected by default.
| if (isHeadlessMode()) { | ||
| return { isTrusted: true, source: undefined }; | ||
| } |
There was a problem hiding this comment.
The isWorkspaceTrusted function is modified to automatically return true when isHeadlessMode() is detected. Headless mode is triggered by common environment variables (e.g., CI=true, GITHUB_ACTIONS=true) or by simply piping stdout/stdin. This effectively bypasses the 'Workspace Trust' security feature in automated environments or when using pipes. An attacker could exploit this by committing a malicious .gemini/settings.json or GEMINI.md file to a repository; when the CLI is run in a CI environment or via a pipe, it will trust the folder and potentially execute malicious hooks or MCP servers without user consent.
Recommendation: Do not automatically grant trust in headless mode. Instead, require an explicit opt-in flag (e.g., --trust-workspace) or default to untrusted if interaction is not possible.
References
- Security checks, such as an extension allowlist, should be implemented in a 'fail-closed' manner. If an item's validity cannot be verified (e.g., due to missing metadata), it should be rejected by default.
| const folderTrust = | ||
| process.env['GEMINI_CLI_INTEGRATION_TEST'] === 'true' || | ||
| process.env['VITEST'] === 'true' | ||
| ? false | ||
| : (settings.security?.folderTrust?.enabled ?? false); |
There was a problem hiding this comment.
The folderTrust security feature is explicitly disabled if the GEMINI_CLI_INTEGRATION_TEST or VITEST environment variables are set to true. Including test-specific bypasses in production code is a security risk, as it allows anyone with control over the environment to completely disable critical security protections. This is particularly dangerous as disabling folderTrust causes the application to treat all workspaces as trusted.
Recommendation: Remove test-specific environment variable checks from production code. Use a more secure configuration mechanism for testing that does not leak into production logic.
References
- Security checks should be implemented in a 'fail-closed' manner. Bypassing security checks, even for testing, can lead to a 'fail-open' state in production environments.
| if (process.env['GEMINI_CLI_INTEGRATION_TEST'] === 'true') { | ||
| return ( | ||
| !!options?.prompt || | ||
| (!!process.stdin && !process.stdin.isTTY) || | ||
| (!!process.stdout && !process.stdout.isTTY) | ||
| ); | ||
| } |
There was a problem hiding this comment.
The isHeadlessMode function uses the GEMINI_CLI_INTEGRATION_TEST environment variable to alter its detection logic. Using test-specific environment variables in production code to change core logic is a security risk and can lead to unexpected behavior or security bypasses when these variables are present in the environment.
Recommendation: Remove test-specific environment variable checks from production code.
References
- Security checks should be implemented in a 'fail-closed' manner. Using test-specific environment variables to alter core logic can lead to security bypasses and a 'fail-open' state.
gemini-cli
bot
added
the
status/need-issue
|
Size Change: +1.34 kB (+0.01%) Total Size: 23.7 MB
ℹ️ View Unchanged
|
galz10
deleted the
hotfix/v0.28.0-preview.6/0.28.0-preview.7/preview/cherry-pick-bce1cae/pr-18407
branch
2 participants
This PR automatically cherry-picks commit bce1cae to patch version v0.28.0-preview.6 in the preview release to create version 0.28.0-preview.7.
This cherry-pick resulted in merge conflicts that need manual resolution.
🔧 Next Steps:
📋 Files with conflicts:
The commit has been created with conflict markers for easier manual resolution.
🚨 Important: