Skip to content

fix(patch): cherry-pick 08e8eea to release/v0.29.0-preview.1-pr-18855 to patch version v0.29.0-preview.1 and create version 0.29.0-preview.2 #18905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
skeshive merged 1 commit into from
Feb 12, 2026
Merged

fix(patch): cherry-pick 08e8eea to release/v0.29.0-preview.1-pr-18855 to patch version v0.29.0-preview.1 and create version 0.29.0-preview.2 #18905

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions packages/cli/src/config/config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -445,7 +445,11 @@ export async function loadCliConfig(
process.env['VITEST'] === 'true'
? false
: (settings.security?.folderTrust?.enabled ?? false);
const trustedFolder = isWorkspaceTrusted(settings, cwd)?.isTrusted ?? false;
const trustedFolder =
isWorkspaceTrusted(settings, cwd, undefined, {
prompt: argv.prompt,
query: argv.query,
})?.isTrusted ?? false;
Comment on lines +448 to +452
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

Passing argv.query to isWorkspaceTrusted triggers a security bypass. Because isHeadlessMode (called internally by isWorkspaceTrusted) returns true if a query is present, any command that includes a positional argument will cause the current folder to be automatically trusted. This bypasses the trust prompt and allows potentially malicious hooks or configurations in the folder to be executed.


// Set the context filename in the server's memoryTool module BEFORE loading memory
// TODO(b/343434939): This is a bit of a hack. The contextFileName should ideally be passed
Expand Down Expand Up @@ -602,8 +606,7 @@ export async function loadCliConfig(
const interactive =
!!argv.promptInteractive ||
!!argv.experimentalAcp ||
(!isHeadlessMode({ prompt: argv.prompt }) &&
!argv.query &&
(!isHeadlessMode({ prompt: argv.prompt, query: argv.query }) &&
!argv.isCommand);

const allowedTools = argv.allowedTools || settings.tools?.allowed || [];
Expand Down
8 changes: 8 additions & 0 deletions packages/cli/src/config/trustedFolders.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -449,6 +449,14 @@ describe('Trusted Folders', () => {
false,
);
});

it('should return true for isPathTrusted when isHeadlessMode is true', async () => {
const geminiCore = await import('@google/gemini-cli-core');
vi.spyOn(geminiCore, 'isHeadlessMode').mockReturnValue(true);

const folders = loadTrustedFolders();
expect(folders.isPathTrusted('/any-untrusted-path')).toBe(true);
});
});

describe('Trusted Folders Caching', () => {
Expand Down
21 changes: 18 additions & 3 deletions packages/cli/src/config/trustedFolders.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ import {
homedir,
isHeadlessMode,
coreEvents,
type HeadlessModeOptions,
} from '@google/gemini-cli-core';
import type { Settings } from './settings.js';
import stripJsonComments from 'strip-json-comments';
Expand Down Expand Up @@ -128,7 +129,11 @@ export class LoadedTrustedFolders {
isPathTrusted(
location: string,
config?: Record<string, TrustLevel>,
headlessOptions?: HeadlessModeOptions,
): boolean | undefined {
if (isHeadlessMode(headlessOptions)) {
return true;
}
const configToUse = config ?? this.user.config;

// Resolve location to its realpath for canonical comparison
Expand Down Expand Up @@ -333,6 +338,7 @@ export function isFolderTrustEnabled(settings: Settings): boolean {
function getWorkspaceTrustFromLocalConfig(
workspaceDir: string,
trustConfig?: Record<string, TrustLevel>,
headlessOptions?: HeadlessModeOptions,
): TrustResult {
const folders = loadTrustedFolders();
const configToUse = trustConfig ?? folders.user.config;
Expand All @@ -346,7 +352,11 @@ function getWorkspaceTrustFromLocalConfig(
);
}

const isTrusted = folders.isPathTrusted(workspaceDir, configToUse);
const isTrusted = folders.isPathTrusted(
workspaceDir,
configToUse,
headlessOptions,
);
return {
isTrusted,
source: isTrusted !== undefined ? 'file' : undefined,
Expand All @@ -357,8 +367,9 @@ export function isWorkspaceTrusted(
settings: Settings,
workspaceDir: string = process.cwd(),
trustConfig?: Record<string, TrustLevel>,
headlessOptions?: HeadlessModeOptions,
): TrustResult {
if (isHeadlessMode()) {
if (isHeadlessMode(headlessOptions)) {
return { isTrusted: true, source: undefined };
}
Comment on lines +372 to 374
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-critical critical

The isWorkspaceTrusted function automatically returns true if isHeadlessMode() is true. Combined with the changes in packages/core/src/utils/headless.ts, this allows a user-controlled flag (like -y or a positional query) to bypass the folder trust security mechanism. This is a critical security bypass because the folder trust feature is intended to be the gatekeeper for dangerous operations like YOLO mode and loading unsanitized environment variables.


Expand All @@ -372,5 +383,9 @@ export function isWorkspaceTrusted(
}

// Fall back to the local user configuration
return getWorkspaceTrustFromLocalConfig(workspaceDir, trustConfig);
return getWorkspaceTrustFromLocalConfig(
workspaceDir,
trustConfig,
headlessOptions,
);
}
52 changes: 44 additions & 8 deletions packages/core/src/utils/headless.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,16 +99,50 @@ describe('isHeadlessMode', () => {
expect(isHeadlessMode({ prompt: true })).toBe(true);
});

it('should return false if query is provided but it is still a TTY', () => {
// Note: per current logic, query alone doesn't force headless if TTY
// This matches the existing behavior in packages/cli/src/config/config.ts
expect(isHeadlessMode({ query: 'test query' })).toBe(false);
it('should return true if query is provided', () => {
expect(isHeadlessMode({ query: 'test query' })).toBe(true);
});

it('should return true if -p or --prompt is in process.argv as a fallback', () => {
const originalArgv = process.argv;
process.argv = ['node', 'index.js', '-p', 'hello'];
try {
expect(isHeadlessMode()).toBe(true);
} finally {
process.argv = originalArgv;
}

process.argv = ['node', 'index.js', '--prompt', 'hello'];
try {
expect(isHeadlessMode()).toBe(true);
} finally {
process.argv = originalArgv;
}
});

it('should return true if -y or --yolo is in process.argv as a fallback', () => {
const originalArgv = process.argv;
process.argv = ['node', 'index.js', '-y'];
try {
expect(isHeadlessMode()).toBe(true);
} finally {
process.argv = originalArgv;
}

process.argv = ['node', 'index.js', '--yolo'];
try {
expect(isHeadlessMode()).toBe(true);
} finally {
process.argv = originalArgv;
}
});

it('should handle undefined process.stdout gracefully', () => {
const originalStdout = process.stdout;
// @ts-expect-error - testing edge case
delete process.stdout;
Object.defineProperty(process, 'stdout', {
value: undefined,
configurable: true,
});

try {
expect(isHeadlessMode()).toBe(false);
Expand All @@ -122,8 +156,10 @@ describe('isHeadlessMode', () => {

it('should handle undefined process.stdin gracefully', () => {
const originalStdin = process.stdin;
// @ts-expect-error - testing edge case
delete process.stdin;
Object.defineProperty(process, 'stdin', {
value: undefined,
configurable: true,
});

try {
expect(isHeadlessMode()).toBe(false);
Expand Down
29 changes: 18 additions & 11 deletions packages/core/src/utils/headless.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,18 +28,25 @@ export interface HeadlessModeOptions {
* @returns true if the environment is considered headless.
*/
export function isHeadlessMode(options?: HeadlessModeOptions): boolean {
if (process.env['GEMINI_CLI_INTEGRATION_TEST'] === 'true') {
return (
!!options?.prompt ||
(!!process.stdin && !process.stdin.isTTY) ||
(!!process.stdout && !process.stdout.isTTY)
);
if (process.env['GEMINI_CLI_INTEGRATION_TEST'] !== 'true') {
const isCI =
process.env['CI'] === 'true' || process.env['GITHUB_ACTIONS'] === 'true';
if (isCI) {
return true;
}
}
return (
process.env['CI'] === 'true' ||
process.env['GITHUB_ACTIONS'] === 'true' ||
!!options?.prompt ||

const isNotTTY =
(!!process.stdin && !process.stdin.isTTY) ||
(!!process.stdout && !process.stdout.isTTY)
(!!process.stdout && !process.stdout.isTTY);

if (isNotTTY || !!options?.prompt || !!options?.query) {
return true;
}

// Fallback: check process.argv for flags that imply headless or auto-approve mode.
return process.argv.some(
(arg) =>
arg === '-p' || arg === '--prompt' || arg === '-y' || arg === '--yolo',
);
Comment on lines +43 to 51
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-critical critical

The isHeadlessMode function now returns true if a query is provided or if the -y/--yolo flags are present in process.argv. Since isHeadlessMode is used by the folder trust mechanism to automatically grant trust, this allows an attacker to bypass folder trust by simply providing a query or convincing a user to use the YOLO flag. Headless mode detection for security-sensitive decisions should be strictly limited to verified environment indicators (like CI=true) and should not be influenced by user-controlled CLI flags.

}
Loading