Skip to content

fix: "allow always" for commands with paths#23558

Merged
scidomino merged 1 commit intomainfrom
tomm_normalize
Mar 23, 2026
Merged

fix: "allow always" for commands with paths#23558
scidomino merged 1 commit intomainfrom
tomm_normalize

Conversation

@scidomino
Copy link
Collaborator

@scidomino scidomino commented Mar 23, 2026

Summary

Don't strip paths from long commands when writing allow policies.

Details

This also changes it to display the full name of the command in the UI. This is probably better since users should understand what command they are approving.

Screenshot 2026-03-23 at 9 49 59 AM

Previously this would have read Allow execution of: 'command'?

Related Issues

For #16450

How to Validate

  1. ask gemini to run long/path/to/command with the shell tool.
  2. Hit "approval for all future sessions"
  3. Verify that the new entry in auto-saved.toml includes the full path.

Pre-Merge Checklist

  • Updated relevant documentation and README (if needed)
  • Added/updated tests (if needed)
  • Noted breaking changes (if any)
  • Validated on required platforms/methods:
    • MacOS
      • npm run
      • npx
      • Docker
      • Podman
      • Seatbelt
    • Windows
      • npm run
      • npx
      • Docker
    • Linux
      • npm run
      • npx
      • Docker

@github-actions
Copy link

Size Change: -110 B (0%)

Total Size: 26.1 MB

Filename Size Change
./bundle/chunk-BDZU7JBU.js 0 B -14.5 MB (removed) 🏆
./bundle/chunk-ZWVJB2ME.js 0 B -3.64 MB (removed) 🏆
./bundle/core-VFOTUWR3.js 0 B -42.4 kB (removed) 🏆
./bundle/devtoolsService-BIOAMKBC.js 0 B -27.7 kB (removed) 🏆
./bundle/interactiveCli-KJN5C7IO.js 0 B -1.62 MB (removed) 🏆
./bundle/oauth2-provider-MI3QNYO6.js 0 B -9.16 kB (removed) 🏆
./bundle/chunk-3Y4MGMCO.js 14.5 MB +14.5 MB (new file) 🆕
./bundle/chunk-C5H423AD.js 3.64 MB +3.64 MB (new file) 🆕
./bundle/core-6UYZCWDO.js 42.4 kB +42.4 kB (new file) 🆕
./bundle/devtoolsService-DPF37MSH.js 27.7 kB +27.7 kB (new file) 🆕
./bundle/interactiveCli-U3WGVHM7.js 1.62 MB +1.62 MB (new file) 🆕
./bundle/oauth2-provider-RJQOLZFQ.js 9.16 kB +9.16 kB (new file) 🆕
ℹ️ View Unchanged
Filename Size
./bundle/chunk-34MYV7JD.js 2.45 kB
./bundle/chunk-5AUYMPVF.js 858 B
./bundle/chunk-5WHECDMU.js 1.95 MB
./bundle/chunk-664ZODQF.js 124 kB
./bundle/chunk-DAHVX5MI.js 206 kB
./bundle/chunk-IUUIT4SU.js 56.5 kB
./bundle/chunk-RJTRUG2J.js 39.8 kB
./bundle/devtools-36NN55EP.js 696 kB
./bundle/dist-T73EYRDX.js 356 B
./bundle/gemini.js 519 kB
./bundle/getMachineId-bsd-TXG52NKR.js 1.55 kB
./bundle/getMachineId-darwin-7OE4DDZ6.js 1.55 kB
./bundle/getMachineId-linux-SHIFKOOX.js 1.34 kB
./bundle/getMachineId-unsupported-5U5DOEYY.js 1.06 kB
./bundle/getMachineId-win-6KLLGOI4.js 1.72 kB
./bundle/memoryDiscovery-DL6LDUAP.js 922 B
./bundle/multipart-parser-KPBZEGQU.js 11.7 kB
./bundle/node_modules/@google/gemini-cli-devtools/dist/client/main.js 221 kB
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/_client-assets.js 227 kB
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/index.js 11.5 kB
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/types.js 132 B
./bundle/sandbox-macos-permissive-open.sb 890 B
./bundle/sandbox-macos-permissive-proxied.sb 1.31 kB
./bundle/sandbox-macos-restrictive-open.sb 3.36 kB
./bundle/sandbox-macos-restrictive-proxied.sb 3.56 kB
./bundle/sandbox-macos-strict-open.sb 4.82 kB
./bundle/sandbox-macos-strict-proxied.sb 5.02 kB
./bundle/src-QVCVGIUX.js 47 kB
./bundle/tree-sitter-7U6MW5PS.js 274 kB
./bundle/tree-sitter-bash-34ZGLXVX.js 1.84 MB

compressed-size-action

@scidomino scidomino changed the title Don't strip paths from commands for policy fix: "allow always" for commands with paths Mar 23, 2026
@scidomino scidomino marked this pull request as ready for review March 23, 2026 16:58
@scidomino scidomino requested a review from a team as a code owner March 23, 2026 16:58
@gemini-code-assist
Copy link
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses an issue where shell command approval policies were not correctly storing the full path of commands. By modifying the command normalization logic, the system now preserves complete command paths, enhancing the accuracy of 'allow always' policies and providing users with a clearer understanding of the commands they are approving in the UI.

Highlights

  • Command Path Preservation: The system will now retain the full path of commands when creating 'allow always' policies, rather than stripping them down to just the binary name. This ensures greater accuracy and clarity in approval policies.
  • UI Display Enhancement: The user interface will now display the full command name, including its path, during the approval process, providing users with complete context for their decisions.
  • Test Case Update: An existing test case for getCommandRoots was updated to reflect the new behavior, asserting that full command paths are correctly returned.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request modifies the shell-utils module. The normalizeCommandName function in packages/core/src/utils/shell-utils.ts has been simplified to only trim the input string, removing the logic that previously extracted just the binary name from a path. Correspondingly, the test case in packages/core/src/utils/shell-utils.test.ts for getCommandRoots has been updated to reflect this change, now expecting the full path of a command rather than just its binary name when a path is provided. There is no feedback to provide.

@gemini-cli gemini-cli bot added priority/p0 Critical and urgent (e.g., critical security vulnerability, major breakage). area/security Issues related to security 🔒 maintainer only ⛔ Do not contribute. Internal roadmap item. labels Mar 23, 2026
@scidomino scidomino enabled auto-merge March 23, 2026 17:15
@scidomino scidomino added this pull request to the merge queue Mar 23, 2026
Copy link
Contributor

@jacob314 jacob314 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Merged via the queue into main with commit daf3691 Mar 23, 2026
37 checks passed
@scidomino scidomino deleted the tomm_normalize branch March 23, 2026 17:38
@scidomino
Copy link
Collaborator Author

/patch preview

@github-actions
Copy link

🚀 [Step 1/4] Patch workflow(s) waiting for approval!

📋 Details:

  • Channels: preview
  • Commit: daf36918413ad60a081e960b21af420468904f41
  • Workflows Created: 1

⏳ Status: The patch creation workflow has been triggered and is waiting for deployment approval. Please visit the specific workflow links below and approve the runs.

🔗 Track Progress:

@github-actions
Copy link

🚀 [Step 2/4] Patch PR Created!

📋 Patch Details:

📝 Next Steps:

  1. Review and approve the hotfix PR: #23565
  2. Once merged, the patch release will automatically trigger
  3. You'll receive updates here when the release completes

🔗 Track Progress:

@github-actions
Copy link

🚀 [Step 3/4] Patch Release Waiting for Approval!

📋 Release Details:

  • Environment: prod
  • Channel: preview → publishing to npm tag preview
  • Version: v0.35.0-preview.2
  • Hotfix PR: Merged ✅
  • Release Branch: release/v0.35.0-preview.2-pr-23558

⏳ Status: The patch release has been triggered and is waiting for deployment approval. Please visit the specific workflow run link below and approve the deployment. You'll receive another update when it completes.

🔗 Track Progress:

@github-actions
Copy link

[Step 4/4] Patch Release Complete!

📦 Release Details:

🎉 Status: Your patch has been successfully released and published to npm!

📝 What's Available:

🔗 Links:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/security Issues related to security 🔒 maintainer only ⛔ Do not contribute. Internal roadmap item. priority/p0 Critical and urgent (e.g., critical security vulnerability, major breakage).

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants