Gemini CLI env sanitization could break every git call; PR restores GIT_CONFIG consistency
Shivansh1980 · ghdev · 2026-08-21
A PR against google-gemini/gemini-cli fixes sanitizeEnvironment() emitting a GITCONFIG environment that git refuses to parse — git aborts on a malformed directive rather than skipping it, so every git invocation through the sanitized environment fails.
Root cause: secret-redaction checks run before the GITCONFIG exemption (locked in by security tests). When a GITCONFIGVALUEn carrying a credential is dropped, its GITCONFIGKEYn and the declared GITCONFIGCOUNT survive, leaving a fatal gap. Realistic triggers: url.<base>.insteadOf rewrites with embedded credentials and http.extraheader bearer tokens; also fires under strict CI sanitization (GITHUBSHA set).
Second path: parseInt on an inherited non-numeric GITCONFIGCOUNT yields NaN, so overrides land on GITCONFIGKEYNaN. Fix touches environmentSanitization.ts and friends.
More from coding & agent
- Decision models match LLMs on routing and safety — and are 7-8x faster — randal_olson · 2026-10-16
- Temporal Serverless Workers on Cloud Run: queue-driven autoscaling, scale to zero — rseroter · 2026-10-16
- Meta's Superintelligence Lab Runs 200+ Direct Reports—A Lesson for Flat Multi-Agent Systems — peterjliu · 2026-10-16
- LangChain CEO: the most interesting agent harness work lives at the harness-infra boundary — hwchase17 · 2026-10-16
- GitSwarm paper: agents share branchable Git memory, solving all 30 IMOProofBench problems in one run — anirudhg9119 · 2026-10-16
- Hands-on with Gemini 4 Argon: faster than Opus 5.5 but hallucinates more and costs more — prasenx · 2026-10-16