Gemini CLI PR hardens workspace path boundaries and symlink checks across command safety
jesussamuel-byte · ghdev · 2026-09-03
A community PR (#29170) on google-gemini/gemini-cli systematically strengthens workspace boundary enforcement and symlink resolution across command safety heuristics, file discovery, and directory listing on POSIX and Windows.
- POSIX command safety: file-reading utilities (cat, grep, find, etc.) now check arguments with isPathEscapingWorkspace to block escapes outside the workspace root or via symlinks; unresolvable shell variables and expansions are treated as unsafe.
- Symlink commands: ln -s invocations now require confirmation before creating links.
- Windows: matching checks for dir, type, get-content, and more.
- Architecture: SandboxManager implementations propagate cwd alongside the workspace root so PolicyEngine.applyShellHeuristics gets effective directory context; FileDiscoveryService ignores links resolving outside the project root.
A useful reference implementation of path-boundary defenses for anyone building coding-agent sandboxes.
More from coding & agent
- Developer asks: is LangChain still worth it vs rolling your own agent harness? — curious_vii · 2026-09-03
- Inference Engineering Is Just a Recipe: vLLM/SGLang, Replicas, Cache-Aware Routing — GabGarrett · 2026-09-03
- Developer accidentally built an entire agent factory with Fable 5.1 — 0xkarasy · 2026-09-03
- Microsoft adds Fabric data agents to Foundry agents via Fabric IQ (preview) — adnan_hashmi · 2026-09-03
- Databricks pitches agent-native data infrastructure, Lakebase Postgres at VLDB 2026 — matei_zaharia · 2026-09-03
- doodlestein ships a comprehensive web app review skill after months of debugging — doodlestein · 2026-09-03