Gemini CLI PR blocks mutating tool calls at scheduler layer to enforce user 'hold' directives
dylanyunlon · ghdev · 2026-09-18
A P1-sized PR (#29394) on google-gemini/gemini-cli addresses an aggressive action-bias: even when users say 'wait', 'explain first' or 'don't apply fixes yet', the agent still fires destructive tool calls (replace, writefile, runshellcommand). Prompt-level instructions alone fail because RLHF completion bias overwhelms attention on negative constraints.
The fix enforces holds programmatically at the scheduler layer:
- Directive detection service: 14 regex patterns across 4 directive types (EXPLICITWAIT, EXPLAINONLY, NOCHANGESYET, REVIEWFIRST), with negation guards against false positives and confidence scores of 0.8–0.95
- Hold directive guard: blocks only mutating tools (writefile, replace, runshellcommand, writetodos, invokeagent); read-only tools like readfile, grep, glob and websearch stay available for continued investigation
- Blocked calls return a structured [HOLD DIRECTIVE ACTIVE] error; both headless execution paths are covered and the system prompt documents the enforcement
More from coding & agent
- Teknium: Jev can't compact context well — Hermes summarizes 95% of it away — Teknium · 2026-09-20
- HarnessRouter open-sources a unified API to run Codex, Claude Code and more as agent backends — daniel_mac8 · 2026-09-20
- HarnessRouter: routing agent harnesses instead of models, a fresh infra idea — daniel_mac8 · 2026-09-20
- GameToMac launched 10 days ago and already runs AoE IV, CS2 and Diablo IV on Apple Silicon — nickbaumann_ · 2026-09-20
- DialKit 2.0 ships: open-source real-time UI tuning tool with prompts for coding agents — LinusEkenstam · 2026-09-20
- Jev loses to Gemini on 1,565-email classification benchmark, but dev still wants it in production — socialwithaayan · 2026-09-20