Gemini CLI PR fixes sandbox: trap-wrapped commands broke per-command permission rules
MauroDruwel · ghdev · 2026-10-13
A PR (#29726) for google-gemini/gemini-cli fixes a bug where per-command rules in sandbox.toml and session permission approvals were never applied on POSIX (Linux/macOS).
Root cause: the shell tool wraps user commands in a subshell with an EXIT trap to track background jobs, but the root filter only skipped shopt and set, so the command name resolved to trap instead of the actual tool — causing configured rules like [commands.gradlew] to miss, and sandboxed runs to fail with read-only filesystem or missing network errors.
The fix centralizes IGNOREDCOMMANDROOTS = {'shopt', 'set', 'trap'} in shell-utils.ts, applies it consistently across Linux/macOS/Windows sandbox managers and command-name resolution, deduplicates helpers, and adds unit tests covering wrapped commands and per-command permissions.
More from coding & agent
- Running tens of millions of experiments on useless programs with LLMs — bushibuilds · 2026-10-13
- Xiryn: Open-Source Personal Agent with Docker Sandboxes and Telegram Control — Scobleizer · 2026-10-13
- Witness Tracks Everything You Do and See So Your Agents Always Have Context — Scobleizer · 2026-10-13
- MecAgent 2.0 launches as its maker claims 'CAD is about to get solved' — Scobleizer · 2026-10-13
- Dev finds ~25% of AI-generated code introduces regressions in .NET 8+ — lucasmeijer · 2026-10-13
- Investor says coding agents left most software firms badly overstaffed, cut now or be disrupted — doodlestein · 2026-10-13