Gemini CLI fix scopes untrusted-input checks to external output, cuts repeat prompts
luisfelipe-alt · ghdev · 2026-10-20
A PR in google-gemini/gemini-cli fixes excessive confirmation prompts in YOLO mode.
- Root cause: runshellcommand output was wrapped in <untrustedcontext> tags and indexed together with webfetch/MCP output, so flags/paths appearing in the agent's own command output (pwd, git diff, test-runner usage text) were treated as external input and repeatedly flagged.
- Fix: a new externalTokens set restricts untrusted-flag checks to genuinely external sources (webfetch, websearch, MCP, remote retrieval); in-workspace path arguments are no longer reported, with carve-outs for executables, URLs, and high-risk flags.
- Approvals now persist for the same flags and root commands for the session; the modified-build-file notice clears after approval and resets on session change.
Useful reference for agent security design: distinguishing untrusted external input from the agent's own output without breaking workflows.
More from coding & agent
- Neon ships official AI Gateway adapter for TanStack AI with single-credential multi-model access — matei_zaharia · 2026-10-23
- Reflection AI's Beam agent auto-builds a Gemma-4 fine-tuning notebook, boosting accuracy 66.5% — danielhanchen · 2026-10-23
- Cua Spaces SDK lets Hermes and other agents run in sandboxes on your own hardware — Teknium · 2026-10-23
- PHP hit by two unauthenticated RCE flaws; ProjectDiscovery launches free internet-wide alert service — cyb3rops · 2026-10-23
- Modal open-sources Spindle, a Tinker-compatible training server that charges GPU time instead of tokens — josh_wills · 2026-10-23
- Testing the Azure Cosmos DB Agent Kit: what it found reviewing a Claude-built app, in RUs saved — adnan_hashmi · 2026-10-23