Gemini CLI PR Fixes Flaw Leting Tainted Shell Commands Save Always-Allow Rules
kanchinadd98 · ghdev · 2026-11-07
google-gemini/gemini-cli PR #30196 fixes a security bug: choosing "Always allow" on a tainted shell command (untrusted flags, or after build files changed) still saved a session or persistent allow rule for the command root — e.g. one approval whitelisted all future npm ... commands.
Key changes:
- The scheduler no longer publishes UPDATEPOLICY when confirmation details carry untrustedFlags or modifiedBuildFiles
- ACP clients now only offer proceed-once and cancel for such commands
- The fix captures confirmation details at prompt time, since the tool's own risk check runs after flags are acknowledged
New test cases in policy.test.ts and acpUtils.test.ts verify the behavior.
More from coding & agent
- Gemini /teamwork agents caught live: four parallel task logs all running that second — RyanSpunk · 2026-11-13
- Codex CLI 0.168.0 adds model provider picker, side-by-side TUI workspace and animated GIF generation — github-actions[bot] · 2026-11-13
- Free MCP server lets Claude read Altium, Allegro, KiCad and Gerber PCB files directly — woodisruff · 2026-11-13
- a16z Partner Clones Open-Source Game with Fable 5.2 Agent, Which Finds Its Own Horse Animation Asset — FinanceYF5 · 2026-11-13
- OpenAI team shares how it runs and governs fleets of persistent agents internally — romainhuet · 2026-11-13
- Perplexity's Decider scanned 1B tokens across 7,000 agent sessions, found 14 security fixes — denisyarats · 2026-11-13