fix(core): enable global session and persistent approval for web_fetch#23295
fix(core): enable global session and persistent approval for web_fetch#23295NTaylorMullen merged 4 commits intomainfrom
Conversation
- Rename SENSITIVE_TOOLS to TOOLS_REQUIRING_NARROWING to better reflect its function of enforcing mandatory argument narrowing. - Remove web_fetch from the mandatory narrowing list. - Update web_fetch to explicitly support global approval for both session-wide and persistent rules. - Add web_fetch to auto-edit allow list in write.toml.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses a regression that prevented the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
|
Size Change: -219 B (0%) Total Size: 26.1 MB
ℹ️ View Unchanged
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
The changes effectively address the regression where web_fetch could not be approved globally for a session or persistently without argument narrowing. The renaming of SENSITIVE_TOOLS to TOOLS_REQUIRING_NARROWING improves clarity, and the removal of web_fetch from this list, combined with the updated getPolicyUpdateOptions method, correctly implements the desired behavior. The addition of web_fetch to the autoEdit allow-list in write.toml is also consistent with the goal of making this tool more broadly usable.
gemini-cli
bot
added
area/agent
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
spencer426
left a comment
spencer426
left a comment
There was a problem hiding this comment.
The PR modifies getPolicyUpdateOptions in web-fetch.ts but does not add or update any unit tests in web-fetch.test.ts
- Fix priority in write.toml to match documented tiers (100 -> 15). - Simplify getPolicyUpdateOptions in web-fetch.ts by removing unreachable narrowing fallback. - Add unit tests for getPolicyUpdateOptions in web-fetch.test.ts. - Remove unused import of buildParamArgsPattern.
google-gemini#23295) Co-authored-by: Spencer <spencertang@google.com>
2 participants
Summary
Fixes the regression where "Allow for this session" for the
web_fetchtool was not being respected. This was caused byweb_fetchbeing included in theSENSITIVE_TOOLSlist, which strictly requires argument-narrowing patterns (like a URL) for any session-wide or persistent approval.Details
SENSITIVE_TOOLStoTOOLS_REQUIRING_NARROWING: This more accurately reflects the list's function in the policy engine—enforcing mandatory argument narrowing for powerful tools.web_fetchfrom the narrowing list: This allowsweb_fetchto be approved globally for a session or persistently without being blocked by the mandatory narrowing check, similar toactivate_skill.web_fetch: Explicitly opted into the global approval model for bothProceedAlways(session) andProceedAlwaysAndSave(persistent).web_fetchto theauto_editallow-list inwrite.tomlfor consistency with other modification tools.Related Issues
Related to PR #22217 (which introduced the regression).
How to Validate
web_fetchcall (e.g., "fetch google.com").web_fetchto a different URL (e.g., "fetch example.com").argsPattern.Pre-Merge Checklist