fix(cli): guard customDeepMerge against circular references

[vedhakoushik]

What

Fixes #28270. customDeepMerge's mergeRecursively recursed into nested plain objects with no cycle tracking, so a settings object containing a circular reference (e.g. obj.self = obj) caused unbounded recursion and crashed the settings manager with RangeError: Maximum call stack size exceeded, breaking CLI initialization until the user manually scrubbed their config.

The repo already documented this limitation with a test in settings.test.ts that asserted the crash (.toThrow(/Maximum call stack size exceeded/)).

Fix

packages/cli/src/utils/deepMerge.ts — track the chain of source objects currently being merged in a WeakSet, added on entry and removed on exit so it represents only the current ancestor path (not already-processed siblings). When a source value is a circular reference back to an ancestor, assign it by reference instead of recursing.

This is deliberately scoped so that shared-but-non-circular references (DAGs) still merge normally — only true cycles are short-circuited.

Tests

• deepMerge.test.ts: added regression tests for self-reference (obj.self = obj), mutual/indirect cycles (a → b → a), and a shared non-circular reference (DAG) to guard against over-eager short-circuiting.
• settings.test.ts: flipped the existing circular-reference test from asserting the crash to asserting it no longer throws.

Verification

• deepMerge.test.ts — 20/20 pass (4 new)
• settings.test.ts circular-reference test — passes
• eslint, tsc --noEmit, and prettier --check all clean on the changed files

---

🤖 Authored with Claude Code. First-time contributor here — happy to adjust the cycle-handling behavior (e.g. omit vs. assign-by-reference) to match maintainer preference.

[github-actions]

📊 PR Size: size/M

• Lines changed: 85
• Additions: +79
• Deletions: -6
• Files changed: 3

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[vedhakoushik]

@googlebot I signed it!

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical issue where circular references in configuration objects caused unbounded recursion and stack overflow crashes in the CLI's settings manager. By introducing a cycle-tracking mechanism using a WeakSet during the deep merge process, the fix allows the system to gracefully handle circular structures by assigning them by reference instead of recursing, while maintaining correct behavior for non-circular shared references.

Highlights

• Circular Reference Handling: Implemented a WeakSet-based tracking mechanism in customDeepMerge to detect and handle circular references during object merging, preventing stack overflow errors.
• Regression Testing: Added comprehensive test cases for self-referential objects, mutual circular references, and DAGs to ensure robust handling and prevent regressions.
• Settings Manager Stability: Updated existing settings tests to verify that circular references in configuration objects no longer cause the CLI to crash.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces circular reference handling to customDeepMerge to prevent stack overflow errors when merging self-referential or mutually circular objects, using a WeakSet to track visited source objects during recursion. The review feedback suggests using a clones map instead of a WeakSet to ensure that circular references are preserved within the newly cloned structure rather than pointing back to the original source objects, and provides corresponding updates to the test assertions.

[gemini-code-assist]

Retrieve the cloned ancestor from the clones map instead of assigning the original srcValue directly.

Suggested change

	if (isPlainObject(srcValue) && seen.has(srcValue)) {
	// Circular reference back to an ancestor source object: assign the
	// reference directly instead of recursing to avoid infinite recursion.
	target[key] = srcValue;
	continue;
	}
	if (isPlainObject(srcValue) && clones.has(srcValue)) {
	// Circular reference back to an ancestor source object: assign the
	// cloned reference directly instead of recursing to avoid infinite recursion
	// and reference sharing with the original source object.
	target[key] = clones.get(srcValue)!;
	continue;
	}

[vedhakoushik]

Done in 11948e9. Switched from a WeakSet of visited sources to a Map<source, clone>, and on a circular reference now assign the ancestor's clone so the merge produces a fully independent clone (result.self === result) rather than embedding a reference to the original source. Used a lint-safe ancestorClone !== undefined check instead of a non-null assertion.

[gemini-code-assist]

Delete the source from the clones map on exit.

Suggested change

	seen.delete(source);
	clones.delete(source);

[vedhakoushik]

Done in 11948e9 — clones.delete(source) on exit.

[gemini-code-assist]

Update the test assertion to verify that the circular reference is preserved within the cloned structure, rather than pointing back to the original source object.

Suggested change

	const result = customDeepMerge(getMergeStrategy, {}, circular);
	expect(result['a']).toBe(1);
	// The cycle is preserved by reference rather than recursed into.
	expect(result['self']).toBe(circular);
	const result = customDeepMerge(getMergeStrategy, {}, circular);
	expect(result['a']).toBe(1);
	// The cycle is preserved within the cloned structure rather than pointing back to the source.
	expect(result['self']).toBe(result);

[vedhakoushik]

Done in 11948e9. The assertion now checks expect(result['self']).toBe(result) (plus .not.toBe(circular)), and I strengthened the mutual-cycle test to assert result.b.a === result.

[vedhakoushik]

@googlebot I signed it!

[vedhakoushik]

Superseded by #28387 — same fix, clean re-submission without the Co-Authored-By trailer that was blocking the CLA check.