fix(core): simplify plan mode write policy to support relative paths#28398
Conversation
|
📊 PR Size: size/M
|
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request updates the Plan Mode file-writing policy to resolve nightly build failures caused by strict path matching. By simplifying the regex pattern to focus on the file extension rather than specific directory structures, the system becomes more resilient to relative paths and varied environment configurations while maintaining security through existing tool-level validation. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request simplifies the file path matching pattern for the write_file and replace tools in plan.toml to allow any .md file. The reviewer identified a high-severity security risk, noting that this change removes a critical defense-in-depth boundary and could allow path traversal or arbitrary markdown file overwrites. A consolidated regex pattern was suggested to safely restrict paths while maintaining policy enforcement.
Note: Security Review has been skipped due to the limited scope of the PR.
|
Size Change: -4 B (0%) Total Size: 35.2 MB
ℹ️ View Unchanged
|
gemini-cli
Bot
added
the
status/need-issue
2 participants
Summary
This PR simplifies the Plan Mode file-writing policy rule in
plan.tomlto match any.mdfile path. This resolves nightly build failures inplan-mode.test.tswhere the LLM generated a relative path or paths with unexpected characters that failed to match the overly restrictive subdirectory regex.Details
.../.gemini/tmp/<session-id>/plans/...). When the live LLM generated a relative path (e.g.plan.md) or when temporary paths used in the environment contained different characters, the policy engine blocked the tool call, causing the integration tests to fail.argsPatternfor the allow rule ofwrite_file/replaceinplan.tomlto match any.mdfile path:\0"file_path":"[^\"]+\.md"\0.WriteFileandEdittools themselves strictly validate and restrict any write operation to the designated plans directory (resolveAndValidatePlanPaththrows an error for any path outside the boundary). Therefore, delegating the subdirectory boundary check to the tool itself and having the policy engine strictly verify the.mdfile extension is completely secure, robust, and highly reliable.Related Issues
Fixes the
plan-mode.test.ts > Plan Mode > should allow write_file to the plans directory in plan modenightly build failure.How to Validate
npm run test:integration:sandbox:none -- -t "Plan Mode"Pre-Merge Checklist