feat(cli): hide workspace policy update dialog and auto-accept by default#20351
Conversation
Summary of ChangesHello @Abhijit-2592, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request streamlines the user experience for the CLI by automating the acceptance of workspace policy updates. It introduces a new configuration flag to control this behavior, defaulting to auto-acceptance, thereby reducing startup friction in interactive mode. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Size Change: +231 B (0%) Total Size: 25.7 MB ℹ️ View Unchanged
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a critical security vulnerability by defaulting to automatically accepting workspace policy updates, which could lead to the silent activation of malicious policies. It is strongly recommended to disable this feature by default, requiring explicit user approval, in line with 'fail-closed' security principles. Additionally, a high-severity concurrency issue has been identified in integrityManager.acceptIntegrity that could lead to data corruption due to a lack of file locking during read-modify-write operations.
Abhijit-2592
force-pushed
the
abhijit-2592/hide-policy-dialogv2
branch
2 times, most recently
from
f64da4a to
5b876cf
Compare
Abhijit-2592
force-pushed
the
abhijit-2592/hide-policy-dialogv2
branch
from
5b876cf to
ff19004
Compare
|
I have reviewed this PR locally. |
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
…ault Introduce automatic acceptance of workspace policies to improve user experience and reduce friction in interactive mode. - Add AUTO_ACCEPT_WORKSPACE_POLICIES flag in policy.ts (defaulting to true). - Update resolveWorkspacePolicyState to automatically accept and load policies when the flag is enabled, matching the existing non-interactive logic. - Add setAutoAcceptWorkspacePolicies setter to allow tests to toggle the behavior. - Update policy.test.ts and workspace-policy-cli.test.ts to verify the new default behavior while maintaining coverage for the manual confirmation flow. This change ensures that users aren't interrupted by policy integrity dialogs while keeping the underlying security infrastructure intact for future use.
Rename AUTO_ACCEPT_WORKSPACE_POLICIES to autoAcceptWorkspacePolicies in policy.ts and update corresponding tests. This aligns with naming conventions for variables that are intended to be modified (e.g., during tests). - Rename variable and update setter in policy.ts. - Update references in policy.test.ts and workspace-policy-cli.test.ts.
Abhijit-2592
force-pushed
the
abhijit-2592/hide-policy-dialogv2
branch
from
ff19004 to
a4b1fb9
Compare
|
/patch preview |
|
✅ Patch workflow(s) dispatched successfully! 📋 Details:
🔗 Track Progress: |
|
🚀 Patch PR Created! 📋 Patch Details:
📝 Next Steps:
🔗 Track Progress: |
3 participants
Summary
Hide the workspace policy update dialog and automatically accept policy changes by default to improve user experience and reduce startup friction in interactive mode.
Details
resolveWorkspacePolicyStateinpackages/cli/src/config/policy.tsto automatically accept and load policies by default in interactive mode. This matches existing non-interactive logic to reduce startup friction.autoAcceptWorkspacePolicies(let) and a correspondingsetAutoAcceptWorkspacePoliciessetter inpolicy.tsto manage workspace policy behavior while maintaining testability.AUTO_ACCEPT_WORKSPACE_POLICIESto camelCaseautoAcceptWorkspacePoliciesto follow naming conventions for mutable variables.policy.test.tsandworkspace-policy-cli.test.tsto verify the new default behavior while maintaining coverage for the manual confirmation flow by toggling the flag via the setter in tests.Related Issues
Fixes #20336
How to Validate
npm test -w @google/gemini-cli -- src/config/policy.test.tsnpm test -w @google/gemini-cli -- src/config/workspace-policy-cli.test.tsnpm run preflightPre-Merge Checklist