feat: add allowEnv policy option for shell commands by rmedranollamas · Pull Request #24782 · google-gemini/gemini-cli

rmedranollamas · 2026-04-06T20:23:18Z

Summary

This PR introduces the allowEnv (and allow_env) configuration option to the policy engine. This allows users to configure rules that permit the AI model to execute shell commands prefixed with environment variables (e.g., PAGER=cat git commit) without requiring user confirmation. Currently, any command with an environment variable assignment is downgraded to ASK_USER. This change brings environment variable assignments to parity with the existing allowRedirection feature, improving the agent's autonomy while maintaining security.

Details

PolicyRule Interface: Added allowEnv property to PolicyRule and allow_env / allowEnv to the TOML policy schema loader.
AST Parsing: Implemented hasEnvPrefix(command) in packages/core/src/utils/shell-utils.ts using the existing tree-sitter-bash parser. It specifically looks for variable_assignment nodes to ensure robust detection without false positives for inline = characters.
Policy Engine: Updated PolicyEngine.checkShellCommand with a new shouldDowngradeForEnvPrefix check. If an allowed command contains an environment variable prefix but the rule lacks allowEnv: true, the decision is safely downgraded to ASK_USER.
User Approvals: Updated ShellToolInvocation so that when a user persistently approves a command with an environment variable prefix, the generated policy rule will automatically include allowEnv: true.
Tests: Comprehensive tests added across shell-utils.test.ts, policy-engine.test.ts, toml-loader.test.ts, and policy-updater.test.ts.

Related Issues

Closes #24779

How to Validate

Build the project locally with npm run build.
Run the tests in the core package: npm run test -w @google/gemini-cli-core. Ensure policy-engine.test.ts, toml-loader.test.ts, shell-utils.test.ts, and policy-updater.test.ts pass.
Start the CLI and verify you can add an allow_env = true rule to your user policies/user.toml file for a specific command (like git).
Ask the model to execute a command like PAGER=cat git log. It should execute without a confirmation prompt.
Ask the model to execute a command with an environment variable that doesn't have allow_env = true configured. It should safely downgrade to a confirmation prompt.

Pre-Merge Checklist

This adds `allowEnv` to the policy engine, mirroring the behavior of `allowRedirection`. It allows shell commands prefixed with environment variable assignments (e.g. `VAR=value cmd`) to execute without prompting the user if they match a rule with `allowEnv = true`. Also includes tests to verify parsing and enforcement logic. Co-authored-by: rmedranollamas <45878745+rmedranollamas@users.noreply.github.com>

gemini-code-assist · 2026-04-06T20:23:43Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the policy engine by adding support for 'allowEnv', a configuration option that allows the AI to execute shell commands containing environment variable assignments without manual intervention. By leveraging the existing tree-sitter-bash parser for precise detection, this change improves agent autonomy while maintaining security, ensuring that commands requiring environment variables are only executed automatically when explicitly permitted by the user's policy.

Highlights

Policy Engine Enhancement: Introduced the 'allowEnv' policy option to permit shell commands with environment variable prefixes without requiring user confirmation.
Robust Detection: Implemented 'hasEnvPrefix' using the tree-sitter-bash parser to accurately identify variable assignments, replacing simple regex checks.
Automatic Policy Updates: Updated 'ShellToolInvocation' to automatically include 'allowEnv: true' in generated policy rules when a user persistently approves a command with an environment variable prefix.
Security Safeguards: Ensured that commands with environment variable prefixes are safely downgraded to 'ASK_USER' if the 'allowEnv' rule is not explicitly enabled.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a mechanism to detect environment variable prefixes in shell commands and downgrade the policy decision from ALLOW to ASK_USER unless explicitly permitted by a new allowEnv rule property. This change includes updates to the policy engine, type definitions, and shell utility functions, along with corresponding tests. A security concern was identified regarding the hasEnvPrefix implementation, which currently only detects bash-native assignments and misses other methods like the env utility, potentially allowing for policy bypasses.

packages/core/src/utils/shell-utils.ts

rmedranollamas · 2026-04-07T10:24:32Z

@jules ptal

This adds `allowEnv` to the policy engine, mirroring the behavior of `allowRedirection`. It allows shell commands prefixed with environment variable assignments (e.g. `VAR=value cmd`) to execute without prompting the user if they match a rule with `allowEnv = true`. Also includes tests to verify parsing and enforcement logic. Address Code Review Feedback: - Updated `hasEnvPrefix` to detect the use of the `env` command (e.g., `env VAR=val cmd`) - Added tests to verify `env` command detection Co-authored-by: rmedranollamas <45878745+rmedranollamas@users.noreply.github.com>

kschaab · 2026-04-07T15:27:31Z

I think this should not work still, but it would be beneficial to carry inspection for injection in the environment prefix. For example FOO=$(rm /tmp/x.txt) echo "Done".

kschaab

This seems to ignore FOO=bar cmd && cmd2 case where FOO now applies to cmd2.

kschaab · 2026-04-07T15:39:29Z

packages/core/src/policy/policy-engine.test.ts

+
+      expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+


You can use tests for escapes like PAGER="less -X" or PAGER=less\ -X.

kschaab · 2026-04-07T16:02:31Z

test_parse_tree3.js

@@ -0,0 +1,28 @@
+import { initializeShellParsers } from './packages/core/dist/src/utils/shell-utils.js';


Committed by accident?

kschaab · 2026-04-07T16:02:49Z

test_parse_tree4.js

@@ -0,0 +1,28 @@
+import { initializeShellParsers } from './packages/core/dist/src/utils/shell-utils.js';


Looks like leftovers from the agent.

google-labs-jules bot and others added 2 commits April 6, 2026 16:41

rmedranollamas requested review from a team as code owners April 6, 2026 20:23

gemini-code-assist bot reviewed Apr 6, 2026

View reviewed changes

packages/core/src/utils/shell-utils.ts Show resolved Hide resolved

gemini-cli bot added the area/enterprise Issues related to Telemetry, Policy, Quota / Licensing label Apr 6, 2026

kschaab requested changes Apr 7, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add allowEnv policy option for shell commands#24782

feat: add allowEnv policy option for shell commands#24782
rmedranollamas wants to merge 3 commits intogoogle-gemini:mainfrom
rmedranollamas:feat/allow-env-policy-4556651499512846396

rmedranollamas commented Apr 6, 2026

Uh oh!

gemini-code-assist bot commented Apr 6, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

rmedranollamas commented Apr 7, 2026

Uh oh!

kschaab commented Apr 7, 2026

Uh oh!

kschaab left a comment

Uh oh!

kschaab Apr 7, 2026

Uh oh!

kschaab Apr 7, 2026

Uh oh!

kschaab Apr 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -0,0 +1,28 @@
		import { initializeShellParsers } from './packages/core/dist/src/utils/shell-utils.js';

Conversation

rmedranollamas commented Apr 6, 2026

Summary

Details

Related Issues

How to Validate

Pre-Merge Checklist

Uh oh!

gemini-code-assist bot commented Apr 6, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

rmedranollamas commented Apr 7, 2026

Uh oh!

kschaab commented Apr 7, 2026

Uh oh!

kschaab left a comment

Choose a reason for hiding this comment

Uh oh!

kschaab Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

kschaab Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

kschaab Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants