fix(patch): cherry-pick 85566a7 to release/v0.43.0-preview.0-pr-27073 [CONFLICTS]#27256
Conversation
…#27073) # Conflicts: # packages/a2a-server/src/config/config.test.ts
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request implements critical security enhancements for the a2a-server by introducing workspace trust verification and restricting configuration overrides. These changes align the server's policy engine configuration with the existing CLI behavior, ensuring consistent security posture. Additionally, the build process has been updated to include necessary policy assets, supporting reliable bundled execution. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request implements workspace trust verification and default policy loading for the a2a-server to ensure parity with the CLI. Key changes include introducing an isTrusted flag across the configuration and execution flow, updating loadSettings to enforce security-sensitive paths, and adding comprehensive tests for these security features. The review identified critical merge conflict markers in the test files that must be resolved, as well as a potential issue regarding the default policy directory configuration.
| expect((config as any).fileFiltering.customIgnoreFilePaths).toEqual([]); | ||
| }); | ||
|
|
||
| <<<<<<< HEAD |
There was a problem hiding this comment.
Unresolved merge conflict markers detected. This will cause syntax errors and prevent the tests from running. Please resolve the conflicts by removing the markers and ensuring the test blocks are correctly closed.
| respectGitIgnore: false, | ||
| respectGeminiIgnore: undefined, | ||
| customIgnoreFilePaths: [testPath], | ||
| ======= |
There was a problem hiding this comment.
This conflict marker should be replaced with the closing braces for the preceding it block to restore valid syntax.
});
});| undefined, | ||
| true, | ||
| ); | ||
| >>>>>>> 85566a73f (fix(a2a-server): Implement default policy loading for parity with CLI (#27073)) |
There was a problem hiding this comment.
Unresolved merge conflict marker detected. Please remove this line.
| const policyEngineConfig = await createPolicyEngineConfig( | ||
| policySettings, | ||
| approvalMode, | ||
| undefined, |
There was a problem hiding this comment.
The defaultPoliciesDir is passed as undefined. In the A2A server context, this will likely prevent the policy engine from finding and loading the default security policies (such as those allowing read_file), as they are located in a specific directory (dist/policies) relative to the server's execution path. You should provide the explicit path to the policies directory here to ensure parity with the CLI's security model and ensure policy paths are loaded from trusted configuration.
References
- Security-sensitive settings, such as policy paths, must be loaded from trusted configuration and not be overridable by untrusted sources.
gemini-cli
Bot
added
the
status/need-issue
|
Size Change: -4 B (0%) Total Size: 34.1 MB
ℹ️ View Unchanged
|
kschaab
deleted the
hotfix/v0.43.0-preview.0/0.43.0-preview.1/preview/cherry-pick-85566a7/pr-27073
branch
3 participants
This PR automatically cherry-picks commit 85566a7 to patch version v0.43.0-preview.0 in the preview release to create version 0.43.0-preview.1.
This cherry-pick resulted in merge conflicts that need manual resolution.
🔧 Next Steps:
📋 Files with conflicts:
The commit has been created with conflict markers for easier manual resolution.
🚨 Important: