Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a deadlock in Plan Mode where the agent was unable to create plan files due to sandbox restrictions when the target directory did not exist. By implementing proactive host-side directory creation and translating virtual file system commands into native shell operations, the changes ensure that the sandbox environment is correctly prepared for file operations. Additionally, the update improves error propagation to handle missing file scenarios gracefully across different platforms.

Highlights

• Proactive Directory Initialization: Updated EnterPlanModeTool to pre-create the plans directory on the host, ensuring it exists before sandbox binding occurs.
• Virtual Command Translation: Implemented translation for __read and __write commands in both Linux and macOS sandbox managers to use native system tools like cat and sh, bypassing sandbox restrictions.
• Sandbox Binding Improvements: Enhanced LinuxSandboxManager to allow binding the parent directory of non-existent paths, facilitating file creation within sandboxed environments.
• Error Handling: Improved SandboxedFileSystemService to correctly identify and propagate platform-specific ENOENT errors, enabling better handling of new file scenarios.

🧠 Model Steering Guidance

This PR modifies files that affect the model's behavior (prompts, tools, or instructions).

• 🚀 Maintainer Reminder: Please ensure that these changes do not regress results on benchmark evals before merging.

This is an automated guidance message triggered by steering logic signatures.

Size Change: +3.17 kB (+0.01%)

Total Size: 26.5 MB

_{compressed-size-action}

Code Review

Scope: Pull Request #24047

The PR effectively solves the Plan Mode deadlock by creating the .gemini/plans directory on the host and implementing virtual command translations (__read and __write) for SandboxedFileSystemService. This correctly allows file operations to respect granular sandbox policies without failing when parent directories are unmapped. The implementation handles file permission grants for non-existent files safely by recursively resolving to the nearest existing parent directory.

However, there are critical issues with how Windows handles the virtual command arguments that could cause syntax errors or unintended command execution. Additionally, an unrelated change to URL validation has been included.

Metadata Review

The PR Title perfectly aligns with the Conventional Commits format (fix(core): ...). The PR Body provides an excellent, detailed explanation of the problem, the specific changes made across different components, and clear validation steps.

Concerns (Action Required)

• packages/core/src/sandbox/windows/WindowsSandboxManager.ts (PowerShell String Concatenation):
  When -Command is passed a string (instead of a script block), PowerShell concatenates the string and all subsequent arguments with spaces before executing them. This means $args[0] in $Input | Out-File -FilePath $args[0] -Encoding utf8 evaluates to $null (since no arguments are bound to the string), and targetPath is appended to the end of the executed string. If targetPath contains spaces, this will result in a syntax error or a write to the wrong location.
  Suggestion: Wrap the command in a script block and invoke it with the call operator (&) so that targetPath is properly bound to $args[0]:

        args = [
          '-NoProfile',
          '-NonInteractive',
          '-Command',
          '& { $Input | Out-File -FilePath $args[0] -Encoding utf8 }',
          targetPath,
        ];

• packages/core/src/sandbox/windows/WindowsSandboxManager.ts (Cmd.exe Parsing):
  For the __read command, you translate the command to cmd.exe /c type ...args. If the filename contains a & character (which is valid in Windows paths) but no spaces, Node's spawn may pass it unquoted. cmd.exe will interpret the & as a command separator, leading to a sandbox error or unintended execution.
  Suggestion: Use PowerShell for the __read command as well, leveraging the same script block pattern for safe argument passing:

      command = 'PowerShell.exe';
      args = [
        '-NoProfile',
        '-NonInteractive',
        '-Command',
        '& { Get-Content -LiteralPath $args[0] -Raw }',
        args[0] || '',
      ];

• packages/core/src/core/contentGenerator.ts & packages/core/src/core/contentGenerator.test.ts:
  The PR includes a new validateBaseUrl function that strictly enforces HTTPS or localhost for baseUrl. This change appears entirely unrelated to the PR's objective of fixing the Plan Mode deadlock.
  Suggestion: Extract this change into a separate PR to keep this PR atomic and focused, or update the PR description to explicitly mention and justify this addition.

Nits (Minor Suggestions)

• packages/core/src/config/config.ts:
  In the constructor, createSandboxManager is called with workspace: params.targetDir. Since this.targetDir is resolved via path.resolve(params.targetDir) immediately prior, it would be safer and more consistent to pass the fully resolved absolute path (this.targetDir) to the SandboxManager:

      this._sandboxManager = createSandboxManager(
        this.sandbox,
        {
          workspace: this.targetDir, // Use resolved path
          includeDirectories: this.pendingIncludeDirectories,
          policyManager: this._sandboxPolicyManager,
        },
        initialApprovalMode,
      );

One thing I'm curious about is if we turn off tool sandboxing mid-session, what happens? Are the sandbox restrictions still lifted?

One thing I'm curious about is if we turn off tool sandboxing mid-session, what happens? Are the sandbox restrictions still lifted?

No Require to restart.