fix(core): resolve windows symlink bypass and stabilize sandbox integration tests by ehedlund · Pull Request #24834 · google-gemini/gemini-cli

ehedlund · 2026-04-07T15:24:13Z

Summary

This PR resolves persistent flakiness and 60-second timeouts in the sandboxManager.integration.test.ts suite on Windows CI runners, and fixes a critical vulnerability where Windows sandboxed processes could bypass forbiddenPaths restrictions by accessing files via symlinks.

To achieve this, we optimized the test workspace isolation strategy and fundamentally refactored how the sandbox manages path resolution across all operating systems to ensure symlink targets are explicitly evaluated and secured.

Details

1. Centralized Path Resolution Architecture:

Introduced ResolvedSandboxPaths, a structured interface that acts as the "Source of Truth" for all sandbox boundaries (workspace, global includes, policy-allowed paths, and dynamic read/write permissions).
Refactored resolveSandboxPaths to centralize all symlink expansion, absolute path enforcement, and deduplication logic. Every path category now automatically yields both the symlink and its real target, preventing bypasses across all OS sandbox engines.
Streamlined WindowsSandboxManager to fully consume the pre-resolved struct, eliminating redundant local loops and improving the robustness of ACL applications (e.g., distinguishing between files and directories for inheritance flags).
Note: macOS and Linux managers have been minimally updated to consume the new interface fields. A follow-up PR will fully refactor their internal profile builders to remove remaining redundant path logic.

2. Stabilized Sandbox Integration Tests:

Isolated Workspaces: Replaced process.cwd() with isolated temporary directories. This prevents false positives and massively speeds up icacls execution on Windows runners by using os.tmpdir().
Standardized Execution: Eliminated dependencies on native shell utilities (powershell.exe, touch, curl). The Platform test helper now exclusively uses process.execPath (node -e), which resolved a specific Windows hang caused by launching powershell.exe from the %TEMP% directory with a Low Mandatory Level token.
Refined Assertions: Split read/write inheritance tests into distinct assertions and added an assertResult helper to bundle command context directly into failure messages.

Related Issues

How to Validate

Ensure you are on a Windows machine or VM.
Run the core integration tests: npm test -w @google/gemini-cli-core -- src/services/sandboxManager.integration.test.ts
Verify that all tests pass rapidly (without 60s timeouts) and that the test output confirms the symlink write-block assertions are succeeding.
Run npm run preflight to ensure cross-platform path resolution typing is fully sound.

Pre-Merge Checklist

gemini-cli · 2026-04-07T15:24:34Z

Hi @ehedlund, thank you so much for your contribution to Gemini CLI! We really appreciate the time and effort you've put into this.

We're making some updates to our contribution process to improve how we track and review changes. Please take a moment to review our recent discussion post: Improving Our Contribution Process & Introducing New Guidelines.

Key Update: Starting January 26, 2026, the Gemini CLI project will require all pull requests to be associated with an existing issue. Any pull requests not linked to an issue by that date will be automatically closed.

Thank you for your understanding and for being a part of our community!

github-actions · 2026-04-07T15:29:35Z

Size Change: +1.14 kB (0%)

Total Size: 34 MB

Filename	Size	Change
`./bundle/chunk-N5XQ3T2L.js`	0 B	-3.16 MB (removed)	🏆
`./bundle/chunk-TM32B5P4.js`	0 B	-14.8 MB (removed)	🏆
`./bundle/core-EKTGXYQG.js`	0 B	-45.5 kB (removed)	🏆
`./bundle/devtoolsService-DX5MBUTI.js`	0 B	-28.4 kB (removed)	🏆
`./bundle/interactiveCli-F3CYUOF2.js`	0 B	-1.65 MB (removed)	🏆
`./bundle/oauth2-provider-YVSA66HC.js`	0 B	-9.16 kB (removed)	🏆
`./bundle/chunk-WNGFM6M3.js`	3.16 MB	+3.16 MB (new file)	🆕
`./bundle/chunk-YOF7EIGU.js`	14.8 MB	+14.8 MB (new file)	🆕
`./bundle/core-KQYTZQED.js`	45.5 kB	+45.5 kB (new file)	🆕
`./bundle/devtoolsService-4OZWAJXC.js`	28.4 kB	+28.4 kB (new file)	🆕
`./bundle/interactiveCli-G6NVY35S.js`	1.65 MB	+1.65 MB (new file)	🆕
`./bundle/oauth2-provider-IR4XIISW.js`	9.16 kB	+9.16 kB (new file)	🆕

ℹ️ View Unchanged

Filename	Size
`./bundle/bundled/third_party/index.js`	8 MB
`./bundle/chunk-34MYV7JD.js`	2.45 kB
`./bundle/chunk-5AUYMPVF.js`	858 B
`./bundle/chunk-5PS3AYFU.js`	1.18 kB
`./bundle/chunk-664ZODQF.js`	124 kB
`./bundle/chunk-DAHVX5MI.js`	206 kB
`./bundle/chunk-IUUIT4SU.js`	56.5 kB
`./bundle/chunk-OGWWODAT.js`	1.96 MB
`./bundle/chunk-RJTRUG2J.js`	39.8 kB
`./bundle/devtools-36NN55EP.js`	696 kB
`./bundle/dist-T73EYRDX.js`	356 B
`./bundle/events-XB7DADIJ.js`	418 B
`./bundle/gemini.js`	554 kB
`./bundle/getMachineId-bsd-TXG52NKR.js`	1.55 kB
`./bundle/getMachineId-darwin-7OE4DDZ6.js`	1.55 kB
`./bundle/getMachineId-linux-SHIFKOOX.js`	1.34 kB
`./bundle/getMachineId-unsupported-5U5DOEYY.js`	1.06 kB
`./bundle/getMachineId-win-6KLLGOI4.js`	1.72 kB
`./bundle/memoryDiscovery-JNNGTYL3.js`	980 B
`./bundle/multipart-parser-KPBZEGQU.js`	11.7 kB
`./bundle/node_modules/@google/gemini-cli-devtools/dist/client/main.js`	222 kB
`./bundle/node_modules/@google/gemini-cli-devtools/dist/src/_client-assets.js`	229 kB
`./bundle/node_modules/@google/gemini-cli-devtools/dist/src/index.js`	13.4 kB
`./bundle/node_modules/@google/gemini-cli-devtools/dist/src/types.js`	132 B
`./bundle/sandbox-macos-permissive-open.sb`	890 B
`./bundle/sandbox-macos-permissive-proxied.sb`	1.31 kB
`./bundle/sandbox-macos-restrictive-open.sb`	3.36 kB
`./bundle/sandbox-macos-restrictive-proxied.sb`	3.56 kB
`./bundle/sandbox-macos-strict-open.sb`	4.82 kB
`./bundle/sandbox-macos-strict-proxied.sb`	5.02 kB
`./bundle/src-QVCVGIUX.js`	47 kB
`./bundle/tree-sitter-7U6MW5PS.js`	274 kB
`./bundle/tree-sitter-bash-34ZGLXVX.js`	1.84 MB

_{compressed-size-action}

github-actions · 2026-04-07T15:43:31Z

✅ 62 tests passed successfully on gemini-3-flash-preview.

🧠 Model Steering Guidance

This PR modifies files that affect the model's behavior (prompts, tools, or instructions).

⚠️ Consider adding Evals: No behavioral evaluations (evals/*.eval.ts) were added or updated in this PR. Consider adding a test case to verify the new behavior and prevent regressions.
🚀 Maintainer Reminder: Please ensure that these changes do not regress results on benchmark evals before merging.

This is an automated guidance message triggered by steering logic signatures.

DavidAPierce

LGMT. I also ran it through the CLI and got a minor nit from it, here's its full review if you want it:

Summary:
This PR significantly improves the reliability and execution speed of the sandboxManager.integration.test.ts suite. The primary fix correctly identifies that the previous approach of sandboxing against process.cwd() was
extremely slow on Windows, causing Vitest timeouts. It replaces this with a much cleaner tracking mechanism using isolated, platform-appropriate temporary directories and introduces a robust assertResult helper.

Findings:

Correctness & Efficiency: The core fix is excellent. By using os.tmpdir() for Windows and Linux, the sandbox no longer attempts to evaluate or lock down the entire massive monorepo during every single command
iteration (which was spawning slow recursive operations). The fallback to process.cwd() uniquely for macOS is a smart workaround for Apple's Seatbelt profiles, which implicitly allow access to the global temp folder
and would thus generate false positives in these tests.
Maintainability & Readability: The introduction of the assertResult helper drastically improves test failure diagnostics. By printing the command, cwd, expected/actual status, and conditional stdout/stderr only when
relevant, you've ensured that future CI flakes will actually have actionable context rather than a generic "expected 0, got 1" message.
Cleanup & Testability: Tracking generated tempDirectories in an array and utilizing afterAll to clean them up is good practice and prevents temporary file accumulation on CI runners.

Improvements:

(Minor) In the afterAll block cleanup, fs.rmSync(dir, { recursive: true, force: true }) handles the deletion perfectly. The enclosing fs.existsSync(dir) check is technically redundant since force: true inherently
ignores the error if the directory doesn't exist, but it doesn't harm anything.

Conclusion: Approved ✅
The logic is sound, explicitly targets the identified flake, significantly improves test speed/robustness on Windows, and leaves behind far superior diagnostic logging for future debugging. All CI and preflight checks
passed perfectly.

This commit resolves a 60,000ms Vitest timeout on Windows CI by completely refactoring the test setup. It abandons the use of process.cwd() as the sandbox workspace, preventing the WindowsSandboxManager from performing an expensive deep scan of the entire git repository and launching dozens of slow icacls.exe processes on every sandboxed command execution. Instead, it introduces a clean createTempDir helper that creates isolated temporary directories and tracks them for automatic cleanup. Crucially, it dynamically routes these test directories to os.tmpdir() on Windows/Linux for maximum icacls performance, but forces them into process.cwd() on macOS to prevent false positives caused by the OS implicitly whitelisting the system temporary directory for tool execution. Finally, it introduces a lean assertResult helper that immediately evaluates the expected command status and conditionally appends stdout/stderr to the error output only if they aren't empty, providing cleaner diagnostic context for future flakes.

…ross-platform sandbox tests This commit completely eliminates all dependencies on native shell utilities (powershell.exe, cmd.exe, bash, touch, curl, cat, echo) within the sandbox integration tests by refactoring the Platform helper to exclusively use process.execPath (Node.js) with inline scripts. This approach guarantees consistent cross-platform behavior, avoids shell parsing quirks, and ensures sandbox denial exceptions reliably translate to non-zero exit codes. Most importantly, avoiding powershell.exe bypasses a severe hang issue when launching a Low Mandatory Level token from within the Windows %TEMP% directory. This allows us to safely route the Windows test workspace back to os.tmpdir() (which is lightning fast for icacls) rather than process.cwd(), definitively resolving the 60,000ms Vitest timeout flake on CI.

…aths

…ration tests (google-gemini#24834)

* refactor(plan): simplify policy priorities and consolidate read-only rules (google-gemini#24849) * feat(test-utils): add memory usage integration test harness (google-gemini#24876) * feat(memory): add /memory inbox command for reviewing extracted skills (google-gemini#24544) * chore(release): bump version to 0.39.0-nightly.20260408.e77b22e63 (google-gemini#24939) * fix(core): ensure robust sandbox cleanup in all process execution paths (google-gemini#24763) Co-authored-by: Spencer <spencertang@google.com> * chore: update ink version to 6.6.8 (google-gemini#24934) * Changelog for v0.38.0-preview.0 (google-gemini#24938) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> Co-authored-by: g-samroberts <samroberts@google.com> * chore: ignore conductor directory (google-gemini#22128) Co-authored-by: Coco Sheng <cocosheng@google.com> * Changelog for v0.37.0 (google-gemini#24940) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> Co-authored-by: Sam Roberts <158088236+g-samroberts@users.noreply.github.com> * feat(plan): require user confirmation for activate_skill in Plan Mode (google-gemini#24946) * feat(test-utils): add CPU performance integration test harness (google-gemini#24951) * fix(core): resolve windows symlink bypass and stabilize sandbox integration tests (google-gemini#24834) * test(sdk): add unit tests for GeminiCliSession (google-gemini#21897) * fix(cli): restore file path display in edit and write tool confirmations (google-gemini#24974) * fix(cli-ui): enable Ctrl+Backspace for word deletion in Windows Terminal (google-gemini#21447) * fix(core): dynamic session ID injection to resolve resume bugs (google-gemini#24972) * Update ink version to 6.6.9 (google-gemini#24980) * feat(core): refine shell tool description display logic (google-gemini#24903) * Generalize evals infra to support more types of evals, organization and queuing of named suites (google-gemini#24941) * fix(cli): optimize startup with lightweight parent process (google-gemini#24667) * refactor(sandbox): use centralized sandbox paths in macOS Seatbelt implementation (google-gemini#24984) * feat(cli): refine tool output formatting for compact mode (google-gemini#24677) * fix(sdk): skip broken sendStream tests to unblock nightly (google-gemini#25000) * refactor(core): use centralized path resolution for Linux sandbox (google-gemini#24985) * Support ctrl+shift+g (google-gemini#25035) * feat(core): refactor subagent tool to unified invoke_subagent tool (google-gemini#24489) * fix(core): add explicit git identity env vars to prevent sandbox checkpointing error (google-gemini#19775) Co-authored-by: David Pierce <davidapierce@google.com> * fix: respect hideContextPercentage when FooterConfigDialog is closed without changes (google-gemini#24773) Co-authored-by: Coco Sheng <cocosheng@google.com> * fix(cli): suppress unhandled AbortError logs during request cancellation (google-gemini#22621) * Automated documentation audit (google-gemini#24567) * feat(cli): implement useAgentStream hook (google-gemini#24292) Co-authored-by: Adam Weidman <adamfweidman@gmail.com> Co-authored-by: Adam Weidman <adamfweidman@google.com> * refactor(core): remove legacy subagent wrapping tools (google-gemini#25053) * refactor(plan) Clean default plan toml (google-gemini#25037) * fix(core): honor retryDelay in RetryInfo for 503 errors (google-gemini#25057) * fix(core): remediate subagent memory leaks using AbortSignal in MessageBus (google-gemini#25048) * feat(cli): wire up useAgentStream in AppContainer (google-gemini#24297) Co-authored-by: Adam Weidman <adamfweidman@gmail.com> Co-authored-by: Adam Weidman <adamfweidman@google.com> * feat(core): migrate chat recording to JSONL streaming (google-gemini#23749) * fix(core): clear 5-minute timeouts in oauth flow to prevent memory leaks (google-gemini#24968) * fix(sandbox): centralize async git worktree resolution and enforce read-only security (google-gemini#25040) * feat(test): add high-volume shell test and refine perf harness (google-gemini#24983) * fix(core): silently handle EPERM when listing dir structure (google-gemini#25066) * Changelog for v0.37.1 (google-gemini#25055) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> * fix: decode Uint8Array and multi-byte UTF-8 in API error messages (google-gemini#23341) Co-authored-by: Coco Sheng <cocosheng@google.com> * Automated documentation audit results (google-gemini#22755) * debugging(ui): add optional debugRainbow setting (google-gemini#25088) * fix: resolve lifecycle memory leaks by cleaning up listeners and root closures (google-gemini#25049) * docs(cli): updates f12 description to be more precise (google-gemini#15816) * fix(cli): mark /settings as unsafe to run concurrently (google-gemini#25061) * fix(core): remove buffer slice to prevent OOM on large output streams (google-gemini#25094) * feat(core): persist subagent agentId in tool call records (google-gemini#25092) * chore(core): increase codebase investigator turn limits to 50 (google-gemini#25125) * refactor(core): consolidate execute() arguments into ExecuteOptions (google-gemini#25101) * feat(core): add Strategic Re-evaluation guidance to system prompt (google-gemini#25062) * fix(core): preserve shell execution config fields on update (google-gemini#25113) * docs: add vi shortcuts and clarify MCP sandbox setup (google-gemini#21679) Co-authored-by: Jenna Inouye <jinouye@google.com> * fix(cli): pass session id to interactive shell executions (google-gemini#25114) * fix(cli): resolve text sanitization data loss due to C1 control characters (google-gemini#22624) * feat(core): add large memory regression test (google-gemini#25059) * fix(core): resolve PTY exhaustion and orphan MCP subprocess leaks (google-gemini#25079) * chore: switch from keytar to @github/keytar (google-gemini#25143) * chore(deps): update vulnerable dependencies via npm audit fix (google-gemini#25140) * perf(sandbox): optimize Windows sandbox initialization via native ACL application (google-gemini#25077) * fix: improve audio MIME normalization and validation in file reads (google-gemini#21636) Co-authored-by: Coco Sheng <cocosheng@google.com> * docs: Update docs-audit to include changes in PR body (google-gemini#25153) * docs: correct documentation for enforced authentication type (google-gemini#25142) * fix(cli): exclude update_topic from confirmation queue count (google-gemini#24945) * Memory fix for trace's streamWrapper. (google-gemini#25089) * fix(core): fix quota footer for non-auto models and improve display (google-gemini#25121) * docs(contributing): clarify self-assignment policy for issues (google-gemini#23087) * feat(core): add skill patching support with /memory inbox integration (google-gemini#25148) * Stop suppressing thoughts and text in model response (google-gemini#25073) * fix(release): prefix git hash in nightly versions to prevent semver normalization (google-gemini#25304) * feat(cli): extract QuotaContext and resolve infinite render loop (google-gemini#24959) * refactor(core): extract and centralize sandbox path utilities (google-gemini#25305) Co-authored-by: David Pierce <davidapierce@google.com> * feat(ui): added enhancements to scroll momentum (google-gemini#24447) * fix(core): replace custom binary detection with isbinaryfile to correctly handle UTF-8 (U+FFFD) (google-gemini#25297) * feat(agent): implement tool-controlled display protocol (Steps 2-3) (google-gemini#25134) * Stop showing scrollbar unless we are in terminalBuffer mode (google-gemini#25320) * fix(core): expose GEMINI_PLANS_DIR to hook environment (google-gemini#25296) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * feat: support auth block in MCP servers config in agents (google-gemini#24770) * feat(core): implement silent fallback for Plan Mode model routing (google-gemini#25317) * fix: correct redirect count increment in fetchJson (google-gemini#24896) Co-authored-by: Tommaso Sciortino <sciortino@gmail.com> * fix(core): prevent secondary crash in ModelRouterService finally block (google-gemini#25333) * feat(core): introduce decoupled ContextManager and Sidecar architecture (google-gemini#24752) * docs(core): update generalist agent documentation (google-gemini#25325) * chore(mcp): check MCP error code over brittle string match (google-gemini#25381) * test(core): improve sandbox integration test coverage and fix OS-specific failures (google-gemini#25307) Co-authored-by: David Pierce <davidapierce@google.com> * feat(plan): update plan mode prompt to allow showing plan content (google-gemini#25058) * fix(core): use debug level for keychain fallback logging (google-gemini#25398) * feat(test): add a performance test in asian language (google-gemini#25392) * feat(cli): enable mouse clicking for cursor positioning in AskUser multi-line answers (google-gemini#24630) * fix(core): detect kmscon terminal as supporting true color (google-gemini#25282) Co-authored-by: Adib234 <30782825+Adib234@users.noreply.github.com> Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * ci: add agent session drift check workflow (google-gemini#25389) * use macos-latest-large runner where applicable. (google-gemini#25413) * Changelog for v0.37.2 (google-gemini#25336) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> * chore(release): v0.39.0-preview.0 * fix(patch): cherry-pick a4e98c0 to release/v0.39.0-preview.0-pr-25138 to patch version v0.39.0-preview.0 and create version 0.39.0-preview.1 (google-gemini#25766) Co-authored-by: Mahima Shanware <mahima.shanware@gmail.com> * chore(release): v0.39.0-preview.1 * fix(patch): cherry-pick d6f88f8 to release/v0.39.0-preview.1-pr-25670 to patch version v0.39.0-preview.1 and create version 0.39.0-preview.2 (google-gemini#25776) Co-authored-by: Adam Weidman <65992621+adamfweidman@users.noreply.github.com> * chore(release): v0.39.0-preview.2 * chore(release): v0.39.0 --------- Co-authored-by: ruomeng <ruomeng@google.com> Co-authored-by: Sri Pasumarthi <111310667+sripasg@users.noreply.github.com> Co-authored-by: Sandy Tao <sandytao520@icloud.com> Co-authored-by: gemini-cli-robot <gemini-cli-robot@google.com> Co-authored-by: Emily Hedlund <ehedlund@google.com> Co-authored-by: Spencer <spencertang@google.com> Co-authored-by: Jacob Richman <jacob314@gmail.com> Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> Co-authored-by: g-samroberts <samroberts@google.com> Co-authored-by: JAYADITYA <96861162+JayadityaGit@users.noreply.github.com> Co-authored-by: Coco Sheng <cocosheng@google.com> Co-authored-by: Sam Roberts <158088236+g-samroberts@users.noreply.github.com> Co-authored-by: Adamya Singh <adamyasingh54@gmail.com> Co-authored-by: Jarrod Whelan <150866123+jwhelangoog@users.noreply.github.com> Co-authored-by: dogukanozen <dogukannozen@hotmail.com> Co-authored-by: Tommaso Sciortino <sciortino@gmail.com> Co-authored-by: Christian Gunderman <gundermanc@google.com> Co-authored-by: Sehoon Shon <sshon@google.com> Co-authored-by: Abhi <43648792+abhipatel12@users.noreply.github.com> Co-authored-by: MD. MOHIBUR RAHMAN <35300157+mrpmohiburrahman@users.noreply.github.com> Co-authored-by: David Pierce <davidapierce@google.com> Co-authored-by: chernistry <73943355+chernistry@users.noreply.github.com> Co-authored-by: euxaristia <25621994+euxaristia@users.noreply.github.com> Co-authored-by: Michael Bleigh <mbleigh@mbleigh.com> Co-authored-by: Adam Weidman <adamfweidman@gmail.com> Co-authored-by: Adam Weidman <adamfweidman@google.com> Co-authored-by: Yuna Seol <yunaseol@gmail.com> Co-authored-by: June <kimjune01@gmail.com> Co-authored-by: Aishanee Shah <aishaneeshah@google.com> Co-authored-by: Jason Matthew Suhari <jasonmatthewsuhari@gmail.com> Co-authored-by: Christopher Thomas <cobekgn@gmail.com> Co-authored-by: Jenna Inouye <jinouye@google.com> Co-authored-by: cynthialong0-0 <82900738+cynthialong0-0@users.noreply.github.com> Co-authored-by: M Junaid Shaukat <154750865+junaiddshaukat@users.noreply.github.com> Co-authored-by: Abhijit Balaji <abhijitbalaji@google.com> Co-authored-by: Mark Griffith <anthraxmilkshake@hotmail.com> Co-authored-by: Jack Wotherspoon <jackwoth@google.com> Co-authored-by: Jesse Rosenstock <jesse.rosenstock@gmail.com> Co-authored-by: Adib234 <30782825+Adib234@users.noreply.github.com> Co-authored-by: Dev Randalpura <devrandalpura@google.com> Co-authored-by: Anjaligarhwal <anjaligarhwal1610@gmail.com> Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Tanmay Vartak <9002434+TanmayVartak@users.noreply.github.com> Co-authored-by: Jerop Kipruto <jerop@google.com> Co-authored-by: Kevin Zhao <kevin8093@126.com> Co-authored-by: joshualitt <joshualitt@google.com> Co-authored-by: Clay <claygeo6@gmail.com> Co-authored-by: Adam Weidman <65992621+adamfweidman@users.noreply.github.com> Co-authored-by: Mahima Shanware <mahima.shanware@gmail.com> Co-authored-by: codex-bot <spigelly+gh-bot@gmail.com>

* refactor(plan): simplify policy priorities and consolidate read-only rules (google-gemini#24849) * feat(test-utils): add memory usage integration test harness (google-gemini#24876) * feat(memory): add /memory inbox command for reviewing extracted skills (google-gemini#24544) * chore(release): bump version to 0.39.0-nightly.20260408.e77b22e63 (google-gemini#24939) * fix(core): ensure robust sandbox cleanup in all process execution paths (google-gemini#24763) Co-authored-by: Spencer <spencertang@google.com> * chore: update ink version to 6.6.8 (google-gemini#24934) * Changelog for v0.38.0-preview.0 (google-gemini#24938) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> Co-authored-by: g-samroberts <samroberts@google.com> * chore: ignore conductor directory (google-gemini#22128) Co-authored-by: Coco Sheng <cocosheng@google.com> * Changelog for v0.37.0 (google-gemini#24940) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> Co-authored-by: Sam Roberts <158088236+g-samroberts@users.noreply.github.com> * feat(plan): require user confirmation for activate_skill in Plan Mode (google-gemini#24946) * feat(test-utils): add CPU performance integration test harness (google-gemini#24951) * fix(core): resolve windows symlink bypass and stabilize sandbox integration tests (google-gemini#24834) * test(sdk): add unit tests for GeminiCliSession (google-gemini#21897) * fix(cli): restore file path display in edit and write tool confirmations (google-gemini#24974) * fix(cli-ui): enable Ctrl+Backspace for word deletion in Windows Terminal (google-gemini#21447) * fix(core): dynamic session ID injection to resolve resume bugs (google-gemini#24972) * Update ink version to 6.6.9 (google-gemini#24980) * feat(core): refine shell tool description display logic (google-gemini#24903) * Generalize evals infra to support more types of evals, organization and queuing of named suites (google-gemini#24941) * fix(cli): optimize startup with lightweight parent process (google-gemini#24667) * refactor(sandbox): use centralized sandbox paths in macOS Seatbelt implementation (google-gemini#24984) * feat(cli): refine tool output formatting for compact mode (google-gemini#24677) * fix(sdk): skip broken sendStream tests to unblock nightly (google-gemini#25000) * refactor(core): use centralized path resolution for Linux sandbox (google-gemini#24985) * Support ctrl+shift+g (google-gemini#25035) * feat(core): refactor subagent tool to unified invoke_subagent tool (google-gemini#24489) * fix(core): add explicit git identity env vars to prevent sandbox checkpointing error (google-gemini#19775) Co-authored-by: David Pierce <davidapierce@google.com> * fix: respect hideContextPercentage when FooterConfigDialog is closed without changes (google-gemini#24773) Co-authored-by: Coco Sheng <cocosheng@google.com> * fix(cli): suppress unhandled AbortError logs during request cancellation (google-gemini#22621) * Automated documentation audit (google-gemini#24567) * feat(cli): implement useAgentStream hook (google-gemini#24292) Co-authored-by: Adam Weidman <adamfweidman@gmail.com> Co-authored-by: Adam Weidman <adamfweidman@google.com> * refactor(core): remove legacy subagent wrapping tools (google-gemini#25053) * refactor(plan) Clean default plan toml (google-gemini#25037) * fix(core): honor retryDelay in RetryInfo for 503 errors (google-gemini#25057) * fix(core): remediate subagent memory leaks using AbortSignal in MessageBus (google-gemini#25048) * feat(cli): wire up useAgentStream in AppContainer (google-gemini#24297) Co-authored-by: Adam Weidman <adamfweidman@gmail.com> Co-authored-by: Adam Weidman <adamfweidman@google.com> * feat(core): migrate chat recording to JSONL streaming (google-gemini#23749) * fix(core): clear 5-minute timeouts in oauth flow to prevent memory leaks (google-gemini#24968) * fix(sandbox): centralize async git worktree resolution and enforce read-only security (google-gemini#25040) * feat(test): add high-volume shell test and refine perf harness (google-gemini#24983) * fix(core): silently handle EPERM when listing dir structure (google-gemini#25066) * Changelog for v0.37.1 (google-gemini#25055) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> * fix: decode Uint8Array and multi-byte UTF-8 in API error messages (google-gemini#23341) Co-authored-by: Coco Sheng <cocosheng@google.com> * Automated documentation audit results (google-gemini#22755) * debugging(ui): add optional debugRainbow setting (google-gemini#25088) * fix: resolve lifecycle memory leaks by cleaning up listeners and root closures (google-gemini#25049) * docs(cli): updates f12 description to be more precise (google-gemini#15816) * fix(cli): mark /settings as unsafe to run concurrently (google-gemini#25061) * fix(core): remove buffer slice to prevent OOM on large output streams (google-gemini#25094) * feat(core): persist subagent agentId in tool call records (google-gemini#25092) * chore(core): increase codebase investigator turn limits to 50 (google-gemini#25125) * refactor(core): consolidate execute() arguments into ExecuteOptions (google-gemini#25101) * feat(core): add Strategic Re-evaluation guidance to system prompt (google-gemini#25062) * fix(core): preserve shell execution config fields on update (google-gemini#25113) * docs: add vi shortcuts and clarify MCP sandbox setup (google-gemini#21679) Co-authored-by: Jenna Inouye <jinouye@google.com> * fix(cli): pass session id to interactive shell executions (google-gemini#25114) * fix(cli): resolve text sanitization data loss due to C1 control characters (google-gemini#22624) * feat(core): add large memory regression test (google-gemini#25059) * fix(core): resolve PTY exhaustion and orphan MCP subprocess leaks (google-gemini#25079) * chore: switch from keytar to @github/keytar (google-gemini#25143) * chore(deps): update vulnerable dependencies via npm audit fix (google-gemini#25140) * perf(sandbox): optimize Windows sandbox initialization via native ACL application (google-gemini#25077) * fix: improve audio MIME normalization and validation in file reads (google-gemini#21636) Co-authored-by: Coco Sheng <cocosheng@google.com> * docs: Update docs-audit to include changes in PR body (google-gemini#25153) * docs: correct documentation for enforced authentication type (google-gemini#25142) * fix(cli): exclude update_topic from confirmation queue count (google-gemini#24945) * Memory fix for trace's streamWrapper. (google-gemini#25089) * fix(core): fix quota footer for non-auto models and improve display (google-gemini#25121) * docs(contributing): clarify self-assignment policy for issues (google-gemini#23087) * feat(core): add skill patching support with /memory inbox integration (google-gemini#25148) * Stop suppressing thoughts and text in model response (google-gemini#25073) * fix(release): prefix git hash in nightly versions to prevent semver normalization (google-gemini#25304) * feat(cli): extract QuotaContext and resolve infinite render loop (google-gemini#24959) * refactor(core): extract and centralize sandbox path utilities (google-gemini#25305) Co-authored-by: David Pierce <davidapierce@google.com> * feat(ui): added enhancements to scroll momentum (google-gemini#24447) * fix(core): replace custom binary detection with isbinaryfile to correctly handle UTF-8 (U+FFFD) (google-gemini#25297) * feat(agent): implement tool-controlled display protocol (Steps 2-3) (google-gemini#25134) * Stop showing scrollbar unless we are in terminalBuffer mode (google-gemini#25320) * fix(core): expose GEMINI_PLANS_DIR to hook environment (google-gemini#25296) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * feat: support auth block in MCP servers config in agents (google-gemini#24770) * feat(core): implement silent fallback for Plan Mode model routing (google-gemini#25317) * fix: correct redirect count increment in fetchJson (google-gemini#24896) Co-authored-by: Tommaso Sciortino <sciortino@gmail.com> * fix(core): prevent secondary crash in ModelRouterService finally block (google-gemini#25333) * feat(core): introduce decoupled ContextManager and Sidecar architecture (google-gemini#24752) * docs(core): update generalist agent documentation (google-gemini#25325) * chore(mcp): check MCP error code over brittle string match (google-gemini#25381) * test(core): improve sandbox integration test coverage and fix OS-specific failures (google-gemini#25307) Co-authored-by: David Pierce <davidapierce@google.com> * feat(plan): update plan mode prompt to allow showing plan content (google-gemini#25058) * fix(core): use debug level for keychain fallback logging (google-gemini#25398) * feat(test): add a performance test in asian language (google-gemini#25392) * feat(cli): enable mouse clicking for cursor positioning in AskUser multi-line answers (google-gemini#24630) * fix(core): detect kmscon terminal as supporting true color (google-gemini#25282) Co-authored-by: Adib234 <30782825+Adib234@users.noreply.github.com> Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * ci: add agent session drift check workflow (google-gemini#25389) * use macos-latest-large runner where applicable. (google-gemini#25413) * Changelog for v0.37.2 (google-gemini#25336) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> * chore(release): bump version to 0.40.0-nightly.20260414.g5b1f7375a (google-gemini#25420) * Fix(core): retry additional OpenSSL 3.x SSL errors during streaming (google-gemini#16075) (google-gemini#25187) * fix(core): prevent YOLO mode from being downgraded (google-gemini#25341) * feat: bundle ripgrep binaries into SEA for offline support (google-gemini#25342) * Changelog for v0.39.0-preview.0 (google-gemini#25417) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> Co-authored-by: Sam Roberts <158088236+g-samroberts@users.noreply.github.com> * feat(test): add large conversation scenario for performance test (google-gemini#25331) * improve(core): require recurrence evidence before extracting skills (google-gemini#25147) * test(evals): add subagent delegation evaluation tests (google-gemini#24619) * feat: add github colorblind themes (google-gemini#15504) Co-authored-by: Coco Sheng <cocosheng@google.com> * fix(core): honor GOOGLE_GEMINI_BASE_URL and GOOGLE_VERTEX_BASE_URL (google-gemini#25357) * fix(cli): clean up slash command IDE listeners (google-gemini#24397) Co-authored-by: Tommaso Sciortino <sciortino@gmail.com> * Changelog for v0.38.0 (google-gemini#25470) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> * fix(evals): update eval tests for invoke_agent telemetry and project-scoped memory (google-gemini#25502) * Changelog for v0.38.1 (google-gemini#25476) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> Co-authored-by: Sam Roberts <158088236+g-samroberts@users.noreply.github.com> * feat(core): integrate skill-creator into skill extraction agent (google-gemini#25421) * feat(cli): provide default post-submit prompt for skill command (google-gemini#25327) * feat(core): add tools to list and read MCP resources (google-gemini#25395) * fix(evals): add typecheck coverage for evals, integration-tests, and memory-tests (google-gemini#25480) * Use OSC 777 for terminal notifications (google-gemini#25300) * fix(extensions): fix bundling for examples (google-gemini#25542) * fix(cli): reset plan session state on /clear (google-gemini#25515) * feat(core): add .mdx support to get-internal-docs tool (google-gemini#25090) * docs(policy): mention that workspace policies are broken (google-gemini#24367) Co-authored-by: Nicolas Ouellet-Payeur <nicolaso@chromium.org> * fix(core): allow explicit write permissions to override governance file protections in sandboxes (google-gemini#25338) * feat(sandbox): resolve custom seatbelt profiles from $HOME/.gemini first (google-gemini#25427) Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * Reduce blank lines. (google-gemini#25563) * fix(ui): revert preview theme on dialog unmount (google-gemini#22542) Co-authored-by: Jack Wotherspoon <jackwoth@google.com> * fix(core): fix ShellExecutionConfig spread and add ProjectRegistry save backoff (google-gemini#25382) * feat(core): Disable topic updates for subagents (google-gemini#25567) * feat(core): enable topic update narration by default and promote to general (google-gemini#25586) Co-authored-by: JAYADITYA <96861162+JayadityaGit@users.noreply.github.com> Co-authored-by: Jack Wotherspoon <jackwoth@google.com> * docs: migrate installation and authentication to mdx with tabbed layouts (google-gemini#25155) * feat(config): split memoryManager flag into autoMemory (google-gemini#25601) * fix(core): allow Cloud Shell users to use PRO_MODEL_NO_ACCESS experiment (google-gemini#25702) * fix(cli): round slow render latency to avoid opentelemetry float warning (google-gemini#25709) * docs(tracker): introduce experimental task tracker feature (google-gemini#24556) * docs(cli): fix inconsistent system.md casing in system prompt docs (google-gemini#25414) Co-authored-by: cynthialong0-0 <82900738+cynthialong0-0@users.noreply.github.com> * feat(cli): add streamlined `gemini gemma` local model setup (google-gemini#25498) Co-authored-by: Abhijit Balaji <abhijitbalaji@google.com> Co-authored-by: Samee Zahid <sameez@google.com> Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * Changelog for v0.38.2 (google-gemini#25593) Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> * Fix: Disallow overriding IDE stdio via workspace .env (RCE) (google-gemini#25022) Co-authored-by: Tommaso Sciortino <sciortino@gmail.com> * feat(test): refactor the memory usage test to use metrics from CLI process instead of test runner (google-gemini#25708) * feat(vertex): add settings for Vertex AI request routing (google-gemini#25513) * Fix/allow for session persistence (google-gemini#25176) * fix(core): resolve nested plan directory duplication and relative path policies (google-gemini#25138) * feat: detect new files in @ recommendations with watcher based updates (google-gemini#25256) * Allow dots on GEMINI_API_KEY (google-gemini#25497) * feat(telemetry): add flag for enabling traces specifically (google-gemini#25343) * fix(cli): use newline in shell command wrapping to avoid breaking heredocs (google-gemini#25537) * fix(cli): ensure theme dialog labels are rendered for all themes (google-gemini#24599) Co-authored-by: cynthialong0-0 <82900738+cynthialong0-0@users.noreply.github.com> * fix(core): disable detached mode in Bun to prevent immediate SIGHUP of child processes (google-gemini#22620) * feat: add /new as alias for /clear and refine command description (google-gemini#17865) * fix(cli): start auto memory in ACP sessions (google-gemini#25626) * fix(core): remove duplicate initialize call on agents refreshed (google-gemini#25670) * test(e2e): default integration tests to Flash Preview (google-gemini#25753) * refactor(memory): replace MemoryManagerAgent with prompt-driven memory editing across four tiers (google-gemini#25716) * fix(cli): fix "/clear (new)" command (google-gemini#25801) * fix(core): use dynamic CLI version for IDE client instead of hardcoded '1.0.0' (google-gemini#24414) Co-authored-by: cynthialong0-0 <82900738+cynthialong0-0@users.noreply.github.com> * fix(core): handle line endings in ignore file parsing (google-gemini#23895) Co-authored-by: cynthialong0-0 <82900738+cynthialong0-0@users.noreply.github.com> * Fix/command injection shell (google-gemini#24170) Co-authored-by: David Pierce <davidapierce@google.com> * fix(ui): removed background color for input (google-gemini#25339) * fix(devtools): reduce memory usage and defer connection (google-gemini#24496) * fix(core): support jsonl session logs in memory and summary services (google-gemini#25816) * fix(release): exclude ripgrep binaries from npm tarballs (google-gemini#25841) * chore(release): v0.40.0-preview.2 * feat(cli): secure .env loading and enforce workspace trust in headless mode (google-gemini#25814) Co-authored-by: galz10 <galzahavi@google.com> Co-authored-by: davidapierce <davidapierce@google.com> * feat(core): enhance shell command validation and add core tools allowlist (google-gemini#25720) Co-authored-by: David Pierce <davidapierce@google.com> Co-authored-by: Keith Schaab <keithsc@google.com> Co-authored-by: Keith Schaab <keith.schaab@gmail.com> Co-authored-by: Emily Hedlund <ehedlund@google.com> * update FatalUntrustedWorkspaceError message to include doc link (google-gemini#25874) * chore(release): v0.40.0-preview.3 * fix(patch): cherry-pick 048bf6e to release/v0.40.0-preview.3-pr-25941 to patch version v0.40.0-preview.3 and create version 0.40.0-preview.4 (google-gemini#25942) Co-authored-by: Tommaso Sciortino <sciortino@gmail.com> * chore(release): v0.40.0-preview.4 * fix(patch): cherry-pick 54b7586 to release/v0.40.0-preview.4-pr-26066 [CONFLICTS] (google-gemini#26124) Co-authored-by: David Pierce <davidapierce@google.com> * chore(release): v0.40.0-preview.5 * chore(release): v0.40.0 * Remove temporary commit message file from tracking This cleans the repository after the upstream merge and ignores the helper file so future local commits do not pollute branch diffs. * Add optional image build trigger to fork resync skill Document the final workflow trigger step for cases where a new container image is required, including the exact workflow name and inputs, and warn against passing the branch name as the version. * Clarify fork bump behavior in resync skill Document that the fork should be bumped from upstream without applying fork patches back onto the upstream release branch, keeping fork-specific changes isolated to the fork resync workflow. --------- Co-authored-by: ruomeng <ruomeng@google.com> Co-authored-by: Sri Pasumarthi <111310667+sripasg@users.noreply.github.com> Co-authored-by: Sandy Tao <sandytao520@icloud.com> Co-authored-by: gemini-cli-robot <gemini-cli-robot@google.com> Co-authored-by: Emily Hedlund <ehedlund@google.com> Co-authored-by: Spencer <spencertang@google.com> Co-authored-by: Jacob Richman <jacob314@gmail.com> Co-authored-by: gemini-cli-robot <224641728+gemini-cli-robot@users.noreply.github.com> Co-authored-by: g-samroberts <samroberts@google.com> Co-authored-by: JAYADITYA <96861162+JayadityaGit@users.noreply.github.com> Co-authored-by: Coco Sheng <cocosheng@google.com> Co-authored-by: Sam Roberts <158088236+g-samroberts@users.noreply.github.com> Co-authored-by: Adamya Singh <adamyasingh54@gmail.com> Co-authored-by: Jarrod Whelan <150866123+jwhelangoog@users.noreply.github.com> Co-authored-by: dogukanozen <dogukannozen@hotmail.com> Co-authored-by: Tommaso Sciortino <sciortino@gmail.com> Co-authored-by: Christian Gunderman <gundermanc@google.com> Co-authored-by: Sehoon Shon <sshon@google.com> Co-authored-by: Abhi <43648792+abhipatel12@users.noreply.github.com> Co-authored-by: MD. MOHIBUR RAHMAN <35300157+mrpmohiburrahman@users.noreply.github.com> Co-authored-by: David Pierce <davidapierce@google.com> Co-authored-by: chernistry <73943355+chernistry@users.noreply.github.com> Co-authored-by: euxaristia <25621994+euxaristia@users.noreply.github.com> Co-authored-by: Michael Bleigh <mbleigh@mbleigh.com> Co-authored-by: Adam Weidman <adamfweidman@gmail.com> Co-authored-by: Adam Weidman <adamfweidman@google.com> Co-authored-by: Yuna Seol <yunaseol@gmail.com> Co-authored-by: June <kimjune01@gmail.com> Co-authored-by: Aishanee Shah <aishaneeshah@google.com> Co-authored-by: Jason Matthew Suhari <jasonmatthewsuhari@gmail.com> Co-authored-by: Christopher Thomas <cobekgn@gmail.com> Co-authored-by: Jenna Inouye <jinouye@google.com> Co-authored-by: cynthialong0-0 <82900738+cynthialong0-0@users.noreply.github.com> Co-authored-by: M Junaid Shaukat <154750865+junaiddshaukat@users.noreply.github.com> Co-authored-by: Abhijit Balaji <abhijitbalaji@google.com> Co-authored-by: Mark Griffith <anthraxmilkshake@hotmail.com> Co-authored-by: Jack Wotherspoon <jackwoth@google.com> Co-authored-by: Jesse Rosenstock <jesse.rosenstock@gmail.com> Co-authored-by: Adib234 <30782825+Adib234@users.noreply.github.com> Co-authored-by: Dev Randalpura <devrandalpura@google.com> Co-authored-by: Anjaligarhwal <anjaligarhwal1610@gmail.com> Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Tanmay Vartak <9002434+TanmayVartak@users.noreply.github.com> Co-authored-by: Jerop Kipruto <jerop@google.com> Co-authored-by: Kevin Zhao <kevin8093@126.com> Co-authored-by: joshualitt <joshualitt@google.com> Co-authored-by: Clay <claygeo6@gmail.com> Co-authored-by: Adam Weidman <65992621+adamfweidman@users.noreply.github.com> Co-authored-by: Rob Clevenger <rcleveng@users.noreply.github.com> Co-authored-by: Gal Zahavi <38544478+galz10@users.noreply.github.com> Co-authored-by: anj-s <32556631+anj-s@users.noreply.github.com> Co-authored-by: Z1xus <40185941+Z1xus@users.noreply.github.com> Co-authored-by: jackyliuxx <jackyliuxx@gmail.com> Co-authored-by: Nicolas Ouellet-Payeur <nicolaso@google.com> Co-authored-by: Nicolas Ouellet-Payeur <nicolaso@chromium.org> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Mahima Shanware <mahima.shanware@gmail.com> Co-authored-by: Timo <36011879+Bodlux@users.noreply.github.com> Co-authored-by: Samee Zahid <sameescouser24@gmail.com> Co-authored-by: Samee Zahid <sameez@google.com> Co-authored-by: Mundur <150439604+M0nd0R@users.noreply.github.com> Co-authored-by: Gordon Hui <125633533+gordonhwc@users.noreply.github.com> Co-authored-by: Muhammad Ahsan Farooq <ahsanfarooq210@gmail.com> Co-authored-by: PRAS Samin <103464543+prassamin@users.noreply.github.com> Co-authored-by: Danyel Cabello <danyel.nerv@gmail.com> Co-authored-by: Vedant Mahajan <vedant.04.mahajan@gmail.com> Co-authored-by: mini2s <143020328+mini2s@users.noreply.github.com> Co-authored-by: Kishan Patel <132991737+thekishandev@users.noreply.github.com> Co-authored-by: xoma-zver <maxidiplomat@gmail.com> Co-authored-by: Horizon_Architect_07 <famousrajbhatt@gmail.com> Co-authored-by: galz10 <galzahavi@google.com> Co-authored-by: Keith Schaab <keithsc@google.com> Co-authored-by: Keith Schaab <keith.schaab@gmail.com> Co-authored-by: codex-bot <spigelly+gh-bot@gmail.com>

ehedlund requested review from a team as code owners April 7, 2026 15:24

ehedlund temporarily deployed to internal April 7, 2026 15:24 — with GitHub Actions Inactive

ehedlund force-pushed the troubleshoot-test branch from 0b39dd4 to 09b3bdf Compare April 7, 2026 15:25

This comment was marked as outdated.

Sign in to view

gemini-cli Bot added the priority/p1 Important and should be addressed in the near term. label Apr 7, 2026

ehedlund force-pushed the troubleshoot-test branch 3 times, most recently from e37d33d to 52f3887 Compare April 7, 2026 17:17

google-gemini deleted a comment from gemini-code-assist Bot Apr 7, 2026

ehedlund force-pushed the troubleshoot-test branch from 88e6003 to 5df16cb Compare April 7, 2026 18:04

ehedlund changed the title ~~test(core): improve diagnostic output for sandbox integration test~~ test(core): optimize sandbox integration tests to fix Windows CI flakiness Apr 7, 2026

ehedlund removed request for a team April 7, 2026 18:08

ehedlund enabled auto-merge April 7, 2026 18:11

gemini-cli Bot added the status/need-issue Pull requests that need to have an associated issue. label Apr 7, 2026

ehedlund force-pushed the troubleshoot-test branch from 988537b to 17727a9 Compare April 7, 2026 18:48

ehedlund changed the title ~~test(core): optimize sandbox integration tests to fix Windows CI flakiness~~ test(core): optimize sandbox integration tests to fix CI flakiness Apr 7, 2026

DavidAPierce approved these changes Apr 7, 2026

View reviewed changes

ehedlund added this pull request to the merge queue Apr 7, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Apr 7, 2026

ehedlund force-pushed the troubleshoot-test branch 4 times, most recently from 6ea03fb to ddcb830 Compare April 7, 2026 20:24

ehedlund changed the title ~~test(core): optimize sandbox integration tests to fix CI flakiness~~ test(core): optimize sandbox integration tests to fix Windows CI flakiness Apr 7, 2026

ehedlund force-pushed the troubleshoot-test branch from ddcb830 to aaae7f5 Compare April 7, 2026 20:31

DavidAPierce enabled auto-merge April 7, 2026 20:34

ehedlund force-pushed the troubleshoot-test branch from f4aed18 to bb25a5f Compare April 7, 2026 20:35

ehedlund disabled auto-merge April 7, 2026 20:37

ehedlund force-pushed the troubleshoot-test branch from bb25a5f to 5b071a9 Compare April 7, 2026 20:59

ehedlund force-pushed the troubleshoot-test branch from 5b071a9 to 25e4f63 Compare April 8, 2026 13:21

deny access to the directory first, then create the file

1d2056a

ehedlund force-pushed the troubleshoot-test branch from a4fe1e5 to 1d2056a Compare April 8, 2026 14:01

ehedlund added 2 commits April 8, 2026 10:03

use touch instead of cat

62e9617

final refinements

5561316

ehedlund force-pushed the troubleshoot-test branch from 14e87a1 to 5561316 Compare April 8, 2026 14:46

ehedlund changed the title ~~test(core): optimize sandbox integration tests to fix Windows CI flakiness~~ test(core): resolve sandbox integration timeouts and standardize cross-platform execution Apr 8, 2026

fix windows symlink bug and reenable test cases

b24477b

ehedlund changed the title ~~test(core): resolve sandbox integration timeouts and standardize cross-platform execution~~ fix(core): resolve windows symlink bypass and stabilize sandbox integration tests Apr 8, 2026

include both the original and real workspace path in ResolvedSandboxP…

8ac3968

…aths

ehedlund force-pushed the troubleshoot-test branch from eb08517 to 8ac3968 Compare April 8, 2026 20:52

ehedlund added 2 commits April 8, 2026 16:55

test(macos): use arrayContaining for expanded paths

b786beb

remove unnecessary fallback logic

73cea34

ehedlund enabled auto-merge April 8, 2026 21:41

ehedlund added this pull request to the merge queue Apr 8, 2026

Merged via the queue into main with commit af36386 Apr 8, 2026
27 checks passed

ehedlund deleted the troubleshoot-test branch April 8, 2026 23:31

student-ankitpandit pushed a commit to student-ankitpandit/gemini-cli that referenced this pull request Apr 9, 2026

fix(core): resolve windows symlink bypass and stabilize sandbox integ…

36b7eab

…ration tests (google-gemini#24834)

warrenzhu25 pushed a commit to warrenzhu25/gemini-cli that referenced this pull request Apr 9, 2026

fix(core): resolve windows symlink bypass and stabilize sandbox integ…

2a08234

…ration tests (google-gemini#24834)

github-actions Bot mentioned this pull request Apr 23, 2026

Tool release: Gemini CLI v0.38.2 (was v0.36.0) agent-sh/agnix#750

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(core): resolve windows symlink bypass and stabilize sandbox integration tests#24834

fix(core): resolve windows symlink bypass and stabilize sandbox integration tests#24834
ehedlund merged 9 commits intomainfrom
troubleshoot-test

ehedlund commented Apr 7, 2026 •

edited

Loading

Uh oh!

gemini-cli Bot commented Apr 7, 2026

Uh oh!

github-actions Bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

github-actions Bot commented Apr 7, 2026

Uh oh!

DavidAPierce left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ehedlund commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Details

Related Issues

How to Validate

Pre-Merge Checklist

Uh oh!

gemini-cli Bot commented Apr 7, 2026

Uh oh!

github-actions Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

github-actions Bot commented Apr 7, 2026

🧠 Model Steering Guidance

Uh oh!

DavidAPierce left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ehedlund commented Apr 7, 2026 •

edited

Loading

github-actions Bot commented Apr 7, 2026 •

edited

Loading