Skip to content

feature: feature: allow absolute path for macos seatbelt profiles (sa…#25024

Closed
flexponsive wants to merge 2 commits intogoogle-gemini:mainfrom
flexponsive:fix-seatbelt-alt
Closed

feature: feature: allow absolute path for macos seatbelt profiles (sa…#25024
flexponsive wants to merge 2 commits intogoogle-gemini:mainfrom
flexponsive:fix-seatbelt-alt

Conversation

@flexponsive
Copy link
Copy Markdown

@flexponsive flexponsive commented Apr 9, 2026

Summary

Enhance macOS Seatbelt configuration flexibility by allowing the SEATBELT_PROFILE environment variable to accept absolute paths. This enables developers to maintain centralized sandbox policies across multiple repositories without duplicating configuration into every project's .gemini folder.

Details

Updated the sandbox utility to check if the SEATBELT_PROFILE value is an absolute path.

  • If absolute: Uses the path directly.
  • If relative/name: Continues with existing logic (checking built-in profiles or the project .gemini folder).

This change is non-breaking and preserves all existing workflows.

Related Issues

Closes #24991

How to Validate

GEMINI_SANDBOX=sandbox-exec SEATBELT_PROFILE=$(pwd)/bundle/sandbox-macos-permissive-open.sb node bundle/gemini.js -s

Pre-Merge Checklist

  • Updated relevant documentation and README (if needed)
  • Added/updated tests (if needed)
  • Noted breaking changes (if any)
  • Validated on required platforms/methods:
    • MacOS
      • npm run
      • npx
      • Docker
      • Podman
      • Seatbelt
    • Windows
      • npm run
      • npx
      • Docker
    • Linux
      • npm run
      • npx
      • Docker

@flexponsive flexponsive requested a review from a team as a code owner April 9, 2026 13:05
@gemini-code-assist
Copy link
Copy Markdown
Contributor

gemini-code-assist Bot commented Apr 9, 2026

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the macOS Seatbelt configuration by allowing the SEATBELT_PROFILE environment variable to accept absolute file paths. This modification provides developers with increased flexibility to manage and reference sandbox policies, enabling the use of centralized configurations across various projects without the need for redundant file copies. The change is designed to be non-breaking, ensuring compatibility with existing setups while improving the overall maintainability and security posture of sandbox environments.

Highlights

  • Enhanced macOS Seatbelt Configuration: The SEATBELT_PROFILE environment variable now supports absolute file paths, offering greater flexibility in managing sandbox policies.
  • Centralized Sandbox Policies: This change allows developers to maintain sandbox policies in a central location, avoiding duplication across multiple repositories.
  • Non-Breaking Change: Existing workflows are preserved, as the system falls back to previous logic if an absolute path is not provided.
  • Input Validation: Added validation for relative profile names to prevent directory traversal and null byte injection.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

@gemini-cli gemini-cli Bot added the area/core Issues related to User Interface, OS Support, Core Functionality label Apr 9, 2026
gemini-code-assist[bot]
gemini-code-assist Bot reviewed Apr 9, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request enhances the start_sandbox function to support absolute paths for the SEATBELT_PROFILE environment variable on macOS, including security checks for path traversal. A new test case was added to verify this functionality. The review points out that the current logic for handling SEATBELT_PROFILE does not correctly default to 'permissive-open' when the environment variable is set to an empty or whitespace-only string, which could lead to a FatalSandboxError. A code suggestion is provided to address this edge case by explicitly trimming the input and applying the default if the result is empty, aligning with repository guidelines.

Comment thread packages/cli/src/utils/sandbox.ts Outdated
@scidomino
Copy link
Copy Markdown
Collaborator

scidomino commented Apr 10, 2026

closing aas we don't want to impl it this way

@scidomino scidomino closed this Apr 10, 2026
@mvanhorn mvanhorn mentioned this pull request Apr 15, 2026
Merged
12 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

area/core Issues related to User Interface, OS Support, Core Functionality

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Support custom seatbelt profiles in ~/.gemini

2 participants

@flexponsive @scidomino