Tighten private Auto Memory patch allowlist by SandyTao520 · Pull Request #26535 · google-gemini/gemini-cli

SandyTao520 · 2026-05-05T19:58:01Z

Summary

Tightens Auto Memory private patch validation so private memory patches can only target the project memory document set: MEMORY.md and direct sibling markdown files in the project memory directory.

Details

Private memory patch listing, aggregate apply/dismiss, and direct apply now share a kind-aware target validator. The validator rejects in-root but non-memory targets such as extraction state files, locks, .inbox/, skills/, nested paths, and non-markdown files.

The shared parsed-patch applicator now accepts an optional resolved-target predicate so memory patches can narrow a coarse root allowlist without changing skill patch behavior.

Also tightened the global memory single-file contract so child paths under ~/.gemini/GEMINI.md/ are rejected.

Related Issues

Fixes #26520

How to Validate

Run:

npx vitest run packages/core/src/commands/memory.test.ts
npm run typecheck --workspace @google/gemini-cli-core
npx prettier --check packages/core/src/commands/memory.ts packages/core/src/services/memoryPatchUtils.ts packages/core/src/commands/memory.test.ts
npm run build --workspace @google/gemini-cli-core
npm run lint --workspace @google/gemini-cli-core
env RUN_EVALS=1 npx vitest run --config evals/vitest.config.ts evals/skill_extraction.eval.ts

Expected results:

Memory command tests pass.
Core typecheck, formatting, build, and lint pass.
skill_extraction.eval.ts reports 4 passed and 1 skipped. The skipped case is gated behind RUN_SCRATCHPAD_STATS=1.
Private patch attempts for .extraction-state.json, .extraction.lock, .inbox/*, skills/*, non-markdown files, and nested markdown paths are omitted from listing and rejected on direct apply.
Valid private patch flows for MEMORY.md and direct sibling *.md files still pass.

Pre-Merge Checklist

gemini-code-assist · 2026-05-05T19:58:10Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces stricter validation for private and global memory patches to ensure they only target intended files. By centralizing target validation logic and providing a mechanism for fine-grained path filtering, the system now prevents unauthorized modifications to system files, nested directories, and non-markdown content, while maintaining compatibility with existing workflows.

Highlights

Private Memory Patch Validation: Implemented a strict allowlist for private memory patches, restricting them to the project memory directory and direct sibling markdown files, while rejecting non-markdown files, nested paths, and system files.
Global Memory Contract: Tightened the global memory single-file contract to explicitly reject any child paths under the primary memory file.
API Enhancement: Updated the shared patch applicator to support an optional resolved-target predicate, allowing for fine-grained validation without impacting existing skill patch behaviors.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

github-actions · 2026-05-05T20:01:50Z

Size Change: +4.3 kB (+0.01%)

Total Size: 34 MB

Filename	Size	Change
`./bundle/chunk-4JE3NMVU.js`	0 B	-14.8 MB (removed)	🏆
`./bundle/chunk-DNXF5QOU.js`	0 B	-19.5 kB (removed)	🏆
`./bundle/chunk-JHHWWKTA.js`	0 B	-49.2 kB (removed)	🏆
`./bundle/chunk-VRDAQHBO.js`	0 B	-12.5 kB (removed)	🏆
`./bundle/chunk-WLSHGY7C.js`	0 B	-658 kB (removed)	🏆
`./bundle/chunk-XQL62NEZ.js`	0 B	-3.8 kB (removed)	🏆
`./bundle/chunk-ZDED2FSO.js`	0 B	-2.78 MB (removed)	🏆
`./bundle/chunk-ZUA6BQE7.js`	0 B	-3.43 kB (removed)	🏆
`./bundle/core-7U5YUA5A.js`	0 B	-48.8 kB (removed)	🏆
`./bundle/devtoolsService-DM2CITXC.js`	0 B	-28 kB (removed)	🏆
`./bundle/gemini-FPTNKWVX.js`	0 B	-584 kB (removed)	🏆
`./bundle/interactiveCli-AVBDMJO4.js`	0 B	-1.29 MB (removed)	🏆
`./bundle/liteRtServerManager-3RIANRO6.js`	0 B	-2.11 kB (removed)	🏆
`./bundle/oauth2-provider-GSESN4OH.js`	0 B	-9.16 kB (removed)	🏆
`./bundle/chunk-3FNEJVMK.js`	12.5 kB	+12.5 kB (new file)	🆕
`./bundle/chunk-3L436AQ6.js`	3.8 kB	+3.8 kB (new file)	🆕
`./bundle/chunk-3O2J3JBW.js`	2.78 MB	+2.78 MB (new file)	🆕
`./bundle/chunk-APIYNMPO.js`	49.2 kB	+49.2 kB (new file)	🆕
`./bundle/chunk-DQJKOYKG.js`	658 kB	+658 kB (new file)	🆕
`./bundle/chunk-ON57QYV3.js`	3.43 kB	+3.43 kB (new file)	🆕
`./bundle/chunk-SSDDDPSZ.js`	19.5 kB	+19.5 kB (new file)	🆕
`./bundle/chunk-Y5THG6AI.js`	14.8 MB	+14.8 MB (new file)	🆕
`./bundle/core-KSZX2Y5Z.js`	48.8 kB	+48.8 kB (new file)	🆕
`./bundle/devtoolsService-SNA5IPT6.js`	28 kB	+28 kB (new file)	🆕
`./bundle/gemini-4D3A5TZ2.js`	584 kB	+584 kB (new file)	🆕
`./bundle/interactiveCli-5P3F3GUI.js`	1.29 MB	+1.29 MB (new file)	🆕
`./bundle/liteRtServerManager-QSI42QKW.js`	2.11 kB	+2.11 kB (new file)	🆕
`./bundle/oauth2-provider-TGBVWBCE.js`	9.16 kB	+9.16 kB (new file)	🆕

ℹ️ View Unchanged

Filename	Size	Change
`./bundle/bundled/third_party/index.js`	8 MB	0 B
`./bundle/chunk-34MYV7JD.js`	2.45 kB	0 B
`./bundle/chunk-5AUYMPVF.js`	858 B	0 B
`./bundle/chunk-5PS3AYFU.js`	1.18 kB	0 B
`./bundle/chunk-664ZODQF.js`	124 kB	0 B
`./bundle/chunk-DAHVX5MI.js`	206 kB	0 B
`./bundle/chunk-IUUIT4SU.js`	56.5 kB	0 B
`./bundle/chunk-RJTRUG2J.js`	39.8 kB	0 B
`./bundle/chunk-VJSUVOZ4.js`	1.97 MB	0 B
`./bundle/cleanup-5ERSFC2O.js`	0 B	-932 B (removed)	🏆
`./bundle/devtools-36NN55EP.js`	696 kB	0 B
`./bundle/dist-T73EYRDX.js`	356 B	0 B
`./bundle/events-XB7DADIJ.js`	418 B	0 B
`./bundle/examples/hooks/scripts/on-start.js`	188 B	0 B
`./bundle/examples/mcp-server/example.js`	1.43 kB	0 B
`./bundle/gemini.js`	5.1 kB	0 B
`./bundle/getMachineId-bsd-TXG52NKR.js`	1.55 kB	0 B
`./bundle/getMachineId-darwin-7OE4DDZ6.js`	1.55 kB	0 B
`./bundle/getMachineId-linux-SHIFKOOX.js`	1.34 kB	0 B
`./bundle/getMachineId-unsupported-5U5DOEYY.js`	1.06 kB	0 B
`./bundle/getMachineId-win-6KLLGOI4.js`	1.72 kB	0 B
`./bundle/memoryDiscovery-NGHTMHWQ.js`	980 B	0 B
`./bundle/multipart-parser-KPBZEGQU.js`	11.7 kB	0 B
`./bundle/node_modules/@google/gemini-cli-devtools/dist/client/main.js`	222 kB	0 B
`./bundle/node_modules/@google/gemini-cli-devtools/dist/src/_client-assets.js`	229 kB	0 B
`./bundle/node_modules/@google/gemini-cli-devtools/dist/src/index.js`	13.4 kB	0 B
`./bundle/node_modules/@google/gemini-cli-devtools/dist/src/types.js`	132 B	0 B
`./bundle/sandbox-macos-permissive-open.sb`	890 B	0 B
`./bundle/sandbox-macos-permissive-proxied.sb`	1.31 kB	0 B
`./bundle/sandbox-macos-restrictive-open.sb`	3.36 kB	0 B
`./bundle/sandbox-macos-restrictive-proxied.sb`	3.56 kB	0 B
`./bundle/sandbox-macos-strict-open.sb`	4.82 kB	0 B
`./bundle/sandbox-macos-strict-proxied.sb`	5.02 kB	0 B
`./bundle/src-QVCVGIUX.js`	47 kB	0 B
`./bundle/start-H7BUFY3Y.js`	0 B	-652 B (removed)	🏆
`./bundle/tree-sitter-7U6MW5PS.js`	274 kB	0 B
`./bundle/tree-sitter-bash-34ZGLXVX.js`	1.84 MB	0 B
`./bundle/cleanup-2NTCLSYM.js`	932 B	+932 B (new file)	🆕
`./bundle/start-TGBHYQUE.js`	652 B	+652 B (new file)	🆕

_{compressed-size-action}

gemini-code-assist

Code Review

This pull request enhances memory patch security by implementing fine-grained validation for patch targets. It introduces a validation context and specific checks to ensure patches only modify allowed markdown files within the project or global memory directories. The core patch application logic was also updated to support these additional constraints. Review feedback identifies opportunities to optimize path resolution logic by removing redundant calls and simplifying filename validation logic.

akh64bit

LGTM!

Tighten private memory patch allowlist

44f401f

SandyTao520 requested a review from a team as a code owner May 5, 2026 19:58

gemini-code-assist Bot reviewed May 5, 2026

View reviewed changes

Comment thread packages/core/src/commands/memory.ts Outdated

Comment thread packages/core/src/commands/memory.ts Outdated

Comment thread packages/core/src/commands/memory.ts Outdated

gemini-cli Bot added the 🔒 maintainer only ⛔ Do not contribute. Internal roadmap item. label May 5, 2026

Address memory patch review cleanup

34ea5b5

akh64bit approved these changes May 5, 2026

View reviewed changes

This was referenced May 6, 2026

📊 AI CLI 工具社区动态日报 2026-05-06 zx0828/big_model_radar#38

Open

📊 AI CLI 工具社区动态日报 2026-05-06 gsscsd/big_model_radar#300

Open

fix memory patch path casing allowlist

d29d0d0

SandyTao520 enabled auto-merge May 6, 2026 17:19

SandyTao520 added this pull request to the merge queue May 6, 2026

Merged via the queue into main with commit 7fb5146 May 6, 2026
27 checks passed

SandyTao520 deleted the st/fix/private-memory-patch-allowlist branch May 6, 2026 17:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Tighten private Auto Memory patch allowlist#26535

Tighten private Auto Memory patch allowlist#26535
SandyTao520 merged 3 commits intomainfrom
st/fix/private-memory-patch-allowlist

SandyTao520 commented May 5, 2026

Uh oh!

gemini-code-assist Bot commented May 5, 2026

Uh oh!

github-actions Bot commented May 5, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

akh64bit left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

SandyTao520 commented May 5, 2026

Summary

Details

Related Issues

How to Validate

Pre-Merge Checklist

Uh oh!

gemini-code-assist Bot commented May 5, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

github-actions Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

akh64bit left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented May 5, 2026 •

edited

Loading