Re-request consent if necessary when updating extensions by jakemac53 · Pull Request #9517 · google-gemini/gemini-cli

jakemac53 · 2025-09-24T21:03:32Z

TLDR

When updating an extension, we compare the old consent text to the new consent text, and if they are different then we require the user to consent again.

Dive Deeper

There is no consent flow in interactive mode, so we default today to giving an error and just telling the user to run it on the command line. This is what that looks like:

Reviewer Test Plan

Try to update an extension which has added some new feature that requires consent both on the command line and in interactive mode.

Testing Matrix

	🍏	🪟	🐧
npm run	❓	❓	❓
npx	❓	❓	❓
Docker	❓	❓	❓
Podman	❓	-	-
Seatbelt	❓	-	-

Linked issues / bugs

Fixes #9400

…rrors for interactive mode.

gemini-code-assist · 2025-09-24T21:03:56Z

Summary of Changes

Hello @jakemac53, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the extension management system by introducing a robust consent re-request mechanism during updates. It ensures that users are prompted for consent if an extension's permissions or operational scope changes, improving transparency and security. The implementation distinguishes between interactive and non-interactive CLI environments for consent handling, laying the groundwork for future interactive consent flows.

Highlights

Consent Re-request on Extension Update: Implemented a mechanism to re-request user consent when an extension is updated, but only if the consent text (e.g., permissions, server usage, excluded tools) has changed since the last installation. This ensures users are always aware of new or modified permissions.
Differentiated Consent Handling: Introduced separate functions for handling consent in non-interactive (requestConsentNonInteractive) and interactive (requestConsentInteractive) modes. The interactive mode currently informs the user to use the command line for updates requiring consent, as direct interactive consent is not yet fully implemented.
Refactored Extension Installation Logic: The installExtension function now accepts a requestConsent callback and an optional previousExtensionConfig. This allows for dynamic consent prompting based on the context (e.g., install, update, migration) and comparison with prior configurations.
Update Command Integration: The updateExtension and updateAllUpdatableExtensions functions have been updated to utilize the new consent mechanism, passing the appropriate requestConsent function based on whether the operation is interactive or non-interactive.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

github-actions · 2025-09-24T21:05:00Z

Size Change: +1.66 kB (+0.01%)

Total Size: 17.4 MB

Filename	Size	Change
`./bundle/gemini.js`	17.4 MB	+1.66 kB (+0.01%)

ℹ️ View Unchanged

Filename	Size
`./bundle/sandbox-macos-permissive-closed.sb`	1.03 kB
`./bundle/sandbox-macos-permissive-open.sb`	830 B
`./bundle/sandbox-macos-permissive-proxied.sb`	1.31 kB
`./bundle/sandbox-macos-restrictive-closed.sb`	3.29 kB
`./bundle/sandbox-macos-restrictive-open.sb`	3.36 kB
`./bundle/sandbox-macos-restrictive-proxied.sb`	3.56 kB

_{compressed-size-action}

gemini-code-assist

Code Review

This pull request refactors the extension consent mechanism. Instead of a boolean flag, installExtension now accepts a requestConsent function, allowing for different consent flows in interactive and non-interactive modes. It also introduces logic to re-request consent during an update if the extension's required permissions have changed. The changes touch installation, linking, and updating of extensions, along with their corresponding tests and UI components. I've found one critical issue with the rollback logic that could lead to data loss.

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

chrstnb · 2025-09-25T17:31:08Z

This looks good overall, but to clarify: are we showing the consent info on all updates? I'm not sure that we need to render it in the UI at all honestly, we can just say "this requires new consent to update, please update manually"

jakemac53 · 2025-09-25T17:33:41Z

This looks good overall, but to clarify: are we showing the consent info on all updates? I'm not sure that we need to render it in the UI at all honestly, we can just say "this requires new consent to update, please update manually"

Sure I will update it to not output the actual consent text, can include that back in once the consent flow is implemented.

jakemac53 · 2025-09-25T17:40:27Z

Ok, it now looks like this

chrstnb · 2025-09-25T17:48:20Z

One last nit: is there a way to improve the Installation cancelled by user piece?

jakemac53 · 2025-09-25T17:55:09Z

One last nit: is there a way to improve the Installation cancelled by user piece?

Updated to just "Installation cancelled"

chrstnb

…ni#9517) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

… extensions (google-gemini#9517)

…ni#9517) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

jakemac53 added 4 commits September 24, 2025 19:31

add initial flow to ask for consent if the consent text has changed

485e21b

Use an injected implementation for requesting consent, add one that e…

e94ca99

…rrors for interactive mode.

fix up tests

e4a1f50

Update error text to be more generic

578545d

jakemac53 requested a review from a team as a code owner September 24, 2025 21:03

jakemac53 requested a review from chrstnb September 24, 2025 21:03

gemini-code-assist Bot reviewed Sep 24, 2025

View reviewed changes

Comment thread packages/cli/src/config/extensions/update.ts Outdated

Apply Gemini fix for edge case

50d2456

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

jakemac53 mentioned this pull request Sep 24, 2025

Enable a consent flow for extension updates in interactive mode #9522

Closed

jakemac53 enabled auto-merge September 24, 2025 21:38

dont include consent text

75609ed

Merge branch 'main' into re-request-content-on-update

febe454

make installation cancelled message more generic

7acaf82

chrstnb approved these changes Sep 25, 2025

View reviewed changes

jakemac53 added this pull request to the merge queue Sep 25, 2025

Merged via the queue into main with commit a0c8e3b Sep 25, 2025
17 of 19 checks passed

jakemac53 deleted the re-request-content-on-update branch September 25, 2025 18:07

geoffdowns pushed a commit to geoffdowns/gemini-cli that referenced this pull request Sep 26, 2025

Re-request consent if necessary when updating extensions (google-gemi…

33b5760

…ni#9517) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

jkcinouye pushed a commit that referenced this pull request Sep 29, 2025

Re-request consent if necessary when updating extensions (#9517)

d1f8802

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

thacio added a commit to thacio/auditaria that referenced this pull request Oct 4, 2025

Merge Commit 'a0c8e3b': Re-request consent if necessary when updating…

9e11b0a

… extensions (google-gemini#9517)

cocosheng-g pushed a commit that referenced this pull request May 6, 2026

Re-request consent if necessary when updating extensions (#9517)

54f0293

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

sripasg added the size/l A large sized PR label Jun 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Re-request consent if necessary when updating extensions#9517

Re-request consent if necessary when updating extensions#9517
jakemac53 merged 8 commits into
mainfrom
re-request-content-on-update

jakemac53 commented Sep 24, 2025

Uh oh!

gemini-code-assist Bot commented Sep 24, 2025

Uh oh!

github-actions Bot commented Sep 24, 2025 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

chrstnb commented Sep 25, 2025

Uh oh!

jakemac53 commented Sep 25, 2025

Uh oh!

jakemac53 commented Sep 25, 2025

Uh oh!

chrstnb commented Sep 25, 2025

Uh oh!

jakemac53 commented Sep 25, 2025

Uh oh!

chrstnb left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

jakemac53 commented Sep 24, 2025

TLDR

Dive Deeper

Reviewer Test Plan

Testing Matrix

Linked issues / bugs

Uh oh!

gemini-code-assist Bot commented Sep 24, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

github-actions Bot commented Sep 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

chrstnb commented Sep 25, 2025

Uh oh!

jakemac53 commented Sep 25, 2025

Uh oh!

jakemac53 commented Sep 25, 2025

Uh oh!

chrstnb commented Sep 25, 2025

Uh oh!

jakemac53 commented Sep 25, 2025

Uh oh!

chrstnb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Sep 24, 2025 •

edited

Loading