fix(patch): cherry-pick 9ca7300 to release/v0.28.0-preview.1-pr-18395 to patch version v0.28.0-preview.1 and create version 0.28.0-preview.2

[gemini-cli-robot]

This PR automatically cherry-picks commit 9ca7300 to patch version v0.28.0-preview.1 in the preview release to create version 0.28.0-preview.2.

[gemini-code-assist]

Summary of Changes

Hello @gemini-cli-robot, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request is an automated cherry-pick operation, applying a specific fix (commit 9ca7300) to a preview release branch. The primary change involves refining how file paths are validated within the application's configuration by removing a condition that previously bypassed detailed path checks for absolute paths in interactive mode. This ensures more consistent and rigorous path validation across all scenarios, leading to the creation of a new patch version 0.28.0-preview.2.

Highlights

• Path Allowance Logic Refinement: The isPathAllowed method in the configuration now consistently processes all paths. A previous conditional check that allowed any absolute path in interactive mode has been removed, ensuring that all paths undergo the full realpath resolution process.

Changelog

• packages/core/src/config/config.ts
  • Removed a conditional block within the isPathAllowed method. The condition if (this.interactive && path.isAbsolute(absolutePath)) no longer exists, meaning all paths will now undergo the full realpath resolution process.

Activity

• This pull request was automatically generated by gemini-cli-robot to cherry-pick commit 9ca7300c90e6cf407bde5c8b1c9d7fbf74736968 into the release/v0.28.0-preview.1-pr-18395 branch.
• The purpose of this automated action is to create a new patch version 0.28.0-preview.2.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request cherry-picks a critical security fix. The change removes a condition in isPathAllowed that incorrectly permitted access to any absolute path when running in interactive mode. By removing this bypass, all file paths are now consistently validated against the workspace and project temporary directories, which effectively mitigates a potential path traversal vulnerability. The change is correct and significantly improves the security of the tool.

[github-actions]

Size Change: -103 B (0%)

Total Size: 23.7 MB

ℹ️ View Unchanged

Filename	Size	Change
./bundle/gemini.js	23.7 MB	-103 B (0%)
./bundle/sandbox-macos-permissive-closed.sb	1.03 kB	0 B
./bundle/sandbox-macos-permissive-open.sb	890 B	0 B
./bundle/sandbox-macos-permissive-proxied.sb	1.31 kB	0 B
./bundle/sandbox-macos-restrictive-closed.sb	3.29 kB	0 B
./bundle/sandbox-macos-restrictive-open.sb	3.36 kB	0 B
./bundle/sandbox-macos-restrictive-proxied.sb	3.56 kB	0 B

_{compressed-size-action}