fix(patch): cherry-pick 7837194 to release/v0.33.0-preview.5-pr-21487 to patch version v0.33.0-preview.5 and create version 0.33.0-preview.6

[gemini-cli-robot]

This PR automatically cherry-picks commit 7837194 to patch version v0.33.0-preview.5 in the preview release to create version 0.33.0-preview.6.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request, an automated cherry-pick, significantly enhances the application's path resolution mechanism. It introduces a more robust resolveToRealPath utility that correctly handles symbolic links and resolves paths even when intermediate components do not exist. This improvement centralizes path handling, simplifies related logic in configuration and workspace contexts, and ensures more accurate and secure path validation across the codebase.

Highlights

• Improved Path Resolution: The resolveToRealPath utility has been significantly enhanced to robustly handle symbolic links and resolve paths even when intermediate components do not exist, ensuring more accurate path validation.
• Refactored Configuration Path Handling: The isPathAllowed method in the Config class was simplified by delegating its path resolution logic to the newly improved resolveToRealPath function, removing a redundant os import in the process.
• Centralized Workspace Path Resolution: The WorkspaceContext now utilizes the centralized resolveToRealPath for its fullyResolvedPath method, eliminating duplicate and less robust path resolution logic, including the removal of the isFileSymlink helper.
• Enhanced Test Coverage: New test cases were added for resolveToRealPath to specifically verify its behavior with recursive symlink resolution for non-existent child paths, improving the reliability of path handling.

Changelog

• packages/core/src/config/config.ts
  • Removed unused os import.
  • Updated isPathAllowed to utilize the new resolveToRealPath function.
• packages/core/src/config/storage.test.ts
  • Modified expected error messages in tests to dynamically include resolved project root paths, aligning with the updated path resolution logic.
• packages/core/src/utils/paths.test.ts
  • Updated a test description for resolveToRealPath to specifically mention ENOENT errors.
  • Added a new test case to verify resolveToRealPath correctly handles recursive symlink resolution for non-existent child paths.
• packages/core/src/utils/paths.ts
  • Refactored resolveToRealPath to delegate to a new robustRealpath helper.
  • Implemented robustRealpath to provide more resilient path resolution, including recursive symlink traversal and handling of non-existent path components by resolving parent directories.
• packages/core/src/utils/workspaceContext.ts
  • Removed the isNodeError import and the isFileSymlink helper function.
  • Refactored fullyResolvedPath to directly use the improved resolveToRealPath utility, simplifying its implementation.

Activity

• Automatically cherry-picked commit 7837194ab54fb66ee88153734c9be53b10085340 from the main branch to the release/v0.33.0-preview.5-pr-21487 branch.
• Created a new patch version v0.33.0-preview.6.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[github-actions]

Size Change: -247 B (0%)

Total Size: 25.9 MB

ℹ️ View Unchanged

Filename	Size	Change
./bundle/gemini.js	25.4 MB	-247 B (0%)
./bundle/node_modules/@google/gemini-cli-devtools/dist/client/main.js	221 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/_client-assets.js	227 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/index.js	11.5 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/types.js	132 B	0 B
./bundle/sandbox-macos-permissive-open.sb	890 B	0 B
./bundle/sandbox-macos-permissive-proxied.sb	1.31 kB	0 B
./bundle/sandbox-macos-restrictive-open.sb	3.36 kB	0 B
./bundle/sandbox-macos-restrictive-proxied.sb	3.56 kB	0 B
./bundle/sandbox-macos-strict-open.sb	4.82 kB	0 B
./bundle/sandbox-macos-strict-proxied.sb	5.02 kB	0 B

_{compressed-size-action}

[gemini-code-assist]

Code Review

This pull request refactors path resolution, centralizing logic in a new robustRealpath function to improve maintainability and correctness, especially for symbolic links and non-existent components. However, the robustRealpath implementation has a critical flaw: it's vulnerable to infinite recursion and a stack overflow (DoS) with certain symlink structures, which could be exploited to bypass security. Furthermore, its broad catch block can mask important errors, leading to incorrect path resolution. These issues contradict established repository rules regarding robust recursive handlers and consistent path resolution.