MediaMetz/gemini-cli
1
0
Fork 0
mirror of https://github.com/google-gemini/gemini-cli.git synced 2026-07-11 02:20:48 -07:00
Code Issues Packages Projects Releases Wiki Activity

feat(sandbox): resolve custom seatbelt profiles from $HOME/.gemini first (#25427)

Browse Source 
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
This commit is contained in:
Matt Van Horn
2026-04-16 18:21:24 -04:00
committed by GitHub
parent fe890429a4
commit 63e4bb985b
2 changed files with 116 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/cli/src/utils/sandbox.ts
+10 -2
View File
@@ -68,9 +68,17 @@ export async function start_sandbox(
let profileFile = fileURLToPath(
new URL(`sandbox-macos-${profile}.sb`, import.meta.url),
);
// if profile name is not recognized, then look for file under project settings directory
// if profile name is not recognized, look in user-level ~/.gemini first,
// then fall back to project-level .gemini. path.basename() strips any
// directory separators to prevent path traversal via SEATBELT_PROFILE.
if (!BUILTIN_SEATBELT_PROFILES.includes(profile)) {
profileFile = path.join(GEMINI_DIR, `sandbox-macos-${profile}.sb`);
const safeProfile = path.basename(profile);
const fileName = `sandbox-macos-${safeProfile}.sb`;
const userProfileFile = path.join(homedir(), GEMINI_DIR, fileName);
const projectProfileFile = path.join(GEMINI_DIR, fileName);
profileFile = fs.existsSync(userProfileFile)
? userProfileFile
: projectProfileFile;
}
if (!fs.existsSync(profileFile)) {
throw new FatalSandboxError(