From 986a2b7117945eadd2df7a78d446135b7eb3ac5d Mon Sep 17 00:00:00 2001
From: Om Patel <ompatel@google.com>
Date: Thu, 21 May 2026 16:44:30 -0400
Subject: [PATCH] fix(cli): prevent workspace overrides of security settings

Use UNION merge strategy for critical security array settings (MCP blacklist, allowed extensions, environment variable redaction) to ensure global user settings cannot be bypassed by workspace configurations.
---
 packages/cli/src/config/settingsSchema.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/packages/cli/src/config/settingsSchema.ts b/packages/cli/src/config/settingsSchema.ts
index e3d68415e9..d4e67b8b28 100644
--- a/packages/cli/src/config/settingsSchema.ts
+++ b/packages/cli/src/config/settingsSchema.ts
@@ -1689,6 +1689,7 @@ const SETTINGS_SCHEMA = {
         `,
         showInDialog: false,
         items: { type: 'string' },
+        mergeStrategy: MergeStrategy.UNION,
       },
       exclude: {
         type: 'array',
@@ -1784,6 +1785,7 @@ const SETTINGS_SCHEMA = {
         description: 'A list of MCP servers to allow.',
         showInDialog: false,
         items: { type: 'string' },
+        mergeStrategy: MergeStrategy.UNION,
       },
       excluded: {
         type: 'array',
@@ -1794,6 +1796,7 @@ const SETTINGS_SCHEMA = {
         description: 'A list of MCP servers to exclude.',
         showInDialog: false,
         items: { type: 'string' },
+        mergeStrategy: MergeStrategy.UNION,
       },
     },
   },
@@ -1886,6 +1889,7 @@ const SETTINGS_SCHEMA = {
           'List of Regex patterns for allowed extensions. If nonempty, only extensions that match the patterns in this list are allowed. Overrides the blockGitExtensions setting.',
         showInDialog: true,
         items: { type: 'string' },
+        mergeStrategy: MergeStrategy.UNION,
       },
       folderTrust: {
         type: 'object',
@@ -1926,6 +1930,7 @@ const SETTINGS_SCHEMA = {
               'Environment variables to always allow (bypass redaction).',
             showInDialog: false,
             items: { type: 'string' },
+            mergeStrategy: MergeStrategy.UNION,
           },
           blocked: {
             type: 'array',
@@ -1936,6 +1941,7 @@ const SETTINGS_SCHEMA = {
             description: 'Environment variables to always redact.',
             showInDialog: false,
             items: { type: 'string' },
+            mergeStrategy: MergeStrategy.UNION,
           },
           enabled: {
             type: 'boolean',