MediaMetz/gemini-cli
1
0
Fork 0
mirror of https://github.com/google-gemini/gemini-cli.git synced 2026-07-16 13:00:39 -07:00
Code Issues Packages Projects Releases Wiki Activity

feat(sandbox): dynamic macOS sandbox expansion and worktree support (#23301)

Browse Source
This commit is contained in:
Gal Zahavi
2026-03-23 21:48:13 -07:00
committed by GitHub
parent 7fdf708e1a
commit fe7baee18b
40 changed files with 2201 additions and 183 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/core/src/tools/definitions/__snapshots__/coreToolsModelSnapshots.test.ts.snap
+58
View File
@@ -583,6 +583,35 @@ exports[`coreTools snapshots for specific models > Model: gemini-2.5-pro > snaps
"name": "run_shell_command",
"parametersJsonSchema": {
"properties": {
"additional_permissions": {
"description": "Sandbox permissions for the command. Use this to request additional sandboxed filesystem or network permissions if a previous command failed with "Operation not permitted".",
"properties": {
"fileSystem": {
"properties": {
"read": {
"description": "List of additional absolute paths to allow reading.",
"items": {
"type": "string",
},
"type": "array",
},
"write": {
"description": "List of additional absolute paths to allow writing.",
"items": {
"type": "string",
},
"type": "array",
},
},
"type": "object",
},
"network": {
"description": "Set to true to enable network access for this command.",
"type": "boolean",
},
},
"type": "object",
},
"command": {
"description": "Exact bash command to execute as \`bash -c <command>\`",
"type": "string",
@@ -1348,6 +1377,35 @@ exports[`coreTools snapshots for specific models > Model: gemini-3-pro-preview >
"name": "run_shell_command",
"parametersJsonSchema": {
"properties": {
"additional_permissions": {
"description": "Sandbox permissions for the command. Use this to request additional sandboxed filesystem or network permissions if a previous command failed with "Operation not permitted".",
"properties": {
"fileSystem": {
"properties": {
"read": {
"description": "List of additional absolute paths to allow reading.",
"items": {
"type": "string",
},
"type": "array",
},
"write": {
"description": "List of additional absolute paths to allow writing.",
"items": {
"type": "string",
},
"type": "array",
},
},
"type": "object",
},
"network": {
"description": "Set to true to enable network access for this command.",
"type": "boolean",
},
},
"type": "object",
},
"command": {
"description": "Exact bash command to execute as \`bash -c <command>\`",
"type": "string",
packages/core/src/tools/definitions/base-declarations.ts
+3
View File
@@ -122,3 +122,6 @@ export const EXIT_PLAN_PARAM_PLAN_PATH = 'plan_path';
// -- enter_plan_mode --
export const ENTER_PLAN_MODE_TOOL_NAME = 'enter_plan_mode';
export const PLAN_MODE_PARAM_REASON = 'reason';
// -- sandbox --
export const PARAM_ADDITIONAL_PERMISSIONS = 'additional_permissions';
packages/core/src/tools/definitions/dynamic-declaration-helpers.ts
+30
View File
@@ -23,6 +23,7 @@ import {
SHELL_PARAM_IS_BACKGROUND,
EXIT_PLAN_PARAM_PLAN_PATH,
SKILL_PARAM_NAME,
PARAM_ADDITIONAL_PERMISSIONS,
} from './base-declarations.js';
/**
@@ -109,6 +110,35 @@ export function getShellDeclaration(
description:
'Set to true if this command should be run in the background (e.g. for long-running servers or watchers). The command will be started, allowed to run for a brief moment to check for immediate errors, and then moved to the background.',
},
[PARAM_ADDITIONAL_PERMISSIONS]: {
type: 'object',
description:
'Sandbox permissions for the command. Use this to request additional sandboxed filesystem or network permissions if a previous command failed with "Operation not permitted".',
properties: {
network: {
type: 'boolean',
description:
'Set to true to enable network access for this command.',
},
fileSystem: {
type: 'object',
properties: {
read: {
type: 'array',
items: { type: 'string' },
description:
'List of additional absolute paths to allow reading.',
},
write: {
type: 'array',
items: { type: 'string' },
description:
'List of additional absolute paths to allow writing.',
},
},
},
},
},
},
required: [SHELL_PARAM_COMMAND],
},