gemini-cli/packages/cli/src/commands/extensions/examples/policies/README.md

Policy engine example extension

This extension demonstrates how to contribute security rules and safety checkers to the Gemini CLI Policy Engine.

Description

The extension uses a policies/ directory containing .toml files to define:

• A rule that requires user confirmation for rm -rf commands.
• A rule that denies searching for sensitive files (like .env) using grep.
• A safety checker that validates file paths for all write operations.

Structure

• gemini-extension.json: The manifest file.
• policies/: Contains the .toml policy files.

How to use

1. Link this extension to your local Gemini CLI installation:

   gemini extensions link packages/cli/src/commands/extensions/examples/policies
   

2. Restart your Gemini CLI session.

3. Observe the policies:

   • Try asking the model to delete a directory: The policy engine will prompt you for confirmation due to the rm -rf rule.
   • Try asking the model to search for secrets: The grep rule will deny the request and display the custom deny message.
   • Any file write operation will now be processed through the allowed-path safety checker.

Security note

For security, Gemini CLI ignores any allow decisions or yolo mode configurations contributed by extensions. This ensures that extensions can strengthen security but cannot bypass user confirmation.