@google/gemini-cli-a2a-server 0.40.0-preview.2 → 0.40.0-preview.4

package/dist/a2a-server.mjs

@@ -113797,68 +113797,68 @@ var require_lockfile = __commonJS({
       });
     }
     function updateLock(file, options) {
-      const lock3 = locks[file];
-      if (lock3.updateTimeout) {
+      const lock4 = locks[file];
+      if (lock4.updateTimeout) {
         return;
       }
-      lock3.updateDelay = lock3.updateDelay || options.update;
-      lock3.updateTimeout = setTimeout(() => {
-        lock3.updateTimeout = null;
-        options.fs.stat(lock3.lockfilePath, (err2, stat5) => {
-          const isOverThreshold = lock3.lastUpdate + options.stale < Date.now();
+      lock4.updateDelay = lock4.updateDelay || options.update;
+      lock4.updateTimeout = setTimeout(() => {
+        lock4.updateTimeout = null;
+        options.fs.stat(lock4.lockfilePath, (err2, stat5) => {
+          const isOverThreshold = lock4.lastUpdate + options.stale < Date.now();
           if (err2) {
             if (err2.code === "ENOENT" || isOverThreshold) {
-              return setLockAsCompromised(file, lock3, Object.assign(err2, { code: "ECOMPROMISED" }));
+              return setLockAsCompromised(file, lock4, Object.assign(err2, { code: "ECOMPROMISED" }));
             }
-            lock3.updateDelay = 1e3;
+            lock4.updateDelay = 1e3;
             return updateLock(file, options);
           }
-          const isMtimeOurs = lock3.mtime.getTime() === stat5.mtime.getTime();
+          const isMtimeOurs = lock4.mtime.getTime() === stat5.mtime.getTime();
           if (!isMtimeOurs) {
             return setLockAsCompromised(
               file,
-              lock3,
+              lock4,
               Object.assign(
                 new Error("Unable to update lock within the stale threshold"),
                 { code: "ECOMPROMISED" }
               )
             );
           }
-          const mtime = mtimePrecision.getMtime(lock3.mtimePrecision);
-          options.fs.utimes(lock3.lockfilePath, mtime, mtime, (err3) => {
-            const isOverThreshold2 = lock3.lastUpdate + options.stale < Date.now();
-            if (lock3.released) {
+          const mtime = mtimePrecision.getMtime(lock4.mtimePrecision);
+          options.fs.utimes(lock4.lockfilePath, mtime, mtime, (err3) => {
+            const isOverThreshold2 = lock4.lastUpdate + options.stale < Date.now();
+            if (lock4.released) {
               return;
             }
             if (err3) {
               if (err3.code === "ENOENT" || isOverThreshold2) {
-                return setLockAsCompromised(file, lock3, Object.assign(err3, { code: "ECOMPROMISED" }));
+                return setLockAsCompromised(file, lock4, Object.assign(err3, { code: "ECOMPROMISED" }));
               }
-              lock3.updateDelay = 1e3;
+              lock4.updateDelay = 1e3;
               return updateLock(file, options);
             }
-            lock3.mtime = mtime;
-            lock3.lastUpdate = Date.now();
-            lock3.updateDelay = null;
+            lock4.mtime = mtime;
+            lock4.lastUpdate = Date.now();
+            lock4.updateDelay = null;
             updateLock(file, options);
           });
         });
-      }, lock3.updateDelay);
-      if (lock3.updateTimeout.unref) {
-        lock3.updateTimeout.unref();
+      }, lock4.updateDelay);
+      if (lock4.updateTimeout.unref) {
+        lock4.updateTimeout.unref();
       }
     }
-    function setLockAsCompromised(file, lock3, err2) {
-      lock3.released = true;
-      if (lock3.updateTimeout) {
-        clearTimeout(lock3.updateTimeout);
+    function setLockAsCompromised(file, lock4, err2) {
+      lock4.released = true;
+      if (lock4.updateTimeout) {
+        clearTimeout(lock4.updateTimeout);
       }
-      if (locks[file] === lock3) {
+      if (locks[file] === lock4) {
         delete locks[file];
       }
-      lock3.options.onCompromised(err2);
+      lock4.options.onCompromised(err2);
     }
-    function lock2(file, options, callback) {
+    function lock3(file, options, callback) {
       options = {
         stale: 1e4,
         update: null,
@@ -113888,7 +113888,7 @@ var require_lockfile = __commonJS({
             if (err3) {
               return callback(operation.mainError());
             }
-            const lock3 = locks[file2] = {
+            const lock4 = locks[file2] = {
               lockfilePath: getLockFile(file2, options),
               mtime,
               mtimePrecision: mtimePrecision2,
@@ -113897,7 +113897,7 @@ var require_lockfile = __commonJS({
             };
             updateLock(file2, options);
             callback(null, (releasedCallback) => {
-              if (lock3.released) {
+              if (lock4.released) {
                 return releasedCallback && releasedCallback(Object.assign(new Error("Lock is already released"), { code: "ERELEASED" }));
               }
               unlock(file2, { ...options, realpath: false }, releasedCallback);
@@ -113916,12 +113916,12 @@ var require_lockfile = __commonJS({
         if (err2) {
           return callback(err2);
         }
-        const lock3 = locks[file2];
-        if (!lock3) {
+        const lock4 = locks[file2];
+        if (!lock4) {
           return callback(Object.assign(new Error("Lock is not acquired/owned by you"), { code: "ENOTACQUIRED" }));
         }
-        lock3.updateTimeout && clearTimeout(lock3.updateTimeout);
-        lock3.released = true;
+        lock4.updateTimeout && clearTimeout(lock4.updateTimeout);
+        lock4.released = true;
         delete locks[file2];
         removeLock(file2, options, callback);
       });
@@ -113958,7 +113958,7 @@ var require_lockfile = __commonJS({
         }
       }
     });
-    module2.exports.lock = lock2;
+    module2.exports.lock = lock3;
     module2.exports.unlock = unlock;
     module2.exports.check = check2;
     module2.exports.getLocks = getLocks;
@@ -114036,7 +114036,7 @@ var require_proper_lockfile = __commonJS({
     "use strict";
     var lockfile = require_lockfile();
     var { toPromise, toSync, toSyncOptions } = require_adapter();
-    async function lock2(file, options) {
+    async function lock3(file, options) {
       const release3 = await toPromise(lockfile.lock)(file, options);
       return toPromise(release3);
     }
@@ -114056,8 +114056,8 @@ var require_proper_lockfile = __commonJS({
     function checkSync(file, options) {
       return toSync(lockfile.check)(file, toSyncOptions(options));
     }
-    module2.exports = lock2;
-    module2.exports.lock = lock2;
+    module2.exports = lock3;
+    module2.exports.lock = lock3;
     module2.exports.unlock = unlock;
     module2.exports.lockSync = lockSync;
     module2.exports.unlockSync = unlockSync;
@@ -114715,7 +114715,7 @@ import * as path6 from "node:path";
 import * as os4 from "node:os";
 import * as crypto10 from "node:crypto";
 import * as fs11 from "node:fs";
-var OAUTH_FILE, TMP_DIR_NAME, BIN_DIR_NAME, AGENTS_DIR_NAME, AUTO_SAVED_POLICY_FILENAME, Storage2;
+var OAUTH_FILE, TRUSTED_FOLDERS_FILENAME, TMP_DIR_NAME, BIN_DIR_NAME, AGENTS_DIR_NAME, AUTO_SAVED_POLICY_FILENAME, Storage2;
 var init_storage = __esm({
   "packages/core/dist/src/config/storage.js"() {
     "use strict";
@@ -114723,6 +114723,7 @@ var init_storage = __esm({
     init_projectRegistry();
     init_storageMigration();
     OAUTH_FILE = "oauth_creds.json";
+    TRUSTED_FOLDERS_FILENAME = "trustedFolders.json";
     TMP_DIR_NAME = "tmp";
     BIN_DIR_NAME = "bin";
     AGENTS_DIR_NAME = ".agents";
@@ -114775,6 +114776,12 @@ var init_storage = __esm({
       static getGoogleAccountsPath() {
         return path6.join(_Storage.getGlobalGeminiDir(), GOOGLE_ACCOUNTS_FILENAME);
       }
+      static getTrustedFoldersPath() {
+        if (process.env["GEMINI_CLI_TRUSTED_FOLDERS_PATH"]) {
+          return process.env["GEMINI_CLI_TRUSTED_FOLDERS_PATH"];
+        }
+        return path6.join(_Storage.getGlobalGeminiDir(), TRUSTED_FOLDERS_FILENAME);
+      }
       static getUserCommandsDir() {
         return path6.join(_Storage.getGlobalGeminiDir(), "commands");
       }
@@ -120552,6 +120559,14 @@ function extractNameFromNode(node) {
       return "heredoc (<<)";
     case "herestring_redirect":
       return "herestring (<<<)";
+    case "command_substitution":
+      return "command substitution";
+    case "backtick_substitution":
+      return "backtick substitution";
+    case "process_substitution":
+      return "process substitution";
+    case "subshell":
+      return "subshell";
     default:
       return null;
   }
@@ -121091,7 +121106,11 @@ foreach ($commandAst in $commandAsts) {
       "redirection (<)",
       "redirection (>)",
       "heredoc (<<)",
-      "herestring (<<<)"
+      "herestring (<<<)",
+      "command substitution",
+      "backtick substitution",
+      "process substitution",
+      "subshell"
     ]);
     isWindows = () => os6.platform() === "win32";
     spawnAsync = async (command, args2, options) => {
@@ -209359,8 +209378,8 @@ var GIT_COMMIT_INFO, CLI_VERSION;
 var init_git_commit = __esm({
   "packages/core/dist/src/generated/git-commit.js"() {
     "use strict";
-    GIT_COMMIT_INFO = "aa05b4583";
-    CLI_VERSION = "0.40.0-preview.2";
+    GIT_COMMIT_INFO = "31bdf112d";
+    CLI_VERSION = "0.40.0-preview.4";
   }
 });
 
@@ -329302,7 +329321,7 @@ function getVersion() {
   }
   versionPromise = (async () => {
     const pkgJson = await getPackageJson(__dirname4);
-    return "0.40.0-preview.2";
+    return "0.40.0-preview.4";
   })();
   return versionPromise;
 }
@@ -393322,7 +393341,8 @@ var init_policy_engine = __esm({
           };
         }
         await initializeShellParsers();
-        const subCommands = splitCommands(command);
+        const parsed = parseCommandDetails(command);
+        const subCommands = parsed?.details ?? [];
         if (subCommands.length === 0) {
           if (ruleDecision === PolicyDecision.DENY) {
             return { decision: PolicyDecision.DENY, rule };
@@ -393339,74 +393359,69 @@ var init_policy_engine = __esm({
             rule
           };
         }
-        if (subCommands.length > 0) {
-          debugLogger.debug(`[PolicyEngine.check] Validating shell command: ${subCommands.length} parts`);
-          if (ruleDecision === PolicyDecision.DENY) {
-            return { decision: PolicyDecision.DENY, rule };
-          }
-          let aggregateDecision = PolicyDecision.ALLOW;
-          let responsibleRule;
-          if (this.shouldDowngradeForRedirection(command, allowRedirection)) {
+        debugLogger.debug(`[PolicyEngine.check] Validating shell command: ${subCommands.length} parts`);
+        if (ruleDecision === PolicyDecision.DENY) {
+          return { decision: PolicyDecision.DENY, rule };
+        }
+        let aggregateDecision = ruleDecision;
+        let responsibleRule = rule && ruleDecision === rule.decision ? rule : void 0;
+        if (this.shouldDowngradeForRedirection(command, allowRedirection)) {
+          if (aggregateDecision === PolicyDecision.ALLOW) {
             debugLogger.debug(`[PolicyEngine.check] Downgrading ALLOW to ASK_USER for redirected command: ${command}`);
             aggregateDecision = PolicyDecision.ASK_USER;
             responsibleRule = void 0;
           }
-          for (const rawSubCmd of subCommands) {
-            const subCmd = rawSubCmd.trim();
-            if (subCmd === command) {
-              if (this.shouldDowngradeForRedirection(subCmd, allowRedirection)) {
-                debugLogger.debug(`[PolicyEngine.check] Downgrading ALLOW to ASK_USER for redirected command: ${subCmd}`);
-                if (aggregateDecision === PolicyDecision.ALLOW) {
-                  aggregateDecision = PolicyDecision.ASK_USER;
-                  responsibleRule = void 0;
-                }
+        }
+        for (const detail of subCommands) {
+          if (REDIRECTION_NAMES.has(detail.name)) {
+            continue;
+          }
+          const subCmd = detail.text.trim();
+          const isAtomic = subCmd === command || detail.startIndex === 0 && detail.text.length === command.length;
+          const stripped = stripShellWrapper(subCmd);
+          if (stripped !== subCmd) {
+            const wrapperResult = await this.check({ name: toolName, args: { command: stripped, dir_path } }, serverName, toolAnnotations, subagent, true);
+            if (wrapperResult.decision === PolicyDecision.DENY)
+              return wrapperResult;
+            if (wrapperResult.decision === PolicyDecision.ASK_USER) {
+              if (aggregateDecision === PolicyDecision.ALLOW) {
+                responsibleRule = wrapperResult.rule;
               } else {
-                if (ruleDecision === PolicyDecision.ASK_USER && aggregateDecision === PolicyDecision.ALLOW) {
-                  aggregateDecision = PolicyDecision.ASK_USER;
-                  responsibleRule = rule;
-                }
+                responsibleRule ??= wrapperResult.rule;
               }
-              continue;
-            }
-            const subResult = await this.check({ name: toolName, args: { command: subCmd, dir_path } }, serverName, toolAnnotations, subagent);
-            const subDecision = subResult.decision;
-            if (subDecision === PolicyDecision.DENY) {
-              return {
-                decision: PolicyDecision.DENY,
-                rule: subResult.rule
-              };
-            }
-            if (subDecision === PolicyDecision.ASK_USER) {
               aggregateDecision = PolicyDecision.ASK_USER;
-              if (!responsibleRule) {
+            }
+          }
+          if (!isAtomic) {
+            const subResult = await this.check({ name: toolName, args: { command: subCmd, dir_path } }, serverName, toolAnnotations, subagent, true);
+            if (subResult.decision === PolicyDecision.DENY)
+              return subResult;
+            if (subResult.decision === PolicyDecision.ASK_USER) {
+              if (aggregateDecision === PolicyDecision.ALLOW) {
                 responsibleRule = subResult.rule;
+              } else {
+                responsibleRule ??= subResult.rule;
               }
+              aggregateDecision = PolicyDecision.ASK_USER;
             }
-            if (subDecision === PolicyDecision.ALLOW && this.shouldDowngradeForRedirection(subCmd, allowRedirection)) {
-              debugLogger.debug(`[PolicyEngine.check] Downgrading ALLOW to ASK_USER for redirected command: ${subCmd}`);
+            if (subResult.decision === PolicyDecision.ALLOW && this.shouldDowngradeForRedirection(subCmd, allowRedirection)) {
               if (aggregateDecision === PolicyDecision.ALLOW) {
                 aggregateDecision = PolicyDecision.ASK_USER;
                 responsibleRule = void 0;
               }
             }
           }
-          return {
-            decision: aggregateDecision,
-            // If we stayed at ALLOW, we return the original rule (if any).
-            // If we downgraded, we return the responsible rule (or undefined if implicit).
-            rule: aggregateDecision === ruleDecision ? rule : responsibleRule
-          };
         }
         return {
-          decision: ruleDecision,
-          rule
+          decision: aggregateDecision,
+          rule: aggregateDecision === ruleDecision ? rule : responsibleRule
         };
       }
       /**
        * Check if a tool call is allowed based on the configured policies.
        * Returns the decision and the matching rule (if any).
        */
-      async check(toolCall, serverName, toolAnnotations, subagent) {
+      async check(toolCall, serverName, toolAnnotations, subagent, skipHeuristics = false) {
         if (!serverName && isMcpToolAnnotation(toolAnnotations)) {
           serverName = toolAnnotations._serverName;
         }
@@ -393454,18 +393469,16 @@ var init_policy_engine = __esm({
           if (match2) {
             debugLogger.debug(`[PolicyEngine.check] MATCHED rule: toolName=${rule.toolName}, decision=${rule.decision}, priority=${rule.priority}, argsPattern=${rule.argsPattern?.source || "none"}`);
             let ruleDecision = rule.decision;
-            if (isShellCommand && command && !("commandPrefix" in rule) && !rule.argsPattern) {
+            if (!skipHeuristics && isShellCommand && command && !("commandPrefix" in rule) && !rule.argsPattern) {
               ruleDecision = await this.applyShellHeuristics(command, ruleDecision);
             }
             if (isShellCommand && toolName) {
               const shellResult = await this.checkShellCommand(toolName, command, ruleDecision, serverName, shellDirPath, rule.allowRedirection, rule, toolAnnotations, subagent);
               decision = shellResult.decision;
-              if (shellResult.rule) {
-                matchedRule = shellResult.rule;
-                break;
-              }
+              matchedRule = shellResult.rule;
+              break;
             } else {
-              decision = rule.decision;
+              decision = ruleDecision;
               matchedRule = rule;
               break;
             }
@@ -393481,7 +393494,7 @@ var init_policy_engine = __esm({
           debugLogger.debug(`[PolicyEngine.check] NO MATCH - using default decision: ${this.defaultDecision}`);
           if (toolName && SHELL_TOOL_NAMES.includes(toolName)) {
             let heuristicDecision = this.defaultDecision;
-            if (command) {
+            if (!skipHeuristics && command) {
               heuristicDecision = await this.applyShellHeuristics(command, heuristicDecision);
             }
             const shellResult = await this.checkShellCommand(toolName, command, heuristicDecision, serverName, shellDirPath, false, void 0, toolAnnotations, subagent);
@@ -396267,7 +396280,7 @@ var init_security = __esm({
 // packages/core/dist/src/policy/config.js
 import * as path79 from "node:path";
 import { fileURLToPath as fileURLToPath15 } from "node:url";
-var import_toml3, __filename6, __dirname8, DEFAULT_CORE_POLICIES_DIR, WORKSPACE_POLICY_TIER, USER_POLICY_TIER, MCP_EXCLUDED_PRIORITY, EXCLUDE_TOOLS_FLAG_PRIORITY, ALLOWED_TOOLS_FLAG_PRIORITY, TRUSTED_MCP_SERVER_PRIORITY, ALLOWED_MCP_SERVER_PRIORITY, ALWAYS_ALLOW_PRIORITY;
+var import_toml3, __filename6, __dirname8, DEFAULT_CORE_POLICIES_DIR, WORKSPACE_POLICY_TIER, USER_POLICY_TIER, MCP_EXCLUDED_PRIORITY, EXCLUDE_TOOLS_FLAG_PRIORITY, CONFIRMATION_REQUIRED_PRIORITY, ALLOWED_TOOLS_FLAG_PRIORITY, CORE_TOOLS_FLAG_PRIORITY, TRUSTED_MCP_SERVER_PRIORITY, ALLOWED_MCP_SERVER_PRIORITY, ALWAYS_ALLOW_PRIORITY;
 var init_config3 = __esm({
   "packages/core/dist/src/policy/config.js"() {
     "use strict";
@@ -396292,7 +396305,9 @@ var init_config3 = __esm({
     USER_POLICY_TIER = 4;
     MCP_EXCLUDED_PRIORITY = USER_POLICY_TIER + 0.9;
     EXCLUDE_TOOLS_FLAG_PRIORITY = USER_POLICY_TIER + 0.4;
+    CONFIRMATION_REQUIRED_PRIORITY = USER_POLICY_TIER + 0.35;
     ALLOWED_TOOLS_FLAG_PRIORITY = USER_POLICY_TIER + 0.3;
+    CORE_TOOLS_FLAG_PRIORITY = USER_POLICY_TIER + 0.25;
     TRUSTED_MCP_SERVER_PRIORITY = USER_POLICY_TIER + 0.2;
     ALLOWED_MCP_SERVER_PRIORITY = USER_POLICY_TIER + 0.1;
     ALWAYS_ALLOW_PRIORITY = WORKSPACE_POLICY_TIER + ALWAYS_ALLOW_PRIORITY_OFFSET;
@@ -425594,6 +425609,26 @@ var init_profiles = __esm({
   }
 });
 
+// packages/core/dist/src/utils/trust.js
+var import_proper_lockfile2, import_strip_json_comments2, TrustLevel;
+var init_trust = __esm({
+  "packages/core/dist/src/utils/trust.js"() {
+    "use strict";
+    import_proper_lockfile2 = __toESM(require_proper_lockfile(), 1);
+    import_strip_json_comments2 = __toESM(require_strip_json_comments(), 1);
+    init_storage();
+    init_paths();
+    init_errors2();
+    init_events();
+    init_ideContext();
+    (function(TrustLevel2) {
+      TrustLevel2["TRUST_FOLDER"] = "TRUST_FOLDER";
+      TrustLevel2["TRUST_PARENT"] = "TRUST_PARENT";
+      TrustLevel2["DO_NOT_TRUST"] = "DO_NOT_TRUST";
+    })(TrustLevel || (TrustLevel = {}));
+  }
+});
+
 // packages/core/dist/src/index.js
 var init_src2 = __esm({
   "packages/core/dist/src/index.js"() {
@@ -425790,6 +425825,7 @@ var init_src2 = __esm({
     init_responseFormatter();
     init_types18();
     init_profiles();
+    init_trust();
   }
 });
 
@@ -442752,7 +442788,7 @@ init_dist4();
 
 // packages/a2a-server/src/config/settings.ts
 init_dist4();
-var import_strip_json_comments2 = __toESM(require_strip_json_comments(), 1);
+var import_strip_json_comments3 = __toESM(require_strip_json_comments(), 1);
 import * as fs78 from "node:fs";
 import * as path85 from "node:path";
 var USER_SETTINGS_DIR = path85.join(homedir(), GEMINI_DIR);
@@ -442765,7 +442801,7 @@ function loadSettings(workspaceDir) {
     if (fs78.existsSync(USER_SETTINGS_PATH)) {
       const userContent = fs78.readFileSync(USER_SETTINGS_PATH, "utf-8");
       const parsedUserSettings = JSON.parse(
-        (0, import_strip_json_comments2.default)(userContent)
+        (0, import_strip_json_comments3.default)(userContent)
       );
       userSettings = resolveEnvVarsInObject(parsedUserSettings);
     }
@@ -442784,7 +442820,7 @@ function loadSettings(workspaceDir) {
     if (fs78.existsSync(workspaceSettingsPath)) {
       const projectContent = fs78.readFileSync(workspaceSettingsPath, "utf-8");
       const parsedWorkspaceSettings = JSON.parse(
-        (0, import_strip_json_comments2.default)(projectContent)
+        (0, import_strip_json_comments3.default)(projectContent)
       );
       workspaceSettings = resolveEnvVarsInObject(parsedWorkspaceSettings);
     }