fix(core): enforce fail-closed workspace trust and filter mcpServers in restricted mode

[luisfelipe-alt]

Summary

Enforce fail-closed workspace trust resolution and filter out repository-defined mcpServers in @google/gemini-cli-a2a-server when running in untrusted or restricted environments. This prevents unintended process execution during server startup and ensures that environment trust signals take precedence over configuration fallbacks.

Details

• Environment Signal Precedence in checkPathTrust (packages/core/src/utils/trust.ts):
  Evaluates GEMINI_RESTRICTED_MODE, GEMINI_FOLDER_TRUST, and GEMINI_CLI_TRUST_WORKSPACE prior to evaluating local options (options.isFolderTrustEnabled), immediately returning { isTrusted: false, source: 'env' } when an untrusted signal is present. This prevents permissive fallback resolution when restricted mode is active.
• Fail-Closed Fallback in Config.isTrustedFolder() (packages/core/src/config/config.ts):
  Evaluates untrusted environment variables early to return false before checking store context or fallbacks, ensuring downstream components that query isTrustedFolder() accurately reflect the untrusted state.
• Child Process Configuration Filtering (packages/a2a-server/src/config/config.ts):
  In loadConfig(), checks the authoritative trusted argument. When !trusted, strips repository-scoped mcpServers definitions (safeMcpServers = undefined) before assigning them to policySettings and configParams.
• Unit Test Coverage:
  • Added comprehensive test suite packages/a2a-server/src/config/workspace_trust.test.ts validating signal resolution, fail-closed behavior, and MCP configuration filtering under untrusted conditions.
  • Added unit test cases to packages/core/src/utils/trust.test.ts for GEMINI_FOLDER_TRUST and GEMINI_RESTRICTED_MODE.
  • Aligned existing test in packages/a2a-server/src/config/config.test.ts to assert MCP definition mapping with trusted = true.

Related Issues

How to Validate

1. Run targeted unit tests across affected workspaces:

   npm test -w @google/gemini-cli-core -- src/utils/trust.test.ts
   npm test -w @google/gemini-cli-a2a-server -- src/config/workspace_trust.test.ts
   npm test -w @google/gemini-cli-a2a-server -- src/config/config.test.ts

2. Verify lint, formatting, and types:

   npm run lint
   npm run typecheck
   npm run format

Pre-Merge Checklist

• Updated relevant documentation and README (if needed)
• Added/updated tests (if needed)
• Noted breaking changes (if any)
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt
  • Windows
    • npm run
    • npx
    • Docker
  • Linux
    • npm run
    • npx
    • Docker

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request strengthens the security posture of the workspace trust model by enforcing a fail-closed approach. By prioritizing environment-level trust signals and stripping potentially unsafe MCP server configurations in untrusted environments, the changes mitigate risks associated with unintended process execution. These updates ensure that security policies are consistently applied regardless of local configuration fallbacks.

Highlights

• Environment Trust Precedence: Updated trust resolution logic to prioritize environment variables (GEMINI_RESTRICTED_MODE, GEMINI_FOLDER_TRUST, GEMINI_CLI_TRUST_WORKSPACE) over local configuration, ensuring a fail-closed state in restricted environments.
• MCP Server Filtering: Implemented automatic filtering of repository-defined mcpServers in untrusted workspaces to prevent unauthorized process execution during server startup.
• Enhanced Test Coverage: Added a new test suite for workspace trust evaluation and expanded existing core trust utility tests to validate environment signal handling.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces workspace trust evaluation checks to prevent unintended command execution in untrusted environments by stripping mcpServers definitions. It adds support for environment variables like GEMINI_RESTRICTED_MODE, GEMINI_FOLDER_TRUST, and GEMINI_CLI_TRUST_WORKSPACE to determine folder trust, along with comprehensive unit tests. A review comment points out a redundant nullish coalescing check (this.trustedFolder ?? false) in isTrustedFolder() that can be simplified since this.trustedFolder is already guaranteed to be undefined at that point in execution.

[luisfelipe-alt]

/gemini review

[gemini-code-assist]

Code Review

This pull request implements workspace trust evaluation logic by checking environment variables like GEMINI_RESTRICTED_MODE and stripping mcpServers definitions in untrusted workspaces to prevent unintended command execution. Feedback on these changes highlights a critical security vulnerability where repository-defined policyPaths must also be stripped in untrusted workspaces to prevent policy bypass. Additionally, the reviewer recommends centralizing the duplicated environment variable checks by having Config.isTrustedFolder() delegate directly to checkPathTrust().

[github-actions]

📊 PR Size: size/L

• Lines changed: 290
• Additions: +268
• Deletions: -22
• Files changed: 6

[luisfelipe-alt]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces workspace trust evaluation to secure configurations in untrusted environments. It updates checkPathTrust to respect environment signals like GEMINI_RESTRICTED_MODE and GEMINI_FOLDER_TRUST, and modifies loadConfig in a2a-server to strip mcpServers and policyPaths when a workspace is untrusted. Feedback on the changes highlights a security vulnerability where settings.adminPolicyPaths is not stripped in untrusted environments, potentially allowing an attacker to override admin policies via a malicious workspace configuration.

[luisfelipe-alt]

/gemini review

[gemini-code-assist]

Code Review

This pull request enhances workspace trust evaluation by stripping security-sensitive configurations (such as MCP servers and policy paths) when an untrusted workspace is detected, and updates environment variable checks to enforce restricted modes. The review feedback suggests avoiding direct mutation of the settings parameter in loadConfig to prevent unintended side effects, and returning isTrusted directly when the trust source is the environment to ensure environment variables consistently take precedence over local folder settings.

[luisfelipe-alt]

/gemini review

[gemini-code-assist]

Code Review

This pull request implements workspace trust evaluation and folder trust checks across the monorepo, stripping sensitive configurations like mcpServers and policy paths in untrusted environments. However, several critical issues were identified in the review: settings.tools is not stripped in untrusted workspaces, creating a potential remote code execution vulnerability; Config.isTrustedFolder() allows local trust settings to override explicit untrusted signals from the IDE or configuration files; and GEMINI_FOLDER_TRUST=false is incorrectly treated as an untrusted signal instead of disabling trust checks, requiring updates to both the implementation and several unit tests.

[luisfelipe-alt]

/gemini review

[gemini-code-assist]

Code Review

This pull request implements workspace trust evaluation and restriction mechanisms across the monorepo, stripping repository-defined configurations like mcpServers, policyPaths, adminPolicyPaths, and tools in untrusted workspaces, and integrating environment-based trust signals into the core trust utility. The review feedback highlights a security concern where telemetry configurations are not stripped in untrusted workspaces, creating a risk of data exfiltration. Additionally, a test in trust.test.ts is identified as misleading because it stubs an unused environment variable (GEMINI_FOLDER_TRUST).

[luisfelipe-alt]

/gemini review

[gemini-code-assist]

Code Review

This pull request implements workspace trust evaluation and restricted mode handling across the a2a-server and core packages. It refactors checkPathTrust to support the GEMINI_RESTRICTED_MODE environment variable and refines the TrustResult type into a discriminated union. In a2a-server, loadConfig now strips sensitive repository settings (such as MCP servers, policy paths, tools, and telemetry) when a workspace is untrusted. Additionally, comprehensive unit tests have been added to verify these trust boundaries and environment variable behaviors. I have no feedback to provide.