refactor(core): introduce InjectionService with source-aware injection and backend-native background completions#22544
Conversation
…ckground completion support
Rename UserHintService to InjectionService as a generic, source-agnostic
injection mechanism. InjectionService supports typed sources ('user_steering'
and 'background_completion') with source-specific gating — user_steering
respects the model steering toggle while background_completion always fires.
Add background completion lifecycle to ExecutionLifecycleService: tracks
backgrounded executions, fires onBackgroundComplete listeners when they
settle, and supports FormatInjectionFn callbacks so execution creators
control how their output is formatted for reinjection.
Wire AppContainer to route background completions through InjectionService
and submit them to the model when idle, independent of model steering.
|
Hi there! Thank you for your contribution to Gemini CLI. To improve our contribution process and better track changes, we now require all pull requests to be associated with an existing issue, as announced in our recent discussion and as detailed in our CONTRIBUTING.md. This pull request is being closed because it is not currently linked to an issue. Once you have updated the description of this PR to link an issue (e.g., by adding How to link an issue: Thank you for your understanding and for being a part of our community! |
|
Hi @adamfweidman, thank you so much for your contribution to Gemini CLI! We really appreciate the time and effort you've put into this. We're making some updates to our contribution process to improve how we track and review changes. Please take a moment to review our recent discussion post: Improving Our Contribution Process & Introducing New Guidelines. Key Update: Starting January 26, 2026, the Gemini CLI project will require all pull requests to be associated with an existing issue. Any pull requests not linked to an issue by that date will be automatically closed. Thank you for your understanding and for being a part of our community! |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a significant refactoring of the content injection mechanism within the application. By generalizing the Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Thank you for linking an issue! This pull request has been automatically reopened. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request is a well-executed refactoring and feature addition, renaming UserHintService to the more generic InjectionService and introducing support for injecting output from backgrounded executions. However, a significant prompt injection risk has been identified: untrusted output from tools or shell commands is automatically re-injected into the model conversation without sufficient sanitization or delimitation, potentially allowing an attacker to manipulate the LLM's behavior. Furthermore, the InjectionService lacks size limits on injected content, which could lead to excessive memory usage. There is also a high-severity issue where an unhandled exception in a callback could lead to a hung state, and a suggestion has been provided to make this part of the code more robust against errors from external code like extensions, aligning with the rule to log detailed errors when catching exceptions.
|
Size Change: +3.84 kB (+0.01%) Total Size: 26.1 MB
ℹ️ View Unchanged
|
gemini-cli
bot
added
the
status/need-issue
Wire ExecutionLifecycleService.setInjectionService() in Config constructor so backgrounded executions inject directly via settleExecution instead of routing through a useEffect bridge in AppContainer.
adamfweidman
changed the title
…nt loop The agent loop in local-executor now listens via onInjection (all sources) instead of onUserHint (steering only), picking up background completions between turns. This removes the separate bg completion useEffect, refs, state, and callback from AppContainer entirely.
…rface Remove legacy onUserHint/offUserHint/addUserHint methods. All callers now use addInjection(text, source) and onInjection/offInjection with source-based filtering where needed.
adamfweidman
changed the title
…ve dead code Rename getUserHints/getUserHintsAfter/getLatestHintIndex to getInjections/getInjectionsAfter/getLatestInjectionIndex with optional source filter so bg completions don't get formatted as user hints. Swap unshift ordering so bg completions appear before user hints in the message — the model sees context before the user's reaction to it. Remove unused getLastUserHintAt().
adamfweidman
force-pushed
the
afw/injection-service-infra
branch
from
7d53152 to
2727a87
Compare
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request refactors the UserHintService into a more generic InjectionService, enabling different sources of content injection like user steering and background task completions. This is a key step for supporting background tasks, with InjectionService handling injections and ExecutionLifecycleService wiring up the completion of background tasks to this new service. However, a critical security concern has been identified: a potential prompt injection vulnerability in the LocalAgentExecutor due to untrusted output from backgrounded executions being directly concatenated into the model's prompt without proper delimiting or sanitization, which could allow a malicious background process to manipulate the main agent's behavior. This aligns with rules emphasizing sanitization and avoiding direct inclusion of untrusted input in LLM content. Additionally, high-severity robustness issues were found in the new listener notification loops within both InjectionService and ExecutionLifecycleService, where unhandled errors could lead to application crashes. Implementing try...catch blocks with detailed error logging, as per established rules, is suggested to enhance event broadcasting resilience.
mattKorwel
left a comment
mattKorwel
left a comment
There was a problem hiding this comment.
Super excited to get this in. I acutally asked gemini to start writing the background notifications tonight, but thankfully had ti check if any outstanding work was in flight and found this 🙇
Approving now as I'm sure you're working through things. But as the review bot found, the local code review also called out the below:
Key Review Findings
- Security Vulnerability (Prompt Injection)
- Issue: In packages/core/src/agents/local-executor.ts, output from background tasks (bgText) is concatenated directly into the prompt without any sanitization or protective wrapping.
- Risk: A malicious background process could output text designed to hijack the agent's behavior (e.g., instructions to delete files or exfiltrate data).
- Recommendation: Wrap background completions in protective tags (like <background_completion>) similar to how user hints are handled.
- Robustness Concerns
- Issue: The listener notification loops in InjectionService and ExecutionLifecycleService lack error handling.
- Risk: If a single listener (e.g., in a plugin or internal component) throws an error, it will crash the entire service, potentially bringing down the CLI session.
- Recommendation: Implement try-catch blocks within the broadcast loops to ensure a failing listener doesn't impact others.
- Integration Testing Gaps
- Issue: While the new services have unit tests, the integration into local-executor.ts is not fully verified.
- Recommendation: Update local-executor.test.ts to include test cases that specifically verify the new background_completion injection flow.
Overall Recommendation: REQUEST CHANGES
The PR is a strong step forward but requires fixes for the formatting errors, the prompt injection vulnerability, and the robustness issues before it can be safely merged.
mattKorwel
left a comment
mattKorwel
left a comment
There was a problem hiding this comment.
Actually don't want it to accidentally auto merge. Ping me as soon as its cleaned up and we'll submit.
Wrap background completion output in <background_output> XML tags with inline instructions to treat as data, consistent with <user_input> tags used for user steering hints. Guard listener iteration in InjectionService.addInjection and ExecutionLifecycleService.settleExecution with try/catch so a throwing listener doesn't block subsequent listeners or crash the caller.
adamfweidman
force-pushed
the
afw/injection-service-infra
branch
from
2d16fde to
1dc55b2
Compare
… flow Tests cover XML tag wrapping with safety instruction, ordering (background completions before user hints), and source filtering to prevent background output from leaking into user hint getters.
adamfweidman
force-pushed
the
afw/injection-service-infra
branch
from
7a9c372 to
1d86b65
Compare
…n and backend-native background completions (google-gemini#22544)
…n and backend-native background completions (google-gemini#22544)
2 participants
Description
PR 1 of 4 in the background task support chain (
afw/injection-service-infra→afw/execute-options→afw/agnostic-background-ui→afw/remote-agent-backgrounding).Replaces
UserHintServicewith a unifiedInjectionServicethat supports typed injection sources ('user_steering' | 'background_completion'). User steering injections are gated on the model steering toggle; background completions always fire.Key architectural changes:
getInjections(source?)andgetInjectionsAfter(index, source?)filter by source so background completions don't get formatted as user hintsExecutionLifecycleService.setInjectionService()wired inConfigconstructor sosettleExecutioninjects directly — no UI hop neededlocal-executorusesonInjectionwith source-aware queues (pendingHintsQueuefor steering,pendingBgCompletionsQueuefor background), draining both between turnsIssues
Relates to #18197
Changes
UserHintService→InjectionServicewith unifiedaddInjection(text, source)/onInjection/offInjectionAPIFormatInjectionFnandBackgroundCompletionInfotoExecutionLifecycleServicefor background completion lifecycleConfigconstructor +settleExecution)getLastUserHintAt()userHintService→injectionServicerenames and source-filtering listenerTest plan
injectionService.test.ts— 10 tests (source filtering, gating, listeners, clear)subagent-tool.test.ts— 15 tests (user hints with source-aware getters)