refactor(sandbox): use centralized sandbox paths in macOS Seatbelt implementation

[ehedlund]

Summary

Refactors the macOS Sandbox implementation (MacOsSandboxManager and seatbeltArgsBuilder) to consume centrally resolved paths from ResolvedSandboxPaths, eliminating redundant, OS-specific path resolution logic from the Seatbelt builder.

Details

Prior to this change, seatbeltArgsBuilder was performing its own manual path resolution (via tryRealpath and resolveGitWorktreePaths) for the workspace, governance files, secrets, and dynamic permissions.

This PR aligns the macOS implementation with the newly introduced ResolvedSandboxPaths structure provided by the core sandbox manager:

• seatbeltArgsBuilder now accepts a single resolvedPaths: ResolvedSandboxPaths object instead of a scattered collection of raw arrays.
• All manual tryRealpath calls mapping over allowed/forbidden/dynamic permissions have been removed.
• Explicit allow rules for both the workspace.original (the raw path, potentially a symlink) and workspace.resolved (the physical path) are now generated natively from the resolved object.
• Governance file checks and Git worktree detection now strictly evaluate against the workspace.resolved path to ensure accurate physical disk operations.
• The searchPaths for secrets now intelligently scans both the original and resolved workspace roots, along with globalIncludes and policyAllowed.
• The MacOsSandboxManager test suites have been updated to reflect the new interface and to accurately mock ResolvedSandboxPaths objects.

This is a structural, no-op refactoring; behavioral boundaries and system-level sandbox controls remain identical to the previous implementation.

Related Issues

Internal refactor.

How to Validate

1. Run unit tests for macOS sandbox components:

   npm run typecheck -w @google/gemini-cli-core
   npm test -w @google/gemini-cli-core -- src/sandbox/macos

2. Run the core sandbox integration tests:

   npm run test:ci -w @google/gemini-cli-core -- src/services/sandboxManager.integration.test.ts

Pre-Merge Checklist

• Updated relevant documentation and README (if needed)
• Added/updated tests (if needed)
• Noted breaking changes (if any)
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt
  • Windows
    • npm run
    • npx
    • Docker
  • Linux
    • npm run
    • npx
    • Docker

[gemini-cli]

Hi @ehedlund, thank you so much for your contribution to Gemini CLI! We really appreciate the time and effort you've put into this.

We're making some updates to our contribution process to improve how we track and review changes. Please take a moment to review our recent discussion post: Improving Our Contribution Process & Introducing New Guidelines.

Key Update: Starting January 26, 2026, the Gemini CLI project will require all pull requests to be associated with an existing issue. Any pull requests not linked to an issue by that date will be automatically closed.

Thank you for your understanding and for being a part of our community!

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refactors the macOS sandbox implementation to centralize path resolution. By introducing a ResolvedSandboxPaths object, the seatbeltArgsBuilder no longer performs its own redundant, OS-specific path resolution. This change simplifies the interface, ensures consistent path handling across the sandbox, and improves maintainability without altering the existing security or functional behavior of the sandbox.

Highlights

• Centralized Path Resolution: Refactored the macOS Sandbox implementation (MacOsSandboxManager and seatbeltArgsBuilder) to consume centrally resolved paths from ResolvedSandboxPaths.
• Simplified seatbeltArgsBuilder Interface: seatbeltArgsBuilder now accepts a single resolvedPaths: ResolvedSandboxPaths object instead of a scattered collection of raw arrays, eliminating redundant, OS-specific path resolution logic.
• Removed Redundant Path Resolution: All manual tryRealpath calls mapping over allowed/forbidden/dynamic permissions have been removed from the Seatbelt builder.
• Comprehensive Workspace Path Handling: Explicit allow rules for both the workspace.original (raw path, potentially a symlink) and workspace.resolved (physical path) are now generated natively from the resolved object.
• Consistent Governance and Git Handling: Governance file checks and Git worktree detection now strictly evaluate against the workspace.resolved path to ensure accurate physical disk operations.
• Enhanced Secret Search Paths: The searchPaths for secrets now intelligently scans both the original and resolved workspace roots, along with globalIncludes and policyAllowed.
• Updated Test Suites: The MacOsSandboxManager test suites have been updated to reflect the new interface and to accurately mock ResolvedSandboxPaths objects.
• No Behavioral Change: This is a structural, no-op refactoring; behavioral boundaries and system-level sandbox controls remain identical to the previous implementation.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[github-actions]

Size Change: -227 B (0%)

Total Size: 34 MB

Filename	Size	Change
./bundle/chunk-EJGOQX7U.js	0 B	-14.8 MB (removed)	🏆
./bundle/chunk-EPKIH4MP.js	0 B	-3.47 kB (removed)	🏆
./bundle/chunk-YPX4U6RM.js	0 B	-3.16 MB (removed)	🏆
./bundle/core-RLZG6MBF.js	0 B	-45.4 kB (removed)	🏆
./bundle/devtoolsService-F46T5ET6.js	0 B	-28.4 kB (removed)	🏆
./bundle/gemini-RQTWB7R2.js	0 B	-552 kB (removed)	🏆
./bundle/interactiveCli-FGBRC3AQ.js	0 B	-1.65 MB (removed)	🏆
./bundle/oauth2-provider-GGXS7P2Q.js	0 B	-9.16 kB (removed)	🏆
./bundle/chunk-FW5SMMUT.js	14.8 MB	+14.8 MB (new file)	🆕
./bundle/chunk-MC3UDVD6.js	3.47 kB	+3.47 kB (new file)	🆕
./bundle/chunk-UBDFCXLT.js	3.16 MB	+3.16 MB (new file)	🆕
./bundle/core-U6L3PWPW.js	45.4 kB	+45.4 kB (new file)	🆕
./bundle/devtoolsService-XBWQEFLU.js	28.4 kB	+28.4 kB (new file)	🆕
./bundle/gemini-ZOBXAWRV.js	552 kB	+552 kB (new file)	🆕
./bundle/interactiveCli-YFIYGQXB.js	1.65 MB	+1.65 MB (new file)	🆕
./bundle/oauth2-provider-RB4EYMEK.js	9.16 kB	+9.16 kB (new file)	🆕

ℹ️ View Unchanged

Filename	Size	Change
./bundle/bundled/third_party/index.js	8 MB	0 B
./bundle/chunk-34MYV7JD.js	2.45 kB	0 B
./bundle/chunk-5AUYMPVF.js	858 B	0 B
./bundle/chunk-5PS3AYFU.js	1.18 kB	0 B
./bundle/chunk-664ZODQF.js	124 kB	0 B
./bundle/chunk-DAHVX5MI.js	206 kB	0 B
./bundle/chunk-IUUIT4SU.js	56.5 kB	0 B
./bundle/chunk-OGWWODAT.js	1.96 MB	0 B
./bundle/chunk-RJTRUG2J.js	39.8 kB	0 B
./bundle/cleanup-MNV4U33B.js	0 B	-856 B (removed)	🏆
./bundle/devtools-36NN55EP.js	696 kB	0 B
./bundle/dist-T73EYRDX.js	356 B	0 B
./bundle/events-XB7DADIJ.js	418 B	0 B
./bundle/gemini.js	4.97 kB	0 B
./bundle/getMachineId-bsd-TXG52NKR.js	1.55 kB	0 B
./bundle/getMachineId-darwin-7OE4DDZ6.js	1.55 kB	0 B
./bundle/getMachineId-linux-SHIFKOOX.js	1.34 kB	0 B
./bundle/getMachineId-unsupported-5U5DOEYY.js	1.06 kB	0 B
./bundle/getMachineId-win-6KLLGOI4.js	1.72 kB	0 B
./bundle/memoryDiscovery-JNNGTYL3.js	980 B	0 B
./bundle/multipart-parser-KPBZEGQU.js	11.7 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/client/main.js	222 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/_client-assets.js	229 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/index.js	13.4 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/types.js	132 B	0 B
./bundle/sandbox-macos-permissive-open.sb	890 B	0 B
./bundle/sandbox-macos-permissive-proxied.sb	1.31 kB	0 B
./bundle/sandbox-macos-restrictive-open.sb	3.36 kB	0 B
./bundle/sandbox-macos-restrictive-proxied.sb	3.56 kB	0 B
./bundle/sandbox-macos-strict-open.sb	4.82 kB	0 B
./bundle/sandbox-macos-strict-proxied.sb	5.02 kB	0 B
./bundle/src-QVCVGIUX.js	47 kB	0 B
./bundle/tree-sitter-7U6MW5PS.js	274 kB	0 B
./bundle/tree-sitter-bash-34ZGLXVX.js	1.84 MB	0 B
./bundle/cleanup-2FDQYWXM.js	856 B	+856 B (new file)	🆕

_{compressed-size-action}

[gemini-code-assist]

Code Review

This pull request refactors the macOS Seatbelt sandbox profile generation by introducing a ResolvedSandboxPaths structure to handle path resolution more consistently. The changes include updating the SeatbeltArgsOptions interface and the buildSeatbeltProfile function, as well as significant updates to the associated test suites. Feedback highlights a security vulnerability where allow rules for user-provided paths are placed after deny rules for sensitive files, potentially allowing sandbox escapes. Additionally, a regression was noted regarding the execution order of path resolution and command handling, which could lead to permission denials for virtual commands.