refactor(core): extract and centralize sandbox path utilities

[ehedlund]

Summary

Extracts path deduplication and identity generation logic from sandboxManager to paths.ts to ensure uniform case-insensitivity handling across the workspace, and patches a Windows drive root path evaluation bug.

Details

• Path Utilities: Core path utilities (sanitizePaths, getPathIdentity) were relocated from the bloated sandboxManager.ts to a dedicated utils/paths.ts and renamed to deduplicateAbsolutePaths and toPathKey. This enforces consistent path case-insensitivity rules across the agent lifecycle.
• Windows Drive Roots: Fixed a bug in toPathKey where trailing slashes were incorrectly stripped from Windows drive roots (e.g., C:\ -> c:). This prevented isSubpath checks from behaving deterministically when users operated at the root of a drive.
• Client Updates: Updated sandboxPolicyManager.ts and shell.ts to consume the centralized path utilities, guaranteeing that critical rules—such as path case-insensitivity on Windows and macOS—are applied identically across the entire agent lifecycle.
• Testing Standards: Converted the path tests to strictly use process.platform rather than os.platform() and updated the test suite to use the repository's standard mockPlatform helper for stability.

Related Issues

None.

Pre-Merge Checklist

• Updated relevant documentation and README (if needed)
• Added/updated tests (if needed)
• Noted breaking changes (if any)
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt
  • Windows
    • npm run
    • npx
    • Docker
  • Linux
    • npm run
    • npx
    • Docker

[gemini-cli]

Hi @ehedlund, thank you so much for your contribution to Gemini CLI! We really appreciate the time and effort you've put into this.

We're making some updates to our contribution process to improve how we track and review changes. Please take a moment to review our recent discussion post: Improving Our Contribution Process & Introducing New Guidelines.

Key Update: Starting January 26, 2026, the Gemini CLI project will require all pull requests to be associated with an existing issue. Any pull requests not linked to an issue by that date will be automatically closed.

Thank you for your understanding and for being a part of our community!

[github-actions]

🛑 Action Required: Evaluation Approval

Steering changes have been detected in this PR. To prevent regressions, a maintainer must approve the evaluation run before this PR can be merged.

Maintainers:

1. Go to the Workflow Run Summary.
2. Click the yellow 'Review deployments' button.
3. Select the 'eval-gate' environment and click 'Approve'.

Once approved, the evaluation results will be posted here automatically.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refactors the codebase by centralizing path manipulation logic. By moving these utilities into a shared location, the changes ensure that path comparisons and deduplication are handled consistently across different operating systems, specifically addressing case-insensitivity requirements on Windows and macOS.

Highlights

• Centralized Path Utilities: Extracted path deduplication and identity generation logic from the sandbox manager into a dedicated utility file to reduce code duplication and improve maintainability.
• Consistent Case-Insensitivity: Implemented robust path normalization that accounts for case-insensitivity on Windows and macOS, ensuring uniform behavior across the agent lifecycle.
• Refactored API: Renamed core utilities to deduplicateAbsolutePaths and toPathKey to better reflect their purpose and updated all dependent modules accordingly.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[github-actions]

Size Change: +68 B (0%)

Total Size: 34.1 MB

Filename	Size	Change
./bundle/chunk-6C7YLK4P.js	0 B	-14.8 MB (removed)	🏆
./bundle/chunk-BXVQSWCV.js	0 B	-3.16 MB (removed)	🏆
./bundle/chunk-LLYV7VFQ.js	0 B	-3.8 kB (removed)	🏆
./bundle/chunk-P52CHEF3.js	0 B	-1.96 MB (removed)	🏆
./bundle/core-FXRURLCV.js	0 B	-46.2 kB (removed)	🏆
./bundle/devtoolsService-ZTKV6TJM.js	0 B	-28.4 kB (removed)	🏆
./bundle/gemini-AMOSQJZ2.js	0 B	-552 kB (removed)	🏆
./bundle/interactiveCli-5Y5TDVYT.js	0 B	-1.66 MB (removed)	🏆
./bundle/oauth2-provider-R3B2AWKF.js	0 B	-9.16 kB (removed)	🏆
./bundle/chunk-66FHRCAL.js	3.8 kB	+3.8 kB (new file)	🆕
./bundle/chunk-DWJPEYKX.js	14.8 MB	+14.8 MB (new file)	🆕
./bundle/chunk-UQUUWW36.js	1.97 MB	+1.97 MB (new file)	🆕
./bundle/chunk-WC23NNGS.js	3.16 MB	+3.16 MB (new file)	🆕
./bundle/core-RQ43DQYP.js	46.2 kB	+46.2 kB (new file)	🆕
./bundle/devtoolsService-J5VVJFKC.js	28.4 kB	+28.4 kB (new file)	🆕
./bundle/gemini-CZ4RKFYY.js	552 kB	+552 kB (new file)	🆕
./bundle/interactiveCli-WNAJNQLA.js	1.66 MB	+1.66 MB (new file)	🆕
./bundle/oauth2-provider-WZJOZFK7.js	9.16 kB	+9.16 kB (new file)	🆕

ℹ️ View Unchanged

Filename	Size	Change
./bundle/bundled/third_party/index.js	8 MB	0 B
./bundle/chunk-34MYV7JD.js	2.45 kB	0 B
./bundle/chunk-5AUYMPVF.js	858 B	0 B
./bundle/chunk-5PS3AYFU.js	1.18 kB	0 B
./bundle/chunk-664ZODQF.js	124 kB	0 B
./bundle/chunk-DAHVX5MI.js	206 kB	0 B
./bundle/chunk-IUUIT4SU.js	56.5 kB	0 B
./bundle/chunk-RJTRUG2J.js	39.8 kB	0 B
./bundle/cleanup-5EK22CZ3.js	0 B	-932 B (removed)	🏆
./bundle/devtools-36NN55EP.js	696 kB	0 B
./bundle/dist-T73EYRDX.js	356 B	0 B
./bundle/events-XB7DADIJ.js	418 B	0 B
./bundle/gemini.js	4.97 kB	0 B
./bundle/getMachineId-bsd-TXG52NKR.js	1.55 kB	0 B
./bundle/getMachineId-darwin-7OE4DDZ6.js	1.55 kB	0 B
./bundle/getMachineId-linux-SHIFKOOX.js	1.34 kB	0 B
./bundle/getMachineId-unsupported-5U5DOEYY.js	1.06 kB	0 B
./bundle/getMachineId-win-6KLLGOI4.js	1.72 kB	0 B
./bundle/memoryDiscovery-23MICZEL.js	0 B	-980 B (removed)	🏆
./bundle/multipart-parser-KPBZEGQU.js	11.7 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/client/main.js	222 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/_client-assets.js	229 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/index.js	13.4 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/types.js	132 B	0 B
./bundle/sandbox-macos-permissive-open.sb	890 B	0 B
./bundle/sandbox-macos-permissive-proxied.sb	1.31 kB	0 B
./bundle/sandbox-macos-restrictive-open.sb	3.36 kB	0 B
./bundle/sandbox-macos-restrictive-proxied.sb	3.56 kB	0 B
./bundle/sandbox-macos-strict-open.sb	4.82 kB	0 B
./bundle/sandbox-macos-strict-proxied.sb	5.02 kB	0 B
./bundle/src-QVCVGIUX.js	47 kB	0 B
./bundle/tree-sitter-7U6MW5PS.js	274 kB	0 B
./bundle/tree-sitter-bash-34ZGLXVX.js	1.84 MB	0 B
./bundle/cleanup-AKRGZXI4.js	932 B	+932 B (new file)	🆕
./bundle/memoryDiscovery-FG4KJ7OU.js	980 B	+980 B (new file)	🆕

_{compressed-size-action}

[gemini-code-assist]

Code Review

This pull request introduces deduplicateAbsolutePaths and toPathKey utilities in packages/core to standardize path normalization and deduplication across sandbox policies and shell tools. The review identified a bug in toPathKey regarding the handling of Windows drive roots and suggested using the mockPlatform helper in tests for improved consistency and platform-specific coverage.

[galz10]

Code Review: refactor(core): extract and centralize sandbox path utilities

This is a high-quality refactor that successfully centralizes path identity logic and fixes a critical Windows-specific bug. The implementation is robust and the test updates are thorough.

Summary of Changes

• Bug Fix: Resolved the Windows drive root issue where C:\ was incorrectly normalized to c:, breaking subpath checks.
• Refactor: Relocated and renamed path utilities from sandboxManager.ts to utils/paths.ts for better discoverability and reuse.
• Standards: Standardized on process.platform and updated tests to use the mockPlatform helper.

Implementation Notes

• Windows Drive Roots: The regex check in toPathKey correctly identifies drive roots and preserves the trailing slash, which is essential for consistent behavior across the agent's filesystem operations.
• Deduplication: Using a Map in deduplicateAbsolutePaths effectively preserves the casing of the first-encountered path while ensuring identity-based uniqueness.

Suggestions (Nits)

• Hoisting Constants: In utils/paths.ts, consider hoisting the platform check and the Windows drive root regex to the module level. Since toPathKey is called frequently during agent loops, this avoids redundant evaluations.
• Efficiency in Shell Tool: In shell.ts, the approvedPaths.some loop currently calls resolveToRealPath and toPathKey on every iteration. Pre-calculating these identities once before entering the loop would provide a minor performance win, especially for sessions with many approved paths.

Great work on this!