Commit Graph

35 Commits

Author SHA1 Message Date
Tolik Malibroda
1d20cedf03 fix: Disable automatic image building if BUILD_SANDBOX is not provided (#764) 2025-06-05 18:47:39 +02:00
Tolik Malibroda
4d4cf0f2f9 feat: Add multi-stage docker build support for custom sandbox.Dockerfile (#746) 2025-06-05 17:46:54 +02:00
Jacob Richman
aa386d135b Jacob314/memory fixes (#754)
Address multiple possible memory leaks found bystatic analysis of the codebase. The primary source of the leaks was event listeners on child processes and global objects that were not being properly removed, potentially causing their closures to be retained in memory indefinitely particularly for processes that did not exit.

There are two commits. A larger one made by gemini CLI and a smaller one by me to make sure we always disconnect child processes as part of the cleanup methods. These changes may not actually fix any leaks but do look like reasonable defensive coding to avoid leaking event listeners or child processes.

The following files were fixed:
This is Gemini's somewhat overconfident description of what it did.

packages/core/src/tools/shell.ts: Fixed a leak where an abortSignal listener was not being reliably removed.
packages/cli/src/utils/readStdin.ts: Fixed a significant leak where listeners on process.stdin were never removed.
packages/cli/src/utils/sandbox.ts: Fixed leaks in the imageExists and pullImage helper functions where listeners on spawned child processes were not being removed.
packages/core/src/tools/grep.ts: Fixed three separate leaks in the isCommandAvailable check and the git grep and system grep strategies due to un-removed listeners on child processes.
packages/core/src/tools/tool-registry.ts: Corrected a leak in the execute method of the DiscoveredTool class where listeners on the spawned tool process were not being removed.
2025-06-05 06:40:33 -07:00
Tolik Malibroda
4b2af10b04 fix: Fix piped input mode in sandbox (#739) 2025-06-04 08:24:33 +02:00
Olcan
12059eb4ca fix BUILD_SANDBOX env var for updating sandbox while running linked binary (#729) 2025-06-03 14:02:00 -07:00
Brandon Keiji
e96fd677ee fix: do not try to pull development sandbox image from the internet (#725) 2025-06-03 19:32:17 +00:00
Brandon Keiji
0869fd168f fix(sandbox): pull sandbox image if it doesnt exist locally (#628) 2025-05-30 20:49:47 +00:00
Brandon Keiji
31a7affb74 feat(sandbox): use package config to dictate sandbox image name (#624) 2025-05-30 19:28:46 +00:00
Olcan
4b7248fc46 allow writing to user cache directory on macos (fixes use of lyria mcp server [to generate songs] under seatbelt) (#600) 2025-05-29 15:06:09 -07:00
Olcan
70277591c4 update email to gemini-cli-dev (#510) 2025-05-23 08:35:16 -07:00
Olcan
17e28036fa fix HOME in sandbox on cloudtops (linux) (#454) 2025-05-20 15:30:49 -07:00
Olcan
76cf5e9fc1 rename env vars GEMINI_CODE_{MODEL,SANDBOX,SANDBOX_IMAGE} (#411) 2025-05-17 17:28:44 -07:00
Olcan
f3d9a499dd move sandbox-related messages to stderr (#363) 2025-05-15 10:54:30 -07:00
Brandon Keiji
3be8b6dc34 fix(sandbox): default to current user profile for debian/ubuntu env (#337) 2025-05-13 21:13:54 +00:00
Brandon Keiji
8da7a71d9a refactor: shorten 'gemini' binary name (#329) 2025-05-13 10:49:45 -07:00
Taylor Mullen
cf91f72c5c Remove terminal tool and dependencies.
- We now solely use the shell tool. This deletes all content around the legacy terminal tool so we can focus on improving the new Shell tool.
- Remove instances from sandboxing, tests, utilities etc.
2025-05-11 12:35:55 -07:00
Olcan
92c1279de6 sandbox/seatbelt-aware system prompt, support for custom seatbelt profiles under project settings (#304) 2025-05-09 11:33:05 -07:00
Olcan
b35a3856a2 fix debugging with seatbelt, including in strict profile (#300) 2025-05-09 08:44:40 -07:00
Brandon Keiji
4741c9a6eb fix(sandbox): set --inspect-brk in production sandbox when env DEBUG is truthy (#295) 2025-05-08 21:12:19 -07:00
Olcan
6b0ac084b8 allow SEATBELT_PROFILE=none to disable seatbelt on macos (#296) 2025-05-08 15:52:04 -07:00
Olcan
b1c449d11c refined sandbox/seatbelt log message, pass NODE_OPTIONS along to sandboxed node (#292) 2025-05-08 14:50:35 -07:00
Olcan
b59a940057 adjust seatbelt to allow write into specific dirs under user home (#289) 2025-05-08 11:28:45 -07:00
Olcan
327bd5f836 rename SANDBOX_EXEC_PROFILE as SEATBELT_PROFILE, and fix another accidental rephrasing (#285) 2025-05-07 21:31:30 -07:00
Olcan
d524309e3c use seatbelt on macos, with two profiles: minimal (default) which only restricts writes, and strict, which is deny-by-default and only allows specific operations (#283) 2025-05-07 20:03:29 -07:00
Brandon Keiji
739654bb25 fix(sandbox): consolidate dev and prod sandbox (#273) 2025-05-07 07:23:13 -07:00
Olcan
cfdbea4dc2 make sandbox venv support more robust, allowing arbitrary venv path, and ignoring venv outside workdir (instead of erroring out) (#254) 2025-05-03 09:12:44 -07:00
Olcan
3a1abb07bf enable recreating a python virtual env (.venv folder) inside sandbox (#253) 2025-05-03 00:39:31 -07:00
Olcan
69d1c644d9 custom sandboxing via sandbox.Dockerfile and sandbox.bashrc in project settings (#249) 2025-05-02 14:07:40 -07:00
Olcan
f237082c37 pass PATH and PYTHONPATH into sandbox, let sandbox scripts recognize user settings for sandbox (#247) 2025-05-02 12:04:22 -07:00
Olcan
a7679db6e9 sandbox setting and argument (#243) 2025-05-02 08:15:46 -07:00
Olcan
a386841947 mount user settings in sandbox (#239) 2025-05-01 12:08:24 -07:00
Olcan
a18eea8c23 remove start_sandbox.sh script (#238) 2025-05-01 09:16:33 -07:00
Brandon Keiji
3aef883f4b refactor: make parseImageName more readable (#228) 2025-04-30 10:16:29 -07:00
Brandon Keiji
28fc2d0de3 refactor(sandbox): make cli path agnostic of docker container build rules (#226) 2025-04-30 00:39:00 -07:00
Brandon Keiji
cb8a7f01ae refactor: move sandbox js code to its own module (#225) 2025-04-29 17:38:25 -07:00