Commit Graph

35 Commits

Author SHA1 Message Date
Tolik Malibroda 1d20cedf03
fix: Disable automatic image building if BUILD_SANDBOX is not provided (#764) 2025-06-05 18:47:39 +02:00
Tolik Malibroda 4d4cf0f2f9
feat: Add multi-stage docker build support for custom sandbox.Dockerfile (#746) 2025-06-05 17:46:54 +02:00
Jacob Richman aa386d135b
Jacob314/memory fixes (#754)
Address multiple possible memory leaks found bystatic analysis of the codebase. The primary source of the leaks was event listeners on child processes and global objects that were not being properly removed, potentially causing their closures to be retained in memory indefinitely particularly for processes that did not exit.

There are two commits. A larger one made by gemini CLI and a smaller one by me to make sure we always disconnect child processes as part of the cleanup methods. These changes may not actually fix any leaks but do look like reasonable defensive coding to avoid leaking event listeners or child processes.

The following files were fixed:
This is Gemini's somewhat overconfident description of what it did.

packages/core/src/tools/shell.ts: Fixed a leak where an abortSignal listener was not being reliably removed.
packages/cli/src/utils/readStdin.ts: Fixed a significant leak where listeners on process.stdin were never removed.
packages/cli/src/utils/sandbox.ts: Fixed leaks in the imageExists and pullImage helper functions where listeners on spawned child processes were not being removed.
packages/core/src/tools/grep.ts: Fixed three separate leaks in the isCommandAvailable check and the git grep and system grep strategies due to un-removed listeners on child processes.
packages/core/src/tools/tool-registry.ts: Corrected a leak in the execute method of the DiscoveredTool class where listeners on the spawned tool process were not being removed.
2025-06-05 06:40:33 -07:00
Tolik Malibroda 4b2af10b04
fix: Fix piped input mode in sandbox (#739) 2025-06-04 08:24:33 +02:00
Olcan 12059eb4ca
fix BUILD_SANDBOX env var for updating sandbox while running linked binary (#729) 2025-06-03 14:02:00 -07:00
Brandon Keiji e96fd677ee
fix: do not try to pull development sandbox image from the internet (#725) 2025-06-03 19:32:17 +00:00
Brandon Keiji 0869fd168f
fix(sandbox): pull sandbox image if it doesnt exist locally (#628) 2025-05-30 20:49:47 +00:00
Brandon Keiji 31a7affb74
feat(sandbox): use package config to dictate sandbox image name (#624) 2025-05-30 19:28:46 +00:00
Olcan 4b7248fc46
allow writing to user cache directory on macos (fixes use of lyria mcp server [to generate songs] under seatbelt) (#600) 2025-05-29 15:06:09 -07:00
Olcan 70277591c4
update email to gemini-cli-dev (#510) 2025-05-23 08:35:16 -07:00
Olcan 17e28036fa
fix HOME in sandbox on cloudtops (linux) (#454) 2025-05-20 15:30:49 -07:00
Olcan 76cf5e9fc1
rename env vars GEMINI_CODE_{MODEL,SANDBOX,SANDBOX_IMAGE} (#411) 2025-05-17 17:28:44 -07:00
Olcan f3d9a499dd
move sandbox-related messages to stderr (#363) 2025-05-15 10:54:30 -07:00
Brandon Keiji 3be8b6dc34
fix(sandbox): default to current user profile for debian/ubuntu env (#337) 2025-05-13 21:13:54 +00:00
Brandon Keiji 8da7a71d9a
refactor: shorten 'gemini' binary name (#329) 2025-05-13 10:49:45 -07:00
Taylor Mullen cf91f72c5c Remove terminal tool and dependencies.
- We now solely use the shell tool. This deletes all content around the legacy terminal tool so we can focus on improving the new Shell tool.
- Remove instances from sandboxing, tests, utilities etc.
2025-05-11 12:35:55 -07:00
Olcan 92c1279de6
sandbox/seatbelt-aware system prompt, support for custom seatbelt profiles under project settings (#304) 2025-05-09 11:33:05 -07:00
Olcan b35a3856a2
fix debugging with seatbelt, including in strict profile (#300) 2025-05-09 08:44:40 -07:00
Brandon Keiji 4741c9a6eb
fix(sandbox): set --inspect-brk in production sandbox when env DEBUG is truthy (#295) 2025-05-08 21:12:19 -07:00
Olcan 6b0ac084b8
allow SEATBELT_PROFILE=none to disable seatbelt on macos (#296) 2025-05-08 15:52:04 -07:00
Olcan b1c449d11c
refined sandbox/seatbelt log message, pass NODE_OPTIONS along to sandboxed node (#292) 2025-05-08 14:50:35 -07:00
Olcan b59a940057
adjust seatbelt to allow write into specific dirs under user home (#289) 2025-05-08 11:28:45 -07:00
Olcan 327bd5f836
rename SANDBOX_EXEC_PROFILE as SEATBELT_PROFILE, and fix another accidental rephrasing (#285) 2025-05-07 21:31:30 -07:00
Olcan d524309e3c
use seatbelt on macos, with two profiles: minimal (default) which only restricts writes, and strict, which is deny-by-default and only allows specific operations (#283) 2025-05-07 20:03:29 -07:00
Brandon Keiji 739654bb25
fix(sandbox): consolidate dev and prod sandbox (#273) 2025-05-07 07:23:13 -07:00
Olcan cfdbea4dc2
make sandbox venv support more robust, allowing arbitrary venv path, and ignoring venv outside workdir (instead of erroring out) (#254) 2025-05-03 09:12:44 -07:00
Olcan 3a1abb07bf
enable recreating a python virtual env (.venv folder) inside sandbox (#253) 2025-05-03 00:39:31 -07:00
Olcan 69d1c644d9
custom sandboxing via sandbox.Dockerfile and sandbox.bashrc in project settings (#249) 2025-05-02 14:07:40 -07:00
Olcan f237082c37
pass PATH and PYTHONPATH into sandbox, let sandbox scripts recognize user settings for sandbox (#247) 2025-05-02 12:04:22 -07:00
Olcan a7679db6e9
sandbox setting and argument (#243) 2025-05-02 08:15:46 -07:00
Olcan a386841947
mount user settings in sandbox (#239) 2025-05-01 12:08:24 -07:00
Olcan a18eea8c23
remove start_sandbox.sh script (#238) 2025-05-01 09:16:33 -07:00
Brandon Keiji 3aef883f4b
refactor: make parseImageName more readable (#228) 2025-04-30 10:16:29 -07:00
Brandon Keiji 28fc2d0de3
refactor(sandbox): make cli path agnostic of docker container build rules (#226) 2025-04-30 00:39:00 -07:00
Brandon Keiji cb8a7f01ae
refactor: move sandbox js code to its own module (#225) 2025-04-29 17:38:25 -07:00