Gemini policy engine not blocking matching command

[rahul-desai3]

What happened?

Gemini CLI has deleted my git branch twice so far, while it has improved since then, I am working on adding safeguards via the policy engine so it doesnt happen to me or anyone in my team again. Note that it was a local delete, I was able to recover my brach from remote but that could severely affect someone who hasn't pushed the branch yet.

Filepath: ~/.gemini/policies/sample-ui-default.toml (notice that this is under home dir on my Mac)

File contents:

# =========================
# Generic dangerous commands
# Priority 999 (highest)
# =========================
[[rule]]
toolName       = "run_shell_command"
commandPrefix  = "rm -rf"
decision       = "deny"
priority       = 999

[[rule]]
toolName       = "run_shell_command"
commandPrefix  = "sudo"
decision       = "deny"
priority       = 999

[[rule]]
toolName       = "run_shell_command"
commandPrefix  = "wget"
decision       = "deny"
priority       = 999

[[rule]]
toolName       = "run_shell_command"
commandPrefix  = "curl"
decision       = "deny"
priority       = 999

[[rule]]
toolName       = "run_shell_command"
commandPrefix  = "dd"
decision       = "deny"
priority       = 999

[[rule]]
toolName       = "run_shell_command"
commandPrefix  = "shred"
decision       = "deny"
priority       = 999

[[rule]]
toolName       = "run_shell_command"
commandPrefix  = "mkfs"
decision       = "deny"
priority       = 999

[[rule]]
toolName       = "run_shell_command"
commandPrefix  = "chmod 777"
decision       = "deny"
priority       = 999

# =========================
# git: deleting branches (local)
# Priority 999
# =========================

[[rule]]
toolName       = "run_shell_command"
commandPrefix  = "git branch -d "
decision       = "deny"
priority       = 999

[[rule]]
toolName       = "run_shell_command"
commandPrefix  = "git branch -D "
decision       = "deny"
priority       = 999

[[rule]]
toolName       = "run_shell_command"
commandPrefix  = "git branch --delete "
decision       = "deny"
priority       = 999

[[rule]]
toolName       = "run_shell_command"
commandPrefix  = "git branch --delete --force "
decision       = "deny"
priority       = 999

# git: deleting branches (remote)
[[rule]]
toolName       = "run_shell_command"
commandPrefix  = "git push origin --delete "
decision       = "deny"
priority       = 999

[[rule]]
toolName       = "run_shell_command"
commandPrefix  = "git push --delete origin "
decision       = "deny"
priority       = 999

This policy file does get recognized if I do /policies list, here is the output:

 > /policies list

ℹ Active Policies
  ### Normal Mode Policies
  1. DENY tool: run_shell_command (args match: "command":"rm\ \-rf(?:[\s"]|\\")) [Priority: 2.999] [Source: User:
  zdx-ui-default.toml]
  2. DENY tool: run_shell_command (args match: "command":"sudo(?:[\s"]|\\")) [Priority: 2.999] [Source: User:
  zdx-ui-default.toml]
  3. DENY tool: run_shell_command (args match: "command":"wget(?:[\s"]|\\")) [Priority: 2.999] [Source: User:
  zdx-ui-default.toml]
  4. DENY tool: run_shell_command (args match: "command":"curl(?:[\s"]|\\")) [Priority: 2.999] [Source: User:
  zdx-ui-default.toml]
  5. DENY tool: run_shell_command (args match: "command":"dd(?:[\s"]|\\")) [Priority: 2.999] [Source: User:
  zdx-ui-default.toml]
  6. DENY tool: run_shell_command (args match: "command":"shred(?:[\s"]|\\")) [Priority: 2.999] [Source: User:
  zdx-ui-default.toml]
  7. DENY tool: run_shell_command (args match: "command":"mkfs(?:[\s"]|\\")) [Priority: 2.999] [Source: User:
  zdx-ui-default.toml]
  8. DENY tool: run_shell_command (args match: "command":"chmod\ 777(?:[\s"]|\\")) [Priority: 2.999] [Source: User:
  zdx-ui-default.toml]
  9. DENY tool: run_shell_command (args match: "command":"git\ branch\ \-d\ (?:[\s"]|\\")) [Priority: 2.999] [Source:
  User: zdx-ui-default.toml]
  10. DENY tool: run_shell_command (args match: "command":"git\ branch\ \-D\ (?:[\s"]|\\")) [Priority: 2.999] [Source:
  User: zdx-ui-default.toml]
  11. DENY tool: run_shell_command (args match: "command":"git\ branch\ \-\-delete\ (?:[\s"]|\\")) [Priority: 2.999]
  [Source: User: zdx-ui-default.toml]
  12. DENY tool: run_shell_command (args match: "command":"git\ branch\ \-\-delete\ \-\-force\ (?:[\s"]|\\")) [Priority
  2.999] [Source: User: zdx-ui-default.toml]
  13. DENY tool: run_shell_command (args match: "command":"git\ push\ origin\ \-\-delete\ (?:[\s"]|\\")) [Priority:
  2.999] [Source: User: zdx-ui-default.toml]
  14. DENY tool: run_shell_command (args match: "command":"git\ push\ \-\-delete\ origin\ (?:[\s"]|\\")) [Priority:
  2.999] [Source: User: zdx-ui-default.toml]
  15. ALLOW tool: glob [Priority: 1.05] [Source: Default: read-only.toml]
  16. ALLOW tool: grep_search [Priority: 1.05] [Source: Default: read-only.toml]
  17. ALLOW tool: list_directory [Priority: 1.05] [Source: Default: read-only.toml]
  18. ALLOW tool: read_file [Priority: 1.05] [Source: Default: read-only.toml]
  19. ALLOW tool: google_web_search [Priority: 1.05] [Source: Default: read-only.toml]
  20. ALLOW tool: codebase_investigator [Priority: 1.05] [Source: AgentRegistry (Dynamic)]
  21. ALLOW tool: cli_help [Priority: 1.05] [Source: AgentRegistry (Dynamic)]
  22. ASK_USER tool: discovered_tool_* [Priority: 1.01] [Source: Default: discovered.toml]
  23. ASK_USER tool: replace [Priority: 1.01] [Source: Default: write.toml]
  24. ASK_USER tool: save_memory [Priority: 1.01] [Source: Default: write.toml]
  25. ASK_USER tool: run_shell_command [Priority: 1.01] [Source: Default: write.toml]
  26. ASK_USER tool: write_file [Priority: 1.01] [Source: Default: write.toml]
  27. ASK_USER tool: activate_skill [Priority: 1.01] [Source: Default: write.toml]
  28. ASK_USER tool: web_fetch [Priority: 1.01] [Source: Default: write.toml]
  ### Auto Edit Mode Policies (combined with normal mode policies)
  1. ALLOW tool: replace [Priority: 1.015] [Source: Default: write.toml]
  2. ALLOW tool: write_file [Priority: 1.015] [Source: Default: write.toml]
  ### Yolo Mode Policies (combined with normal mode policies)
  1. ASK_USER tool: ask_user [Priority: 1.999] [Source: Default: yolo.toml]
  2. ALLOW all tools [Priority: 1.998] [Source: Default: yolo.toml]

With that I ask Gemini CLI:

do git delete on current branch "test" and switch to main branch

then it goes ahead, uses the Shell tool and deletes it with command:

git branch -d test

What did you expect to happen?

Gemini CLI should follow the rule and not delete the git branch

Client information

Client Information

Run gemini to enter the interactive CLI, then run the /about command.

> /about
│ CLI Version                             0.30.0                                                                      │
│ Git Commit                              1e3b992f6                                                                   │
│ Model                                   Auto (Gemini 2.5)                                                           │
│ Sandbox                                 no sandbox                                                                  │
│ OS                                      darwin                                                                      │
│ Auth Method                             Logged in with Google (rdesai@zscaler.com)                                  │
│ Tier                                    Gemini Code Assist Enterprise                                               │
│ GCP Project                             eng-systems-ai-code-assist      

Login information

Enterprise account login

Anything else we need to know?

No response

[AshuShekhar07]

Hi, I’ve reviewed this issue and was able to understand and reproduce the behavior where the policy rules are loaded but not enforced for run_shell_command.

I’d like to work on investigating and fixing this. If it’s available, could you please assign this issue to me?

[gemini-cli]

This item has been automatically marked as stale due to 60 days of inactivity. It will be closed in 14 days if no further activity occurs. Thank you!

[gemini-cli]

The policy engine is failing to block explicitly denied dangerous commands (like git branch -D), which is a core security policy failure causing data loss.

[rahul-desai3]

anybody?