fix: add system PATH fallback for ripgrep resolution (#26777)

[cocosheng-g]

Summary

Add system PATH fallback to getRipgrepPath to ensure ripgrep can be found even if bundled binaries are missing.

Details

This PR implements a minimal, secure, and architecturally sound fallback for resolving the ripgrep binary.

Key Improvements & Security

1. Security (RCE Prevention): Implemented Secure System Resolution. The fallback uses resolveExecutable('rg') to find system binaries but strictly validates them using resolveToRealPath and isTrustedSystemPath.
   • Symlink Bypass Prevention: It strictly validates the resolved real path of the binary to prevent executing untrusted binaries symlinked from trusted locations.
   • Search Path Interruption: It explicitly rejects bare commands or binaries found in the current working directory.
   • Homebrew Compatibility: Added Homebrew Cellar paths (/opt/homebrew/Cellar and /usr/local/Cellar) to trusted directories to gracefully handle symlinked installations on macOS.
2. Architectural Alignment: Moved ripgrep caching from module-level global state into an instance-scoped property (_ripgrepPathPromise) within the Config class. This satisfies the repository's rule against global caches and ensures concurrency safety.
3. Thread-Safe Caching: Caching the resolution Promise directly ensures the environment is only scanned once per session, even during concurrent tool initialization.
4. Sandbox & CI Compatibility:
   • Updated commandSafety.ts to explicitly decouple command intent (isRipgrepCommand) from safety validation (isTrustedCommandPath). This ensures that absolute paths to trusted binaries execute smoothly in the sandbox while bare rg commands or untrusted binaries correctly fall back to prompting the user, completely eliminating Search Path Interruption risks.
   • Caching avoids expensive redundant PATH scans, resolving the performance-related timeouts previously seen in Windows CI.

Related Issues

Fixes #26777

How to Validate

1. Build the project: npm run build
2. Run unit tests: npm test -w @google/gemini-cli-core -- src/sandbox/utils/commandSafety.test.ts src/utils/paths.test.ts src/tools/ripGrep.test.ts
3. Manual check: Hide bundled binaries in packages/core/vendor/ripgrep and ensure rg is on your system path in a trusted location (e.g., /usr/bin or Homebrew Cellar). Verify the tool finds it. Place a dummy rg in your CWD and verify it is correctly rejected.

Pre-Merge Checklist

• Added/updated tests (if needed)
• Validated on required platforms/methods:
  • MacOS
    • npm run

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request improves the robustness of the ripgrep binary resolution process. By introducing a system PATH fallback, the application can now successfully locate rg in environments where bundled binaries are missing, such as specific global installations or restricted setups, ensuring better compatibility across different deployment scenarios.

Highlights

• System PATH Fallback: Added a fallback mechanism to getRipgrepPath that attempts to resolve the rg executable from the system PATH if bundled binaries are unavailable.
• Testing Improvements: Updated ripGrep.test.ts to include unit tests verifying the new fallback logic and ensuring correct behavior when the binary is missing from all locations.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[github-actions]

Size Change: +2.35 kB (+0.01%)

Total Size: 34.1 MB

Filename	Size	Change
./bundle/chunk-6LL447YA.js	0 B	-19.5 kB (removed)	🏆
./bundle/chunk-ERXF46WU.js	0 B	-14.8 MB (removed)	🏆
./bundle/chunk-JTTGR7U5.js	0 B	-3.8 kB (removed)	🏆
./bundle/chunk-MNVM4433.js	0 B	-12.5 kB (removed)	🏆
./bundle/chunk-OPBX7WOS.js	0 B	-49.2 kB (removed)	🏆
./bundle/chunk-QQJRITJW.js	0 B	-3.43 kB (removed)	🏆
./bundle/chunk-QTB23IKC.js	0 B	-1.97 MB (removed)	🏆
./bundle/chunk-XJ3I7APM.js	0 B	-659 kB (removed)	🏆
./bundle/chunk-YYF4PQDB.js	0 B	-2.78 MB (removed)	🏆
./bundle/core-UEZFFBOW.js	0 B	-49.2 kB (removed)	🏆
./bundle/devtoolsService-OX4VE4PD.js	0 B	-28 kB (removed)	🏆
./bundle/gemini-6BUGMPH2.js	0 B	-587 kB (removed)	🏆
./bundle/interactiveCli-YCJJEHFF.js	0 B	-1.3 MB (removed)	🏆
./bundle/liteRtServerManager-VXWWQ3QD.js	0 B	-2.11 kB (removed)	🏆
./bundle/oauth2-provider-HJ6AEQR4.js	0 B	-9.16 kB (removed)	🏆
./bundle/chunk-3BLNPUG4.js	12.5 kB	+12.5 kB (new file)	🆕
./bundle/chunk-7RT3SV32.js	3.43 kB	+3.43 kB (new file)	🆕
./bundle/chunk-BBKLFJ4V.js	14.8 MB	+14.8 MB (new file)	🆕
./bundle/chunk-CZE7EYPL.js	1.98 MB	+1.98 MB (new file)	🆕
./bundle/chunk-GFQTMJYD.js	659 kB	+659 kB (new file)	🆕
./bundle/chunk-HGJLR2AU.js	19.5 kB	+19.5 kB (new file)	🆕
./bundle/chunk-QTZTFBP4.js	2.78 MB	+2.78 MB (new file)	🆕
./bundle/chunk-V3WXY2DA.js	3.8 kB	+3.8 kB (new file)	🆕
./bundle/chunk-YCT7NPHU.js	49.2 kB	+49.2 kB (new file)	🆕
./bundle/core-Q7COGIOV.js	49.2 kB	+49.2 kB (new file)	🆕
./bundle/devtoolsService-AQHCOE54.js	28 kB	+28 kB (new file)	🆕
./bundle/gemini-SSIGKMYG.js	587 kB	+587 kB (new file)	🆕
./bundle/interactiveCli-QOVX6AMK.js	1.3 MB	+1.3 MB (new file)	🆕
./bundle/liteRtServerManager-WZRZCNPW.js	2.11 kB	+2.11 kB (new file)	🆕
./bundle/oauth2-provider-66SOMBQ4.js	9.16 kB	+9.16 kB (new file)	🆕

ℹ️ View Unchanged

Filename	Size	Change
./bundle/bundled/third_party/index.js	8 MB	0 B
./bundle/chunk-34MYV7JD.js	2.45 kB	0 B
./bundle/chunk-5AUYMPVF.js	858 B	0 B
./bundle/chunk-5PS3AYFU.js	1.18 kB	0 B
./bundle/chunk-664ZODQF.js	124 kB	0 B
./bundle/chunk-DAHVX5MI.js	206 kB	0 B
./bundle/chunk-IUUIT4SU.js	56.5 kB	0 B
./bundle/chunk-RJTRUG2J.js	39.8 kB	0 B
./bundle/cleanup-MU63Q7OA.js	0 B	-932 B (removed)	🏆
./bundle/devtools-36NN55EP.js	696 kB	0 B
./bundle/dist-T73EYRDX.js	356 B	0 B
./bundle/events-XB7DADIJ.js	418 B	0 B
./bundle/examples/hooks/scripts/on-start.js	188 B	0 B
./bundle/examples/mcp-server/example.js	1.43 kB	0 B
./bundle/gemini.js	5.1 kB	0 B
./bundle/getMachineId-bsd-TXG52NKR.js	1.55 kB	0 B
./bundle/getMachineId-darwin-7OE4DDZ6.js	1.55 kB	0 B
./bundle/getMachineId-linux-SHIFKOOX.js	1.34 kB	0 B
./bundle/getMachineId-unsupported-5U5DOEYY.js	1.06 kB	0 B
./bundle/getMachineId-win-6KLLGOI4.js	1.72 kB	0 B
./bundle/memoryDiscovery-PTF4YLMR.js	0 B	-980 B (removed)	🏆
./bundle/multipart-parser-KPBZEGQU.js	11.7 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/client/main.js	222 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/_client-assets.js	229 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/index.js	13.4 kB	0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/types.js	132 B	0 B
./bundle/sandbox-macos-permissive-open.sb	890 B	0 B
./bundle/sandbox-macos-permissive-proxied.sb	1.31 kB	0 B
./bundle/sandbox-macos-restrictive-open.sb	3.36 kB	0 B
./bundle/sandbox-macos-restrictive-proxied.sb	3.56 kB	0 B
./bundle/sandbox-macos-strict-open.sb	4.82 kB	0 B
./bundle/sandbox-macos-strict-proxied.sb	5.02 kB	0 B
./bundle/src-QVCVGIUX.js	47 kB	0 B
./bundle/start-343KNR4R.js	0 B	-652 B (removed)	🏆
./bundle/tree-sitter-7U6MW5PS.js	274 kB	0 B
./bundle/tree-sitter-bash-34ZGLXVX.js	1.84 MB	0 B
./bundle/cleanup-HFSBURBS.js	932 B	+932 B (new file)	🆕
./bundle/memoryDiscovery-TEIL4SXZ.js	980 B	+980 B (new file)	🆕
./bundle/start-UQMS4M2L.js	652 B	+652 B (new file)	🆕

_{compressed-size-action}

[gemini-code-assist]

Code Review

This pull request enhances the getRipgrepPath function in the core package to include a fallback check for the ripgrep binary in the system PATH if it is not found in the bundled directories. It introduces the use of resolveExecutable for this purpose and includes updated unit tests to validate the fallback logic and the failure case where the binary is completely unavailable. I have no feedback to provide.

[github-actions]

🚨 Action Required: Eval Regressions Detected

Model: gemini-3-flash-preview

The following trustworthy evaluations passed on main and in recent Nightly runs, but failed in this PR. These regressions must be addressed before merging.

Test Name	Nightly	PR Result	Status
should handle nested plan directories correctly	89%	25%	❌ Regression

The check passed or was cleared for 79 other trustworthy evaluations.

🛠️ Troubleshooting & Fix Instructions

1. Ask Gemini CLI to fix it (Recommended)

Copy and paste this prompt to the agent:

The eval "should handle nested plan directories correctly" in evals/plan_mode.eval.ts is failing. Investigate and fix it using the behavioral-evals skill.

2. Reproduce Locally

Run the following command to see the failure trajectory:

GEMINI_MODEL=gemini-3-flash-preview npm run test:all_evals -- evals/plan_mode.eval.ts --testNamePattern="should handle nested plan directories correctly"

3. Manual Fix

See the Fixing Guide for detailed troubleshooting steps.

### 🧠 Model Steering Guidance

This PR modifies files that affect the model's behavior (prompts, tools, or instructions).

• ⚠️ Consider adding Evals: No behavioral evaluations (evals/*.eval.ts) were added or updated in this PR. Consider adding a test case to verify the new behavior and prevent regressions.
• 🚀 Maintainer Reminder: Please ensure that these changes do not regress results on benchmark evals before merging.

---

This is an automated guidance message triggered by steering logic signatures.

[lesteral]

I believe this will also fix:
#26193
#26409
#26541

[cocosheng-g]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a caching mechanism for the ripgrep executable path and adds a fallback to the system PATH if bundled binaries are not found. Feedback focuses on a potential security vulnerability related to Search Path Interruption in the fallback logic and the use of a module-level global variable for caching, which violates repository guidelines and may cause race conditions in concurrent environments.

[cocosheng-g]

/gemini review

[gemini-code-assist]

Code Review

This pull request enhances ripgrep path resolution by implementing a caching mechanism and adding a fallback to system binaries when bundled versions are unavailable. It introduces security validations to ensure system binaries are only executed from trusted directories and includes comprehensive tests for these scenarios. Review feedback points out a security risk related to Search Path Interruption on Windows when using bare command names and a violation of repository standards concerning the use of module-level global variables for state.