[Security & Core Patches] Status Update & Review Protection for Active Security PRs (#29536, #29510, #29688)

[zainnadeem786]

Hi Gemini CLI Maintainers & Community,

I wanted to raise a quick status update regarding three critical security hardening pull requests I have authored for the core codebase. Two of these were recently closed by the inactivity bot due to the 14-day threshold, while the third remains open but is at risk of the same automated sweep.

To ensure these security patches don't get lost and that my contribution efforts aren't disrupted, I would love a maintainer's guidance or assistance in getting them properly labeled and reviewed:

1. Closed PRs Needing Reopening & Merge:

• [fix(grep): prevent command-line option injection by passing search patterns with explicit -e delimiter #29536] fix(grep): prevent command-line option injection via -e delimiter[cite: 2]
  • Impact: Fixes CWE-88 command-line option injection in both git grep and system grep pipelines.
  • Status: Fully tested (35/35 unit tests passed), linter/typecheck clean, and officially approved by maintainer @svessebror-maker. Closed by the inactivity bot 2 hours ago[cite: 2].
• [fix(editor): harden Windows subprocess argument quoting and prevent command injection on Windows #29510] fix(editor): harden Windows subprocess argument quoting[cite: 2]
  • Impact: Prevents command injection and argument splitting when spawning editor/diff tools via cmd.exe on Windows (win32).
  • Status: 233/233 unit tests passed, review comments addressed. Closed by the inactivity bot 2 days ago[cite: 2].

2. Active PR at Risk of Bot Closure:

• [fix(core): prevent command substitution guard bypass via shell wrapper flags #29688] fix(core): prevent command substitution guard bypass via shell wrapper flags[cite: 3]
  • Impact: Hardens stripShellWrapper and command-substitution guards against intermediate flag bypasses.
  • Status: Currently open (area/security, size/m), fully tested and verified, but currently lacks a 'help wanted' label and risks automated closure[cite: 3].

---

Request to Maintainers

Since these are security-focused contributions improving the core CLI engine, could a maintainer please:

1. Reopen PRs fix(grep): prevent command-line option injection by passing search patterns with explicit -e delimiter #29536 and fix(editor): harden Windows subprocess argument quoting and prevent command injection on Windows #29510[cite: 2].
2. Apply appropriate status or exempt labels to fix(grep): prevent command-line option injection by passing search patterns with explicit -e delimiter #29536, fix(editor): harden Windows subprocess argument quoting and prevent command injection on Windows #29510, and fix(core): prevent command substitution guard bypass via shell wrapper flags #29688 so they remain active and prioritized for merging[cite: 2, 3].

Thank you for your time, guidance, and support in securing the Gemini CLI!

Best regards,
@zainnadeem786