$ the-wire · showcase
Codex scopes MITM credential substitution, Gemini CLI stops clobbering read-only files
By RepoJournal · Filed · About Agentic Coding · Composed from the cited sources · methodology
21 people shipped this
copyberry
@copyberry
2 cited
elberthc-byte
@elberthc-byte
2 cited
luisfelipe-alt
@luisfelipe-alt
1 cited
jamadeo
@jamadeo
1 cited
lifeizhou-ap
@lifeizhou-ap
1 cited
DOsinga
@DOsinga
1 cited
GitHub Actions
@actions-user
viyatb-oai
@viyatb-oai
Benjamin Carlsson
@bc-openai
jlongster
@jlongster
adamdotdevin
@adamdotdevin
Aiden Cline
@rekram1-node
urielefrenvirtusa
@urielefrenvirtusa
villahernandez-coder
@villahernandez-coder
hieptl
@hieptl
OpenHands Bot
@all-hands-bot
VascoSch92
@VascoSch92
simonrosenberg
@simonrosenberg
zurrll
@zurrll
Saoud Rizwan
@saoudrizwan
github-actions
@github-actions
Two long-standing footguns got closed today: Codex now authorizes the destination before injecting host secrets, and Gemini CLI's atomic write path no longer bypasses the write bit on read-only files or splits hard links.
Scope MITM credential substitution to trusted origins and placeholders openai/codex
Credential substitution now checks hook `schemes` and `ports` constraints and an exact whole-header `placeholder` before exposing host secrets, and project configuration can no longer redirect trusted credential policies; the maintainers' stated goal is that older clients reject scoped policies rather than silently apply unconditional injection. If your hooks set credentials today, verify they ...
fix(core): respect read-only files and hard links in atomic writeTextFile google-gemini/gemini-cli
Since the atomic write landed, `StandardFileSystemService.writeTextFile` replaced `0444` files the CLI used to refuse with `EACCES`, and the write tool's `PERMISSION_DENIED` branch never fired for them; the same rename gave the path a new inode, so editing one name of a hard link left the others behind. Gemini CLI users who relied on the permission denial as a guard now get it back.
fix(core): scope untrusted flag checks to external output and remember approved flags google-gemini/gemini-cli
Repeated shell-command confirmations should drop sharply: flags and paths that appear only in the output of the agent's own commands no longer count as external input, in-workspace paths aren't reported, and one approval covers the same flags and root commands for the rest of the session. Approval state resets when the session changes, so a new session starts prompting again.
fix(developer): terminate owned shell process trees on cancellation aaif-goose/goose
Each shell invocation now runs in its own Unix process group or Windows Job Object, and goose cleans up descendants on cancellation, timeout, and execution drop without touching concurrent commands or successful background work. Earlier, a cancelled command could leave orphaned child processes behind; operators running long builds should see fewer strays.
Support confidential OAuth clients for enterprise-managed MCP auth openai/codex
Enterprise-managed MCP auth accepts separate `client_secret` and `token_endpoint_auth_method` settings for the IdP and the MCP server registration, supporting `client_secret_basic` and `client_secret_post`. If your identity provider won't hand out public OAuth clients, this is what was blocking you.
fix (acp): fail session/prompt when a turn ends on an error aaif-goose/goose
A turn that ends on an error (network failure, context too long, failed compaction) used to return `EndTurn`, so ACP clients read it as success; `session/prompt` now fails with `data.reason = "turn_failed"`, and a failed auto-compaction saves a real error. ACP clients that treated every `EndTurn` as a successful run will now see the failure.
feat(cli): bridge the IDE companion into container sandboxes over exec stdio google-gemini/gemini-cli
IDE integration (`/ide status`, `/ide enable`, open-file context, native diffs) previously didn't work at all when the CLI ran in a `GEMINI_SANDBOX=docker|podman|runsc` container with the IDE on the host; the companion is now bridged over exec stdio. Under `runsc` even the `--network host` workaround had failed, because netstack's loopback is private to the sandbox.
Add dangerous include history aaif-goose/goose
Including shell history in shell integration is now opt-in, and the warning is explicit: turning it on may expose secrets to the agent. Check whether your shell integration config assumed history was included by default.
Action items
- → Update Codex hooks to declare `schemes`/`ports` constraints and an exact `placeholder` for credential substitution be... openai/codex [plan]
- → Audit any Gemini CLI workflow that relied on `EACCES`/`PERMISSION_DENIED` on `0444` files or on hard-linked paths, si... google-gemini/gemini-cli [plan]
- → Check goose shell-integration config: history inclusion is now opt-in, and enabling it may expose secrets to the agent aaif-goose/goose [plan]
