refactor(core): centralize tool definitions (Group 1: replace, search, grep) - #18944
Conversation
…h tool definitions
… with distinct definitions
…initions without changing logic
|
Hi there! Thank you for your contribution to Gemini CLI. To improve our contribution process and better track changes, we now require all pull requests to be associated with an existing issue, as announced in our recent discussion and as detailed in our CONTRIBUTING.md. This pull request is being closed because it is not currently linked to an issue. Once you have updated the description of this PR to link an issue (e.g., by adding How to link an issue: Thank you for your understanding and for being a part of our community! |
|
Hi @aishaneeshah, thank you so much for your contribution to Gemini CLI! We really appreciate the time and effort you've put into this. We're making some updates to our contribution process to improve how we track and review changes. Please take a moment to review our recent discussion post: Improving Our Contribution Process & Introducing New Guidelines. Key Update: Starting January 26, 2026, the Gemini CLI project will require all pull requests to be associated with an existing issue. Any pull requests not linked to an issue by that date will be automatically closed. Thank you for your understanding and for being a part of our community! |
Summary of ChangesHello @aishaneeshah, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request initiates a significant refactoring effort to centralize the definitions of core tools within the system. By moving tool schemas and descriptions to a single source, it enhances maintainability, reduces duplication, and ensures consistency across various tool implementations. This change specifically targets the Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Thank you for linking an issue! This pull request has been automatically reopened. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request centralizes tool definitions for replace, google_web_search, and grep_search, improving code organization and maintainability, with snapshot tests correctly updated. However, two high-severity security issues were identified: the LLM edit fixer utility is vulnerable to prompt injection and corruption due to unsafe use of String.prototype.replace when constructing prompts from untrusted data, and the grep_search tool's no_ignore parameter could allow bypassing security-critical ignore rules like .gitignore, potentially exposing sensitive information. Additionally, a minor issue was found in the refactored EDIT_DEFINITION where an extra comma was introduced, which could affect LLM behavior.
| }, | ||
| include: { | ||
| description: |
There was a problem hiding this comment.
The grep_search tool (specifically the RipGrepTool implementation) includes a no_ignore parameter that, when set to true, causes the tool to bypass all file ignore rules (such as .gitignore and .geminiignore). This allows the LLM to search and read potentially sensitive files that are intended to be hidden, such as .env files containing secrets, private keys, or configuration files. Since grep_search is a "read" tool (Kind.Search), it may not require user confirmation in many configurations, allowing an LLM to exfiltrate sensitive data without the user's knowledge if it is tricked via prompt injection.
Consider removing the no_ignore parameter from the tool's public schema to prevent the LLM from bypassing ignore rules. If the functionality is required for users, ensure that its use by the LLM always triggers a high-visibility warning or requires explicit user confirmation.
|
Size Change: +972 B (0%) Total Size: 24.4 MB ℹ️ View Unchanged
|
gemini-cli
Bot
added
area/agent
| WebSearchTool.Name, | ||
| 'GoogleSearch', | ||
| 'Performs a web search using Google Search (via the Gemini API) and returns the results. This tool is useful for finding information on the internet based on a query.', | ||
| WEB_SEARCH_DEFINITION.base.description!, |
There was a problem hiding this comment.
nit: It'd be great to see if we can adjust the typings for WEB_SEARCH_DEFINITION to not require a null suppression.
Gemini provided this helpful idea:
| { name: 'read_file', definition: READ_FILE_DEFINITION }, | ||
| { name: 'write_file', definition: WRITE_FILE_DEFINITION }, | ||
| { name: 'grep_search', definition: GREP_DEFINITION }, | ||
| { name: 'grep_search_ripgrep', definition: RIP_GREP_DEFINITION }, |
There was a problem hiding this comment.
Does this change the name of the tool as seen by the model? I think we want that to stay 'grep'.
3 participants
Summary
Refactor and centralize core tool definitions for the first group of tools:
replace(edit),google_web_search, andgrep_search(both basic and advanced implementations).Details
This PR is part of a larger effort to centralize tool definitions and descriptions in
packages/core/src/tools/definitions/coreTools.ts. This specific group includes:replace(EditTool): CentralizedEDIT_DEFINITIONand instruction descriptions.google_web_search(WebSearchTool): CentralizedWEB_SEARCH_DEFINITIONand fixed a minor typo in the description.grep_search(GrepTool & RipGrepTool):GREP_DEFINITIONfor the basic fallback implementation.RIP_GREP_DEFINITIONfor the advanced ripgrep implementation.grep_searchname and are chosen by the configuration at runtime.Key Verification:
mainbranch exactly.coreToolsModelSnapshots.test.tsto independently verify both search implementations under the same tool name, ensuring no unintended interface changes.config.tsremains unchanged.Related Issues
Related to the ongoing tool centralization refactor.
How to Validate
npm test -w @google/gemini-cli-core -- src/tools/definitions/coreToolsModelSnapshots.test.tsnpm run build && npm run lintPre-Merge Checklist
Related to #17958