google-gemini · akabarki76 · Jun 28, 2025 · Jun 28, 2025 · Jun 28, 2025 · Jun 28, 2025
@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"
@@ -0,0 +1,13 @@
+name: Security Policy Check
+on: [push, pull_request]
+jobs:
+  verify-security-md:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check for placeholders
+        run: |
+          if grep -qE "Use this section|Tell them|placeholder" SECURITY.md; then
+            echo "::error::Placeholder text detected in SECURITY.md"
+            exit 1
+          fi
@@ -0,0 +1,178 @@
+<!DOCTYPE html>
+<!-- saved from url=(0057)https://cla.developers.google.com/about/google-individual -->
+<html class="google-js" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+    <script nonce="">
+      (function(H){H.className=H.className.replace(/\bgoogle\b/,'google-js')})(document.documentElement)
+    </script>
+
+    <meta content="initial-scale=1, minimum-scale=1, width=device-width" name="viewport">
+    <title>Google Individual Contributor License Agreement - Google CLA</title>
+
+    <script src="./Google Individual Contributor License Agreement - Google CLA_files/google.js.download" nonce=""></script>
+    <link href="./Google Individual Contributor License Agreement - Google CLA_files/css" rel="stylesheet">
+    <link href="./Google Individual Contributor License Agreement - Google CLA_files/signcla.css" rel="stylesheet">
+    <script nonce="">
+      window.ga=window.ga||function(){(ga.q=ga.q||[]).push(arguments)};ga.l=+new Date;
+      ga('create', 'UA-55628895-1', 'auto');
+      ga('send', 'pageview');
+    </script>
+    <script async="" src="./Google Individual Contributor License Agreement - Google CLA_files/analytics.js.download" nonce=""></script>
+  </head>
+  <body>
+    <header id="maia-header" role="banner">
+      <div class="maia-aux">
+        <div id="logo-wrapper">
+          <h1><a href="https://cla.developers.google.com/">
+              <img src="./Google Individual Contributor License Agreement - Google CLA_files/logo_lockup_open_source_icon_horizontal.png" alt="Google Open Source">
+          </a></h1>
+        </div>
+        <div class="maia-util">
+
+          <ul class="nav">
+            <li><a href="https://cla.developers.google.com/about">About</a></li>
+            <li><a href="https://cla.developers.google.com/clas">Manage Agreements</a></li>
+          </ul>
+        </div>
+      </div>
+    </header>
+
+    <div id="gc-appbar" class="maia-aux">
+      <h1><a href="https://cla.developers.google.com/">Contributor License Agreements</a></h1>
+    </div>
+
+    <main id="maia-main" role="main">
+
+      <div class="maia-teleport" id="content"></div>
+
+  <h1>Google Individual Contributor License Agreement</h1>
+
+    <p>In order to clarify the intellectual property license granted with
+    Contributions from any person or entity, Google LLC ("Google") must
+    have a Contributor License Agreement ("CLA") on file that has been
+    signed by each Contributor, indicating agreement to the license terms
+    below.  This license is for your protection as a Contributor as well
+    as the protection of Google; it does not change your rights to use
+    your own Contributions for any other purpose.</p>
+
+    <p>You accept and agree to the following terms and conditions for Your
+    present and future Contributions submitted to Google.  Except for the
+    license granted herein to Google and recipients of software
+    distributed by Google, You reserve all right, title, and interest in
+    and to Your Contributions.</p>
+
+    <ol>
+      <li>
+        <p>Definitions.</p>
+
+        <p>"You" (or "Your") shall mean the copyright owner or legal entity
+        authorized by the copyright owner that is making this Agreement with
+        Google.  For legal entities, the entity making a Contribution and all
+        other entities that control, are controlled by, or are under common
+        control with that entity are considered to be a single Contributor.
+        For the purposes of this definition, "control" means (i) the power,
+        direct or indirect, to cause the direction or management of such
+        entity, whether by contract or otherwise, or (ii) ownership of fifty
+        percent (50%) or more of the outstanding shares, or (iii) beneficial
+        ownership of such entity.</p>
+
+        <p>"Contribution" shall mean any original work of authorship,
+        including any modifications or additions to an existing work, that is
+        intentionally submitted by You to Google for inclusion in, or
+        documentation of, any of the products owned or managed by Google (the
+        "Work").  For the purposes of this definition, "submitted" means any
+        form of electronic, verbal, or written communication sent to Google or
+        its representatives, including but not limited to communication on
+        electronic mailing lists, source code control systems, and issue
+        tracking systems that are managed by, or on behalf of, Google for the
+        purpose of discussing and improving the Work, but excluding
+        communication that is conspicuously marked or otherwise designated in
+        writing by You as "Not a Contribution."</p>
+      </li>
+
+      <li><p>Grant of Copyright License.  Subject to the terms and
+      conditions of this Agreement, You hereby grant to Google and to
+      recipients of software distributed by Google a perpetual, worldwide,
+      non-exclusive, no-charge, royalty-free, irrevocable copyright license
+      to reproduce, prepare derivative works of, publicly display, publicly
+      perform, sublicense, and distribute Your Contributions and such
+      derivative works.</p></li>
+
+      <li><p>Grant of Patent License.  Subject to the terms and conditions
+      of this Agreement, You hereby grant to Google and to recipients of
+      software distributed by Google a perpetual, worldwide, non-exclusive,
+      no-charge, royalty-free, irrevocable (except as stated in this
+      section) patent license to make, have made, use, offer to sell, sell,
+      import, and otherwise transfer the Work, where such license applies
+      only to those patent claims licensable by You that are necessarily
+      infringed by Your Contribution(s) alone or by combination of Your
+      Contribution(s) with the Work to which such Contribution(s) was
+      submitted. If any entity institutes patent litigation against You
+      or any other entity (including a cross-claim or counterclaim in a
+      lawsuit) alleging that your Contribution, or the Work to which you
+      have contributed, constitutes direct or contributory patent infringement,
+      then any patent licenses granted to that entity under this Agreement for
+      that Contribution or Work shall terminate as of the date such litigation
+      is filed.</p></li>
+
+      <li><p>You represent that you are legally entitled to grant the above
+      license.  If your employer(s) has rights to intellectual property that
+      you create that includes your Contributions, you represent that you
+      have received permission to make Contributions on behalf of that
+      employer, that your employer has waived such rights for your
+      Contributions to Google, or that your employer has executed a separate
+      Corporate CLA with Google.</p></li>
+
+      <li><p>You represent that each of Your Contributions is Your original
+      creation (see section 7 for submissions on behalf of others).  You
+      represent that Your Contribution submissions include complete details
+      of any third-party license or other restriction (including, but not
+      limited to, related patents and trademarks) of which you are
+      personally aware and which are associated with any part of Your
+      Contributions.</p></li>
+
+      <li><p>You are not expected to provide support for Your Contributions,
+      except to the extent You desire to provide support.  You may provide
+      support for free, for a fee, or not at all.  Unless required by
+      applicable law or agreed to in writing, You provide Your Contributions
+      on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+      either express or implied, including, without limitation, any
+      warranties or conditions of TITLE, NON- INFRINGEMENT, MERCHANTABILITY,
+      or FITNESS FOR A PARTICULAR PURPOSE.</p></li>
+
+      <li><p>Should You wish to submit work that is not Your original
+      creation, You may submit it to Google separately from any
+      Contribution, identifying the complete details of its source and of
+      any license or other restriction (including, but not limited to,
+      related patents, trademarks, and license agreements) of which you are
+      personally aware, and conspicuously marking the work as "Submitted on
+      behalf of a third-party: [named here]".</p></li>
+
+      <li><p>You agree to notify Google of any facts or circumstances of
+      which you become aware that would make these representations
+      inaccurate in any respect.</p></li>
+    </ol>
+
+  <p><a class="maia-button" href="https://cla.developers.google.com/clas">Manage your Agreements</a></p>
+
+  <p>If you have questions about this process, please refer to the
+  <a href="https://cla.developers.google.com/about">About</a> page.</p>
+
+    </main>
+
+    <footer id="maia-footer">
+      <div id="maia-footer-global">
+        <div class="maia-aux">
+          <ul>
+            <li><a href="https://opensource.google/">
+              <img class="inline" src="./Google Individual Contributor License Agreement - Google CLA_files/logo_lockup_open_source_icon_horizontal.png" alt="Google Open Source">
+            </a></li>
+            <li><a href="https://developers.google.com/site-terms/">Terms</a></li>
+            <li><a href="https://www.google.com/intl/en/privacy/">Privacy</a></li>
+          </ul>
+        </div>
+      </div>
+    </footer>
+
+    <script src="./Google Individual Contributor License Agreement - Google CLA_files/maia.js.download" nonce=""></script>
+
+</body></html>
@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+Use this section to tell people about which versions of your project are
+currently being supported with security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.1.x   | :white_check_mark: |
+| 5.0.x   | :x:                |
+| 4.0.x   | :white_check_mark: |
+| < 4.0   | :x:                |
+
+## Reporting a Vulnerability
+
+Use this section to tell people how to report a vulnerability.
+
+Tell them where to go, how often they can expect to get an update on a
+reported vulnerability, what to expect if the vulnerability is accepted or
+declined, etc.
@@ -105,10 +105,15 @@ export class WebFetchTool extends BaseTool<WebFetchToolParams, ToolResult> {
     let url = urls[0];
 
     // Convert GitHub blob URL to raw URL
-    if (url.includes('github.com') && url.includes('/blob/')) {
-      url = url
-        .replace('github.com', 'raw.githubusercontent.com')
-        .replace('/blob/', '/');
+    try {
+      const parsedUrl = new URL(url);
+      if (parsedUrl.host === 'github.com' && url.includes('/blob/')) {
+        url = url
+          .replace('github.com', 'raw.githubusercontent.com')
+          .replace('/blob/', '/');
+      }
+    } catch (error) {
+      throw new Error(`Invalid URL: ${url}`);
     }
 
     try {
@@ -195,10 +200,16 @@ ${textContent}
     // Perform GitHub URL conversion here to differentiate between user-provided
     // URL and the actual URL to be fetched.
     const urls = extractUrls(params.prompt).map((url) => {
-      if (url.includes('github.com') && url.includes('/blob/')) {
-        return url
-          .replace('github.com', 'raw.githubusercontent.com')
-          .replace('/blob/', '/');
+      try {
+        const parsedUrl = new URL(url);
+        if (parsedUrl.hostname === 'github.com' && url.includes('/blob/')) {
+          return url
+            .replace('github.com', 'raw.githubusercontent.com')
+            .replace('/blob/', '/');
+        }
+      } catch (e) {
+        // If URL parsing fails, ignore this URL
+        console.error(`Invalid URL encountered: ${url}`);
       }
       return url;
     });

@@ -137,8 +137,8 @@ export function getDiffCommand(
           // Auto close all windows when one is closed
           '-c',
           'autocmd WinClosed * wqa',
-          oldPath,
-          newPath,
+          shellQuote.quote([oldPath]),
+          shellQuote.quote([newPath]),
-          shellQuote.quote([oldPath]),
-          shellQuote.quote([newPath]),
+          oldPath,
+          newPath,
-          shellQuote.quote([oldPath]),
-          shellQuote.quote([newPath]),
+          oldPath,
+          newPath,
         ],
       };
     default:
@@ -173,7 +173,6 @@ export async function openDiff(
         return new Promise((resolve, reject) => {
           const childProcess = spawn(diffCommand.command, diffCommand.args, {
             stdio: 'inherit',
-            shell: true,
           });
 
           childProcess.on('close', (code) => {
@@ -192,11 +191,8 @@ export async function openDiff(
       case 'vim':
       case 'neovim': {
         // Use execSync for terminal-based editors
-        const command =
-          process.platform === 'win32'
-            ? `${diffCommand.command} ${diffCommand.args.join(' ')}`
-            : `${diffCommand.command} ${diffCommand.args.map((arg) => `"${arg}"`).join(' ')}`;
-        execSync(command, {
+        const args = diffCommand.args;
+        execFileSync(diffCommand.command, args, {
           stdio: 'inherit',
           encoding: 'utf8',
         });

@@ -0,0 +1,15 @@
+ ## Supported Versions
+
+-The following versions are currently supported with security updates:
+-
+-| Version | Supported |
+-| ------- | :-------: |
+-| 1.0.x   |    ✅     |
+-| 2.0.x   |    ✅     |
++The following versions are currently supported with security updates:
++
++| Version    | Supported? |
++| ---------- | :--------: |
++| 0.1.x      |     ✅     |
++| 0.2.x      |  (when released)  |
+