GSoC 2026: [Idea #9]Interactive Security Policy / Sandbox Wizard (with policy visualization) #20833
Replies: 2 comments
-
|
Hi everyone again! 👋 It's really nice to see so many people discussing the GSoC ideas here. I'm fairly new to the Gemini CLI community and have been digging this repo over the past few days. I went through quite a lot of issues and PRs in the repository. It might be useful to share a quick reference list here for anyone else exploring this idea as well!
Issues (26) #850 (closed) #2168 (closed) #5140 (closed) #14484 (open) #15270 (open) #15383 (open) #16012 (open) #16363 (open) #16665 (open) #17575 (open) #18134 (open) #18186 (open) #18329 (open) #18397 (open) #18398 (open) #18750 (open) #19275 (closed) #19762 (closed) #19919 (open) #20058 (closed) #20060 (open) #20281 (open) #20327 (open) #20444 (open) #20469 (open) #20595 (closed) PRs (34) #863 (closed) #2036 (closed) #12567 (closed) #14499 (closed) #15395 (closed) #16284 (closed) #16362 (closed) #17806 (closed) #18213 (open) #18682 (closed) #19492 (closed) #19703 (closed) #19707 (closed) #19763 (open) #19921 (open) #20024 (closed) #20029 (closed) #20048 (open) #20083 (closed) #20178 (closed) #20289 (open) #20351 (closed) #20397 (open) #20440 (open) #20514 (open) #20518 (closed) #20523 (closed) #20531 (closed) #20596 (closed) #20639 (open) #20673 (open) #20745 (closed) #20762 (open) #20806 (open) If I missed any issues or PRs that are relevant to Idea 9, feel free to add them here. I'm still learning how the sandbox and policy pieces fit together, corrections or suggestions from maintainers are very welcome 🙂 |
Beta Was this translation helpful? Give feedback.
-
|
From my point of view, this idea stands out because it is grounded in how beginners actually experience security prompts rather than only in backend architecture. The most important first step feels like making policy.json the canonical source while keeping the wizard explanations plain enough that a new user understands the consequences of each choice. If the visualization helps people compare safe defaults against risky overrides, it could become one of the most educational parts of the whole workflow. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Hi team,
I’m Ruikang (Karl) @Thankyou-Cheems
I studied Computer Science and Industrial Design, and previously worked as a Functional Safety Engineer in automotive electronics (ISO 26262). I recently left my job and am preparing to start my MS in Computer Engineering at Northwestern University this fall. This gives me full-time availability for GSoC.
I’d really like to work on Idea 9: the Interactive Security Policy / Sandbox Wizard.
Over the past year I’ve tried a lot of “coding agent” style tools, including very popular ones in China like Qwen CLI and OpenClaw. I’m active in several WeChat groups for these tools, and I’ve noticed that many users there are new to programming. They often just follow the most viewed tutorials step by step without really understanding concepts like Docker or sandboxing. It’s very easy for them to just click “allow” and keep going when security prompts feel abstract.
I also run a small homelab on an old rooted Android phone (Termux + chroot). While testing lightweight assistants imitate this workflow, I noticed some could read .env files by default. That kind of silent behavior is easy for beginners to miss, but the security impact is real.
I’m relatively new to the open source community, I used to only dabble occasionally. Recently I’ve been putting a lot of energy into contributing: I’m working on my own project Bomana, participating in Steve’s beads development, and have submitted some PRs. I find the open source community really charming and am excited to get more involved. This makes me especially eager to help Gemini CLI build friendly, educational secure defaults.
I want to build
An Ink-based guided workflow around the gemini sandbox-setup command that stays fully aligned with the current Gemini CLI code paths and Idea 9’s expected outcomes.
Hope my initial plan fits the 90-hour scope nicely:
I’m also interested in Idea 12 (Generative Architecture & UI Visualization). If I get selected for either Idea 9 or Idea 12, I’d actively reach out to communicate and collaborate with the contributor working on the other one!
Questions for mentors
For the Idea 9 MVP, should
.gemini/policy.jsonbe the single source for project policy, and how much TOML interoperability is expected?For TOML, do you prefer migration-only (TOML → policy.json), or some round-trip capability?
Does this milestone order feel right for validate/audit/templates first, wizard second, dashboard third?
Which conflict checks are mandatory for acceptance, like allow/deny overlap?
Which current issues would you recommend as the best first PRs to learn the codebase, coding style, and review process?
Thanks so much! Looking forward to your feedback and hopefully working together.
Ruikang (Karl)
Beta Was this translation helpful? Give feedback.
All reactions