CLI crashes on startup when ran inside a Git repository and MacOS seatbelt is enabled

[tomb1n0]

What happened?

Running Gemini CLI with MacOS seatbelt enabled:

  "tools": {
    "sandbox": true
  },

And then starting Gemini CLI in a folder that contains a Git repository instantly crashes the CLI.

Folder without a Git repository:

Initialising this folder with a Git repo:

What did you expect to happen?

Not to crash.

Client information

Client Information

Run gemini to enter the interactive CLI, then run the /about command.

> /about
╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                                                                                                                                                                                                                  │
│ About Gemini CLI                                                                                                                                                                                                                                                                                 │
│                                                                                                                                                                                                                                                                                                  │
│ CLI Version                                                                                          0.53.0                                                                                                                                                                                      │
│ Git Commit                                                                                           decc0b46c                                                                                                                                                                                   │
│ Model                                                                                                Auto                                                                                                                                                                                        │
│ Sandbox                                                                                              sandbox-exec (permissive-open)                                                                                                                                                              │
│ OS                                                                                                   darwin                                                                                                                                                                                      │
│ Auth Method                                                                                          Signed in with Google (<REDACTED>)                                                                                                                                             │
│ Tier                                                                                                 Gemini Code Assist Standard                                                                                                                                                                 │
│ GCP Project                                                                                           <REDACTED>                                                                                                                                                                       │
│                                                                                                                                                                                                                                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯

Login information

Signed with OAuth using a Gemini Code Assist standard License.

GOOGLE_CLOUD_PROJECT Environment variable is set.

Anything else we need to know?

No response

[tomb1n0]

Out of interest, i also got Gemini 0.52.0 to review the Gemini CLI source to see if it could identify the root cause of this:

 Investigation complete: macOS Seatbelt Git crash root cause analyzed: Complete the investigation and deliver the final report detailing the root cause and proposed solution.


✦ I have successfully identified the root cause of the startup hang when running under the macOS Seatbelt sandbox inside a Git repository.

  1. The Root Cause

  In version 0.52.0, the macOS Seatbelt permissive sandbox profile (packages/cli/src/utils/sandbox-macos-permissive-open.sb) used an (allow default) foundation, which allowed all system operations except those explicitly blocked (like file-writes outside target directories):

   1 ;; allow everything by default
   2 (allow default)

  In version 0.53.0, PR #28424 ("align macOS permissive Seatbelt profiles with deny-default model") migrated the permissive profiles to use a secure (deny default) base:
   1 (deny default)
  This means any system operation not explicitly permitted is blocked by macOS Seatbelt.

  However, the new profile is missing permissions for several low-level operations that are essential for running standard child processes (such as git and Node's subprocess controller), specifically:
   1. process-info*: Denying this prevents Node's child_process managers (like execa) and subprocesses (like git) from querying process IDs, process groups, and process statuses (proc_pidinfo, getpriority, etc.).
   2. sysctl-read: Standard git invocations query system configuration details on startup that fall outside the highly limited whitelist defined in the profile.
   3. socket (Unix Domain Sockets): Apple-provided git and its associated keychain credential helpers require Unix domain sockets (AF_UNIX) to talk to system daemons (like opendirectoryd and security daemons) or the SSH agent (SSH_AUTH_SOCK).

  ---

  2. Why it only hangs when inside a Git repository

   * Inside a Git Repository: On startup, the CLI renders AppContainer.tsx, which triggers hooks that spawn asynchronous Git commands (such as useGitBranchName running git rev-parse --abbrev-ref HEAD and loadCliConfig running resolveWorktreeSettings -> git rev-parse --show-toplevel).
    Because of the missing sandbox permissions, these git subprocesses hang indefinitely or are terminated by the kernel. The startup initialization promises (such as loadCliConfig or config.refreshAuth) never resolve, keeping the CLI stuck in the Unauthenticated loading phase, which renders
  the Waiting for authentication... (Press Esc or Ctrl+C to cancel) dialogue indefinitely.
   * Outside of a Git Repository (e.g., in ~): When you run the CLI in your home directory, the same Git checks are executed but immediately fail with exit code 128 ("Not a git repository"), allowing the promises to reject instantly and proceed. Since the startup sequence is not blocked, the
     cached Google credentials are successfully verified and you are signed in automatically.

  ---

  3. Proposed Solution

  To resolve this issue, the macOS permissive sandbox profiles (sandbox-macos-permissive-open.sb and sandbox-macos-permissive-proxied.sb) must be updated to allow standard process and system monitoring operations.

  We can address this by adding the following rules:

   1 ;; allow process info operations (e.g. pgid, pid info, priority, process boundaries)
   2 (allow process-info*)

  If you would like me to apply this fix to the permissive Seatbelt profile files and run the test suite to verify, please issue a directive!

[gemini-cli]

Effort Analysis:
The crash occurs during the createToolRegistry phase at startup, which calls discoverAllTools() in packages/core/src/tools/tool-registry.ts. When tools.sandbox is enabled, this triggers MacOsSandboxManager.prepareCommand in packages/core/src/sandbox/macos/MacOsSandboxManager.ts, which calls buildSeatbeltProfile in seatbeltArgsBuilder.ts. The builder calls denyUnlessExplicitlyAllowed on governance files such as .git. This function uses resolveToRealPath from packages/core/src/utils/paths.ts, which invokes fs.realpathSync. In restricted MacOS environments (e.g., when the CLI is already partially sandboxed), fs.realpathSync throws an EACCES error that is not caught by the builder, leading to an unhandled exception and an immediate CLI crash. The issue is specific to Git repositories because the sandbox builder only attempts to protect and resolve .git paths when a repository is detected. Resolving this requires implementing robust error handling for filesystem resolution within the Seatbelt profile generation logic and verifying the fix against MacOS-specific sandbox behaviors.