agent deletes user's .git

[kingarrrt]

What happened?

Description:

While assisting a user in fixing a broken Git submodule configuration, the Gemini CLI agent made a critical error resulting what would have been critical data loss were it not for ZFS snapshotting.

Steps to Reproduce:

1. A submodule directory incorrectly contained a full .git directory instead of a .git file, making it an independent, nested Git repository.
2. The agent couldn't identify this as the root cause of Git being borked, but worked out a plan after some prompting.
3. As part of a planned fix, the agent created a backup of the submodule's .git directory by renaming it to .git.bak.
4. After successfully re-initializing the submodule, the agent proceeded with a cleanup step.

Problem:

The agent incorrectly classified the .git.bak directory (which was a backup of critical user version control data) as a temporary artifact created during the session and recursively deleted it (rm -rf) without seeking explicit user confirmation.

Impact:

This action permanently deleted the user's local commit history. While the working files were restored, the Git history from that specific, nested repository had to be restored from backup.

Root Cause Analysis:

1. Faulty Heuristics: The agent's internal cleanup logic is overly aggressive and makes dangerous assumptions about file ownership and purpose. It failed to differentiate between a genuinely temporary, disposable file and a backup of user data (especially sensitive Git metadata).
2. Inadequate Safety Protocols: The agent lacks a robust, non-negotiable protocol to never delete user data backups, regardless of how they are named or created. It also failed to implement a mandatory, explicit user confirmation step before executing a destructive rm -rf command on a directory it did not originally create as a true ephemeral temporary file.
3. Lack of Contextual Awareness: The agent failed to recognize the inherent high value of a .git directory backup and treated it with the same priority as a trivial temporary file.

Requested Actions:

1. Implement a hard-coded, inviolable rule preventing the agent from ever deleting backups containing user data (e.g., any file or directory ending in .bak, .backup, .old, etc., that was not explicitly created as a true ephemeral temporary file by the agent in the first place).
2. Enforce mandatory, explicit user confirmation for any rm command targeting files or directories that the agent did not originate as true temporary files within the current session. This confirmation should include a clear statement of what is being deleted and why.
3. Improve agent training and internal knowledge base to specifically recognize and prioritize the preservation of version control metadata (.git, .svn, .hg, etc.) and its backups as critical user assets.

What did you expect to happen?

.git directory not to be blatted.

Client information

Client Information

Run gemini to enter the interactive CLI, then run the /about command.

> /about

╭────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                        │
│ About Gemini CLI                                                                                       │
│                                                                                                        │
│ CLI Version                         0.23.0                                                             │
│ Model                               auto-gemini-2.5                                                    │
│ Sandbox                             no sandbox                                                         │
│ OS                                  linux                                                              │
│ Auth Method                         gemini-api-key                                                     │
│                                                                                                        │
╰────────────────────────────────────────────────────────────────────────────────────────────────────────╯

Login information

API key

Anything else we need to know?

No response

[scidomino]

Were you running in YOLO mode?

[JagjeevanAK]

most probably he was in YOLO mode

[scidomino]

The point of YOLO mode is to not require interactions from the user. If you want to prevent YOLO mode from taking certain actions, the way to do this is to create a policy file toml. In that you can specify certain bash commands to DENY. It will apply even in YOLO mode with no user interactions.

[kingarrrt]

Yes I was in YOLO mode, but I don't see what that's got to do with anything.

My point is that the agent made an bad decision. The bug report comes from it, but I don't see its requests as unreasonable. Safety counts.