{"record":{"id":"e965b5380c831e21","repo":"google-gemini/gemini-cli","slug":"configuration-untrusted-workspace-detected-stri-e965b5","errorCode":null,"errorMessage":"[Configuration] Untrusted workspace detected. Stripping repository telemetry definitions to prevent unintended data routing.","messagePattern":"\\[Configuration\\] Untrusted workspace detected\\. Stripping repository telemetry definitions to prevent unintended data routing\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/a2a-server/src/config/config.ts","lineNumber":312,"sourceCode":"      );\n    }\n    if (settings.policyPaths) {\n      logger.warn(\n        '[Configuration] Untrusted workspace detected. Stripping repository policyPaths definitions to prevent unintended policy override.',\n      );\n    }\n    if (settings.adminPolicyPaths) {\n      logger.warn(\n        '[Configuration] Untrusted workspace detected. Stripping repository adminPolicyPaths definitions to prevent unintended admin policy override.',\n      );\n    }\n    if (settings.tools) {\n      logger.warn(\n        '[Configuration] Untrusted workspace detected. Stripping repository tools definitions to prevent unintended tool enablement.',\n      );\n    }\n    if (settings.telemetry) {\n      logger.warn(\n        '[Configuration] Untrusted workspace detected. Stripping repository telemetry definitions to prevent unintended data routing.',\n      );\n    }\n    settings = {\n      ...settings,\n      mcpServers: undefined,\n      policyPaths: undefined,\n      adminPolicyPaths: undefined,\n      tools: undefined,\n      telemetry: undefined,\n    };\n  }\n  const safeMcpServers = settings.mcpServers;\n\n  const policySettings: PolicySettings = {\n    mcpServers: safeMcpServers,\n    tools: {\n      core: settings.tools?.core,","sourceCodeStart":294,"sourceCodeEnd":330,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/0bd1d439751478771c45d3d0895a6a9760554bf4/packages/a2a-server/src/config/config.ts#L294-L330","documentation":"Security warning from loadConfig: when the workspace is not trusted, repository-defined telemetry settings are stripped so a cloned repo cannot redirect where usage data is sent. Loading proceeds; the repo's telemetry configuration is ignored and defaults apply.","triggerScenarios":"loadConfig called with trusted=false while settings.telemetry is set in project settings; workspace trust not enabled (folderTrust=false, GEMINI_FOLDER_TRUST!=true).","commonSituations":"Repo ships telemetry (OTel endpoint) configuration that stops applying after cloning; CI/container without the trust env var; version upgrade that added telemetry stripping in untrusted workspaces.","solutions":["Enable workspace trust (settings.folderTrust=true or GEMINI_FOLDER_TRUST=true and pass trusted=true to loadConfig)","Move telemetry settings to user-level/global settings so they are honored","Remove repo-level telemetry settings if not needed","Accept the warning: telemetry falls back to defaults"],"exampleFix":"// before\n// untrusted workspace + project settings: { \"telemetry\": { \"outfile\": \"./otlp.json\" } } -> stripped\n// after\nexport GEMINI_FOLDER_TRUST=true\n// or user-level settings:\n{ \"folderTrust\": true, \"telemetry\": { \"outfile\": \"/abs/path/otlp.json\" } }","handlingStrategy":"validation","validationCode":"export function assertTelemetrySurvive(settings: { telemetry?: unknown; folderTrust?: boolean }): void {\n  const trusted = settings.folderTrust === true || process.env['GEMINI_FOLDER_TRUST'] === 'true';\n  if (!trusted && settings.telemetry) {\n    throw new Error('Workspace is untrusted: repository telemetry configuration will be stripped. Enable folderTrust or move telemetry config to user settings.');\n  }\n}","typeGuard":"function isTrustedWorkspace(s: { folderTrust?: boolean }): boolean {\n  return s.folderTrust === true || process.env['GEMINI_FOLDER_TRUST'] === 'true';\n}","tryCatchPattern":null,"preventionTips":["Configure telemetry (OTel endpoints) at user level, not repo level","Set GEMINI_FOLDER_TRUST=true only for owned workspaces","Confirm telemetry settings took effect after loadConfig","Review logs for stripping warnings when provisioning environments"],"tags":["security","configuration","workspace-trust","telemetry"],"backgroundTag":"untrusted-workspace-settings-stripped","analyzedSha":"0bd1d439751478771c45d3d0895a6a9760554bf4","analyzedAt":"2026-09-01T05:28:28.590Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}