[Configuration] Untrusted workspace detected. Stripping repo

Error message

[Configuration] Untrusted workspace detected. Stripping repository policyPaths definitions to prevent unintended policy override.

What it means

Security warning from loadConfig: when the workspace is not trusted, repository-defined policyPaths are stripped so a cloned repo cannot override the server's policy files. Loading proceeds; only the repo-supplied policyPaths are ignored.

Source

Thrown at packages/a2a-server/src/config/config.ts:297

        '[Config] Checkpointing is enabled but git is not installed. Disabling checkpointing.',
      );
      checkpointing = false;
    }
  }

  const approvalMode =
    getEnvLocal('GEMINI_YOLO_MODE') === 'true'
      ? ApprovalMode.YOLO
      : ApprovalMode.DEFAULT;

  if (!trusted) {
    if (settings.mcpServers) {
      logger.warn(
        '[Configuration] Untrusted workspace detected. Stripping repository mcpServers definitions to prevent unintended command execution.',
      );
    }
    if (settings.policyPaths) {
      logger.warn(
        '[Configuration] Untrusted workspace detected. Stripping repository policyPaths definitions to prevent unintended policy override.',
      );
    }
    if (settings.adminPolicyPaths) {
      logger.warn(
        '[Configuration] Untrusted workspace detected. Stripping repository adminPolicyPaths definitions to prevent unintended admin policy override.',
      );
    }
    if (settings.tools) {
      logger.warn(
        '[Configuration] Untrusted workspace detected. Stripping repository tools definitions to prevent unintended tool enablement.',
      );
    }
    if (settings.telemetry) {
      logger.warn(
        '[Configuration] Untrusted workspace detected. Stripping repository telemetry definitions to prevent unintended data routing.',
      );
    }

View on GitHub (pinned to 0bd1d43975)

Solutions

Enable workspace trust (settings.folderTrust=true or GEMINI_FOLDER_TRUST=true and trusted=true when calling loadConfig)
Relocate policyPaths to user-level/global settings that are not subject to the untrusted-workspace strip
Remove repo-level policyPaths if not needed to silence the warning
Treat as informational: policies simply fall back to defaults

Example fix

// before
// project settings: { "policyPaths": ["./policies.json"] } in untrusted workspace -> stripped
// after
export GEMINI_FOLDER_TRUST=true
// or move to user-level settings:
{ "folderTrust": true, "policyPaths": ["/abs/path/policies.json"] }

Defensive patterns

Strategy: validation

Validate before calling

export function assertPolicyPathsSurvive(settings: { policyPaths?: unknown; folderTrust?: boolean }): void {
  const trusted = settings.folderTrust === true || process.env['GEMINI_FOLDER_TRUST'] === 'true';
  if (!trusted && settings.policyPaths) {
    throw new Error('Workspace is untrusted: repository policyPaths will be stripped. Enable folderTrust or relocate policies to user settings.');
  }
}

Type guard

function isTrustedWorkspace(s: { folderTrust?: boolean }): boolean {
  return s.folderTrust === true || process.env['GEMINI_FOLDER_TRUST'] === 'true';
}

Prevention

Grant folder trust before relying on repo-supplied policyPaths
Keep policy files at user level for repeatable environments
Verify the resulting Config's policy engine state after loadConfig
Audit repos for policyPaths before running the server on them

When it happens

Trigger: loadConfig invoked with trusted=false while settings.policyPaths is set in project settings; trust flag (folderTrust / GEMINI_FOLDER_TRUST) not enabled.

Common situations: Running the server on a checked-out repo that ships policyPaths in its project settings; forgetting to export GEMINI_FOLDER_TRUST=true in a dev container; newly enforced folder-trust feature after an upgrade silently disables repo policies.

Related errors

AI-assisted analysis of google-gemini/gemini-cli@0bd1d43975 (2026-09-01). Data as JSON: /api/errors/a74e0579f1d022cf. Report an issue: GitHub.