# Gemini CLI: the "build" policy, with its directory and the network,
# but not its telemetry. It can change its own settings and extensions,
# which run outside the sandbox later. policies/commands/gemini.policy in
# blinker's config directory comes first.

# type  access  pattern
include build
file    write   ~/.gemini/

host    allow   *
host    deny    play.googleapis.com

env     allow   GEMINI_API_KEY
env     allow   GOOGLE_API_KEY
env     allow   GOOGLE_CLOUD_PROJECT