Merge branch 'main' into feature/differentiated-user-agent

docs/reference/configuration.md

@@ -92,6 +92,13 @@ their corresponding top-level category object in your `settings.json` file.
   - **Default:** `[]`
   - **Requires restart:** Yes
 
+#### `adminPolicyPaths`
+
+- **`adminPolicyPaths`** (array):
+  - **Description:** Additional admin policy files or directories to load.
+  - **Default:** `[]`
+  - **Requires restart:** Yes
+
 #### `general`
 
 - **`general.preferredEditor`** (string):
@@ -756,7 +763,7 @@ their corresponding top-level category object in your `settings.json` file.
 
 #### `tools`
 
-- **`tools.sandbox`** (boolean | string):
+- **`tools.sandbox`** (string):
   - **Description:** Sandbox execution environment. Set to a boolean to enable
     or disable the sandbox, provide a string path to a sandbox profile, or
     specify an explicit sandbox command (e.g., "docker", "podman", "lxc").

docs/reference/keyboard-shortcuts.md

@@ -130,10 +130,9 @@ available combinations.
 
 ## Customizing Keybindings
 
-You can add alternative keybindings for commands by creating or modifying the
+You can add alternative keybindings or remove default keybindings by creating a
 `keybindings.json` file in your home gemini directory (typically
-`~/.gemini/keybindings.json`). This allows you to bind commands to additional
-key combinations. Note that default keybindings cannot be removed.
+`~/.gemini/keybindings.json`).
 
 ### Configuration Format
 
@@ -144,28 +143,57 @@ a `key` combination.
 ```json
 [
   {
-    "command": "input.submit",
-    "key": "cmd+s"
+    "command": "edit.clear",
+    "key": "cmd+l"
   },
   {
-    "command": "edit.clear",
-    "key": "ctrl+l"
+    // prefix "-" to unbind a key
+    "command": "-app.toggleYolo",
+    "key": "ctrl+y"
+  },
+  {
+    "command": "input.submit",
+    "key": "ctrl+y"
+  },
+  {
+    // multiple modifiers
+    "command": "cursor.right",
+    "key": "shift+alt+a"
+  },
+  {
+    // Some mac keyboards send "Å" instead of "shift+option+a"
+    "command": "cursor.right",
+    "key": "Å"
+  },
+  {
+    // some base keys have special multi-char names
+    "command": "cursor.right",
+    "key": "shift+pageup"
   }
 ]
 ```
 
-### Keyboard Rules
-
+- **Unbinding** To remove an existing or default keybinding, prefix a minus sign
+  (`-`) to the `command` name.
+- **No Auto-unbinding** The same key can be bound to multiple commands in
+  different contexts at the same time. Therefore, creating a binding does not
+  automatically unbind the key from other commands.
 - **Explicit Modifiers**: Key matching is explicit. For example, a binding for
   `ctrl+f` will only trigger on exactly `ctrl+f`, not `ctrl+shift+f` or
-  `alt+ctrl+f`. You must specify the exact modifier keys (`ctrl`, `shift`,
-  `alt`/`opt`/`option`, `cmd`/`meta`).
+  `alt+ctrl+f`.
 - **Literal Characters**: Terminals often translate complex key combinations
-  (especially on macOS with the `Option` key) into special characters. To handle
-  this reliably across all operating systems and SSH sessions, you can bind
-  directly to the literal character produced. For example, instead of trying to
-  bind `shift+5`, bind directly to `%`.
-- **Special Keys**: Supported special keys include:
+  (especially on macOS with the `Option` key) into special characters, losing
+  modifier and keystroke information along the way. For example,`shift+5` might
+  be sent as `%`. In these cases, you must bind to the literal character `%` as
+  bindings to `shift+5` will never fire. To see precisely what is being sent,
+  enable `Debug Keystroke Logging` and hit f12 to open the debug log console.
+- **Key Modifiers**: The supported key modifiers are:
+  - `ctrl`
+  - `shift`,
+  - `alt` (synonyms: `opt`, `option`)
+  - `cmd` (synonym: `meta`)
+- **Base Key**: The base key can be any single unicode code point or any of the
+  following special keys:
   - **Navigation**: `up`, `down`, `left`, `right`, `home`, `end`, `pageup`,
     `pagedown`
   - **Actions**: `enter`, `escape`, `tab`, `space`, `backspace`, `delete`,
@@ -201,6 +229,9 @@ a `key` combination.
   the numbered radio option and confirm when the full number is entered.
 - `Ctrl + O`: Expand or collapse paste placeholders (`[Pasted Text: X lines]`)
   inline when the cursor is over the placeholder.
+- `Ctrl + X` (while a plan is presented): Open the plan in an external editor to
+  [collaboratively edit or comment](../cli/plan-mode.md#collaborative-plan-editing)
+  on the implementation strategy.
 - `Double-click` on a paste placeholder (alternate buffer mode only): Expand to
   view full content inline. Double-click again to collapse.
 

docs/reference/policy-engine.md

@@ -191,9 +191,13 @@ User, and (if configured) Admin directories.
 
 #### System-wide policies (Admin)
 
-Administrators can enforce system-wide policies (Tier 3) that override all user
-and default settings. These policies must be placed in specific, secure
-directories:
+Administrators can enforce system-wide policies (Tier 4) that override all user
+and default settings. These policies can be loaded from standard system
+locations or supplemental paths.
+
+##### Standard Locations
+
+These are the default paths the CLI searches for admin policies:
 
 | OS          | Policy Directory Path                             |
 | :---------- | :------------------------------------------------ |
@@ -201,10 +205,25 @@ directories:
 | **macOS**   | `/Library/Application Support/GeminiCli/policies` |
 | **Windows** | `C:\ProgramData\gemini-cli\policies`              |
 
-**Security Requirements:**
+##### Supplemental Admin Policies
 
-To prevent privilege escalation, the CLI enforces strict security checks on
-admin directories. If checks fail, system policies are **ignored**.
+Administrators can also specify supplemental policy paths using:
+
+- The `--admin-policy` command-line flag.
+- The `adminPolicyPaths` setting in a system settings file.
+
+These supplemental policies are assigned the same **Admin** tier (Base 4) as
+policies in standard locations.
+
+**Security Guard**: Supplemental admin policies are **ignored** if any `.toml`
+policy files are found in the standard system location. This prevents flag-based
+overrides when a central system policy has already been established.
+
+#### Security Requirements
+
+To prevent privilege escalation, the CLI enforces strict security checks on the
+**standard system policy directory**. If checks fail, the policies in that
+directory are **ignored**.
 
 - **Linux / macOS:** Must be owned by `root` (UID 0) and NOT writable by group
   or others (e.g., `chmod 755`).
@@ -214,6 +233,11 @@ admin directories. If checks fail, system policies are **ignored**.
   for non-admin groups. You may need to "Disable inheritance" in Advanced
   Security Settings._
 
+**Note:** Supplemental admin policies (provided via `--admin-policy` or
+`adminPolicyPaths` settings) are **NOT** subject to these strict ownership
+checks, as they are explicitly provided by the user or administrator in their
+current execution context.
+
 ### TOML rule schema
 
 Here is a breakdown of the fields available in a TOML policy rule: