fix(patch): cherry-pick 3ff68a9 to release/v0.33.0-preview.14-pr-21884 [CONFLICTS] (#21952)

Co-authored-by: Gaurav <39389231+gsquared94@users.noreply.github.com>
Co-authored-by: Gal Zahavi <38544478+galz10@users.noreply.github.com>

packages/a2a-server/package.json

@@ -36,7 +36,7 @@
     "winston": "^3.17.0"
   },
   "devDependencies": {
-    "@google/genai": "^1.30.0",
+    "@google/genai": "1.30.0",
     "@types/express": "^5.0.3",
     "@types/fs-extra": "^11.0.4",
     "@types/supertest": "^6.0.3",

packages/cli/package.json

@@ -31,7 +31,7 @@
   "dependencies": {
     "@agentclientprotocol/sdk": "^0.12.0",
     "@google/gemini-cli-core": "file:../core",
-    "@google/genai": "1.41.0",
+    "@google/genai": "1.30.0",
     "@iarna/toml": "^2.2.5",
     "@modelcontextprotocol/sdk": "^1.23.0",
     "ansi-escapes": "^7.3.0",

packages/cli/src/ui/hooks/useGeminiStream.ts

@@ -1036,10 +1036,6 @@ export const useGeminiStream = (
           'Response stopped due to prohibited image content.',
         [FinishReason.NO_IMAGE]:
           'Response stopped because no image was generated.',
-        [FinishReason.IMAGE_RECITATION]:
-          'Response stopped due to image recitation policy.',
-        [FinishReason.IMAGE_OTHER]:
-          'Response stopped due to other image-related reasons.',
       };
 
       const message = finishReasonMessages[finishReason];

packages/cli/src/ui/utils/textUtils.ts

@@ -126,9 +126,10 @@ export function stripUnsafeCharacters(str: string): string {
   // C1: 0x80-0x9F
   // BiDi: U+200E (LRM), U+200F (RLM), U+202A-U+202E, U+2066-U+2069
   // Zero-width: U+200B (ZWSP), U+FEFF (BOM)
+  // U+0602: ARABIC FOOTNOTE MARKER (can crash string-width)
   return strippedVT.replace(
     // eslint-disable-next-line no-control-regex
-    /[\x00-\x08\x0B\x0C\x0E-\x1F\x80-\x9F\u200E\u200F\u202A-\u202E\u2066-\u2069\u200B\uFEFF]/g,
+    /[\x00-\x08\x0B\x0C\x0E-\x1F\x80-\x9F\u200E\u200F\u202A-\u202E\u2066-\u2069\u200B\uFEFF\u0602]/g,
     '',
   );
 }
@@ -187,7 +188,7 @@ export const getCachedStringWidth = (str: string): number => {
   } catch {
     // Fallback for characters that cause string-width to crash (e.g. U+0602)
     // See: https://github.com/google-gemini/gemini-cli/issues/16418
-    width = toCodePoints(stripAnsi(str)).length;
+    width = toCodePoints(stripUnsafeCharacters(str)).length;
   }
 
   stringWidthCache.set(str, width);

packages/core/package.json

@@ -25,7 +25,8 @@
     "@google-cloud/logging": "^11.2.1",
     "@google-cloud/opentelemetry-cloud-monitoring-exporter": "^0.21.0",
     "@google-cloud/opentelemetry-cloud-trace-exporter": "^3.0.0",
-    "@google/genai": "1.41.0",
+    "@google/genai": "1.30.0",
+    "@grpc/grpc-js": "^1.14.3",
     "@iarna/toml": "^2.2.5",
     "@joshua.litt/get-ripgrep": "^0.0.3",
     "@modelcontextprotocol/sdk": "^1.23.0",
@@ -59,7 +60,7 @@
     "fdir": "^6.4.6",
     "fzf": "^0.5.2",
     "glob": "^12.0.0",
-    "google-auth-library": "^10.5.0",
+    "google-auth-library": "^9.11.0",
     "html-to-text": "^9.0.5",
     "https-proxy-agent": "^7.0.6",
     "ignore": "^7.0.0",

packages/vscode-ide-companion/NOTICES.txt

@@ -34,7 +34,7 @@ SOFTWARE.
 License text not found.
 
 ============================================================
-ajv@6.14.0
+ajv@6.12.6
 (https://github.com/ajv-validator/ajv.git)
 
 The MIT License (MIT)
@@ -1676,33 +1676,6 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
-============================================================
-safe-buffer@5.2.1
-(git://github.com/feross/safe-buffer.git)
-
-The MIT License (MIT)
-
-Copyright (c) Feross Aboukhadijeh
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
-
 ============================================================
 cookie@0.7.2
 (No repository found)
@@ -2156,33 +2129,6 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 
-============================================================
-path-to-regexp@6.3.0
-(https://github.com/pillarjs/path-to-regexp.git)
-
-The MIT License (MIT)
-
-Copyright (c) 2014 Blake Embrey (hello@blakeembrey.com)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
-
 ============================================================
 send@1.2.1
 (No repository found)
@@ -2295,7 +2241,7 @@ THE SOFTWARE.
 
 
 ============================================================
-hono@4.12.2
+hono@4.11.9
 (git+https://github.com/honojs/hono.git)
 
 MIT License

scripts/check-lockfile.js

@@ -70,5 +70,36 @@ if (invalidPackages.length > 0) {
   process.exitCode = 1;
 } else {
   console.log('Lockfile check passed.');
+}
+
+// Check that gaxios v7+ is NOT resolved in any workspace node_modules.
+// gaxios v7.x has a bug where Array.toString() joins stream chunks with
+// commas, corrupting error response JSON at TCP chunk boundaries.
+// See: https://github.com/google-gemini/gemini-cli/pull/21884
+const gaxiosViolations = [];
+for (const [location, details] of Object.entries(packages)) {
+  if (
+    location.match(/(^|\/)node_modules\/gaxios$/) &&
+    !location.includes('@google/genai/node_modules') &&
+    details.version &&
+    parseInt(details.version.split('.')[0], 10) >= 7
+  ) {
+    gaxiosViolations.push(`${location} (v${details.version})`);
+  }
+}
+
+if (gaxiosViolations.length > 0) {
+  console.error(
+    '\nError: gaxios v7+ detected in workspace node_modules. This version has a stream corruption bug.',
+  );
+  console.error('See: https://github.com/google-gemini/gemini-cli/pull/21884');
+  gaxiosViolations.forEach((v) => console.error(`- ${v}`));
+  console.error(
+    '\nDo NOT upgrade @google/genai or google-auth-library until the gaxios v7 bug is fixed upstream.',
+  );
+  process.exitCode = 1;
+}
+
+if (!process.exitCode) {
   process.exitCode = 0;
 }