diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 95cd3488c9..bde7ae31ab 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -1,7 +1,5 @@
 name: 'Bug Report'
 description: 'Report a bug to help us improve Gemini CLI'
-labels:
-  - 'status/need-triage'
 body:
   - type: 'markdown'
     attributes:
diff --git a/.github/scripts/pr-triage.sh b/.github/scripts/pr-triage.sh
index 2052406869..cca12747b7 100755
--- a/.github/scripts/pr-triage.sh
+++ b/.github/scripts/pr-triage.sh
@@ -68,7 +68,7 @@ process_pr_optimized() {
             fi
         else
             echo "   ⚠️  No linked issue found for PR #${PR_NUMBER}"
-            if [[ ",${CURRENT_LABELS}," != ",status/need-issue,"* ]]; then
+            if [[ ",${CURRENT_LABELS}," != *",status/need-issue,"* ]]; then
                 echo "      ➕ Adding status/need-issue label"
                 LABELS_TO_ADD="status/need-issue"
             fi
@@ -82,7 +82,7 @@ process_pr_optimized() {
     else
         echo "   🔗 Found linked issue #${ISSUE_NUMBER}"
 
-        if [[ ",${CURRENT_LABELS}," == ",status/need-issue,"* ]]; then
+        if [[ ",${CURRENT_LABELS}," == *",status/need-issue,"* ]]; then
             echo "      ➖ Removing status/need-issue label"
             LABELS_TO_REMOVE="status/need-issue"
         fi
diff --git a/.github/workflows/label-enforcer.yml b/.github/workflows/label-enforcer.yml
index 173a80c103..98b8a3f554 100644
--- a/.github/workflows/label-enforcer.yml
+++ b/.github/workflows/label-enforcer.yml
@@ -10,7 +10,7 @@ jobs:
   enforce-label:
     # Run this job only when restricted labels are changed
     if: |-
-      ${{ (github.event.label.name == 'help wanted' || github.event.label.name == 'status/need-triage') &&
+      ${{ (github.event.label.name == 'help wanted' || github.event.label.name == 'status/need-triage' || github.event.label.name == '🔒 maintainer only') &&
           (github.repository == 'google-gemini/gemini-cli' || github.repository == 'google-gemini/maintainers-gemini-cli') }}
     runs-on: 'ubuntu-latest'
     permissions:
@@ -39,28 +39,34 @@ jobs:
             const labelName = context.payload.label.name;
 
             // Skip if the change was made by a bot to avoid infinite loops
-            if (username === 'github-actions[bot]') {
+            if (username === 'github-actions[bot]' || username === 'gemini-cli[bot]' || username.endsWith('[bot]')) {
               core.info('Change made by a bot. Skipping.');
               return;
             }
 
             try {
-              // This will succeed with a 204 status if the user is a member,
-              // and fail with a 404 error if they are not.
-              await github.rest.teams.getMembershipForUserInOrg ({
-                org,
-                team_slug,
+              // Check repository permission level directly.
+              // This is more robust than team membership as it doesn't require Org-level read permissions
+              // and correctly handles Repo Admins/Writers who might not be in the specific team.
+              const { data: { permission } } = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: org,
+                repo: context.repo.repo,
                 username,
               });
-              core.info(`${username} is a member of the ${team_slug} team. No action needed.`);
-            } catch (error) {
-              // If the error is not 404, rethrow it to fail the action
-              if (error.status !== 404) {
-                throw error;
+
+              if (permission === 'admin' || permission === 'write') {
+                core.info(`${username} has '${permission}' permission. Allowed.`);
+                return;
               }
 
-              core.info(`${username} is not a member. Reverting '${action}' action for '${labelName}' label.`);
+              core.info(`${username} has '${permission}' permission (needs 'write' or 'admin'). Reverting '${action}' action for '${labelName}' label.`);
+            } catch (error) {
+              core.error(`Failed to check permissions for ${username}: ${error.message}`);
+              // Fall through to revert logic if we can't verify permissions (fail safe)
+            }
 
+            // If we are here, the user is NOT authorized.
+            if (true) { // wrapping block to preserve variable scope if needed
               if (action === 'labeled') {
                 // 1. Remove the label if added by a non-maintainer
                 await github.rest.issues.removeLabel ({
diff --git a/.github/workflows/label-workstream-rollup.yml b/.github/workflows/label-workstream-rollup.yml
new file mode 100644
index 0000000000..38707bac7b
--- /dev/null
+++ b/.github/workflows/label-workstream-rollup.yml
@@ -0,0 +1,94 @@
+name: 'Label Workstream Rollup'
+
+on:
+  issues:
+    types: ['opened', 'edited', 'reopened']
+  schedule:
+    - cron: '0 * * * *'
+  workflow_dispatch:
+
+jobs:
+  labeler:
+    runs-on: 'ubuntu-latest'
+    permissions:
+      issues: 'write'
+    steps:
+      - name: 'Check for Parent Workstream and Apply Label'
+        uses: 'actions/github-script@v7'
+        with:
+          script: |
+            const labelToAdd = 'workstream-rollup';
+
+            // Allow-list of parent issue URLs
+            const allowedParentUrls = [
+              'https://github.com/google-gemini/gemini-cli/issues/15374',
+              'https://github.com/google-gemini/gemini-cli/issues/15456',
+              'https://github.com/google-gemini/gemini-cli/issues/15324'
+            ];
+
+            async function getIssueParent(owner, repo, number) {
+              const query = `
+                query($owner:String!, $repo:String!, $number:Int!) {
+                  repository(owner:$owner, name:$repo) {
+                    issue(number:$number) {
+                      parent {
+                        url
+                      }
+                    }
+                  }
+                }
+              `;
+              try {
+                const result = await github.graphql(query, { owner, repo, number });
+                return result.repository.issue.parent ? result.repository.issue.parent.url : null;
+              } catch (error) {
+                console.error(`Failed to fetch parent for #${number}:`, error);
+                return null;
+              }
+            }
+
+            // Determine which issues to process
+            let issuesToProcess = [];
+
+            if (context.eventName === 'issues') {
+               // Context payload for 'issues' event already has the issue object
+               issuesToProcess.push({
+                 number: context.payload.issue.number,
+                 owner: context.repo.owner,
+                 repo: context.repo.repo
+               });
+            } else {
+              // For schedule/dispatch, fetch open issues (lightweight list)
+              console.log(`Running for event: ${context.eventName}. Fetching open issues...`);
+              const openIssues = await github.paginate(github.rest.issues.listForRepo, {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                state: 'open'
+              });
+              issuesToProcess = openIssues.map(i => ({
+                number: i.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo
+              }));
+            }
+
+            console.log(`Processing ${issuesToProcess.length} issue(s)...`);
+
+            for (const issue of issuesToProcess) {
+              const parentUrl = await getIssueParent(issue.owner, issue.repo, issue.number);
+
+              if (parentUrl && allowedParentUrls.includes(parentUrl)) {
+                console.log(`SUCCESS: Issue #${issue.number} is a direct child of ${parentUrl}. Adding label.`);
+                await github.rest.issues.addLabels({
+                  owner: issue.owner,
+                  repo: issue.repo,
+                  issue_number: issue.number,
+                  labels: [labelToAdd]
+                });
+              } else {
+                 // logging only for single execution to avoid spam
+                 if (context.eventName === 'issues') {
+                    console.log(`Issue #${issue.number} parent is ${parentUrl || 'None'}. No action.`);
+                 }
+              }
+            }
diff --git a/GEMINI.md b/GEMINI.md
index 3da20efb75..1752c32a20 100644
--- a/GEMINI.md
+++ b/GEMINI.md
@@ -15,6 +15,17 @@ project. While you can run the individual steps (`build`, `test`, `typecheck`,
 `lint`) separately, it is highly recommended to use `npm run preflight` to
 ensure a comprehensive validation.
 
+## Running Tests in Workspaces\*\*: To run a specific test file within a
+
+workspace, use the command:
+`npm test -w <workspace-name> -- <path/to/test-file.test.ts>`. **CRITICAL**: The
+`<path/to/test-file.test.ts>` MUST be relative to the workspace directory root,
+NOT the project root.
+
+- _Example (Core package)_:
+  `npm test -w @google/gemini-cli-core -- src/routing/modelRouterService.test.ts`
+- _Common workspaces_: `@google/gemini-cli`, `@google/gemini-cli-core`.
+
 ## Writing Tests
 
 This project uses **Vitest** as its primary testing framework. When writing
diff --git a/docs/changelogs/releases.md b/docs/changelogs/releases.md
index 90b94140c3..23524cfc3c 100644
--- a/docs/changelogs/releases.md
+++ b/docs/changelogs/releases.md
@@ -1230,7 +1230,7 @@ https://github.com/google-gemini/gemini-cli/compare/v0.19.4...v0.20.0
   https://github.com/google-gemini/gemini-cli/pull/12863
 - feat(hooks): Hook Telemetry Infrastructure by @Edilmo in
   https://github.com/google-gemini/gemini-cli/pull/9082
-- fix: (some minor improvements to configs and getPackageJson return behaviour)
+- fix: (some minor improvements to configs and getPackageJson return behavior)
   by @grMLEqomlkkU5Eeinz4brIrOVCUCkJuN in
   https://github.com/google-gemini/gemini-cli/pull/12510
 - feat(hooks): Hook Event Handling by @Edilmo in
@@ -1364,7 +1364,7 @@ https://github.com/google-gemini/gemini-cli/compare/v0.18.4...v0.19.0
   https://github.com/google-gemini/gemini-cli/pull/12863
 - feat(hooks): Hook Telemetry Infrastructure by @Edilmo in
   https://github.com/google-gemini/gemini-cli/pull/9082
-- fix: (some minor improvements to configs and getPackageJson return behaviour)
+- fix: (some minor improvements to configs and getPackageJson return behavior)
   by @grMLEqomlkkU5Eeinz4brIrOVCUCkJuN in
   https://github.com/google-gemini/gemini-cli/pull/12510
 - feat(hooks): Hook Event Handling by @Edilmo in
diff --git a/docs/cli/commands.md b/docs/cli/commands.md
index fb5da33133..886a3d4669 100644
--- a/docs/cli/commands.md
+++ b/docs/cli/commands.md
@@ -204,6 +204,23 @@ Slash commands provide meta-level control over the CLI itself.
     modify them as desired. Changes to some settings are applied immediately,
     while others require a restart.
 
+- [**`/skills`**](./skills.md)
+  - **Description:** (Experimental) Manage Agent Skills, which provide on-demand
+    expertise and specialized workflows.
+  - **Sub-commands:**
+    - **`list`**:
+      - **Description:** List all discovered skills and their current status
+        (enabled/disabled).
+    - **`enable`**:
+      - **Description:** Enable a specific skill by name.
+      - **Usage:** `/skills enable <name>`
+    - **`disable`**:
+      - **Description:** Disable a specific skill by name.
+      - **Usage:** `/skills disable <name>`
+    - **`reload`**:
+      - **Description:** Refresh the list of discovered skills from all tiers
+        (workspace, user, and extensions).
+
 - **`/stats`**
   - **Description:** Display detailed statistics for the current Gemini CLI
     session, including token usage, cached token savings (when available), and
diff --git a/docs/cli/custom-commands.md b/docs/cli/custom-commands.md
index 2d251fc373..b70be823f1 100644
--- a/docs/cli/custom-commands.md
+++ b/docs/cli/custom-commands.md
@@ -50,7 +50,7 @@ Your command definition files must be written in the TOML format and use the
 ## Handling arguments
 
 Custom commands support two powerful methods for handling arguments. The CLI
-automatically chooses the correct method based on the content of your command\'s
+automatically chooses the correct method based on the content of your command's
 `prompt`.
 
 ### 1. Context-aware injection with `{{args}}`
@@ -96,13 +96,13 @@ Search Results:
 """
 ```
 
-When you run `/grep-code It\'s complicated`:
+When you run `/grep-code It's complicated`:
 
 1. The CLI sees `{{args}}` used both outside and inside `!{...}`.
-2. Outside: The first `{{args}}` is replaced raw with `It\'s complicated`.
+2. Outside: The first `{{args}}` is replaced raw with `It's complicated`.
 3. Inside: The second `{{args}}` is replaced with the escaped version (e.g., on
    Linux: `"It\'s complicated"`).
-4. The command executed is `grep -r "It\'s complicated" .`.
+4. The command executed is `grep -r "It's complicated" .`.
 5. The CLI prompts you to confirm this exact, secure command before execution.
 6. The final prompt is sent.
 
@@ -129,13 +129,13 @@ format and behavior.
 # In: <project>/.gemini/commands/changelog.toml
 # Invoked via: /changelog 1.2.0 added "Support for default argument parsing."
 
-description = "Adds a new entry to the project\'s CHANGELOG.md file."
+description = "Adds a new entry to the project's CHANGELOG.md file."
 prompt = """
 # Task: Update Changelog
 
 You are an expert maintainer of this software project. A user has invoked a command to add a new entry to the changelog.
 
-**The user\'s raw command is appended below your instructions.**
+**The user's raw command is appended below your instructions.**
 
 Your task is to parse the `<version>`, `<change_type>`, and `<message>` from their input and use the `write_file` tool to correctly update the `CHANGELOG.md` file.
 
@@ -147,7 +147,7 @@ The command follows this format: `/changelog <version> <type> <message>`
 1. Read the `CHANGELOG.md` file.
 2. Find the section for the specified `<version>`.
 3. Add the `<message>` under the correct `<type>` heading.
-4. If the version or type section doesn\'t exist, create it.
+4. If the version or type section doesn't exist, create it.
 5. Adhere strictly to the "Keep a Changelog" format.
 """
 ```
@@ -241,7 +241,7 @@ operate on specific files.
 **Example (`review.toml`):**
 
 This command injects the content of a _fixed_ best practices file
-(`docs/best-practices.md`) and uses the user\'s arguments to provide context for
+(`docs/best-practices.md`) and uses the user's arguments to provide context for
 the review.
 
 ```toml
@@ -293,7 +293,7 @@ practice.
 description = "Asks the model to refactor the current context into a pure function."
 
 prompt = """
-Please analyze the code I\'ve provided in the current context.
+Please analyze the code I've provided in the current context.
 Refactor it into a pure function.
 
 Your response should include:
diff --git a/docs/cli/index.md b/docs/cli/index.md
index 069c802411..4c5f7eac8a 100644
--- a/docs/cli/index.md
+++ b/docs/cli/index.md
@@ -25,10 +25,12 @@ overview of Gemini CLI, see the [main documentation page](../index.md).
 
 - **[Checkpointing](./checkpointing.md):** Automatically save and restore
   snapshots of your session and files.
-- **[Enterprise configuration](./enterprise.md):** Deploying and manage Gemini
-  CLI in an enterprise environment.
+- **[Enterprise configuration](./enterprise.md):** Deploy and manage Gemini CLI
+  in an enterprise environment.
 - **[Sandboxing](./sandbox.md):** Isolate tool execution in a secure,
   containerized environment.
+- **[Agent Skills](./skills.md):** (Experimental) Extend the CLI with
+  specialized expertise and procedural workflows.
 - **[Telemetry](./telemetry.md):** Configure observability to monitor usage and
   performance.
 - **[Token caching](./token-caching.md):** Optimize API costs by caching tokens.
diff --git a/docs/cli/keyboard-shortcuts.md b/docs/cli/keyboard-shortcuts.md
index 16a4083584..3a6abf14f7 100644
--- a/docs/cli/keyboard-shortcuts.md
+++ b/docs/cli/keyboard-shortcuts.md
@@ -8,10 +8,12 @@ available combinations.
 
 #### Basic Controls
 
-| Action                                       | Keys    |
-| -------------------------------------------- | ------- |
-| Confirm the current selection or choice.     | `Enter` |
-| Dismiss dialogs or cancel the current focus. | `Esc`   |
+| Action                                                          | Keys       |
+| --------------------------------------------------------------- | ---------- |
+| Confirm the current selection or choice.                        | `Enter`    |
+| Dismiss dialogs or cancel the current focus.                    | `Esc`      |
+| Cancel the current request or quit the CLI when input is empty. | `Ctrl + C` |
+| Exit the CLI when the input buffer is empty.                    | `Ctrl + D` |
 
 #### Cursor Movement
 
@@ -40,12 +42,6 @@ available combinations.
 | Undo the most recent text edit.                  | `Ctrl + Z (no Shift)`                                     |
 | Redo the most recent undone text edit.           | `Ctrl + Shift + Z`                                        |
 
-#### Screen Control
-
-| Action                                       | Keys       |
-| -------------------------------------------- | ---------- |
-| Clear the terminal screen and redraw the UI. | `Ctrl + L` |
-
 #### Scrolling
 
 | Action                   | Keys                 |
@@ -88,39 +84,28 @@ available combinations.
 
 #### Text Input
 
-| Action                               | Keys                                                                   |
-| ------------------------------------ | ---------------------------------------------------------------------- |
-| Submit the current prompt.           | `Enter (no Ctrl, no Shift, no Cmd)`                                    |
-| Insert a newline without submitting. | `Ctrl + Enter`<br />`Cmd + Enter`<br />`Shift + Enter`<br />`Ctrl + J` |
-
-#### External Tools
-
-| Action                                         | Keys                      |
-| ---------------------------------------------- | ------------------------- |
-| Open the current prompt in an external editor. | `Ctrl + X`                |
-| Paste from the clipboard.                      | `Ctrl + V`<br />`Cmd + V` |
+| Action                                         | Keys                                                                   |
+| ---------------------------------------------- | ---------------------------------------------------------------------- |
+| Submit the current prompt.                     | `Enter (no Ctrl, no Shift, no Cmd)`                                    |
+| Insert a newline without submitting.           | `Ctrl + Enter`<br />`Cmd + Enter`<br />`Shift + Enter`<br />`Ctrl + J` |
+| Open the current prompt in an external editor. | `Ctrl + X`                                                             |
+| Paste from the clipboard.                      | `Ctrl + V`<br />`Cmd + V`                                              |
 
 #### App Controls
 
-| Action                                                            | Keys             |
-| ----------------------------------------------------------------- | ---------------- |
-| Toggle detailed error information.                                | `F12`            |
-| Toggle the full TODO list.                                        | `Ctrl + T`       |
-| Show IDE context details.                                         | `Ctrl + G`       |
-| Toggle Markdown rendering.                                        | `Cmd + M`        |
-| Toggle copy mode when the terminal is using the alternate buffer. | `Ctrl + S`       |
-| Toggle YOLO (auto-approval) mode for tool calls.                  | `Ctrl + Y`       |
-| Toggle Auto Edit (auto-accept edits) mode.                        | `Shift + Tab`    |
-| Expand a height-constrained response to show additional lines.    | `Ctrl + S`       |
-| Focus the shell input from the gemini input.                      | `Tab (no Shift)` |
-| Focus the Gemini input from the shell input.                      | `Tab`            |
-
-#### Session Control
-
-| Action                                       | Keys       |
-| -------------------------------------------- | ---------- |
-| Cancel the current request or quit the CLI.  | `Ctrl + C` |
-| Exit the CLI when the input buffer is empty. | `Ctrl + D` |
+| Action                                                                                           | Keys             |
+| ------------------------------------------------------------------------------------------------ | ---------------- |
+| Toggle detailed error information.                                                               | `F12`            |
+| Toggle the full TODO list.                                                                       | `Ctrl + T`       |
+| Show IDE context details.                                                                        | `Ctrl + G`       |
+| Toggle Markdown rendering.                                                                       | `Cmd + M`        |
+| Toggle copy mode when in alternate buffer mode.                                                  | `Ctrl + S`       |
+| Toggle YOLO (auto-approval) mode for tool calls.                                                 | `Ctrl + Y`       |
+| Toggle Auto Edit (auto-accept edits) mode.                                                       | `Shift + Tab`    |
+| Expand a height-constrained response to show additional lines when not in alternate buffer mode. | `Ctrl + S`       |
+| Focus the shell input from the gemini input.                                                     | `Tab (no Shift)` |
+| Focus the Gemini input from the shell input.                                                     | `Tab`            |
+| Clear the terminal screen and redraw the UI.                                                     | `Ctrl + L`       |
 
 <!-- KEYBINDINGS-AUTOGEN:END -->
 
diff --git a/docs/cli/model-routing.md b/docs/cli/model-routing.md
index 15105a4ef8..1f833d3f6e 100644
--- a/docs/cli/model-routing.md
+++ b/docs/cli/model-routing.md
@@ -11,7 +11,7 @@ health and automatically routes requests to available models based on defined
 policies.
 
 1.  **Model failure:** If the currently selected model fails (e.g., due to quota
-    or server errors), the CLI will iniate the fallback process.
+    or server errors), the CLI will initiate the fallback process.
 
 2.  **User consent:** Depending on the failure and the model's policy, the CLI
     may prompt you to switch to a fallback model (by default always prompts
diff --git a/docs/cli/sandbox.md b/docs/cli/sandbox.md
index 09bb8f76d3..28b54851c2 100644
--- a/docs/cli/sandbox.md
+++ b/docs/cli/sandbox.md
@@ -11,7 +11,7 @@ Before using sandboxing, you need to install and set up the Gemini CLI:
 npm install -g @google/gemini-cli
 ```
 
-To verify the installation
+To verify the installation:
 
 ```bash
 gemini --version
diff --git a/docs/cli/telemetry.md b/docs/cli/telemetry.md
index df59b2fcff..40f234335d 100644
--- a/docs/cli/telemetry.md
+++ b/docs/cli/telemetry.md
@@ -224,11 +224,11 @@ visualize your telemetry.
 This dashboard can be found under **Google Cloud Monitoring Dashboard
 Templates** as "**Gemini CLI Monitoring**".
 
-![Gemini CLI Monitoring Dashboard Overview](../assets/monitoring-dashboard-overview.png)
+![Gemini CLI Monitoring Dashboard Overview](/docs/assets/monitoring-dashboard-overview.png)
 
-![Gemini CLI Monitoring Dashboard Metrics](../assets/monitoring-dashboard-metrics.png)
+![Gemini CLI Monitoring Dashboard Metrics](/docs/assets/monitoring-dashboard-metrics.png)
 
-![Gemini CLI Monitoring Dashboard Logs](../assets/monitoring-dashboard-logs.png)
+![Gemini CLI Monitoring Dashboard Logs](/docs/assets/monitoring-dashboard-logs.png)
 
 To learn more, check out this blog post:
 [Instant insights: Gemini CLI’s new pre-configured monitoring dashboards](https://cloud.google.com/blog/topics/developers-practitioners/instant-insights-gemini-clis-new-pre-configured-monitoring-dashboards/).
diff --git a/docs/extensions/getting-started-extensions.md b/docs/extensions/getting-started-extensions.md
index 8f174a2966..04e5987c85 100644
--- a/docs/extensions/getting-started-extensions.md
+++ b/docs/extensions/getting-started-extensions.md
@@ -222,9 +222,45 @@ need this for extensions built to expose commands and prompts.
 Restart the CLI again. The model will now have the context from your `GEMINI.md`
 file in every session where the extension is active.
 
-## Step 6: Releasing your extension
+## (Optional) Step 6: Add an Agent Skill
 
-Once you are happy with your extension, you can share it with others. The two
+_Note: This is an experimental feature enabled via `experimental.skills`._
+
+[Agent Skills](../cli/skills.md) let you bundle specialized expertise and
+procedural workflows. Unlike `GEMINI.md`, which provides persistent context,
+skills are activated only when needed, saving context tokens.
+
+1.  Create a `skills` directory and a subdirectory for your skill:
+
+    ```bash
+    mkdir -p skills/security-audit
+    ```
+
+2.  Create a `skills/security-audit/SKILL.md` file:
+
+    ```markdown
+    ---
+    name: security-audit
+    description:
+      Expertise in auditing code for security vulnerabilities. Use when the user
+      asks to "check for security issues" or "audit" their changes.
+    ---
+
+    # Security Auditor
+
+    You are an expert security researcher. When auditing code:
+
+    1. Look for common vulnerabilities (OWASP Top 10).
+    2. Check for hardcoded secrets or API keys.
+    3. Suggest remediation steps for any findings.
+    ```
+
+Skills bundled with your extension are automatically discovered and can be
+activated by the model during a session when it identifies a relevant task.
+
+## Step 7: Release your extension
+
+Once you're happy with your extension, you can share it with others. The two
 primary ways of releasing extensions are via a Git repository or through GitHub
 Releases. Using a public Git repository is the simplest method.
 
@@ -239,6 +275,7 @@ You've successfully created a Gemini CLI extension! You learned how to:
 - Add custom tools with an MCP server.
 - Create convenient custom commands.
 - Provide persistent context to the model.
+- Bundle specialized Agent Skills.
 - Link your extension for local development.
 
 From here, you can explore more advanced features and build powerful new
diff --git a/docs/extensions/index.md b/docs/extensions/index.md
index 25c24c7f21..8f71d1c184 100644
--- a/docs/extensions/index.md
+++ b/docs/extensions/index.md
@@ -2,10 +2,10 @@
 
 _This documentation is up-to-date with the v0.4.0 release._
 
-Gemini CLI extensions package prompts, MCP servers, and custom commands into a
-familiar and user-friendly format. With extensions, you can expand the
-capabilities of Gemini CLI and share those capabilities with others. They are
-designed to be easily installable and shareable.
+Gemini CLI extensions package prompts, MCP servers, Agent Skills, and custom
+commands into a familiar and user-friendly format. With extensions, you can
+expand the capabilities of Gemini CLI and share those capabilities with others.
+They're designed to be easily installable and shareable.
 
 To see examples of extensions, you can browse a gallery of
 [Gemini CLI extensions](https://geminicli.com/extensions/browse/).
@@ -263,6 +263,40 @@ Would provide these commands:
 - `/deploy` - Shows as `[gcp] Custom command from deploy.toml` in help
 - `/gcs:sync` - Shows as `[gcp] Custom command from sync.toml` in help
 
+### Agent Skills
+
+_Note: This is an experimental feature enabled via `experimental.skills`._
+
+Extensions can bundle [Agent Skills](../cli/skills.md) to provide on-demand
+expertise and specialized workflows. To include skills in your extension, place
+them in a `skills/` subdirectory within the extension directory. Each skill must
+follow the [Agent Skills structure](../cli/skills.md#folder-structure),
+including a `SKILL.md` file.
+
+**Example**
+
+An extension named `security-toolkit` with the following structure:
+
+```
+.gemini/extensions/security-toolkit/
+├── gemini-extension.json
+└── skills/
+    ├── audit/
+    │   ├── SKILL.md
+    │   └── scripts/
+    │       └── scan.py
+    └── hardening/
+        └── SKILL.md
+```
+
+Upon installation, these skills will be discovered by Gemini CLI and can be
+activated during a session when the model identifies a task matching their
+descriptions.
+
+Extension skills have the lowest precedence and will be overridden by user or
+workspace skills of the same name. They can be viewed and managed (enabled or
+disabled) using the [`/skills` command](../cli/skills.md#managing-skills).
+
 ### Hooks
 
 Extensions can provide [hooks](../hooks/index.md) to intercept and customize
diff --git a/docs/get-started/configuration.md b/docs/get-started/configuration.md
index d0ae56041c..de9c6db5e7 100644
--- a/docs/get-started/configuration.md
+++ b/docs/get-started/configuration.md
@@ -1346,6 +1346,10 @@ for that specific session.
     - `auto_edit`: Automatically approve edit tools (replace, write_file) while
       prompting for others
     - `yolo`: Automatically approve all tool calls (equivalent to `--yolo`)
+    - `plan`: Read-only mode for tool calls (requires experimental planning to
+      be enabled).
+      > **Note:** This mode is currently under development and not yet fully
+      > functional.
   - Cannot be used together with `--yolo`. Use `--approval-mode=yolo` instead of
     `--yolo` for the new unified approach.
   - Example: `gemini --approval-mode auto_edit`
diff --git a/docs/index.md b/docs/index.md
index 83e834818e..217fba8391 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -56,6 +56,8 @@ This documentation is organized into the following sections:
   commands with `/model`.
 - **[Sandbox](./cli/sandbox.md):** Isolate tool execution in a secure,
   containerized environment.
+- **[Agent Skills](./cli/skills.md):** (Experimental) Extend the CLI with
+  specialized expertise and procedural workflows.
 - **[Settings](./cli/settings.md):** Configure various aspects of the CLI's
   behavior and appearance with `/settings`.
 - **[Telemetry](./cli/telemetry.md):** Overview of telemetry in the CLI.
diff --git a/docs/local-development.md b/docs/local-development.md
index 11cbbae139..e194307eae 100644
--- a/docs/local-development.md
+++ b/docs/local-development.md
@@ -10,7 +10,7 @@ debug your code by instrumenting interesting events like model calls, tool
 scheduler, tool calls, etc.
 
 Dev traces are verbose and are specifically meant for understanding agent
-behaviour and debugging issues. They are disabled by default.
+behavior and debugging issues. They are disabled by default.
 
 To enable dev traces, set the `GEMINI_DEV_TRACING=true` environment variable
 when running Gemini CLI.
diff --git a/docs/tools/index.md b/docs/tools/index.md
index 68a7f5826a..0434046ac4 100644
--- a/docs/tools/index.md
+++ b/docs/tools/index.md
@@ -91,5 +91,8 @@ Additionally, these tools incorporate:
 
 - **[MCP servers](./mcp-server.md)**: MCP servers act as a bridge between the
   Gemini model and your local environment or other services like APIs.
+- **[Agent Skills](../cli/skills.md)**: (Experimental) On-demand expertise
+  packages that are activated via the `activate_skill` tool to provide
+  specialized guidance and resources.
 - **[Sandboxing](../cli/sandbox.md)**: Sandboxing isolates the model and its
   changes from your environment to reduce potential risk.
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index 2dea1c7212..515099934a 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -28,6 +28,16 @@ topics on:
     - **Organizational Users:** Contact your Google Cloud administrator to be
       added to your organization's Gemini Code Assist subscription.
 
+- **Error:
+  `Failed to login. Message: Your current account is not eligible... because it is not currently available in your location.`**
+  - **Cause:** Gemini CLI does not currently support your location. For a full
+    list of supported locations, see the following pages:
+    - Gemini Code Assist for individuals:
+      [Available locations](https://developers.google.com/gemini-code-assist/resources/available-locations#americas)
+    - Google AI Pro and Ultra where Gemini Code Assist (and Gemini CLI) is also
+      available:
+      [Available locations](https://developers.google.com/gemini-code-assist/resources/locations-pro-ultra)
+
 - **Error: `Failed to login. Message: Request contains an invalid argument`**
   - **Cause:** Users with Google Workspace accounts or Google Cloud accounts
     associated with their Gmail accounts may not be able to activate the free
@@ -137,7 +147,8 @@ This is especially useful for scripting and automation.
 
 - **Core debugging:**
   - Check the server console output for error messages or stack traces.
-  - Increase log verbosity if configurable.
+  - Increase log verbosity if configurable. For example, set the `DEBUG_MODE`
+    environment variable to `true` or `1`.
   - Use Node.js debugging tools (e.g., `node --inspect`) if you need to step
     through server-side code.
 
diff --git a/evals/README.md b/evals/README.md
index 891a9549f5..962f54886c 100644
--- a/evals/README.md
+++ b/evals/README.md
@@ -88,6 +88,13 @@ describe('my_feature', () => {
 
 ## Running Evaluations
 
+First, build the bundled Gemini CLI. You must do this after every code change.
+
+```bash
+npm run build
+npm run bundle
+```
+
 ### Always Passing Evals
 
 To run the evaluations that are expected to always pass (CI safe):
diff --git a/evals/subagents.eval.ts b/evals/subagents.eval.ts
new file mode 100644
index 0000000000..d0c77d4fe7
--- /dev/null
+++ b/evals/subagents.eval.ts
@@ -0,0 +1,64 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe } from 'vitest';
+import { evalTest } from './test-helper.js';
+
+const AGENT_DEFINITION = `---
+name: docs-agent
+description: An agent with expertise in updating documentation.
+tools:
+  - read_file
+  - write_file
+---
+
+You are the docs agent. Update the documentation.
+`;
+
+const INDEX_TS = 'export const add = (a: number, b: number) => a + b;';
+
+describe('subagent eval test cases', () => {
+  /**
+   * Checks whether the outer agent reliably utilizes an expert subagent to
+   * accomplish a task when one is available.
+   *
+   * Note that the test is intentionally crafted to avoid the word "document"
+   * or "docs". We want to see the outer agent make the connection even when
+   * the prompt indirectly implies need of expertise.
+   *
+   * This tests the system prompt's subagent specific clauses.
+   */
+  evalTest('ALWAYS_PASSES', {
+    name: 'should delegate to user provided agent with relevant expertise',
+    params: {
+      settings: {
+        experimental: {
+          enableAgents: true,
+        },
+      },
+    },
+    prompt: 'Please update README.md with a description of this library.',
+    files: {
+      '.gemini/agents/test-agent.md': AGENT_DEFINITION,
+      'index.ts': INDEX_TS,
+      'README.md': 'TODO: update the README.',
+    },
+    assert: async (rig, _result) => {
+      await rig.expectToolCallSuccess(
+        ['delegate_to_agent'],
+        undefined,
+        (args) => {
+          try {
+            const parsed = JSON.parse(args);
+            return parsed.agent_name === 'docs-agent';
+          } catch {
+            return false;
+          }
+        },
+      );
+    },
+  });
+});
diff --git a/evals/test-helper.ts b/evals/test-helper.ts
index 9801d2307b..7fc9589986 100644
--- a/evals/test-helper.ts
+++ b/evals/test-helper.ts
@@ -6,7 +6,10 @@
 
 import { it } from 'vitest';
 import fs from 'node:fs';
+import path from 'node:path';
+import { execSync } from 'node:child_process';
 import { TestRig } from '@google/gemini-cli-test-utils';
+import { createUnauthorizedToolError } from '@google/gemini-cli-core';
 
 export * from '@google/gemini-cli-test-utils';
 
@@ -32,8 +35,33 @@ export function evalTest(policy: EvalPolicy, evalCase: EvalCase) {
   const fn = async () => {
     const rig = new TestRig();
     try {
-      await rig.setup(evalCase.name, evalCase.params);
+      rig.setup(evalCase.name, evalCase.params);
+
+      if (evalCase.files) {
+        for (const [filePath, content] of Object.entries(evalCase.files)) {
+          const fullPath = path.join(rig.testDir!, filePath);
+          fs.mkdirSync(path.dirname(fullPath), { recursive: true });
+          fs.writeFileSync(fullPath, content);
+        }
+
+        const execOptions = { cwd: rig.testDir!, stdio: 'inherit' as const };
+        execSync('git init', execOptions);
+        execSync('git config user.email "test@example.com"', execOptions);
+        execSync('git config user.name "Test User"', execOptions);
+        execSync('git add .', execOptions);
+        execSync('git commit --allow-empty -m "Initial commit"', execOptions);
+      }
+
       const result = await rig.run({ args: evalCase.prompt });
+
+      const unauthorizedErrorPrefix =
+        createUnauthorizedToolError('').split("'")[0];
+      if (result.includes(unauthorizedErrorPrefix)) {
+        throw new Error(
+          'Test failed due to unauthorized tool call in output: ' + result,
+        );
+      }
+
       await evalCase.assert(rig, result);
     } finally {
       await logToFile(
@@ -44,7 +72,7 @@ export function evalTest(policy: EvalPolicy, evalCase: EvalCase) {
     }
   };
 
-  if (policy === 'USUALLY_PASSES' && !process.env.RUN_EVALS) {
+  if (policy === 'USUALLY_PASSES' && !process.env['RUN_EVALS']) {
     it.skip(evalCase.name, fn);
   } else {
     it(evalCase.name, fn);
@@ -55,6 +83,7 @@ export interface EvalCase {
   name: string;
   params?: Record<string, any>;
   prompt: string;
+  files?: Record<string, string>;
   assert: (rig: TestRig, result: string) => Promise<void>;
 }
 
diff --git a/integration-tests/simple-mcp-server.test.ts b/integration-tests/simple-mcp-server.test.ts
index 1de8007810..6db9927616 100644
--- a/integration-tests/simple-mcp-server.test.ts
+++ b/integration-tests/simple-mcp-server.test.ts
@@ -164,7 +164,7 @@ rpc.send({
 });
 `;
 
-describe('simple-mcp-server', () => {
+describe.skip('simple-mcp-server', () => {
   let rig: TestRig;
 
   beforeEach(() => {
diff --git a/package-lock.json b/package-lock.json
index 56b985c5e7..7d487301e1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.26.0-nightly.20260114.bb6c57414",
+  "version": "0.26.0-nightly.20260115.6cb3ae4e0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@google/gemini-cli",
-      "version": "0.26.0-nightly.20260114.bb6c57414",
+      "version": "0.26.0-nightly.20260115.6cb3ae4e0",
       "workspaces": [
         "packages/*"
       ],
@@ -2474,6 +2474,7 @@
       "integrity": "sha512-t54CUOsFMappY1Jbzb7fetWeO0n6K0k/4+/ZpkS+3Joz8I4VcvY9OiEBFRYISqaI2fq5sCiPtAjRDOzVYG8m+Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@octokit/auth-token": "^6.0.0",
         "@octokit/graphql": "^9.0.2",
@@ -2654,6 +2655,7 @@
       "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
       "integrity": "sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==",
       "license": "Apache-2.0",
+      "peer": true,
       "engines": {
         "node": ">=8.0.0"
       }
@@ -2687,6 +2689,7 @@
       "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.0.1.tgz",
       "integrity": "sha512-MaZk9SJIDgo1peKevlbhP6+IwIiNPNmswNL4AF0WaQJLbHXjr9SrZMgS12+iqr9ToV4ZVosCcc0f8Rg67LXjxw==",
       "license": "Apache-2.0",
+      "peer": true,
       "dependencies": {
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
@@ -3055,6 +3058,7 @@
       "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.0.1.tgz",
       "integrity": "sha512-dZOB3R6zvBwDKnHDTB4X1xtMArB/d324VsbiPkX/Yu0Q8T2xceRthoIVFhJdvgVM2QhGVUyX9tzwiNxGtoBJUw==",
       "license": "Apache-2.0",
+      "peer": true,
       "dependencies": {
         "@opentelemetry/core": "2.0.1",
         "@opentelemetry/semantic-conventions": "^1.29.0"
@@ -3088,6 +3092,7 @@
       "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.0.1.tgz",
       "integrity": "sha512-wf8OaJoSnujMAHWR3g+/hGvNcsC16rf9s1So4JlMiFaFHiE4HpIA3oUh+uWZQ7CNuK8gVW/pQSkgoa5HkkOl0g==",
       "license": "Apache-2.0",
+      "peer": true,
       "dependencies": {
         "@opentelemetry/core": "2.0.1",
         "@opentelemetry/resources": "2.0.1"
@@ -3140,6 +3145,7 @@
       "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.0.1.tgz",
       "integrity": "sha512-xYLlvk/xdScGx1aEqvxLwf6sXQLXCjk3/1SQT9X9AoN5rXRhkdvIFShuNNmtTEPRBqcsMbS4p/gJLNI2wXaDuQ==",
       "license": "Apache-2.0",
+      "peer": true,
       "dependencies": {
         "@opentelemetry/core": "2.0.1",
         "@opentelemetry/resources": "2.0.1",
@@ -4352,6 +4358,7 @@
       "integrity": "sha512-6mDvHUFSjyT2B2yeNx2nUgMxh9LtOWvkhIU3uePn2I2oyNymUAX1NIsdgviM4CH+JSrp2D2hsMvJOkxY+0wNRA==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "csstype": "^3.0.2"
       }
@@ -4629,6 +4636,7 @@
       "integrity": "sha512-6sMvZePQrnZH2/cJkwRpkT7DxoAWh+g6+GFRK6bV3YQo7ogi3SX5rgF6099r5Q53Ma5qeT7LGmOmuIutF4t3lA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.35.0",
         "@typescript-eslint/types": "8.35.0",
@@ -5633,6 +5641,7 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -6077,8 +6086,7 @@
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
       "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/array-includes": {
       "version": "3.1.9",
@@ -7362,7 +7370,6 @@
       "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
       "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "safe-buffer": "5.2.1"
       },
@@ -8682,6 +8689,7 @@
       "integrity": "sha512-GsGizj2Y1rCWDu6XoEekL3RLilp0voSePurjZIkxL3wlm5o5EC9VpgaP7lrCvjnkuLvzFBQWB3vWB3K5KQTveQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -9284,7 +9292,6 @@
       "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.1.tgz",
       "integrity": "sha512-6DnInpx7SJ2AK3+CTUE/ZM0vWTUboZCegxhC2xiIydHR9jNuTAASBrfEpHhiGOZw/nX51bHt6YQl8jsGo4y/0w==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -9294,7 +9301,6 @@
       "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
       "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "ms": "2.0.0"
       }
@@ -9304,7 +9310,6 @@
       "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz",
       "integrity": "sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -9558,7 +9563,6 @@
       "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.1.tgz",
       "integrity": "sha512-6BN9trH7bp3qvnrRyzsBz+g3lZxTNZTbVO2EV1CS0WIcDbawYVdYvGflME/9QP0h0pYlCDBCTjYa9nZzMDpyxQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "debug": "2.6.9",
         "encodeurl": "~2.0.0",
@@ -9577,7 +9581,6 @@
       "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
       "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "ms": "2.0.0"
       }
@@ -9586,15 +9589,13 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/finalhandler/node_modules/statuses": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz",
       "integrity": "sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -10877,6 +10878,7 @@
       "resolved": "https://registry.npmjs.org/@jrichman/ink/-/ink-6.4.7.tgz",
       "integrity": "sha512-QHyxhNF5VonF5cRmdAJD/UPucB9nRx3FozWMjQrDGfBxfAL9lpyu72/MlFPgloS1TMTGsOt7YN6dTPPA6mh0Aw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@alcalzone/ansi-tokenize": "^0.2.1",
         "ansi-escapes": "^7.0.0",
@@ -14061,8 +14063,7 @@
       "version": "0.1.12",
       "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz",
       "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==",
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/path-type": {
       "version": "3.0.0",
@@ -14639,6 +14640,7 @@
       "resolved": "https://registry.npmjs.org/react/-/react-19.2.0.tgz",
       "integrity": "sha512-tmbWg6W31tQLeB5cdIBOicJDJRR2KzXsV7uSK9iNfLWQ5bIZfxuPEHp7M8wiHyHnn0DD1i7w3Zmin0FtkrwoCQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -14649,6 +14651,7 @@
       "integrity": "sha512-ePrwPfxAnB+7hgnEr8vpKxL9cmnp7F322t8oqcPshbIQQhDKgFDW4tjhF2wjVbdXF9O/nyuy3sQWd9JGpiLPvA==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "shell-quote": "^1.6.1",
         "ws": "^7"
@@ -16908,6 +16911,7 @@
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -17131,7 +17135,8 @@
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
       "dev": true,
-      "license": "0BSD"
+      "license": "0BSD",
+      "peer": true
     },
     "node_modules/tsx": {
       "version": "4.20.3",
@@ -17139,6 +17144,7 @@
       "integrity": "sha512-qjbnuR9Tr+FJOMBqJCW5ehvIo/buZq7vH7qD7JziU98h6l3qGy0a/yPFjwO+y0/T7GFpNgNAvEcPPVfyT8rrPQ==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "esbuild": "~0.25.0",
         "get-tsconfig": "^4.7.5"
@@ -17322,6 +17328,7 @@
       "integrity": "sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ==",
       "devOptional": true,
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -17484,7 +17491,6 @@
       "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
       "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.4.0"
       }
@@ -17539,6 +17545,7 @@
       "resolved": "https://registry.npmjs.org/vite/-/vite-7.2.2.tgz",
       "integrity": "sha512-BxAKBWmIbrDgrokdGZH1IgkIk/5mMHDreLDmCJ0qpyJaAteP8NvMhkwr/ZCQNqNH97bw/dANTE9PDzqwJghfMQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.5.0",
@@ -17652,6 +17659,7 @@
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -17664,6 +17672,7 @@
       "resolved": "https://registry.npmjs.org/vitest/-/vitest-3.2.4.tgz",
       "integrity": "sha512-LUCP5ev3GURDysTWiP47wRRUpLKMOfPh+yKTx3kVIEiu5KOMeqzpnYNsKyOoVrULivR8tLcks4+lga33Whn90A==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/chai": "^5.2.2",
         "@vitest/expect": "3.2.4",
@@ -18368,6 +18377,7 @@
       "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
       "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
       "license": "MIT",
+      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
@@ -18383,7 +18393,7 @@
     },
     "packages/a2a-server": {
       "name": "@google/gemini-cli-a2a-server",
-      "version": "0.26.0-nightly.20260114.bb6c57414",
+      "version": "0.26.0-nightly.20260115.6cb3ae4e0",
       "dependencies": {
         "@a2a-js/sdk": "^0.3.7",
         "@google-cloud/storage": "^7.16.0",
@@ -18693,7 +18703,7 @@
     },
     "packages/cli": {
       "name": "@google/gemini-cli",
-      "version": "0.26.0-nightly.20260114.bb6c57414",
+      "version": "0.26.0-nightly.20260115.6cb3ae4e0",
       "license": "Apache-2.0",
       "dependencies": {
         "@agentclientprotocol/sdk": "^0.12.0",
@@ -18704,6 +18714,7 @@
         "@types/update-notifier": "^6.0.8",
         "ansi-regex": "^6.2.2",
         "clipboardy": "^5.0.0",
+        "color-convert": "^2.0.1",
         "command-exists": "^1.2.9",
         "comment-json": "^4.2.5",
         "diff": "^7.0.0",
@@ -18796,7 +18807,7 @@
     },
     "packages/core": {
       "name": "@google/gemini-cli-core",
-      "version": "0.26.0-nightly.20260114.bb6c57414",
+      "version": "0.26.0-nightly.20260115.6cb3ae4e0",
       "license": "Apache-2.0",
       "dependencies": {
         "@a2a-js/sdk": "^0.3.7",
@@ -18933,6 +18944,7 @@
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -18955,7 +18967,7 @@
     },
     "packages/test-utils": {
       "name": "@google/gemini-cli-test-utils",
-      "version": "0.26.0-nightly.20260114.bb6c57414",
+      "version": "0.26.0-nightly.20260115.6cb3ae4e0",
       "license": "Apache-2.0",
       "dependencies": {
         "@google/gemini-cli-core": "file:../core",
@@ -18972,7 +18984,7 @@
     },
     "packages/vscode-ide-companion": {
       "name": "gemini-cli-vscode-ide-companion",
-      "version": "0.26.0-nightly.20260114.bb6c57414",
+      "version": "0.26.0-nightly.20260115.6cb3ae4e0",
       "license": "LICENSE",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.23.0",
diff --git a/package.json b/package.json
index e4602937ba..3434bb8e49 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.26.0-nightly.20260114.bb6c57414",
+  "version": "0.26.0-nightly.20260115.6cb3ae4e0",
   "engines": {
     "node": ">=20.0.0"
   },
@@ -14,7 +14,7 @@
     "url": "git+https://github.com/google-gemini/gemini-cli.git"
   },
   "config": {
-    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.26.0-nightly.20260114.bb6c57414"
+    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.26.0-nightly.20260115.6cb3ae4e0"
   },
   "scripts": {
     "start": "cross-env NODE_ENV=development node scripts/start.js",
diff --git a/packages/a2a-server/package.json b/packages/a2a-server/package.json
index 91bca79c21..d8d42b3cc8 100644
--- a/packages/a2a-server/package.json
+++ b/packages/a2a-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-a2a-server",
-  "version": "0.26.0-nightly.20260114.bb6c57414",
+  "version": "0.26.0-nightly.20260115.6cb3ae4e0",
   "description": "Gemini CLI A2A Server",
   "repository": {
     "type": "git",
diff --git a/packages/a2a-server/src/http/app.test.ts b/packages/a2a-server/src/http/app.test.ts
index f427bdfe63..4eb6b522b2 100644
--- a/packages/a2a-server/src/http/app.test.ts
+++ b/packages/a2a-server/src/http/app.test.ts
@@ -14,7 +14,7 @@ import type {
   TaskStatusUpdateEvent,
   SendStreamingMessageSuccessResponse,
 } from '@a2a-js/sdk';
-import type express from 'express';
+import express from 'express';
 import type { Server } from 'node:http';
 import request from 'supertest';
 import {
@@ -27,7 +27,7 @@ import {
   it,
   vi,
 } from 'vitest';
-import { createApp } from './app.js';
+import { createApp, main } from './app.js';
 import { commandRegistry } from '../commands/command-registry.js';
 import {
   assertUniqueFinalEventIsLast,
@@ -1176,4 +1176,43 @@ describe('E2E Tests', () => {
       });
     });
   });
+
+  describe('main', () => {
+    it('should listen on localhost only', async () => {
+      const listenSpy = vi
+        .spyOn(express.application, 'listen')
+        .mockImplementation((...args: unknown[]) => {
+          // Trigger the callback passed to listen
+          const callback = args.find(
+            (arg): arg is () => void => typeof arg === 'function',
+          );
+          if (callback) {
+            callback();
+          }
+
+          return {
+            address: () => ({ port: 1234 }),
+            on: vi.fn(),
+            once: vi.fn(),
+            emit: vi.fn(),
+          } as unknown as Server;
+        });
+
+      // Avoid process.exit if possible, or mock it if main might fail
+      const exitSpy = vi
+        .spyOn(process, 'exit')
+        .mockImplementation(() => undefined as never);
+
+      await main();
+
+      expect(listenSpy).toHaveBeenCalledWith(
+        expect.any(Number),
+        'localhost',
+        expect.any(Function),
+      );
+
+      listenSpy.mockRestore();
+      exitSpy.mockRestore();
+    });
+  });
 });
diff --git a/packages/a2a-server/src/http/app.ts b/packages/a2a-server/src/http/app.ts
index 8d7be4f7a1..4b5763f00b 100644
--- a/packages/a2a-server/src/http/app.ts
+++ b/packages/a2a-server/src/http/app.ts
@@ -326,9 +326,9 @@ export async function createApp() {
 export async function main() {
   try {
     const expressApp = await createApp();
-    const port = process.env['CODER_AGENT_PORT'] || 0;
+    const port = Number(process.env['CODER_AGENT_PORT'] || 0);
 
-    const server = expressApp.listen(port, () => {
+    const server = expressApp.listen(port, 'localhost', () => {
       const address = server.address();
       let actualPort;
       if (process.env['CODER_AGENT_PORT']) {
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 2f8e5ec8c2..3007ecd5b0 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli",
-  "version": "0.26.0-nightly.20260114.bb6c57414",
+  "version": "0.26.0-nightly.20260115.6cb3ae4e0",
   "description": "Gemini CLI",
   "license": "Apache-2.0",
   "repository": {
@@ -26,7 +26,7 @@
     "dist"
   ],
   "config": {
-    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.26.0-nightly.20260114.bb6c57414"
+    "sandboxImageUri": "us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.26.0-nightly.20260115.6cb3ae4e0"
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "^0.12.0",
@@ -37,6 +37,7 @@
     "@types/update-notifier": "^6.0.8",
     "ansi-regex": "^6.2.2",
     "clipboardy": "^5.0.0",
+    "color-convert": "^2.0.1",
     "command-exists": "^1.2.9",
     "comment-json": "^4.2.5",
     "diff": "^7.0.0",
diff --git a/packages/cli/src/commands/hooks/migrate.ts b/packages/cli/src/commands/hooks/migrate.ts
index 36a1344f74..008997d4fe 100644
--- a/packages/cli/src/commands/hooks/migrate.ts
+++ b/packages/cli/src/commands/hooks/migrate.ts
@@ -230,8 +230,7 @@ export async function handleMigrateFromClaude() {
   const settings = loadSettings(workingDir);
 
   // Merge migrated hooks with existing hooks
-  const existingHooks =
-    (settings.merged.hooks as Record<string, unknown>) || {};
+  const existingHooks = settings.merged.hooks as Record<string, unknown>;
   const mergedHooks = { ...existingHooks, ...migratedHooks };
 
   // Update settings (setValue automatically saves)
diff --git a/packages/cli/src/commands/mcp/list.test.ts b/packages/cli/src/commands/mcp/list.test.ts
index 7d78d48233..fed9fb6a5c 100644
--- a/packages/cli/src/commands/mcp/list.test.ts
+++ b/packages/cli/src/commands/mcp/list.test.ts
@@ -6,15 +6,20 @@
 
 import { vi, describe, it, expect, beforeEach, type Mock } from 'vitest';
 import { listMcpServers } from './list.js';
-import { loadSettings } from '../../config/settings.js';
+import { loadSettings, mergeSettings } from '../../config/settings.js';
 import { createTransport, debugLogger } from '@google/gemini-cli-core';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { ExtensionStorage } from '../../config/extensions/storage.js';
 import { ExtensionManager } from '../../config/extension-manager.js';
 
-vi.mock('../../config/settings.js', () => ({
-  loadSettings: vi.fn(),
-}));
+vi.mock('../../config/settings.js', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('../../config/settings.js')>();
+  return {
+    ...actual,
+    loadSettings: vi.fn(),
+  };
+});
 vi.mock('../../config/extensions/storage.js', () => ({
   ExtensionStorage: {
     getUserExtensionsDir: vi.fn(),
@@ -32,11 +37,16 @@ vi.mock('@google/gemini-cli-core', async (importOriginal) => {
       CONNECTING: 'CONNECTING',
       DISCONNECTED: 'DISCONNECTED',
     },
-    Storage: vi.fn().mockImplementation((_cwd: string) => ({
-      getGlobalSettingsPath: () => '/tmp/gemini/settings.json',
-      getWorkspaceSettingsPath: () => '/tmp/gemini/workspace-settings.json',
-      getProjectTempDir: () => '/test/home/.gemini/tmp/mocked_hash',
-    })),
+    Storage: Object.assign(
+      vi.fn().mockImplementation((_cwd: string) => ({
+        getGlobalSettingsPath: () => '/tmp/gemini/settings.json',
+        getWorkspaceSettingsPath: () => '/tmp/gemini/workspace-settings.json',
+        getProjectTempDir: () => '/test/home/.gemini/tmp/mocked_hash',
+      })),
+      {
+        getGlobalSettingsPath: () => '/tmp/gemini/settings.json',
+      },
+    ),
     GEMINI_DIR: '.gemini',
     getErrorMessage: (e: unknown) =>
       e instanceof Error ? e.message : String(e),
@@ -96,7 +106,10 @@ describe('mcp list command', () => {
   });
 
   it('should display message when no servers configured', async () => {
-    mockedLoadSettings.mockReturnValue({ merged: { mcpServers: {} } });
+    const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
+    mockedLoadSettings.mockReturnValue({
+      merged: { ...defaultMergedSettings, mcpServers: {} },
+    });
 
     await listMcpServers();
 
@@ -104,8 +117,10 @@ describe('mcp list command', () => {
   });
 
   it('should display different server types with connected status', async () => {
+    const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
     mockedLoadSettings.mockReturnValue({
       merged: {
+        ...defaultMergedSettings,
         mcpServers: {
           'stdio-server': { command: '/path/to/server', args: ['arg1'] },
           'sse-server': { url: 'https://example.com/sse' },
@@ -138,8 +153,10 @@ describe('mcp list command', () => {
   });
 
   it('should display disconnected status when connection fails', async () => {
+    const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
     mockedLoadSettings.mockReturnValue({
       merged: {
+        ...defaultMergedSettings,
         mcpServers: {
           'test-server': { command: '/test/server' },
         },
@@ -158,9 +175,13 @@ describe('mcp list command', () => {
   });
 
   it('should merge extension servers with config servers', async () => {
+    const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
     mockedLoadSettings.mockReturnValue({
       merged: {
-        mcpServers: { 'config-server': { command: '/config/server' } },
+        ...defaultMergedSettings,
+        mcpServers: {
+          'config-server': { command: '/config/server' },
+        },
       },
     });
 
diff --git a/packages/cli/src/commands/mcp/list.ts b/packages/cli/src/commands/mcp/list.ts
index b41baec960..27a25fec4a 100644
--- a/packages/cli/src/commands/mcp/list.ts
+++ b/packages/cli/src/commands/mcp/list.ts
@@ -35,7 +35,7 @@ async function getMcpServersFromConfig(): Promise<
     requestSetting: promptForSetting,
   });
   const extensions = await extensionManager.loadExtensions();
-  const mcpServers = { ...(settings.merged.mcpServers || {}) };
+  const mcpServers = { ...settings.merged.mcpServers };
   for (const extension of extensions) {
     Object.entries(extension.mcpServers || {}).forEach(([key, server]) => {
       if (mcpServers[key]) {
@@ -63,8 +63,7 @@ async function testMCPConnection(
   const sanitizationConfig = {
     enableEnvironmentVariableRedaction: true,
     allowedEnvironmentVariables: [],
-    blockedEnvironmentVariables:
-      settings.merged.advanced?.excludedEnvVars || [],
+    blockedEnvironmentVariables: settings.merged.advanced.excludedEnvVars,
   };
 
   let transport;
diff --git a/packages/cli/src/config/config.integration.test.ts b/packages/cli/src/config/config.integration.test.ts
index 49afb1ae5b..6797be4447 100644
--- a/packages/cli/src/config/config.integration.test.ts
+++ b/packages/cli/src/config/config.integration.test.ts
@@ -22,8 +22,9 @@ import {
   Config,
   DEFAULT_FILE_FILTERING_OPTIONS,
 } from '@google/gemini-cli-core';
-import type { Settings } from './settingsSchema.js';
+import { createTestMergedSettings } from './settings.js';
 import { http, HttpResponse } from 'msw';
+
 import { setupServer } from 'msw/node';
 
 export const server = setupServer();
@@ -212,7 +213,7 @@ describe('Configuration Integration Tests', () => {
       const originalArgv = process.argv;
       try {
         process.argv = argv;
-        const parsedArgs = await parseArguments({} as Settings);
+        const parsedArgs = await parseArguments(createTestMergedSettings());
         expect(parsedArgs.approvalMode).toBe(expected.approvalMode);
         expect(parsedArgs.prompt).toBe(expected.prompt);
         expect(parsedArgs.yolo).toBe(expected.yolo);
@@ -235,7 +236,9 @@ describe('Configuration Integration Tests', () => {
       const originalArgv = process.argv;
       try {
         process.argv = argv;
-        await expect(parseArguments({} as Settings)).rejects.toThrow();
+        await expect(
+          parseArguments(createTestMergedSettings()),
+        ).rejects.toThrow();
       } finally {
         process.argv = originalArgv;
       }
diff --git a/packages/cli/src/config/config.test.ts b/packages/cli/src/config/config.test.ts
index 78a4847fd2..59d1f4d906 100644
--- a/packages/cli/src/config/config.test.ts
+++ b/packages/cli/src/config/config.test.ts
@@ -19,8 +19,9 @@ import {
   ApprovalMode,
 } from '@google/gemini-cli-core';
 import { loadCliConfig, parseArguments, type CliArgs } from './config.js';
-import type { Settings } from './settings.js';
+import { type Settings, createTestMergedSettings } from './settings.js';
 import * as ServerConfig from '@google/gemini-cli-core';
+
 import { isWorkspaceTrusted } from './trustedFolders.js';
 import { ExtensionManager } from './extension-manager.js';
 import { RESUME_LATEST } from '../utils/sessionUtils.js';
@@ -189,7 +190,7 @@ describe('parseArguments', () => {
         .spyOn(console, 'error')
         .mockImplementation(() => {});
 
-      await expect(parseArguments({} as Settings)).rejects.toThrow(
+      await expect(parseArguments(createTestMergedSettings())).rejects.toThrow(
         'process.exit called',
       );
 
@@ -222,7 +223,7 @@ describe('parseArguments', () => {
     },
   ])('$description', async ({ argv, expected }) => {
     process.argv = argv;
-    const parsedArgs = await parseArguments({} as Settings);
+    const parsedArgs = await parseArguments(createTestMergedSettings());
     expect(parsedArgs.prompt).toBe(expected.prompt);
     expect(parsedArgs.promptInteractive).toBe(expected.promptInteractive);
   });
@@ -344,7 +345,7 @@ describe('parseArguments', () => {
       '$description',
       async ({ argv, expectedQuery, expectedModel, debug }) => {
         process.argv = argv;
-        const parsedArgs = await parseArguments({} as Settings);
+        const parsedArgs = await parseArguments(createTestMergedSettings());
         expect(parsedArgs.query).toBe(expectedQuery);
         expect(parsedArgs.prompt).toBe(expectedQuery);
         expect(parsedArgs.promptInteractive).toBeUndefined();
@@ -380,7 +381,7 @@ describe('parseArguments', () => {
         .spyOn(console, 'error')
         .mockImplementation(() => {});
 
-      await expect(parseArguments({} as Settings)).rejects.toThrow(
+      await expect(parseArguments(createTestMergedSettings())).rejects.toThrow(
         'process.exit called',
       );
 
@@ -408,7 +409,7 @@ describe('parseArguments', () => {
     },
   ])('$description', async ({ argv, expected }) => {
     process.argv = argv;
-    const parsedArgs = await parseArguments({} as Settings);
+    const parsedArgs = await parseArguments(createTestMergedSettings());
     expect(parsedArgs.approvalMode).toBe(expected.approvalMode);
     expect(parsedArgs.yolo).toBe(expected.yolo);
   });
@@ -427,7 +428,7 @@ describe('parseArguments', () => {
       .spyOn(debugLogger, 'error')
       .mockImplementation(() => {});
 
-    await expect(parseArguments({} as Settings)).rejects.toThrow(
+    await expect(parseArguments(createTestMergedSettings())).rejects.toThrow(
       'process.exit called',
     );
 
@@ -447,7 +448,7 @@ describe('parseArguments', () => {
     process.argv = ['node', 'script.js', '--resume', 'session-id'];
 
     try {
-      const argv = await parseArguments({} as Settings);
+      const argv = await parseArguments(createTestMergedSettings());
       expect(argv.resume).toBe('session-id');
     } finally {
       process.stdin.isTTY = originalIsTTY;
@@ -460,7 +461,7 @@ describe('parseArguments', () => {
     process.argv = ['node', 'script.js', '--resume'];
 
     try {
-      const argv = await parseArguments({} as Settings);
+      const argv = await parseArguments(createTestMergedSettings());
       expect(argv.resume).toBe(RESUME_LATEST);
       expect(argv.resume).toBe('latest');
     } finally {
@@ -475,7 +476,7 @@ describe('parseArguments', () => {
       '--allowed-tools',
       'read_file,ShellTool(git status)',
     ];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     expect(argv.allowedTools).toEqual(['read_file', 'ShellTool(git status)']);
   });
 
@@ -486,13 +487,13 @@ describe('parseArguments', () => {
       '--allowed-mcp-server-names',
       'server1,server2',
     ];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     expect(argv.allowedMcpServerNames).toEqual(['server1', 'server2']);
   });
 
   it('should support comma-separated values for --extensions', async () => {
     process.argv = ['node', 'script.js', '--extensions', 'ext1,ext2'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     expect(argv.extensions).toEqual(['ext1', 'ext2']);
   });
 
@@ -504,7 +505,7 @@ describe('parseArguments', () => {
       'test-model-string',
       'my-positional-arg',
     ];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     expect(argv.model).toBe('test-model-string');
     expect(argv.query).toBe('my-positional-arg');
   });
@@ -521,7 +522,7 @@ describe('parseArguments', () => {
       '--allowed-tools=ShellTool(wc)',
       'Use whoami to write a poem in file poem.md about my username in pig latin and use wc to tell me how many lines are in the poem you wrote.',
     ];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     expect(argv.extensions).toEqual(['none']);
     expect(argv.approvalMode).toBe('auto_edit');
     expect(argv.allowedTools).toEqual([
@@ -576,8 +577,8 @@ describe('loadCliConfig', () => {
 
     it(`should leave proxy to empty by default`, async () => {
       process.argv = ['node', 'script.js'];
-      const argv = await parseArguments({} as Settings);
-      const settings: Settings = {};
+      const argv = await parseArguments(createTestMergedSettings());
+      const settings = createTestMergedSettings();
       const config = await loadCliConfig(settings, 'test-session', argv);
       expect(config.getProxy()).toBeFalsy();
     });
@@ -617,8 +618,8 @@ describe('loadCliConfig', () => {
       it(`should set proxy to ${expected} according to environment variable [${input.env_name}]`, async () => {
         vi.stubEnv(input.env_name, input.proxy_url);
         process.argv = ['node', 'script.js'];
-        const argv = await parseArguments({} as Settings);
-        const settings: Settings = {};
+        const argv = await parseArguments(createTestMergedSettings());
+        const settings = createTestMergedSettings();
         const config = await loadCliConfig(settings, 'test-session', argv);
         expect(config.getProxy()).toBe(expected);
       });
@@ -627,8 +628,8 @@ describe('loadCliConfig', () => {
 
   it('should use default fileFilter options when unconfigured', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {};
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings();
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getFileFilteringRespectGitIgnore()).toBe(
       DEFAULT_FILE_FILTERING_OPTIONS.respectGitIgnore,
@@ -653,7 +654,7 @@ describe('Hierarchical Memory Loading (config.ts) - Placeholder Suite', () => {
 
   it('should pass extension context file paths to loadServerHierarchicalMemory', async () => {
     process.argv = ['node', 'script.js'];
-    const settings: Settings = {};
+    const settings = createTestMergedSettings();
     vi.spyOn(ExtensionManager.prototype, 'getExtensions').mockReturnValue([
       {
         path: '/path/to/ext1',
@@ -683,7 +684,7 @@ describe('Hierarchical Memory Loading (config.ts) - Placeholder Suite', () => {
         isActive: true,
       },
     ]);
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     await loadCliConfig(settings, 'session-id', argv);
     expect(ServerConfig.loadServerHierarchicalMemory).toHaveBeenCalledWith(
       expect.any(String),
@@ -693,24 +694,24 @@ describe('Hierarchical Memory Loading (config.ts) - Placeholder Suite', () => {
       expect.any(ExtensionManager),
       true,
       'tree',
-      {
-        respectGitIgnore: false,
+      expect.objectContaining({
+        respectGitIgnore: true,
         respectGeminiIgnore: true,
-      },
-      undefined, // maxDirs
+      }),
+      200, // maxDirs
     );
   });
 });
 
 describe('mergeMcpServers', () => {
   it('should not modify the original settings object', async () => {
-    const settings: Settings = {
+    const settings = createTestMergedSettings({
       mcpServers: {
         'test-server': {
           url: 'http://localhost:8080',
         },
       },
-    };
+    });
 
     vi.spyOn(ExtensionManager.prototype, 'getExtensions').mockReturnValue([
       {
@@ -730,7 +731,7 @@ describe('mergeMcpServers', () => {
     ]);
     const originalSettings = JSON.parse(JSON.stringify(settings));
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     await loadCliConfig(settings, 'test-session', argv);
     expect(settings).toEqual(originalSettings);
   });
@@ -755,7 +756,9 @@ describe('mergeExcludeTools', () => {
   });
 
   it('should merge excludeTools from settings and extensions', async () => {
-    const settings: Settings = { tools: { exclude: ['tool1', 'tool2'] } };
+    const settings = createTestMergedSettings({
+      tools: { exclude: ['tool1', 'tool2'] },
+    });
     vi.spyOn(ExtensionManager.prototype, 'getExtensions').mockReturnValue([
       {
         path: '/path/to/ext1',
@@ -777,7 +780,7 @@ describe('mergeExcludeTools', () => {
       },
     ]);
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(
       settings,
 
@@ -791,7 +794,9 @@ describe('mergeExcludeTools', () => {
   });
 
   it('should handle overlapping excludeTools between settings and extensions', async () => {
-    const settings: Settings = { tools: { exclude: ['tool1', 'tool2'] } };
+    const settings = createTestMergedSettings({
+      tools: { exclude: ['tool1', 'tool2'] },
+    });
     vi.spyOn(ExtensionManager.prototype, 'getExtensions').mockReturnValue([
       {
         path: '/path/to/ext1',
@@ -804,7 +809,7 @@ describe('mergeExcludeTools', () => {
       },
     ]);
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getExcludeTools()).toEqual(
       new Set(['tool1', 'tool2', 'tool3']),
@@ -813,7 +818,9 @@ describe('mergeExcludeTools', () => {
   });
 
   it('should handle overlapping excludeTools between extensions', async () => {
-    const settings: Settings = { tools: { exclude: ['tool1'] } };
+    const settings = createTestMergedSettings({
+      tools: { exclude: ['tool1'] },
+    });
     vi.spyOn(ExtensionManager.prototype, 'getExtensions').mockReturnValue([
       {
         path: '/path/to/ext1',
@@ -835,7 +842,7 @@ describe('mergeExcludeTools', () => {
       },
     ]);
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getExcludeTools()).toEqual(
       new Set(['tool1', 'tool2', 'tool3', 'tool4']),
@@ -845,26 +852,28 @@ describe('mergeExcludeTools', () => {
 
   it('should return an empty array when no excludeTools are specified and it is interactive', async () => {
     process.stdin.isTTY = true;
-    const settings: Settings = {};
+    const settings = createTestMergedSettings();
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getExcludeTools()).toEqual(new Set([]));
   });
 
   it('should return default excludes when no excludeTools are specified and it is not interactive', async () => {
     process.stdin.isTTY = false;
-    const settings: Settings = {};
+    const settings = createTestMergedSettings();
     process.argv = ['node', 'script.js', '-p', 'test'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getExcludeTools()).toEqual(defaultExcludes);
   });
 
   it('should handle settings with excludeTools but no extensions', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = { tools: { exclude: ['tool1', 'tool2'] } };
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
+      tools: { exclude: ['tool1', 'tool2'] },
+    });
     vi.spyOn(ExtensionManager.prototype, 'getExtensions').mockReturnValue([]);
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getExcludeTools()).toEqual(new Set(['tool1', 'tool2']));
@@ -872,7 +881,7 @@ describe('mergeExcludeTools', () => {
   });
 
   it('should handle extensions with excludeTools but no settings', async () => {
-    const settings: Settings = {};
+    const settings = createTestMergedSettings();
     vi.spyOn(ExtensionManager.prototype, 'getExtensions').mockReturnValue([
       {
         path: '/path/to/ext',
@@ -885,14 +894,16 @@ describe('mergeExcludeTools', () => {
       },
     ]);
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getExcludeTools()).toEqual(new Set(['tool1', 'tool2']));
     expect(config.getExcludeTools()).toHaveLength(2);
   });
 
   it('should not modify the original settings object', async () => {
-    const settings: Settings = { tools: { exclude: ['tool1'] } };
+    const settings = createTestMergedSettings({
+      tools: { exclude: ['tool1'] },
+    });
     vi.spyOn(ExtensionManager.prototype, 'getExtensions').mockReturnValue([
       {
         path: '/path/to/ext',
@@ -906,7 +917,7 @@ describe('mergeExcludeTools', () => {
     ]);
     const originalSettings = JSON.parse(JSON.stringify(settings));
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     await loadCliConfig(settings, 'test-session', argv);
     expect(settings).toEqual(originalSettings);
   });
@@ -930,8 +941,8 @@ describe('Approval mode tool exclusion logic', () => {
 
   it('should exclude all interactive tools in non-interactive mode with default approval mode', async () => {
     process.argv = ['node', 'script.js', '-p', 'test'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {};
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings();
     const config = await loadCliConfig(settings, 'test-session', argv);
 
     const excludedTools = config.getExcludeTools();
@@ -949,8 +960,8 @@ describe('Approval mode tool exclusion logic', () => {
       '-p',
       'test',
     ];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {};
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings();
 
     const config = await loadCliConfig(settings, 'test-session', argv);
 
@@ -969,8 +980,8 @@ describe('Approval mode tool exclusion logic', () => {
       '-p',
       'test',
     ];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {};
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings();
 
     const config = await loadCliConfig(settings, 'test-session', argv);
 
@@ -989,8 +1000,8 @@ describe('Approval mode tool exclusion logic', () => {
       '-p',
       'test',
     ];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {};
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings();
 
     const config = await loadCliConfig(settings, 'test-session', argv);
 
@@ -1000,10 +1011,34 @@ describe('Approval mode tool exclusion logic', () => {
     expect(excludedTools).not.toContain(WRITE_FILE_TOOL_NAME);
   });
 
+  it('should exclude all interactive tools in non-interactive mode with plan approval mode', async () => {
+    process.argv = [
+      'node',
+      'script.js',
+      '--approval-mode',
+      'plan',
+      '-p',
+      'test',
+    ];
+    const settings = createTestMergedSettings({
+      experimental: {
+        plan: true,
+      },
+    });
+    const argv = await parseArguments(createTestMergedSettings());
+
+    const config = await loadCliConfig(settings, 'test-session', argv);
+
+    const excludedTools = config.getExcludeTools();
+    expect(excludedTools).toContain(SHELL_TOOL_NAME);
+    expect(excludedTools).toContain(EDIT_TOOL_NAME);
+    expect(excludedTools).toContain(WRITE_FILE_TOOL_NAME);
+  });
+
   it('should exclude no interactive tools in non-interactive mode with legacy yolo flag', async () => {
     process.argv = ['node', 'script.js', '--yolo', '-p', 'test'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {};
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings();
 
     const config = await loadCliConfig(settings, 'test-session', argv);
 
@@ -1026,8 +1061,8 @@ describe('Approval mode tool exclusion logic', () => {
 
     for (const testCase of testCases) {
       process.argv = testCase.args;
-      const argv = await parseArguments({} as Settings);
-      const settings: Settings = {};
+      const argv = await parseArguments(createTestMergedSettings());
+      const settings = createTestMergedSettings();
 
       const config = await loadCliConfig(settings, 'test-session', argv);
 
@@ -1047,8 +1082,10 @@ describe('Approval mode tool exclusion logic', () => {
       '-p',
       'test',
     ];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = { tools: { exclude: ['custom_tool'] } };
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
+      tools: { exclude: ['custom_tool'] },
+    });
 
     const config = await loadCliConfig(settings, 'test-session', argv);
 
@@ -1061,12 +1098,12 @@ describe('Approval mode tool exclusion logic', () => {
 
   it('should throw an error if YOLO mode is attempted when disableYoloMode is true', async () => {
     process.argv = ['node', 'script.js', '--yolo'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       security: {
         disableYoloMode: true,
       },
-    };
+    });
 
     await expect(loadCliConfig(settings, 'test-session', argv)).rejects.toThrow(
       'Cannot start in YOLO mode since it is disabled by your admin',
@@ -1082,11 +1119,11 @@ describe('Approval mode tool exclusion logic', () => {
       yolo: false,
     };
 
-    const settings: Settings = {};
+    const settings = createTestMergedSettings();
     await expect(
       loadCliConfig(settings, 'test-session', invalidArgv as CliArgs),
     ).rejects.toThrow(
-      'Invalid approval mode: invalid_mode. Valid values are: yolo, auto_edit, default',
+      'Invalid approval mode: invalid_mode. Valid values are: yolo, auto_edit, plan, default',
     );
   });
 });
@@ -1104,17 +1141,17 @@ describe('loadCliConfig with allowed-mcp-server-names', () => {
     vi.restoreAllMocks();
   });
 
-  const baseSettings: Settings = {
+  const baseSettings = createTestMergedSettings({
     mcpServers: {
       server1: { url: 'http://localhost:8080' },
       server2: { url: 'http://localhost:8081' },
       server3: { url: 'http://localhost:8082' },
     },
-  };
+  });
 
   it('should allow all MCP servers if the flag is not provided', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(baseSettings, 'test-session', argv);
     expect(config.getMcpServers()).toEqual(baseSettings.mcpServers);
   });
@@ -1126,7 +1163,7 @@ describe('loadCliConfig with allowed-mcp-server-names', () => {
       '--allowed-mcp-server-names',
       'server1',
     ];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(baseSettings, 'test-session', argv);
     expect(config.getAllowedMcpServers()).toEqual(['server1']);
   });
@@ -1140,7 +1177,7 @@ describe('loadCliConfig with allowed-mcp-server-names', () => {
       '--allowed-mcp-server-names',
       'server3',
     ];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(baseSettings, 'test-session', argv);
     expect(config.getAllowedMcpServers()).toEqual(['server1', 'server3']);
   });
@@ -1154,50 +1191,50 @@ describe('loadCliConfig with allowed-mcp-server-names', () => {
       '--allowed-mcp-server-names',
       'server4',
     ];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(baseSettings, 'test-session', argv);
     expect(config.getAllowedMcpServers()).toEqual(['server1', 'server4']);
   });
 
   it('should allow no MCP servers if the flag is provided but empty', async () => {
     process.argv = ['node', 'script.js', '--allowed-mcp-server-names', ''];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(baseSettings, 'test-session', argv);
     expect(config.getAllowedMcpServers()).toEqual(['']);
   });
 
   it('should read allowMCPServers from settings', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       ...baseSettings,
       mcp: { allowed: ['server1', 'server2'] },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getAllowedMcpServers()).toEqual(['server1', 'server2']);
   });
 
   it('should read excludeMCPServers from settings', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       ...baseSettings,
       mcp: { excluded: ['server1', 'server2'] },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getBlockedMcpServers()).toEqual(['server1', 'server2']);
   });
 
   it('should override allowMCPServers with excludeMCPServers if overlapping', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       ...baseSettings,
       mcp: {
         excluded: ['server1'],
         allowed: ['server1', 'server2'],
       },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getAllowedMcpServers()).toEqual(['server1', 'server2']);
     expect(config.getBlockedMcpServers()).toEqual(['server1']);
@@ -1210,14 +1247,14 @@ describe('loadCliConfig with allowed-mcp-server-names', () => {
       '--allowed-mcp-server-names',
       'server1',
     ];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       ...baseSettings,
       mcp: {
         excluded: ['server1'],
         allowed: ['server2'],
       },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getAllowedMcpServers()).toEqual(['server1']);
   });
@@ -1231,14 +1268,14 @@ describe('loadCliConfig with allowed-mcp-server-names', () => {
       '--allowed-mcp-server-names',
       'server3',
     ];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       ...baseSettings,
       mcp: {
         allowed: ['server1', 'server2'], // Should be ignored
         excluded: ['server3'], // Should be ignored
       },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getAllowedMcpServers()).toEqual(['server2', 'server3']);
     expect(config.getBlockedMcpServers()).toEqual([]);
@@ -1256,13 +1293,13 @@ describe('loadCliConfig model selection', () => {
 
   it('selects a model from settings.json if provided', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(
-      {
+      createTestMergedSettings({
         model: {
           name: 'gemini-2.5-pro',
         },
-      },
+      }),
       'test-session',
       argv,
     );
@@ -1272,11 +1309,11 @@ describe('loadCliConfig model selection', () => {
 
   it('uses the default gemini model if nothing is set', async () => {
     process.argv = ['node', 'script.js']; // No model set.
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(
-      {
+      createTestMergedSettings({
         // No model set.
-      },
+      }),
       'test-session',
       argv,
     );
@@ -1286,13 +1323,13 @@ describe('loadCliConfig model selection', () => {
 
   it('always prefers model from argv', async () => {
     process.argv = ['node', 'script.js', '--model', 'gemini-2.5-flash-preview'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(
-      {
+      createTestMergedSettings({
         model: {
           name: 'gemini-2.5-pro',
         },
-      },
+      }),
       'test-session',
       argv,
     );
@@ -1302,11 +1339,11 @@ describe('loadCliConfig model selection', () => {
 
   it('selects the model from argv if provided', async () => {
     process.argv = ['node', 'script.js', '--model', 'gemini-2.5-flash-preview'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(
-      {
+      createTestMergedSettings({
         // No model provided via settings.
-      },
+      }),
       'test-session',
       argv,
     );
@@ -1316,11 +1353,11 @@ describe('loadCliConfig model selection', () => {
 
   it('selects the default auto model if provided via auto alias', async () => {
     process.argv = ['node', 'script.js', '--model', 'auto'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(
-      {
+      createTestMergedSettings({
         // No model provided via settings.
-      },
+      }),
       'test-session',
       argv,
     );
@@ -1344,36 +1381,36 @@ describe('loadCliConfig folderTrust', () => {
 
   it('should be false when folderTrust is false', async () => {
     process.argv = ['node', 'script.js'];
-    const settings: Settings = {
+    const settings = createTestMergedSettings({
       security: {
         folderTrust: {
           enabled: false,
         },
       },
-    };
-    const argv = await parseArguments({} as Settings);
+    });
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getFolderTrust()).toBe(false);
   });
 
   it('should be true when folderTrust is true', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       security: {
         folderTrust: {
           enabled: true,
         },
       },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getFolderTrust()).toBe(true);
   });
 
   it('should be false by default', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {};
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings();
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getFolderTrust()).toBe(false);
   });
@@ -1404,8 +1441,8 @@ describe('loadCliConfig with includeDirectories', () => {
       '--include-directories',
       `${path.resolve(path.sep, 'cli', 'path1')},${path.join(mockCwd, 'cli', 'path2')}`,
     ];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       context: {
         includeDirectories: [
           path.resolve(path.sep, 'settings', 'path1'),
@@ -1413,7 +1450,7 @@ describe('loadCliConfig with includeDirectories', () => {
           path.join(mockCwd, 'settings', 'path3'),
         ],
       },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     const expected = [
       mockCwd,
@@ -1449,22 +1486,22 @@ describe('loadCliConfig compressionThreshold', () => {
 
   it('should pass settings to the core config', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       model: {
         compressionThreshold: 0.5,
       },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(await config.getCompressionThreshold()).toBe(0.5);
   });
 
-  it('should have undefined compressionThreshold if not in settings', async () => {
+  it('should have default compressionThreshold if not in settings', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {};
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings();
     const config = await loadCliConfig(settings, 'test-session', argv);
-    expect(await config.getCompressionThreshold()).toBeUndefined();
+    expect(await config.getCompressionThreshold()).toBe(0.5);
   });
 });
 
@@ -1483,24 +1520,24 @@ describe('loadCliConfig useRipgrep', () => {
 
   it('should be true by default when useRipgrep is not set in settings', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {};
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings();
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getUseRipgrep()).toBe(true);
   });
 
   it('should be false when useRipgrep is set to false in settings', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = { tools: { useRipgrep: false } };
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({ tools: { useRipgrep: false } });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getUseRipgrep()).toBe(false);
   });
 
   it('should be true when useRipgrep is explicitly set to true in settings', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = { tools: { useRipgrep: true } };
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({ tools: { useRipgrep: true } });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getUseRipgrep()).toBe(true);
   });
@@ -1521,38 +1558,38 @@ describe('screenReader configuration', () => {
 
   it('should use screenReader value from settings if CLI flag is not present (settings true)', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       ui: { accessibility: { screenReader: true } },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getScreenReader()).toBe(true);
   });
 
   it('should use screenReader value from settings if CLI flag is not present (settings false)', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       ui: { accessibility: { screenReader: false } },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getScreenReader()).toBe(false);
   });
 
   it('should prioritize --screen-reader CLI flag (true) over settings (false)', async () => {
     process.argv = ['node', 'script.js', '--screen-reader'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       ui: { accessibility: { screenReader: false } },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getScreenReader()).toBe(true);
   });
 
   it('should be false by default when no flag or setting is present', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {};
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings();
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getScreenReader()).toBe(false);
   });
@@ -1582,8 +1619,12 @@ describe('loadCliConfig tool exclusions', () => {
   it('should not exclude interactive tools in interactive mode without YOLO', async () => {
     process.stdin.isTTY = true;
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getExcludeTools()).not.toContain('run_shell_command');
     expect(config.getExcludeTools()).not.toContain('replace');
     expect(config.getExcludeTools()).not.toContain('write_file');
@@ -1592,8 +1633,12 @@ describe('loadCliConfig tool exclusions', () => {
   it('should not exclude interactive tools in interactive mode with YOLO', async () => {
     process.stdin.isTTY = true;
     process.argv = ['node', 'script.js', '--yolo'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getExcludeTools()).not.toContain('run_shell_command');
     expect(config.getExcludeTools()).not.toContain('replace');
     expect(config.getExcludeTools()).not.toContain('write_file');
@@ -1602,8 +1647,12 @@ describe('loadCliConfig tool exclusions', () => {
   it('should exclude interactive tools in non-interactive mode without YOLO', async () => {
     process.stdin.isTTY = false;
     process.argv = ['node', 'script.js', '-p', 'test'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getExcludeTools()).toContain('run_shell_command');
     expect(config.getExcludeTools()).toContain('replace');
     expect(config.getExcludeTools()).toContain('write_file');
@@ -1612,8 +1661,12 @@ describe('loadCliConfig tool exclusions', () => {
   it('should not exclude interactive tools in non-interactive mode with YOLO', async () => {
     process.stdin.isTTY = false;
     process.argv = ['node', 'script.js', '-p', 'test', '--yolo'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getExcludeTools()).not.toContain('run_shell_command');
     expect(config.getExcludeTools()).not.toContain('replace');
     expect(config.getExcludeTools()).not.toContain('write_file');
@@ -1629,16 +1682,24 @@ describe('loadCliConfig tool exclusions', () => {
       '--allowed-tools',
       'ShellTool',
     ];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getExcludeTools()).not.toContain(SHELL_TOOL_NAME);
   });
 
   it('should exclude web-fetch in non-interactive mode when not allowed', async () => {
     process.stdin.isTTY = false;
     process.argv = ['node', 'script.js', '-p', 'test'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getExcludeTools()).toContain(WEB_FETCH_TOOL_NAME);
   });
 
@@ -1652,8 +1713,12 @@ describe('loadCliConfig tool exclusions', () => {
       '--allowed-tools',
       WEB_FETCH_TOOL_NAME,
     ];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getExcludeTools()).not.toContain(WEB_FETCH_TOOL_NAME);
   });
 
@@ -1667,8 +1732,12 @@ describe('loadCliConfig tool exclusions', () => {
       '--allowed-tools',
       'run_shell_command',
     ];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getExcludeTools()).not.toContain(SHELL_TOOL_NAME);
   });
 
@@ -1682,8 +1751,12 @@ describe('loadCliConfig tool exclusions', () => {
       '--allowed-tools',
       'ShellTool(wc)',
     ];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getExcludeTools()).not.toContain(SHELL_TOOL_NAME);
   });
 });
@@ -1708,40 +1781,60 @@ describe('loadCliConfig interactive', () => {
   it('should be interactive if isTTY and no prompt', async () => {
     process.stdin.isTTY = true;
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.isInteractive()).toBe(true);
   });
 
   it('should be interactive if prompt-interactive is set', async () => {
     process.stdin.isTTY = false;
     process.argv = ['node', 'script.js', '--prompt-interactive', 'test'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.isInteractive()).toBe(true);
   });
 
   it('should not be interactive if not isTTY and no prompt', async () => {
     process.stdin.isTTY = false;
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.isInteractive()).toBe(false);
   });
 
   it('should not be interactive if prompt is set', async () => {
     process.stdin.isTTY = true;
     process.argv = ['node', 'script.js', '--prompt', 'test'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.isInteractive()).toBe(false);
   });
 
   it('should not be interactive if positional prompt words are provided with other flags', async () => {
     process.stdin.isTTY = true;
     process.argv = ['node', 'script.js', '--model', 'gemini-2.5-pro', 'Hello'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.isInteractive()).toBe(false);
   });
 
@@ -1755,8 +1848,12 @@ describe('loadCliConfig interactive', () => {
       '--yolo',
       'Hello world',
     ];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.isInteractive()).toBe(false);
     // Verify the question is preserved for one-shot execution
     expect(argv.prompt).toBe('Hello world');
@@ -1766,8 +1863,12 @@ describe('loadCliConfig interactive', () => {
   it('should not be interactive if positional prompt words are provided with extensions flag', async () => {
     process.stdin.isTTY = true;
     process.argv = ['node', 'script.js', '-e', 'none', 'hello'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.isInteractive()).toBe(false);
     expect(argv.query).toBe('hello');
     expect(argv.extensions).toEqual(['none']);
@@ -1776,8 +1877,12 @@ describe('loadCliConfig interactive', () => {
   it('should handle multiple positional words correctly', async () => {
     process.stdin.isTTY = true;
     process.argv = ['node', 'script.js', 'hello world how are you'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.isInteractive()).toBe(false);
     expect(argv.query).toBe('hello world how are you');
     expect(argv.prompt).toBe('hello world how are you');
@@ -1797,8 +1902,12 @@ describe('loadCliConfig interactive', () => {
       'sort',
       'array',
     ];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.isInteractive()).toBe(false);
     expect(argv.query).toBe('write a function to sort array');
     expect(argv.model).toBe('gemini-2.5-pro');
@@ -1807,8 +1916,12 @@ describe('loadCliConfig interactive', () => {
   it('should handle empty positional arguments', async () => {
     process.stdin.isTTY = true;
     process.argv = ['node', 'script.js', ''];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.isInteractive()).toBe(true);
     expect(argv.query).toBeUndefined();
   });
@@ -1826,8 +1939,12 @@ describe('loadCliConfig interactive', () => {
       'are',
       'you',
     ];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.isInteractive()).toBe(false);
     expect(argv.query).toBe('hello world how are you');
     expect(argv.extensions).toEqual(['none']);
@@ -1836,8 +1953,12 @@ describe('loadCliConfig interactive', () => {
   it('should be interactive if no positional prompt words are provided with flags', async () => {
     process.stdin.isTTY = true;
     process.argv = ['node', 'script.js', '--model', 'gemini-2.5-pro'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.isInteractive()).toBe(true);
   });
 });
@@ -1865,43 +1986,67 @@ describe('loadCliConfig approval mode', () => {
 
   it('should default to DEFAULT approval mode when no flags are set', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.DEFAULT);
   });
 
   it('should set YOLO approval mode when --yolo flag is used', async () => {
     process.argv = ['node', 'script.js', '--yolo'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.YOLO);
   });
 
   it('should set YOLO approval mode when -y flag is used', async () => {
     process.argv = ['node', 'script.js', '-y'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.YOLO);
   });
 
   it('should set DEFAULT approval mode when --approval-mode=default', async () => {
     process.argv = ['node', 'script.js', '--approval-mode', 'default'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.DEFAULT);
   });
 
   it('should set AUTO_EDIT approval mode when --approval-mode=auto_edit', async () => {
     process.argv = ['node', 'script.js', '--approval-mode', 'auto_edit'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.AUTO_EDIT);
   });
 
   it('should set YOLO approval mode when --approval-mode=yolo', async () => {
     process.argv = ['node', 'script.js', '--approval-mode', 'yolo'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.YOLO);
   });
 
@@ -1909,20 +2054,64 @@ describe('loadCliConfig approval mode', () => {
     // Note: This test documents the intended behavior, but in practice the validation
     // prevents both flags from being used together
     process.argv = ['node', 'script.js', '--approval-mode', 'default'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     // Manually set yolo to true to simulate what would happen if validation didn't prevent it
     argv.yolo = true;
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.DEFAULT);
   });
 
   it('should fall back to --yolo behavior when --approval-mode is not set', async () => {
     process.argv = ['node', 'script.js', '--yolo'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.YOLO);
   });
 
+  it('should set Plan approval mode when --approval-mode=plan is used and experimental.plan is enabled', async () => {
+    process.argv = ['node', 'script.js', '--approval-mode', 'plan'];
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
+      experimental: {
+        plan: true,
+      },
+    });
+    const config = await loadCliConfig(settings, 'test-session', argv);
+    expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.PLAN);
+  });
+
+  it('should throw error when --approval-mode=plan is used but experimental.plan is disabled', async () => {
+    process.argv = ['node', 'script.js', '--approval-mode', 'plan'];
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
+      experimental: {
+        plan: false,
+      },
+    });
+
+    await expect(loadCliConfig(settings, 'test-session', argv)).rejects.toThrow(
+      'Approval mode "plan" is only available when experimental.plan is enabled.',
+    );
+  });
+
+  it('should throw error when --approval-mode=plan is used but experimental.plan setting is missing', async () => {
+    process.argv = ['node', 'script.js', '--approval-mode', 'plan'];
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({});
+
+    await expect(loadCliConfig(settings, 'test-session', argv)).rejects.toThrow(
+      'Approval mode "plan" is only available when experimental.plan is enabled.',
+    );
+  });
+
   // --- Untrusted Folder Scenarios ---
   describe('when folder is NOT trusted', () => {
     beforeEach(() => {
@@ -1934,29 +2123,45 @@ describe('loadCliConfig approval mode', () => {
 
     it('should override --approval-mode=yolo to DEFAULT', async () => {
       process.argv = ['node', 'script.js', '--approval-mode', 'yolo'];
-      const argv = await parseArguments({} as Settings);
-      const config = await loadCliConfig({}, 'test-session', argv);
+      const argv = await parseArguments(createTestMergedSettings());
+      const config = await loadCliConfig(
+        createTestMergedSettings(),
+        'test-session',
+        argv,
+      );
       expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.DEFAULT);
     });
 
     it('should override --approval-mode=auto_edit to DEFAULT', async () => {
       process.argv = ['node', 'script.js', '--approval-mode', 'auto_edit'];
-      const argv = await parseArguments({} as Settings);
-      const config = await loadCliConfig({}, 'test-session', argv);
+      const argv = await parseArguments(createTestMergedSettings());
+      const config = await loadCliConfig(
+        createTestMergedSettings(),
+        'test-session',
+        argv,
+      );
       expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.DEFAULT);
     });
 
     it('should override --yolo flag to DEFAULT', async () => {
       process.argv = ['node', 'script.js', '--yolo'];
-      const argv = await parseArguments({} as Settings);
-      const config = await loadCliConfig({}, 'test-session', argv);
+      const argv = await parseArguments(createTestMergedSettings());
+      const config = await loadCliConfig(
+        createTestMergedSettings(),
+        'test-session',
+        argv,
+      );
       expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.DEFAULT);
     });
 
     it('should remain DEFAULT when --approval-mode=default', async () => {
       process.argv = ['node', 'script.js', '--approval-mode', 'default'];
-      const argv = await parseArguments({} as Settings);
-      const config = await loadCliConfig({}, 'test-session', argv);
+      const argv = await parseArguments(createTestMergedSettings());
+      const config = await loadCliConfig(
+        createTestMergedSettings(),
+        'test-session',
+        argv,
+      );
       expect(config.getApprovalMode()).toBe(ServerConfig.ApprovalMode.DEFAULT);
     });
   });
@@ -2032,11 +2237,11 @@ describe('loadCliConfig fileFiltering', () => {
   it.each(testCases)(
     'should pass $property from settings to config when $value',
     async ({ property, getter, value }) => {
-      const settings: Settings = {
+      const settings = createTestMergedSettings({
         context: {
           fileFiltering: { [property]: value },
         },
-      };
+      });
       const argv = await parseArguments(settings);
       const config = await loadCliConfig(settings, 'test-session', argv);
       expect(getter(config)).toBe(value);
@@ -2055,16 +2260,20 @@ describe('Output format', () => {
 
   it('should default to TEXT', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getOutputFormat()).toBe(OutputFormat.TEXT);
   });
 
   it('should use the format from settings', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(
-      { output: { format: OutputFormat.JSON } },
+      createTestMergedSettings({ output: { format: OutputFormat.JSON } }),
       'test-session',
       argv,
     );
@@ -2073,9 +2282,9 @@ describe('Output format', () => {
 
   it('should prioritize the format from argv', async () => {
     process.argv = ['node', 'script.js', '--output-format', 'json'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(
-      { output: { format: OutputFormat.JSON } },
+      createTestMergedSettings({ output: { format: OutputFormat.JSON } }),
       'test-session',
       argv,
     );
@@ -2084,8 +2293,12 @@ describe('Output format', () => {
 
   it('should accept stream-json as a valid output format', async () => {
     process.argv = ['node', 'script.js', '--output-format', 'stream-json'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getOutputFormat()).toBe(OutputFormat.STREAM_JSON);
   });
 
@@ -2103,7 +2316,7 @@ describe('Output format', () => {
       .spyOn(debugLogger, 'error')
       .mockImplementation(() => {});
 
-    await expect(parseArguments({} as Settings)).rejects.toThrow(
+    await expect(parseArguments(createTestMergedSettings())).rejects.toThrow(
       'process.exit called',
     );
     expect(debugErrorSpy).toHaveBeenCalledWith(
@@ -2145,7 +2358,7 @@ describe('parseArguments with positional prompt', () => {
       .spyOn(debugLogger, 'error')
       .mockImplementation(() => {});
 
-    await expect(parseArguments({} as Settings)).rejects.toThrow(
+    await expect(parseArguments(createTestMergedSettings())).rejects.toThrow(
       'process.exit called',
     );
 
@@ -2162,7 +2375,7 @@ describe('parseArguments with positional prompt', () => {
 
   it('should correctly parse a positional prompt to query field', async () => {
     process.argv = ['node', 'script.js', 'positional', 'prompt'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     expect(argv.query).toBe('positional prompt');
     // Since no explicit prompt flags are set and query doesn't start with @, should map to prompt (one-shot)
     expect(argv.prompt).toBe('positional prompt');
@@ -2175,13 +2388,13 @@ describe('parseArguments with positional prompt', () => {
     // This test verifies that the positional 'query' argument is properly configured
     // with the description: "Positional prompt. Defaults to one-shot; use -i/--prompt-interactive for interactive."
     process.argv = ['node', 'script.js', 'test', 'query'];
-    const argv = await yargsInstance.parseArguments({} as Settings);
+    const argv = await yargsInstance.parseArguments(createTestMergedSettings());
     expect(argv.query).toBe('test query');
   });
 
   it('should correctly parse a prompt from the --prompt flag', async () => {
     process.argv = ['node', 'script.js', '--prompt', 'test prompt'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     expect(argv.prompt).toBe('test prompt');
   });
 });
@@ -2197,8 +2410,10 @@ describe('Telemetry configuration via environment variables', () => {
   it('should prioritize GEMINI_TELEMETRY_ENABLED over settings', async () => {
     vi.stubEnv('GEMINI_TELEMETRY_ENABLED', 'true');
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = { telemetry: { enabled: false } };
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
+      telemetry: { enabled: false },
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getTelemetryEnabled()).toBe(true);
   });
@@ -2206,10 +2421,10 @@ describe('Telemetry configuration via environment variables', () => {
   it('should prioritize GEMINI_TELEMETRY_TARGET over settings', async () => {
     vi.stubEnv('GEMINI_TELEMETRY_TARGET', 'gcp');
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       telemetry: { target: ServerConfig.TelemetryTarget.LOCAL },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getTelemetryTarget()).toBe('gcp');
   });
@@ -2217,10 +2432,10 @@ describe('Telemetry configuration via environment variables', () => {
   it('should throw when GEMINI_TELEMETRY_TARGET is invalid', async () => {
     vi.stubEnv('GEMINI_TELEMETRY_TARGET', 'bogus');
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       telemetry: { target: ServerConfig.TelemetryTarget.GCP },
-    };
+    });
     await expect(loadCliConfig(settings, 'test-session', argv)).rejects.toThrow(
       /Invalid telemetry configuration: .*Invalid telemetry target/i,
     );
@@ -2231,10 +2446,10 @@ describe('Telemetry configuration via environment variables', () => {
     vi.stubEnv('OTEL_EXPORTER_OTLP_ENDPOINT', 'http://default.env.com');
     vi.stubEnv('GEMINI_TELEMETRY_OTLP_ENDPOINT', 'http://gemini.env.com');
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       telemetry: { otlpEndpoint: 'http://settings.com' },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getTelemetryOtlpEndpoint()).toBe('http://gemini.env.com');
   });
@@ -2242,8 +2457,10 @@ describe('Telemetry configuration via environment variables', () => {
   it('should prioritize GEMINI_TELEMETRY_OTLP_PROTOCOL over settings', async () => {
     vi.stubEnv('GEMINI_TELEMETRY_OTLP_PROTOCOL', 'http');
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = { telemetry: { otlpProtocol: 'grpc' } };
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
+      telemetry: { otlpProtocol: 'grpc' },
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getTelemetryOtlpProtocol()).toBe('http');
   });
@@ -2251,8 +2468,10 @@ describe('Telemetry configuration via environment variables', () => {
   it('should prioritize GEMINI_TELEMETRY_LOG_PROMPTS over settings', async () => {
     vi.stubEnv('GEMINI_TELEMETRY_LOG_PROMPTS', 'false');
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = { telemetry: { logPrompts: true } };
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
+      telemetry: { logPrompts: true },
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getTelemetryLogPromptsEnabled()).toBe(false);
   });
@@ -2260,10 +2479,10 @@ describe('Telemetry configuration via environment variables', () => {
   it('should prioritize GEMINI_TELEMETRY_OUTFILE over settings', async () => {
     vi.stubEnv('GEMINI_TELEMETRY_OUTFILE', '/gemini/env/telemetry.log');
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       telemetry: { outfile: '/settings/telemetry.log' },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getTelemetryOutfile()).toBe('/gemini/env/telemetry.log');
   });
@@ -2271,8 +2490,10 @@ describe('Telemetry configuration via environment variables', () => {
   it('should prioritize GEMINI_TELEMETRY_USE_COLLECTOR over settings', async () => {
     vi.stubEnv('GEMINI_TELEMETRY_USE_COLLECTOR', 'true');
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = { telemetry: { useCollector: false } };
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
+      telemetry: { useCollector: false },
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getTelemetryUseCollector()).toBe(true);
   });
@@ -2280,8 +2501,8 @@ describe('Telemetry configuration via environment variables', () => {
   it('should use settings value when GEMINI_TELEMETRY_ENABLED is not set', async () => {
     vi.stubEnv('GEMINI_TELEMETRY_ENABLED', undefined);
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = { telemetry: { enabled: true } };
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({ telemetry: { enabled: true } });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getTelemetryEnabled()).toBe(true);
   });
@@ -2289,10 +2510,10 @@ describe('Telemetry configuration via environment variables', () => {
   it('should use settings value when GEMINI_TELEMETRY_TARGET is not set', async () => {
     vi.stubEnv('GEMINI_TELEMETRY_TARGET', undefined);
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       telemetry: { target: ServerConfig.TelemetryTarget.LOCAL },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getTelemetryTarget()).toBe('local');
   });
@@ -2300,17 +2521,21 @@ describe('Telemetry configuration via environment variables', () => {
   it("should treat GEMINI_TELEMETRY_ENABLED='1' as true", async () => {
     vi.stubEnv('GEMINI_TELEMETRY_ENABLED', '1');
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getTelemetryEnabled()).toBe(true);
   });
 
   it("should treat GEMINI_TELEMETRY_ENABLED='0' as false", async () => {
     vi.stubEnv('GEMINI_TELEMETRY_ENABLED', '0');
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(
-      { telemetry: { enabled: true } },
+      createTestMergedSettings({ telemetry: { enabled: true } }),
       'test-session',
       argv,
     );
@@ -2320,17 +2545,21 @@ describe('Telemetry configuration via environment variables', () => {
   it("should treat GEMINI_TELEMETRY_LOG_PROMPTS='1' as true", async () => {
     vi.stubEnv('GEMINI_TELEMETRY_LOG_PROMPTS', '1');
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.getTelemetryLogPromptsEnabled()).toBe(true);
   });
 
   it("should treat GEMINI_TELEMETRY_LOG_PROMPTS='false' as false", async () => {
     vi.stubEnv('GEMINI_TELEMETRY_LOG_PROMPTS', 'false');
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
+    const argv = await parseArguments(createTestMergedSettings());
     const config = await loadCliConfig(
-      { telemetry: { logPrompts: true } },
+      createTestMergedSettings({ telemetry: { logPrompts: true } }),
       'test-session',
       argv,
     );
@@ -2355,8 +2584,12 @@ describe('PolicyEngine nonInteractive wiring', () => {
   it('should set nonInteractive to true in one-shot mode', async () => {
     process.stdin.isTTY = true;
     process.argv = ['node', 'script.js', 'echo hello']; // Positional query makes it one-shot
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.isInteractive()).toBe(false);
     expect(
       (config.getPolicyEngine() as unknown as { nonInteractive: boolean })
@@ -2367,8 +2600,12 @@ describe('PolicyEngine nonInteractive wiring', () => {
   it('should set nonInteractive to false in interactive mode', async () => {
     process.stdin.isTTY = true;
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const config = await loadCliConfig({}, 'test-session', argv);
+    const argv = await parseArguments(createTestMergedSettings());
+    const config = await loadCliConfig(
+      createTestMergedSettings(),
+      'test-session',
+      argv,
+    );
     expect(config.isInteractive()).toBe(true);
     expect(
       (config.getPolicyEngine() as unknown as { nonInteractive: boolean })
@@ -2392,8 +2629,10 @@ describe('Policy Engine Integration in loadCliConfig', () => {
 
   it('should pass merged allowed tools from CLI and settings to createPolicyEngineConfig', async () => {
     process.argv = ['node', 'script.js', '--allowed-tools', 'cli-tool'];
-    const settings: Settings = { tools: { allowed: ['settings-tool'] } };
-    const argv = await parseArguments({} as Settings);
+    const settings = createTestMergedSettings({
+      tools: { allowed: ['settings-tool'] },
+    });
+    const argv = await parseArguments(createTestMergedSettings());
 
     await loadCliConfig(settings, 'test-session', argv);
 
@@ -2410,8 +2649,10 @@ describe('Policy Engine Integration in loadCliConfig', () => {
   it('should pass merged exclude tools from CLI logic and settings to createPolicyEngineConfig', async () => {
     process.stdin.isTTY = false; // Non-interactive to trigger default excludes
     process.argv = ['node', 'script.js', '-p', 'test'];
-    const settings: Settings = { tools: { exclude: ['settings-exclude'] } };
-    const argv = await parseArguments({} as Settings);
+    const settings = createTestMergedSettings({
+      tools: { exclude: ['settings-exclude'] },
+    });
+    const argv = await parseArguments(createTestMergedSettings());
 
     await loadCliConfig(settings, 'test-session', argv);
 
@@ -2446,20 +2687,20 @@ describe('loadCliConfig disableYoloMode', () => {
 
   it('should allow auto_edit mode even if yolo mode is disabled', async () => {
     process.argv = ['node', 'script.js', '--approval-mode=auto_edit'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       security: { disableYoloMode: true },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getApprovalMode()).toBe(ApprovalMode.AUTO_EDIT);
   });
 
   it('should throw if YOLO mode is attempted when disableYoloMode is true', async () => {
     process.argv = ['node', 'script.js', '--yolo'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       security: { disableYoloMode: true },
-    };
+    });
     await expect(loadCliConfig(settings, 'test-session', argv)).rejects.toThrow(
       'Cannot start in YOLO mode since it is disabled by your admin',
     );
@@ -2485,12 +2726,12 @@ describe('loadCliConfig secureModeEnabled', () => {
 
   it('should throw an error if YOLO mode is attempted when secureModeEnabled is true', async () => {
     process.argv = ['node', 'script.js', '--yolo'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       admin: {
         secureModeEnabled: true,
       },
-    };
+    });
 
     await expect(loadCliConfig(settings, 'test-session', argv)).rejects.toThrow(
       'Cannot start in YOLO mode since it is disabled by your admin',
@@ -2499,12 +2740,12 @@ describe('loadCliConfig secureModeEnabled', () => {
 
   it('should throw an error if approval-mode=yolo is attempted when secureModeEnabled is true', async () => {
     process.argv = ['node', 'script.js', '--approval-mode=yolo'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       admin: {
         secureModeEnabled: true,
       },
-    };
+    });
 
     await expect(loadCliConfig(settings, 'test-session', argv)).rejects.toThrow(
       'Cannot start in YOLO mode since it is disabled by your admin',
@@ -2513,12 +2754,12 @@ describe('loadCliConfig secureModeEnabled', () => {
 
   it('should set disableYoloMode to true when secureModeEnabled is true', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       admin: {
         secureModeEnabled: true,
       },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.isYoloModeDisabled()).toBe(true);
   });
@@ -2548,8 +2789,8 @@ describe('loadCliConfig mcpEnabled', () => {
 
   it('should enable MCP by default', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = { ...mcpSettings };
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({ ...mcpSettings });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getMcpEnabled()).toBe(true);
     expect(config.getMcpServerCommand()).toBe('mcp-server');
@@ -2560,15 +2801,15 @@ describe('loadCliConfig mcpEnabled', () => {
 
   it('should disable MCP when mcpEnabled is false', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       ...mcpSettings,
       admin: {
         mcp: {
           enabled: false,
         },
       },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getMcpEnabled()).toBe(false);
     expect(config.getMcpServerCommand()).toBeUndefined();
@@ -2579,15 +2820,15 @@ describe('loadCliConfig mcpEnabled', () => {
 
   it('should enable MCP when mcpEnabled is true', async () => {
     process.argv = ['node', 'script.js'];
-    const argv = await parseArguments({} as Settings);
-    const settings: Settings = {
+    const argv = await parseArguments(createTestMergedSettings());
+    const settings = createTestMergedSettings({
       ...mcpSettings,
       admin: {
         mcp: {
           enabled: true,
         },
       },
-    };
+    });
     const config = await loadCliConfig(settings, 'test-session', argv);
     expect(config.getMcpEnabled()).toBe(true);
     expect(config.getMcpServerCommand()).toBe('mcp-server');
diff --git a/packages/cli/src/config/config.ts b/packages/cli/src/config/config.ts
index 341226fed2..591d861d7c 100755
--- a/packages/cli/src/config/config.ts
+++ b/packages/cli/src/config/config.ts
@@ -38,8 +38,12 @@ import {
   type OutputFormat,
   GEMINI_MODEL_ALIAS_AUTO,
 } from '@google/gemini-cli-core';
-import type { Settings } from './settings.js';
-import { saveModelChange, loadSettings } from './settings.js';
+import {
+  type Settings,
+  type MergedSettings,
+  saveModelChange,
+  loadSettings,
+} from './settings.js';
 
 import { loadSandboxConfig } from './sandboxConfig.js';
 import { resolvePath } from '../utils/resolvePath.js';
@@ -54,7 +58,6 @@ import { requestConsentNonInteractive } from './extensions/consent.js';
 import { promptForSetting } from './extensions/extensionSettings.js';
 import type { EventEmitter } from 'node:stream';
 import { runExitCleanup } from '../utils/cleanup.js';
-import { getEnableHooks, getEnableHooksUI } from './settingsSchema.js';
 
 export interface CliArgs {
   query: string | undefined;
@@ -82,7 +85,9 @@ export interface CliArgs {
   recordResponses: string | undefined;
 }
 
-export async function parseArguments(settings: Settings): Promise<CliArgs> {
+export async function parseArguments(
+  settings: MergedSettings,
+): Promise<CliArgs> {
   const rawArgv = hideBin(process.argv);
   const yargsInstance = yargs(rawArgv)
     .locale('en')
@@ -138,9 +143,9 @@ export async function parseArguments(settings: Settings): Promise<CliArgs> {
         .option('approval-mode', {
           type: 'string',
           nargs: 1,
-          choices: ['default', 'auto_edit', 'yolo'],
+          choices: ['default', 'auto_edit', 'yolo', 'plan'],
           description:
-            'Set the approval mode: default (prompt for approval), auto_edit (auto-approve edit tools), yolo (auto-approve all tools)',
+            'Set the approval mode: default (prompt for approval), auto_edit (auto-approve edit tools), yolo (auto-approve all tools), plan (read-only mode)',
         })
         .option('experimental-acp', {
           type: 'boolean',
@@ -280,16 +285,16 @@ export async function parseArguments(settings: Settings): Promise<CliArgs> {
       return true;
     });
 
-  if (settings?.experimental?.extensionManagement ?? true) {
+  if (settings.experimental.extensionManagement) {
     yargsInstance.command(extensionsCommand);
   }
 
-  if (settings?.experimental?.skills ?? false) {
+  if (settings.experimental.skills) {
     yargsInstance.command(skillsCommand);
   }
 
   // Register hooks command if hooks are enabled
-  if (getEnableHooksUI(settings)) {
+  if (settings.tools.enableHooks) {
     yargsInstance.command(hooksCommand);
   }
 
@@ -392,7 +397,7 @@ export interface LoadCliConfigOptions {
 }
 
 export async function loadCliConfig(
-  settings: Settings,
+  settings: MergedSettings,
   sessionId: string,
   argv: CliArgs,
   options: LoadCliConfigOptions = {},
@@ -487,12 +492,20 @@ export async function loadCliConfig(
       case 'auto_edit':
         approvalMode = ApprovalMode.AUTO_EDIT;
         break;
+      case 'plan':
+        if (!(settings.experimental?.plan ?? false)) {
+          throw new Error(
+            'Approval mode "plan" is only available when experimental.plan is enabled.',
+          );
+        }
+        approvalMode = ApprovalMode.PLAN;
+        break;
       case 'default':
         approvalMode = ApprovalMode.DEFAULT;
         break;
       default:
         throw new Error(
-          `Invalid approval mode: ${argv.approvalMode}. Valid values are: yolo, auto_edit, default`,
+          `Invalid approval mode: ${argv.approvalMode}. Valid values are: yolo, auto_edit, plan, default`,
         );
     }
   } else {
@@ -573,6 +586,11 @@ export async function loadCliConfig(
     );
 
     switch (approvalMode) {
+      case ApprovalMode.PLAN:
+        // In plan non-interactive mode, all tools that require approval are excluded.
+        // TODO(#16625): Replace this default exclusion logic with specific rules for plan mode.
+        extraExcludes.push(...defaultExcludes.filter(toolExclusionFilter));
+        break;
       case ApprovalMode.DEFAULT:
         // In default non-interactive mode, all tools that require approval are excluded.
         extraExcludes.push(...defaultExcludes.filter(toolExclusionFilter));
@@ -590,10 +608,7 @@ export async function loadCliConfig(
     }
   }
 
-  const excludeTools = mergeExcludeTools(
-    settings,
-    extraExcludes.length > 0 ? extraExcludes : undefined,
-  );
+  const excludeTools = mergeExcludeTools(settings, extraExcludes);
 
   // Create a settings object that includes CLI overrides for policy generation
   const effectiveSettings: Settings = {
@@ -742,15 +757,17 @@ export async function loadCliConfig(
     disableLLMCorrection: settings.tools?.disableLLMCorrection,
     modelConfigServiceConfig: settings.modelConfigs,
     // TODO: loading of hooks based on workspace trust
-    enableHooks: getEnableHooks(settings),
-    enableHooksUI: getEnableHooksUI(settings),
+    enableHooks:
+      (settings.tools?.enableHooks ?? true) &&
+      (settings.hooks?.enabled ?? false),
+    enableHooksUI: settings.tools?.enableHooks ?? true,
     hooks: settings.hooks || {},
     projectHooks: projectHooks || {},
     onModelChange: (model: string) => saveModelChange(loadedSettings, model),
     onReload: async () => {
       const refreshedSettings = loadSettings(cwd);
       return {
-        disabledSkills: refreshedSettings.merged.skills?.disabled,
+        disabledSkills: refreshedSettings.merged.skills.disabled,
         agents: refreshedSettings.merged.agents,
       };
     },
@@ -758,12 +775,12 @@ export async function loadCliConfig(
 }
 
 function mergeExcludeTools(
-  settings: Settings,
-  extraExcludes?: string[] | undefined,
+  settings: MergedSettings,
+  extraExcludes: string[] = [],
 ): string[] {
   const allExcludeTools = new Set([
-    ...(settings.tools?.exclude || []),
-    ...(extraExcludes || []),
+    ...(settings.tools.exclude || []),
+    ...extraExcludes,
   ]);
-  return [...allExcludeTools];
+  return Array.from(allExcludeTools);
 }
diff --git a/packages/cli/src/config/extension-manager-agents.test.ts b/packages/cli/src/config/extension-manager-agents.test.ts
index 7ae845875f..19ef150d22 100644
--- a/packages/cli/src/config/extension-manager-agents.test.ts
+++ b/packages/cli/src/config/extension-manager-agents.test.ts
@@ -10,7 +10,7 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { ExtensionManager } from './extension-manager.js';
 import { debugLogger } from '@google/gemini-cli-core';
-import { type Settings } from './settings.js';
+import { createTestMergedSettings } from './settings.js';
 import { createExtension } from '../test-utils/createExtension.js';
 import { EXTENSIONS_DIRECTORY_NAME } from './extensions/variables.js';
 
@@ -52,10 +52,9 @@ describe('ExtensionManager agents loading', () => {
     fs.mkdirSync(extensionsDir, { recursive: true });
 
     extensionManager = new ExtensionManager({
-      settings: {
+      settings: createTestMergedSettings({
         telemetry: { enabled: false },
-        trustedFolders: [tempDir],
-      } as unknown as Settings,
+      }),
       requestConsent: vi.fn().mockResolvedValue(true),
       requestSetting: vi.fn(),
       workspaceDir: tempDir,
diff --git a/packages/cli/src/config/extension-manager-scope.test.ts b/packages/cli/src/config/extension-manager-scope.test.ts
index 6d3e51b4d8..5079075366 100644
--- a/packages/cli/src/config/extension-manager-scope.test.ts
+++ b/packages/cli/src/config/extension-manager-scope.test.ts
@@ -9,7 +9,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import { ExtensionManager } from './extension-manager.js';
-import type { Settings } from './settings.js';
+import { createTestMergedSettings } from './settings.js';
 import {
   loadAgentsFromDirectory,
   loadSkillsFromDir,
@@ -105,14 +105,10 @@ describe('ExtensionManager Settings Scope', () => {
       workspaceDir: tempWorkspace,
       requestConsent: async () => true,
       requestSetting: async () => '',
-      settings: {
-        telemetry: {
-          enabled: false,
-        },
-        experimental: {
-          extensionConfig: true,
-        },
-      } as Settings,
+      settings: createTestMergedSettings({
+        telemetry: { enabled: false },
+        experimental: { extensionConfig: true },
+      }),
     });
 
     const extensions = await extensionManager.loadExtensions();
@@ -147,14 +143,10 @@ describe('ExtensionManager Settings Scope', () => {
       workspaceDir: tempWorkspace,
       requestConsent: async () => true,
       requestSetting: async () => '',
-      settings: {
-        telemetry: {
-          enabled: false,
-        },
-        experimental: {
-          extensionConfig: true,
-        },
-      } as Settings,
+      settings: createTestMergedSettings({
+        telemetry: { enabled: false },
+        experimental: { extensionConfig: true },
+      }),
     });
 
     const extensions = await extensionManager.loadExtensions();
@@ -187,14 +179,10 @@ describe('ExtensionManager Settings Scope', () => {
       workspaceDir: tempWorkspace,
       requestConsent: async () => true,
       requestSetting: async () => '',
-      settings: {
-        telemetry: {
-          enabled: false,
-        },
-        experimental: {
-          extensionConfig: true,
-        },
-      } as Settings,
+      settings: createTestMergedSettings({
+        telemetry: { enabled: false },
+        experimental: { extensionConfig: true },
+      }),
     });
 
     const extensions = await extensionManager.loadExtensions();
diff --git a/packages/cli/src/config/extension-manager-skills.test.ts b/packages/cli/src/config/extension-manager-skills.test.ts
index ecc0dfa3c0..a76d88482d 100644
--- a/packages/cli/src/config/extension-manager-skills.test.ts
+++ b/packages/cli/src/config/extension-manager-skills.test.ts
@@ -10,7 +10,7 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { ExtensionManager } from './extension-manager.js';
 import { debugLogger, coreEvents } from '@google/gemini-cli-core';
-import { type Settings } from './settings.js';
+import { createTestMergedSettings } from './settings.js';
 import { createExtension } from '../test-utils/createExtension.js';
 import { EXTENSIONS_DIRECTORY_NAME } from './extensions/variables.js';
 
@@ -58,10 +58,9 @@ describe('ExtensionManager skills validation', () => {
     fs.mkdirSync(extensionsDir, { recursive: true });
 
     extensionManager = new ExtensionManager({
-      settings: {
+      settings: createTestMergedSettings({
         telemetry: { enabled: false },
-        trustedFolders: [tempDir],
-      } as unknown as Settings,
+      }),
       requestConsent: vi.fn().mockResolvedValue(true),
       requestSetting: vi.fn(),
       workspaceDir: tempDir,
@@ -134,10 +133,9 @@ describe('ExtensionManager skills validation', () => {
 
     // 3. Create a fresh ExtensionManager to force loading from disk
     const newExtensionManager = new ExtensionManager({
-      settings: {
+      settings: createTestMergedSettings({
         telemetry: { enabled: false },
-        trustedFolders: [tempDir],
-      } as unknown as Settings,
+      }),
       requestConsent: vi.fn().mockResolvedValue(true),
       requestSetting: vi.fn(),
       workspaceDir: tempDir,
diff --git a/packages/cli/src/config/extension-manager.ts b/packages/cli/src/config/extension-manager.ts
index 75416f1909..45ca5a0d8a 100644
--- a/packages/cli/src/config/extension-manager.ts
+++ b/packages/cli/src/config/extension-manager.ts
@@ -9,7 +9,7 @@ import * as path from 'node:path';
 import { stat } from 'node:fs/promises';
 import chalk from 'chalk';
 import { ExtensionEnablementManager } from './extensions/extensionEnablement.js';
-import { type Settings, SettingScope } from './settings.js';
+import { type MergedSettings, SettingScope } from './settings.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { loadInstallMetadata, type ExtensionConfig } from './extension.js';
 import {
@@ -68,11 +68,10 @@ import {
   ExtensionSettingScope,
 } from './extensions/extensionSettings.js';
 import type { EventEmitter } from 'node:stream';
-import { getEnableHooks } from './settingsSchema.js';
 
 interface ExtensionManagerParams {
   enabledExtensionOverrides?: string[];
-  settings: Settings;
+  settings: MergedSettings;
   requestConsent: (consent: string) => Promise<boolean>;
   requestSetting: ((setting: ExtensionSetting) => Promise<string>) | null;
   workspaceDir: string;
@@ -86,7 +85,7 @@ interface ExtensionManagerParams {
  */
 export class ExtensionManager extends ExtensionLoader {
   private extensionEnablementManager: ExtensionEnablementManager;
-  private settings: Settings;
+  private settings: MergedSettings;
   private requestConsent: (consent: string) => Promise<boolean>;
   private requestSetting:
     | ((setting: ExtensionSetting) => Promise<string>)
@@ -143,7 +142,7 @@ export class ExtensionManager extends ExtensionLoader {
     if (
       (installMetadata.type === 'git' ||
         installMetadata.type === 'github-release') &&
-      this.settings.security?.blockGitExtensions
+      this.settings.security.blockGitExtensions
     ) {
       throw new Error(
         'Installing extensions from remote sources is disallowed by your current settings.',
@@ -287,10 +286,7 @@ Would you like to attempt to install via "git clone" instead?`,
         }
 
         await fs.promises.mkdir(destinationPath, { recursive: true });
-        if (
-          this.requestSetting &&
-          (this.settings.experimental?.extensionConfig ?? false)
-        ) {
+        if (this.requestSetting && this.settings.experimental.extensionConfig) {
           if (isUpdate) {
             await maybePromptForSettings(
               newExtensionConfig,
@@ -308,14 +304,13 @@ Would you like to attempt to install via "git clone" instead?`,
           }
         }
 
-        const missingSettings =
-          (this.settings.experimental?.extensionConfig ?? false)
-            ? await getMissingSettings(
-                newExtensionConfig,
-                extensionId,
-                this.workspaceDir,
-              )
-            : [];
+        const missingSettings = this.settings.experimental.extensionConfig
+          ? await getMissingSettings(
+              newExtensionConfig,
+              extensionId,
+              this.workspaceDir,
+            )
+          : [];
         if (missingSettings.length > 0) {
           const message = `Extension "${newExtensionConfig.name}" has missing settings: ${missingSettings
             .map((s) => s.name)
@@ -478,7 +473,7 @@ Would you like to attempt to install via "git clone" instead?`,
       throw new Error('Extensions already loaded, only load extensions once.');
     }
 
-    if (this.settings.admin?.extensions?.enabled === false) {
+    if (this.settings.admin.extensions.enabled === false) {
       this.loadedExtensions = [];
       return this.loadedExtensions;
     }
@@ -511,7 +506,7 @@ Would you like to attempt to install via "git clone" instead?`,
     if (
       (installMetadata?.type === 'git' ||
         installMetadata?.type === 'github-release') &&
-      this.settings.security?.blockGitExtensions
+      this.settings.security.blockGitExtensions
     ) {
       return null;
     }
@@ -535,7 +530,7 @@ Would you like to attempt to install via "git clone" instead?`,
       let userSettings: Record<string, string> = {};
       let workspaceSettings: Record<string, string> = {};
 
-      if (this.settings.experimental?.extensionConfig ?? false) {
+      if (this.settings.experimental.extensionConfig) {
         userSettings = await getScopedEnvContents(
           config,
           extensionId,
@@ -553,10 +548,7 @@ Would you like to attempt to install via "git clone" instead?`,
       config = resolveEnvVarsInObject(config, customEnv);
 
       const resolvedSettings: ResolvedExtensionSetting[] = [];
-      if (
-        config.settings &&
-        (this.settings.experimental?.extensionConfig ?? false)
-      ) {
+      if (config.settings && this.settings.experimental.extensionConfig) {
         for (const setting of config.settings) {
           const value = customEnv[setting.envVar];
           let scope: 'user' | 'workspace' | undefined;
@@ -600,7 +592,7 @@ Would you like to attempt to install via "git clone" instead?`,
       }
 
       if (config.mcpServers) {
-        if (this.settings.admin?.mcp?.enabled === false) {
+        if (this.settings.admin.mcp.enabled === false) {
           config.mcpServers = undefined;
         } else {
           config.mcpServers = Object.fromEntries(
@@ -619,7 +611,7 @@ Would you like to attempt to install via "git clone" instead?`,
         .filter((contextFilePath) => fs.existsSync(contextFilePath));
 
       let hooks: { [K in HookEventName]?: HookDefinition[] } | undefined;
-      if (getEnableHooks(this.settings)) {
+      if (this.settings.tools.enableHooks && this.settings.hooks.enabled) {
         hooks = await this.loadExtensionHooks(effectiveExtensionPath, {
           extensionPath: effectiveExtensionPath,
           workspacePath: this.workspaceDir,
diff --git a/packages/cli/src/config/extension.test.ts b/packages/cli/src/config/extension.test.ts
index a3230058f7..55f44a6c20 100644
--- a/packages/cli/src/config/extension.test.ts
+++ b/packages/cli/src/config/extension.test.ts
@@ -26,7 +26,11 @@ import {
   loadAgentsFromDirectory,
   loadSkillsFromDir,
 } from '@google/gemini-cli-core';
-import { loadSettings, SettingScope } from './settings.js';
+import {
+  loadSettings,
+  createTestMergedSettings,
+  SettingScope,
+} from './settings.js';
 import {
   isWorkspaceTrusted,
   resetTrustedFoldersForTesting,
@@ -201,7 +205,7 @@ describe('extension tests', () => {
     });
     vi.spyOn(process, 'cwd').mockReturnValue(tempWorkspaceDir);
     const settings = loadSettings(tempWorkspaceDir).merged;
-    (settings.experimental ??= {}).extensionConfig = true;
+    settings.experimental.extensionConfig = true;
     extensionManager = new ExtensionManager({
       workspaceDir: tempWorkspaceDir,
       requestConsent: mockRequestConsent,
@@ -628,11 +632,9 @@ describe('extension tests', () => {
         },
       });
 
-      const blockGitExtensionsSetting = {
-        security: {
-          blockGitExtensions: true,
-        },
-      };
+      const blockGitExtensionsSetting = createTestMergedSettings({
+        security: { blockGitExtensions: true },
+      });
       extensionManager = new ExtensionManager({
         workspaceDir: tempWorkspaceDir,
         requestConsent: mockRequestConsent,
@@ -652,7 +654,6 @@ describe('extension tests', () => {
         version: '1.0.0',
       });
       const loadedSettings = loadSettings(tempWorkspaceDir).merged;
-      (loadedSettings.admin ??= {}).extensions ??= {};
       loadedSettings.admin.extensions.enabled = false;
 
       extensionManager = new ExtensionManager({
@@ -676,7 +677,6 @@ describe('extension tests', () => {
         },
       });
       const loadedSettings = loadSettings(tempWorkspaceDir).merged;
-      (loadedSettings.admin ??= {}).mcp ??= {};
       loadedSettings.admin.mcp.enabled = false;
 
       extensionManager = new ExtensionManager({
@@ -701,7 +701,6 @@ describe('extension tests', () => {
         },
       });
       const loadedSettings = loadSettings(tempWorkspaceDir).merged;
-      (loadedSettings.admin ??= {}).mcp ??= {};
       loadedSettings.admin.mcp.enabled = true;
 
       extensionManager = new ExtensionManager({
@@ -837,7 +836,6 @@ describe('extension tests', () => {
         );
 
         const settings = loadSettings(tempWorkspaceDir).merged;
-        if (!settings.hooks) settings.hooks = {};
         settings.hooks.enabled = true;
 
         extensionManager = new ExtensionManager({
@@ -873,7 +871,6 @@ describe('extension tests', () => {
         );
 
         const settings = loadSettings(tempWorkspaceDir).merged;
-        if (!settings.hooks) settings.hooks = {};
         settings.hooks.enabled = false;
 
         extensionManager = new ExtensionManager({
@@ -1098,11 +1095,9 @@ describe('extension tests', () => {
 
     it('should not install a github extension if blockGitExtensions is set', async () => {
       const gitUrl = 'https://somehost.com/somerepo.git';
-      const blockGitExtensionsSetting = {
-        security: {
-          blockGitExtensions: true,
-        },
-      };
+      const blockGitExtensionsSetting = createTestMergedSettings({
+        security: { blockGitExtensions: true },
+      });
       extensionManager = new ExtensionManager({
         workspaceDir: tempWorkspaceDir,
         requestConsent: mockRequestConsent,
diff --git a/packages/cli/src/config/extensions/extensionUpdates.test.ts b/packages/cli/src/config/extensions/extensionUpdates.test.ts
index a9240a1676..43b19d1228 100644
--- a/packages/cli/src/config/extensions/extensionUpdates.test.ts
+++ b/packages/cli/src/config/extensions/extensionUpdates.test.ts
@@ -11,7 +11,6 @@ import * as fs from 'node:fs';
 import { getMissingSettings } from './extensionSettings.js';
 import type { ExtensionConfig } from '../extension.js';
 import { ExtensionStorage } from './storage.js';
-import type { Settings } from '../settings.js';
 import {
   KeychainTokenStorage,
   debugLogger,
@@ -21,6 +20,7 @@ import {
 } from '@google/gemini-cli-core';
 import { EXTENSION_SETTINGS_FILENAME } from './variables.js';
 import { ExtensionManager } from '../extension-manager.js';
+import { createTestMergedSettings } from '../settings.js';
 
 vi.mock('node:fs', async (importOriginal) => {
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -247,12 +247,10 @@ describe('extensionUpdates', () => {
       const manager = new ExtensionManager({
         workspaceDir: tempWorkspaceDir,
 
-        settings: {
-          telemetry: {
-            enabled: false,
-          },
+        settings: createTestMergedSettings({
+          telemetry: { enabled: false },
           experimental: { extensionConfig: true },
-        } as unknown as Settings,
+        }),
         requestConsent: vi.fn().mockResolvedValue(true),
         requestSetting: null, // Simulate non-interactive
       });
diff --git a/packages/cli/src/config/keyBindings.ts b/packages/cli/src/config/keyBindings.ts
index b101ae489e..47e4d6c400 100644
--- a/packages/cli/src/config/keyBindings.ts
+++ b/packages/cli/src/config/keyBindings.ts
@@ -8,87 +8,79 @@
  * Command enum for all available keyboard shortcuts
  */
 export enum Command {
-  // Basic bindings
-  RETURN = 'return',
-  ESCAPE = 'escape',
+  // Basic Controls
+  RETURN = 'basic.confirm',
+  ESCAPE = 'basic.cancel',
+  QUIT = 'basic.quit',
+  EXIT = 'basic.exit',
 
-  // Cursor movement
-  HOME = 'home',
-  END = 'end',
+  // Cursor Movement
+  HOME = 'cursor.home',
+  END = 'cursor.end',
+  MOVE_UP = 'cursor.up',
+  MOVE_DOWN = 'cursor.down',
+  MOVE_LEFT = 'cursor.left',
+  MOVE_RIGHT = 'cursor.right',
+  MOVE_WORD_LEFT = 'cursor.wordLeft',
+  MOVE_WORD_RIGHT = 'cursor.wordRight',
 
-  // Text deletion
-  KILL_LINE_RIGHT = 'killLineRight',
-  KILL_LINE_LEFT = 'killLineLeft',
-  CLEAR_INPUT = 'clearInput',
-  DELETE_WORD_BACKWARD = 'deleteWordBackward',
-
-  // Screen control
-  CLEAR_SCREEN = 'clearScreen',
+  // Editing
+  KILL_LINE_RIGHT = 'edit.deleteRightAll',
+  KILL_LINE_LEFT = 'edit.deleteLeftAll',
+  CLEAR_INPUT = 'edit.clear',
+  DELETE_WORD_BACKWARD = 'edit.deleteWordLeft',
+  DELETE_WORD_FORWARD = 'edit.deleteWordRight',
+  DELETE_CHAR_LEFT = 'edit.deleteLeft',
+  DELETE_CHAR_RIGHT = 'edit.deleteRight',
+  UNDO = 'edit.undo',
+  REDO = 'edit.redo',
 
   // Scrolling
-  SCROLL_UP = 'scrollUp',
-  SCROLL_DOWN = 'scrollDown',
-  SCROLL_HOME = 'scrollHome',
-  SCROLL_END = 'scrollEnd',
-  PAGE_UP = 'pageUp',
-  PAGE_DOWN = 'pageDown',
+  SCROLL_UP = 'scroll.up',
+  SCROLL_DOWN = 'scroll.down',
+  SCROLL_HOME = 'scroll.home',
+  SCROLL_END = 'scroll.end',
+  PAGE_UP = 'scroll.pageUp',
+  PAGE_DOWN = 'scroll.pageDown',
 
-  // History navigation
-  HISTORY_UP = 'historyUp',
-  HISTORY_DOWN = 'historyDown',
-  NAVIGATION_UP = 'navigationUp',
-  NAVIGATION_DOWN = 'navigationDown',
+  // History & Search
+  HISTORY_UP = 'history.previous',
+  HISTORY_DOWN = 'history.next',
+  REVERSE_SEARCH = 'history.search.start',
+  SUBMIT_REVERSE_SEARCH = 'history.search.submit',
+  ACCEPT_SUGGESTION_REVERSE_SEARCH = 'history.search.accept',
 
-  // Dialog navigation
-  DIALOG_NAVIGATION_UP = 'dialogNavigationUp',
-  DIALOG_NAVIGATION_DOWN = 'dialogNavigationDown',
+  // Navigation
+  NAVIGATION_UP = 'nav.up',
+  NAVIGATION_DOWN = 'nav.down',
+  DIALOG_NAVIGATION_UP = 'nav.dialog.up',
+  DIALOG_NAVIGATION_DOWN = 'nav.dialog.down',
 
-  // Auto-completion
-  ACCEPT_SUGGESTION = 'acceptSuggestion',
-  COMPLETION_UP = 'completionUp',
-  COMPLETION_DOWN = 'completionDown',
+  // Suggestions & Completions
+  ACCEPT_SUGGESTION = 'suggest.accept',
+  COMPLETION_UP = 'suggest.focusPrevious',
+  COMPLETION_DOWN = 'suggest.focusNext',
+  EXPAND_SUGGESTION = 'suggest.expand',
+  COLLAPSE_SUGGESTION = 'suggest.collapse',
 
-  // Text input
-  SUBMIT = 'submit',
-  NEWLINE = 'newline',
+  // Text Input
+  SUBMIT = 'input.submit',
+  NEWLINE = 'input.newline',
+  OPEN_EXTERNAL_EDITOR = 'input.openExternalEditor',
+  PASTE_CLIPBOARD = 'input.paste',
 
-  // External tools
-  OPEN_EXTERNAL_EDITOR = 'openExternalEditor',
-  PASTE_CLIPBOARD = 'pasteClipboard',
-
-  // App level bindings
-  SHOW_ERROR_DETAILS = 'showErrorDetails',
-  SHOW_FULL_TODOS = 'showFullTodos',
-  SHOW_IDE_CONTEXT_DETAIL = 'showIDEContextDetail',
-  TOGGLE_MARKDOWN = 'toggleMarkdown',
-  TOGGLE_COPY_MODE = 'toggleCopyMode',
-  TOGGLE_YOLO = 'toggleYolo',
-  TOGGLE_AUTO_EDIT = 'toggleAutoEdit',
-  UNDO = 'undo',
-  REDO = 'redo',
-  MOVE_UP = 'moveUp',
-  MOVE_DOWN = 'moveDown',
-  MOVE_LEFT = 'moveLeft',
-  MOVE_RIGHT = 'moveRight',
-  MOVE_WORD_LEFT = 'moveWordLeft',
-  MOVE_WORD_RIGHT = 'moveWordRight',
-  DELETE_CHAR_LEFT = 'deleteCharLeft',
-  DELETE_CHAR_RIGHT = 'deleteCharRight',
-  DELETE_WORD_FORWARD = 'deleteWordForward',
-  QUIT = 'quit',
-  EXIT = 'exit',
-  SHOW_MORE_LINES = 'showMoreLines',
-
-  // Shell commands
-  REVERSE_SEARCH = 'reverseSearch',
-  SUBMIT_REVERSE_SEARCH = 'submitReverseSearch',
-  ACCEPT_SUGGESTION_REVERSE_SEARCH = 'acceptSuggestionReverseSearch',
-  FOCUS_SHELL_INPUT = 'focusShellInput',
-  UNFOCUS_SHELL_INPUT = 'unfocusShellInput',
-
-  // Suggestion expansion
-  EXPAND_SUGGESTION = 'expandSuggestion',
-  COLLAPSE_SUGGESTION = 'collapseSuggestion',
+  // App Controls
+  SHOW_ERROR_DETAILS = 'app.showErrorDetails',
+  SHOW_FULL_TODOS = 'app.showFullTodos',
+  SHOW_IDE_CONTEXT_DETAIL = 'app.showIdeContextDetail',
+  TOGGLE_MARKDOWN = 'app.toggleMarkdown',
+  TOGGLE_COPY_MODE = 'app.toggleCopyMode',
+  TOGGLE_YOLO = 'app.toggleYolo',
+  TOGGLE_AUTO_EDIT = 'app.toggleAutoEdit',
+  SHOW_MORE_LINES = 'app.showMoreLines',
+  FOCUS_SHELL_INPUT = 'app.focusShellInput',
+  UNFOCUS_SHELL_INPUT = 'app.unfocusShellInput',
+  CLEAR_SCREEN = 'app.clearScreen',
 }
 
 /**
@@ -117,24 +109,17 @@ export type KeyBindingConfig = {
  * Matches the original hard-coded logic exactly
  */
 export const defaultKeyBindings: KeyBindingConfig = {
-  // Basic bindings
+  // Basic Controls
   [Command.RETURN]: [{ key: 'return' }],
   [Command.ESCAPE]: [{ key: 'escape' }],
+  [Command.QUIT]: [{ key: 'c', ctrl: true }],
+  [Command.EXIT]: [{ key: 'd', ctrl: true }],
 
-  // Cursor movement
+  // Cursor Movement
   [Command.HOME]: [{ key: 'a', ctrl: true }, { key: 'home' }],
   [Command.END]: [{ key: 'e', ctrl: true }, { key: 'end' }],
-
-  // Text deletion
-  [Command.KILL_LINE_RIGHT]: [{ key: 'k', ctrl: true }],
-  [Command.KILL_LINE_LEFT]: [{ key: 'u', ctrl: true }],
-  [Command.CLEAR_INPUT]: [{ key: 'c', ctrl: true }],
-  // Added command (meta/alt/option) for mac compatibility
-  [Command.DELETE_WORD_BACKWARD]: [
-    { key: 'backspace', ctrl: true },
-    { key: 'backspace', command: true },
-    { key: 'w', ctrl: true },
-  ],
+  [Command.MOVE_UP]: [{ key: 'up', ctrl: false, command: false }],
+  [Command.MOVE_DOWN]: [{ key: 'down', ctrl: false, command: false }],
   [Command.MOVE_LEFT]: [
     { key: 'left', ctrl: false, command: false },
     { key: 'b', ctrl: true },
@@ -143,8 +128,6 @@ export const defaultKeyBindings: KeyBindingConfig = {
     { key: 'right', ctrl: false, command: false },
     { key: 'f', ctrl: true },
   ],
-  [Command.MOVE_UP]: [{ key: 'up', ctrl: false, command: false }],
-  [Command.MOVE_DOWN]: [{ key: 'down', ctrl: false, command: false }],
   [Command.MOVE_WORD_LEFT]: [
     { key: 'left', ctrl: true },
     { key: 'left', command: true },
@@ -155,15 +138,25 @@ export const defaultKeyBindings: KeyBindingConfig = {
     { key: 'right', command: true },
     { key: 'f', command: true },
   ],
-  [Command.DELETE_CHAR_LEFT]: [{ key: 'backspace' }, { key: 'h', ctrl: true }],
-  [Command.DELETE_CHAR_RIGHT]: [{ key: 'delete' }, { key: 'd', ctrl: true }],
+
+  // Editing
+  [Command.KILL_LINE_RIGHT]: [{ key: 'k', ctrl: true }],
+  [Command.KILL_LINE_LEFT]: [{ key: 'u', ctrl: true }],
+  [Command.CLEAR_INPUT]: [{ key: 'c', ctrl: true }],
+  // Added command (meta/alt/option) for mac compatibility
+  [Command.DELETE_WORD_BACKWARD]: [
+    { key: 'backspace', ctrl: true },
+    { key: 'backspace', command: true },
+    { key: 'w', ctrl: true },
+  ],
   [Command.DELETE_WORD_FORWARD]: [
     { key: 'delete', ctrl: true },
     { key: 'delete', command: true },
   ],
-
-  // Screen control
-  [Command.CLEAR_SCREEN]: [{ key: 'l', ctrl: true }],
+  [Command.DELETE_CHAR_LEFT]: [{ key: 'backspace' }, { key: 'h', ctrl: true }],
+  [Command.DELETE_CHAR_RIGHT]: [{ key: 'delete' }, { key: 'd', ctrl: true }],
+  [Command.UNDO]: [{ key: 'z', ctrl: true, shift: false }],
+  [Command.REDO]: [{ key: 'z', ctrl: true, shift: true }],
 
   // Scrolling
   [Command.SCROLL_UP]: [{ key: 'up', shift: true }],
@@ -173,13 +166,17 @@ export const defaultKeyBindings: KeyBindingConfig = {
   [Command.PAGE_UP]: [{ key: 'pageup' }],
   [Command.PAGE_DOWN]: [{ key: 'pagedown' }],
 
-  // History navigation
+  // History & Search
   [Command.HISTORY_UP]: [{ key: 'p', ctrl: true, shift: false }],
   [Command.HISTORY_DOWN]: [{ key: 'n', ctrl: true, shift: false }],
+  [Command.REVERSE_SEARCH]: [{ key: 'r', ctrl: true }],
+  // Note: original logic ONLY checked ctrl=false, ignored meta/shift/paste
+  [Command.SUBMIT_REVERSE_SEARCH]: [{ key: 'return', ctrl: false }],
+  [Command.ACCEPT_SUGGESTION_REVERSE_SEARCH]: [{ key: 'tab' }],
+
+  // Navigation
   [Command.NAVIGATION_UP]: [{ key: 'up', shift: false }],
   [Command.NAVIGATION_DOWN]: [{ key: 'down', shift: false }],
-
-  // Dialog navigation
   // Navigation shortcuts appropriate for dialogs where we do not need to accept
   // text input.
   [Command.DIALOG_NAVIGATION_UP]: [
@@ -191,7 +188,7 @@ export const defaultKeyBindings: KeyBindingConfig = {
     { key: 'j', shift: false },
   ],
 
-  // Auto-completion
+  // Suggestions & Completions
   [Command.ACCEPT_SUGGESTION]: [{ key: 'tab' }, { key: 'return', ctrl: false }],
   // Completion navigation (arrow or Ctrl+P/N)
   [Command.COMPLETION_UP]: [
@@ -202,8 +199,10 @@ export const defaultKeyBindings: KeyBindingConfig = {
     { key: 'down', shift: false },
     { key: 'n', ctrl: true, shift: false },
   ],
+  [Command.EXPAND_SUGGESTION]: [{ key: 'right' }],
+  [Command.COLLAPSE_SUGGESTION]: [{ key: 'left' }],
 
-  // Text input
+  // Text Input
   // Must also exclude shift to allow shift+enter for newline
   [Command.SUBMIT]: [
     {
@@ -221,15 +220,13 @@ export const defaultKeyBindings: KeyBindingConfig = {
     { key: 'return', shift: true },
     { key: 'j', ctrl: true },
   ],
-
-  // External tools
   [Command.OPEN_EXTERNAL_EDITOR]: [{ key: 'x', ctrl: true }],
   [Command.PASTE_CLIPBOARD]: [
     { key: 'v', ctrl: true },
     { key: 'v', command: true },
   ],
 
-  // App level bindings
+  // App Controls
   [Command.SHOW_ERROR_DETAILS]: [{ key: 'f12' }],
   [Command.SHOW_FULL_TODOS]: [{ key: 't', ctrl: true }],
   [Command.SHOW_IDE_CONTEXT_DETAIL]: [{ key: 'g', ctrl: true }],
@@ -237,22 +234,10 @@ export const defaultKeyBindings: KeyBindingConfig = {
   [Command.TOGGLE_COPY_MODE]: [{ key: 's', ctrl: true }],
   [Command.TOGGLE_YOLO]: [{ key: 'y', ctrl: true }],
   [Command.TOGGLE_AUTO_EDIT]: [{ key: 'tab', shift: true }],
-  [Command.UNDO]: [{ key: 'z', ctrl: true, shift: false }],
-  [Command.REDO]: [{ key: 'z', ctrl: true, shift: true }],
-  [Command.QUIT]: [{ key: 'c', ctrl: true }],
-  [Command.EXIT]: [{ key: 'd', ctrl: true }],
   [Command.SHOW_MORE_LINES]: [{ key: 's', ctrl: true }],
-
-  // Shell commands
-  [Command.REVERSE_SEARCH]: [{ key: 'r', ctrl: true }],
-  // Note: original logic ONLY checked ctrl=false, ignored meta/shift/paste
-  [Command.SUBMIT_REVERSE_SEARCH]: [{ key: 'return', ctrl: false }],
-  [Command.ACCEPT_SUGGESTION_REVERSE_SEARCH]: [{ key: 'tab' }],
   [Command.FOCUS_SHELL_INPUT]: [{ key: 'tab', shift: false }],
   [Command.UNFOCUS_SHELL_INPUT]: [{ key: 'tab' }],
-  // Suggestion expansion
-  [Command.EXPAND_SUGGESTION]: [{ key: 'right' }],
-  [Command.COLLAPSE_SUGGESTION]: [{ key: 'left' }],
+  [Command.CLEAR_SCREEN]: [{ key: 'l', ctrl: true }],
 };
 
 interface CommandCategory {
@@ -266,7 +251,7 @@ interface CommandCategory {
 export const commandCategories: readonly CommandCategory[] = [
   {
     title: 'Basic Controls',
-    commands: [Command.RETURN, Command.ESCAPE],
+    commands: [Command.RETURN, Command.ESCAPE, Command.QUIT, Command.EXIT],
   },
   {
     title: 'Cursor Movement',
@@ -295,10 +280,6 @@ export const commandCategories: readonly CommandCategory[] = [
       Command.REDO,
     ],
   },
-  {
-    title: 'Screen Control',
-    commands: [Command.CLEAR_SCREEN],
-  },
   {
     title: 'Scrolling',
     commands: [
@@ -341,11 +322,12 @@ export const commandCategories: readonly CommandCategory[] = [
   },
   {
     title: 'Text Input',
-    commands: [Command.SUBMIT, Command.NEWLINE],
-  },
-  {
-    title: 'External Tools',
-    commands: [Command.OPEN_EXTERNAL_EDITOR, Command.PASTE_CLIPBOARD],
+    commands: [
+      Command.SUBMIT,
+      Command.NEWLINE,
+      Command.OPEN_EXTERNAL_EDITOR,
+      Command.PASTE_CLIPBOARD,
+    ],
   },
   {
     title: 'App Controls',
@@ -360,28 +342,33 @@ export const commandCategories: readonly CommandCategory[] = [
       Command.SHOW_MORE_LINES,
       Command.FOCUS_SHELL_INPUT,
       Command.UNFOCUS_SHELL_INPUT,
+      Command.CLEAR_SCREEN,
     ],
   },
-  {
-    title: 'Session Control',
-    commands: [Command.QUIT, Command.EXIT],
-  },
 ];
 
 /**
  * Human-readable descriptions for each command, used in docs/tooling.
  */
 export const commandDescriptions: Readonly<Record<Command, string>> = {
+  // Basic Controls
   [Command.RETURN]: 'Confirm the current selection or choice.',
   [Command.ESCAPE]: 'Dismiss dialogs or cancel the current focus.',
+  [Command.QUIT]:
+    'Cancel the current request or quit the CLI when input is empty.',
+  [Command.EXIT]: 'Exit the CLI when the input buffer is empty.',
+
+  // Cursor Movement
   [Command.HOME]: 'Move the cursor to the start of the line.',
   [Command.END]: 'Move the cursor to the end of the line.',
-  [Command.MOVE_LEFT]: 'Move the cursor one character to the left.',
-  [Command.MOVE_RIGHT]: 'Move the cursor one character to the right.',
   [Command.MOVE_UP]: 'Move the cursor up one line.',
   [Command.MOVE_DOWN]: 'Move the cursor down one line.',
+  [Command.MOVE_LEFT]: 'Move the cursor one character to the left.',
+  [Command.MOVE_RIGHT]: 'Move the cursor one character to the right.',
   [Command.MOVE_WORD_LEFT]: 'Move the cursor one word to the left.',
   [Command.MOVE_WORD_RIGHT]: 'Move the cursor one word to the right.',
+
+  // Editing
   [Command.KILL_LINE_RIGHT]: 'Delete from the cursor to the end of the line.',
   [Command.KILL_LINE_LEFT]: 'Delete from the cursor to the start of the line.',
   [Command.CLEAR_INPUT]: 'Clear all text in the input field.',
@@ -391,45 +378,54 @@ export const commandDescriptions: Readonly<Record<Command, string>> = {
   [Command.DELETE_CHAR_RIGHT]: 'Delete the character to the right.',
   [Command.UNDO]: 'Undo the most recent text edit.',
   [Command.REDO]: 'Redo the most recent undone text edit.',
-  [Command.CLEAR_SCREEN]: 'Clear the terminal screen and redraw the UI.',
+
+  // Scrolling
   [Command.SCROLL_UP]: 'Scroll content up.',
   [Command.SCROLL_DOWN]: 'Scroll content down.',
   [Command.SCROLL_HOME]: 'Scroll to the top.',
   [Command.SCROLL_END]: 'Scroll to the bottom.',
   [Command.PAGE_UP]: 'Scroll up by one page.',
   [Command.PAGE_DOWN]: 'Scroll down by one page.',
+
+  // History & Search
   [Command.HISTORY_UP]: 'Show the previous entry in history.',
   [Command.HISTORY_DOWN]: 'Show the next entry in history.',
+  [Command.REVERSE_SEARCH]: 'Start reverse search through history.',
+  [Command.SUBMIT_REVERSE_SEARCH]: 'Submit the selected reverse-search match.',
+  [Command.ACCEPT_SUGGESTION_REVERSE_SEARCH]:
+    'Accept a suggestion while reverse searching.',
+
+  // Navigation
   [Command.NAVIGATION_UP]: 'Move selection up in lists.',
   [Command.NAVIGATION_DOWN]: 'Move selection down in lists.',
   [Command.DIALOG_NAVIGATION_UP]: 'Move up within dialog options.',
   [Command.DIALOG_NAVIGATION_DOWN]: 'Move down within dialog options.',
+
+  // Suggestions & Completions
   [Command.ACCEPT_SUGGESTION]: 'Accept the inline suggestion.',
   [Command.COMPLETION_UP]: 'Move to the previous completion option.',
   [Command.COMPLETION_DOWN]: 'Move to the next completion option.',
+  [Command.EXPAND_SUGGESTION]: 'Expand an inline suggestion.',
+  [Command.COLLAPSE_SUGGESTION]: 'Collapse an inline suggestion.',
+
+  // Text Input
   [Command.SUBMIT]: 'Submit the current prompt.',
   [Command.NEWLINE]: 'Insert a newline without submitting.',
   [Command.OPEN_EXTERNAL_EDITOR]:
     'Open the current prompt in an external editor.',
   [Command.PASTE_CLIPBOARD]: 'Paste from the clipboard.',
+
+  // App Controls
   [Command.SHOW_ERROR_DETAILS]: 'Toggle detailed error information.',
   [Command.SHOW_FULL_TODOS]: 'Toggle the full TODO list.',
   [Command.SHOW_IDE_CONTEXT_DETAIL]: 'Show IDE context details.',
   [Command.TOGGLE_MARKDOWN]: 'Toggle Markdown rendering.',
-  [Command.TOGGLE_COPY_MODE]:
-    'Toggle copy mode when the terminal is using the alternate buffer.',
+  [Command.TOGGLE_COPY_MODE]: 'Toggle copy mode when in alternate buffer mode.',
   [Command.TOGGLE_YOLO]: 'Toggle YOLO (auto-approval) mode for tool calls.',
   [Command.TOGGLE_AUTO_EDIT]: 'Toggle Auto Edit (auto-accept edits) mode.',
-  [Command.QUIT]: 'Cancel the current request or quit the CLI.',
-  [Command.EXIT]: 'Exit the CLI when the input buffer is empty.',
   [Command.SHOW_MORE_LINES]:
-    'Expand a height-constrained response to show additional lines.',
-  [Command.REVERSE_SEARCH]: 'Start reverse search through history.',
-  [Command.SUBMIT_REVERSE_SEARCH]: 'Submit the selected reverse-search match.',
-  [Command.ACCEPT_SUGGESTION_REVERSE_SEARCH]:
-    'Accept a suggestion while reverse searching.',
+    'Expand a height-constrained response to show additional lines when not in alternate buffer mode.',
   [Command.FOCUS_SHELL_INPUT]: 'Focus the shell input from the gemini input.',
   [Command.UNFOCUS_SHELL_INPUT]: 'Focus the Gemini input from the shell input.',
-  [Command.EXPAND_SUGGESTION]: 'Expand an inline suggestion.',
-  [Command.COLLAPSE_SUGGESTION]: 'Collapse an inline suggestion.',
+  [Command.CLEAR_SCREEN]: 'Clear the terminal screen and redraw the UI.',
 };
diff --git a/packages/cli/src/config/policy-engine.integration.test.ts b/packages/cli/src/config/policy-engine.integration.test.ts
index e9a94836cf..422ca92aad 100644
--- a/packages/cli/src/config/policy-engine.integration.test.ts
+++ b/packages/cli/src/config/policy-engine.integration.test.ts
@@ -287,6 +287,43 @@ describe('Policy Engine Integration Tests', () => {
       ).toBe(PolicyDecision.ASK_USER);
     });
 
+    it('should handle Plan mode correctly', async () => {
+      const settings: Settings = {};
+
+      const config = await createPolicyEngineConfig(
+        settings,
+        ApprovalMode.PLAN,
+      );
+      const engine = new PolicyEngine(config);
+
+      // Read and search tools should be allowed
+      expect(
+        (await engine.check({ name: 'read_file' }, undefined)).decision,
+      ).toBe(PolicyDecision.ALLOW);
+      expect(
+        (await engine.check({ name: 'google_web_search' }, undefined)).decision,
+      ).toBe(PolicyDecision.ALLOW);
+      expect(
+        (await engine.check({ name: 'list_directory' }, undefined)).decision,
+      ).toBe(PolicyDecision.ALLOW);
+
+      // Other tools should be denied via catch all
+      expect(
+        (await engine.check({ name: 'replace' }, undefined)).decision,
+      ).toBe(PolicyDecision.DENY);
+      expect(
+        (await engine.check({ name: 'write_file' }, undefined)).decision,
+      ).toBe(PolicyDecision.DENY);
+      expect(
+        (await engine.check({ name: 'run_shell_command' }, undefined)).decision,
+      ).toBe(PolicyDecision.DENY);
+
+      // Unknown tools should be denied via catch-all
+      expect(
+        (await engine.check({ name: 'unknown_tool' }, undefined)).decision,
+      ).toBe(PolicyDecision.DENY);
+    });
+
     it('should verify priority ordering works correctly in practice', async () => {
       const settings: Settings = {
         tools: {
diff --git a/packages/cli/src/config/settings.ts b/packages/cli/src/config/settings.ts
index 07cd457785..a7bbd76ca6 100644
--- a/packages/cli/src/config/settings.ts
+++ b/packages/cli/src/config/settings.ts
@@ -24,12 +24,24 @@ import { DefaultDark } from '../ui/themes/default.js';
 import { isWorkspaceTrusted } from './trustedFolders.js';
 import {
   type Settings,
+  type MergedSettings,
   type MemoryImportFormat,
   type MergeStrategy,
   type SettingsSchema,
   type SettingDefinition,
   getSettingsSchema,
 } from './settingsSchema.js';
+
+export {
+  type Settings,
+  type MergedSettings,
+  type MemoryImportFormat,
+  type MergeStrategy,
+  type SettingsSchema,
+  type SettingDefinition,
+  getSettingsSchema,
+};
+
 import { resolveEnvVarsInObject } from '../utils/envVarResolver.js';
 import { customDeepMerge } from '../utils/deepMerge.js';
 import { updateSettingsFilePreservingFormat } from '../utils/commentJson.js';
@@ -59,8 +71,6 @@ function getMergeStrategyForPath(path: string[]): MergeStrategy | undefined {
   return current?.mergeStrategy;
 }
 
-export type { Settings, MemoryImportFormat };
-
 export const USER_SETTINGS_PATH = Storage.getGlobalSettingsPath();
 export const USER_SETTINGS_DIR = path.dirname(USER_SETTINGS_PATH);
 export const DEFAULT_EXCLUDED_ENV_VARS = ['DEBUG', 'DEBUG_MODE'];
@@ -201,10 +211,7 @@ export function getDefaultsFromSchema(
   for (const key in schema) {
     const definition = schema[key];
     if (definition.properties) {
-      const childDefaults = getDefaultsFromSchema(definition.properties);
-      if (Object.keys(childDefaults).length > 0) {
-        defaults[key] = childDefaults;
-      }
+      defaults[key] = getDefaultsFromSchema(definition.properties);
     } else if (definition.default !== undefined) {
       defaults[key] = definition.default;
     }
@@ -212,13 +219,13 @@ export function getDefaultsFromSchema(
   return defaults as Settings;
 }
 
-function mergeSettings(
+export function mergeSettings(
   system: Settings,
   systemDefaults: Settings,
   user: Settings,
   workspace: Settings,
   isTrusted: boolean,
-): Settings {
+): MergedSettings {
   const safeWorkspace = isTrusted ? workspace : ({} as Settings);
   const schemaDefaults = getDefaultsFromSchema();
 
@@ -236,7 +243,24 @@ function mergeSettings(
     user,
     safeWorkspace,
     system,
-  ) as Settings;
+  ) as MergedSettings;
+}
+
+/**
+ * Creates a fully populated MergedSettings object for testing purposes.
+ * It merges the provided overrides with the default settings from the schema.
+ *
+ * @param overrides Partial settings to override the defaults.
+ * @returns A complete MergedSettings object.
+ */
+export function createTestMergedSettings(
+  overrides: Partial<Settings> = {},
+): MergedSettings {
+  return customDeepMerge(
+    getMergeStrategyForPath,
+    getDefaultsFromSchema(),
+    overrides,
+  ) as MergedSettings;
 }
 
 export class LoadedSettings {
@@ -264,14 +288,14 @@ export class LoadedSettings {
   readonly isTrusted: boolean;
   readonly errors: SettingsError[];
 
-  private _merged: Settings;
+  private _merged: MergedSettings;
   private _remoteAdminSettings: Partial<Settings> | undefined;
 
-  get merged(): Settings {
+  get merged(): MergedSettings {
     return this._merged;
   }
 
-  private computeMergedSettings(): Settings {
+  private computeMergedSettings(): MergedSettings {
     const merged = mergeSettings(
       this.system.settings,
       this.systemDefaults.settings,
@@ -293,7 +317,7 @@ export class LoadedSettings {
         (path: string[]) => getMergeStrategyForPath(['admin', ...path]),
         adminDefaults,
         this._remoteAdminSettings?.admin ?? {},
-      ) as Settings['admin'];
+      ) as MergedSettings['admin'];
     }
     return merged;
   }
diff --git a/packages/cli/src/config/settingsSchema.ts b/packages/cli/src/config/settingsSchema.ts
index b7d4cbb296..a9c49ce581 100644
--- a/packages/cli/src/config/settingsSchema.ts
+++ b/packages/cli/src/config/settingsSchema.ts
@@ -14,6 +14,7 @@ import type {
   BugCommandSettings,
   TelemetrySettings,
   AuthType,
+  AgentOverride,
 } from '@google/gemini-cli-core';
 import {
   DEFAULT_TRUNCATE_TOOL_OUTPUT_LINES,
@@ -799,7 +800,7 @@ const SETTINGS_SCHEMA = {
         label: 'Agent Overrides',
         category: 'Advanced',
         requiresRestart: true,
-        default: {},
+        default: {} as Record<string, AgentOverride>,
         description:
           'Override settings for specific agents, e.g. to disable the agent, set a custom model config, or run config.',
         showInDialog: false,
@@ -2092,6 +2093,10 @@ export const SETTINGS_SCHEMA_DEFINITIONS: Record<
           },
         },
       },
+      enabled: {
+        type: 'boolean',
+        description: 'Whether to enable the agent.',
+      },
       disabled: {
         type: 'boolean',
         description: 'Whether to disable the agent.',
@@ -2262,12 +2267,17 @@ type InferSettings<T extends SettingsSchema> = {
         : T[K]['default'];
 };
 
+type InferMergedSettings<T extends SettingsSchema> = {
+  -readonly [K in keyof T]-?: T[K] extends { properties: SettingsSchema }
+    ? InferMergedSettings<T[K]['properties']>
+    : T[K]['type'] extends 'enum'
+      ? T[K]['options'] extends readonly SettingEnumOption[]
+        ? T[K]['options'][number]['value']
+        : T[K]['default']
+      : T[K]['default'] extends boolean
+        ? boolean
+        : T[K]['default'];
+};
+
 export type Settings = InferSettings<SettingsSchemaType>;
-
-export function getEnableHooksUI(settings: Settings): boolean {
-  return settings.tools?.enableHooks ?? true;
-}
-
-export function getEnableHooks(settings: Settings): boolean {
-  return getEnableHooksUI(settings) && (settings.hooks?.enabled ?? false);
-}
+export type MergedSettings = InferMergedSettings<SettingsSchemaType>;
diff --git a/packages/cli/src/core/initializer.test.ts b/packages/cli/src/core/initializer.test.ts
index 61a4b00422..57f1c41551 100644
--- a/packages/cli/src/core/initializer.test.ts
+++ b/packages/cli/src/core/initializer.test.ts
@@ -127,7 +127,7 @@ describe('initializer', () => {
   });
 
   it('should handle undefined auth type', async () => {
-    mockSettings.merged.security!.auth!.selectedType = undefined;
+    mockSettings.merged.security.auth.selectedType = undefined;
     const result = await initializeApp(
       mockConfig as unknown as Config,
       mockSettings,
diff --git a/packages/cli/src/core/initializer.ts b/packages/cli/src/core/initializer.ts
index 0ba76a989f..e99efd90f6 100644
--- a/packages/cli/src/core/initializer.ts
+++ b/packages/cli/src/core/initializer.ts
@@ -39,13 +39,13 @@ export async function initializeApp(
   const authHandle = startupProfiler.start('authenticate');
   const authError = await performInitialAuth(
     config,
-    settings.merged.security?.auth?.selectedType,
+    settings.merged.security.auth.selectedType,
   );
   authHandle?.end();
   const themeError = validateTheme(settings);
 
   const shouldOpenAuthDialog =
-    settings.merged.security?.auth?.selectedType === undefined || !!authError;
+    settings.merged.security.auth.selectedType === undefined || !!authError;
 
   logCliConfiguration(
     config,
diff --git a/packages/cli/src/core/theme.test.ts b/packages/cli/src/core/theme.test.ts
index fb57d2cde3..eb87a9ee10 100644
--- a/packages/cli/src/core/theme.test.ts
+++ b/packages/cli/src/core/theme.test.ts
@@ -46,7 +46,7 @@ describe('theme', () => {
   });
 
   it('should return null if theme is undefined', () => {
-    mockSettings.merged.ui!.theme = undefined;
+    mockSettings.merged.ui.theme = undefined;
     const result = validateTheme(mockSettings);
     expect(result).toBeNull();
     expect(themeManager.findThemeByName).not.toHaveBeenCalled();
diff --git a/packages/cli/src/core/theme.ts b/packages/cli/src/core/theme.ts
index ed2805a5ab..f0f58fdbba 100644
--- a/packages/cli/src/core/theme.ts
+++ b/packages/cli/src/core/theme.ts
@@ -13,7 +13,7 @@ import { type LoadedSettings } from '../config/settings.js';
  * @returns An error message if the theme is not found, otherwise null.
  */
 export function validateTheme(settings: LoadedSettings): string | null {
-  const effectiveTheme = settings.merged.ui?.theme;
+  const effectiveTheme = settings.merged.ui.theme;
   if (effectiveTheme && !themeManager.findThemeByName(effectiveTheme)) {
     return `Theme "${effectiveTheme}" not found.`;
   }
diff --git a/packages/cli/src/gemini.test.tsx b/packages/cli/src/gemini.test.tsx
index 9619035b0d..896f89e3c8 100644
--- a/packages/cli/src/gemini.test.tsx
+++ b/packages/cli/src/gemini.test.tsx
@@ -23,8 +23,30 @@ import {
 import os from 'node:os';
 import v8 from 'node:v8';
 import { type CliArgs } from './config/config.js';
-import { type LoadedSettings } from './config/settings.js';
+import {
+  type LoadedSettings,
+  type Settings,
+  createTestMergedSettings,
+} from './config/settings.js';
 import { appEvents, AppEvent } from './utils/events.js';
+
+function createMockSettings(
+  overrides: Record<string, unknown> = {},
+): LoadedSettings {
+  const merged = createTestMergedSettings(
+    (overrides['merged'] as Partial<Settings>) || {},
+  );
+
+  return {
+    system: { settings: {} },
+    systemDefaults: { settings: {} },
+    user: { settings: {} },
+    workspace: { settings: {} },
+    errors: [],
+    ...overrides,
+    merged,
+  } as unknown as LoadedSettings;
+}
 import {
   type Config,
   type ResumedSessionData,
@@ -108,26 +130,19 @@ class MockProcessExitError extends Error {
 }
 
 // Mock dependencies
-vi.mock('./config/settings.js', () => ({
-  loadSettings: vi.fn().mockReturnValue({
-    merged: {
-      advanced: {},
-      security: { auth: {} },
-      ui: {},
-    },
-    workspace: { settings: {} },
-    setValue: vi.fn(),
-    forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
-    errors: [],
-  }),
-  migrateDeprecatedSettings: vi.fn(),
-  SettingScope: {
-    User: 'user',
-    Workspace: 'workspace',
-    System: 'system',
-    SystemDefaults: 'system-defaults',
-  },
-}));
+vi.mock('./config/settings.js', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('./config/settings.js')>();
+  return {
+    ...actual,
+    loadSettings: vi.fn().mockImplementation(() => ({
+      merged: actual.getDefaultsFromSchema(),
+      workspace: { settings: {} },
+      errors: [],
+    })),
+    saveModelChange: vi.fn(),
+    getDefaultsFromSchema: actual.getDefaultsFromSchema,
+  };
+});
 
 vi.mock('./ui/utils/terminalCapabilityManager.js', () => ({
   terminalCapabilityManager: {
@@ -443,17 +458,15 @@ describe('gemini.tsx main function kitty protocol', () => {
         getProjectTempDir: vi.fn().mockReturnValue('/tmp/gemini-test'),
       },
     } as unknown as Config);
-    vi.mocked(loadSettings).mockReturnValue({
-      errors: [],
-      merged: {
-        advanced: {},
-        security: { auth: {} },
-        ui: {},
-      },
-      workspace: { settings: {} },
-      setValue: vi.fn(),
-      forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
-    } as never);
+    vi.mocked(loadSettings).mockReturnValue(
+      createMockSettings({
+        merged: {
+          advanced: {},
+          security: { auth: {} },
+          ui: {},
+        },
+      }),
+    );
     vi.mocked(parseArguments).mockResolvedValue({
       model: undefined,
       sandbox: undefined,
@@ -505,17 +518,18 @@ describe('gemini.tsx main function kitty protocol', () => {
         throw new MockProcessExitError(code);
       });
 
-    vi.mocked(loadSettings).mockReturnValue({
-      merged: {
-        advanced: {},
-        security: { auth: {} },
-        ui: {},
-      },
-      workspace: { settings: {} },
-      setValue: vi.fn(),
-      forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
-      errors: [],
-    } as any); // eslint-disable-line @typescript-eslint/no-explicit-any
+    vi.mocked(loadSettings).mockReturnValue(
+      createMockSettings({
+        merged: {
+          advanced: {},
+          security: { auth: {} },
+          ui: {},
+        },
+        workspace: { settings: {} },
+        setValue: vi.fn(),
+        forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
+      }),
+    );
 
     vi.mocked(parseArguments).mockResolvedValue({
       promptInteractive: false,
@@ -594,17 +608,18 @@ describe('gemini.tsx main function kitty protocol', () => {
       promptInteractive: false,
     } as any); // eslint-disable-line @typescript-eslint/no-explicit-any
 
-    vi.mocked(loadSettings).mockReturnValue({
-      merged: {
-        advanced: {},
-        security: { auth: {} },
-        ui: {},
-      },
-      workspace: { settings: {} },
-      setValue: vi.fn(),
-      forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
-      errors: [],
-    } as any); // eslint-disable-line @typescript-eslint/no-explicit-any
+    vi.mocked(loadSettings).mockReturnValue(
+      createMockSettings({
+        merged: {
+          advanced: {},
+          security: { auth: {} },
+          ui: {},
+        },
+        workspace: { settings: {} },
+        setValue: vi.fn(),
+        forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
+      }),
+    );
 
     const mockConfig = {
       isInteractive: () => false,
@@ -665,17 +680,18 @@ describe('gemini.tsx main function kitty protocol', () => {
         throw new MockProcessExitError(code);
       });
 
-    vi.mocked(loadSettings).mockReturnValue({
-      merged: {
-        advanced: {},
-        security: { auth: {} },
-        ui: { theme: 'non-existent-theme' },
-      },
-      workspace: { settings: {} },
-      setValue: vi.fn(),
-      forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
-      errors: [],
-    } as any); // eslint-disable-line @typescript-eslint/no-explicit-any
+    vi.mocked(loadSettings).mockReturnValue(
+      createMockSettings({
+        merged: {
+          advanced: {},
+          security: { auth: {} },
+          ui: { theme: 'non-existent-theme' },
+        },
+        workspace: { settings: {} },
+        setValue: vi.fn(),
+        forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
+      }),
+    );
 
     vi.mocked(parseArguments).mockResolvedValue({
       promptInteractive: false,
@@ -753,13 +769,14 @@ describe('gemini.tsx main function kitty protocol', () => {
       });
     const emitFeedbackSpy = vi.spyOn(coreEvents, 'emitFeedback');
 
-    vi.mocked(loadSettings).mockReturnValue({
-      merged: { advanced: {}, security: { auth: {} }, ui: { theme: 'test' } },
-      workspace: { settings: {} },
-      setValue: vi.fn(),
-      forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
-      errors: [],
-    } as any); // eslint-disable-line @typescript-eslint/no-explicit-any
+    vi.mocked(loadSettings).mockReturnValue(
+      createMockSettings({
+        merged: { advanced: {}, security: { auth: {} }, ui: { theme: 'test' } },
+        workspace: { settings: {} },
+        setValue: vi.fn(),
+        forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
+      }),
+    );
 
     vi.mocked(parseArguments).mockResolvedValue({
       promptInteractive: false,
@@ -839,13 +856,14 @@ describe('gemini.tsx main function kitty protocol', () => {
         throw new MockProcessExitError(code);
       });
 
-    vi.mocked(loadSettings).mockReturnValue({
-      merged: { advanced: {}, security: { auth: {} }, ui: {} },
-      workspace: { settings: {} },
-      setValue: vi.fn(),
-      forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
-      errors: [],
-    } as any); // eslint-disable-line @typescript-eslint/no-explicit-any
+    vi.mocked(loadSettings).mockReturnValue(
+      createMockSettings({
+        merged: { advanced: {}, security: { auth: {} }, ui: {} },
+        workspace: { settings: {} },
+        setValue: vi.fn(),
+        forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
+      }),
+    );
 
     vi.mocked(parseArguments).mockResolvedValue({
       promptInteractive: false,
@@ -918,13 +936,14 @@ describe('gemini.tsx main function kitty protocol', () => {
         throw new MockProcessExitError(code);
       });
 
-    vi.mocked(loadSettings).mockReturnValue({
-      merged: { advanced: {}, security: { auth: {} }, ui: {} },
-      workspace: { settings: {} },
-      setValue: vi.fn(),
-      forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
-      errors: [],
-    } as any); // eslint-disable-line @typescript-eslint/no-explicit-any
+    vi.mocked(loadSettings).mockReturnValue(
+      createMockSettings({
+        merged: { advanced: {}, security: { auth: {} }, ui: {} },
+        workspace: { settings: {} },
+        setValue: vi.fn(),
+        forScope: () => ({ settings: {}, originalSettings: {}, path: '' }),
+      }),
+    );
 
     vi.mocked(parseArguments).mockResolvedValue({
       promptInteractive: false,
@@ -1034,10 +1053,11 @@ describe('gemini.tsx main function exit codes', () => {
     );
     const { loadSettings } = await import('./config/settings.js');
     vi.mocked(loadCliConfig).mockResolvedValue({} as Config);
-    vi.mocked(loadSettings).mockReturnValue({
-      merged: { security: { auth: {} }, ui: {} },
-      errors: [],
-    } as never);
+    vi.mocked(loadSettings).mockReturnValue(
+      createMockSettings({
+        merged: { security: { auth: {} }, ui: {} },
+      }),
+    );
     vi.mocked(parseArguments).mockResolvedValue({
       promptInteractive: true,
     } as unknown as CliArgs);
@@ -1066,14 +1086,13 @@ describe('gemini.tsx main function exit codes', () => {
     vi.mocked(loadCliConfig).mockResolvedValue({
       refreshAuth: vi.fn().mockRejectedValue(new Error('Auth failed')),
     } as unknown as Config);
-    vi.mocked(loadSettings).mockReturnValue({
-      merged: {
-        security: { auth: { selectedType: 'google', useExternal: false } },
-        ui: {},
-      },
-      workspace: { settings: {} },
-      errors: [],
-    } as never);
+    vi.mocked(loadSettings).mockReturnValue(
+      createMockSettings({
+        merged: {
+          security: { auth: { selectedType: 'google', useExternal: false } },
+        },
+      }),
+    );
     vi.mocked(parseArguments).mockResolvedValue({} as unknown as CliArgs);
     vi.mock('./config/auth.js', () => ({
       validateAuthMethod: vi.fn().mockReturnValue(null),
@@ -1131,11 +1150,11 @@ describe('gemini.tsx main function exit codes', () => {
         getProjectTempDir: vi.fn().mockReturnValue('/tmp/gemini-test'),
       },
     } as unknown as Config);
-    vi.mocked(loadSettings).mockReturnValue({
-      merged: { security: { auth: {} }, ui: {} },
-      workspace: { settings: {} },
-      errors: [],
-    } as never);
+    vi.mocked(loadSettings).mockReturnValue(
+      createMockSettings({
+        merged: { security: { auth: {} }, ui: {} },
+      }),
+    );
     vi.mocked(parseArguments).mockResolvedValue({
       resume: 'invalid-session',
     } as unknown as CliArgs);
@@ -1200,11 +1219,11 @@ describe('gemini.tsx main function exit codes', () => {
       },
       getRemoteAdminSettings: () => undefined,
     } as unknown as Config);
-    vi.mocked(loadSettings).mockReturnValue({
-      merged: { security: { auth: {} }, ui: {} },
-      workspace: { settings: {} },
-      errors: [],
-    } as never);
+    vi.mocked(loadSettings).mockReturnValue(
+      createMockSettings({
+        merged: { security: { auth: {} }, ui: {} },
+      }),
+    );
     vi.mocked(parseArguments).mockResolvedValue({} as unknown as CliArgs);
     Object.defineProperty(process.stdin, 'isTTY', {
       value: true, // Simulate TTY so it doesn't try to read stdin
diff --git a/packages/cli/src/gemini.tsx b/packages/cli/src/gemini.tsx
index 3f808c20b7..36411feae5 100644
--- a/packages/cli/src/gemini.tsx
+++ b/packages/cli/src/gemini.tsx
@@ -213,12 +213,12 @@ export async function startInteractiveUI(
       <SettingsContext.Provider value={settings}>
         <KeypressProvider
           config={config}
-          debugKeystrokeLogging={settings.merged.general?.debugKeystrokeLogging}
+          debugKeystrokeLogging={settings.merged.general.debugKeystrokeLogging}
         >
           <MouseProvider
             mouseEventsEnabled={mouseEventsEnabled}
             debugKeystrokeLogging={
-              settings.merged.general?.debugKeystrokeLogging
+              settings.merged.general.debugKeystrokeLogging
             }
           >
             <ScrollProvider>
@@ -263,8 +263,7 @@ export async function startInteractiveUI(
       patchConsole: false,
       alternateBuffer: useAlternateBuffer,
       incrementalRendering:
-        settings.merged.ui?.incrementalRendering !== false &&
-        useAlternateBuffer,
+        settings.merged.ui.incrementalRendering !== false && useAlternateBuffer,
     },
   );
 
@@ -336,13 +335,13 @@ export async function main() {
   registerCleanup(consolePatcher.cleanup);
 
   dns.setDefaultResultOrder(
-    validateDnsResolutionOrder(settings.merged.advanced?.dnsResolutionOrder),
+    validateDnsResolutionOrder(settings.merged.advanced.dnsResolutionOrder),
   );
 
   // Set a default auth type if one isn't set or is set to a legacy type
   if (
-    !settings.merged.security?.auth?.selectedType ||
-    settings.merged.security?.auth?.selectedType === AuthType.LEGACY_CLOUD_SHELL
+    !settings.merged.security.auth.selectedType ||
+    settings.merged.security.auth.selectedType === AuthType.LEGACY_CLOUD_SHELL
   ) {
     if (
       process.env['CLOUD_SHELL'] === 'true' ||
@@ -364,8 +363,8 @@ export async function main() {
   // the sandbox because the sandbox will interfere with the Oauth2 web
   // redirect.
   if (
-    settings.merged.security?.auth?.selectedType &&
-    !settings.merged.security?.auth?.useExternal
+    settings.merged.security.auth.selectedType &&
+    !settings.merged.security.auth.useExternal
   ) {
     try {
       if (partialConfig.isInteractive()) {
@@ -381,8 +380,8 @@ export async function main() {
         );
       } else {
         const authType = await validateNonInteractiveAuth(
-          settings.merged.security?.auth?.selectedType,
-          settings.merged.security?.auth?.useExternal,
+          settings.merged.security.auth.selectedType,
+          settings.merged.security.auth.useExternal,
           partialConfig,
           settings,
         );
@@ -403,7 +402,7 @@ export async function main() {
 
   // hop into sandbox if we are outside and sandboxing is enabled
   if (!process.env['SANDBOX']) {
-    const memoryArgs = settings.merged.advanced?.autoConfigureMemory
+    const memoryArgs = settings.merged.advanced.autoConfigureMemory
       ? getNodeMemoryArgs(isDebugMode)
       : [];
     const sandboxConfig = await loadSandboxConfig(settings.merged, argv);
@@ -506,7 +505,7 @@ export async function main() {
     // Handle --list-sessions flag
     if (config.getListSessions()) {
       // Attempt auth for summary generation (gracefully skips if not configured)
-      const authType = settings.merged.security?.auth?.selectedType;
+      const authType = settings.merged.security.auth.selectedType;
       if (authType) {
         try {
           await config.refreshAuth(authType);
@@ -566,7 +565,7 @@ export async function main() {
     initAppHandle?.end();
 
     if (
-      settings.merged.security?.auth?.selectedType ===
+      settings.merged.security.auth.selectedType ===
         AuthType.LOGIN_WITH_GOOGLE &&
       config.isBrowserLaunchSuppressed()
     ) {
@@ -678,8 +677,8 @@ export async function main() {
     );
 
     const authType = await validateNonInteractiveAuth(
-      settings.merged.security?.auth?.selectedType,
-      settings.merged.security?.auth?.useExternal,
+      settings.merged.security.auth.selectedType,
+      settings.merged.security.auth.useExternal,
       config,
       settings,
     );
@@ -705,14 +704,14 @@ export async function main() {
 }
 
 function setWindowTitle(title: string, settings: LoadedSettings) {
-  if (!settings.merged.ui?.hideWindowTitle) {
+  if (!settings.merged.ui.hideWindowTitle) {
     // Initial state before React loop starts
     const windowTitle = computeTerminalTitle({
       streamingState: StreamingState.Idle,
       isConfirming: false,
       folderName: title,
-      showThoughts: !!settings.merged.ui?.showStatusInTitle,
-      useDynamicTitle: settings.merged.ui?.dynamicWindowTitle ?? true,
+      showThoughts: !!settings.merged.ui.showStatusInTitle,
+      useDynamicTitle: settings.merged.ui.dynamicWindowTitle,
     });
     writeToStdout(`\x1b]0;${windowTitle}\x07`);
 
diff --git a/packages/cli/src/test-utils/mockCommandContext.ts b/packages/cli/src/test-utils/mockCommandContext.ts
index 37a0edcb19..63328b2a21 100644
--- a/packages/cli/src/test-utils/mockCommandContext.ts
+++ b/packages/cli/src/test-utils/mockCommandContext.ts
@@ -7,6 +7,7 @@
 import { vi } from 'vitest';
 import type { CommandContext } from '../ui/commands/types.js';
 import type { LoadedSettings } from '../config/settings.js';
+import { mergeSettings } from '../config/settings.js';
 import type { GitService } from '@google/gemini-cli-core';
 import type { SessionStatsState } from '../ui/contexts/SessionContext.js';
 
@@ -27,6 +28,8 @@ type DeepPartial<T> = T extends object
 export const createMockCommandContext = (
   overrides: DeepPartial<CommandContext> = {},
 ): CommandContext => {
+  const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
+
   const defaultMocks: CommandContext = {
     invocation: {
       raw: '',
@@ -35,7 +38,11 @@ export const createMockCommandContext = (
     },
     services: {
       config: null,
-      settings: { merged: {} } as LoadedSettings,
+      settings: {
+        merged: defaultMergedSettings,
+        setValue: vi.fn(),
+        forScope: vi.fn().mockReturnValue({ settings: {} }),
+      } as unknown as LoadedSettings,
       git: undefined as GitService | undefined,
       logger: {
         log: vi.fn(),
diff --git a/packages/cli/src/ui/App.test.tsx b/packages/cli/src/ui/App.test.tsx
index 695de98684..404bea4866 100644
--- a/packages/cli/src/ui/App.test.tsx
+++ b/packages/cli/src/ui/App.test.tsx
@@ -151,7 +151,7 @@ describe('App', () => {
       pendingHistoryItems: [{ type: 'user', text: 'pending item' }],
     } as UIState;
 
-    mockLoadedSettings.merged.ui = { useAlternateBuffer: true };
+    mockLoadedSettings.merged.ui.useAlternateBuffer = true;
 
     const { lastFrame } = renderWithProviders(<App />, quittingUIState);
 
@@ -159,7 +159,7 @@ describe('App', () => {
     expect(lastFrame()).toContain('Quitting...');
 
     // Reset settings
-    mockLoadedSettings.merged.ui = { useAlternateBuffer: false };
+    mockLoadedSettings.merged.ui.useAlternateBuffer = false;
   });
 
   it('should render dialog manager when dialogs are visible', () => {
diff --git a/packages/cli/src/ui/AppContainer.test.tsx b/packages/cli/src/ui/AppContainer.test.tsx
index 3dbf61c965..74ad2f35b1 100644
--- a/packages/cli/src/ui/AppContainer.test.tsx
+++ b/packages/cli/src/ui/AppContainer.test.tsx
@@ -82,7 +82,7 @@ vi.mock('@google/gemini-cli-core', async (importOriginal) => {
   };
 });
 import ansiEscapes from 'ansi-escapes';
-import type { LoadedSettings } from '../config/settings.js';
+import { type LoadedSettings, mergeSettings } from '../config/settings.js';
 import type { InitializationResult } from '../core/initializer.js';
 import { useQuotaAndFallback } from './hooks/useQuotaAndFallback.js';
 import { UIStateContext, type UIState } from './contexts/UIStateContext.js';
@@ -380,14 +380,17 @@ describe('AppContainer State Management', () => {
     );
 
     // Mock LoadedSettings
+    const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
     mockSettings = {
       merged: {
+        ...defaultMergedSettings,
         hideBanner: false,
         hideFooter: false,
         hideTips: false,
         showMemoryUsage: false,
         theme: 'default',
         ui: {
+          ...defaultMergedSettings.ui,
           showStatusInTitle: false,
           hideWindowTitle: false,
         },
@@ -507,8 +510,10 @@ describe('AppContainer State Management', () => {
 
   describe('Settings Integration', () => {
     it('handles settings with all display options disabled', async () => {
+      const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
       const settingsAllHidden = {
         merged: {
+          ...defaultMergedSettings,
           hideBanner: true,
           hideFooter: true,
           hideTips: true,
@@ -526,8 +531,10 @@ describe('AppContainer State Management', () => {
     });
 
     it('handles settings with memory usage enabled', async () => {
+      const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
       const settingsWithMemory = {
         merged: {
+          ...defaultMergedSettings,
           hideBanner: false,
           hideFooter: false,
           hideTips: false,
@@ -574,7 +581,7 @@ describe('AppContainer State Management', () => {
 
     it('handles undefined settings gracefully', async () => {
       const undefinedSettings = {
-        merged: {},
+        merged: mergeSettings({}, {}, {}, {}, true),
       } as LoadedSettings;
 
       let unmount: () => void;
@@ -991,12 +998,13 @@ describe('AppContainer State Management', () => {
 
     it('should update terminal title with Working… when showStatusInTitle is false', () => {
       // Arrange: Set up mock settings with showStatusInTitle disabled
+      const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
       const mockSettingsWithShowStatusFalse = {
         ...mockSettings,
         merged: {
-          ...mockSettings.merged,
+          ...defaultMergedSettings,
           ui: {
-            ...mockSettings.merged.ui,
+            ...defaultMergedSettings.ui,
             showStatusInTitle: false,
             hideWindowTitle: false,
           },
@@ -1073,12 +1081,13 @@ describe('AppContainer State Management', () => {
 
     it('should not update terminal title when hideWindowTitle is true', () => {
       // Arrange: Set up mock settings with hideWindowTitle enabled
+      const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
       const mockSettingsWithHideTitleTrue = {
         ...mockSettings,
         merged: {
-          ...mockSettings.merged,
+          ...defaultMergedSettings,
           ui: {
-            ...mockSettings.merged.ui,
+            ...defaultMergedSettings.ui,
             showStatusInTitle: true,
             hideWindowTitle: true,
           },
@@ -1101,12 +1110,13 @@ describe('AppContainer State Management', () => {
 
     it('should update terminal title with thought subject when in active state', () => {
       // Arrange: Set up mock settings with showStatusInTitle enabled
+      const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
       const mockSettingsWithTitleEnabled = {
         ...mockSettings,
         merged: {
-          ...mockSettings.merged,
+          ...defaultMergedSettings,
           ui: {
-            ...mockSettings.merged.ui,
+            ...defaultMergedSettings.ui,
             showStatusInTitle: true,
             hideWindowTitle: false,
           },
@@ -1143,12 +1153,13 @@ describe('AppContainer State Management', () => {
 
     it('should update terminal title with default text when in Idle state and no thought subject', () => {
       // Arrange: Set up mock settings with showStatusInTitle enabled
+      const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
       const mockSettingsWithTitleEnabled = {
         ...mockSettings,
         merged: {
-          ...mockSettings.merged,
+          ...defaultMergedSettings,
           ui: {
-            ...mockSettings.merged.ui,
+            ...defaultMergedSettings.ui,
             showStatusInTitle: true,
             hideWindowTitle: false,
           },
@@ -1184,12 +1195,13 @@ describe('AppContainer State Management', () => {
 
     it('should update terminal title when in WaitingForConfirmation state with thought subject', async () => {
       // Arrange: Set up mock settings with showStatusInTitle enabled
+      const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
       const mockSettingsWithTitleEnabled = {
         ...mockSettings,
         merged: {
-          ...mockSettings.merged,
+          ...defaultMergedSettings,
           ui: {
-            ...mockSettings.merged.ui,
+            ...defaultMergedSettings.ui,
             showStatusInTitle: true,
             hideWindowTitle: false,
           },
@@ -1392,12 +1404,13 @@ describe('AppContainer State Management', () => {
 
     it('should pad title to exactly 80 characters', () => {
       // Arrange: Set up mock settings with showStatusInTitle enabled
+      const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
       const mockSettingsWithTitleEnabled = {
         ...mockSettings,
         merged: {
-          ...mockSettings.merged,
+          ...defaultMergedSettings,
           ui: {
-            ...mockSettings.merged.ui,
+            ...defaultMergedSettings.ui,
             showStatusInTitle: true,
             hideWindowTitle: false,
           },
@@ -1435,12 +1448,13 @@ describe('AppContainer State Management', () => {
 
     it('should use correct ANSI escape code format', () => {
       // Arrange: Set up mock settings with showStatusInTitle enabled
+      const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
       const mockSettingsWithTitleEnabled = {
         ...mockSettings,
         merged: {
-          ...mockSettings.merged,
+          ...defaultMergedSettings,
           ui: {
-            ...mockSettings.merged.ui,
+            ...defaultMergedSettings.ui,
             showStatusInTitle: true,
             hideWindowTitle: false,
           },
@@ -1802,12 +1816,13 @@ describe('AppContainer State Management', () => {
 
     const setupCopyModeTest = async (isAlternateMode = false) => {
       // Update settings for this test run
+      const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
       const testSettings = {
         ...mockSettings,
         merged: {
-          ...mockSettings.merged,
+          ...defaultMergedSettings,
           ui: {
-            ...mockSettings.merged.ui,
+            ...defaultMergedSettings.ui,
             useAlternateBuffer: isAlternateMode,
           },
         },
diff --git a/packages/cli/src/ui/AppContainer.tsx b/packages/cli/src/ui/AppContainer.tsx
index 10f5a54a1c..46dd1a69c2 100644
--- a/packages/cli/src/ui/AppContainer.tsx
+++ b/packages/cli/src/ui/AppContainer.tsx
@@ -392,8 +392,8 @@ export const AppContainer = (props: AppContainerProps) => {
   }, []);
 
   const getPreferredEditor = useCallback(
-    () => settings.merged.general?.preferredEditor as EditorType,
-    [settings.merged.general?.preferredEditor],
+    () => settings.merged.general.preferredEditor as EditorType,
+    [settings.merged.general.preferredEditor],
   );
 
   const buffer = useTextBuffer({
@@ -443,7 +443,7 @@ export const AppContainer = (props: AppContainerProps) => {
 
   useEffect(() => {
     if (
-      !(settings.merged.ui?.hideBanner || config.getScreenReader()) &&
+      !(settings.merged.ui.hideBanner || config.getScreenReader()) &&
       bannerVisible &&
       bannerText
     ) {
@@ -603,17 +603,17 @@ Logging in with Google... Restarting Gemini CLI to continue.
   // Check for enforced auth type mismatch
   useEffect(() => {
     if (
-      settings.merged.security?.auth?.enforcedType &&
-      settings.merged.security?.auth.selectedType &&
-      settings.merged.security?.auth.enforcedType !==
-        settings.merged.security?.auth.selectedType
+      settings.merged.security.auth.enforcedType &&
+      settings.merged.security.auth.selectedType &&
+      settings.merged.security.auth.enforcedType !==
+        settings.merged.security.auth.selectedType
     ) {
       onAuthError(
-        `Authentication is enforced to be ${settings.merged.security?.auth.enforcedType}, but you are currently using ${settings.merged.security?.auth.selectedType}.`,
+        `Authentication is enforced to be ${settings.merged.security.auth.enforcedType}, but you are currently using ${settings.merged.security.auth.selectedType}.`,
       );
     } else if (
-      settings.merged.security?.auth?.selectedType &&
-      !settings.merged.security?.auth?.useExternal
+      settings.merged.security.auth.selectedType &&
+      !settings.merged.security.auth.useExternal
     ) {
       // We skip validation for Gemini API key here because it might be stored
       // in the keychain, which we can't check synchronously.
@@ -630,9 +630,9 @@ Logging in with Google... Restarting Gemini CLI to continue.
       }
     }
   }, [
-    settings.merged.security?.auth?.selectedType,
-    settings.merged.security?.auth?.enforcedType,
-    settings.merged.security?.auth?.useExternal,
+    settings.merged.security.auth.selectedType,
+    settings.merged.security.auth.enforcedType,
+    settings.merged.security.auth.useExternal,
     onAuthError,
   ]);
 
@@ -951,8 +951,8 @@ Logging in with Google... Restarting Gemini CLI to continue.
       Math.floor(availableTerminalHeight - SHELL_HEIGHT_PADDING),
       1,
     ),
-    pager: settings.merged.tools?.shell?.pager,
-    showColor: settings.merged.tools?.shell?.showColor,
+    pager: settings.merged.tools.shell.pager,
+    showColor: settings.merged.tools.shell.showColor,
     sanitizationConfig: config.sanitizationConfig,
   });
 
@@ -960,13 +960,13 @@ Logging in with Google... Restarting Gemini CLI to continue.
 
   // Context file names computation
   const contextFileNames = useMemo(() => {
-    const fromSettings = settings.merged.context?.fileName;
+    const fromSettings = settings.merged.context.fileName;
     return fromSettings
       ? Array.isArray(fromSettings)
         ? fromSettings
         : [fromSettings]
       : getAllGeminiMdFilenames();
-  }, [settings.merged.context?.fileName]);
+  }, [settings.merged.context.fileName]);
   // Initial prompt handling
   const initialPrompt = useMemo(() => config.getQuestion(), [config]);
   const initialPromptSubmitted = useRef(false);
@@ -1040,7 +1040,7 @@ Logging in with Google... Restarting Gemini CLI to continue.
   const shouldShowIdePrompt = Boolean(
     currentIDE &&
       !config.getIdeMode() &&
-      !settings.merged.ide?.hasSeenNudge &&
+      !settings.merged.ide.hasSeenNudge &&
       !idePromptAnswered,
   );
 
@@ -1221,7 +1221,7 @@ Logging in with Google... Restarting Gemini CLI to continue.
 
   const { elapsedTime, currentLoadingPhrase } = useLoadingIndicator(
     streamingState,
-    settings.merged.ui?.customWittyPhrases,
+    settings.merged.ui.customWittyPhrases,
     !!activePtyId && !embeddedShellFocused,
     lastOutputTime,
     retryStatus,
@@ -1237,7 +1237,7 @@ Logging in with Google... Restarting Gemini CLI to continue.
       }
 
       // Debug log keystrokes if enabled
-      if (settings.merged.general?.debugKeystrokeLogging) {
+      if (settings.merged.general.debugKeystrokeLogging) {
         debugLogger.log('[DEBUG] Keystroke:', JSON.stringify(key));
       }
 
@@ -1337,7 +1337,7 @@ Logging in with Google... Restarting Gemini CLI to continue.
       cancelOngoingRequest,
       activePtyId,
       embeddedShellFocused,
-      settings.merged.general?.debugKeystrokeLogging,
+      settings.merged.general.debugKeystrokeLogging,
       refreshStatic,
       setCopyModeEnabled,
       copyModeEnabled,
@@ -1351,7 +1351,7 @@ Logging in with Google... Restarting Gemini CLI to continue.
   // Update terminal title with Gemini CLI status and thoughts
   useEffect(() => {
     // Respect hideWindowTitle settings
-    if (settings.merged.ui?.hideWindowTitle) return;
+    if (settings.merged.ui.hideWindowTitle) return;
 
     const paddedTitle = computeTerminalTitle({
       streamingState,
@@ -1361,8 +1361,8 @@ Logging in with Google... Restarting Gemini CLI to continue.
         !!confirmationRequest ||
         showShellActionRequired,
       folderName: basename(config.getTargetDir()),
-      showThoughts: !!settings.merged.ui?.showStatusInTitle,
-      useDynamicTitle: settings.merged.ui?.dynamicWindowTitle ?? true,
+      showThoughts: !!settings.merged.ui.showStatusInTitle,
+      useDynamicTitle: settings.merged.ui.dynamicWindowTitle,
     });
 
     // Only update the title if it's different from the last value we set
@@ -1377,9 +1377,9 @@ Logging in with Google... Restarting Gemini CLI to continue.
     shellConfirmationRequest,
     confirmationRequest,
     showShellActionRequired,
-    settings.merged.ui?.showStatusInTitle,
-    settings.merged.ui?.dynamicWindowTitle,
-    settings.merged.ui?.hideWindowTitle,
+    settings.merged.ui.showStatusInTitle,
+    settings.merged.ui.dynamicWindowTitle,
+    settings.merged.ui.hideWindowTitle,
     config,
     stdout,
   ]);
diff --git a/packages/cli/src/ui/auth/AuthDialog.test.tsx b/packages/cli/src/ui/auth/AuthDialog.test.tsx
index 66be01856d..6757979c42 100644
--- a/packages/cli/src/ui/auth/AuthDialog.test.tsx
+++ b/packages/cli/src/ui/auth/AuthDialog.test.tsx
@@ -152,7 +152,7 @@ describe('AuthDialog', () => {
   });
 
   it('filters auth types when enforcedType is set', () => {
-    props.settings.merged.security!.auth!.enforcedType = AuthType.USE_GEMINI;
+    props.settings.merged.security.auth.enforcedType = AuthType.USE_GEMINI;
     renderWithProviders(<AuthDialog {...props} />);
     const items = mockedRadioButtonSelect.mock.calls[0][0].items;
     expect(items).toHaveLength(1);
@@ -160,7 +160,7 @@ describe('AuthDialog', () => {
   });
 
   it('sets initial index to 0 when enforcedType is set', () => {
-    props.settings.merged.security!.auth!.enforcedType = AuthType.USE_GEMINI;
+    props.settings.merged.security.auth.enforcedType = AuthType.USE_GEMINI;
     renderWithProviders(<AuthDialog {...props} />);
     const { initialIndex } = mockedRadioButtonSelect.mock.calls[0][0];
     expect(initialIndex).toBe(0);
@@ -170,7 +170,7 @@ describe('AuthDialog', () => {
     it.each([
       {
         setup: () => {
-          props.settings.merged.security!.auth!.selectedType =
+          props.settings.merged.security.auth.selectedType =
             AuthType.USE_VERTEX_AI;
         },
         expected: AuthType.USE_VERTEX_AI,
@@ -290,7 +290,7 @@ describe('AuthDialog', () => {
       mockedValidateAuthMethod.mockReturnValue(null);
       process.env['GEMINI_API_KEY'] = 'test-key-from-env';
       // Simulate that the user has already authenticated once
-      props.settings.merged.security!.auth!.selectedType =
+      props.settings.merged.security.auth.selectedType =
         AuthType.LOGIN_WITH_GOOGLE;
 
       renderWithProviders(<AuthDialog {...props} />);
@@ -349,7 +349,7 @@ describe('AuthDialog', () => {
       {
         desc: 'calls onAuthError on escape if no auth method is set',
         setup: () => {
-          props.settings.merged.security!.auth!.selectedType = undefined;
+          props.settings.merged.security.auth.selectedType = undefined;
         },
         expectations: (p: typeof props) => {
           expect(p.onAuthError).toHaveBeenCalledWith(
@@ -360,7 +360,7 @@ describe('AuthDialog', () => {
       {
         desc: 'calls setAuthState(Unauthenticated) on escape if auth method is set',
         setup: () => {
-          props.settings.merged.security!.auth!.selectedType =
+          props.settings.merged.security.auth.selectedType =
             AuthType.USE_GEMINI;
         },
         expectations: (p: typeof props) => {
@@ -392,7 +392,7 @@ describe('AuthDialog', () => {
     });
 
     it('renders correctly with enforced auth type', () => {
-      props.settings.merged.security!.auth!.enforcedType = AuthType.USE_GEMINI;
+      props.settings.merged.security.auth.enforcedType = AuthType.USE_GEMINI;
       const { lastFrame } = renderWithProviders(<AuthDialog {...props} />);
       expect(lastFrame()).toMatchSnapshot();
     });
diff --git a/packages/cli/src/ui/auth/AuthDialog.tsx b/packages/cli/src/ui/auth/AuthDialog.tsx
index 558927dcf2..0799b38b70 100644
--- a/packages/cli/src/ui/auth/AuthDialog.tsx
+++ b/packages/cli/src/ui/auth/AuthDialog.tsx
@@ -78,9 +78,9 @@ export function AuthDialog({
     },
   ];
 
-  if (settings.merged.security?.auth?.enforcedType) {
+  if (settings.merged.security.auth.enforcedType) {
     items = items.filter(
-      (item) => item.value === settings.merged.security?.auth?.enforcedType,
+      (item) => item.value === settings.merged.security.auth.enforcedType,
     );
   }
 
@@ -94,7 +94,7 @@ export function AuthDialog({
   }
 
   let initialAuthIndex = items.findIndex((item) => {
-    if (settings.merged.security?.auth?.selectedType) {
+    if (settings.merged.security.auth.selectedType) {
       return item.value === settings.merged.security.auth.selectedType;
     }
 
@@ -108,7 +108,7 @@ export function AuthDialog({
 
     return item.value === AuthType.LOGIN_WITH_GOOGLE;
   });
-  if (settings.merged.security?.auth?.enforcedType) {
+  if (settings.merged.security.auth.enforcedType) {
     initialAuthIndex = 0;
   }
 
@@ -171,7 +171,7 @@ export function AuthDialog({
         if (authError) {
           return;
         }
-        if (settings.merged.security?.auth?.selectedType === undefined) {
+        if (settings.merged.security.auth.selectedType === undefined) {
           // Prevent exiting if no auth method is set
           onAuthError(
             'You must select an auth method to proceed. Press Ctrl+C twice to exit.',
diff --git a/packages/cli/src/ui/auth/useAuth.ts b/packages/cli/src/ui/auth/useAuth.ts
index 004e362d10..7b37e2d421 100644
--- a/packages/cli/src/ui/auth/useAuth.ts
+++ b/packages/cli/src/ui/auth/useAuth.ts
@@ -20,11 +20,11 @@ export function validateAuthMethodWithSettings(
   authType: AuthType,
   settings: LoadedSettings,
 ): string | null {
-  const enforcedType = settings.merged.security?.auth?.enforcedType;
+  const enforcedType = settings.merged.security.auth.enforcedType;
   if (enforcedType && enforcedType !== authType) {
     return `Authentication is enforced to be ${enforcedType}, but you are currently using ${authType}.`;
   }
-  if (settings.merged.security?.auth?.useExternal) {
+  if (settings.merged.security.auth.useExternal) {
     return null;
   }
   // If using Gemini API key, we don't validate it here as we might need to prompt for it.
@@ -80,7 +80,7 @@ export const useAuthCommand = (settings: LoadedSettings, config: Config) => {
         return;
       }
 
-      const authType = settings.merged.security?.auth?.selectedType;
+      const authType = settings.merged.security.auth.selectedType;
       if (!authType) {
         if (process.env['GEMINI_API_KEY']) {
           onAuthError(
diff --git a/packages/cli/src/ui/commands/aboutCommand.ts b/packages/cli/src/ui/commands/aboutCommand.ts
index 46589a0c99..3def750895 100644
--- a/packages/cli/src/ui/commands/aboutCommand.ts
+++ b/packages/cli/src/ui/commands/aboutCommand.ts
@@ -33,7 +33,7 @@ export const aboutCommand: SlashCommand = {
     const modelVersion = context.services.config?.getModel() || 'Unknown';
     const cliVersion = await getVersion();
     const selectedAuthType =
-      context.services.settings.merged.security?.auth?.selectedType || '';
+      context.services.settings.merged.security.auth.selectedType || '';
     const gcpProject = process.env['GOOGLE_CLOUD_PROJECT'] || '';
     const ideClient = await getIdeClientName(context);
 
diff --git a/packages/cli/src/ui/commands/agentsCommand.test.ts b/packages/cli/src/ui/commands/agentsCommand.test.ts
index f126ddd8ee..e8d2568f60 100644
--- a/packages/cli/src/ui/commands/agentsCommand.test.ts
+++ b/packages/cli/src/ui/commands/agentsCommand.test.ts
@@ -7,7 +7,7 @@
 import { vi, describe, it, expect, beforeEach } from 'vitest';
 import { agentsCommand } from './agentsCommand.js';
 import { createMockCommandContext } from '../../test-utils/mockCommandContext.js';
-import type { Config, AgentOverride } from '@google/gemini-cli-core';
+import type { Config } from '@google/gemini-cli-core';
 import type { LoadedSettings } from '../../config/settings.js';
 import { MessageType } from '../types.js';
 import { enableAgent, disableAgent } from '../../utils/agentSettings.js';
@@ -148,12 +148,9 @@ describe('agentsCommand', () => {
       reload: reloadSpy,
     });
     // Add agent to disabled overrides so validation passes
-    (
-      mockContext.services.settings.merged.agents!.overrides as Record<
-        string,
-        AgentOverride
-      >
-    )['test-agent'] = { disabled: true };
+    mockContext.services.settings.merged.agents.overrides['test-agent'] = {
+      disabled: true,
+    };
 
     vi.mocked(enableAgent).mockReturnValue({
       status: 'success',
@@ -266,12 +263,9 @@ describe('agentsCommand', () => {
 
   it('should show info message if agent is already disabled', async () => {
     mockConfig.getAgentRegistry().getAllAgentNames.mockReturnValue([]);
-    (
-      mockContext.services.settings.merged.agents!.overrides as Record<
-        string,
-        AgentOverride
-      >
-    )['test-agent'] = { disabled: true };
+    mockContext.services.settings.merged.agents.overrides['test-agent'] = {
+      disabled: true,
+    };
 
     const disableCommand = agentsCommand.subCommands?.find(
       (cmd) => cmd.name === 'disable',
diff --git a/packages/cli/src/ui/commands/agentsCommand.ts b/packages/cli/src/ui/commands/agentsCommand.ts
index 1c03524332..345d66bb24 100644
--- a/packages/cli/src/ui/commands/agentsCommand.ts
+++ b/packages/cli/src/ui/commands/agentsCommand.ts
@@ -12,7 +12,6 @@ import type {
 import { CommandKind } from './types.js';
 import { MessageType, type HistoryItemAgentsList } from '../types.js';
 import { SettingScope } from '../../config/settings.js';
-import type { AgentOverride } from '@google/gemini-cli-core';
 import { disableAgent, enableAgent } from '../../utils/agentSettings.js';
 import { renderAgentActionFeedback } from '../../utils/agentUtils.js';
 
@@ -84,10 +83,7 @@ async function enableAction(
   }
 
   const allAgents = agentRegistry.getAllAgentNames();
-  const overrides = (settings.merged.agents?.overrides ?? {}) as Record<
-    string,
-    AgentOverride
-  >;
+  const overrides = settings.merged.agents.overrides;
   const disabledAgents = Object.keys(overrides).filter(
     (name) => overrides[name]?.disabled === true,
   );
@@ -157,10 +153,7 @@ async function disableAction(
   }
 
   const allAgents = agentRegistry.getAllAgentNames();
-  const overrides = (settings.merged.agents?.overrides ?? {}) as Record<
-    string,
-    AgentOverride
-  >;
+  const overrides = settings.merged.agents.overrides;
   const disabledAgents = Object.keys(overrides).filter(
     (name) => overrides[name]?.disabled === true,
   );
@@ -211,10 +204,7 @@ function completeAgentsToEnable(context: CommandContext, partialArg: string) {
   const { config, settings } = context.services;
   if (!config) return [];
 
-  const overrides = (settings.merged.agents?.overrides ?? {}) as Record<
-    string,
-    AgentOverride
-  >;
+  const overrides = settings.merged.agents.overrides;
   const disabledAgents = Object.entries(overrides)
     .filter(([_, override]) => override?.disabled === true)
     .map(([name]) => name);
diff --git a/packages/cli/src/ui/commands/hooksCommand.test.ts b/packages/cli/src/ui/commands/hooksCommand.test.ts
index 4f9499c0aa..2d5588dee8 100644
--- a/packages/cli/src/ui/commands/hooksCommand.test.ts
+++ b/packages/cli/src/ui/commands/hooksCommand.test.ts
@@ -271,9 +271,10 @@ describe('hooksCommand', () => {
 
     it('should enable a hook and update settings', async () => {
       // Update the context's settings with disabled hooks
-      mockContext.services.settings.merged.hooks = {
-        disabled: ['test-hook', 'other-hook'],
-      };
+      mockContext.services.settings.merged.hooks.disabled = [
+        'test-hook',
+        'other-hook',
+      ];
 
       const enableCmd = hooksCommand.subCommands!.find(
         (cmd) => cmd.name === 'enable',
@@ -401,9 +402,7 @@ describe('hooksCommand', () => {
     });
 
     it('should disable a hook and update settings', async () => {
-      mockContext.services.settings.merged.hooks = {
-        disabled: [],
-      };
+      mockContext.services.settings.merged.hooks.disabled = [];
 
       const disableCmd = hooksCommand.subCommands!.find(
         (cmd) => cmd.name === 'disable',
@@ -432,9 +431,7 @@ describe('hooksCommand', () => {
 
     it('should return info when hook is already disabled', async () => {
       // Update the context's settings with the hook already disabled
-      mockContext.services.settings.merged.hooks = {
-        disabled: ['test-hook'],
-      };
+      mockContext.services.settings.merged.hooks.disabled = ['test-hook'];
 
       const disableCmd = hooksCommand.subCommands!.find(
         (cmd) => cmd.name === 'disable',
@@ -455,9 +452,7 @@ describe('hooksCommand', () => {
     });
 
     it('should handle error when disabling hook fails', async () => {
-      mockContext.services.settings.merged.hooks = {
-        disabled: [],
-      };
+      mockContext.services.settings.merged.hooks.disabled = [];
       mockSettings.setValue.mockImplementationOnce(() => {
         throw new Error('Failed to save settings');
       });
diff --git a/packages/cli/src/ui/commands/hooksCommand.ts b/packages/cli/src/ui/commands/hooksCommand.ts
index 050bf3045e..e8afca5613 100644
--- a/packages/cli/src/ui/commands/hooksCommand.ts
+++ b/packages/cli/src/ui/commands/hooksCommand.ts
@@ -76,8 +76,7 @@ async function enableAction(
 
   // Get current disabled hooks from settings
   const settings = context.services.settings;
-  const disabledHooks = settings.merged.hooks?.disabled || ([] as string[]);
-
+  const disabledHooks = settings.merged.hooks.disabled;
   // Remove from disabled list if present
   const newDisabledHooks = disabledHooks.filter(
     (name: string) => name !== hookName,
@@ -143,8 +142,7 @@ async function disableAction(
 
   // Get current disabled hooks from settings
   const settings = context.services.settings;
-  const disabledHooks = settings.merged.hooks?.disabled || ([] as string[]);
-
+  const disabledHooks = settings.merged.hooks.disabled;
   // Add to disabled list if not already present
   if (!disabledHooks.includes(hookName)) {
     const newDisabledHooks = [...disabledHooks, hookName];
diff --git a/packages/cli/src/ui/commands/policiesCommand.test.ts b/packages/cli/src/ui/commands/policiesCommand.test.ts
index 1e72bce0ae..268d00b9eb 100644
--- a/packages/cli/src/ui/commands/policiesCommand.test.ts
+++ b/packages/cli/src/ui/commands/policiesCommand.test.ts
@@ -72,6 +72,7 @@ describe('policiesCommand', () => {
         {
           decision: PolicyDecision.ALLOW,
           argsPattern: /safe/,
+          source: 'test.toml',
         },
         {
           decision: PolicyDecision.ASK_USER,
@@ -101,7 +102,9 @@ describe('policiesCommand', () => {
       expect(content).toContain(
         '1. **DENY** tool: `dangerousTool` [Priority: 10]',
       );
-      expect(content).toContain('2. **ALLOW** all tools (args match: `safe`)');
+      expect(content).toContain(
+        '2. **ALLOW** all tools (args match: `safe`) [Source: `test.toml`]',
+      );
       expect(content).toContain('3. **ASK_USER** all tools');
     });
   });
diff --git a/packages/cli/src/ui/commands/policiesCommand.ts b/packages/cli/src/ui/commands/policiesCommand.ts
index cc6136c3d5..f739364c11 100644
--- a/packages/cli/src/ui/commands/policiesCommand.ts
+++ b/packages/cli/src/ui/commands/policiesCommand.ts
@@ -53,6 +53,9 @@ const listPoliciesCommand: SlashCommand = {
       if (rule.priority !== undefined) {
         content += ` [Priority: ${rule.priority}]`;
       }
+      if (rule.source) {
+        content += ` [Source: \`${rule.source}\`]`;
+      }
       content += '\n';
     });
 
diff --git a/packages/cli/src/ui/components/AppHeader.tsx b/packages/cli/src/ui/components/AppHeader.tsx
index c404c0e9f9..a70a7b20d8 100644
--- a/packages/cli/src/ui/components/AppHeader.tsx
+++ b/packages/cli/src/ui/components/AppHeader.tsx
@@ -26,7 +26,7 @@ export const AppHeader = ({ version }: AppHeaderProps) => {
 
   return (
     <Box flexDirection="column">
-      {!(settings.merged.ui?.hideBanner || config.getScreenReader()) && (
+      {!(settings.merged.ui.hideBanner || config.getScreenReader()) && (
         <>
           <Header version={version} nightly={nightly} />
           {bannerVisible && bannerText && (
@@ -38,7 +38,7 @@ export const AppHeader = ({ version }: AppHeaderProps) => {
           )}
         </>
       )}
-      {!(settings.merged.ui?.hideTips || config.getScreenReader()) && (
+      {!(settings.merged.ui.hideTips || config.getScreenReader()) && (
         <Tips config={config} />
       )}
     </Box>
diff --git a/packages/cli/src/ui/components/Composer.test.tsx b/packages/cli/src/ui/components/Composer.test.tsx
index c39d7c5ece..73e68684a5 100644
--- a/packages/cli/src/ui/components/Composer.test.tsx
+++ b/packages/cli/src/ui/components/Composer.test.tsx
@@ -24,6 +24,7 @@ vi.mock('../contexts/VimModeContext.js', () => ({
 }));
 import { ApprovalMode } from '@google/gemini-cli-core';
 import { StreamingState } from '../types.js';
+import { mergeSettings } from '../../config/settings.js';
 
 // Mock child components
 vi.mock('./LoadingIndicator.js', () => ({
@@ -163,13 +164,20 @@ const createMockConfig = (overrides = {}) => ({
   ...overrides,
 });
 
-const createMockSettings = (merged = {}) => ({
-  merged: {
-    hideFooter: false,
-    showMemoryUsage: false,
-    ...merged,
-  },
-});
+const createMockSettings = (merged = {}) => {
+  const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
+  return {
+    merged: {
+      ...defaultMergedSettings,
+      ui: {
+        ...defaultMergedSettings.ui,
+        hideFooter: false,
+        showMemoryUsage: false,
+        ...merged,
+      },
+    },
+  };
+};
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 const renderComposer = (
diff --git a/packages/cli/src/ui/components/Composer.tsx b/packages/cli/src/ui/components/Composer.tsx
index d48cced332..b7db494409 100644
--- a/packages/cli/src/ui/components/Composer.tsx
+++ b/packages/cli/src/ui/components/Composer.tsx
@@ -82,9 +82,7 @@ export const Composer = () => {
       <Box
         marginTop={1}
         justifyContent={
-          settings.merged.ui?.hideContextSummary
-            ? 'flex-start'
-            : 'space-between'
+          settings.merged.ui.hideContextSummary ? 'flex-start' : 'space-between'
         }
         width="100%"
         flexDirection={isNarrow ? 'column' : 'row'}
@@ -153,7 +151,7 @@ export const Composer = () => {
         />
       )}
 
-      {!settings.merged.ui?.hideFooter && !isScreenReaderEnabled && <Footer />}
+      {!settings.merged.ui.hideFooter && !isScreenReaderEnabled && <Footer />}
     </Box>
   );
 };
diff --git a/packages/cli/src/ui/components/EditorSettingsDialog.tsx b/packages/cli/src/ui/components/EditorSettingsDialog.tsx
index 6886d43319..671d3067cf 100644
--- a/packages/cli/src/ui/components/EditorSettingsDialog.tsx
+++ b/packages/cli/src/ui/components/EditorSettingsDialog.tsx
@@ -124,12 +124,12 @@ export function EditorSettingsDialog({
 
   let mergedEditorName = 'None';
   if (
-    settings.merged.general?.preferredEditor &&
-    isEditorAvailable(settings.merged.general?.preferredEditor)
+    settings.merged.general.preferredEditor &&
+    isEditorAvailable(settings.merged.general.preferredEditor)
   ) {
     mergedEditorName =
       EDITOR_DISPLAY_NAMES[
-        settings.merged.general?.preferredEditor as EditorType
+        settings.merged.general.preferredEditor as EditorType
       ];
   }
 
diff --git a/packages/cli/src/ui/components/Footer.tsx b/packages/cli/src/ui/components/Footer.tsx
index 7ab087fd99..44bab56f45 100644
--- a/packages/cli/src/ui/components/Footer.tsx
+++ b/packages/cli/src/ui/components/Footer.tsx
@@ -59,12 +59,11 @@ export const Footer: React.FC = () => {
   };
 
   const showMemoryUsage =
-    config.getDebugMode() || settings.merged.ui?.showMemoryUsage || false;
-  const hideCWD = settings.merged.ui?.footer?.hideCWD;
-  const hideSandboxStatus = settings.merged.ui?.footer?.hideSandboxStatus;
-  const hideModelInfo = settings.merged.ui?.footer?.hideModelInfo;
-  const hideContextPercentage =
-    settings.merged.ui?.footer?.hideContextPercentage;
+    config.getDebugMode() || settings.merged.ui.showMemoryUsage;
+  const hideCWD = settings.merged.ui.footer.hideCWD;
+  const hideSandboxStatus = settings.merged.ui.footer.hideSandboxStatus;
+  const hideModelInfo = settings.merged.ui.footer.hideModelInfo;
+  const hideContextPercentage = settings.merged.ui.footer.hideContextPercentage;
 
   const pathLength = Math.max(20, Math.floor(mainAreaWidth * 0.25));
   const displayPath = shortenPath(tildeifyPath(targetDir), pathLength);
diff --git a/packages/cli/src/ui/components/StatusDisplay.tsx b/packages/cli/src/ui/components/StatusDisplay.tsx
index 96d2868830..c9e9e414e5 100644
--- a/packages/cli/src/ui/components/StatusDisplay.tsx
+++ b/packages/cli/src/ui/components/StatusDisplay.tsx
@@ -52,14 +52,11 @@ export const StatusDisplay: React.FC<StatusDisplayProps> = ({
     return <Text color={theme.status.error}>{uiState.queueErrorMessage}</Text>;
   }
 
-  if (
-    uiState.activeHooks.length > 0 &&
-    (settings.merged.hooks?.notifications ?? true)
-  ) {
+  if (uiState.activeHooks.length > 0 && settings.merged.hooks.notifications) {
     return <HookStatusDisplay activeHooks={uiState.activeHooks} />;
   }
 
-  if (!settings.merged.ui?.hideContextSummary && !hideContextSummary) {
+  if (!settings.merged.ui.hideContextSummary && !hideContextSummary) {
     return (
       <ContextSummaryDisplay
         ideContext={uiState.ideContextState}
diff --git a/packages/cli/src/ui/components/ThemeDialog.tsx b/packages/cli/src/ui/components/ThemeDialog.tsx
index 60dfc72080..3b5324e8f5 100644
--- a/packages/cli/src/ui/components/ThemeDialog.tsx
+++ b/packages/cli/src/ui/components/ThemeDialog.tsx
@@ -95,7 +95,7 @@ export function ThemeDialog({
   const [highlightedThemeName, setHighlightedThemeName] = useState<string>(
     () => {
       // If a theme is already set, use it.
-      if (settings.merged.ui?.theme) {
+      if (settings.merged.ui.theme) {
         return settings.merged.ui.theme;
       }
 
@@ -113,7 +113,7 @@ export function ThemeDialog({
   const customThemes =
     selectedScope === SettingScope.User
       ? settings.user.settings.ui?.customThemes || {}
-      : settings.merged.ui?.customThemes || {};
+      : settings.merged.ui.customThemes;
   const builtInThemes = themeManager
     .getAvailableThemes()
     .filter((theme) => theme.type !== 'custom');
diff --git a/packages/cli/src/ui/components/messages/ToolConfirmationMessage.tsx b/packages/cli/src/ui/components/messages/ToolConfirmationMessage.tsx
index 6728100eff..051ca0eae2 100644
--- a/packages/cli/src/ui/components/messages/ToolConfirmationMessage.tsx
+++ b/packages/cli/src/ui/components/messages/ToolConfirmationMessage.tsx
@@ -42,7 +42,7 @@ export const ToolConfirmationMessage: React.FC<
 
   const settings = useSettings();
   const allowPermanentApproval =
-    settings.merged.security?.enablePermanentToolApproval ?? false;
+    settings.merged.security.enablePermanentToolApproval;
 
   const [ideClient, setIdeClient] = useState<IdeClient | null>(null);
   const [isDiffingEnabled, setIsDiffingEnabled] = useState(false);
diff --git a/packages/cli/src/ui/components/shared/performance.test.ts b/packages/cli/src/ui/components/shared/performance.test.ts
new file mode 100644
index 0000000000..683995745b
--- /dev/null
+++ b/packages/cli/src/ui/components/shared/performance.test.ts
@@ -0,0 +1,93 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import { act } from 'react';
+import { renderHook } from '../../../test-utils/render.js';
+import { useTextBuffer } from './text-buffer.js';
+import { parseInputForHighlighting } from '../../utils/highlight.js';
+
+describe('text-buffer performance', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('should handle pasting large amounts of text efficiently', () => {
+    const viewport = { width: 80, height: 24 };
+    const { result } = renderHook(() =>
+      useTextBuffer({
+        viewport,
+        isValidPath: () => false,
+      }),
+    );
+
+    const lines = 5000;
+    const largeText = Array.from(
+      { length: lines },
+      (_, i) =>
+        `Line ${i}: some sample text with many @path/to/image${i}.png and maybe some more @path/to/another/image.png references to trigger regex. This line is much longer than the previous one to test wrapping.`,
+    ).join('\n');
+
+    const start = Date.now();
+    act(() => {
+      result.current.insert(largeText, { paste: true });
+    });
+    const end = Date.now();
+
+    const duration = end - start;
+    expect(duration).toBeLessThan(5000);
+  });
+
+  it('should handle character-by-character insertion in a large buffer efficiently', () => {
+    const lines = 5000;
+    const initialText = Array.from(
+      { length: lines },
+      (_, i) => `Line ${i}: some sample text with @path/to/image.png`,
+    ).join('\n');
+    const viewport = { width: 80, height: 24 };
+
+    const { result } = renderHook(() =>
+      useTextBuffer({
+        initialText,
+        viewport,
+        isValidPath: () => false,
+      }),
+    );
+
+    const start = Date.now();
+    const charsToInsert = 100;
+    for (let i = 0; i < charsToInsert; i++) {
+      act(() => {
+        result.current.insert('a');
+      });
+    }
+    const end = Date.now();
+
+    const duration = end - start;
+    expect(duration).toBeLessThan(5000);
+  });
+
+  it('should highlight many lines efficiently', () => {
+    const lines = 5000;
+    const sampleLines = Array.from(
+      { length: lines },
+      (_, i) =>
+        `Line ${i}: some sample text with @path/to/image${i}.png /command and more @file.txt`,
+    );
+
+    const start = Date.now();
+    for (let i = 0; i < 100; i++) {
+      // Simulate 100 renders
+      for (const line of sampleLines.slice(0, 20)) {
+        // 20 visible lines
+        parseInputForHighlighting(line, 1, []);
+      }
+    }
+    const end = Date.now();
+
+    const duration = end - start;
+    expect(duration).toBeLessThan(500);
+  });
+});
diff --git a/packages/cli/src/ui/components/shared/text-buffer.test.ts b/packages/cli/src/ui/components/shared/text-buffer.test.ts
index 0cd7c7bfd2..4a264c2cd8 100644
--- a/packages/cli/src/ui/components/shared/text-buffer.test.ts
+++ b/packages/cli/src/ui/components/shared/text-buffer.test.ts
@@ -4,10 +4,13 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { describe, it, expect, beforeEach } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import stripAnsi from 'strip-ansi';
 import { act } from 'react';
-import { renderHook } from '../../../test-utils/render.js';
+import {
+  renderHook,
+  renderHookWithProviders,
+} from '../../../test-utils/render.js';
 import type {
   Viewport,
   TextBuffer,
@@ -55,6 +58,10 @@ const initialState: TextBufferState = {
 };
 
 describe('textBufferReducer', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
   it('should return the initial state if state is undefined', () => {
     const action = { type: 'unknown_action' } as unknown as TextBufferAction;
     const state = textBufferReducer(initialState, action);
@@ -381,6 +388,10 @@ describe('useTextBuffer', () => {
     viewport = { width: 10, height: 3 }; // Default viewport for tests
   });
 
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
   describe('Initialization', () => {
     it('should initialize with empty text and cursor at (0,0) by default', () => {
       const { result } = renderHook(() =>
@@ -2371,6 +2382,10 @@ describe('Unicode helper functions', () => {
 });
 
 describe('Transformation Utilities', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
   describe('getTransformedImagePath', () => {
     it('should transform a simple image path', () => {
       expect(getTransformedImagePath('@test.png')).toBe('[Image test.png]');
@@ -2547,4 +2562,125 @@ describe('Transformation Utilities', () => {
       expect(result.transformedToLogMap).toEqual([0]); // Just the trailing position
     });
   });
+
+  describe('Layout Caching and Invalidation', () => {
+    it.each([
+      {
+        desc: 'via setText',
+        actFn: (result: { current: TextBuffer }) =>
+          result.current.setText('changed line'),
+        expected: 'changed line',
+      },
+      {
+        desc: 'via replaceRange',
+        actFn: (result: { current: TextBuffer }) =>
+          result.current.replaceRange(0, 0, 0, 13, 'changed line'),
+        expected: 'changed line',
+      },
+    ])(
+      'should invalidate cache when line content changes $desc',
+      ({ actFn, expected }) => {
+        const viewport = { width: 80, height: 24 };
+        const { result } = renderHookWithProviders(() =>
+          useTextBuffer({
+            initialText: 'original line',
+            viewport,
+            isValidPath: () => true,
+          }),
+        );
+
+        const originalLayout = result.current.visualLayout;
+
+        act(() => {
+          actFn(result);
+        });
+
+        expect(result.current.visualLayout).not.toBe(originalLayout);
+        expect(result.current.allVisualLines[0]).toBe(expected);
+      },
+    );
+
+    it('should invalidate cache when viewport width changes', () => {
+      const viewport = { width: 80, height: 24 };
+      const { result, rerender } = renderHookWithProviders(
+        ({ vp }) =>
+          useTextBuffer({
+            initialText:
+              'a very long line that will wrap when the viewport is small',
+            viewport: vp,
+            isValidPath: () => true,
+          }),
+        { initialProps: { vp: viewport } },
+      );
+
+      const originalLayout = result.current.visualLayout;
+
+      // Shrink viewport to force wrapping change
+      rerender({ vp: { width: 10, height: 24 } });
+
+      expect(result.current.visualLayout).not.toBe(originalLayout);
+      expect(result.current.allVisualLines.length).toBeGreaterThan(1);
+    });
+
+    it('should correctly handle cursor expansion/collapse in cached layout', () => {
+      const viewport = { width: 80, height: 24 };
+      const text = 'Check @image.png here';
+      const { result } = renderHookWithProviders(() =>
+        useTextBuffer({
+          initialText: text,
+          viewport,
+          isValidPath: () => true,
+        }),
+      );
+
+      // Cursor at start (collapsed)
+      act(() => {
+        result.current.moveToOffset(0);
+      });
+      expect(result.current.allVisualLines[0]).toContain('[Image image.png]');
+
+      // Move cursor onto the @path (expanded)
+      act(() => {
+        result.current.moveToOffset(7); // onto @
+      });
+      expect(result.current.allVisualLines[0]).toContain('@image.png');
+      expect(result.current.allVisualLines[0]).not.toContain(
+        '[Image image.png]',
+      );
+
+      // Move cursor away (collapsed again)
+      act(() => {
+        result.current.moveToOffset(0);
+      });
+      expect(result.current.allVisualLines[0]).toContain('[Image image.png]');
+    });
+
+    it('should reuse cache for unchanged lines during editing', () => {
+      const viewport = { width: 80, height: 24 };
+      const initialText = 'line 1\nline 2\nline 3';
+      const { result } = renderHookWithProviders(() =>
+        useTextBuffer({
+          initialText,
+          viewport,
+          isValidPath: () => true,
+        }),
+      );
+
+      const layout1 = result.current.visualLayout;
+
+      // Edit line 1
+      act(() => {
+        result.current.moveToOffset(0);
+        result.current.insert('X');
+      });
+
+      const layout2 = result.current.visualLayout;
+      expect(layout2).not.toBe(layout1);
+
+      // Verify that visual lines for line 2 and 3 (indices 1 and 2 in visualLines)
+      // are identical in content if not in object reference (the arrays are rebuilt, but contents are cached)
+      expect(result.current.allVisualLines[1]).toBe('line 2');
+      expect(result.current.allVisualLines[2]).toBe('line 3');
+    });
+  });
 });
diff --git a/packages/cli/src/ui/components/shared/text-buffer.ts b/packages/cli/src/ui/components/shared/text-buffer.ts
index a80d088bf2..61e6b98e55 100644
--- a/packages/cli/src/ui/components/shared/text-buffer.ts
+++ b/packages/cli/src/ui/components/shared/text-buffer.ts
@@ -18,6 +18,7 @@ import {
   type EditorType,
   getEditorCommand,
   isGuiEditor,
+  LruCache,
 } from '@google/gemini-cli-core';
 import {
   toCodePoints,
@@ -31,6 +32,7 @@ import type { Key } from '../../contexts/KeypressContext.js';
 import { keyMatchers, Command } from '../../keyMatchers.js';
 import type { VimAction } from './vim-buffer-actions.js';
 import { handleVimAction } from './vim-buffer-actions.js';
+import { LRU_BUFFER_PERF_CACHE_LIMIT } from '../../constants.js';
 
 export type Direction =
   | 'left'
@@ -726,9 +728,18 @@ export function getTransformedImagePath(filePath: string): string {
   return `[Image ${truncatedBase}${extension}]`;
 }
 
+const transformationsCache = new LruCache<string, Transformation[]>(
+  LRU_BUFFER_PERF_CACHE_LIMIT,
+);
+
 export function calculateTransformationsForLine(
   line: string,
 ): Transformation[] {
+  const cached = transformationsCache.get(line);
+  if (cached) {
+    return cached;
+  }
+
   const transformations: Transformation[] = [];
   let match: RegExpExecArray | null;
 
@@ -748,6 +759,8 @@ export function calculateTransformationsForLine(
     });
   }
 
+  transformationsCache.set(line, transformations);
+
   return transformations;
 }
 
@@ -845,6 +858,7 @@ export function calculateTransformedLine(
 
   return { transformedLine, transformedToLogMap };
 }
+
 export interface VisualLayout {
   visualLines: string[];
   // For each logical line, an array of [visualLineIndex, startColInLogical]
@@ -858,6 +872,33 @@ export interface VisualLayout {
   visualToTransformedMap: number[];
 }
 
+// Caches for layout calculation
+interface LineLayoutResult {
+  visualLines: string[];
+  logicalToVisualMap: Array<[number, number]>;
+  visualToLogicalMap: Array<[number, number]>;
+  transformedToLogMap: number[];
+  visualToTransformedMap: number[];
+}
+
+const lineLayoutCache = new LruCache<string, LineLayoutResult>(
+  LRU_BUFFER_PERF_CACHE_LIMIT,
+);
+
+function getLineLayoutCacheKey(
+  line: string,
+  viewportWidth: number,
+  isCursorOnLine: boolean,
+  cursorCol: number,
+): string {
+  // Most lines (99.9% in a large buffer) are not cursor lines.
+  // We use a simpler key for them to reduce string allocation overhead.
+  if (!isCursorOnLine) {
+    return `${viewportWidth}:N:${line}`;
+  }
+  return `${viewportWidth}:C:${cursorCol}:${line}`;
+}
+
 // Calculates the visual wrapping of lines and the mapping between logical and visual coordinates.
 // This is an expensive operation and should be memoized.
 function calculateLayout(
@@ -873,6 +914,34 @@ function calculateLayout(
 
   logicalLines.forEach((logLine, logIndex) => {
     logicalToVisualMap[logIndex] = [];
+
+    const isCursorOnLine = logIndex === logicalCursor[0];
+    const cacheKey = getLineLayoutCacheKey(
+      logLine,
+      viewportWidth,
+      isCursorOnLine,
+      logicalCursor[1],
+    );
+    const cached = lineLayoutCache.get(cacheKey);
+
+    if (cached) {
+      const visualLineOffset = visualLines.length;
+      visualLines.push(...cached.visualLines);
+      cached.logicalToVisualMap.forEach(([relVisualIdx, logCol]) => {
+        logicalToVisualMap[logIndex].push([
+          visualLineOffset + relVisualIdx,
+          logCol,
+        ]);
+      });
+      cached.visualToLogicalMap.forEach(([, logCol]) => {
+        visualToLogicalMap.push([logIndex, logCol]);
+      });
+      transformedToLogicalMaps[logIndex] = cached.transformedToLogMap;
+      visualToTransformedMap.push(...cached.visualToTransformedMap);
+      return;
+    }
+
+    // Not in cache, calculate
     const transformations = calculateTransformationsForLine(logLine);
     const { transformedLine, transformedToLogMap } = calculateTransformedLine(
       logLine,
@@ -880,13 +949,18 @@ function calculateLayout(
       logicalCursor,
       transformations,
     );
-    transformedToLogicalMaps[logIndex] = transformedToLogMap;
+
+    const lineVisualLines: string[] = [];
+    const lineLogicalToVisualMap: Array<[number, number]> = [];
+    const lineVisualToLogicalMap: Array<[number, number]> = [];
+    const lineVisualToTransformedMap: number[] = [];
+
     if (transformedLine.length === 0) {
       // Handle empty logical line
-      logicalToVisualMap[logIndex].push([visualLines.length, 0]);
-      visualToLogicalMap.push([logIndex, 0]);
-      visualToTransformedMap.push(0);
-      visualLines.push('');
+      lineLogicalToVisualMap.push([0, 0]);
+      lineVisualToLogicalMap.push([logIndex, 0]);
+      lineVisualToTransformedMap.push(0);
+      lineVisualLines.push('');
     } else {
       // Non-empty logical line
       let currentPosInLogLine = 0; // Tracks position within the current logical line (code point index)
@@ -929,15 +1003,6 @@ function calculateLayout(
                 // Single character is wider than viewport, take it anyway
                 currentChunk = char;
                 numCodePointsInChunk = 1;
-              } else if (
-                numCodePointsInChunk === 0 &&
-                charVisualWidth <= viewportWidth
-              ) {
-                // This case should ideally be caught by the next iteration if the char fits.
-                // If it doesn't fit (because currentChunkVisualWidth was already > 0 from a previous char that filled the line),
-                // then numCodePointsInChunk would not be 0.
-                // This branch means the current char *itself* doesn't fit an empty line, which is handled by the above.
-                // If we are here, it means the loop should break and the current chunk (which is empty) is finalized.
               }
             }
             break; // Break from inner loop to finalize this chunk
@@ -955,55 +1020,57 @@ function calculateLayout(
           }
         }
 
-        // If the inner loop completed without breaking (i.e., remaining text fits)
-        // or if the loop broke but numCodePointsInChunk is still 0 (e.g. first char too wide for empty line)
         if (
           numCodePointsInChunk === 0 &&
           currentPosInLogLine < codePointsInLogLine.length
         ) {
-          // This can happen if the very first character considered for a new visual line is wider than the viewport.
-          // In this case, we take that single character.
           const firstChar = codePointsInLogLine[currentPosInLogLine];
           currentChunk = firstChar;
-          numCodePointsInChunk = 1; // Ensure we advance
-        }
-
-        // If after everything, numCodePointsInChunk is still 0 but we haven't processed the whole logical line,
-        // it implies an issue, like viewportWidth being 0 or less. Avoid infinite loop.
-        if (
-          numCodePointsInChunk === 0 &&
-          currentPosInLogLine < codePointsInLogLine.length
-        ) {
-          // Force advance by one character to prevent infinite loop if something went wrong
-          currentChunk = codePointsInLogLine[currentPosInLogLine];
           numCodePointsInChunk = 1;
         }
 
         const logicalStartCol = transformedToLogMap[currentPosInLogLine] ?? 0;
-        logicalToVisualMap[logIndex].push([
-          visualLines.length,
-          logicalStartCol,
-        ]);
-        visualToLogicalMap.push([logIndex, logicalStartCol]);
-        visualToTransformedMap.push(currentPosInLogLine);
-        visualLines.push(currentChunk);
+        lineLogicalToVisualMap.push([lineVisualLines.length, logicalStartCol]);
+        lineVisualToLogicalMap.push([logIndex, logicalStartCol]);
+        lineVisualToTransformedMap.push(currentPosInLogLine);
+        lineVisualLines.push(currentChunk);
 
         const logicalStartOfThisChunk = currentPosInLogLine;
         currentPosInLogLine += numCodePointsInChunk;
 
-        // If the chunk processed did not consume the entire logical line,
-        // and the character immediately following the chunk is a space,
-        // advance past this space as it acted as a delimiter for word wrapping.
         if (
           logicalStartOfThisChunk + numCodePointsInChunk <
             codePointsInLogLine.length &&
-          currentPosInLogLine < codePointsInLogLine.length && // Redundant if previous is true, but safe
+          currentPosInLogLine < codePointsInLogLine.length &&
           codePointsInLogLine[currentPosInLogLine] === ' '
         ) {
           currentPosInLogLine++;
         }
       }
     }
+
+    // Cache the result for this line
+    lineLayoutCache.set(cacheKey, {
+      visualLines: lineVisualLines,
+      logicalToVisualMap: lineLogicalToVisualMap,
+      visualToLogicalMap: lineVisualToLogicalMap,
+      transformedToLogMap,
+      visualToTransformedMap: lineVisualToTransformedMap,
+    });
+
+    const visualLineOffset = visualLines.length;
+    visualLines.push(...lineVisualLines);
+    lineLogicalToVisualMap.forEach(([relVisualIdx, logCol]) => {
+      logicalToVisualMap[logIndex].push([
+        visualLineOffset + relVisualIdx,
+        logCol,
+      ]);
+    });
+    lineVisualToLogicalMap.forEach(([, logCol]) => {
+      visualToLogicalMap.push([logIndex, logCol]);
+    });
+    transformedToLogicalMaps[logIndex] = transformedToLogMap;
+    visualToTransformedMap.push(...lineVisualToTransformedMap);
   });
 
   // If the entire logical text was empty, ensure there's one empty visual line.
@@ -2378,6 +2445,7 @@ export function useTextBuffer({
       transformedToLogicalMaps,
       visualToTransformedMap,
       transformationsByLine,
+      visualLayout,
       setText,
       insert,
       newline,
@@ -2447,6 +2515,7 @@ export function useTextBuffer({
       transformedToLogicalMaps,
       visualToTransformedMap,
       transformationsByLine,
+      visualLayout,
       setText,
       insert,
       newline,
@@ -2540,6 +2609,7 @@ export interface TextBuffer {
   visualToTransformedMap: number[];
   /** Cached transformations per logical line */
   transformationsByLine: Transformation[][];
+  visualLayout: VisualLayout;
 
   // Actions
 
diff --git a/packages/cli/src/ui/constants.ts b/packages/cli/src/ui/constants.ts
index b211c9ce8d..f6c867f56f 100644
--- a/packages/cli/src/ui/constants.ts
+++ b/packages/cli/src/ui/constants.ts
@@ -32,3 +32,4 @@ export const MAX_MCP_RESOURCES_TO_SHOW = 10;
 export const WARNING_PROMPT_DURATION_MS = 1000;
 export const QUEUE_ERROR_DISPLAY_DURATION_MS = 3000;
 export const SHELL_ACTION_REQUIRED_TITLE_DELAY_MS = 30000;
+export const LRU_BUFFER_PERF_CACHE_LIMIT = 20000;
diff --git a/packages/cli/src/ui/contexts/VimModeContext.tsx b/packages/cli/src/ui/contexts/VimModeContext.tsx
index 66529914ee..6d53767312 100644
--- a/packages/cli/src/ui/contexts/VimModeContext.tsx
+++ b/packages/cli/src/ui/contexts/VimModeContext.tsx
@@ -32,7 +32,7 @@ export const VimModeProvider = ({
   children: React.ReactNode;
   settings: LoadedSettings;
 }) => {
-  const initialVimEnabled = settings.merged.general?.vimMode ?? false;
+  const initialVimEnabled = settings.merged.general.vimMode;
   const [vimEnabled, setVimEnabled] = useState(initialVimEnabled);
   const [vimMode, setVimMode] = useState<VimMode>(
     initialVimEnabled ? 'NORMAL' : 'INSERT',
@@ -40,13 +40,13 @@ export const VimModeProvider = ({
 
   useEffect(() => {
     // Initialize vimEnabled from settings on mount
-    const enabled = settings.merged.general?.vimMode ?? false;
+    const enabled = settings.merged.general.vimMode;
     setVimEnabled(enabled);
     // When vim mode is enabled, always start in NORMAL mode
     if (enabled) {
       setVimMode('NORMAL');
     }
-  }, [settings.merged.general?.vimMode]);
+  }, [settings.merged.general.vimMode]);
 
   const toggleVimEnabled = useCallback(async () => {
     const newValue = !vimEnabled;
diff --git a/packages/cli/src/ui/hooks/slashCommandProcessor.ts b/packages/cli/src/ui/hooks/slashCommandProcessor.ts
index c3ead63f87..238f82f9b7 100644
--- a/packages/cli/src/ui/hooks/slashCommandProcessor.ts
+++ b/packages/cli/src/ui/hooks/slashCommandProcessor.ts
@@ -28,6 +28,9 @@ import {
   ToolConfirmationOutcome,
   Storage,
   IdeClient,
+  addMCPStatusChangeListener,
+  removeMCPStatusChangeListener,
+  MCPDiscoveryState,
 } from '@google/gemini-cli-core';
 import { useSessionStats } from '../contexts/SessionContext.js';
 import type {
@@ -269,6 +272,10 @@ export const useSlashCommandProcessor = (
       ideClient.addStatusChangeListener(listener);
     })();
 
+    // Listen for MCP server status changes (e.g. connection, discovery completion)
+    // to reload slash commands (since they may include MCP prompts).
+    addMCPStatusChangeListener(listener);
+
     // TODO: Ideally this would happen more directly inside the ExtensionLoader,
     // but the CommandService today is not conducive to that since it isn't a
     // long lived service but instead gets fully re-created based on reload
@@ -289,6 +296,7 @@ export const useSlashCommandProcessor = (
         const ideClient = await IdeClient.getInstance();
         ideClient.removeStatusChangeListener(listener);
       })();
+      removeMCPStatusChangeListener(listener);
       appEvents.off('extensionsStarting', extensionEventListener);
       appEvents.off('extensionsStopping', extensionEventListener);
     };
@@ -572,9 +580,16 @@ export const useSlashCommandProcessor = (
           }
         }
 
+        const isMcpLoading =
+          config?.getMcpClientManager()?.getDiscoveryState() ===
+          MCPDiscoveryState.IN_PROGRESS;
+        const errorMessage = isMcpLoading
+          ? `Unknown command: ${trimmed}. Command might have been from an MCP server but MCP servers are not done loading.`
+          : `Unknown command: ${trimmed}`;
+
         addMessage({
           type: MessageType.ERROR,
-          content: `Unknown command: ${trimmed}`,
+          content: errorMessage,
           timestamp: new Date(),
         });
 
diff --git a/packages/cli/src/ui/hooks/useAlternateBuffer.ts b/packages/cli/src/ui/hooks/useAlternateBuffer.ts
index ba5dd460ee..45b387173a 100644
--- a/packages/cli/src/ui/hooks/useAlternateBuffer.ts
+++ b/packages/cli/src/ui/hooks/useAlternateBuffer.ts
@@ -8,7 +8,7 @@ import { useSettings } from '../contexts/SettingsContext.js';
 import type { LoadedSettings } from '../../config/settings.js';
 
 export const isAlternateBufferEnabled = (settings: LoadedSettings): boolean =>
-  settings.merged.ui?.useAlternateBuffer === true;
+  settings.merged.ui.useAlternateBuffer === true;
 
 export const useAlternateBuffer = (): boolean => {
   const settings = useSettings();
diff --git a/packages/cli/src/ui/hooks/useAtCompletion.ts b/packages/cli/src/ui/hooks/useAtCompletion.ts
index dcb6dfa478..c5f9ddb888 100644
--- a/packages/cli/src/ui/hooks/useAtCompletion.ts
+++ b/packages/cli/src/ui/hooks/useAtCompletion.ts
@@ -5,6 +5,7 @@
  */
 
 import { useEffect, useReducer, useRef } from 'react';
+import { setTimeout as setTimeoutPromise } from 'node:timers/promises';
 import type { Config, FileSearch } from '@google/gemini-cli-core';
 import { FileSearchFactory, escapePath } from '@google/gemini-cli-core';
 import type { Suggestion } from '../components/SuggestionsDisplay.js';
@@ -12,6 +13,8 @@ import { MAX_SUGGESTIONS_TO_SHOW } from '../components/SuggestionsDisplay.js';
 import { CommandKind } from '../commands/types.js';
 import { AsyncFzf } from 'fzf';
 
+const DEFAULT_SEARCH_TIMEOUT_MS = 5000;
+
 export enum AtCompletionStatus {
   IDLE = 'idle',
   INITIALIZING = 'initializing',
@@ -257,6 +260,7 @@ export function useAtCompletion(props: UseAtCompletionProps): void {
             config?.getEnableRecursiveFileSearch() ?? true,
           disableFuzzySearch:
             config?.getFileFilteringDisableFuzzySearch() ?? false,
+          maxFiles: config?.getFileFilteringOptions()?.maxFileCount,
         });
         await searcher.initialize();
         fileSearch.current = searcher;
@@ -285,6 +289,22 @@ export function useAtCompletion(props: UseAtCompletionProps): void {
         dispatch({ type: 'SET_LOADING', payload: true });
       }, 200);
 
+      const timeoutMs =
+        config?.getFileFilteringOptions()?.searchTimeout ??
+        DEFAULT_SEARCH_TIMEOUT_MS;
+
+      // eslint-disable-next-line @typescript-eslint/no-floating-promises
+      (async () => {
+        try {
+          await setTimeoutPromise(timeoutMs, undefined, {
+            signal: controller.signal,
+          });
+          controller.abort();
+        } catch {
+          // ignore
+        }
+      })();
+
       try {
         const results = await fileSearch.current.search(state.pattern, {
           signal: controller.signal,
@@ -332,6 +352,8 @@ export function useAtCompletion(props: UseAtCompletionProps): void {
         if (!(error instanceof Error && error.name === 'AbortError')) {
           dispatch({ type: 'ERROR' });
         }
+      } finally {
+        controller.abort();
       }
     };
 
diff --git a/packages/cli/src/ui/hooks/useFolderTrust.ts b/packages/cli/src/ui/hooks/useFolderTrust.ts
index b975319c83..7bc313f97c 100644
--- a/packages/cli/src/ui/hooks/useFolderTrust.ts
+++ b/packages/cli/src/ui/hooks/useFolderTrust.ts
@@ -27,7 +27,7 @@ export const useFolderTrust = (
   const [isRestarting, setIsRestarting] = useState(false);
   const startupMessageSent = useRef(false);
 
-  const folderTrust = settings.merged.security?.folderTrust?.enabled;
+  const folderTrust = settings.merged.security.folderTrust.enabled;
 
   useEffect(() => {
     const { isTrusted: trusted } = isWorkspaceTrusted(settings.merged);
diff --git a/packages/cli/src/ui/hooks/useGeminiStream.test.tsx b/packages/cli/src/ui/hooks/useGeminiStream.test.tsx
index c5a004a437..d3a3ad2836 100644
--- a/packages/cli/src/ui/hooks/useGeminiStream.test.tsx
+++ b/packages/cli/src/ui/hooks/useGeminiStream.test.tsx
@@ -36,6 +36,7 @@ import {
   debugLogger,
   coreEvents,
   CoreEvent,
+  MCPDiscoveryState,
 } from '@google/gemini-cli-core';
 import type { Part, PartListUnion } from '@google/genai';
 import type { UseHistoryManagerReturn } from './useHistoryManager.js';
@@ -178,6 +179,11 @@ describe('useGeminiStream', () => {
       return clientInstance;
     });
 
+    const mockMcpClientManager = {
+      getDiscoveryState: vi.fn().mockReturnValue(MCPDiscoveryState.COMPLETED),
+      getMcpServerCount: vi.fn().mockReturnValue(0),
+    };
+
     const contentGeneratorConfig = {
       model: 'test-model',
       apiKey: 'test-key',
@@ -211,6 +217,7 @@ describe('useGeminiStream', () => {
       getProjectRoot: vi.fn(() => '/test/dir'),
       getCheckpointingEnabled: vi.fn(() => false),
       getGeminiClient: mockGetGeminiClient,
+      getMcpClientManager: () => mockMcpClientManager as any,
       getApprovalMode: () => ApprovalMode.DEFAULT,
       getUsageStatisticsEnabled: () => true,
       getDebugMode: () => false,
@@ -254,6 +261,7 @@ describe('useGeminiStream', () => {
       .mockClear()
       .mockReturnValue((async function* () {})());
     handleAtCommandSpy = vi.spyOn(atCommandProcessor, 'handleAtCommand');
+    vi.spyOn(coreEvents, 'emitFeedback');
   });
 
   const mockLoadedSettings: LoadedSettings = {
@@ -1954,6 +1962,73 @@ describe('useGeminiStream', () => {
     });
   });
 
+  describe('MCP Discovery State', () => {
+    it('should block non-slash command queries when discovery is in progress and servers exist', async () => {
+      const mockMcpClientManager = {
+        getDiscoveryState: vi
+          .fn()
+          .mockReturnValue(MCPDiscoveryState.IN_PROGRESS),
+        getMcpServerCount: vi.fn().mockReturnValue(1),
+      };
+      mockConfig.getMcpClientManager = () => mockMcpClientManager as any;
+
+      const { result } = renderTestHook();
+
+      await act(async () => {
+        await result.current.submitQuery('test query');
+      });
+
+      expect(coreEvents.emitFeedback).toHaveBeenCalledWith(
+        'info',
+        'Waiting for MCP servers to initialize... Slash commands are still available.',
+      );
+      expect(mockSendMessageStream).not.toHaveBeenCalled();
+    });
+
+    it('should NOT block queries when discovery is NOT_STARTED but there are no servers', async () => {
+      const mockMcpClientManager = {
+        getDiscoveryState: vi
+          .fn()
+          .mockReturnValue(MCPDiscoveryState.NOT_STARTED),
+        getMcpServerCount: vi.fn().mockReturnValue(0),
+      };
+      mockConfig.getMcpClientManager = () => mockMcpClientManager as any;
+
+      const { result } = renderTestHook();
+
+      await act(async () => {
+        await result.current.submitQuery('test query');
+      });
+
+      expect(coreEvents.emitFeedback).not.toHaveBeenCalledWith(
+        'info',
+        'Waiting for MCP servers to initialize... Slash commands are still available.',
+      );
+      expect(mockSendMessageStream).toHaveBeenCalled();
+    });
+
+    it('should NOT block slash commands even when discovery is in progress', async () => {
+      const mockMcpClientManager = {
+        getDiscoveryState: vi
+          .fn()
+          .mockReturnValue(MCPDiscoveryState.IN_PROGRESS),
+        getMcpServerCount: vi.fn().mockReturnValue(1),
+      };
+      mockConfig.getMcpClientManager = () => mockMcpClientManager as any;
+
+      const { result } = renderTestHook();
+
+      await act(async () => {
+        await result.current.submitQuery('/help');
+      });
+
+      expect(coreEvents.emitFeedback).not.toHaveBeenCalledWith(
+        'info',
+        'Waiting for MCP servers to initialize... Slash commands are still available.',
+      );
+    });
+  });
+
   describe('handleFinishedEvent', () => {
     it('should add info message for MAX_TOKENS finish reason', async () => {
       // Setup mock to return a stream with MAX_TOKENS finish reason
@@ -3015,4 +3090,68 @@ describe('useGeminiStream', () => {
       });
     });
   });
+
+  describe('MCP Server Initialization', () => {
+    it('should allow slash commands to run while MCP servers are initializing', async () => {
+      const mockMcpClientManager = {
+        getDiscoveryState: vi
+          .fn()
+          .mockReturnValue(MCPDiscoveryState.IN_PROGRESS),
+        getMcpServerCount: vi.fn().mockReturnValue(1),
+      };
+      mockConfig.getMcpClientManager = () => mockMcpClientManager as any;
+
+      const { result } = renderTestHook();
+
+      await act(async () => {
+        await result.current.submitQuery('/help');
+      });
+
+      // Slash command should be handled, and no Gemini call should be made.
+      expect(mockHandleSlashCommand).toHaveBeenCalledWith('/help');
+      expect(coreEvents.emitFeedback).not.toHaveBeenCalled();
+    });
+
+    it('should block normal prompts and provide feedback while MCP servers are initializing', async () => {
+      const mockMcpClientManager = {
+        getDiscoveryState: vi
+          .fn()
+          .mockReturnValue(MCPDiscoveryState.IN_PROGRESS),
+        getMcpServerCount: vi.fn().mockReturnValue(1),
+      };
+      mockConfig.getMcpClientManager = () => mockMcpClientManager as any;
+      const { result } = renderTestHook();
+
+      await act(async () => {
+        await result.current.submitQuery('a normal prompt');
+      });
+
+      // No slash command, no Gemini call, but feedback should be emitted.
+      expect(mockHandleSlashCommand).not.toHaveBeenCalled();
+      expect(mockSendMessageStream).not.toHaveBeenCalled();
+      expect(coreEvents.emitFeedback).toHaveBeenCalledWith(
+        'info',
+        'Waiting for MCP servers to initialize... Slash commands are still available.',
+      );
+    });
+
+    it('should allow normal prompts to run when MCP servers are finished initializing', async () => {
+      const mockMcpClientManager = {
+        getDiscoveryState: vi.fn().mockReturnValue(MCPDiscoveryState.COMPLETED),
+        getMcpServerCount: vi.fn().mockReturnValue(1),
+      };
+      mockConfig.getMcpClientManager = () => mockMcpClientManager as any;
+
+      const { result } = renderTestHook();
+
+      await act(async () => {
+        await result.current.submitQuery('a normal prompt');
+      });
+
+      // Prompt should be sent to Gemini.
+      expect(mockHandleSlashCommand).not.toHaveBeenCalled();
+      expect(mockSendMessageStream).toHaveBeenCalled();
+      expect(coreEvents.emitFeedback).not.toHaveBeenCalled();
+    });
+  });
 });
diff --git a/packages/cli/src/ui/hooks/useGeminiStream.ts b/packages/cli/src/ui/hooks/useGeminiStream.ts
index 21add85556..02295dbb88 100644
--- a/packages/cli/src/ui/hooks/useGeminiStream.ts
+++ b/packages/cli/src/ui/hooks/useGeminiStream.ts
@@ -30,6 +30,7 @@ import {
   ToolErrorType,
   coreEvents,
   CoreEvent,
+  MCPDiscoveryState,
 } from '@google/gemini-cli-core';
 import type {
   Config,
@@ -83,7 +84,7 @@ enum StreamProcessingStatus {
 }
 
 function showCitations(settings: LoadedSettings): boolean {
-  const enabled = settings?.merged?.ui?.showCitations;
+  const enabled = settings.merged.ui.showCitations;
   if (enabled !== undefined) {
     return enabled;
   }
@@ -459,7 +460,7 @@ export const useGeminiStream = (
                   isClientInitiated: true,
                   prompt_id,
                 };
-                scheduleToolCalls([toolCallRequest], abortSignal);
+                await scheduleToolCalls([toolCallRequest], abortSignal);
                 return { queryToSend: null, shouldProceed: false };
               }
               case 'submit_prompt': {
@@ -782,7 +783,7 @@ export const useGeminiStream = (
 
   const handleChatModelEvent = useCallback(
     (eventValue: string, userMessageTimestamp: number) => {
-      if (!settings?.merged?.ui?.showModelInfoInChat) {
+      if (!settings.merged.ui.showModelInfoInChat) {
         return;
       }
       if (pendingHistoryItemRef.current) {
@@ -922,7 +923,7 @@ export const useGeminiStream = (
         }
       }
       if (toolCallRequests.length > 0) {
-        scheduleToolCalls(toolCallRequests, signal);
+        await scheduleToolCalls(toolCallRequests, signal);
       }
       return StreamProcessingStatus.Completed;
     },
@@ -951,6 +952,26 @@ export const useGeminiStream = (
         { name: 'submitQuery' },
         async ({ metadata: spanMetadata }) => {
           spanMetadata.input = query;
+
+          const discoveryState = config
+            .getMcpClientManager()
+            ?.getDiscoveryState();
+          const mcpServerCount =
+            config.getMcpClientManager()?.getMcpServerCount() ?? 0;
+          if (
+            !options?.isContinuation &&
+            typeof query === 'string' &&
+            !isSlashCommand(query.trim()) &&
+            mcpServerCount > 0 &&
+            discoveryState !== MCPDiscoveryState.COMPLETED
+          ) {
+            coreEvents.emitFeedback(
+              'info',
+              'Waiting for MCP servers to initialize... Slash commands are still available.',
+            );
+            return;
+          }
+
           const queryId = `${Date.now()}-${Math.random()}`;
           activeQueryIdRef.current = queryId;
           if (
diff --git a/packages/cli/src/ui/hooks/usePermissionsModifyTrust.ts b/packages/cli/src/ui/hooks/usePermissionsModifyTrust.ts
index 9d38613113..5d97ffb36d 100644
--- a/packages/cli/src/ui/hooks/usePermissionsModifyTrust.ts
+++ b/packages/cli/src/ui/hooks/usePermissionsModifyTrust.ts
@@ -85,7 +85,7 @@ export const usePermissionsModifyTrust = (
   );
   const [needsRestart, setNeedsRestart] = useState(false);
 
-  const isFolderTrustEnabled = !!settings.merged.security?.folderTrust?.enabled;
+  const isFolderTrustEnabled = !!settings.merged.security.folderTrust.enabled;
 
   const updateTrustLevel = useCallback(
     (trustLevel: TrustLevel) => {
diff --git a/packages/cli/src/ui/hooks/useReactToolScheduler.ts b/packages/cli/src/ui/hooks/useReactToolScheduler.ts
index 8939f5aa80..53f345948a 100644
--- a/packages/cli/src/ui/hooks/useReactToolScheduler.ts
+++ b/packages/cli/src/ui/hooks/useReactToolScheduler.ts
@@ -32,7 +32,7 @@ import { ToolCallStatus } from '../types.js';
 export type ScheduleFn = (
   request: ToolCallRequestInfo | ToolCallRequestInfo[],
   signal: AbortSignal,
-) => void;
+) => Promise<void>;
 export type MarkToolsAsSubmittedFn = (callIds: string[]) => void;
 
 export type TrackedScheduledToolCall = ScheduledToolCall & {
@@ -181,7 +181,7 @@ export function useReactToolScheduler(
       signal: AbortSignal,
     ) => {
       setToolCallsForDisplay([]);
-      void scheduler.schedule(request, signal);
+      return scheduler.schedule(request, signal);
     },
     [scheduler, setToolCallsForDisplay],
   );
diff --git a/packages/cli/src/ui/hooks/useShowMemoryCommand.ts b/packages/cli/src/ui/hooks/useShowMemoryCommand.ts
index 40b2c6ba76..d9c105d279 100644
--- a/packages/cli/src/ui/hooks/useShowMemoryCommand.ts
+++ b/packages/cli/src/ui/hooks/useShowMemoryCommand.ts
@@ -32,7 +32,7 @@ export function createShowMemoryAction(
 
     const currentMemory = config.getUserMemory();
     const fileCount = config.getGeminiMdFileCount();
-    const contextFileName = settings.merged.context?.fileName;
+    const contextFileName = settings.merged.context.fileName;
     const contextFileNames = Array.isArray(contextFileName)
       ? contextFileName
       : [contextFileName];
diff --git a/packages/cli/src/ui/hooks/useThemeCommand.ts b/packages/cli/src/ui/hooks/useThemeCommand.ts
index 47252b9aff..38a06ea32e 100644
--- a/packages/cli/src/ui/hooks/useThemeCommand.ts
+++ b/packages/cli/src/ui/hooks/useThemeCommand.ts
@@ -67,7 +67,7 @@ export const useThemeCommand = (
 
   const closeThemeDialog = useCallback(() => {
     // Re-apply the saved theme to revert any preview changes from highlighting
-    applyTheme(loadedSettings.merged.ui?.theme);
+    applyTheme(loadedSettings.merged.ui.theme);
     setIsThemeDialogOpen(false);
   }, [applyTheme, loadedSettings]);
 
@@ -88,10 +88,10 @@ export const useThemeCommand = (
           return;
         }
         loadedSettings.setValue(scope, 'ui.theme', themeName); // Update the merged settings
-        if (loadedSettings.merged.ui?.customThemes) {
-          themeManager.loadCustomThemes(loadedSettings.merged.ui?.customThemes);
+        if (loadedSettings.merged.ui.customThemes) {
+          themeManager.loadCustomThemes(loadedSettings.merged.ui.customThemes);
         }
-        applyTheme(loadedSettings.merged.ui?.theme); // Apply the current theme
+        applyTheme(loadedSettings.merged.ui.theme); // Apply the current theme
         setThemeError(null);
       } finally {
         setIsThemeDialogOpen(false); // Close the dialog
diff --git a/packages/cli/src/ui/hooks/useToolScheduler.test.ts b/packages/cli/src/ui/hooks/useToolScheduler.test.ts
index 1ffaa61cc7..a1fbe21dd3 100644
--- a/packages/cli/src/ui/hooks/useToolScheduler.test.ts
+++ b/packages/cli/src/ui/hooks/useToolScheduler.test.ts
@@ -172,8 +172,8 @@ describe('useReactToolScheduler in YOLO Mode', () => {
       args: { data: 'any data' },
     } as any;
 
-    act(() => {
-      schedule(request, new AbortController().signal);
+    await act(async () => {
+      await schedule(request, new AbortController().signal);
     });
 
     await act(async () => {
@@ -229,11 +229,11 @@ describe('useReactToolScheduler', () => {
     schedule: (
       req: ToolCallRequestInfo | ToolCallRequestInfo[],
       signal: AbortSignal,
-    ) => void,
+    ) => Promise<void>,
     request: ToolCallRequestInfo | ToolCallRequestInfo[],
   ) => {
-    act(() => {
-      schedule(request, new AbortController().signal);
+    await act(async () => {
+      await schedule(request, new AbortController().signal);
     });
 
     await advanceAndSettle();
@@ -322,10 +322,13 @@ describe('useReactToolScheduler', () => {
 
   it('should clear previous tool calls when scheduling new ones', async () => {
     mockToolRegistry.getTool.mockReturnValue(mockTool);
-    (mockTool.execute as Mock).mockResolvedValue({
-      llmContent: 'Tool output',
-      returnDisplay: 'Formatted tool output',
-    } as ToolResult);
+    (mockTool.execute as Mock).mockImplementation(async () => {
+      await new Promise((r) => setTimeout(r, 10));
+      return {
+        llmContent: 'Tool output',
+        returnDisplay: 'Formatted tool output',
+      };
+    });
 
     const { result } = renderScheduler();
     const schedule = result.current[1];
@@ -346,10 +349,13 @@ describe('useReactToolScheduler', () => {
       name: 'mockTool',
       args: {},
     } as any;
-    act(() => {
-      schedule(newRequest, new AbortController().signal);
+    let schedulePromise: Promise<void>;
+    await act(async () => {
+      schedulePromise = schedule(newRequest, new AbortController().signal);
     });
 
+    await advanceAndSettle();
+
     // After scheduling, the old call should be gone,
     // and the new one should be in the display in its initial state.
     expect(result.current[0].length).toBe(1);
@@ -358,14 +364,13 @@ describe('useReactToolScheduler', () => {
 
     // Let the new call finish.
     await act(async () => {
-      await vi.advanceTimersByTimeAsync(0);
+      await vi.advanceTimersByTimeAsync(20);
     });
+
     await act(async () => {
-      await vi.advanceTimersByTimeAsync(0);
-    });
-    await act(async () => {
-      await vi.advanceTimersByTimeAsync(0);
+      await schedulePromise;
     });
+
     expect(onComplete).toHaveBeenCalled();
   });
 
@@ -388,16 +393,14 @@ describe('useReactToolScheduler', () => {
       args: {},
     } as any;
 
-    act(() => {
-      schedule(request, new AbortController().signal);
-    });
+    let schedulePromise: Promise<void>;
     await act(async () => {
-      await vi.advanceTimersByTimeAsync(0);
-    }); // validation
-    await act(async () => {
-      await vi.advanceTimersByTimeAsync(0); // Process scheduling
+      schedulePromise = schedule(request, new AbortController().signal);
     });
 
+    await advanceAndSettle(); // validation
+    await advanceAndSettle(); // Process scheduling
+
     // At this point, the tool is 'executing' and waiting on the promise.
     expect(result.current[0][0].status).toBe('executing');
 
@@ -406,9 +409,7 @@ describe('useReactToolScheduler', () => {
       cancelAllToolCalls(cancelController.signal);
     });
 
-    await act(async () => {
-      await vi.advanceTimersByTimeAsync(0);
-    });
+    await advanceAndSettle();
 
     expect(onComplete).toHaveBeenCalledWith([
       expect.objectContaining({
@@ -421,6 +422,11 @@ describe('useReactToolScheduler', () => {
     await act(async () => {
       resolveExecute({ llmContent: 'output', returnDisplay: 'display' });
     });
+
+    // Now await the schedule promise
+    await act(async () => {
+      await schedulePromise;
+    });
   });
 
   it.each([
@@ -520,8 +526,9 @@ describe('useReactToolScheduler', () => {
       args: { data: 'sensitive' },
     } as any;
 
-    act(() => {
-      schedule(request, new AbortController().signal);
+    let schedulePromise: Promise<void>;
+    await act(async () => {
+      schedulePromise = schedule(request, new AbortController().signal);
     });
     await advanceAndSettle();
 
@@ -535,8 +542,11 @@ describe('useReactToolScheduler', () => {
     });
 
     await advanceAndSettle();
-    await advanceAndSettle();
-    await advanceAndSettle();
+
+    // Now await the schedule promise as it should complete
+    await act(async () => {
+      await schedulePromise;
+    });
 
     expect(mockOnUserConfirmForToolConfirmation).toHaveBeenCalledWith(
       ToolConfirmationOutcome.ProceedOnce,
@@ -567,8 +577,9 @@ describe('useReactToolScheduler', () => {
       args: {},
     } as any;
 
-    act(() => {
-      schedule(request, new AbortController().signal);
+    let schedulePromise: Promise<void>;
+    await act(async () => {
+      schedulePromise = schedule(request, new AbortController().signal);
     });
     await advanceAndSettle();
 
@@ -580,8 +591,13 @@ describe('useReactToolScheduler', () => {
     await act(async () => {
       await capturedOnConfirmForTest?.(ToolConfirmationOutcome.Cancel);
     });
+
     await advanceAndSettle();
-    await advanceAndSettle();
+
+    // Now await the schedule promise
+    await act(async () => {
+      await schedulePromise;
+    });
 
     expect(mockOnUserConfirmForToolConfirmation).toHaveBeenCalledWith(
       ToolConfirmationOutcome.Cancel,
@@ -628,8 +644,12 @@ describe('useReactToolScheduler', () => {
       args: {},
     } as any;
 
-    act(() => {
-      result.current[1](request, new AbortController().signal);
+    let schedulePromise: Promise<void>;
+    await act(async () => {
+      schedulePromise = result.current[1](
+        request,
+        new AbortController().signal,
+      );
     });
     await advanceAndSettle();
 
@@ -653,7 +673,11 @@ describe('useReactToolScheduler', () => {
       } as ToolResult);
     });
     await advanceAndSettle();
-    await advanceAndSettle();
+
+    // Now await schedule
+    await act(async () => {
+      await schedulePromise;
+    });
 
     const completedCalls = onComplete.mock.calls[0][0] as ToolCall[];
     expect(completedCalls[0].status).toBe('success');
@@ -699,8 +723,8 @@ describe('useReactToolScheduler', () => {
       { callId: 'multi2', name: 'tool2', args: { p: 2 } } as any,
     ];
 
-    act(() => {
-      schedule(requests, new AbortController().signal);
+    await act(async () => {
+      await schedule(requests, new AbortController().signal);
     });
     await act(async () => {
       await vi.advanceTimersByTimeAsync(0);
@@ -791,24 +815,30 @@ describe('useReactToolScheduler', () => {
       args: {},
     } as any;
 
-    act(() => {
-      schedule(request1, new AbortController().signal);
+    let schedulePromise1: Promise<void>;
+    let schedulePromise2: Promise<void>;
+
+    await act(async () => {
+      schedulePromise1 = schedule(request1, new AbortController().signal);
     });
     await act(async () => {
       await vi.advanceTimersByTimeAsync(0);
     });
 
-    act(() => {
-      schedule(request2, new AbortController().signal);
+    await act(async () => {
+      schedulePromise2 = schedule(request2, new AbortController().signal);
     });
 
     await act(async () => {
       await vi.advanceTimersByTimeAsync(50);
       await vi.advanceTimersByTimeAsync(0);
-      await act(async () => {
-        await vi.advanceTimersByTimeAsync(0);
-      });
     });
+
+    // Wait for first to complete
+    await act(async () => {
+      await schedulePromise1;
+    });
+
     expect(onComplete).toHaveBeenCalledWith([
       expect.objectContaining({
         status: 'success',
@@ -816,13 +846,17 @@ describe('useReactToolScheduler', () => {
         response: expect.objectContaining({ resultDisplay: 'done display' }),
       }),
     ]);
+
     await act(async () => {
       await vi.advanceTimersByTimeAsync(50);
       await vi.advanceTimersByTimeAsync(0);
-      await act(async () => {
-        await vi.advanceTimersByTimeAsync(0);
-      });
     });
+
+    // Wait for second to complete
+    await act(async () => {
+      await schedulePromise2;
+    });
+
     expect(onComplete).toHaveBeenCalledWith([
       expect.objectContaining({
         status: 'success',
diff --git a/packages/cli/src/ui/utils/CodeColorizer.tsx b/packages/cli/src/ui/utils/CodeColorizer.tsx
index 75571883f4..ed5326eec7 100644
--- a/packages/cli/src/ui/utils/CodeColorizer.tsx
+++ b/packages/cli/src/ui/utils/CodeColorizer.tsx
@@ -149,7 +149,7 @@ export function colorizeCode({
   const activeTheme = theme || themeManager.getActiveTheme();
   const showLineNumbers = hideLineNumbers
     ? false
-    : (settings?.merged.ui?.showLineNumbers ?? true);
+    : settings.merged.ui.showLineNumbers;
 
   const useMaxSizedBox = !isAlternateBufferEnabled(settings);
   try {
diff --git a/packages/cli/src/ui/utils/commandUtils.test.ts b/packages/cli/src/ui/utils/commandUtils.test.ts
index ba5aeaab35..9a423e6abc 100644
--- a/packages/cli/src/ui/utils/commandUtils.test.ts
+++ b/packages/cli/src/ui/utils/commandUtils.test.ts
@@ -33,6 +33,7 @@ vi.mock('child_process');
 // fs (for /dev/tty)
 const mockFs = vi.hoisted(() => ({
   createWriteStream: vi.fn(),
+  constants: { W_OK: 2 },
 }));
 vi.mock('node:fs', () => ({
   default: mockFs,
@@ -63,10 +64,12 @@ const makeWritable = (opts?: { isTTY?: boolean; writeReturn?: boolean }) => {
     once: EventEmitter.prototype.once,
     on: EventEmitter.prototype.on,
     off: EventEmitter.prototype.off,
+    removeAllListeners: EventEmitter.prototype.removeAllListeners,
   }) as unknown as EventEmitter & {
     write: Mock;
     end: Mock;
     isTTY?: boolean;
+    removeAllListeners: Mock;
   };
   return stream;
 };
@@ -125,9 +128,11 @@ describe('commandUtils', () => {
     // Setup clipboardy mock
     mockClipboardyWrite = clipboardy.write as Mock;
 
-    // default: no /dev/tty available
+    // default: /dev/tty creation succeeds and emits 'open'
     mockFs.createWriteStream.mockImplementation(() => {
-      throw new Error('ENOENT');
+      const tty = makeWritable({ isTTY: true });
+      setTimeout(() => tty.emit('open'), 0);
+      return tty;
     });
 
     // default: stdio are not TTY for tests unless explicitly set
@@ -224,7 +229,10 @@ describe('commandUtils', () => {
     it('writes OSC-52 to /dev/tty when in SSH', async () => {
       const testText = 'abc';
       const tty = makeWritable({ isTTY: true });
-      mockFs.createWriteStream.mockReturnValue(tty);
+      mockFs.createWriteStream.mockImplementation(() => {
+        setTimeout(() => tty.emit('open'), 0);
+        return tty;
+      });
 
       process.env['SSH_CONNECTION'] = '1';
 
@@ -242,7 +250,10 @@ describe('commandUtils', () => {
     it('wraps OSC-52 for tmux when in SSH', async () => {
       const testText = 'tmux-copy';
       const tty = makeWritable({ isTTY: true });
-      mockFs.createWriteStream.mockReturnValue(tty);
+      mockFs.createWriteStream.mockImplementation(() => {
+        setTimeout(() => tty.emit('open'), 0);
+        return tty;
+      });
 
       process.env['SSH_CONNECTION'] = '1';
       process.env['TMUX'] = '1';
@@ -262,7 +273,10 @@ describe('commandUtils', () => {
       // ensure payload > chunk size (240) so there are multiple chunks
       const testText = 'x'.repeat(1200);
       const tty = makeWritable({ isTTY: true });
-      mockFs.createWriteStream.mockReturnValue(tty);
+      mockFs.createWriteStream.mockImplementation(() => {
+        setTimeout(() => tty.emit('open'), 0);
+        return tty;
+      });
 
       process.env['SSH_CONNECTION'] = '1';
       process.env['STY'] = 'screen-session';
@@ -290,6 +304,13 @@ describe('commandUtils', () => {
 
       process.env['SSH_TTY'] = '/dev/pts/1';
 
+      // Simulate /dev/tty access failure
+      mockFs.createWriteStream.mockImplementation(() => {
+        const tty = makeWritable({ isTTY: true });
+        setTimeout(() => tty.emit('error', new Error('EACCES')), 0);
+        return tty;
+      });
+
       await copyToClipboard(testText);
 
       const b64 = Buffer.from(testText, 'utf8').toString('base64');
@@ -303,7 +324,11 @@ describe('commandUtils', () => {
       const testText = 'no-tty';
       mockClipboardyWrite.mockResolvedValue(undefined);
 
-      // /dev/tty throws; stderr/stdout are non-TTY by default
+      // /dev/tty throws or errors
+      mockFs.createWriteStream.mockImplementation(() => {
+        throw new Error('ENOENT');
+      });
+
       process.env['SSH_CLIENT'] = 'client';
 
       await copyToClipboard(testText);
@@ -313,7 +338,10 @@ describe('commandUtils', () => {
 
     it('resolves on drain when backpressure occurs', async () => {
       const tty = makeWritable({ isTTY: true, writeReturn: false });
-      mockFs.createWriteStream.mockReturnValue(tty);
+      mockFs.createWriteStream.mockImplementation(() => {
+        setTimeout(() => tty.emit('open'), 0);
+        return tty;
+      });
       process.env['SSH_CONNECTION'] = '1';
 
       const p = copyToClipboard('drain-test');
@@ -325,7 +353,10 @@ describe('commandUtils', () => {
 
     it('propagates errors from OSC-52 write path', async () => {
       const tty = makeWritable({ isTTY: true, writeReturn: false });
-      mockFs.createWriteStream.mockReturnValue(tty);
+      mockFs.createWriteStream.mockImplementation(() => {
+        setTimeout(() => tty.emit('open'), 0);
+        return tty;
+      });
       process.env['SSH_CONNECTION'] = '1';
 
       const p = copyToClipboard('err-test');
@@ -349,7 +380,10 @@ describe('commandUtils', () => {
 
     it('uses clipboardy when not in eligible env even if /dev/tty exists', async () => {
       const tty = makeWritable({ isTTY: true });
-      mockFs.createWriteStream.mockReturnValue(tty);
+      mockFs.createWriteStream.mockImplementation(() => {
+        setTimeout(() => tty.emit('open'), 0);
+        return tty;
+      });
       const text = 'local-terminal';
       mockClipboardyWrite.mockResolvedValue(undefined);
 
@@ -360,9 +394,31 @@ describe('commandUtils', () => {
       expect(tty.end).not.toHaveBeenCalled();
     });
 
+    it('falls back if /dev/tty emits error (e.g. sandbox)', async () => {
+      const testText = 'access-denied-fallback';
+      process.env['SSH_CONNECTION'] = '1'; // normally would trigger OSC52 on TTY
+
+      mockFs.createWriteStream.mockImplementation(() => {
+        const stream = makeWritable({ isTTY: true });
+        // Emit error instead of open
+        setTimeout(() => stream.emit('error', new Error('EACCES')), 0);
+        return stream;
+      });
+
+      // Fallback to clipboardy since stdio isn't configured as TTY in this test (default from beforeEach)
+      mockClipboardyWrite.mockResolvedValue(undefined);
+
+      await copyToClipboard(testText);
+
+      expect(mockFs.createWriteStream).toHaveBeenCalled();
+      expect(mockClipboardyWrite).toHaveBeenCalledWith(testText);
+    });
     it('uses clipboardy in tmux when not in SSH/WSL', async () => {
       const tty = makeWritable({ isTTY: true });
-      mockFs.createWriteStream.mockReturnValue(tty);
+      mockFs.createWriteStream.mockImplementation(() => {
+        setTimeout(() => tty.emit('open'), 0);
+        return tty;
+      });
       const text = 'tmux-local';
       mockClipboardyWrite.mockResolvedValue(undefined);
 
@@ -375,6 +431,24 @@ describe('commandUtils', () => {
       expect(tty.end).not.toHaveBeenCalled();
     });
 
+    it('falls back if /dev/tty hangs (timeout)', async () => {
+      const testText = 'timeout-fallback';
+      process.env['SSH_CONNECTION'] = '1';
+
+      mockFs.createWriteStream.mockImplementation(() =>
+        // Stream that never emits open or error
+        makeWritable({ isTTY: true }),
+      );
+
+      mockClipboardyWrite.mockResolvedValue(undefined);
+
+      // Should complete even though stream hangs
+      await copyToClipboard(testText);
+
+      expect(mockFs.createWriteStream).toHaveBeenCalled();
+      expect(mockClipboardyWrite).toHaveBeenCalledWith(testText);
+    });
+
     it('skips /dev/tty on Windows and uses stderr fallback for OSC-52', async () => {
       mockProcess.platform = 'win32';
       const stderrStream = makeWritable({ isTTY: true });
diff --git a/packages/cli/src/ui/utils/commandUtils.ts b/packages/cli/src/ui/utils/commandUtils.ts
index 87a873cb64..d8894503e3 100644
--- a/packages/cli/src/ui/utils/commandUtils.ts
+++ b/packages/cli/src/ui/utils/commandUtils.ts
@@ -65,20 +65,50 @@ const SCREEN_DCS_CHUNK_SIZE = 240;
 
 type TtyTarget = { stream: Writable; closeAfter: boolean } | null;
 
-const pickTty = (): TtyTarget => {
-  // /dev/tty is only available on Unix-like systems (Linux, macOS, BSD, etc.)
-  if (process.platform !== 'win32') {
-    // Prefer the controlling TTY to avoid interleaving escape sequences with piped stdout.
-    try {
-      const devTty = fs.createWriteStream('/dev/tty');
-      // Prevent unhandled 'error' events from crashing the process.
-      devTty.on('error', () => {});
-      return { stream: devTty, closeAfter: true };
-    } catch {
-      // fall through - /dev/tty not accessible
-    }
-  }
+const pickTty = (): Promise<TtyTarget> =>
+  new Promise((resolve) => {
+    // /dev/tty is only available on Unix-like systems (Linux, macOS, BSD, etc.)
+    if (process.platform !== 'win32') {
+      // Prefer the controlling TTY to avoid interleaving escape sequences with piped stdout.
+      try {
+        const devTty = fs.createWriteStream('/dev/tty');
 
+        // Safety timeout: if /dev/tty doesn't respond quickly, fallback to avoid hanging.
+        const timeout = setTimeout(() => {
+          // Remove listeners to prevent them from firing after timeout.
+          devTty.removeAllListeners('open');
+          devTty.removeAllListeners('error');
+          devTty.destroy();
+          resolve(getStdioTty());
+        }, 100);
+
+        // If we can't open it (e.g. sandbox), we'll get an error.
+        // We wait for 'open' to confirm it's usable, or 'error' to fallback.
+        // If it opens, we resolve with the stream.
+        devTty.once('open', () => {
+          clearTimeout(timeout);
+          devTty.removeAllListeners('error');
+          // Prevent future unhandled 'error' events from crashing the process
+          devTty.on('error', () => {});
+          resolve({ stream: devTty, closeAfter: true });
+        });
+
+        // If it errors immediately (or quickly), we fallback.
+        devTty.once('error', () => {
+          clearTimeout(timeout);
+          devTty.removeAllListeners('open');
+          resolve(getStdioTty());
+        });
+        return;
+      } catch {
+        // fall through - synchronous failure
+      }
+    }
+
+    resolve(getStdioTty());
+  });
+
+const getStdioTty = (): TtyTarget => {
   if (process.stderr?.isTTY)
     return { stream: process.stderr, closeAfter: false };
   if (process.stdout?.isTTY)
@@ -172,7 +202,7 @@ const writeAll = (stream: Writable, data: string): Promise<void> =>
 export const copyToClipboard = async (text: string): Promise<void> => {
   if (!text) return;
 
-  const tty = pickTty();
+  const tty = await pickTty();
 
   if (shouldUseOsc52(tty)) {
     const osc = buildOsc52(text);
diff --git a/packages/cli/src/ui/utils/highlight.test.ts b/packages/cli/src/ui/utils/highlight.test.ts
index ba2cc09eea..db98ae90a6 100644
--- a/packages/cli/src/ui/utils/highlight.test.ts
+++ b/packages/cli/src/ui/utils/highlight.test.ts
@@ -212,13 +212,13 @@ describe('parseInputForHighlighting with Transformations', () => {
   });
 
   it('should handle empty transformations array', () => {
-    const line = 'Check out @test.png';
+    const line = 'Check out @test_no_transform.png';
     const result = parseInputForHighlighting(line, 0, [], 0);
 
     // Should fall back to default highlighting
     expect(result).toEqual([
       { text: 'Check out ', type: 'default' },
-      { text: '@test.png', type: 'file' },
+      { text: '@test_no_transform.png', type: 'file' },
     ]);
   });
 
diff --git a/packages/cli/src/ui/utils/highlight.ts b/packages/cli/src/ui/utils/highlight.ts
index 475854a3dd..3d182f2451 100644
--- a/packages/cli/src/ui/utils/highlight.ts
+++ b/packages/cli/src/ui/utils/highlight.ts
@@ -4,8 +4,10 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import { LruCache } from '@google/gemini-cli-core';
 import type { Transformation } from '../components/shared/text-buffer.js';
 import { cpLen, cpSlice } from './textUtils.js';
+import { LRU_BUFFER_PERF_CACHE_LIMIT } from '../constants.js';
 
 export type HighlightToken = {
   text: string;
@@ -18,12 +20,30 @@ export type HighlightToken = {
 // semicolon, common punctuation, and brackets.
 const HIGHLIGHT_REGEX = /(^\/[a-zA-Z0-9_-]+|@(?:\\ |[^,\s;!?()[\]{}])+)/g;
 
+const highlightCache = new LruCache<string, readonly HighlightToken[]>(
+  LRU_BUFFER_PERF_CACHE_LIMIT,
+);
+
 export function parseInputForHighlighting(
   text: string,
   index: number,
   transformations: Transformation[] = [],
   cursorCol?: number,
 ): readonly HighlightToken[] {
+  let isCursorInsideTransform = false;
+  if (cursorCol !== undefined) {
+    for (const transform of transformations) {
+      if (cursorCol >= transform.logStart && cursorCol <= transform.logEnd) {
+        isCursorInsideTransform = true;
+        break;
+      }
+    }
+  }
+
+  const cacheKey = `${index === 0 ? 'F' : 'N'}:${isCursorInsideTransform ? cursorCol : 'NC'}:${text}`;
+  const cached = highlightCache.get(cacheKey);
+  if (cached !== undefined) return cached;
+
   HIGHLIGHT_REGEX.lastIndex = 0;
 
   if (!text) {
@@ -79,7 +99,7 @@ export function parseInputForHighlighting(
     tokens.push(...parseUntransformedInput(textBeforeTransformation));
 
     const isCursorInside =
-      typeof cursorCol === 'number' &&
+      cursorCol !== undefined &&
       cursorCol >= transformation.logStart &&
       cursorCol <= transformation.logEnd;
     const transformationText = isCursorInside
@@ -92,6 +112,9 @@ export function parseInputForHighlighting(
 
   const textAfterFinalTransformation = cpSlice(text, column);
   tokens.push(...parseUntransformedInput(textAfterFinalTransformation));
+
+  highlightCache.set(cacheKey, tokens);
+
   return tokens;
 }
 
diff --git a/packages/cli/src/ui/utils/textUtils.ts b/packages/cli/src/ui/utils/textUtils.ts
index 13c009a136..86d345047d 100644
--- a/packages/cli/src/ui/utils/textUtils.ts
+++ b/packages/cli/src/ui/utils/textUtils.ts
@@ -8,6 +8,8 @@ import stripAnsi from 'strip-ansi';
 import ansiRegex from 'ansi-regex';
 import { stripVTControlCharacters } from 'node:util';
 import stringWidth from 'string-width';
+import { LruCache } from '@google/gemini-cli-core';
+import { LRU_BUFFER_PERF_CACHE_LIMIT } from '../constants.js';
 
 /**
  * Calculates the maximum width of a multi-line ASCII art string.
@@ -28,9 +30,11 @@ export const getAsciiArtWidth = (asciiArt: string): number => {
  *  code units so that surrogate‑pair emoji count as one "column".)
  * ---------------------------------------------------------------------- */
 
-// Cache for code points to reduce GC pressure
-const codePointsCache = new Map<string, string[]>();
+// Cache for code points
 const MAX_STRING_LENGTH_TO_CACHE = 1000;
+const codePointsCache = new LruCache<string, string[]>(
+  LRU_BUFFER_PERF_CACHE_LIMIT,
+);
 
 export function toCodePoints(str: string): string[] {
   // ASCII fast path - check if all chars are ASCII (0-127)
@@ -48,14 +52,14 @@ export function toCodePoints(str: string): string[] {
   // Cache short strings
   if (str.length <= MAX_STRING_LENGTH_TO_CACHE) {
     const cached = codePointsCache.get(str);
-    if (cached) {
+    if (cached !== undefined) {
       return cached;
     }
   }
 
   const result = Array.from(str);
 
-  // Cache result (unlimited like Ink)
+  // Cache result
   if (str.length <= MAX_STRING_LENGTH_TO_CACHE) {
     codePointsCache.set(str, result);
   }
@@ -119,21 +123,26 @@ export function stripUnsafeCharacters(str: string): string {
     .join('');
 }
 
-// String width caching for performance optimization
-const stringWidthCache = new Map<string, number>();
+const stringWidthCache = new LruCache<string, number>(
+  LRU_BUFFER_PERF_CACHE_LIMIT,
+);
 
 /**
  * Cached version of stringWidth function for better performance
- * Follows Ink's approach with unlimited cache (no eviction)
  */
 export const getCachedStringWidth = (str: string): number => {
-  // ASCII printable chars have width 1
-  if (/^[\x20-\x7E]*$/.test(str)) {
-    return str.length;
+  // ASCII printable chars (32-126) have width 1.
+  // This is a very frequent path, so we use a fast numeric check.
+  if (str.length === 1) {
+    const code = str.charCodeAt(0);
+    if (code >= 0x20 && code <= 0x7e) {
+      return 1;
+    }
   }
 
-  if (stringWidthCache.has(str)) {
-    return stringWidthCache.get(str)!;
+  const cached = stringWidthCache.get(str);
+  if (cached !== undefined) {
+    return cached;
   }
 
   let width: number;
diff --git a/packages/cli/src/ui/utils/ui-sizing.ts b/packages/cli/src/ui/utils/ui-sizing.ts
index 26d28fefa4..bb9ef1b6f6 100644
--- a/packages/cli/src/ui/utils/ui-sizing.ts
+++ b/packages/cli/src/ui/utils/ui-sizing.ts
@@ -27,7 +27,7 @@ export const calculateMainAreaWidth = (
   terminalWidth: number,
   settings: LoadedSettings,
 ): number => {
-  if (settings.merged.ui?.useFullWidth) {
+  if (settings.merged.ui.useFullWidth) {
     if (isAlternateBufferEnabled(settings)) {
       return terminalWidth - 1;
     }
diff --git a/packages/cli/src/ui/utils/updateCheck.test.ts b/packages/cli/src/ui/utils/updateCheck.test.ts
index 6ab29d6667..5cf4d532a3 100644
--- a/packages/cli/src/ui/utils/updateCheck.test.ts
+++ b/packages/cli/src/ui/utils/updateCheck.test.ts
@@ -46,7 +46,7 @@ describe('checkForUpdates', () => {
   });
 
   it('should return null if disableUpdateNag is true', async () => {
-    mockSettings.merged.general!.disableUpdateNag = true;
+    mockSettings.merged.general.disableUpdateNag = true;
     const result = await checkForUpdates(mockSettings);
     expect(result).toBeNull();
     expect(getPackageJson).not.toHaveBeenCalled();
diff --git a/packages/cli/src/ui/utils/updateCheck.ts b/packages/cli/src/ui/utils/updateCheck.ts
index 000b37070d..d5f609bf01 100644
--- a/packages/cli/src/ui/utils/updateCheck.ts
+++ b/packages/cli/src/ui/utils/updateCheck.ts
@@ -51,7 +51,7 @@ export async function checkForUpdates(
   settings: LoadedSettings,
 ): Promise<UpdateObject | null> {
   try {
-    if (settings.merged.general?.disableUpdateNag) {
+    if (settings.merged.general.disableUpdateNag) {
       return null;
     }
     // Skip update check when running from source (development mode)
diff --git a/packages/cli/src/utils/agentSettings.ts b/packages/cli/src/utils/agentSettings.ts
index adf444c4ba..adb1c946cf 100644
--- a/packages/cli/src/utils/agentSettings.ts
+++ b/packages/cli/src/utils/agentSettings.ts
@@ -10,7 +10,6 @@ import {
   type LoadedSettings,
 } from '../config/settings.js';
 import type { ModifiedScope } from './skillSettings.js';
-import type { AgentOverride } from '@google/gemini-cli-core';
 
 export type AgentActionStatus = 'success' | 'no-op' | 'error';
 
@@ -44,8 +43,8 @@ export function enableAgent(
   for (const scope of writableScopes) {
     if (isLoadableSettingScope(scope)) {
       const scopePath = settings.forScope(scope).path;
-      const agentOverrides = settings.forScope(scope).settings.agents
-        ?.overrides as Record<string, AgentOverride> | undefined;
+      const agentOverrides =
+        settings.forScope(scope).settings.agents?.overrides;
       const isDisabled = agentOverrides?.[agentName]?.disabled === true;
 
       if (isDisabled) {
@@ -105,9 +104,7 @@ export function disableAgent(
   }
 
   const scopePath = settings.forScope(scope).path;
-  const agentOverrides = settings.forScope(scope).settings.agents?.overrides as
-    | Record<string, AgentOverride>
-    | undefined;
+  const agentOverrides = settings.forScope(scope).settings.agents?.overrides;
   const isDisabled = agentOverrides?.[agentName]?.disabled === true;
 
   if (isDisabled) {
@@ -128,8 +125,8 @@ export function disableAgent(
   const alreadyDisabledInOther: ModifiedScope[] = [];
 
   if (isLoadableSettingScope(otherScope)) {
-    const otherOverrides = settings.forScope(otherScope).settings.agents
-      ?.overrides as Record<string, AgentOverride> | undefined;
+    const otherOverrides =
+      settings.forScope(otherScope).settings.agents?.overrides;
     if (otherOverrides?.[agentName]?.disabled === true) {
       alreadyDisabledInOther.push({
         scope: otherScope,
diff --git a/packages/cli/src/utils/handleAutoUpdate.test.ts b/packages/cli/src/utils/handleAutoUpdate.test.ts
index d7134d44db..0a29cf3229 100644
--- a/packages/cli/src/utils/handleAutoUpdate.test.ts
+++ b/packages/cli/src/utils/handleAutoUpdate.test.ts
@@ -14,6 +14,7 @@ import EventEmitter from 'node:events';
 import type { ChildProcess } from 'node:child_process';
 import { handleAutoUpdate, setUpdateHandler } from './handleAutoUpdate.js';
 import { MessageType } from '../ui/types.js';
+import { mergeSettings } from '../config/settings.js';
 
 vi.mock('./installationInfo.js', async () => {
   const actual = await vi.importActual('./installationInfo.js');
@@ -49,12 +50,9 @@ describe('handleAutoUpdate', () => {
       message: 'An update is available!',
     };
 
+    const defaultMergedSettings = mergeSettings({}, {}, {}, {}, true);
     mockSettings = {
-      merged: {
-        general: {
-          disableAutoUpdate: false,
-        },
-      },
+      merged: defaultMergedSettings,
     } as LoadedSettings;
 
     mockChildProcess = Object.assign(new EventEmitter(), {
@@ -82,7 +80,7 @@ describe('handleAutoUpdate', () => {
   });
 
   it('should do nothing if update nag is disabled', () => {
-    mockSettings.merged.general!.disableUpdateNag = true;
+    mockSettings.merged.general.disableUpdateNag = true;
     handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', mockSpawn);
     expect(mockGetInstallationInfo).not.toHaveBeenCalled();
     expect(updateEventEmitter.emit).not.toHaveBeenCalled();
@@ -90,7 +88,7 @@ describe('handleAutoUpdate', () => {
   });
 
   it('should emit "update-received" but not update if auto-updates are disabled', () => {
-    mockSettings.merged.general!.disableAutoUpdate = true;
+    mockSettings.merged.general.disableAutoUpdate = true;
     mockGetInstallationInfo.mockReturnValue({
       updateCommand: 'npm i -g @google/gemini-cli@latest',
       updateMessage: 'Please update manually.',
diff --git a/packages/cli/src/utils/handleAutoUpdate.ts b/packages/cli/src/utils/handleAutoUpdate.ts
index b1940c3037..9cadc0bd59 100644
--- a/packages/cli/src/utils/handleAutoUpdate.ts
+++ b/packages/cli/src/utils/handleAutoUpdate.ts
@@ -23,20 +23,20 @@ export function handleAutoUpdate(
     return;
   }
 
-  if (settings.merged.tools?.sandbox || process.env['GEMINI_SANDBOX']) {
+  if (settings.merged.tools.sandbox || process.env['GEMINI_SANDBOX']) {
     updateEventEmitter.emit('update-info', {
       message: `${info.message}\nAutomatic update is not available in sandbox mode.`,
     });
     return;
   }
 
-  if (settings.merged.general?.disableUpdateNag) {
+  if (settings.merged.general.disableUpdateNag) {
     return;
   }
 
   const installationInfo = getInstallationInfo(
     projectRoot,
-    settings.merged.general?.disableAutoUpdate ?? false,
+    settings.merged.general.disableAutoUpdate,
   );
 
   if (
@@ -58,7 +58,7 @@ export function handleAutoUpdate(
 
   if (
     !installationInfo.updateCommand ||
-    settings.merged.general?.disableAutoUpdate
+    settings.merged.general.disableAutoUpdate
   ) {
     return;
   }
diff --git a/packages/cli/src/utils/terminalTheme.ts b/packages/cli/src/utils/terminalTheme.ts
index 024e79e23b..7707d24a8c 100644
--- a/packages/cli/src/utils/terminalTheme.ts
+++ b/packages/cli/src/utils/terminalTheme.ts
@@ -32,14 +32,14 @@ export async function setupTerminalAndTheme(
   }
 
   // Load custom themes from settings
-  themeManager.loadCustomThemes(settings.merged.ui?.customThemes);
+  themeManager.loadCustomThemes(settings.merged.ui.customThemes);
 
-  if (settings.merged.ui?.theme) {
-    if (!themeManager.setActiveTheme(settings.merged.ui?.theme)) {
+  if (settings.merged.ui.theme) {
+    if (!themeManager.setActiveTheme(settings.merged.ui.theme)) {
       // If the theme is not found during initial load, log a warning and continue.
       // The useThemeCommand hook in AppContainer.tsx will handle opening the dialog.
       debugLogger.warn(
-        `Warning: Theme "${settings.merged.ui?.theme}" not found.`,
+        `Warning: Theme "${settings.merged.ui.theme}" not found.`,
       );
     }
   } else {
diff --git a/packages/cli/src/validateNonInterActiveAuth.test.ts b/packages/cli/src/validateNonInterActiveAuth.test.ts
index 06f1067730..819a4c2924 100644
--- a/packages/cli/src/validateNonInterActiveAuth.test.ts
+++ b/packages/cli/src/validateNonInterActiveAuth.test.ts
@@ -295,7 +295,7 @@ describe('validateNonInterActiveAuth', () => {
   });
 
   it('succeeds if effectiveAuthType matches enforcedAuthType', async () => {
-    mockSettings.merged.security!.auth!.enforcedType = AuthType.USE_GEMINI;
+    mockSettings.merged.security.auth.enforcedType = AuthType.USE_GEMINI;
     process.env['GEMINI_API_KEY'] = 'fake-key';
     const nonInteractiveConfig = createLocalMockConfig({});
     await validateNonInteractiveAuth(
@@ -309,8 +309,7 @@ describe('validateNonInterActiveAuth', () => {
   });
 
   it('exits if configuredAuthType does not match enforcedAuthType', async () => {
-    mockSettings.merged.security!.auth!.enforcedType =
-      AuthType.LOGIN_WITH_GOOGLE;
+    mockSettings.merged.security.auth.enforcedType = AuthType.LOGIN_WITH_GOOGLE;
     const nonInteractiveConfig = createLocalMockConfig({
       getOutputFormat: vi.fn().mockReturnValue(OutputFormat.TEXT),
     });
@@ -336,8 +335,7 @@ describe('validateNonInterActiveAuth', () => {
   });
 
   it('exits if auth from env var does not match enforcedAuthType', async () => {
-    mockSettings.merged.security!.auth!.enforcedType =
-      AuthType.LOGIN_WITH_GOOGLE;
+    mockSettings.merged.security.auth.enforcedType = AuthType.LOGIN_WITH_GOOGLE;
     process.env['GEMINI_API_KEY'] = 'fake-key';
     const nonInteractiveConfig = createLocalMockConfig({
       getOutputFormat: vi.fn().mockReturnValue(OutputFormat.TEXT),
@@ -398,7 +396,7 @@ describe('validateNonInterActiveAuth', () => {
     });
 
     it(`prints JSON error when enforced auth mismatches current auth and exits with code ${ExitCodes.FATAL_AUTHENTICATION_ERROR}`, async () => {
-      mockSettings.merged.security!.auth!.enforcedType = AuthType.USE_GEMINI;
+      mockSettings.merged.security.auth.enforcedType = AuthType.USE_GEMINI;
       const nonInteractiveConfig = createLocalMockConfig({
         getOutputFormat: vi.fn().mockReturnValue(OutputFormat.JSON),
         getContentGeneratorConfig: vi
diff --git a/packages/cli/src/validateNonInterActiveAuth.ts b/packages/cli/src/validateNonInterActiveAuth.ts
index 82fb7cd725..668d0390de 100644
--- a/packages/cli/src/validateNonInterActiveAuth.ts
+++ b/packages/cli/src/validateNonInterActiveAuth.ts
@@ -39,7 +39,7 @@ export async function validateNonInteractiveAuth(
   try {
     const effectiveAuthType = configuredAuthType || getAuthTypeFromEnv();
 
-    const enforcedType = settings.merged.security?.auth?.enforcedType;
+    const enforcedType = settings.merged.security.auth.enforcedType;
     if (enforcedType && effectiveAuthType !== enforcedType) {
       const message = effectiveAuthType
         ? `The enforced authentication type is '${enforcedType}', but the current type is '${effectiveAuthType}'. Please re-authenticate with the correct type.`
diff --git a/packages/cli/src/zed-integration/zedIntegration.ts b/packages/cli/src/zed-integration/zedIntegration.ts
index 0d7d3262ac..3cf00302cf 100644
--- a/packages/cli/src/zed-integration/zedIntegration.ts
+++ b/packages/cli/src/zed-integration/zedIntegration.ts
@@ -121,7 +121,7 @@ export class GeminiAgent {
 
   async authenticate({ methodId }: acp.AuthenticateRequest): Promise<void> {
     const method = z.nativeEnum(AuthType).parse(methodId);
-    const selectedAuthType = this.settings.merged.security?.auth?.selectedType;
+    const selectedAuthType = this.settings.merged.security.auth.selectedType;
 
     // Only clear credentials when switching to a different auth method
     if (selectedAuthType && selectedAuthType !== method) {
@@ -147,7 +147,7 @@ export class GeminiAgent {
     const config = await this.newSessionConfig(sessionId, cwd, mcpServers);
 
     let isAuthenticated = false;
-    if (this.settings.merged.security?.auth?.selectedType) {
+    if (this.settings.merged.security.auth.selectedType) {
       try {
         await config.refreshAuth(
           this.settings.merged.security.auth.selectedType,
diff --git a/packages/core/package.json b/packages/core/package.json
index 47cf6dca99..c07bde995f 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-core",
-  "version": "0.26.0-nightly.20260114.bb6c57414",
+  "version": "0.26.0-nightly.20260115.6cb3ae4e0",
   "description": "Gemini CLI Core",
   "license": "Apache-2.0",
   "repository": {
diff --git a/packages/core/src/agents/generalist-agent.test.ts b/packages/core/src/agents/generalist-agent.test.ts
new file mode 100644
index 0000000000..efd651c121
--- /dev/null
+++ b/packages/core/src/agents/generalist-agent.test.ts
@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, vi } from 'vitest';
+import { GeneralistAgent } from './generalist-agent.js';
+import { makeFakeConfig } from '../test-utils/config.js';
+import { DELEGATE_TO_AGENT_TOOL_NAME } from '../tools/tool-names.js';
+import type { ToolRegistry } from '../tools/tool-registry.js';
+import type { AgentRegistry } from './registry.js';
+
+describe('GeneralistAgent', () => {
+  it('should create a valid generalist agent definition', () => {
+    const config = makeFakeConfig();
+    vi.spyOn(config, 'getToolRegistry').mockReturnValue({
+      getAllToolNames: () => ['tool1', 'tool2', DELEGATE_TO_AGENT_TOOL_NAME],
+    } as unknown as ToolRegistry);
+    vi.spyOn(config, 'getAgentRegistry').mockReturnValue({
+      getDirectoryContext: () => 'mock directory context',
+    } as unknown as AgentRegistry);
+
+    const agent = GeneralistAgent(config);
+
+    expect(agent.name).toBe('generalist');
+    expect(agent.kind).toBe('local');
+    expect(agent.modelConfig.model).toBe('inherit');
+    expect(agent.toolConfig?.tools).toBeDefined();
+    expect(agent.toolConfig?.tools).not.toContain(DELEGATE_TO_AGENT_TOOL_NAME);
+    expect(agent.toolConfig?.tools).toContain('tool1');
+    expect(agent.promptConfig.systemPrompt).toContain('CLI agent');
+    // Ensure it's non-interactive
+    expect(agent.promptConfig.systemPrompt).toContain('non-interactive');
+  });
+});
diff --git a/packages/core/src/agents/generalist-agent.ts b/packages/core/src/agents/generalist-agent.ts
new file mode 100644
index 0000000000..c9c3340a0c
--- /dev/null
+++ b/packages/core/src/agents/generalist-agent.ts
@@ -0,0 +1,71 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { z } from 'zod';
+import type { Config } from '../config/config.js';
+import { getCoreSystemPrompt } from '../core/prompts.js';
+import type { LocalAgentDefinition } from './types.js';
+import { DELEGATE_TO_AGENT_TOOL_NAME } from '../tools/tool-names.js';
+
+const GeneralistAgentSchema = z.object({
+  response: z.string().describe('The final response from the agent.'),
+});
+
+/**
+ * A general-purpose AI agent with access to all tools.
+ * It uses the same core system prompt as the main agent but in a non-interactive mode.
+ */
+export const GeneralistAgent = (
+  config: Config,
+): LocalAgentDefinition<typeof GeneralistAgentSchema> => ({
+  kind: 'local',
+  name: 'generalist',
+  displayName: 'Generalist Agent',
+  description:
+    "A general-purpose AI agent with access to all tools. Use it for complex tasks that don't fit into other specialized agents.",
+  experimental: true,
+  inputConfig: {
+    inputs: {
+      request: {
+        description: 'The task or question for the generalist agent.',
+        type: 'string',
+        required: true,
+      },
+    },
+  },
+  outputConfig: {
+    outputName: 'result',
+    description: 'The final answer or results of the task.',
+    schema: GeneralistAgentSchema,
+  },
+  modelConfig: {
+    model: 'inherit',
+  },
+  get toolConfig() {
+    // TODO(15179): Support recursive agent invocation.
+    const tools = config
+      .getToolRegistry()
+      .getAllToolNames()
+      .filter((name) => name !== DELEGATE_TO_AGENT_TOOL_NAME);
+    return {
+      tools,
+    };
+  },
+  get promptConfig() {
+    return {
+      systemPrompt: getCoreSystemPrompt(
+        config,
+        /*useMemory=*/ undefined,
+        /*interactiveOverride=*/ false,
+      ),
+      query: '${request}',
+    };
+  },
+  runConfig: {
+    maxTimeMinutes: 10,
+    maxTurns: 20,
+  },
+});
diff --git a/packages/core/src/agents/local-executor.ts b/packages/core/src/agents/local-executor.ts
index fa5b4701c6..8859b72385 100644
--- a/packages/core/src/agents/local-executor.ts
+++ b/packages/core/src/agents/local-executor.ts
@@ -68,6 +68,10 @@ type AgentTurnResult =
       finalResult: string | null;
     };
 
+export function createUnauthorizedToolError(toolName: string): string {
+  return `Unauthorized tool call: '${toolName}' is not available to this agent.`;
+}
+
 /**
  * Executes an agent loop based on an {@link AgentDefinition}.
  *
@@ -883,7 +887,7 @@ export class LocalAgentExecutor<TOutput extends z.ZodTypeAny> {
 
       // Handle standard tools
       if (!allowedToolNames.has(functionCall.name as string)) {
-        const error = `Unauthorized tool call: '${functionCall.name}' is not available to this agent.`;
+        const error = createUnauthorizedToolError(functionCall.name as string);
 
         debugLogger.warn(`[LocalAgentExecutor] Blocked call: ${error}`);
 
diff --git a/packages/core/src/agents/registry.test.ts b/packages/core/src/agents/registry.test.ts
index a81b3035bb..b35a62ea9b 100644
--- a/packages/core/src/agents/registry.test.ts
+++ b/packages/core/src/agents/registry.test.ts
@@ -21,6 +21,8 @@ import {
 } from '../config/models.js';
 import * as tomlLoader from './agentLoader.js';
 import { SimpleExtensionLoader } from '../utils/extensionLoader.js';
+import type { ConfigParameters } from '../config/config.js';
+import type { ToolRegistry } from '../tools/tool-registry.js';
 
 vi.mock('./agentLoader.js', () => ({
   loadAgentsFromDirectory: vi
@@ -34,6 +36,17 @@ vi.mock('./a2a-client-manager.js', () => ({
   },
 }));
 
+function makeMockedConfig(params?: Partial<ConfigParameters>): Config {
+  const config = makeFakeConfig(params);
+  vi.spyOn(config, 'getToolRegistry').mockReturnValue({
+    getAllToolNames: () => ['tool1', 'tool2'],
+  } as unknown as ToolRegistry);
+  vi.spyOn(config, 'getAgentRegistry').mockReturnValue({
+    getDirectoryContext: () => 'mock directory context',
+  } as unknown as AgentRegistry);
+  return config;
+}
+
 // A test-only subclass to expose the protected `registerAgent` method.
 class TestableAgentRegistry extends AgentRegistry {
   async testRegisterAgent(definition: AgentDefinition): Promise<void> {
@@ -73,7 +86,7 @@ describe('AgentRegistry', () => {
 
   beforeEach(() => {
     // Default configuration (debugMode: false)
-    mockConfig = makeFakeConfig();
+    mockConfig = makeMockedConfig();
     registry = new TestableAgentRegistry(mockConfig);
     vi.mocked(tomlLoader.loadAgentsFromDirectory).mockResolvedValue({
       agents: [],
@@ -97,7 +110,7 @@ describe('AgentRegistry', () => {
     // });
 
     it('should log the count of loaded agents in debug mode', async () => {
-      const debugConfig = makeFakeConfig({
+      const debugConfig = makeMockedConfig({
         debugMode: true,
         enableAgents: true,
       });
@@ -115,7 +128,7 @@ describe('AgentRegistry', () => {
     });
 
     it('should use preview flash model for codebase investigator if main model is preview pro', async () => {
-      const previewConfig = makeFakeConfig({
+      const previewConfig = makeMockedConfig({
         model: PREVIEW_GEMINI_MODEL,
         codebaseInvestigatorSettings: {
           enabled: true,
@@ -136,7 +149,7 @@ describe('AgentRegistry', () => {
     });
 
     it('should use preview flash model for codebase investigator if main model is preview auto', async () => {
-      const previewConfig = makeFakeConfig({
+      const previewConfig = makeMockedConfig({
         model: PREVIEW_GEMINI_MODEL_AUTO,
         codebaseInvestigatorSettings: {
           enabled: true,
@@ -157,7 +170,7 @@ describe('AgentRegistry', () => {
     });
 
     it('should use the model from the investigator settings', async () => {
-      const previewConfig = makeFakeConfig({
+      const previewConfig = makeMockedConfig({
         model: PREVIEW_GEMINI_MODEL,
         codebaseInvestigatorSettings: {
           enabled: true,
@@ -178,7 +191,7 @@ describe('AgentRegistry', () => {
     });
 
     it('should load agents from user and project directories with correct precedence', async () => {
-      mockConfig = makeFakeConfig({ enableAgents: true });
+      mockConfig = makeMockedConfig({ enableAgents: true });
       registry = new TestableAgentRegistry(mockConfig);
 
       const userAgent = {
@@ -217,7 +230,7 @@ describe('AgentRegistry', () => {
     });
 
     it('should NOT load TOML agents when enableAgents is false', async () => {
-      const disabledConfig = makeFakeConfig({
+      const disabledConfig = makeMockedConfig({
         enableAgents: false,
         codebaseInvestigatorSettings: { enabled: false },
         cliHelpAgentSettings: { enabled: false },
@@ -233,7 +246,7 @@ describe('AgentRegistry', () => {
     });
 
     it('should register CLI help agent by default', async () => {
-      const config = makeFakeConfig();
+      const config = makeMockedConfig();
       const registry = new TestableAgentRegistry(config);
 
       await registry.initialize();
@@ -242,7 +255,7 @@ describe('AgentRegistry', () => {
     });
 
     it('should register CLI help agent if disabled', async () => {
-      const config = makeFakeConfig({
+      const config = makeMockedConfig({
         cliHelpAgentSettings: { enabled: false },
       });
       const registry = new TestableAgentRegistry(config);
@@ -252,6 +265,61 @@ describe('AgentRegistry', () => {
       expect(registry.getDefinition('cli_help')).toBeUndefined();
     });
 
+    it('should NOT register generalist agent by default (because it is experimental)', async () => {
+      const config = makeMockedConfig();
+      const registry = new TestableAgentRegistry(config);
+
+      await registry.initialize();
+
+      expect(registry.getDefinition('generalist')).toBeUndefined();
+    });
+
+    it('should register generalist agent if explicitly enabled via override', async () => {
+      const config = makeMockedConfig({
+        agents: {
+          overrides: {
+            generalist: { enabled: true },
+          },
+        },
+      });
+      const registry = new TestableAgentRegistry(config);
+
+      await registry.initialize();
+
+      expect(registry.getDefinition('generalist')).toBeDefined();
+    });
+
+    it('should NOT register a non-experimental agent if enabled is false', async () => {
+      // CLI help is NOT experimental, but we explicitly disable it via enabled: false
+      const config = makeMockedConfig({
+        agents: {
+          overrides: {
+            cli_help: { enabled: false },
+          },
+        },
+      });
+      const registry = new TestableAgentRegistry(config);
+
+      await registry.initialize();
+
+      expect(registry.getDefinition('cli_help')).toBeUndefined();
+    });
+
+    it('should respect disabled override over enabled override', async () => {
+      const config = makeMockedConfig({
+        agents: {
+          overrides: {
+            generalist: { enabled: true, disabled: true },
+          },
+        },
+      });
+      const registry = new TestableAgentRegistry(config);
+
+      await registry.initialize();
+
+      expect(registry.getDefinition('generalist')).toBeUndefined();
+    });
+
     it('should load agents from active extensions', async () => {
       const extensionAgent = {
         ...MOCK_AGENT_V1,
@@ -268,7 +336,7 @@ describe('AgentRegistry', () => {
           id: 'test-extension-id',
         },
       ];
-      const mockConfig = makeFakeConfig({
+      const mockConfig = makeMockedConfig({
         extensionLoader: new SimpleExtensionLoader(extensions),
         enableAgents: true,
       });
@@ -295,7 +363,7 @@ describe('AgentRegistry', () => {
           id: 'test-extension-id',
         },
       ];
-      const mockConfig = makeFakeConfig({
+      const mockConfig = makeMockedConfig({
         extensionLoader: new SimpleExtensionLoader(extensions),
       });
       const registry = new TestableAgentRegistry(mockConfig);
@@ -391,7 +459,7 @@ describe('AgentRegistry', () => {
     });
 
     it('should log remote agent registration in debug mode', async () => {
-      const debugConfig = makeFakeConfig({ debugMode: true });
+      const debugConfig = makeMockedConfig({ debugMode: true });
       const debugRegistry = new TestableAgentRegistry(debugConfig);
       const debugLogSpy = vi
         .spyOn(debugLogger, 'log')
@@ -469,7 +537,7 @@ describe('AgentRegistry', () => {
     });
 
     it('should log overwrites when in debug mode', async () => {
-      const debugConfig = makeFakeConfig({ debugMode: true });
+      const debugConfig = makeMockedConfig({ debugMode: true });
       const debugRegistry = new TestableAgentRegistry(debugConfig);
       const debugLogSpy = vi
         .spyOn(debugLogger, 'log')
@@ -511,7 +579,7 @@ describe('AgentRegistry', () => {
 
   describe('reload', () => {
     it('should clear existing agents and reload from directories', async () => {
-      const config = makeFakeConfig({ enableAgents: true });
+      const config = makeMockedConfig({ enableAgents: true });
       const registry = new TestableAgentRegistry(config);
 
       const initialAgent = { ...MOCK_AGENT_V1, name: 'InitialAgent' };
@@ -542,7 +610,7 @@ describe('AgentRegistry', () => {
 
   describe('inheritance and refresh', () => {
     it('should resolve "inherit" to the current model from configuration', async () => {
-      const config = makeFakeConfig({ model: 'current-model' });
+      const config = makeMockedConfig({ model: 'current-model' });
       const registry = new TestableAgentRegistry(config);
 
       const agent: AgentDefinition = {
@@ -559,7 +627,7 @@ describe('AgentRegistry', () => {
     });
 
     it('should update inherited models when the main model changes', async () => {
-      const config = makeFakeConfig({ model: 'initial-model' });
+      const config = makeMockedConfig({ model: 'initial-model' });
       const registry = new TestableAgentRegistry(config);
       await registry.initialize();
 
@@ -633,7 +701,7 @@ describe('AgentRegistry', () => {
 
   describe('overrides', () => {
     it('should skip registration if agent is disabled in settings', async () => {
-      const config = makeFakeConfig({
+      const config = makeMockedConfig({
         agents: {
           overrides: {
             MockAgent: { disabled: true },
@@ -648,7 +716,7 @@ describe('AgentRegistry', () => {
     });
 
     it('should skip remote agent registration if disabled in settings', async () => {
-      const config = makeFakeConfig({
+      const config = makeMockedConfig({
         agents: {
           overrides: {
             RemoteAgent: { disabled: true },
@@ -671,7 +739,7 @@ describe('AgentRegistry', () => {
     });
 
     it('should merge runConfig overrides', async () => {
-      const config = makeFakeConfig({
+      const config = makeMockedConfig({
         agents: {
           overrides: {
             MockAgent: {
@@ -692,7 +760,7 @@ describe('AgentRegistry', () => {
     });
 
     it('should apply modelConfig overrides', async () => {
-      const config = makeFakeConfig({
+      const config = makeMockedConfig({
         agents: {
           overrides: {
             MockAgent: {
@@ -721,7 +789,7 @@ describe('AgentRegistry', () => {
     });
 
     it('should deep merge generateContentConfig (e.g. thinkingConfig)', async () => {
-      const config = makeFakeConfig({
+      const config = makeMockedConfig({
         agents: {
           overrides: {
             MockAgent: {
@@ -749,6 +817,40 @@ describe('AgentRegistry', () => {
         thinkingBudget: 16384, // Overridden
       });
     });
+
+    it('should preserve lazy getters when applying overrides', async () => {
+      let getterCalled = false;
+      const agentWithGetter: LocalAgentDefinition = {
+        ...MOCK_AGENT_V1,
+        name: 'GetterAgent',
+        get toolConfig() {
+          getterCalled = true;
+          return { tools: ['lazy-tool'] };
+        },
+      };
+
+      const config = makeMockedConfig({
+        agents: {
+          overrides: {
+            GetterAgent: {
+              runConfig: { maxTurns: 100 },
+            },
+          },
+        },
+      });
+      const registry = new TestableAgentRegistry(config);
+
+      await registry.testRegisterAgent(agentWithGetter);
+
+      const registeredDef = registry.getDefinition(
+        'GetterAgent',
+      ) as LocalAgentDefinition;
+
+      expect(registeredDef.runConfig.maxTurns).toBe(100);
+      expect(getterCalled).toBe(false); // Getter should not have been called yet
+      expect(registeredDef.toolConfig?.tools).toEqual(['lazy-tool']);
+      expect(getterCalled).toBe(true); // Getter should have been called now
+    });
   });
 
   describe('getToolDescription', () => {
diff --git a/packages/core/src/agents/registry.ts b/packages/core/src/agents/registry.ts
index 4e042ab711..82fccb05cc 100644
--- a/packages/core/src/agents/registry.ts
+++ b/packages/core/src/agents/registry.ts
@@ -11,6 +11,7 @@ import type { AgentDefinition, LocalAgentDefinition } from './types.js';
 import { loadAgentsFromDirectory } from './agentLoader.js';
 import { CodebaseInvestigatorAgent } from './codebase-investigator.js';
 import { CliHelpAgent } from './cli-help-agent.js';
+import { GeneralistAgent } from './generalist-agent.js';
 import { A2AClientManager } from './a2a-client-manager.js';
 import { ADCHandler } from './remote-invocation.js';
 import { type z } from 'zod';
@@ -26,6 +27,7 @@ import {
   type ModelConfig,
   ModelConfigService,
 } from '../services/modelConfigService.js';
+import { DELEGATE_TO_AGENT_TOOL_NAME } from '../tools/tool-names.js';
 
 /**
  * Returns the model config alias for a given agent definition.
@@ -202,6 +204,9 @@ export class AgentRegistry {
     ) {
       this.registerLocalAgent(CliHelpAgent(this.config));
     }
+
+    // Register the generalist agent.
+    this.registerLocalAgent(GeneralistAgent(this.config));
   }
 
   private async refreshAgents(): Promise<void> {
@@ -248,7 +253,8 @@ export class AgentRegistry {
 
     const settingsOverrides =
       this.config.getAgentsSettings().overrides?.[definition.name];
-    if (settingsOverrides?.disabled) {
+
+    if (!this.isAgentEnabled(definition, settingsOverrides)) {
       if (this.config.getDebugMode()) {
         debugLogger.log(
           `[AgentRegistry] Skipping disabled agent '${definition.name}'`,
@@ -267,6 +273,24 @@ export class AgentRegistry {
     this.registerModelConfigs(mergedDefinition);
   }
 
+  private isAgentEnabled<TOutput extends z.ZodTypeAny>(
+    definition: AgentDefinition<TOutput>,
+    overrides?: AgentOverride,
+  ): boolean {
+    const isExperimental = definition.experimental === true;
+    let isEnabled = !isExperimental;
+
+    if (overrides) {
+      if (overrides.disabled !== undefined) {
+        isEnabled = !overrides.disabled;
+      } else if (overrides.enabled !== undefined) {
+        isEnabled = overrides.enabled;
+      }
+    }
+
+    return isEnabled;
+  }
+
   /**
    * Registers a remote agent definition asynchronously.
    */
@@ -287,7 +311,8 @@ export class AgentRegistry {
 
     const overrides =
       this.config.getAgentsSettings().overrides?.[definition.name];
-    if (overrides?.disabled) {
+
+    if (!this.isAgentEnabled(definition, overrides)) {
       if (this.config.getDebugMode()) {
         debugLogger.log(
           `[AgentRegistry] Skipping disabled remote agent '${definition.name}'`,
@@ -340,17 +365,24 @@ export class AgentRegistry {
       return definition;
     }
 
-    return {
-      ...definition,
-      runConfig: {
+    // Use Object.create to preserve lazy getters on the definition object
+    const merged: LocalAgentDefinition<TOutput> = Object.create(definition);
+
+    if (overrides.runConfig) {
+      merged.runConfig = {
         ...definition.runConfig,
         ...overrides.runConfig,
-      },
-      modelConfig: ModelConfigService.merge(
+      };
+    }
+
+    if (overrides.modelConfig) {
+      merged.modelConfig = ModelConfigService.merge(
         definition.modelConfig,
-        overrides.modelConfig ?? {},
-      ),
-    };
+        overrides.modelConfig,
+      );
+    }
+
+    return merged;
   }
 
   private registerModelConfigs<TOutput extends z.ZodTypeAny>(
@@ -434,8 +466,19 @@ export class AgentRegistry {
     }
 
     let context = '## Available Sub-Agents\n';
-    context +=
-      'Use `delegate_to_agent` for complex tasks requiring specialized analysis.\n\n';
+    context += `Sub-agents are specialized expert agents that you can use to assist you in
+      the completion of all or part of a task.
+
+      ALWAYS use \`${DELEGATE_TO_AGENT_TOOL_NAME}\` to delegate to a subagent if one
+      exists that has expertise relevant to your task.
+
+      For example:
+      - Prompt: 'Fix test', Description: 'An agent with expertise in fixing tests.' -> should use the sub-agent.
+      - Prompt: 'Update the license header', Description: 'An agent with expertise in licensing and copyright.' -> should use the sub-agent.
+      - Prompt: 'Diagram the architecture of the codebase', Description: 'Agent with architecture experience'. -> should use the sub-agent.
+      - Prompt: 'Implement a fix for [bug]' -> Should decompose the project into subtasks, which may utilize available agents like 'plan', 'validate', and 'fix-tests'.
+
+      The following are the available sub-agents:\n\n`;
 
     for (const [name, def] of this.agents) {
       context += `- **${name}**: ${def.description}\n`;
diff --git a/packages/core/src/agents/types.ts b/packages/core/src/agents/types.ts
index 23c6f75626..a1811c0f15 100644
--- a/packages/core/src/agents/types.ts
+++ b/packages/core/src/agents/types.ts
@@ -65,6 +65,7 @@ export interface BaseAgentDefinition<
   name: string;
   displayName?: string;
   description: string;
+  experimental?: boolean;
   inputConfig: InputConfig;
   outputConfig?: OutputConfig<TOutput>;
 }
diff --git a/packages/core/src/config/config.test.ts b/packages/core/src/config/config.test.ts
index 225b687380..f9cc9bcdfc 100644
--- a/packages/core/src/config/config.test.ts
+++ b/packages/core/src/config/config.test.ts
@@ -274,6 +274,35 @@ describe('Server Config (config.ts)', () => {
       );
     });
 
+    it('should not await MCP initialization', async () => {
+      const config = new Config({
+        ...baseParams,
+        checkpointing: false,
+      });
+
+      const { McpClientManager } = await import(
+        '../tools/mcp-client-manager.js'
+      );
+      let mcpStarted = false;
+
+      (McpClientManager as unknown as Mock).mockImplementation(() => ({
+        startConfiguredMcpServers: vi.fn().mockImplementation(async () => {
+          await new Promise((resolve) => setTimeout(resolve, 50));
+          mcpStarted = true;
+        }),
+        getMcpInstructions: vi.fn(),
+      }));
+
+      await config.initialize();
+
+      // Should return immediately, before MCP finishes (50ms delay)
+      expect(mcpStarted).toBe(false);
+
+      // Wait for it to eventually finish to avoid open handles
+      await new Promise((resolve) => setTimeout(resolve, 60));
+      expect(mcpStarted).toBe(true);
+    });
+
     describe('getCompressionThreshold', () => {
       it('should return the local compression threshold if it is set', async () => {
         const config = new Config({
diff --git a/packages/core/src/config/config.ts b/packages/core/src/config/config.ts
index 08bd18216d..34a02a849d 100644
--- a/packages/core/src/config/config.ts
+++ b/packages/core/src/config/config.ts
@@ -171,6 +171,7 @@ export interface AgentOverride {
   modelConfig?: ModelConfig;
   runConfig?: AgentRunConfig;
   disabled?: boolean;
+  enabled?: boolean;
 }
 
 export interface AgentSettings {
@@ -310,6 +311,8 @@ export interface ConfigParameters {
     respectGeminiIgnore?: boolean;
     enableRecursiveFileSearch?: boolean;
     disableFuzzySearch?: boolean;
+    maxFileCount?: number;
+    searchTimeout?: number;
   };
   checkpointing?: boolean;
   proxy?: string;
@@ -441,6 +444,8 @@ export class Config {
     respectGeminiIgnore: boolean;
     enableRecursiveFileSearch: boolean;
     disableFuzzySearch: boolean;
+    maxFileCount: number;
+    searchTimeout: number;
   };
   private fileDiscoveryService: FileDiscoveryService | null = null;
   private gitService: GitService | undefined = undefined;
@@ -593,6 +598,14 @@ export class Config {
       enableRecursiveFileSearch:
         params.fileFiltering?.enableRecursiveFileSearch ?? true,
       disableFuzzySearch: params.fileFiltering?.disableFuzzySearch ?? false,
+      maxFileCount:
+        params.fileFiltering?.maxFileCount ??
+        DEFAULT_FILE_FILTERING_OPTIONS.maxFileCount ??
+        20000,
+      searchTimeout:
+        params.fileFiltering?.searchTimeout ??
+        DEFAULT_FILE_FILTERING_OPTIONS.searchTimeout ??
+        5000,
     };
     this.checkpointing = params.checkpointing ?? false;
     this.proxy = params.proxy;
@@ -784,12 +797,14 @@ export class Config {
       this,
       this.eventEmitter,
     );
-    const initMcpHandle = startupProfiler.start('initialize_mcp_clients');
-    await Promise.all([
-      await this.mcpClientManager.startConfiguredMcpServers(),
-      await this.getExtensionLoader().start(this),
-    ]);
-    initMcpHandle?.end();
+    // We do not await this promise so that the CLI can start up even if
+    // MCP servers are slow to connect.
+    Promise.all([
+      this.mcpClientManager.startConfiguredMcpServers(),
+      this.getExtensionLoader().start(this),
+    ]).catch((error) => {
+      debugLogger.error('Error initializing MCP clients:', error);
+    });
 
     if (this.skillsSupport) {
       this.getSkillManager().setAdminSettings(this.adminSkillsEnabled);
@@ -1385,6 +1400,8 @@ export class Config {
     return {
       respectGitIgnore: this.fileFiltering.respectGitIgnore,
       respectGeminiIgnore: this.fileFiltering.respectGeminiIgnore,
+      maxFileCount: this.fileFiltering.maxFileCount,
+      searchTimeout: this.fileFiltering.searchTimeout,
     };
   }
 
diff --git a/packages/core/src/config/constants.ts b/packages/core/src/config/constants.ts
index 75ef3e4979..9f3047a84f 100644
--- a/packages/core/src/config/constants.ts
+++ b/packages/core/src/config/constants.ts
@@ -7,16 +7,22 @@
 export interface FileFilteringOptions {
   respectGitIgnore: boolean;
   respectGeminiIgnore: boolean;
+  maxFileCount?: number;
+  searchTimeout?: number;
 }
 
 // For memory files
 export const DEFAULT_MEMORY_FILE_FILTERING_OPTIONS: FileFilteringOptions = {
   respectGitIgnore: false,
   respectGeminiIgnore: true,
+  maxFileCount: 20000,
+  searchTimeout: 5000,
 };
 
 // For all other files
 export const DEFAULT_FILE_FILTERING_OPTIONS: FileFilteringOptions = {
   respectGitIgnore: true,
   respectGeminiIgnore: true,
+  maxFileCount: 20000,
+  searchTimeout: 5000,
 };
diff --git a/packages/core/src/core/client.test.ts b/packages/core/src/core/client.test.ts
index 50ee7f765a..11dc28a998 100644
--- a/packages/core/src/core/client.test.ts
+++ b/packages/core/src/core/client.test.ts
@@ -679,6 +679,34 @@ describe('Gemini Client (client.ts)', () => {
       });
     });
 
+    it('does not emit ModelInfo event if signal is aborted', async () => {
+      // Arrange
+      mockTurnRunFn.mockReturnValue(
+        (async function* () {
+          yield { type: 'content', value: 'Hello' };
+        })(),
+      );
+
+      const controller = new AbortController();
+      controller.abort();
+
+      // Act
+      const stream = client.sendMessageStream(
+        [{ text: 'Hi' }],
+        controller.signal,
+        'prompt-id-1',
+      );
+
+      const events = await fromAsync(stream);
+
+      // Assert
+      expect(events).not.toContainEqual(
+        expect.objectContaining({
+          type: GeminiEventType.ModelInfo,
+        }),
+      );
+    });
+
     it.each([
       {
         compressionStatus:
diff --git a/packages/core/src/core/client.ts b/packages/core/src/core/client.ts
index dbf81aee2f..73445da67b 100644
--- a/packages/core/src/core/client.ts
+++ b/packages/core/src/core/client.ts
@@ -627,8 +627,9 @@ export class GeminiClient {
     modelToUse = finalModel;
 
     this.currentSequenceModel = modelToUse;
-    yield { type: GeminiEventType.ModelInfo, value: modelToUse };
-
+    if (!signal.aborted) {
+      yield { type: GeminiEventType.ModelInfo, value: modelToUse };
+    }
     const resultStream = turn.run(modelConfigKey, request, linkedSignal);
     let isError = false;
     let isInvalidStream = false;
diff --git a/packages/core/src/core/coreToolScheduler.test.ts b/packages/core/src/core/coreToolScheduler.test.ts
index 1497f7ac02..779f3ef0a3 100644
--- a/packages/core/src/core/coreToolScheduler.test.ts
+++ b/packages/core/src/core/coreToolScheduler.test.ts
@@ -7,7 +7,10 @@
 import { describe, it, expect, vi } from 'vitest';
 import type { Mock } from 'vitest';
 import type { CallableTool } from '@google/genai';
-import { CoreToolScheduler } from './coreToolScheduler.js';
+import {
+  CoreToolScheduler,
+  PLAN_MODE_DENIAL_MESSAGE,
+} from './coreToolScheduler.js';
 import type {
   ToolCall,
   WaitingToolCall,
@@ -32,6 +35,7 @@ import {
   ApprovalMode,
   HookSystem,
   PolicyDecision,
+  ToolErrorType,
 } from '../index.js';
 import { createMockMessageBus } from '../test-utils/mock-message-bus.js';
 import {
@@ -2078,4 +2082,53 @@ describe('CoreToolScheduler Sequential Execution', () => {
 
     expect(onAllToolCallsComplete).toHaveBeenCalledTimes(1);
   });
+
+  describe('Policy Decisions in Plan Mode', () => {
+    it('should return STOP_EXECUTION error type and informative message when denied in Plan Mode', async () => {
+      const mockTool = new MockTool({
+        name: 'dangerous_tool',
+        displayName: 'Dangerous Tool',
+        description: 'Does risky stuff',
+      });
+      const mockToolRegistry = {
+        getTool: () => mockTool,
+        getAllToolNames: () => ['dangerous_tool'],
+      } as unknown as ToolRegistry;
+
+      const onAllToolCallsComplete = vi.fn();
+
+      const mockConfig = createMockConfig({
+        getToolRegistry: () => mockToolRegistry,
+        getApprovalMode: () => ApprovalMode.PLAN,
+        getPolicyEngine: () =>
+          ({
+            check: async () => ({ decision: PolicyDecision.DENY }),
+          }) as unknown as PolicyEngine,
+      });
+
+      const scheduler = new CoreToolScheduler({
+        config: mockConfig,
+        onAllToolCallsComplete,
+        getPreferredEditor: () => 'vscode',
+      });
+
+      const request = {
+        callId: 'call-1',
+        name: 'dangerous_tool',
+        args: {},
+        isClientInitiated: false,
+        prompt_id: 'prompt-1',
+      };
+
+      await scheduler.schedule(request, new AbortController().signal);
+
+      expect(onAllToolCallsComplete).toHaveBeenCalledTimes(1);
+      const reportedTools = onAllToolCallsComplete.mock.calls[0][0];
+      const result = reportedTools[0];
+
+      expect(result.status).toBe('error');
+      expect(result.response.errorType).toBe(ToolErrorType.STOP_EXECUTION);
+      expect(result.response.error.message).toBe(PLAN_MODE_DENIAL_MESSAGE);
+    });
+  });
 });
diff --git a/packages/core/src/core/coreToolScheduler.ts b/packages/core/src/core/coreToolScheduler.ts
index 0d4ad1b938..f73d4ad12a 100644
--- a/packages/core/src/core/coreToolScheduler.ts
+++ b/packages/core/src/core/coreToolScheduler.ts
@@ -14,7 +14,7 @@ import {
 } from '../tools/tools.js';
 import type { EditorType } from '../utils/editor.js';
 import type { Config } from '../config/config.js';
-import { PolicyDecision } from '../policy/types.js';
+import { PolicyDecision, ApprovalMode } from '../policy/types.js';
 import { logToolCall } from '../telemetry/loggers.js';
 import { ToolErrorType } from '../tools/tool-error.js';
 import { ToolCallEvent } from '../telemetry/types.js';
@@ -65,6 +65,9 @@ export type {
   ToolCallResponseInfo,
 };
 
+export const PLAN_MODE_DENIAL_MESSAGE =
+  'You are in Plan Mode - adjust your prompt to only use read and search tools.';
+
 const createErrorResponse = (
   request: ToolCallRequestInfo,
   error: Error,
@@ -603,16 +606,18 @@ export class CoreToolScheduler {
           .check(toolCallForPolicy, serverName);
 
         if (decision === PolicyDecision.DENY) {
-          const errorMessage = `Tool execution denied by policy.`;
+          let errorMessage = `Tool execution denied by policy.`;
+          let errorType = ToolErrorType.POLICY_VIOLATION;
+
+          if (this.config.getApprovalMode() === ApprovalMode.PLAN) {
+            errorMessage = PLAN_MODE_DENIAL_MESSAGE;
+            errorType = ToolErrorType.STOP_EXECUTION;
+          }
           this.setStatusInternal(
             reqInfo.callId,
             'error',
             signal,
-            createErrorResponse(
-              reqInfo,
-              new Error(errorMessage),
-              ToolErrorType.POLICY_VIOLATION,
-            ),
+            createErrorResponse(reqInfo, new Error(errorMessage), errorType),
           );
           await this.checkAndNotifyCompletion(signal);
           return;
diff --git a/packages/core/src/core/prompts.ts b/packages/core/src/core/prompts.ts
index 0aec32f155..17bf1cd64d 100644
--- a/packages/core/src/core/prompts.ts
+++ b/packages/core/src/core/prompts.ts
@@ -80,6 +80,7 @@ export function resolvePathFromEnv(envVar?: string): {
 export function getCoreSystemPrompt(
   config: Config,
   userMemory?: string,
+  interactiveOverride?: boolean,
 ): string {
   // A flag to indicate whether the system prompt override is active.
   let systemMdEnabled = false;
@@ -128,7 +129,7 @@ export function getCoreSystemPrompt(
     .getAllToolNames()
     .includes(WriteTodosTool.Name);
 
-  const interactiveMode = config.isInteractive();
+  const interactiveMode = interactiveOverride ?? config.isInteractive();
 
   const skills = config.getSkillManager().getSkills();
   let skillsPrompt = '';
diff --git a/packages/core/src/hooks/hookRegistry.test.ts b/packages/core/src/hooks/hookRegistry.test.ts
index f98f475054..5d6d3ccced 100644
--- a/packages/core/src/hooks/hookRegistry.test.ts
+++ b/packages/core/src/hooks/hookRegistry.test.ts
@@ -8,7 +8,12 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import * as fs from 'node:fs';
 import { HookRegistry } from './hookRegistry.js';
 import type { Storage } from '../config/storage.js';
-import { ConfigSource, HookEventName, HookType } from './types.js';
+import {
+  ConfigSource,
+  HookEventName,
+  HookType,
+  HOOKS_CONFIG_FIELDS,
+} from './types.js';
 import type { Config } from '../config/config.js';
 import type { HookDefinition } from './types.js';
 
@@ -645,6 +650,51 @@ describe('HookRegistry', () => {
         expect.objectContaining({ type: 'invalid-type' }),
       );
     });
+
+    it('should skip known config fields and warn on invalid event names', async () => {
+      const configWithExtras: Record<string, unknown> = {
+        InvalidEvent: [],
+        BeforeTool: [
+          {
+            hooks: [
+              {
+                type: 'command',
+                command: './test.sh',
+              },
+            ],
+          },
+        ],
+      };
+
+      // Add all known config fields dynamically
+      for (const field of HOOKS_CONFIG_FIELDS) {
+        configWithExtras[field] = field === 'disabled' ? [] : true;
+      }
+
+      vi.mocked(mockConfig.getHooks).mockReturnValue(
+        configWithExtras as unknown as {
+          [K in HookEventName]?: HookDefinition[];
+        },
+      );
+
+      await hookRegistry.initialize();
+
+      // Should only load the valid hook
+      expect(hookRegistry.getAllHooks()).toHaveLength(1);
+
+      // Should skip all known config fields without warnings
+      for (const field of HOOKS_CONFIG_FIELDS) {
+        expect(mockDebugLogger.warn).not.toHaveBeenCalledWith(
+          expect.stringContaining(`Invalid hook event name: ${field}`),
+        );
+      }
+
+      // Should warn on truly invalid event name
+      expect(mockCoreEvents.emitFeedback).toHaveBeenCalledWith(
+        'warning',
+        expect.stringContaining('Invalid hook event name: "InvalidEvent"'),
+      );
+    });
   });
 
   describe('project hook warnings', () => {
diff --git a/packages/core/src/hooks/hookRegistry.ts b/packages/core/src/hooks/hookRegistry.ts
index f3961a8cce..072f049f0a 100644
--- a/packages/core/src/hooks/hookRegistry.ts
+++ b/packages/core/src/hooks/hookRegistry.ts
@@ -6,7 +6,7 @@
 
 import type { Config } from '../config/config.js';
 import type { HookDefinition, HookConfig } from './types.js';
-import { HookEventName, ConfigSource } from './types.js';
+import { HookEventName, ConfigSource, HOOKS_CONFIG_FIELDS } from './types.js';
 import { debugLogger } from '../utils/debugLogger.js';
 import { TrustedHooksManager } from './trustedHooks.js';
 import { coreEvents } from '../utils/events.js';
@@ -169,8 +169,15 @@ please review the project settings (.gemini/settings.json) and remove them.`;
     source: ConfigSource,
   ): void {
     for (const [eventName, definitions] of Object.entries(hooksConfig)) {
+      if (HOOKS_CONFIG_FIELDS.includes(eventName)) {
+        continue;
+      }
+
       if (!this.isValidEventName(eventName)) {
-        debugLogger.warn(`Invalid hook event name: ${eventName}`);
+        coreEvents.emitFeedback(
+          'warning',
+          `Invalid hook event name: "${eventName}" from ${source} config. Skipping.`,
+        );
         continue;
       }
 
diff --git a/packages/core/src/hooks/types.ts b/packages/core/src/hooks/types.ts
index 8d6e203778..7457db83ea 100644
--- a/packages/core/src/hooks/types.ts
+++ b/packages/core/src/hooks/types.ts
@@ -44,6 +44,11 @@ export enum HookEventName {
   BeforeToolSelection = 'BeforeToolSelection',
 }
 
+/**
+ * Fields in the hooks configuration that are not hook event names
+ */
+export const HOOKS_CONFIG_FIELDS = ['enabled', 'disabled', 'notifications'];
+
 /**
  * Hook configuration entry
  */
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index a42ea862f2..1a387b5828 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -92,6 +92,7 @@ export * from './utils/version.js';
 export * from './utils/checkpointUtils.js';
 export * from './utils/apiConversionUtils.js';
 export * from './utils/channel.js';
+export * from './utils/LruCache.js';
 
 // Export services
 export * from './services/fileDiscoveryService.js';
@@ -127,6 +128,7 @@ export * from './prompts/mcp-prompts.js';
 // Export agent definitions
 export * from './agents/types.js';
 export * from './agents/agentLoader.js';
+export * from './agents/local-executor.js';
 
 // Export specific tool logic
 export * from './tools/read-file.js';
diff --git a/packages/core/src/policy/config.ts b/packages/core/src/policy/config.ts
index ff09b31d41..ccd2df7ec2 100644
--- a/packages/core/src/policy/config.ts
+++ b/packages/core/src/policy/config.ts
@@ -174,6 +174,7 @@ export async function createPolicyEngineConfig(
         toolName: `${serverName}__*`,
         decision: PolicyDecision.DENY,
         priority: 2.9,
+        source: 'Settings (MCP Excluded)',
       });
     }
   }
@@ -186,6 +187,7 @@ export async function createPolicyEngineConfig(
         toolName: tool,
         decision: PolicyDecision.DENY,
         priority: 2.4,
+        source: 'Settings (Tools Excluded)',
       });
     }
   }
@@ -213,6 +215,7 @@ export async function createPolicyEngineConfig(
                 decision: PolicyDecision.ALLOW,
                 priority: 2.3,
                 argsPattern: new RegExp(pattern),
+                source: 'Settings (Tools Allowed)',
               });
             }
           }
@@ -223,6 +226,7 @@ export async function createPolicyEngineConfig(
             toolName,
             decision: PolicyDecision.ALLOW,
             priority: 2.3,
+            source: 'Settings (Tools Allowed)',
           });
         }
       } else {
@@ -234,6 +238,7 @@ export async function createPolicyEngineConfig(
           toolName,
           decision: PolicyDecision.ALLOW,
           priority: 2.3,
+          source: 'Settings (Tools Allowed)',
         });
       }
     }
@@ -252,6 +257,7 @@ export async function createPolicyEngineConfig(
           toolName: `${serverName}__*`,
           decision: PolicyDecision.ALLOW,
           priority: 2.2,
+          source: 'Settings (MCP Trusted)',
         });
       }
     }
@@ -265,6 +271,7 @@ export async function createPolicyEngineConfig(
         toolName: `${serverName}__*`,
         decision: PolicyDecision.ALLOW,
         priority: 2.1,
+        source: 'Settings (MCP Allowed)',
       });
     }
   }
@@ -310,6 +317,7 @@ export function createPolicyUpdater(
               // but still lose to admin policies (3.xxx) and settings excludes (200)
               priority: 2.95,
               argsPattern: new RegExp(pattern),
+              source: 'Dynamic (Confirmed)',
             });
           }
         }
@@ -326,6 +334,7 @@ export function createPolicyUpdater(
           // but still lose to admin policies (3.xxx) and settings excludes (200)
           priority: 2.95,
           argsPattern,
+          source: 'Dynamic (Confirmed)',
         });
       }
 
diff --git a/packages/core/src/policy/policies/plan.toml b/packages/core/src/policy/policies/plan.toml
new file mode 100644
index 0000000000..c69493e7e3
--- /dev/null
+++ b/packages/core/src/policy/policies/plan.toml
@@ -0,0 +1,70 @@
+# Priority system for policy rules:
+# - Higher priority numbers win over lower priority numbers
+# - When multiple rules match, the highest priority rule is applied
+# - Rules are evaluated in order of priority (highest first)
+#
+# Priority bands (tiers):
+# - Default policies (TOML): 1 + priority/1000 (e.g., priority 100 → 1.100)
+# - User policies (TOML): 2 + priority/1000 (e.g., priority 100 → 2.100)
+# - Admin policies (TOML): 3 + priority/1000 (e.g., priority 100 → 3.100)
+#
+# This ensures Admin > User > Default hierarchy is always preserved,
+# while allowing user-specified priorities to work within each tier.
+#
+# Settings-based and dynamic rules (all in user tier 2.x):
+#   2.95: Tools that the user has selected as "Always Allow" in the interactive UI
+#   2.9:  MCP servers excluded list (security: persistent server blocks)
+#   2.4:  Command line flag --exclude-tools (explicit temporary blocks)
+#   2.3:  Command line flag --allowed-tools (explicit temporary allows)
+#   2.2:  MCP servers with trust=true (persistent trusted servers)
+#   2.1:  MCP servers allowed list (persistent general server allows)
+#
+# TOML policy priorities (before transformation):
+#   10: Write tools default to ASK_USER (becomes 1.010 in default tier)
+#   20: Plan mode catch-all DENY override (becomes 1.020 in default tier)
+#   50: Read-only tools (becomes 1.050 in default tier)
+#   999: YOLO mode allow-all (becomes 1.999 in default tier)
+
+# Catch-All: Deny everything by default in Plan mode.
+
+[[rule]]
+decision = "deny"
+priority = 20
+modes = ["plan"]
+
+# Explicitly Allow Read-Only Tools in Plan mode.
+
+[[rule]]
+toolName = "glob"
+decision = "allow"
+priority = 50
+modes = ["plan"]
+
+[[rule]]
+toolName = "search_file_content"
+decision = "allow"
+priority = 50
+modes = ["plan"]
+
+[[rule]]
+toolName = "list_directory"
+decision = "allow"
+priority = 50
+modes = ["plan"]
+
+[[rule]]
+toolName = "read_file"
+decision = "allow"
+priority = 50
+modes = ["plan"]
+
+[[rule]]
+toolName = "google_web_search"
+decision = "allow"
+priority = 50
+modes = ["plan"]
+
+[[rule]]
+toolName = "SubagentInvocation"
+decision = "allow"
+priority = 50
diff --git a/packages/core/src/policy/policies/read-only.toml b/packages/core/src/policy/policies/read-only.toml
index f234f1d47f..5a669c28c7 100644
--- a/packages/core/src/policy/policies/read-only.toml
+++ b/packages/core/src/policy/policies/read-only.toml
@@ -45,11 +45,6 @@ toolName = "read_file"
 decision = "allow"
 priority = 50
 
-[[rule]]
-toolName = "read_many_files"
-decision = "allow"
-priority = 50
-
 [[rule]]
 toolName = "google_web_search"
 decision = "allow"
diff --git a/packages/core/src/policy/toml-loader.test.ts b/packages/core/src/policy/toml-loader.test.ts
index 5f0a0eab8d..5b26c6a4bb 100644
--- a/packages/core/src/policy/toml-loader.test.ts
+++ b/packages/core/src/policy/toml-loader.test.ts
@@ -53,6 +53,7 @@ priority = 100
         toolName: 'glob',
         decision: PolicyDecision.ALLOW,
         priority: 1.1, // tier 1 + 100/1000
+        source: 'Default: test.toml',
       });
       expect(result.checkers).toHaveLength(0);
       expect(result.errors).toHaveLength(0);
@@ -190,6 +191,7 @@ modes = ["autoEdit"]
       expect(result.rules).toHaveLength(1);
       expect(result.rules[0].toolName).toBe('tier2-tool');
       expect(result.rules[0].modes).toEqual(['autoEdit']);
+      expect(result.rules[0].source).toBe('User: tier2.toml');
       expect(result.errors).toHaveLength(0);
     });
 
diff --git a/packages/core/src/policy/toml-loader.ts b/packages/core/src/policy/toml-loader.ts
index b731151424..a895d01572 100644
--- a/packages/core/src/policy/toml-loader.ts
+++ b/packages/core/src/policy/toml-loader.ts
@@ -346,6 +346,7 @@ export async function loadPoliciesFromToml(
                   priority: transformPriority(rule.priority, tier),
                   modes: rule.modes,
                   allowRedirection: rule.allow_redirection,
+                  source: `${tierName.charAt(0).toUpperCase() + tierName.slice(1)}: ${file}`,
                 };
 
                 // Compile regex pattern
diff --git a/packages/core/src/policy/types.ts b/packages/core/src/policy/types.ts
index c2d2802f1e..21c7c7f190 100644
--- a/packages/core/src/policy/types.ts
+++ b/packages/core/src/policy/types.ts
@@ -46,6 +46,7 @@ export enum ApprovalMode {
   DEFAULT = 'default',
   AUTO_EDIT = 'autoEdit',
   YOLO = 'yolo',
+  PLAN = 'plan',
 }
 
 /**
@@ -135,6 +136,12 @@ export interface PolicyRule {
    * Only applies when decision is ALLOW.
    */
   allowRedirection?: boolean;
+
+  /**
+   * Effect of the rule's source.
+   * e.g. "my-policies.toml", "Settings (MCP Trusted)", etc.
+   */
+  source?: string;
 }
 
 export interface SafetyCheckerRule {
diff --git a/packages/core/src/scheduler/confirmation.test.ts b/packages/core/src/scheduler/confirmation.test.ts
new file mode 100644
index 0000000000..4e7453428b
--- /dev/null
+++ b/packages/core/src/scheduler/confirmation.test.ts
@@ -0,0 +1,222 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { EventEmitter } from 'node:events';
+import { awaitConfirmation } from './confirmation.js';
+import {
+  MessageBusType,
+  type ToolConfirmationResponse,
+} from '../confirmation-bus/types.js';
+import type { MessageBus } from '../confirmation-bus/message-bus.js';
+import { ToolConfirmationOutcome } from '../tools/tools.js';
+
+describe('awaitConfirmation', () => {
+  let mockMessageBus: MessageBus;
+
+  beforeEach(() => {
+    mockMessageBus = new EventEmitter() as unknown as MessageBus;
+    mockMessageBus.publish = vi.fn().mockResolvedValue(undefined);
+    // on() from node:events uses addListener/removeListener or on/off internally.
+    vi.spyOn(mockMessageBus, 'on');
+    vi.spyOn(mockMessageBus, 'removeListener');
+  });
+
+  const emitResponse = (response: ToolConfirmationResponse) => {
+    mockMessageBus.emit(MessageBusType.TOOL_CONFIRMATION_RESPONSE, response);
+  };
+
+  it('should resolve when confirmed response matches correlationId', async () => {
+    const correlationId = 'test-correlation-id';
+    const abortController = new AbortController();
+
+    const promise = awaitConfirmation(
+      mockMessageBus,
+      correlationId,
+      abortController.signal,
+    );
+
+    expect(mockMessageBus.on).toHaveBeenCalledWith(
+      MessageBusType.TOOL_CONFIRMATION_RESPONSE,
+      expect.any(Function),
+    );
+
+    // Simulate response
+    emitResponse({
+      type: MessageBusType.TOOL_CONFIRMATION_RESPONSE,
+      correlationId,
+      confirmed: true,
+    });
+
+    const result = await promise;
+    expect(result).toEqual({
+      outcome: ToolConfirmationOutcome.ProceedOnce,
+      payload: undefined,
+    });
+    expect(mockMessageBus.removeListener).toHaveBeenCalled();
+  });
+
+  it('should resolve with mapped outcome when confirmed is false', async () => {
+    const correlationId = 'id-123';
+    const abortController = new AbortController();
+
+    const promise = awaitConfirmation(
+      mockMessageBus,
+      correlationId,
+      abortController.signal,
+    );
+
+    emitResponse({
+      type: MessageBusType.TOOL_CONFIRMATION_RESPONSE,
+      correlationId,
+      confirmed: false,
+    });
+
+    const result = await promise;
+    expect(result.outcome).toBe(ToolConfirmationOutcome.Cancel);
+  });
+
+  it('should resolve with explicit outcome if provided', async () => {
+    const correlationId = 'id-456';
+    const abortController = new AbortController();
+
+    const promise = awaitConfirmation(
+      mockMessageBus,
+      correlationId,
+      abortController.signal,
+    );
+
+    emitResponse({
+      type: MessageBusType.TOOL_CONFIRMATION_RESPONSE,
+      correlationId,
+      confirmed: true,
+      outcome: ToolConfirmationOutcome.ProceedAlways,
+    });
+
+    const result = await promise;
+    expect(result.outcome).toBe(ToolConfirmationOutcome.ProceedAlways);
+  });
+
+  it('should resolve with payload', async () => {
+    const correlationId = 'id-payload';
+    const abortController = new AbortController();
+    const payload = { newContent: 'updated' };
+
+    const promise = awaitConfirmation(
+      mockMessageBus,
+      correlationId,
+      abortController.signal,
+    );
+
+    emitResponse({
+      type: MessageBusType.TOOL_CONFIRMATION_RESPONSE,
+      correlationId,
+      confirmed: true,
+      outcome: ToolConfirmationOutcome.ModifyWithEditor,
+      payload,
+    });
+
+    const result = await promise;
+    expect(result.payload).toEqual(payload);
+  });
+
+  it('should ignore responses with different correlation IDs', async () => {
+    const correlationId = 'my-id';
+    const abortController = new AbortController();
+
+    let resolved = false;
+    const promise = awaitConfirmation(
+      mockMessageBus,
+      correlationId,
+      abortController.signal,
+    ).then((r) => {
+      resolved = true;
+      return r;
+    });
+
+    // Emit wrong ID
+    emitResponse({
+      type: MessageBusType.TOOL_CONFIRMATION_RESPONSE,
+      correlationId: 'wrong-id',
+      confirmed: true,
+    });
+
+    // Allow microtasks to process
+    await new Promise((r) => setTimeout(r, 0));
+    expect(resolved).toBe(false);
+
+    // Emit correct ID
+    emitResponse({
+      type: MessageBusType.TOOL_CONFIRMATION_RESPONSE,
+      correlationId,
+      confirmed: true,
+    });
+
+    await expect(promise).resolves.toBeDefined();
+  });
+
+  it('should reject when abort signal is triggered', async () => {
+    const correlationId = 'abort-id';
+    const abortController = new AbortController();
+
+    const promise = awaitConfirmation(
+      mockMessageBus,
+      correlationId,
+      abortController.signal,
+    );
+
+    abortController.abort();
+
+    await expect(promise).rejects.toThrow('Operation cancelled');
+    expect(mockMessageBus.removeListener).toHaveBeenCalled();
+  });
+
+  it('should reject when abort signal timeout is triggered', async () => {
+    vi.useFakeTimers();
+    const correlationId = 'timeout-id';
+    const signal = AbortSignal.timeout(100);
+
+    const promise = awaitConfirmation(mockMessageBus, correlationId, signal);
+
+    vi.advanceTimersByTime(101);
+
+    await expect(promise).rejects.toThrow('Operation cancelled');
+    expect(mockMessageBus.removeListener).toHaveBeenCalled();
+    vi.useRealTimers();
+  });
+
+  it('should reject immediately if signal is already aborted', async () => {
+    const correlationId = 'pre-abort-id';
+    const abortController = new AbortController();
+    abortController.abort();
+
+    const promise = awaitConfirmation(
+      mockMessageBus,
+      correlationId,
+      abortController.signal,
+    );
+
+    await expect(promise).rejects.toThrow('Operation cancelled');
+    expect(mockMessageBus.on).not.toHaveBeenCalled();
+  });
+
+  it('should cleanup and reject if subscribe throws', async () => {
+    const error = new Error('Subscribe failed');
+    vi.mocked(mockMessageBus.on).mockImplementationOnce(() => {
+      throw error;
+    });
+
+    const abortController = new AbortController();
+    const promise = awaitConfirmation(
+      mockMessageBus,
+      'fail-id',
+      abortController.signal,
+    );
+
+    await expect(promise).rejects.toThrow(error);
+    expect(mockMessageBus.removeListener).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/core/src/scheduler/confirmation.ts b/packages/core/src/scheduler/confirmation.ts
new file mode 100644
index 0000000000..5ed2f31e98
--- /dev/null
+++ b/packages/core/src/scheduler/confirmation.ts
@@ -0,0 +1,73 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { on } from 'node:events';
+import {
+  MessageBusType,
+  type ToolConfirmationResponse,
+} from '../confirmation-bus/types.js';
+import type { MessageBus } from '../confirmation-bus/message-bus.js';
+import {
+  ToolConfirmationOutcome,
+  type ToolConfirmationPayload,
+} from '../tools/tools.js';
+
+export interface ConfirmationResult {
+  outcome: ToolConfirmationOutcome;
+  payload?: ToolConfirmationPayload;
+}
+
+/**
+ * Waits for a confirmation response with the matching correlationId.
+ *
+ * NOTE: It is the caller's responsibility to manage the lifecycle of this wait
+ * via the provided AbortSignal. To prevent memory leaks and "zombie" listeners
+ * in the event of a lost connection (e.g. IDE crash), it is strongly recommended
+ * to use a signal with a timeout (e.g. AbortSignal.timeout(ms)).
+ *
+ * @param messageBus The MessageBus to listen on.
+ * @param correlationId The correlationId to match.
+ * @param signal An AbortSignal to cancel the wait and cleanup listeners.
+ */
+export async function awaitConfirmation(
+  messageBus: MessageBus,
+  correlationId: string,
+  signal: AbortSignal,
+): Promise<ConfirmationResult> {
+  if (signal.aborted) {
+    throw new Error('Operation cancelled');
+  }
+
+  try {
+    for await (const [msg] of on(
+      messageBus,
+      MessageBusType.TOOL_CONFIRMATION_RESPONSE,
+      { signal },
+    )) {
+      const response = msg as ToolConfirmationResponse;
+      if (response.correlationId === correlationId) {
+        return {
+          outcome:
+            response.outcome ??
+            // TODO: Remove legacy confirmed boolean fallback once migration complete
+            (response.confirmed
+              ? ToolConfirmationOutcome.ProceedOnce
+              : ToolConfirmationOutcome.Cancel),
+          payload: response.payload,
+        };
+      }
+    }
+  } catch (error) {
+    if (signal.aborted || (error as Error).name === 'AbortError') {
+      throw new Error('Operation cancelled');
+    }
+    throw error;
+  }
+
+  // This point should only be reached if the iterator closes without resolving,
+  // which generally means the signal was aborted.
+  throw new Error('Operation cancelled');
+}
diff --git a/packages/core/src/services/shellExecutionService.test.ts b/packages/core/src/services/shellExecutionService.test.ts
index 14ffafa3c0..e5c977f103 100644
--- a/packages/core/src/services/shellExecutionService.test.ts
+++ b/packages/core/src/services/shellExecutionService.test.ts
@@ -30,11 +30,20 @@ const mockIsBinary = vi.hoisted(() => vi.fn());
 const mockPlatform = vi.hoisted(() => vi.fn());
 const mockGetPty = vi.hoisted(() => vi.fn());
 const mockSerializeTerminalToObject = vi.hoisted(() => vi.fn());
+const mockResolveExecutable = vi.hoisted(() => vi.fn());
 
 // Top-level Mocks
 vi.mock('@lydell/node-pty', () => ({
   spawn: mockPtySpawn,
 }));
+vi.mock('../utils/shell-utils.js', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('../utils/shell-utils.js')>();
+  return {
+    ...actual,
+    resolveExecutable: mockResolveExecutable,
+  };
+});
 vi.mock('node:child_process', async (importOriginal) => {
   const actual = await importOriginal();
   return {
@@ -45,7 +54,7 @@ vi.mock('node:child_process', async (importOriginal) => {
 vi.mock('../utils/textUtils.js', () => ({
   isBinary: mockIsBinary,
 }));
-vi.mock('os', () => ({
+vi.mock('node:os', () => ({
   default: {
     platform: mockPlatform,
     constants: {
@@ -136,6 +145,7 @@ describe('ShellExecutionService', () => {
     onExit: Mock;
     write: Mock;
     resize: Mock;
+    destroy: Mock;
   };
   let mockHeadlessTerminal: {
     resize: Mock;
@@ -153,6 +163,8 @@ describe('ShellExecutionService', () => {
     mockSerializeTerminalToObject.mockReturnValue([]);
     mockIsBinary.mockReturnValue(false);
     mockPlatform.mockReturnValue('linux');
+    mockResolveExecutable.mockImplementation(async (exe: string) => exe);
+    process.env['PATH'] = '/test/path';
     mockGetPty.mockResolvedValue({
       module: { spawn: mockPtySpawn },
       name: 'mock-pty',
@@ -167,6 +179,7 @@ describe('ShellExecutionService', () => {
       onExit: Mock;
       write: Mock;
       resize: Mock;
+      destroy: Mock;
     };
     mockPtyProcess.pid = 12345;
     mockPtyProcess.kill = vi.fn();
@@ -174,6 +187,7 @@ describe('ShellExecutionService', () => {
     mockPtyProcess.onExit = vi.fn();
     mockPtyProcess.write = vi.fn();
     mockPtyProcess.resize = vi.fn();
+    mockPtyProcess.destroy = vi.fn();
 
     mockHeadlessTerminal = {
       resize: vi.fn(),
@@ -821,6 +835,31 @@ describe('ShellExecutionService', () => {
       );
     });
   });
+
+  describe('Resource Management', () => {
+    it('should destroy the PTY process and clear activePtys on exit', async () => {
+      await simulateExecution('ls -l', (pty) => {
+        pty.onExit.mock.calls[0][0]({ exitCode: 0, signal: null });
+      });
+
+      expect(mockPtyProcess.destroy).toHaveBeenCalled();
+      expect(ShellExecutionService['activePtys'].size).toBe(0);
+    });
+
+    it('should destroy the PTY process even if destroy throws', async () => {
+      mockPtyProcess.destroy.mockImplementation(() => {
+        throw new Error('Destroy failed');
+      });
+
+      await expect(
+        simulateExecution('ls -l', (pty) => {
+          pty.onExit.mock.calls[0][0]({ exitCode: 0, signal: null });
+        }),
+      ).resolves.not.toThrow();
+
+      expect(ShellExecutionService['activePtys'].size).toBe(0);
+    });
+  });
 });
 
 describe('ShellExecutionService child_process fallback', () => {
diff --git a/packages/core/src/services/shellExecutionService.ts b/packages/core/src/services/shellExecutionService.ts
index 1509072fe5..91c1df4853 100644
--- a/packages/core/src/services/shellExecutionService.ts
+++ b/packages/core/src/services/shellExecutionService.ts
@@ -12,7 +12,11 @@ import { TextDecoder } from 'node:util';
 import os from 'node:os';
 import type { IPty } from '@lydell/node-pty';
 import { getCachedEncodingForBuffer } from '../utils/systemEncoding.js';
-import { getShellConfiguration, type ShellType } from '../utils/shell-utils.js';
+import {
+  getShellConfiguration,
+  resolveExecutable,
+  type ShellType,
+} from '../utils/shell-utils.js';
 import { isBinary } from '../utils/textUtils.js';
 import pkg from '@xterm/headless';
 import {
@@ -183,7 +187,7 @@ export class ShellExecutionService {
       const ptyInfo = await getPty();
       if (ptyInfo) {
         try {
-          return this.executeWithPty(
+          return await this.executeWithPty(
             commandToExecute,
             cwd,
             onOutputEvent,
@@ -445,14 +449,14 @@ export class ShellExecutionService {
     }
   }
 
-  private static executeWithPty(
+  private static async executeWithPty(
     commandToExecute: string,
     cwd: string,
     onOutputEvent: (event: ShellOutputEvent) => void,
     abortSignal: AbortSignal,
     shellExecutionConfig: ShellExecutionConfig,
     ptyInfo: PtyImplementation,
-  ): ShellExecutionHandle {
+  ): Promise<ShellExecutionHandle> {
     if (!ptyInfo) {
       // This should not happen, but as a safeguard...
       throw new Error('PTY implementation not found');
@@ -461,6 +465,14 @@ export class ShellExecutionService {
       const cols = shellExecutionConfig.terminalWidth ?? 80;
       const rows = shellExecutionConfig.terminalHeight ?? 30;
       const { executable, argsPrefix, shell } = getShellConfiguration();
+
+      const resolvedExecutable = await resolveExecutable(executable);
+      if (!resolvedExecutable) {
+        throw new Error(
+          `Shell executable "${executable}" not found in PATH or at absolute location. Please ensure the shell is installed and available in your environment.`,
+        );
+      }
+
       const guardedCommand = ensurePromptvarsDisabled(commandToExecute, shell);
       const args = [...argsPrefix, guardedCommand];
 
@@ -660,6 +672,12 @@ export class ShellExecutionService {
             exited = true;
             abortSignal.removeEventListener('abort', abortHandler);
             this.activePtys.delete(ptyProcess.pid);
+            // Attempt to destroy the PTY to ensure FD is closed
+            try {
+              (ptyProcess as IPty & { destroy?: () => void }).destroy?.();
+            } catch {
+              // Ignore errors during cleanup
+            }
 
             const finalize = () => {
               render(true);
diff --git a/packages/core/src/telemetry/sdk.test.ts b/packages/core/src/telemetry/sdk.test.ts
index c17f8b159f..bf9ed83a44 100644
--- a/packages/core/src/telemetry/sdk.test.ts
+++ b/packages/core/src/telemetry/sdk.test.ts
@@ -312,7 +312,8 @@ describe('Telemetry SDK', () => {
     expect(GcpTraceExporter).not.toHaveBeenCalled();
 
     // 2. Set project ID and emit post_auth event
-    process.env['GOOGLE_CLOUD_PROJECT'] = 'test-project';
+    vi.stubEnv('GOOGLE_CLOUD_PROJECT', 'test-project');
+    vi.stubEnv('OTLP_GOOGLE_CLOUD_PROJECT', 'test-project');
 
     const mockCredentials = {
       client_email: 'test@example.com',
diff --git a/packages/core/src/telemetry/semantic.truncation.test.ts b/packages/core/src/telemetry/semantic.truncation.test.ts
new file mode 100644
index 0000000000..00bb6c5d57
--- /dev/null
+++ b/packages/core/src/telemetry/semantic.truncation.test.ts
@@ -0,0 +1,104 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect } from 'vitest';
+import { toInputMessages } from './semantic.js';
+import { type Content } from '@google/genai';
+
+// 160KB limit for the total size of string content in a log entry.
+const GLOBAL_TEXT_LIMIT = 160 * 1024;
+const SUFFIX = '...[TRUNCATED]';
+
+describe('Semantic Telemetry Truncation', () => {
+  it('should not truncate a single part if it is within global limit', () => {
+    // 150KB part -> Should fit in 160KB limit
+    const textLen = 150 * 1024;
+    const longText = 'a'.repeat(textLen);
+    const contents: Content[] = [
+      {
+        role: 'user',
+        parts: [{ text: longText }],
+      },
+    ];
+    const result = toInputMessages(contents);
+    // @ts-expect-error - testing internal state
+    expect(result[0].parts[0].content.length).toBe(textLen);
+    // @ts-expect-error - testing internal state
+    expect(result[0].parts[0].content.endsWith(SUFFIX)).toBe(false);
+  });
+
+  it('should truncate a single part if it exceeds global limit', () => {
+    // 170KB part -> Should get truncated to ~160KB
+    const textLen = 170 * 1024;
+    const longText = 'a'.repeat(textLen);
+    const contents: Content[] = [
+      {
+        role: 'user',
+        parts: [{ text: longText }],
+      },
+    ];
+    const result = toInputMessages(contents);
+    // @ts-expect-error - testing internal state
+    const content = result[0].parts[0].content;
+    expect(content.length).toBeLessThan(textLen);
+    // Because it's the only part, it gets the full budget of 160KB
+    expect(content.length).toBe(GLOBAL_TEXT_LIMIT + SUFFIX.length);
+    expect(content.endsWith(SUFFIX)).toBe(true);
+  });
+
+  it('should fairly distribute budget among multiple large parts', () => {
+    // Two 100KB parts (Total 200KB) -> Budget 160KB
+    // Each should get roughly 80KB
+    const partLen = 100 * 1024;
+    const part1 = 'a'.repeat(partLen);
+    const part2 = 'b'.repeat(partLen);
+    const contents: Content[] = [
+      { role: 'user', parts: [{ text: part1 }] },
+      { role: 'model', parts: [{ text: part2 }] },
+    ];
+
+    const result = toInputMessages(contents);
+
+    // @ts-expect-error - testing internal state
+    const c1 = result[0].parts[0].content;
+    // @ts-expect-error - testing internal state
+    const c2 = result[1].parts[0].content;
+
+    expect(c1.length).toBeLessThan(partLen);
+    expect(c2.length).toBeLessThan(partLen);
+
+    // Budget is split evenly
+    const expectedLen = Math.floor(GLOBAL_TEXT_LIMIT / 2) + SUFFIX.length;
+    expect(c1.length).toBe(expectedLen);
+    expect(c2.length).toBe(expectedLen);
+  });
+
+  it('should not truncate small parts while truncating large ones', () => {
+    // One 200KB part, one 1KB part.
+    // 1KB part is small (below average), so it keeps its size.
+    // 200KB part gets the remaining budget (128KB - 1KB = 127KB).
+    const bigLen = 200 * 1024;
+    const smallLen = 1 * 1024;
+    const bigText = 'a'.repeat(bigLen);
+    const smallText = 'b'.repeat(smallLen);
+
+    const contents: Content[] = [
+      { role: 'user', parts: [{ text: bigText }] },
+      { role: 'model', parts: [{ text: smallText }] },
+    ];
+
+    const result = toInputMessages(contents);
+    // @ts-expect-error - testing internal state
+    const cBig = result[0].parts[0].content;
+    // @ts-expect-error - testing internal state
+    const cSmall = result[1].parts[0].content;
+
+    expect(cSmall.length).toBe(smallLen); // Untouched
+    expect(cBig.length).toBeLessThan(bigLen);
+
+    const expectedBigLen = GLOBAL_TEXT_LIMIT - smallLen + SUFFIX.length;
+    expect(cBig.length).toBe(expectedBigLen);
+  });
+});
diff --git a/packages/core/src/telemetry/semantic.ts b/packages/core/src/telemetry/semantic.ts
index 6192a6e94d..31520eb802 100644
--- a/packages/core/src/telemetry/semantic.ts
+++ b/packages/core/src/telemetry/semantic.ts
@@ -19,12 +19,111 @@ import type {
   Part,
   PartUnion,
 } from '@google/genai';
+import { truncateString } from '../utils/textUtils.js';
+
+// 160KB limit for the total size of string content in a log entry.
+// The total log entry size limit is 256KB. We leave ~96KB (approx 37%) for JSON overhead (escaping, structure) and other fields.
+const GLOBAL_TEXT_LIMIT = 160 * 1024;
+
+interface StringReference {
+  get: () => string | undefined;
+  set: (val: string) => void;
+  len: () => number;
+}
+
+function getStringReferences(parts: AnyPart[]): StringReference[] {
+  const refs: StringReference[] = [];
+  for (const part of parts) {
+    if (part instanceof TextPart) {
+      refs.push({
+        get: () => part.content,
+        set: (val: string) => (part.content = val),
+        len: () => part.content.length,
+      });
+    } else if (part instanceof ReasoningPart) {
+      refs.push({
+        get: () => part.content,
+        set: (val: string) => (part.content = val),
+        len: () => part.content.length,
+      });
+    } else if (part instanceof ToolCallRequestPart) {
+      if (part.arguments) {
+        refs.push({
+          get: () => part.arguments,
+          set: (val: string) => (part.arguments = val),
+          len: () => part.arguments?.length ?? 0,
+        });
+      }
+    } else if (part instanceof ToolCallResponsePart) {
+      if (part.response) {
+        refs.push({
+          get: () => part.response,
+          set: (val: string) => (part.response = val),
+          len: () => part.response?.length ?? 0,
+        });
+      }
+    } else if (part instanceof GenericPart) {
+      if (part.type === 'executableCode' && typeof part['code'] === 'string') {
+        refs.push({
+          get: () => part['code'] as string,
+          set: (val: string) => (part['code'] = val),
+          len: () => (part['code'] as string).length,
+        });
+      } else if (
+        part.type === 'codeExecutionResult' &&
+        typeof part['output'] === 'string'
+      ) {
+        refs.push({
+          get: () => part['output'] as string,
+          set: (val: string) => (part['output'] = val),
+          len: () => (part['output'] as string).length,
+        });
+      }
+    }
+  }
+  return refs;
+}
+
+function limitTotalLength(parts: AnyPart[]): void {
+  const refs = getStringReferences(parts);
+  const totalLength = refs.reduce((sum, ref) => sum + ref.len(), 0);
+
+  if (totalLength <= GLOBAL_TEXT_LIMIT) {
+    return;
+  }
+
+  // Calculate the average budget per part for "large" parts.
+  // We identify parts that are larger than the fair share (average) and truncate them.
+  const averageSize = GLOBAL_TEXT_LIMIT / refs.length;
+
+  // Filter out parts that are already small enough to not need truncation
+  const largeRefs = refs.filter((ref) => ref.len() > averageSize);
+  const smallRefsLength = refs
+    .filter((ref) => ref.len() <= averageSize)
+    .reduce((sum, ref) => sum + ref.len(), 0);
+
+  // Distribute the remaining budget among large parts
+  const remainingBudget = GLOBAL_TEXT_LIMIT - smallRefsLength;
+  const budgetPerLargePart = Math.max(
+    1,
+    Math.floor(remainingBudget / largeRefs.length),
+  );
+
+  for (const ref of largeRefs) {
+    const original = ref.get();
+    if (original) {
+      ref.set(truncateString(original, budgetPerLargePart));
+    }
+  }
+}
 
 export function toInputMessages(contents: Content[]): InputMessages {
   const messages: ChatMessage[] = [];
   for (const content of contents) {
     messages.push(toChatMessage(content));
   }
+  const allParts = messages.flatMap((m) => m.parts);
+  limitTotalLength(allParts);
   return messages;
 }
 
@@ -81,6 +180,7 @@ export function toSystemInstruction(
       }
     }
   }
+  limitTotalLength(parts);
   return parts;
 }
 
@@ -94,6 +194,8 @@ export function toOutputMessages(candidates?: Candidate[]): OutputMessages {
       });
     }
   }
+  const allParts = messages.flatMap((m) => m.parts);
+  limitTotalLength(allParts);
   return messages;
 }
 
diff --git a/packages/core/src/tools/mcp-client-manager.test.ts b/packages/core/src/tools/mcp-client-manager.test.ts
index d2fdc5d119..ba035d54f1 100644
--- a/packages/core/src/tools/mcp-client-manager.test.ts
+++ b/packages/core/src/tools/mcp-client-manager.test.ts
@@ -14,7 +14,7 @@ import {
   type MockedObject,
 } from 'vitest';
 import { McpClientManager } from './mcp-client-manager.js';
-import { McpClient } from './mcp-client.js';
+import { McpClient, MCPDiscoveryState } from './mcp-client.js';
 import type { ToolRegistry } from './tool-registry.js';
 import type { Config } from '../config/config.js';
 
@@ -71,6 +71,18 @@ describe('McpClientManager', () => {
     expect(mockedMcpClient.discover).toHaveBeenCalledOnce();
   });
 
+  it('should update global discovery state', async () => {
+    mockConfig.getMcpServers.mockReturnValue({
+      'test-server': {},
+    });
+    const manager = new McpClientManager(toolRegistry, mockConfig);
+    expect(manager.getDiscoveryState()).toBe(MCPDiscoveryState.NOT_STARTED);
+    const promise = manager.startConfiguredMcpServers();
+    expect(manager.getDiscoveryState()).toBe(MCPDiscoveryState.IN_PROGRESS);
+    await promise;
+    expect(manager.getDiscoveryState()).toBe(MCPDiscoveryState.COMPLETED);
+  });
+
   it('should not discover tools if folder is not trusted', async () => {
     mockConfig.getMcpServers.mockReturnValue({
       'test-server': {},
diff --git a/packages/core/src/tools/mcp-client-manager.ts b/packages/core/src/tools/mcp-client-manager.ts
index 7a1443e096..925edd17bc 100644
--- a/packages/core/src/tools/mcp-client-manager.ts
+++ b/packages/core/src/tools/mcp-client-manager.ts
@@ -362,4 +362,8 @@ export class McpClientManager {
     }
     return instructions.join('\n\n');
   }
+
+  getMcpServerCount(): number {
+    return this.clients.size;
+  }
 }
diff --git a/packages/core/src/utils/LruCache.test.ts b/packages/core/src/utils/LruCache.test.ts
new file mode 100644
index 0000000000..10cdbb600c
--- /dev/null
+++ b/packages/core/src/utils/LruCache.test.ts
@@ -0,0 +1,70 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect } from 'vitest';
+import { LruCache } from './LruCache.js';
+
+describe('LruCache', () => {
+  it('should store and retrieve values', () => {
+    const cache = new LruCache<string, number>(10);
+    cache.set('a', 1);
+    expect(cache.get('a')).toBe(1);
+    expect(cache.get('b')).toBeUndefined();
+  });
+
+  it('should evict oldest items when limit is reached', () => {
+    const cache = new LruCache<string, number>(2);
+    cache.set('a', 1);
+    cache.set('b', 2);
+    cache.set('c', 3);
+
+    expect(cache.get('a')).toBeUndefined();
+    expect(cache.get('b')).toBe(2);
+    expect(cache.get('c')).toBe(3);
+  });
+
+  it('should update LRU order on get', () => {
+    const cache = new LruCache<string, number>(2);
+    cache.set('a', 1);
+    cache.set('b', 2);
+    cache.get('a'); // Mark 'a' as recently used
+    cache.set('c', 3); // Should evict 'b'
+
+    expect(cache.get('b')).toBeUndefined();
+    expect(cache.get('a')).toBe(1);
+    expect(cache.get('c')).toBe(3);
+  });
+
+  it('should correctly handle falsy values (truthiness bug fix)', () => {
+    const cache = new LruCache<string, unknown>(2);
+    cache.set('zero', 0);
+    cache.set('empty', '');
+
+    // Both should be in cache
+    expect(cache.get('zero')).toBe(0);
+    expect(cache.get('empty')).toBe('');
+
+    // Access 'zero' to move it to end
+    cache.get('zero');
+
+    // Add new item, should evict 'empty' (because 'zero' was just accessed)
+    cache.set('new', 'item');
+
+    expect(cache.get('empty')).toBeUndefined();
+    expect(cache.get('zero')).toBe(0);
+    expect(cache.get('new')).toBe('item');
+  });
+
+  it('should correctly handle undefined as a value', () => {
+    // NOTE: mnemonist LRUMap returns undefined if not found.
+    // If we store undefined, we can't distinguish between "not found" and "found undefined".
+    // But we should at least check its behavior.
+    const cache = new LruCache<string, unknown>(10);
+    cache.set('key', undefined);
+    expect(cache.has('key')).toBe(true);
+    expect(cache.get('key')).toBeUndefined();
+  });
+});
diff --git a/packages/core/src/utils/LruCache.ts b/packages/core/src/utils/LruCache.ts
index 076828c459..7c917a8d30 100644
--- a/packages/core/src/utils/LruCache.ts
+++ b/packages/core/src/utils/LruCache.ts
@@ -4,34 +4,24 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import { LRUMap } from 'mnemonist';
+
 export class LruCache<K, V> {
-  private cache: Map<K, V>;
-  private maxSize: number;
+  private cache: LRUMap<K, V>;
 
   constructor(maxSize: number) {
-    this.cache = new Map<K, V>();
-    this.maxSize = maxSize;
+    this.cache = new LRUMap<K, V>(maxSize);
   }
 
   get(key: K): V | undefined {
-    const value = this.cache.get(key);
-    if (value) {
-      // Move to end to mark as recently used
-      this.cache.delete(key);
-      this.cache.set(key, value);
-    }
-    return value;
+    return this.cache.get(key);
+  }
+
+  has(key: K): boolean {
+    return this.cache.has(key);
   }
 
   set(key: K, value: V): void {
-    if (this.cache.has(key)) {
-      this.cache.delete(key);
-    } else if (this.cache.size >= this.maxSize) {
-      const firstKey = this.cache.keys().next().value;
-      if (firstKey !== undefined) {
-        this.cache.delete(firstKey);
-      }
-    }
     this.cache.set(key, value);
   }
 
diff --git a/packages/core/src/utils/filesearch/crawler.test.ts b/packages/core/src/utils/filesearch/crawler.test.ts
index c2865f4401..bf1ccea209 100644
--- a/packages/core/src/utils/filesearch/crawler.test.ts
+++ b/packages/core/src/utils/filesearch/crawler.test.ts
@@ -503,14 +503,14 @@ describe('crawler', () => {
       });
     });
 
-    const getCrawlResults = (maxDepth?: number) => {
+    const getCrawlResults = async (maxDepth?: number) => {
       const ignore = loadIgnoreRules({
         projectRoot: tmpDir,
         useGitignore: false,
         useGeminiignore: false,
         ignoreDirs: [],
       });
-      return crawl({
+      const paths = await crawl({
         crawlDirectory: tmpDir,
         cwd: tmpDir,
         ignore,
@@ -518,6 +518,7 @@ describe('crawler', () => {
         cacheTtl: 0,
         maxDepth,
       });
+      return paths;
     };
 
     it('should only crawl top-level files when maxDepth is 0', async () => {
@@ -571,4 +572,34 @@ describe('crawler', () => {
       );
     });
   });
+
+  it('should detect truncation when maxFiles is hit', async () => {
+    tmpDir = await createTmpDir({
+      'file1.js': '',
+      'file2.js': '',
+      'file3.js': '',
+    });
+
+    const ignore = loadIgnoreRules({
+      projectRoot: tmpDir,
+      useGitignore: false,
+      useGeminiignore: false,
+      ignoreDirs: [],
+    });
+
+    const paths = await crawl({
+      crawlDirectory: tmpDir,
+      cwd: tmpDir,
+      ignore,
+      cache: false,
+      cacheTtl: 0,
+      maxFiles: 2,
+    });
+
+    // fdir returns files and directories.
+    // In our filter, we only increment fileCount for files.
+    // So we should have 2 files + some directories.
+    const files = paths.filter((p) => p !== '.' && !p.endsWith('/'));
+    expect(files.length).toBe(2);
+  });
 });
diff --git a/packages/core/src/utils/filesearch/crawler.ts b/packages/core/src/utils/filesearch/crawler.ts
index 9184ba3286..6eb174b968 100644
--- a/packages/core/src/utils/filesearch/crawler.ts
+++ b/packages/core/src/utils/filesearch/crawler.ts
@@ -16,6 +16,8 @@ export interface CrawlOptions {
   cwd: string;
   // The fdir maxDepth option.
   maxDepth?: number;
+  // Maximum number of files to return.
+  maxFiles?: number;
   // A pre-configured Ignore instance.
   ignore: Ignore;
   // Caching options.
@@ -43,6 +45,9 @@ export async function crawl(options: CrawlOptions): Promise<string[]> {
 
   const posixCwd = toPosixPath(options.cwd);
   const posixCrawlDirectory = toPosixPath(options.crawlDirectory);
+  const maxFiles = options.maxFiles ?? Infinity;
+  let fileCount = 0;
+  let truncated = false;
 
   let results: string[];
   try {
@@ -51,7 +56,21 @@ export async function crawl(options: CrawlOptions): Promise<string[]> {
       .withRelativePaths()
       .withDirs()
       .withPathSeparator('/') // Always use unix style paths
+      .filter((path, isDirectory) => {
+        if (!isDirectory) {
+          fileCount++;
+          if (fileCount > maxFiles) {
+            truncated = true;
+            return false;
+          }
+        }
+        return true;
+      })
       .exclude((_, dirPath) => {
+        if (fileCount > maxFiles) {
+          truncated = true;
+          return true;
+        }
         const relativePath = path.posix.relative(posixCrawlDirectory, dirPath);
         return dirFilter(`${relativePath}/`);
       });
@@ -72,7 +91,7 @@ export async function crawl(options: CrawlOptions): Promise<string[]> {
     path.posix.join(relativeToCrawlDir, p),
   );
 
-  if (options.cache) {
+  if (options.cache && !truncated) {
     const cacheKey = cache.getCacheKey(
       options.crawlDirectory,
       options.ignore.getFingerprint(),
diff --git a/packages/core/src/utils/filesearch/fileSearch.test.ts b/packages/core/src/utils/filesearch/fileSearch.test.ts
index 1b61cdf3f7..ee1af9761f 100644
--- a/packages/core/src/utils/filesearch/fileSearch.test.ts
+++ b/packages/core/src/utils/filesearch/fileSearch.test.ts
@@ -7,6 +7,7 @@
 import { describe, it, expect, afterEach, vi } from 'vitest';
 import { FileSearchFactory, AbortError, filter } from './fileSearch.js';
 import { createTmpDir, cleanupTmpDir } from '@google/gemini-cli-test-utils';
+import * as crawler from './crawler.js';
 
 describe('FileSearch', () => {
   let tmpDir: string;
@@ -481,6 +482,33 @@ describe('FileSearch', () => {
     expect(results).toEqual(['src/', 'src/main.js']);
   });
 
+  it('should respect default maxFiles budget of 20000 in RecursiveFileSearch', async () => {
+    const crawlSpy = vi.spyOn(crawler, 'crawl');
+
+    tmpDir = await createTmpDir({
+      'file1.js': '',
+    });
+
+    const fileSearch = FileSearchFactory.create({
+      projectRoot: tmpDir,
+      useGitignore: false,
+      useGeminiignore: false,
+      ignoreDirs: [],
+      cache: false,
+      cacheTtl: 0,
+      enableRecursiveFileSearch: true,
+      disableFuzzySearch: false,
+    });
+
+    await fileSearch.initialize();
+
+    expect(crawlSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        maxFiles: 20000,
+      }),
+    );
+  });
+
   it('should be cancellable via AbortSignal', async () => {
     const largeDir: Record<string, string> = {};
     for (let i = 0; i < 100; i++) {
diff --git a/packages/core/src/utils/filesearch/fileSearch.ts b/packages/core/src/utils/filesearch/fileSearch.ts
index 6cd82b75a3..e18fdf3111 100644
--- a/packages/core/src/utils/filesearch/fileSearch.ts
+++ b/packages/core/src/utils/filesearch/fileSearch.ts
@@ -24,6 +24,7 @@ export interface FileSearchOptions {
   enableRecursiveFileSearch: boolean;
   disableFuzzySearch: boolean;
   maxDepth?: number;
+  maxFiles?: number;
 }
 
 export class AbortError extends Error {
@@ -109,7 +110,9 @@ class RecursiveFileSearch implements FileSearch {
       cache: this.options.cache,
       cacheTtl: this.options.cacheTtl,
       maxDepth: this.options.maxDepth,
+      maxFiles: this.options.maxFiles ?? 20000,
     });
+
     this.buildResultCache();
   }
 
diff --git a/packages/core/src/utils/shell-utils.test.ts b/packages/core/src/utils/shell-utils.test.ts
index 862b2014bc..745e85ca30 100644
--- a/packages/core/src/utils/shell-utils.test.ts
+++ b/packages/core/src/utils/shell-utils.test.ts
@@ -20,7 +20,9 @@ import {
   initializeShellParsers,
   stripShellWrapper,
   hasRedirection,
+  resolveExecutable,
 } from './shell-utils.js';
+import path from 'node:path';
 
 const mockPlatform = vi.hoisted(() => vi.fn());
 const mockHomedir = vi.hoisted(() => vi.fn());
@@ -33,6 +35,20 @@ vi.mock('os', () => ({
   homedir: mockHomedir,
 }));
 
+const mockAccess = vi.hoisted(() => vi.fn());
+vi.mock('node:fs', () => ({
+  default: {
+    promises: {
+      access: mockAccess,
+    },
+    constants: { X_OK: 1 },
+  },
+  promises: {
+    access: mockAccess,
+  },
+  constants: { X_OK: 1 },
+}));
+
 const mockSpawnSync = vi.hoisted(() => vi.fn());
 vi.mock('node:child_process', () => ({
   spawnSync: mockSpawnSync,
@@ -463,3 +479,65 @@ describe('hasRedirection (PowerShell via mock)', () => {
     expect(hasRedirection('echo "-> arrow"')).toBe(true);
   });
 });
+
+describe('resolveExecutable', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    process.env = { ...originalEnv };
+    mockAccess.mockReset();
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+  });
+
+  it('should return the absolute path if it exists and is executable', async () => {
+    const absPath = path.resolve('/usr/bin/git');
+    mockAccess.mockResolvedValue(undefined); // success
+    expect(await resolveExecutable(absPath)).toBe(absPath);
+    expect(mockAccess).toHaveBeenCalledWith(absPath, 1);
+  });
+
+  it('should return undefined for absolute path if it does not exist', async () => {
+    const absPath = path.resolve('/usr/bin/nonexistent');
+    mockAccess.mockRejectedValue(new Error('ENOENT'));
+    expect(await resolveExecutable(absPath)).toBeUndefined();
+  });
+
+  it('should resolve executable in PATH', async () => {
+    const binDir = path.resolve('/bin');
+    const usrBinDir = path.resolve('/usr/bin');
+    process.env['PATH'] = `${binDir}${path.delimiter}${usrBinDir}`;
+    mockPlatform.mockReturnValue('linux');
+
+    const targetPath = path.join(usrBinDir, 'ls');
+    mockAccess.mockImplementation(async (p: string) => {
+      if (p === targetPath) return undefined;
+      throw new Error('ENOENT');
+    });
+
+    expect(await resolveExecutable('ls')).toBe(targetPath);
+  });
+
+  it('should try extensions on Windows', async () => {
+    const sys32 = path.resolve('C:\\Windows\\System32');
+    process.env['PATH'] = sys32;
+    mockPlatform.mockReturnValue('win32');
+    mockAccess.mockImplementation(async (p: string) => {
+      // Use includes because on Windows path separators might differ
+      if (p.includes('cmd.exe')) return undefined;
+      throw new Error('ENOENT');
+    });
+
+    expect(await resolveExecutable('cmd')).toContain('cmd.exe');
+  });
+
+  it('should return undefined if not found in PATH', async () => {
+    process.env['PATH'] = path.resolve('/bin');
+    mockPlatform.mockReturnValue('linux');
+    mockAccess.mockRejectedValue(new Error('ENOENT'));
+
+    expect(await resolveExecutable('unknown')).toBeUndefined();
+  });
+});
diff --git a/packages/core/src/utils/shell-utils.ts b/packages/core/src/utils/shell-utils.ts
index c5eb6e8cf9..230870415c 100644
--- a/packages/core/src/utils/shell-utils.ts
+++ b/packages/core/src/utils/shell-utils.ts
@@ -5,6 +5,8 @@
  */
 
 import os from 'node:os';
+import fs from 'node:fs';
+import path from 'node:path';
 import { quote } from 'shell-quote';
 import {
   spawn,
@@ -37,6 +39,35 @@ export interface ShellConfiguration {
   shell: ShellType;
 }
 
+export async function resolveExecutable(
+  exe: string,
+): Promise<string | undefined> {
+  if (path.isAbsolute(exe)) {
+    try {
+      await fs.promises.access(exe, fs.constants.X_OK);
+      return exe;
+    } catch {
+      return undefined;
+    }
+  }
+  const paths = (process.env['PATH'] || '').split(path.delimiter);
+  const extensions =
+    os.platform() === 'win32' ? ['.exe', '.cmd', '.bat', ''] : [''];
+
+  for (const p of paths) {
+    for (const ext of extensions) {
+      const fullPath = path.join(p, exe + ext);
+      try {
+        await fs.promises.access(fullPath, fs.constants.X_OK);
+        return fullPath;
+      } catch {
+        continue;
+      }
+    }
+  }
+  return undefined;
+}
+
 let bashLanguage: Language | null = null;
 let treeSitterInitialization: Promise<void> | null = null;
 let treeSitterInitializationError: Error | null = null;
diff --git a/packages/core/src/utils/textUtils.test.ts b/packages/core/src/utils/textUtils.test.ts
index c1468c111b..4a2c319b87 100644
--- a/packages/core/src/utils/textUtils.test.ts
+++ b/packages/core/src/utils/textUtils.test.ts
@@ -5,7 +5,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { safeLiteralReplace } from './textUtils.js';
+import { safeLiteralReplace, truncateString } from './textUtils.js';
 
 describe('safeLiteralReplace', () => {
   it('returns original string when oldString empty or not found', () => {
@@ -77,3 +77,25 @@ describe('safeLiteralReplace', () => {
     expect(safeLiteralReplace('abc', 'b', '$$')).toBe('a$$c');
   });
 });
+
+describe('truncateString', () => {
+  it('should not truncate string shorter than maxLength', () => {
+    expect(truncateString('abc', 5)).toBe('abc');
+  });
+
+  it('should not truncate string equal to maxLength', () => {
+    expect(truncateString('abcde', 5)).toBe('abcde');
+  });
+
+  it('should truncate string longer than maxLength and append default suffix', () => {
+    expect(truncateString('abcdef', 5)).toBe('abcde...[TRUNCATED]');
+  });
+
+  it('should truncate string longer than maxLength and append custom suffix', () => {
+    expect(truncateString('abcdef', 5, '...')).toBe('abcde...');
+  });
+
+  it('should handle empty string', () => {
+    expect(truncateString('', 5)).toBe('');
+  });
+});
diff --git a/packages/core/src/utils/textUtils.ts b/packages/core/src/utils/textUtils.ts
index 693ab48fe5..c227d89e98 100644
--- a/packages/core/src/utils/textUtils.ts
+++ b/packages/core/src/utils/textUtils.ts
@@ -53,3 +53,21 @@ export function isBinary(
   // If no NULL bytes were found in the sample, we assume it's text.
   return false;
 }
+
+/**
+ * Truncates a string to a maximum length, appending a suffix if truncated.
+ * @param str The string to truncate.
+ * @param maxLength The maximum length of the string.
+ * @param suffix The suffix to append if truncated (default: '...[TRUNCATED]').
+ * @returns The truncated string.
+ */
+export function truncateString(
+  str: string,
+  maxLength: number,
+  suffix = '...[TRUNCATED]',
+): string {
+  if (str.length <= maxLength) {
+    return str;
+  }
+  return str.slice(0, maxLength) + suffix;
+}
diff --git a/packages/core/tsconfig.json b/packages/core/tsconfig.json
index 06e3256b97..7526c37932 100644
--- a/packages/core/tsconfig.json
+++ b/packages/core/tsconfig.json
@@ -4,7 +4,11 @@
     "outDir": "dist",
     "lib": ["DOM", "DOM.Iterable", "ES2023"],
     "composite": true,
-    "types": ["node", "vitest/globals"]
+    "types": ["node", "vitest/globals"],
+    "baseUrl": ".",
+    "paths": {
+      "@google/gemini-cli-core": ["./index.ts"]
+    }
   },
   "include": ["index.ts", "src/**/*.ts", "src/**/*.json"],
   "exclude": ["node_modules", "dist"]
diff --git a/packages/test-utils/package.json b/packages/test-utils/package.json
index c3e00ddd69..948fa14020 100644
--- a/packages/test-utils/package.json
+++ b/packages/test-utils/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@google/gemini-cli-test-utils",
-  "version": "0.26.0-nightly.20260114.bb6c57414",
+  "version": "0.26.0-nightly.20260115.6cb3ae4e0",
   "private": true,
   "main": "src/index.ts",
   "license": "Apache-2.0",
diff --git a/packages/vscode-ide-companion/package.json b/packages/vscode-ide-companion/package.json
index 9b0a994862..446e483664 100644
--- a/packages/vscode-ide-companion/package.json
+++ b/packages/vscode-ide-companion/package.json
@@ -2,7 +2,7 @@
   "name": "gemini-cli-vscode-ide-companion",
   "displayName": "Gemini CLI Companion",
   "description": "Enable Gemini CLI with direct access to your IDE workspace.",
-  "version": "0.26.0-nightly.20260114.bb6c57414",
+  "version": "0.26.0-nightly.20260115.6cb3ae4e0",
   "publisher": "google",
   "icon": "assets/icon.png",
   "repository": {
diff --git a/schemas/settings.schema.json b/schemas/settings.schema.json
index 4b99ec4632..7c36fdf589 100644
--- a/schemas/settings.schema.json
+++ b/schemas/settings.schema.json
@@ -1929,6 +1929,10 @@
             }
           }
         },
+        "enabled": {
+          "type": "boolean",
+          "description": "Whether to enable the agent."
+        },
         "disabled": {
           "type": "boolean",
           "description": "Whether to disable the agent."