feat(admin): implement admin controls polling and restart prompt (#16627)

packages/cli/src/config/keyBindings.ts

@@ -81,6 +81,7 @@ export enum Command {
   FOCUS_SHELL_INPUT = 'app.focusShellInput',
   UNFOCUS_SHELL_INPUT = 'app.unfocusShellInput',
   CLEAR_SCREEN = 'app.clearScreen',
+  RESTART_APP = 'app.restart',
 }
 
 /**
@@ -238,6 +239,7 @@ export const defaultKeyBindings: KeyBindingConfig = {
   [Command.FOCUS_SHELL_INPUT]: [{ key: 'tab', shift: false }],
   [Command.UNFOCUS_SHELL_INPUT]: [{ key: 'tab' }],
   [Command.CLEAR_SCREEN]: [{ key: 'l', ctrl: true }],
+  [Command.RESTART_APP]: [{ key: 'r' }],
 };
 
 interface CommandCategory {
@@ -343,6 +345,7 @@ export const commandCategories: readonly CommandCategory[] = [
       Command.FOCUS_SHELL_INPUT,
       Command.UNFOCUS_SHELL_INPUT,
       Command.CLEAR_SCREEN,
+      Command.RESTART_APP,
     ],
   },
 ];
@@ -428,4 +431,5 @@ export const commandDescriptions: Readonly<Record<Command, string>> = {
   [Command.FOCUS_SHELL_INPUT]: 'Focus the shell input from the gemini input.',
   [Command.UNFOCUS_SHELL_INPUT]: 'Focus the Gemini input from the shell input.',
   [Command.CLEAR_SCREEN]: 'Clear the terminal screen and redraw the UI.',
+  [Command.RESTART_APP]: 'Restart the application.',
 };

packages/cli/src/config/settings.ts

@@ -16,7 +16,7 @@ import {
   Storage,
   coreEvents,
   homedir,
-  type GeminiCodeAssistSetting,
+  type FetchAdminControlsResponse,
 } from '@google/gemini-cli-core';
 import stripJsonComments from 'strip-json-comments';
 import { DefaultLight } from '../ui/themes/default-light.js';
@@ -346,7 +346,7 @@ export class LoadedSettings {
     coreEvents.emitSettingsChanged();
   }
 
-  setRemoteAdminSettings(remoteSettings: GeminiCodeAssistSetting): void {
+  setRemoteAdminSettings(remoteSettings: FetchAdminControlsResponse): void {
     const admin: Settings['admin'] = {};
     const { secureModeEnabled, mcpSetting, cliFeatureSetting } = remoteSettings;
 

packages/cli/src/gemini.tsx

@@ -61,6 +61,7 @@ import {
   SessionStartSource,
   SessionEndReason,
   getVersion,
+  type FetchAdminControlsResponse,
 } from '@google/gemini-cli-core';
 import {
   initializeApp,
@@ -283,6 +284,14 @@ export async function startInteractiveUI(
 
 export async function main() {
   const cliStartupHandle = startupProfiler.start('cli_startup');
+
+  // Listen for admin controls from parent process (IPC) in non-sandbox mode. In
+  // sandbox mode, we re-fetch the admin controls from the server once we enter
+  // the sandbox.
+  // TODO: Cache settings in sandbox mode as well.
+  const adminControlsListner = setupAdminControlsListener();
+  registerCleanup(adminControlsListner.cleanup);
+
   const cleanupStdio = patchStdio();
   registerSyncCleanup(() => {
     // This is needed to ensure we don't lose any buffered output.
@@ -358,6 +367,7 @@ export async function main() {
   const partialConfig = await loadCliConfig(settings.merged, sessionId, argv, {
     projectHooks: settings.workspace.settings.hooks,
   });
+  adminControlsListner.setConfig(partialConfig);
 
   // Refresh auth to fetch remote admin settings from CCPA and before entering
   // the sandbox because the sandbox will interfere with the Oauth2 web
@@ -451,7 +461,7 @@ export async function main() {
     } else {
       // Relaunch app so we always have a child process that can be internally
       // restarted if needed.
-      await relaunchAppInChildProcess(memoryArgs, []);
+      await relaunchAppInChildProcess(memoryArgs, [], remoteAdminSettings);
     }
   }
 
@@ -464,6 +474,7 @@ export async function main() {
       projectHooks: settings.workspace.settings.hooks,
     });
     loadConfigHandle?.end();
+    adminControlsListner.setConfig(config);
 
     if (config.isInteractive() && config.storage && config.getDebugMode()) {
       const { registerActivityLogger } = await import(
@@ -756,3 +767,36 @@ export function initializeOutputListenersAndFlush() {
   }
   coreEvents.drainBacklogs();
 }
+
+function setupAdminControlsListener() {
+  let pendingSettings: FetchAdminControlsResponse | undefined;
+  let config: Config | undefined;
+
+  const messageHandler = (msg: unknown) => {
+    const message = msg as {
+      type?: string;
+      settings?: FetchAdminControlsResponse;
+    };
+    if (message?.type === 'admin-settings' && message.settings) {
+      if (config) {
+        config.setRemoteAdminSettings(message.settings);
+      } else {
+        pendingSettings = message.settings;
+      }
+    }
+  };
+
+  process.on('message', messageHandler);
+
+  return {
+    setConfig: (newConfig: Config) => {
+      config = newConfig;
+      if (pendingSettings) {
+        config.setRemoteAdminSettings(pendingSettings);
+      }
+    },
+    cleanup: () => {
+      process.off('message', messageHandler);
+    },
+  };
+}

packages/cli/src/test-utils/render.tsx

@@ -173,6 +173,7 @@ const mockUIActions: UIActions = {
   setBannerVisible: vi.fn(),
   setEmbeddedShellFocused: vi.fn(),
   setAuthContext: vi.fn(),
+  handleRestart: vi.fn(),
 };
 
 export const renderWithProviders = (

packages/cli/src/ui/AppContainer.tsx

@@ -186,6 +186,7 @@ export const AppContainer = (props: AppContainerProps) => {
   );
   const [copyModeEnabled, setCopyModeEnabled] = useState(false);
   const [pendingRestorePrompt, setPendingRestorePrompt] = useState(false);
+  const [adminSettingsChanged, setAdminSettingsChanged] = useState(false);
 
   const [shellModeActive, setShellModeActive] = useState(false);
   const [modelSwitchedFromQuotaError, setModelSwitchedFromQuotaError] =
@@ -364,9 +365,18 @@ export const AppContainer = (props: AppContainerProps) => {
       setSettingsNonce((prev) => prev + 1);
     };
 
+    const handleAdminSettingsChanged = () => {
+      setAdminSettingsChanged(true);
+    };
+
     coreEvents.on(CoreEvent.SettingsChanged, handleSettingsChanged);
+    coreEvents.on(CoreEvent.AdminSettingsChanged, handleAdminSettingsChanged);
     return () => {
       coreEvents.off(CoreEvent.SettingsChanged, handleSettingsChanged);
+      coreEvents.off(
+        CoreEvent.AdminSettingsChanged,
+        handleAdminSettingsChanged,
+      );
     };
   }, []);
 
@@ -1452,6 +1462,7 @@ Logging in with Google... Restarting Gemini CLI to continue.
   const dialogsVisible =
     shouldShowIdePrompt ||
     isFolderTrustDialogOpen ||
+    adminSettingsChanged ||
     !!shellConfirmationRequest ||
     !!confirmationRequest ||
     !!customDialog ||
@@ -1616,6 +1627,7 @@ Logging in with Google... Restarting Gemini CLI to continue.
       bannerVisible,
       terminalBackgroundColor: config.getTerminalBackground(),
       settingsNonce,
+      adminSettingsChanged,
     }),
     [
       isThemeDialogOpen,
@@ -1710,6 +1722,7 @@ Logging in with Google... Restarting Gemini CLI to continue.
       bannerVisible,
       config,
       settingsNonce,
+      adminSettingsChanged,
     ],
   );
 
@@ -1754,6 +1767,10 @@ Logging in with Google... Restarting Gemini CLI to continue.
       setBannerVisible,
       setEmbeddedShellFocused,
       setAuthContext,
+      handleRestart: async () => {
+        await runExitCleanup();
+        process.exit(RELAUNCH_EXIT_CODE);
+      },
     }),
     [
       handleThemeSelect,

packages/cli/src/ui/components/AdminSettingsChangedDialog.test.tsx

@@ -0,0 +1,51 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { renderWithProviders } from '../../test-utils/render.js';
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { act } from 'react';
+import { AdminSettingsChangedDialog } from './AdminSettingsChangedDialog.js';
+
+const handleRestartMock = vi.fn();
+
+describe('AdminSettingsChangedDialog', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('renders correctly', () => {
+    const { lastFrame } = renderWithProviders(<AdminSettingsChangedDialog />);
+    expect(lastFrame()).toMatchSnapshot();
+  });
+
+  it('restarts on "r" key press', async () => {
+    const { stdin } = renderWithProviders(<AdminSettingsChangedDialog />, {
+      uiActions: {
+        handleRestart: handleRestartMock,
+      },
+    });
+
+    act(() => {
+      stdin.write('r');
+    });
+
+    expect(handleRestartMock).toHaveBeenCalled();
+  });
+
+  it.each(['r', 'R'])('restarts on "%s" key press', async (key) => {
+    const { stdin } = renderWithProviders(<AdminSettingsChangedDialog />, {
+      uiActions: {
+        handleRestart: handleRestartMock,
+      },
+    });
+
+    act(() => {
+      stdin.write(key);
+    });
+
+    expect(handleRestartMock).toHaveBeenCalled();
+  });
+});

packages/cli/src/ui/components/AdminSettingsChangedDialog.tsx

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { Box, Text } from 'ink';
+import { theme } from '../semantic-colors.js';
+import { useKeypress } from '../hooks/useKeypress.js';
+import { useUIActions } from '../contexts/UIActionsContext.js';
+import { Command, keyMatchers } from '../keyMatchers.js';
+
+export const AdminSettingsChangedDialog = () => {
+  const { handleRestart } = useUIActions();
+
+  useKeypress(
+    (key) => {
+      if (keyMatchers[Command.RESTART_APP](key)) {
+        handleRestart();
+      }
+    },
+    { isActive: true },
+  );
+
+  const message =
+    'Admin settings have changed. Please restart the session to apply new settings.';
+
+  return (
+    <Box borderStyle="round" borderColor={theme.status.warning} paddingX={1}>
+      <Text color={theme.status.warning}>
+        {message} Press &apos;r&apos; to restart, or &apos;Ctrl+C&apos; twice to
+        exit.
+      </Text>
+    </Box>
+  );
+};

packages/cli/src/ui/components/DialogManager.tsx

@@ -30,6 +30,7 @@ import { useConfig } from '../contexts/ConfigContext.js';
 import { useSettings } from '../contexts/SettingsContext.js';
 import process from 'node:process';
 import { type UseHistoryManagerReturn } from '../hooks/useHistoryManager.js';
+import { AdminSettingsChangedDialog } from './AdminSettingsChangedDialog.js';
 import { IdeTrustChangeDialog } from './IdeTrustChangeDialog.js';
 
 interface DialogManagerProps {
@@ -50,6 +51,9 @@ export const DialogManager = ({
   const { constrainHeight, terminalHeight, staticExtraHeight, mainAreaWidth } =
     uiState;
 
+  if (uiState.adminSettingsChanged) {
+    return <AdminSettingsChangedDialog />;
+  }
   if (uiState.showIdeRestartPrompt) {
     return <IdeTrustChangeDialog reason={uiState.ideTrustRestartReason} />;
   }

packages/cli/src/ui/components/__snapshots__/AdminSettingsChangedDialog.test.tsx.snap

@@ -0,0 +1,8 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`AdminSettingsChangedDialog > renders correctly 1`] = `
+"╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
+│ Admin settings have changed. Please restart the session to apply new settings. Press 'r' to restart, or 'Ctrl+C'     │
+│ twice to exit.                                                                                                       │
+╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯"
+`;

packages/cli/src/ui/contexts/UIActionsContext.tsx

@@ -57,6 +57,7 @@ export interface UIActions {
   setBannerVisible: (visible: boolean) => void;
   setEmbeddedShellFocused: (value: boolean) => void;
   setAuthContext: (context: { requiresRestart?: boolean }) => void;
+  handleRestart: () => void;
 }
 
 export const UIActionsContext = createContext<UIActions | null>(null);

packages/cli/src/ui/contexts/UIStateContext.tsx

@@ -141,6 +141,7 @@ export interface UIState {
   customDialog: React.ReactNode | null;
   terminalBackgroundColor: TerminalBackgroundColor;
   settingsNonce: number;
+  adminSettingsChanged: boolean;
 }
 
 export const UIStateContext = createContext<UIState | null>(null);

packages/cli/src/utils/relaunch.ts

@@ -6,7 +6,10 @@
 
 import { spawn } from 'node:child_process';
 import { RELAUNCH_EXIT_CODE } from './processUtils.js';
-import { writeToStderr } from '@google/gemini-cli-core';
+import {
+  writeToStderr,
+  type FetchAdminControlsResponse,
+} from '@google/gemini-cli-core';
 
 export async function relaunchOnExitCode(runner: () => Promise<number>) {
   while (true) {
@@ -31,6 +34,7 @@ export async function relaunchOnExitCode(runner: () => Promise<number>) {
 export async function relaunchAppInChildProcess(
   additionalNodeArgs: string[],
   additionalScriptArgs: string[],
+  remoteAdminSettings?: FetchAdminControlsResponse,
 ) {
   if (process.env['GEMINI_CLI_NO_RELAUNCH']) {
     return;
@@ -55,10 +59,14 @@ export async function relaunchAppInChildProcess(
     process.stdin.pause();
 
     const child = spawn(process.execPath, nodeArgs, {
-      stdio: 'inherit',
+      stdio: ['inherit', 'inherit', 'inherit', 'ipc'],
       env: newEnv,
     });
 
+    if (remoteAdminSettings) {
+      child.send({ type: 'admin-settings', settings: remoteAdminSettings });
+    }
+
     return new Promise<number>((resolve, reject) => {
       child.on('error', reject);
       child.on('close', (code) => {