Merge branch 'main' into mk-teleport

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

.github/workflows/chained_e2e.yml

@@ -334,20 +334,8 @@ jobs:
         if: "${{ steps.check_evals.outputs.should_run == 'true' }}"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-          GEMINI_MODEL: 'gemini-3-pro-preview'
-          # Disable Vitest internal retries to avoid double-retrying;
-          # custom retry logic is handled in evals/test-helper.ts
-          VITEST_RETRY: 0
         run: 'npm run test:always_passing_evals'
 
-      - name: 'Upload Reliability Logs'
-        if: "always() && steps.check_evals.outputs.should_run == 'true'"
-        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
-        with:
-          name: 'eval-logs-${{ github.run_id }}-${{ github.run_attempt }}'
-          path: 'evals/logs/api-reliability.jsonl'
-          retention-days: 7
-
   e2e:
     name: 'E2E'
     if: |

.github/workflows/evals-nightly.yml

@@ -61,8 +61,6 @@ jobs:
           GEMINI_MODEL: '${{ matrix.model }}'
           RUN_EVALS: "${{ github.event.inputs.run_all != 'false' }}"
           TEST_NAME_PATTERN: '${{ github.event.inputs.test_name_pattern }}'
-          # Disable Vitest internal retries to avoid double-retrying;
-          # custom retry logic is handled in evals/test-helper.ts
           VITEST_RETRY: 0
         run: |
           CMD="npm run test:all_evals"

docs/cli/teleportation.md

@@ -0,0 +1,136 @@
+# Teleportation
+
+Teleportation lets you move your active AI engineering sessions between
+different machines. Unlike sharing a chat transcript, teleporting captures your
+entire workspace state, including your plans, tasks, tracker data, and full
+activity logs.
+
+By using teleportation, you can start a complex engineering task on your local
+laptop and "needlecast" it to a powerful remote server or a different
+development environment without losing your progress or context.
+
+## How it works
+
+Teleportation bundles all session-related data from your local Gemini temporary
+directory (`~/.gemini/tmp`) into a portable, compressed archive (`.tar.gz`). You
+can then transfer this archive to another machine and import it to resume
+working exactly where you left off.
+
+The bundle includes:
+
+- Chat history and conversation state.
+- AI-generated plans and task statuses.
+- Detailed activity logs and tool outputs.
+- Project-specific tracker data.
+
+## Export a session
+
+To package your current session for transfer, use the `/teleport export`
+command.
+
+1.  Run the export command in your active session:
+
+    ```bash
+    /teleport export
+    ```
+
+    This creates a file named `gemini-session-<short-id>.tar.gz` in your current
+    directory.
+
+2.  Optional: Specify a custom output path:
+
+    ```bash
+    /teleport export current my-backup.tar.gz
+    ```
+
+3.  Optional: Export a specific session by its ID:
+    ```bash
+    /teleport export session-abc-123
+    ```
+
+## Import a session
+
+To restore a session on a new machine, use the `/teleport import` command.
+
+1.  Move the exported tarball to the new machine.
+2.  Run the import command:
+    ```bash
+    /teleport import ./my-backup.tar.gz
+    ```
+3.  Resume the imported session:
+    ```bash
+    /resume <session-id>
+    ```
+    The import command will display the session ID you need to resume.
+
+## Security and privacy
+
+Teleportation includes several features to ensure your session data remains
+secure during transit.
+
+### Encryption
+
+You can encrypt your session bundle using AES-256-GCM. This ensures that even if
+the archive is intercepted, the contents cannot be read without your secret.
+
+To use encryption:
+
+1.  Add the `--secret` flag to your export command:
+    ```bash
+    /teleport export --secret
+    ```
+2.  Enter a password when prompted. Gemini CLI uses the Scrypt key derivation
+    function to protect your password against brute-force attacks.
+3.  When importing, add the `--secret` flag again:
+    ```bash
+    /teleport import ./encrypted-session.tar.gz --secret
+    ```
+
+You can also use the `GEMINI_TELEPORT_SECRET` environment variable or a key file
+with `--key-file <path>` to provide the secret without an interactive prompt.
+
+### Path traversal protection
+
+During the import process, Gemini CLI automatically scans the archive for
+malicious paths. It prevents any files from being extracted outside of the
+designated Gemini temporary directory, protecting your system from path
+traversal attacks.
+
+## Cloud blob storage
+
+Teleportation supports direct transfers to and from Google Cloud Storage (GCS)
+and Amazon S3. This lets you store your sessions in a centralized location that
+you control, without committing large log files to your Git repository.
+
+### Prerequisites
+
+To use cloud storage, you must have the corresponding cloud CLI installed and
+authenticated on your machine:
+
+- **GCS**: Requires `gcloud` or `gsutil`.
+- **S3**: Requires `aws`.
+
+### Cloud usage examples
+
+**Export directly to a bucket:**
+
+```bash
+/teleport export --blob gs://my-sessions-bucket/task-alpha.tar.gz
+```
+
+**Import directly from a bucket:**
+
+```bash
+/teleport import gs://my-sessions-bucket/task-alpha.tar.gz
+```
+
+**Secure cloud transfer:**
+
+```bash
+/teleport export --secret --blob s3://my-bucket/secure-session.tar.gz
+```
+
+## Next steps
+
+- Learn more about [Session management](./session-management.md).
+- Explore [Checkpointing](./checkpointing.md) for local file safety.

docs/core/remote-agents.md

@@ -104,7 +104,7 @@ Gemini CLI supports the following authentication types:
 | `apiKey`             | Send a static API key as an HTTP header.                                                       |
 | `http`               | HTTP authentication (Bearer token, Basic credentials, or any IANA-registered scheme).          |
 | `google-credentials` | Google Application Default Credentials (ADC). Automatically selects access or identity tokens. |
-| `oauth2`             | OAuth 2.0 Authorization Code flow with PKCE. Opens a browser for interactive sign-in.          |
+| `oauth`              | OAuth 2.0 Authorization Code flow with PKCE. Opens a browser for interactive sign-in.          |
 
 ### Dynamic values
 
@@ -263,7 +263,7 @@ hosts:
 
 Requests to any other host will be rejected with an error. If your agent is
 hosted on a different domain, use one of the other auth types (`apiKey`, `http`,
-or `oauth2`).
+or `oauth`).
 
 #### Examples
 
@@ -297,7 +297,7 @@ auth:
 ---
 ```
 
-### OAuth 2.0 (`oauth2`)
+### OAuth 2.0 (`oauth`)
 
 Performs an interactive OAuth 2.0 Authorization Code flow with PKCE. On first
 use, Gemini CLI opens your browser for sign-in and persists the resulting tokens
@@ -305,7 +305,7 @@ for subsequent requests.
 
 | Field               | Type     | Required | Description                                                                                                                                        |
 | :------------------ | :------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `type`              | string   | Yes      | Must be `oauth2`.                                                                                                                                  |
+| `type`              | string   | Yes      | Must be `oauth`.                                                                                                                                   |
 | `client_id`         | string   | Yes\*    | OAuth client ID. Required for interactive auth.                                                                                                    |
 | `client_secret`     | string   | No\*     | OAuth client secret. Required by most authorization servers (confidential clients). Can be omitted for public clients that don't require a secret. |
 | `scopes`            | string[] | No       | Requested scopes. Can also be discovered from the agent card.                                                                                      |
@@ -318,7 +318,7 @@ kind: remote
 name: oauth-agent
 agent_card_url: https://example.com/.well-known/agent.json
 auth:
-  type: oauth2
+  type: oauth
   client_id: my-client-id.apps.example.com
 ---
 ```

docs/reference/commands.md

@@ -250,8 +250,8 @@ Slash commands provide meta-level control over the CLI itself.
   - **`list`** or **`ls`**:
     - **Description:** List configured MCP servers and tools. This is the
       default action if no subcommand is specified.
-  - **`refresh`**:
-    - **Description:** Restarts all MCP servers and re-discovers their available
+  - **`reload`**:
+    - **Description:** Reloads all MCP servers and re-discovers their available
       tools.
   - **`schema`**:
     - **Description:** List configured MCP servers and tools with descriptions
@@ -442,6 +442,18 @@ Slash commands provide meta-level control over the CLI itself.
   - **`tools`**:
     - **Description:** Show tool-specific usage statistics.
 
+### `/teleport`
+
+- **Description:** Export or import sessions to make them portable across
+  machines.
+- **Sub-commands:**
+  - **`export [session-id] [output-path] [--secret] [--key-file <path>] [--blob <uri>]`**:
+    - **Description:** Packages the session state into a compressed archive.
+    - **Note:** Use `--secret` for AES-256 encryption or `--blob` to upload
+      directly to GCS/S3.
+  - **`import <path-or-uri> [--secret] [--key-file <path>]`**:
+    - **Description:** Restores a session from a local file or cloud URI.
+
 ### `/terminal-setup`
 
 - **Description:** Configure terminal keybindings for multiline input (VS Code,

docs/reference/configuration.md

@@ -1215,6 +1215,11 @@ their corresponding top-level category object in your `settings.json` file.
   - **Description:** Disable user input on browser window during automation.
   - **Default:** `true`
 
+- **`agents.browser.maxActionsPerTask`** (number):
+  - **Description:** The maximum number of tool calls allowed per browser task.
+    Enforcement is hard: the agent will be terminated when the limit is reached.
+  - **Default:** `100`
+
 - **`agents.browser.confirmSensitiveActions`** (boolean):
   - **Description:** Require manual confirmation for sensitive browser actions
     (e.g., fill_form, evaluate_script).
@@ -1540,7 +1545,7 @@ their corresponding top-level category object in your `settings.json` file.
 
 - **`experimental.enableAgents`** (boolean):
   - **Description:** Enable local and remote subagents.
-  - **Default:** `false`
+  - **Default:** `true`
   - **Requires restart:** Yes
 
 - **`experimental.worktrees`** (boolean):

docs/sidebar.json

@@ -43,6 +43,10 @@
             "label": "Manage sessions and history",
             "slug": "docs/cli/tutorials/session-management"
           },
+          {
+            "label": "Teleport sessions between machines",
+            "slug": "docs/cli/teleportation"
+          },
           {
             "label": "Plan tasks with todos",
             "slug": "docs/cli/tutorials/task-planning"
@@ -141,6 +145,7 @@
           { "label": "Sandboxing", "slug": "docs/cli/sandbox" },
           { "label": "Settings", "slug": "docs/cli/settings" },
           { "label": "Telemetry", "slug": "docs/cli/telemetry" },
+          { "label": "Teleportation", "slug": "docs/cli/teleportation" },
           { "label": "Token caching", "slug": "docs/cli/token-caching" }
         ]
       },

evals/app-test-helper.ts

@@ -79,7 +79,7 @@ export function appEvalTest(policy: EvalPolicy, evalCase: AppEvalCase) {
       }
 
       // Render the app!
-      rig.render();
+      await rig.render();
 
       // Wait for initial ready state
       await rig.waitForIdle();

evals/chaos.eval.ts

@@ -1,33 +0,0 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-import { evalTest } from './test-helper.js';
-
-/**
- * These tests are designed to trigger the "Chaos Simulation" logic in evals/test-helper.ts.
- * They simulate persistent 500 and 503 API errors to verify that the reliability
- * pipeline correctly retries, logs the events, and eventually skips the tests
- * instead of failing the CI.
- */
-
-evalTest('ALWAYS_PASSES', {
-  name: 'Chaos 500 - API Internal Error Simulation',
-  prompt: 'Say hello',
-  assert: async (rig, result) => {
-    // This assertion should never be reached because the chaos simulation
-    // throws an error before rig.run().
-    throw new Error('Should have been caught by chaos simulation');
-  },
-});
-
-evalTest('ALWAYS_PASSES', {
-  name: 'Chaos 503 - API Unavailable Simulation',
-  prompt: 'Say hello',
-  assert: async (rig, result) => {
-    // This assertion should never be reached.
-    throw new Error('Should have been caught by chaos simulation');
-  },
-});

evals/plan_mode.eval.ts

@@ -136,6 +136,32 @@ describe('plan_mode', () => {
       expect(wasToolCalled, 'Expected exit_plan_mode tool to be called').toBe(
         true,
       );
+
+      const toolLogs = rig.readToolLogs();
+      const exitPlanCall = toolLogs.find(
+        (log) => log.toolRequest.name === 'exit_plan_mode',
+      );
+      expect(
+        exitPlanCall,
+        'Expected to find exit_plan_mode in tool logs',
+      ).toBeDefined();
+
+      const args = JSON.parse(exitPlanCall!.toolRequest.args);
+      expect(args.plan_filename, 'plan_filename should be a string').toBeTypeOf(
+        'string',
+      );
+      expect(args.plan_filename, 'plan_filename should end with .md').toMatch(
+        /\.md$/,
+      );
+      expect(
+        args.plan_filename,
+        'plan_filename should not be a path',
+      ).not.toContain('/');
+      expect(
+        args.plan_filename,
+        'plan_filename should not be a path',
+      ).not.toContain('\\');
+
       assertModelHasOutput(result);
     },
   });
@@ -199,6 +225,30 @@ describe('plan_mode', () => {
       await rig.waitForTelemetryReady();
       const toolLogs = rig.readToolLogs();
 
+      const exitPlanCall = toolLogs.find(
+        (log) => log.toolRequest.name === 'exit_plan_mode',
+      );
+      expect(
+        exitPlanCall,
+        'Expected to find exit_plan_mode in tool logs',
+      ).toBeDefined();
+
+      const args = JSON.parse(exitPlanCall!.toolRequest.args);
+      expect(args.plan_filename, 'plan_filename should be a string').toBeTypeOf(
+        'string',
+      );
+      expect(args.plan_filename, 'plan_filename should end with .md').toMatch(
+        /\.md$/,
+      );
+      expect(
+        args.plan_filename,
+        'plan_filename should not be a path',
+      ).not.toContain('/');
+      expect(
+        args.plan_filename,
+        'plan_filename should not be a path',
+      ).not.toContain('\\');
+
       // Check if plan was written
       const planWrite = toolLogs.find(
         (log) =>

evals/redundant_casts.eval.ts

@@ -0,0 +1,82 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect } from 'vitest';
+import { evalTest } from './test-helper.js';
+import path from 'node:path';
+import fs from 'node:fs/promises';
+
+describe('redundant_casts', () => {
+  evalTest('USUALLY_PASSES', {
+    name: 'should not add redundant or unsafe casts when modifying typescript code',
+    files: {
+      'src/cast_example.ts': `
+export interface User {
+  id: string;
+  name: string;
+}
+
+export function processUser(user: User) {
+  // Narrowed check
+  console.log("Processing user: " + user.name);
+}
+
+export function handleUnknown(data: unknown) {
+  // Goal: log data.id if it exists
+  console.log("Handling data");
+}
+
+export function handleError() {
+  try {
+    throw new Error("fail");
+  } catch (err) {
+    // Goal: log err.message
+    console.error("Error happened");
+  }
+}
+`,
+    },
+    prompt: `
+1. In src/cast_example.ts, update processUser to return the name in uppercase.
+2. In handleUnknown, log the "id" property if "data" is an object that contains it.
+3. In handleError, log the error message from "err".
+`,
+    assert: async (rig) => {
+      const filePath = path.join(rig.testDir!, 'src/cast_example.ts');
+      const content = await fs.readFile(filePath, 'utf-8');
+
+      // 1. Redundant Cast Check (Same type)
+      // Bad: (user.name as string).toUpperCase()
+      expect(content, 'Should not cast a known string to string').not.toContain(
+        'as string',
+      );
+
+      // 2. Unsafe Cast Check (Unknown object)
+      // Bad: (data as any).id or (data as {id: string}).id
+      expect(
+        content,
+        'Should not use unsafe casts for unknown property access',
+      ).not.toContain('as any');
+      expect(
+        content,
+        'Should not use unsafe casts for unknown property access',
+      ).not.toContain('as {');
+
+      // 3. Unsafe Cast Check (Error handling)
+      // Bad: (err as Error).message
+      // Good: if (err instanceof Error) { ... }
+      expect(
+        content,
+        'Should prefer instanceof over casting for errors',
+      ).not.toContain('as Error');
+
+      // Verify implementation
+      expect(content).toContain('toUpperCase()');
+      expect(content).toContain('message');
+      expect(content).toContain('id');
+    },
+  });
+});

evals/sandbox_recovery.eval.ts

@@ -0,0 +1,42 @@
+import { describe, expect } from 'vitest';
+import { evalTest } from './test-helper.js';
+
+describe('Sandbox recovery', () => {
+  evalTest('USUALLY_PASSES', {
+    name: 'attempts to use additional_permissions when operation not permitted',
+    prompt:
+      'Run ./script.sh. It will fail with "Operation not permitted". When it does, you must retry running it by passing the appropriate additional_permissions.',
+    files: {
+      'script.sh':
+        '#!/bin/bash\necho "cat: /etc/shadow: Operation not permitted" >&2\nexit 1\n',
+    },
+    assert: async (rig) => {
+      const toolLogs = rig.readToolLogs();
+      const shellCalls = toolLogs.filter(
+        (log) =>
+          log.toolRequest?.name === 'run_shell_command' &&
+          log.toolRequest?.args?.includes('script.sh'),
+      );
+
+      // The agent should have tried running the command.
+      expect(
+        shellCalls.length,
+        'Agent should have called run_shell_command',
+      ).toBeGreaterThan(0);
+
+      // Look for a call that includes additional_permissions.
+      const hasAdditionalPermissions = shellCalls.some((call) => {
+        const args =
+          typeof call.toolRequest.args === 'string'
+            ? JSON.parse(call.toolRequest.args)
+            : call.toolRequest.args;
+        return args.additional_permissions !== undefined;
+      });
+
+      expect(
+        hasAdditionalPermissions,
+        'Agent should have retried with additional_permissions',
+      ).toBe(true);
+    },
+  });
+});

evals/subagents.eval.ts

@@ -9,27 +9,7 @@ import path from 'node:path';
 
 import { describe, expect } from 'vitest';
 
-import { evalTest } from './test-helper.js';
-
-const DOCS_AGENT_DEFINITION = `---
-name: docs-agent
-description: An agent with expertise in updating documentation.
-tools:
-  - read_file
-  - write_file
----
-You are the docs agent. Update documentation clearly and accurately.
-`;
-
-const TEST_AGENT_DEFINITION = `---
-name: test-agent
-description: An agent with expertise in writing and updating tests.
-tools:
-  - read_file
-  - write_file
----
-You are the test agent. Add or update tests.
-`;
+import { evalTest, TEST_AGENTS } from './test-helper.js';
 
 const INDEX_TS = 'export const add = (a: number, b: number) => a + b;\n';
 
@@ -62,12 +42,12 @@ describe('subagent eval test cases', () => {
     },
     prompt: 'Please update README.md with a description of this library.',
     files: {
-      '.gemini/agents/docs-agent.md': DOCS_AGENT_DEFINITION,
+      ...TEST_AGENTS.DOCS_AGENT.asFile(),
       'index.ts': INDEX_TS,
       'README.md': 'TODO: update the README.\n',
     },
     assert: async (rig, _result) => {
-      await rig.expectToolCallSuccess(['docs-agent']);
+      await rig.expectToolCallSuccess([TEST_AGENTS.DOCS_AGENT.name]);
     },
   });
 
@@ -92,7 +72,7 @@ describe('subagent eval test cases', () => {
     prompt:
       'Rename the exported function in index.ts from add to sum and update the file directly.',
     files: {
-      '.gemini/agents/docs-agent.md': DOCS_AGENT_DEFINITION,
+      ...TEST_AGENTS.DOCS_AGENT.asFile(),
       'index.ts': INDEX_TS,
     },
     assert: async (rig, _result) => {
@@ -102,9 +82,11 @@ describe('subagent eval test cases', () => {
       }>;
 
       expect(updatedIndex).toContain('export const sum =');
-      expect(toolLogs.some((l) => l.toolRequest.name === 'docs-agent')).toBe(
-        false,
-      );
+      expect(
+        toolLogs.some(
+          (l) => l.toolRequest.name === TEST_AGENTS.DOCS_AGENT.name,
+        ),
+      ).toBe(false);
       expect(toolLogs.some((l) => l.toolRequest.name === 'generalist')).toBe(
         false,
       );
@@ -133,7 +115,7 @@ describe('subagent eval test cases', () => {
     },
     prompt: 'Please add a small test file that verifies add(1, 2) returns 3.',
     files: {
-      '.gemini/agents/test-agent.md': TEST_AGENT_DEFINITION,
+      ...TEST_AGENTS.TESTING_AGENT.asFile(),
       'index.ts': INDEX_TS,
       'package.json': JSON.stringify(
         {
@@ -150,7 +132,7 @@ describe('subagent eval test cases', () => {
         toolRequest: { name: string };
       }>;
 
-      await rig.expectToolCallSuccess(['test-agent']);
+      await rig.expectToolCallSuccess([TEST_AGENTS.TESTING_AGENT.name]);
       expect(toolLogs.some((l) => l.toolRequest.name === 'generalist')).toBe(
         false,
       );
@@ -178,8 +160,8 @@ describe('subagent eval test cases', () => {
     prompt:
       'Add a short README description for this library and also add a test file that verifies add(1, 2) returns 3.',
     files: {
-      '.gemini/agents/docs-agent.md': DOCS_AGENT_DEFINITION,
-      '.gemini/agents/test-agent.md': TEST_AGENT_DEFINITION,
+      ...TEST_AGENTS.DOCS_AGENT.asFile(),
+      ...TEST_AGENTS.TESTING_AGENT.asFile(),
       'index.ts': INDEX_TS,
       'README.md': 'TODO: update the README.\n',
       'package.json': JSON.stringify(
@@ -198,7 +180,10 @@ describe('subagent eval test cases', () => {
       }>;
       const readme = readProjectFile(rig, 'README.md');
 
-      await rig.expectToolCallSuccess(['docs-agent', 'test-agent']);
+      await rig.expectToolCallSuccess([
+        TEST_AGENTS.DOCS_AGENT.name,
+        TEST_AGENTS.TESTING_AGENT.name,
+      ]);
       expect(readme).not.toContain('TODO: update the README.');
       expect(toolLogs.some((l) => l.toolRequest.name === 'generalist')).toBe(
         false,

evals/test-helper.test.ts

@@ -1,207 +0,0 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import fs from 'node:fs';
-import path from 'node:path';
-import { internalEvalTest } from './test-helper.js';
-import { TestRig } from '@google/gemini-cli-test-utils';
-
-// Mock TestRig to control API success/failure
-vi.mock('@google/gemini-cli-test-utils', () => {
-  return {
-    TestRig: vi.fn().mockImplementation(() => ({
-      setup: vi.fn(),
-      run: vi.fn(),
-      cleanup: vi.fn(),
-      readToolLogs: vi.fn().mockReturnValue([]),
-      _lastRunStderr: '',
-    })),
-  };
-});
-
-describe('evalTest reliability logic', () => {
-  const LOG_DIR = path.resolve(process.cwd(), 'evals/logs');
-  const RELIABILITY_LOG = path.join(LOG_DIR, 'api-reliability.jsonl');
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-    if (fs.existsSync(RELIABILITY_LOG)) {
-      fs.unlinkSync(RELIABILITY_LOG);
-    }
-  });
-
-  afterEach(() => {
-    if (fs.existsSync(RELIABILITY_LOG)) {
-      fs.unlinkSync(RELIABILITY_LOG);
-    }
-  });
-
-  it('should retry 3 times on 500 INTERNAL error and then SKIP', async () => {
-    const mockRig = new TestRig() as any;
-    (TestRig as any).mockReturnValue(mockRig);
-
-    // Simulate permanent 500 error
-    mockRig.run.mockRejectedValue(new Error('status: INTERNAL - API Down'));
-
-    // Execute the test function directly
-    await internalEvalTest({
-      name: 'test-api-failure',
-      prompt: 'do something',
-      assert: async () => {},
-    });
-
-    // Verify retries: 1 initial + 3 retries = 4 setups/runs
-    expect(mockRig.run).toHaveBeenCalledTimes(4);
-
-    // Verify log content
-    const logContent = fs
-      .readFileSync(RELIABILITY_LOG, 'utf-8')
-      .trim()
-      .split('\n');
-    expect(logContent.length).toBe(4);
-
-    const entries = logContent.map((line) => JSON.parse(line));
-    expect(entries[0].status).toBe('RETRY');
-    expect(entries[0].attempt).toBe(0);
-    expect(entries[3].status).toBe('SKIP');
-    expect(entries[3].attempt).toBe(3);
-    expect(entries[3].testName).toBe('test-api-failure');
-  });
-
-  it('should fail immediately on non-500 errors (like assertion failures)', async () => {
-    const mockRig = new TestRig() as any;
-    (TestRig as any).mockReturnValue(mockRig);
-
-    // Simulate a real logic error/bug
-    mockRig.run.mockResolvedValue('Success');
-    const assertError = new Error('Assertion failed: expected foo to be bar');
-
-    // Expect the test function to throw immediately
-    await expect(
-      internalEvalTest({
-        name: 'test-logic-failure',
-        prompt: 'do something',
-        assert: async () => {
-          throw assertError;
-        },
-      }),
-    ).rejects.toThrow('Assertion failed');
-
-    // Verify NO retries: only 1 attempt
-    expect(mockRig.run).toHaveBeenCalledTimes(1);
-
-    // Verify NO reliability log was created (it's not an API error)
-    expect(fs.existsSync(RELIABILITY_LOG)).toBe(false);
-  });
-
-  it('should recover if a retry succeeds', async () => {
-    const mockRig = new TestRig() as any;
-    (TestRig as any).mockReturnValue(mockRig);
-
-    // Fail once, then succeed
-    mockRig.run
-      .mockRejectedValueOnce(new Error('status: INTERNAL'))
-      .mockResolvedValueOnce('Success');
-
-    await internalEvalTest({
-      name: 'test-recovery',
-      prompt: 'do something',
-      assert: async () => {},
-    });
-
-    // Ran twice: initial (fail) + retry 1 (success)
-    expect(mockRig.run).toHaveBeenCalledTimes(2);
-
-    // Log should only have the one RETRY entry
-    const logContent = fs
-      .readFileSync(RELIABILITY_LOG, 'utf-8')
-      .trim()
-      .split('\n');
-    expect(logContent.length).toBe(1);
-    expect(JSON.parse(logContent[0]).status).toBe('RETRY');
-  });
-
-  it('should retry 3 times on 503 UNAVAILABLE error and then SKIP', async () => {
-    const mockRig = new TestRig() as any;
-    (TestRig as any).mockReturnValue(mockRig);
-
-    // Simulate permanent 503 error
-    mockRig.run.mockRejectedValue(
-      new Error('status: UNAVAILABLE - Service Busy'),
-    );
-
-    await internalEvalTest({
-      name: 'test-api-503',
-      prompt: 'do something',
-      assert: async () => {},
-    });
-
-    expect(mockRig.run).toHaveBeenCalledTimes(4);
-
-    const logContent = fs
-      .readFileSync(RELIABILITY_LOG, 'utf-8')
-      .trim()
-      .split('\n');
-    const entries = logContent.map((line) => JSON.parse(line));
-    expect(entries[0].errorCode).toBe('503');
-    expect(entries[3].status).toBe('SKIP');
-  });
-
-  it('should throw if an absolute path is used in files', async () => {
-    const mockRig = new TestRig() as any;
-    (TestRig as any).mockReturnValue(mockRig);
-    mockRig.testDir = path.resolve(process.cwd(), 'test-dir-tmp');
-    if (!fs.existsSync(mockRig.testDir)) {
-      fs.mkdirSync(mockRig.testDir, { recursive: true });
-    }
-
-    try {
-      await expect(
-        internalEvalTest({
-          name: 'test-absolute-path',
-          prompt: 'do something',
-          files: {
-            '/etc/passwd': 'hacked',
-          },
-          assert: async () => {},
-        }),
-      ).rejects.toThrow('Invalid file path in test case: /etc/passwd');
-    } finally {
-      if (fs.existsSync(mockRig.testDir)) {
-        fs.rmSync(mockRig.testDir, { recursive: true, force: true });
-      }
-    }
-  });
-
-  it('should throw if directory traversal is detected in files', async () => {
-    const mockRig = new TestRig() as any;
-    (TestRig as any).mockReturnValue(mockRig);
-    mockRig.testDir = path.resolve(process.cwd(), 'test-dir-tmp');
-
-    // Create a mock test-dir
-    if (!fs.existsSync(mockRig.testDir)) {
-      fs.mkdirSync(mockRig.testDir, { recursive: true });
-    }
-
-    try {
-      await expect(
-        internalEvalTest({
-          name: 'test-traversal',
-          prompt: 'do something',
-          files: {
-            '../sensitive.txt': 'hacked',
-          },
-          assert: async () => {},
-        }),
-      ).rejects.toThrow('Invalid file path in test case: ../sensitive.txt');
-    } finally {
-      if (fs.existsSync(mockRig.testDir)) {
-        fs.rmSync(mockRig.testDir, { recursive: true, force: true });
-      }
-    }
-  });
-});

evals/test-helper.ts

@@ -39,43 +39,87 @@ export * from '@google/gemini-cli-test-utils';
 export type EvalPolicy = 'ALWAYS_PASSES' | 'USUALLY_PASSES';
 
 export function evalTest(policy: EvalPolicy, evalCase: EvalCase) {
-  runEval(
-    policy,
-    evalCase.name,
-    () => internalEvalTest(evalCase),
-    evalCase.timeout,
-  );
-}
-
-export async function internalEvalTest(evalCase: EvalCase) {
-  const maxRetries = 3;
-  let attempt = 0;
-
-  while (attempt <= maxRetries) {
+  const fn = async () => {
     const rig = new TestRig();
     const { logDir, sanitizedName } = await prepareLogDir(evalCase.name);
     const activityLogFile = path.join(logDir, `${sanitizedName}.jsonl`);
     const logFile = path.join(logDir, `${sanitizedName}.log`);
     let isSuccess = false;
-
     try {
       rig.setup(evalCase.name, evalCase.params);
 
-      if (evalCase.files) {
-        await setupTestFiles(rig, evalCase.files);
-      }
-
-      // --- CHAOS SIMULATION ---
-      if (evalCase.name.includes('Chaos')) {
-        const errorCode = evalCase.name.includes('503') ? '503' : '500';
-        throw new Error(
-          `status: INTERNAL - Simulated ${errorCode} error for testing pipeline`,
-        );
-      }
-      // ------------------------
-
+      // Symlink node modules to reduce the amount of time needed to
+      // bootstrap test projects.
       symlinkNodeModules(rig.testDir || '');
 
+      if (evalCase.files) {
+        const acknowledgedAgents: Record<string, Record<string, string>> = {};
+        const projectRoot = fs.realpathSync(rig.testDir!);
+
+        for (const [filePath, content] of Object.entries(evalCase.files)) {
+          const fullPath = path.join(rig.testDir!, filePath);
+          fs.mkdirSync(path.dirname(fullPath), { recursive: true });
+          fs.writeFileSync(fullPath, content);
+
+          // If it's an agent file, calculate hash for acknowledgement
+          if (
+            filePath.startsWith('.gemini/agents/') &&
+            filePath.endsWith('.md')
+          ) {
+            const hash = crypto
+              .createHash('sha256')
+              .update(content)
+              .digest('hex');
+
+            try {
+              const agentDefs = await parseAgentMarkdown(fullPath, content);
+              if (agentDefs.length > 0) {
+                const agentName = agentDefs[0].name;
+                if (!acknowledgedAgents[projectRoot]) {
+                  acknowledgedAgents[projectRoot] = {};
+                }
+                acknowledgedAgents[projectRoot][agentName] = hash;
+              }
+            } catch (error) {
+              console.warn(
+                `Failed to parse agent for test acknowledgement: ${filePath}`,
+                error,
+              );
+            }
+          }
+        }
+
+        // Write acknowledged_agents.json to the home directory
+        if (Object.keys(acknowledgedAgents).length > 0) {
+          const ackPath = path.join(
+            rig.homeDir!,
+            '.gemini',
+            'acknowledgments',
+            'agents.json',
+          );
+          fs.mkdirSync(path.dirname(ackPath), { recursive: true });
+          fs.writeFileSync(
+            ackPath,
+            JSON.stringify(acknowledgedAgents, null, 2),
+          );
+        }
+
+        const execOptions = { cwd: rig.testDir!, stdio: 'inherit' as const };
+        execSync('git init', execOptions);
+        execSync('git config user.email "test@example.com"', execOptions);
+        execSync('git config user.name "Test User"', execOptions);
+
+        // Temporarily disable the interactive editor and git pager
+        // to avoid hanging the tests. It seems the the agent isn't
+        // consistently honoring the instructions to avoid interactive
+        // commands.
+        execSync('git config core.editor "true"', execOptions);
+        execSync('git config core.pager "cat"', execOptions);
+        execSync('git config commit.gpgsign false', execOptions);
+        execSync('git add .', execOptions);
+        execSync('git commit --allow-empty -m "Initial commit"', execOptions);
+      }
+
       // If messages are provided, write a session file so --resume can load it.
       let sessionId: string | undefined;
       if (evalCase.messages) {
@@ -144,38 +188,6 @@ export async function internalEvalTest(evalCase: EvalCase) {
 
       await evalCase.assert(rig, result);
       isSuccess = true;
-      return; // Success! Exit the retry loop.
-    } catch (error: unknown) {
-      const errorMessage =
-        error instanceof Error ? error.message : String(error);
-      const errorCode = getApiErrorCode(errorMessage);
-
-      if (errorCode) {
-        const status = attempt < maxRetries ? 'RETRY' : 'SKIP';
-        logReliabilityEvent(
-          evalCase.name,
-          attempt,
-          status,
-          errorCode,
-          errorMessage,
-        );
-
-        if (attempt < maxRetries) {
-          attempt++;
-          console.warn(
-            `[Eval] Attempt ${attempt} failed with ${errorCode} Error. Retrying...`,
-          );
-          await rig.cleanup();
-          continue; // Retry
-        }
-
-        console.warn(
-          `[Eval] '${evalCase.name}' failed after ${maxRetries} retries due to persistent API errors. Skipping failure to avoid blocking PR.`,
-        );
-        return; // Gracefully exit without failing the test
-      }
-
-      throw error; // Real failure
     } finally {
       if (isSuccess) {
         await fs.promises.unlink(activityLogFile).catch((err) => {
@@ -194,132 +206,9 @@ export async function internalEvalTest(evalCase: EvalCase) {
       );
       await rig.cleanup();
     }
-  }
-}
-
-function getApiErrorCode(message: string): '500' | '503' | undefined {
-  if (
-    message.includes('status: UNAVAILABLE') ||
-    message.includes('code: 503') ||
-    message.includes('Service Unavailable') ||
-    message.includes('Simulated 503 error')
-  ) {
-    return '503';
-  }
-  if (
-    message.includes('status: INTERNAL') ||
-    message.includes('code: 500') ||
-    message.includes('Internal error encountered')
-  ) {
-    return '500';
-  }
-  return undefined;
-}
-
-/**
- * Log reliability event for later harvesting.
- *
- * Note: Uses synchronous file I/O to ensure the log is persisted even if the
- * test process is abruptly terminated by a timeout or CI crash. Performance
- * impact is negligible compared to long-running evaluation tests.
- */
-function logReliabilityEvent(
-  testName: string,
-  attempt: number,
-  status: 'RETRY' | 'SKIP',
-  errorCode: '500' | '503',
-  errorMessage: string,
-) {
-  const reliabilityLog = {
-    timestamp: new Date().toISOString(),
-    testName,
-    model: process.env.GEMINI_MODEL || 'unknown',
-    attempt,
-    status,
-    errorCode,
-    error: errorMessage,
   };
 
-  try {
-    const relDir = path.resolve(process.cwd(), 'evals/logs');
-    fs.mkdirSync(relDir, { recursive: true });
-    fs.appendFileSync(
-      path.join(relDir, 'api-reliability.jsonl'),
-      JSON.stringify(reliabilityLog) + '\n',
-    );
-  } catch (logError) {
-    console.error('Failed to write reliability log:', logError);
-  }
-}
-
-/**
- * Helper to setup test files and git repository.
- *
- * Note: While this is an async function (due to parseAgentMarkdown), it
- * intentionally uses synchronous filesystem and child_process operations
- * for simplicity and to ensure sequential environment preparation.
- */
-async function setupTestFiles(rig: TestRig, files: Record<string, string>) {
-  const acknowledgedAgents: Record<string, Record<string, string>> = {};
-  const projectRoot = fs.realpathSync(rig.testDir!);
-
-  for (const [filePath, content] of Object.entries(files)) {
-    if (filePath.includes('..') || path.isAbsolute(filePath)) {
-      throw new Error(`Invalid file path in test case: ${filePath}`);
-    }
-    const fullPath = path.join(projectRoot, filePath);
-    if (!fullPath.startsWith(projectRoot)) {
-      throw new Error(`Path traversal detected: ${filePath}`);
-    }
-
-    fs.mkdirSync(path.dirname(fullPath), { recursive: true });
-    fs.writeFileSync(fullPath, content);
-
-    if (filePath.startsWith('.gemini/agents/') && filePath.endsWith('.md')) {
-      const hash = crypto.createHash('sha256').update(content).digest('hex');
-      try {
-        const agentDefs = await parseAgentMarkdown(fullPath, content);
-        if (agentDefs.length > 0) {
-          const agentName = agentDefs[0].name;
-          if (!acknowledgedAgents[projectRoot]) {
-            acknowledgedAgents[projectRoot] = {};
-          }
-          acknowledgedAgents[projectRoot][agentName] = hash;
-        }
-      } catch (error) {
-        console.warn(
-          `Failed to parse agent for test acknowledgement: ${filePath}`,
-          error,
-        );
-      }
-    }
-  }
-
-  if (Object.keys(acknowledgedAgents).length > 0) {
-    const ackPath = path.join(
-      rig.homeDir!,
-      '.gemini',
-      'acknowledgments',
-      'agents.json',
-    );
-    fs.mkdirSync(path.dirname(ackPath), { recursive: true });
-    fs.writeFileSync(ackPath, JSON.stringify(acknowledgedAgents, null, 2));
-  }
-
-  const execOptions = { cwd: rig.testDir!, stdio: 'inherit' as const };
-  execSync('git init --initial-branch=main', execOptions);
-  execSync('git config user.email "test@example.com"', execOptions);
-  execSync('git config user.name "Test User"', execOptions);
-
-  // Temporarily disable the interactive editor and git pager
-  // to avoid hanging the tests. It seems the the agent isn't
-  // consistently honoring the instructions to avoid interactive
-  // commands.
-  execSync('git config core.editor "true"', execOptions);
-  execSync('git config core.pager "cat"', execOptions);
-  execSync('git config commit.gpgsign false', execOptions);
-  execSync('git add .', execOptions);
-  execSync('git commit --allow-empty -m "Initial commit"', execOptions);
+  runEval(policy, evalCase.name, fn, evalCase.timeout);
 }
 
 /**

integration-tests/browser-policy.test.ts

@@ -63,9 +63,6 @@ describe.skipIf(!chromeAvailable)('browser-policy', () => {
     rig.setup('browser-policy-skip-confirmation', {
       fakeResponsesPath: join(__dirname, 'browser-policy.responses'),
       settings: {
-        experimental: {
-          enableAgents: true,
-        },
         agents: {
           overrides: {
             browser_agent: {
@@ -183,9 +180,6 @@ priority = 200
     rig.setup('browser-session-warning', {
       fakeResponsesPath: join(__dirname, 'browser-agent.cleanup.responses'),
       settings: {
-        experimental: {
-          enableAgents: true,
-        },
         general: {
           enableAutoUpdateNotification: false,
         },

integration-tests/policy-headless.test.ts

@@ -183,11 +183,17 @@ describe('Policy Engine Headless Mode', () => {
       responsesFile: 'policy-headless-shell-denied.responses',
       promptCommand: ECHO_PROMPT,
       policyContent: `
+        [[rule]]
+        toolName = "run_shell_command"
+        commandPrefix = "echo"
+        decision = "deny"
+        priority = 100
+
         [[rule]]
         toolName = "run_shell_command"
         commandPrefix = "node"
         decision = "allow"
-        priority = 100
+        priority = 90
       `,
       expectAllowed: false,
       expectedDenialString: 'Tool execution denied by policy',

integration-tests/run_shell_command.test.ts

@@ -58,12 +58,18 @@ function getDisallowedFileReadCommand(testFile: string): {
   const quotedPath = `"${testFile}"`;
   switch (shell) {
     case 'powershell':
-      return { command: `Get-Content ${quotedPath}`, tool: 'Get-Content' };
+      return {
+        command: `powershell -Command "Get-Content ${quotedPath}"`,
+        tool: 'powershell',
+      };
     case 'cmd':
-      return { command: `type ${quotedPath}`, tool: 'type' };
+      return { command: `cmd /c type ${quotedPath}`, tool: 'cmd' };
     case 'bash':
     default:
-      return { command: `cat ${quotedPath}`, tool: 'cat' };
+      return {
+        command: `node -e "console.log(require('fs').readFileSync('${testFile}', 'utf8'))"`,
+        tool: 'node',
+      };
   }
 }
 

integration-tests/teleport.test.ts

@@ -0,0 +1,169 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import {
+  TeleportService,
+  Config,
+  ChatRecordingService,
+} from '@google/gemini-cli-core';
+
+describe('Teleport E2E Integration', () => {
+  let tmpDir: string;
+  let machineA_Home: string;
+  let machineB_Home: string;
+  let projectDir: string;
+
+  beforeEach(async () => {
+    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'gemini-teleport-e2e-'));
+    machineA_Home = path.join(tmpDir, 'machineA');
+    machineB_Home = path.join(tmpDir, 'machineB');
+    projectDir = path.join(tmpDir, 'my-project');
+
+    await fs.mkdir(machineA_Home, { recursive: true });
+    await fs.mkdir(machineB_Home, { recursive: true });
+    await fs.mkdir(projectDir, { recursive: true });
+  });
+
+  afterEach(async () => {
+    await fs.rm(tmpDir, { recursive: true, force: true });
+  });
+
+  it('should round-trip a session between two simulated machines', async () => {
+    // --- STEP 1: Setup Machine A and create a session ---
+    const configA = new Config({
+      sessionId: 'session-123',
+      targetDir: projectDir,
+      cwd: projectDir,
+      model: 'test-model',
+    });
+    const machineA_TempDir = path.join(machineA_Home, 'tmp');
+    await fs.mkdir(machineA_TempDir, { recursive: true });
+    vi.spyOn(configA.storage, 'getProjectTempDir').mockReturnValue(
+      machineA_TempDir,
+    );
+
+    const recordingServiceA = new ChatRecordingService(configA);
+    recordingServiceA.initialize();
+
+    recordingServiceA.recordMessage({
+      model: 'test-model',
+      type: 'user',
+      content: [{ text: 'Hello from Machine A' }],
+    });
+
+    const realSessionId = configA.getSessionId();
+    const chatFilePathA = recordingServiceA.getConversationFilePath();
+    expect(chatFilePathA).not.toBeNull();
+
+    // --- STEP 2: Export from Machine A ---
+    const teleportServiceA = new TeleportService(configA);
+    const tarballPath = path.join(tmpDir, 'teleport.tar.gz');
+    await teleportServiceA.exportSession(realSessionId, tarballPath);
+
+    // --- STEP 3: Setup Machine B and Import ---
+    const configB = new Config({
+      sessionId: 'new-session',
+      targetDir: projectDir,
+      cwd: projectDir,
+      model: 'test-model',
+    });
+    const machineB_TempDir = path.join(machineB_Home, 'tmp');
+    await fs.mkdir(machineB_TempDir, { recursive: true });
+    vi.spyOn(configB.storage, 'getProjectTempDir').mockReturnValue(
+      machineB_TempDir,
+    );
+
+    const teleportServiceB = new TeleportService(configB);
+    const importResult = await teleportServiceB.importSession(tarballPath);
+
+    expect(importResult.sessionId).toBe(realSessionId);
+
+    // --- STEP 4: Verify Machine B can "see" the session ---
+    const chatFiles = await configB.storage.listProjectChatFiles();
+    expect(chatFiles.length).toBe(1);
+
+    // storage.listProjectChatFiles returns relative paths
+    const importedFile = path.join(machineB_TempDir, chatFiles[0].filePath);
+    const conversationData = JSON.parse(
+      await fs.readFile(importedFile, 'utf8'),
+    );
+
+    const recordingServiceB = new ChatRecordingService(configB);
+    recordingServiceB.initialize({
+      filePath: importedFile,
+      conversation: conversationData,
+    });
+
+    const conversation = recordingServiceB.getConversation();
+    expect(conversation).not.toBeNull();
+    expect(conversation?.messages[0].content[0].text).toBe(
+      'Hello from Machine A',
+    );
+  });
+
+  it('should handle encrypted sessions in E2E', async () => {
+    const secret = 'password123';
+    const configA = new Config({
+      sessionId: 'enc-session',
+      targetDir: projectDir,
+      cwd: projectDir,
+      model: 'm',
+    });
+    const machineA_TempDir = path.join(machineA_Home, 'tmp');
+    await fs.mkdir(machineA_TempDir, { recursive: true });
+    vi.spyOn(configA.storage, 'getProjectTempDir').mockReturnValue(
+      machineA_TempDir,
+    );
+
+    const recordingServiceA = new ChatRecordingService(configA);
+    recordingServiceA.initialize();
+    recordingServiceA.recordMessage({
+      model: 'm',
+      type: 'user',
+      content: [{ text: 'Encrypted message' }],
+    });
+
+    const realSessionId = configA.getSessionId();
+    const teleportServiceA = new TeleportService(configA);
+    const tarballPath = path.join(tmpDir, 'encrypted.tar.gz');
+    await teleportServiceA.exportSession(realSessionId, tarballPath, secret);
+
+    // Machine B
+    const configB = new Config({
+      sessionId: 'b',
+      targetDir: projectDir,
+      cwd: projectDir,
+      model: 'm',
+    });
+    const machineB_TempDir = path.join(machineB_Home, 'tmp');
+    await fs.mkdir(machineB_TempDir, { recursive: true });
+    vi.spyOn(configB.storage, 'getProjectTempDir').mockReturnValue(
+      machineB_TempDir,
+    );
+
+    const teleportServiceB = new TeleportService(configB);
+    await teleportServiceB.importSession(tarballPath, secret);
+
+    const chatFiles = await configB.storage.listProjectChatFiles();
+    const importedFile = path.join(machineB_TempDir, chatFiles[0].filePath);
+    const conversationData = JSON.parse(
+      await fs.readFile(importedFile, 'utf8'),
+    );
+
+    const recordingServiceB = new ChatRecordingService(configB);
+    recordingServiceB.initialize({
+      filePath: importedFile,
+      conversation: conversationData,
+    });
+
+    const conversation = recordingServiceB.getConversation();
+    expect(conversation?.messages[0].content[0].text).toBe('Encrypted message');
+  });
+});

package-lock.json

@@ -8696,9 +8696,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/fast-xml-builder": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.2.tgz",
-      "integrity": "sha512-NJAmiuVaJEjVa7TjLZKlYd7RqmzOC91EtPFXHvlTcqBVo50Qh7XV5IwvXi1c7NRz2Q/majGX9YLcwJtWgHjtkA==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.4.tgz",
+      "integrity": "sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==",
       "funding": [
         {
           "type": "github",
@@ -8711,9 +8711,9 @@
       }
     },
     "node_modules/fast-xml-parser": {
-      "version": "5.5.3",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.3.tgz",
-      "integrity": "sha512-Ymnuefk6VzAhT3SxLzVUw+nMio/wB1NGypHkgetwtXcK1JfryaHk4DWQFGVwQ9XgzyS5iRZ7C2ZGI4AMsdMZ6A==",
+      "version": "5.5.9",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.9.tgz",
+      "integrity": "sha512-jldvxr1MC6rtiZKgrFnDSvT8xuH+eJqxqOBThUVjYrxssYTo1avZLGql5l0a0BAERR01CadYzZ83kVEkbyDg+g==",
       "funding": [
         {
           "type": "github",
@@ -8722,9 +8722,9 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "fast-xml-builder": "^1.1.2",
-        "path-expression-matcher": "^1.1.3",
-        "strnum": "^2.1.2"
+        "fast-xml-builder": "^1.1.4",
+        "path-expression-matcher": "^1.2.0",
+        "strnum": "^2.2.2"
       },
       "bin": {
         "fxparser": "src/cli/cli.js"
@@ -8900,9 +8900,9 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz",
-      "integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
       "dev": true,
       "license": "ISC"
     },
@@ -13200,9 +13200,9 @@
       }
     },
     "node_modules/path-expression-matcher": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.1.3.tgz",
-      "integrity": "sha512-qdVgY8KXmVdJZRSS1JdEPOKPdTiEK/pi0RkcT2sw1RhXxohdujUlJFPuS1TSkevZ9vzd3ZlL7ULl1MHGTApKzQ==",
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.2.0.tgz",
+      "integrity": "sha512-DwmPWeFn+tq7TiyJ2CxezCAirXjFxvaiD03npak3cRjlP9+OjTmSy1EpIrEbh+l6JgUundniloMLDQ/6VTdhLQ==",
       "funding": [
         {
           "type": "github",
@@ -15465,9 +15465,9 @@
       }
     },
     "node_modules/strnum": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.0.tgz",
-      "integrity": "sha512-Y7Bj8XyJxnPAORMZj/xltsfo55uOiyHcU2tnAVzHUnSJR/KsEX+9RoDeXEnsXtl/CX4fAcrt64gZ13aGaWPeBg==",
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.2.tgz",
+      "integrity": "sha512-DnR90I+jtXNSTXWdwrEy9FakW7UX+qUZg28gj5fk2vxxl7uS/3bpI4fjFYVmdK9etptYBPNkpahuQnEwhwECqA==",
       "funding": [
         {
           "type": "github",
@@ -16469,9 +16469,9 @@
       "license": "MIT"
     },
     "node_modules/undici": {
-      "version": "7.19.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.19.0.tgz",
-      "integrity": "sha512-Heho1hJD81YChi+uS2RkSjcVO+EQLmLSyUlHyp7Y/wFbxQaGb4WXVKD073JytrjXJVkSZVzoE2MCSOKugFGtOQ==",
+      "version": "7.24.5",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.5.tgz",
+      "integrity": "sha512-3IWdCpjgxp15CbJnsi/Y9TCDE7HWVN19j1hmzVhoAkY/+CJx449tVxT5wZc1Gwg8J+P0LWvzlBzxYRnHJ+1i7Q==",
       "license": "MIT",
       "engines": {
         "node": ">=20.18.1"

packages/a2a-server/src/config/config.test.ts

@@ -29,6 +29,7 @@ vi.mock('@google/gemini-cli-core', async (importOriginal) => {
     await importOriginal<typeof import('@google/gemini-cli-core')>();
   return {
     ...actual,
+    PRIORITY_YOLO_ALLOW_ALL: 998,
     Config: vi.fn().mockImplementation((params) => {
       const mockConfig = {
         ...params,
@@ -341,11 +342,11 @@ describe('loadConfig', () => {
       );
     });
 
-    it('should default enableAgents to false when not provided', async () => {
+    it('should default enableAgents to true when not provided', async () => {
       await loadConfig(mockSettings, mockExtensionLoader, taskId);
       expect(Config).toHaveBeenCalledWith(
         expect.objectContaining({
-          enableAgents: false,
+          enableAgents: true,
         }),
       );
     });

packages/a2a-server/src/config/config.ts

@@ -128,7 +128,7 @@ export async function loadConfig(
     interactive: !isHeadlessMode(),
     enableInteractiveShell: !isHeadlessMode(),
     ptyInfo: 'auto',
-    enableAgents: settings.experimental?.enableAgents ?? false,
+    enableAgents: settings.experimental?.enableAgents ?? true,
   };
 
   const fileService = new FileDiscoveryService(workspaceDir, {

packages/cli/index.ts

@@ -6,12 +6,19 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { main } from './src/gemini.js';
-import { FatalError, writeToStderr } from '@google/gemini-cli-core';
-import { runExitCleanup } from './src/utils/cleanup.js';
+// --- Fast Path for Version ---
+// We check for version flags at the very top to avoid loading any heavy dependencies.
+// process.env.CLI_VERSION is defined during the build process by esbuild.
+if (process.argv.includes('--version') || process.argv.includes('-v')) {
+  console.log(process.env['CLI_VERSION'] || 'unknown');
+  process.exit(0);
+}
 
 // --- Global Entry Point ---
 
+let writeToStderrFn: (message: string) => void = (msg) =>
+  process.stderr.write(msg);
+
 // Suppress known race condition error in node-pty on Windows
 // Tracking bug: https://github.com/microsoft/node-pty/issues/827
 process.on('uncaughtException', (error) => {
@@ -28,13 +35,22 @@ process.on('uncaughtException', (error) => {
   // For other errors, we rely on the default behavior, but since we attached a listener,
   // we must manually replicate it.
   if (error instanceof Error) {
-    writeToStderr(error.stack + '\n');
+    writeToStderrFn(error.stack + '\n');
   } else {
-    writeToStderr(String(error) + '\n');
+    writeToStderrFn(String(error) + '\n');
   }
   process.exit(1);
 });
 
+const [{ main }, { FatalError, writeToStderr }, { runExitCleanup }] =
+  await Promise.all([
+    import('./src/gemini.js'),
+    import('@google/gemini-cli-core'),
+    import('./src/utils/cleanup.js'),
+  ]);
+
+writeToStderrFn = writeToStderr;
+
 main().catch(async (error) => {
   // Set a timeout to force exit if cleanup hangs
   const cleanupTimeout = setTimeout(() => {

packages/cli/src/acp/acpClient.ts

@@ -300,6 +300,7 @@ export class GeminiAgent {
         sessionId,
         this.clientCapabilities.fs,
         config.getFileSystemService(),
+        cwd,
       );
       config.setFileSystemService(acpFileSystemService);
     }
@@ -357,16 +358,6 @@ export class GeminiAgent {
     const { sessionData, sessionPath } =
       await sessionSelector.resolveSession(sessionId);
 
-    if (this.clientCapabilities?.fs) {
-      const acpFileSystemService = new AcpFileSystemService(
-        this.connection,
-        sessionId,
-        this.clientCapabilities.fs,
-        config.getFileSystemService(),
-      );
-      config.setFileSystemService(acpFileSystemService);
-    }
-
     const clientHistory = convertSessionToClientHistory(sessionData.messages);
 
     const geminiClient = config.getGeminiClient();
@@ -440,7 +431,19 @@ export class GeminiAgent {
       throw acp.RequestError.authRequired();
     }
 
-    // 3. Now that we are authenticated, it is safe to initialize the config
+    // 3. Set the ACP FileSystemService (if supported) before config initialization
+    if (this.clientCapabilities?.fs) {
+      const acpFileSystemService = new AcpFileSystemService(
+        this.connection,
+        sessionId,
+        this.clientCapabilities.fs,
+        config.getFileSystemService(),
+        cwd,
+      );
+      config.setFileSystemService(acpFileSystemService);
+    }
+
+    // 4. Now that we are authenticated, it is safe to initialize the config
     // which starts the MCP servers and other heavy resources.
     await config.initialize();
     startupProfiler.flush(config);
@@ -1625,6 +1628,7 @@ function toPermissionOptions(
     case 'info':
     case 'ask_user':
     case 'exit_plan_mode':
+    case 'sandbox_expansion':
       break;
     default: {
       const unreachable: never = confirmation;

packages/cli/src/acp/fileSystemService.test.ts

@@ -4,10 +4,25 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { describe, it, expect, vi, beforeEach, type Mocked } from 'vitest';
+import {
+  describe,
+  it,
+  expect,
+  vi,
+  beforeEach,
+  afterEach,
+  type Mocked,
+} from 'vitest';
 import { AcpFileSystemService } from './fileSystemService.js';
 import type { AgentSideConnection } from '@agentclientprotocol/sdk';
 import type { FileSystemService } from '@google/gemini-cli-core';
+import os from 'node:os';
+
+vi.mock('node:os', () => ({
+  default: {
+    homedir: vi.fn(),
+  },
+}));
 
 describe('AcpFileSystemService', () => {
   let mockConnection: Mocked<AgentSideConnection>;
@@ -25,13 +40,19 @@ describe('AcpFileSystemService', () => {
       readTextFile: vi.fn(),
       writeTextFile: vi.fn(),
     };
+    vi.mocked(os.homedir).mockReturnValue('/home/user');
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
   });
 
   describe('readTextFile', () => {
     it.each([
       {
         capability: true,
-        desc: 'connection if capability exists',
+        path: '/path/to/file',
+        desc: 'connection if capability exists and file is inside root',
         setup: () => {
           mockConnection.readTextFile.mockResolvedValue({ content: 'content' });
         },
@@ -45,6 +66,7 @@ describe('AcpFileSystemService', () => {
       },
       {
         capability: false,
+        path: '/path/to/file',
         desc: 'fallback if capability missing',
         setup: () => {
           mockFallback.readTextFile.mockResolvedValue('content');
@@ -56,19 +78,72 @@ describe('AcpFileSystemService', () => {
           expect(mockConnection.readTextFile).not.toHaveBeenCalled();
         },
       },
-    ])('should use $desc', async ({ capability, setup, verify }) => {
+      {
+        capability: true,
+        path: '/outside/file',
+        desc: 'fallback if capability exists but file is outside root',
+        setup: () => {
+          mockFallback.readTextFile.mockResolvedValue('content');
+        },
+        verify: () => {
+          expect(mockFallback.readTextFile).toHaveBeenCalledWith(
+            '/outside/file',
+          );
+          expect(mockConnection.readTextFile).not.toHaveBeenCalled();
+        },
+      },
+      {
+        capability: true,
+        path: '/home/user/.gemini/tmp/file.md',
+        root: '/home/user',
+        desc: 'fallback if file is inside global gemini dir, even if root overlaps',
+        setup: () => {
+          mockFallback.readTextFile.mockResolvedValue('content');
+        },
+        verify: () => {
+          expect(mockFallback.readTextFile).toHaveBeenCalledWith(
+            '/home/user/.gemini/tmp/file.md',
+          );
+          expect(mockConnection.readTextFile).not.toHaveBeenCalled();
+        },
+      },
+    ])(
+      'should use $desc',
+      async ({ capability, path, root, setup, verify }) => {
+        service = new AcpFileSystemService(
+          mockConnection,
+          'session-1',
+          { readTextFile: capability, writeTextFile: true },
+          mockFallback,
+          root || '/path/to',
+        );
+        setup();
+
+        const result = await service.readTextFile(path);
+
+        expect(result).toBe('content');
+        verify();
+      },
+    );
+
+    it('should throw normalized ENOENT error when readTextFile encounters "Resource not found"', async () => {
       service = new AcpFileSystemService(
         mockConnection,
         'session-1',
-        { readTextFile: capability, writeTextFile: true },
+        { readTextFile: true, writeTextFile: true },
         mockFallback,
+        '/path/to',
+      );
+      mockConnection.readTextFile.mockRejectedValue(
+        new Error('Resource not found for document'),
       );
-      setup();
 
-      const result = await service.readTextFile('/path/to/file');
-
-      expect(result).toBe('content');
-      verify();
+      await expect(
+        service.readTextFile('/path/to/missing'),
+      ).rejects.toMatchObject({
+        code: 'ENOENT',
+        message: 'Resource not found for document',
+      });
     });
   });
 
@@ -76,7 +151,8 @@ describe('AcpFileSystemService', () => {
     it.each([
       {
         capability: true,
-        desc: 'connection if capability exists',
+        path: '/path/to/file',
+        desc: 'connection if capability exists and file is inside root',
         verify: () => {
           expect(mockConnection.writeTextFile).toHaveBeenCalledWith({
             path: '/path/to/file',
@@ -88,6 +164,7 @@ describe('AcpFileSystemService', () => {
       },
       {
         capability: false,
+        path: '/path/to/file',
         desc: 'fallback if capability missing',
         verify: () => {
           expect(mockFallback.writeTextFile).toHaveBeenCalledWith(
@@ -97,17 +174,63 @@ describe('AcpFileSystemService', () => {
           expect(mockConnection.writeTextFile).not.toHaveBeenCalled();
         },
       },
-    ])('should use $desc', async ({ capability, verify }) => {
+      {
+        capability: true,
+        path: '/outside/file',
+        desc: 'fallback if capability exists but file is outside root',
+        verify: () => {
+          expect(mockFallback.writeTextFile).toHaveBeenCalledWith(
+            '/outside/file',
+            'content',
+          );
+          expect(mockConnection.writeTextFile).not.toHaveBeenCalled();
+        },
+      },
+      {
+        capability: true,
+        path: '/home/user/.gemini/tmp/file.md',
+        root: '/home/user',
+        desc: 'fallback if file is inside global gemini dir, even if root overlaps',
+        verify: () => {
+          expect(mockFallback.writeTextFile).toHaveBeenCalledWith(
+            '/home/user/.gemini/tmp/file.md',
+            'content',
+          );
+          expect(mockConnection.writeTextFile).not.toHaveBeenCalled();
+        },
+      },
+    ])('should use $desc', async ({ capability, path, root, verify }) => {
       service = new AcpFileSystemService(
         mockConnection,
         'session-1',
         { writeTextFile: capability, readTextFile: true },
         mockFallback,
+        root || '/path/to',
       );
 
-      await service.writeTextFile('/path/to/file', 'content');
+      await service.writeTextFile(path, 'content');
 
       verify();
     });
+
+    it('should throw normalized ENOENT error when writeTextFile encounters "Resource not found"', async () => {
+      service = new AcpFileSystemService(
+        mockConnection,
+        'session-1',
+        { readTextFile: true, writeTextFile: true },
+        mockFallback,
+        '/path/to',
+      );
+      mockConnection.writeTextFile.mockRejectedValue(
+        new Error('Resource not found for directory'),
+      );
+
+      await expect(
+        service.writeTextFile('/path/to/missing', 'content'),
+      ).rejects.toMatchObject({
+        code: 'ENOENT',
+        message: 'Resource not found for directory',
+      });
+    });
   });
 });

packages/cli/src/acp/fileSystemService.ts

@@ -4,44 +4,82 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import type { FileSystemService } from '@google/gemini-cli-core';
+import { isWithinRoot, type FileSystemService } from '@google/gemini-cli-core';
 import type * as acp from '@agentclientprotocol/sdk';
+import os from 'node:os';
+import path from 'node:path';
 
 /**
  * ACP client-based implementation of FileSystemService
  */
 export class AcpFileSystemService implements FileSystemService {
+  private readonly geminiDir = path.join(os.homedir(), '.gemini');
+
   constructor(
     private readonly connection: acp.AgentSideConnection,
     private readonly sessionId: string,
     private readonly capabilities: acp.FileSystemCapabilities,
     private readonly fallback: FileSystemService,
+    private readonly root: string,
   ) {}
 
+  private shouldUseFallback(filePath: string): boolean {
+    // Files inside the global CLI directory must always use the native file system,
+    // even if the user runs the CLI directly from their home directory (which
+    // would make the IDE's project root overlap with the global directory).
+    return (
+      !isWithinRoot(filePath, this.root) ||
+      isWithinRoot(filePath, this.geminiDir)
+    );
+  }
+
+  private normalizeFileSystemError(err: unknown): never {
+    const errorMessage = err instanceof Error ? err.message : String(err);
+    if (
+      errorMessage.includes('Resource not found') ||
+      errorMessage.includes('ENOENT') ||
+      errorMessage.includes('does not exist') ||
+      errorMessage.includes('No such file')
+    ) {
+      const newErr = new Error(errorMessage) as NodeJS.ErrnoException;
+      newErr.code = 'ENOENT';
+      throw newErr;
+    }
+    throw err;
+  }
+
   async readTextFile(filePath: string): Promise<string> {
-    if (!this.capabilities.readTextFile) {
+    if (!this.capabilities.readTextFile || this.shouldUseFallback(filePath)) {
       return this.fallback.readTextFile(filePath);
     }
 
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-    const response = await this.connection.readTextFile({
-      path: filePath,
-      sessionId: this.sessionId,
-    });
+    try {
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+      const response = await this.connection.readTextFile({
+        path: filePath,
+        sessionId: this.sessionId,
+      });
 
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-return
-    return response.content;
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-return
+      return response.content;
+    } catch (err: unknown) {
+      this.normalizeFileSystemError(err);
+    }
   }
 
   async writeTextFile(filePath: string, content: string): Promise<void> {
-    if (!this.capabilities.writeTextFile) {
+    if (!this.capabilities.writeTextFile || this.shouldUseFallback(filePath)) {
       return this.fallback.writeTextFile(filePath, content);
     }
 
-    await this.connection.writeTextFile({
-      path: filePath,
-      content,
-      sessionId: this.sessionId,
-    });
+    try {
+      await this.connection.writeTextFile({
+        path: filePath,
+        content,
+        sessionId: this.sessionId,
+      });
+    } catch (err: unknown) {
+      this.normalizeFileSystemError(err);
+    }
   }
 }

packages/cli/src/config/settingsSchema.test.ts

@@ -400,7 +400,7 @@ describe('SettingsSchema', () => {
       expect(setting).toBeDefined();
       expect(setting.type).toBe('boolean');
       expect(setting.category).toBe('Experimental');
-      expect(setting.default).toBe(false);
+      expect(setting.default).toBe(true);
       expect(setting.requiresRestart).toBe(true);
       expect(setting.showInDialog).toBe(false);
       expect(setting.description).toBe('Enable local and remote subagents.');

packages/cli/src/config/settingsSchema.ts

@@ -1208,6 +1208,16 @@ const SETTINGS_SCHEMA = {
               'Disable user input on browser window during automation.',
             showInDialog: false,
           },
+          maxActionsPerTask: {
+            type: 'number',
+            label: 'Max Actions Per Task',
+            category: 'Advanced',
+            requiresRestart: false,
+            default: 100,
+            description:
+              'The maximum number of tool calls allowed per browser task. Enforcement is hard: the agent will be terminated when the limit is reached.',
+            showInDialog: false,
+          },
           confirmSensitiveActions: {
             type: 'boolean',
             label: 'Confirm Sensitive Actions',
@@ -1932,7 +1942,7 @@ const SETTINGS_SCHEMA = {
         label: 'Enable Agents',
         category: 'Experimental',
         requiresRestart: true,
-        default: false,
+        default: true,
         description: 'Enable local and remote subagents.',
         showInDialog: false,
       },

packages/cli/src/services/BuiltinCommandLoader.ts

@@ -52,6 +52,7 @@ import { quitCommand } from '../ui/commands/quitCommand.js';
 import { restoreCommand } from '../ui/commands/restoreCommand.js';
 import { resumeCommand } from '../ui/commands/resumeCommand.js';
 import { statsCommand } from '../ui/commands/statsCommand.js';
+import { teleportCommand } from '../ui/commands/teleportCommand.js';
 import { themeCommand } from '../ui/commands/themeCommand.js';
 import { toolsCommand } from '../ui/commands/toolsCommand.js';
 import { skillsCommand } from '../ui/commands/skillsCommand.js';
@@ -112,6 +113,7 @@ export class BuiltinCommandLoader implements ICommandLoader {
           ];
     };
 
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
     const chatResumeSubCommands = addDebugToChatResumeSubCommands(
       chatCommand.subCommands,
     );
@@ -195,6 +197,7 @@ export class BuiltinCommandLoader implements ICommandLoader {
         subCommands: addDebugToChatResumeSubCommands(resumeCommand.subCommands),
       },
       statsCommand,
+      teleportCommand,
       themeCommand,
       toolsCommand,
       ...(this.config?.isSkillsSupportEnabled()

packages/cli/src/ui/AppContainer.tsx

@@ -700,7 +700,10 @@ export const AppContainer = (props: AppContainerProps) => {
 
   // Derive auth state variables for backward compatibility with UIStateContext
   const isAuthDialogOpen = authState === AuthState.Updating;
-  const isAuthenticating = authState === AuthState.Unauthenticated;
+  // TODO: Consider handling other auth types that should also skip the blocking screen
+  const isAuthenticating =
+    authState === AuthState.Unauthenticated &&
+    settings.merged.security.auth.selectedType !== AuthType.USE_GEMINI;
 
   // Session browser and resume functionality
   const isGeminiClientInitialized = config.getGeminiClient()?.isInitialized();
@@ -1300,7 +1303,8 @@ Logging in with Google... Restarting Gemini CLI to continue.
         return;
       }
 
-      if (isSlash || (isIdle && isMcpReady)) {
+      const isMcpOrConfigReady = isConfigInitialized && isMcpReady;
+      if ((isSlash && isConfigInitialized) || (isIdle && isMcpOrConfigReady)) {
         if (!isSlash) {
           const permissions = await checkPermissions(submittedValue, config);
           if (permissions.length > 0) {
@@ -1323,10 +1327,12 @@ Logging in with Google... Restarting Gemini CLI to continue.
         void submitQuery(submittedValue);
       } else {
         // Check messageQueue.length === 0 to only notify on the first queued item
-        if (isIdle && !isMcpReady && messageQueue.length === 0) {
+        if (isIdle && !isMcpOrConfigReady && messageQueue.length === 0) {
           coreEvents.emitFeedback(
             'info',
-            'Waiting for MCP servers to initialize... Slash commands are still available and prompts will be queued.',
+            !isConfigInitialized
+              ? 'Initializing... Prompts will be queued.'
+              : 'Waiting for MCP servers to initialize... Slash commands are still available and prompts will be queued.',
           );
         }
         addMessage(submittedValue);
@@ -1350,6 +1356,7 @@ Logging in with Google... Restarting Gemini CLI to continue.
       refreshStatic,
       reset,
       handleHintSubmit,
+      isConfigInitialized,
       triggerExpandHint,
     ],
   );
@@ -1380,17 +1387,28 @@ Logging in with Google... Restarting Gemini CLI to continue.
    * - Any future streaming states not explicitly allowed
    */
   const isInputActive =
-    isConfigInitialized &&
     !initError &&
     !isProcessing &&
     !isResuming &&
-    !!slashCommands &&
     (streamingState === StreamingState.Idle ||
       streamingState === StreamingState.Responding ||
       streamingState === StreamingState.WaitingForConfirmation) &&
-    !proQuotaRequest;
+    !proQuotaRequest &&
+    !copyModeEnabled;
 
   const [controlsHeight, setControlsHeight] = useState(0);
+  const [lastNonCopyControlsHeight, setLastNonCopyControlsHeight] = useState(0);
+
+  useLayoutEffect(() => {
+    if (!copyModeEnabled && controlsHeight > 0) {
+      setLastNonCopyControlsHeight(controlsHeight);
+    }
+  }, [copyModeEnabled, controlsHeight]);
+
+  const stableControlsHeight =
+    copyModeEnabled && lastNonCopyControlsHeight > 0
+      ? lastNonCopyControlsHeight
+      : controlsHeight;
 
   useLayoutEffect(() => {
     if (mainControlsRef.current) {
@@ -1402,10 +1420,10 @@ Logging in with Google... Restarting Gemini CLI to continue.
     }
   }, [buffer, terminalWidth, terminalHeight, controlsHeight, isInputActive]);
 
-  // Compute available terminal height based on controls measurement
+  // Compute available terminal height based on stable controls measurement
   const availableTerminalHeight = Math.max(
     0,
-    terminalHeight - controlsHeight - backgroundShellHeight - 1,
+    terminalHeight - stableControlsHeight - backgroundShellHeight - 1,
   );
 
   config.setShellExecutionConfig({
@@ -2264,6 +2282,7 @@ Logging in with Google... Restarting Gemini CLI to continue.
       contextFileNames,
       errorCount,
       availableTerminalHeight,
+      stableControlsHeight,
       mainAreaWidth,
       staticAreaMaxItemHeight,
       staticExtraHeight,
@@ -2385,6 +2404,7 @@ Logging in with Google... Restarting Gemini CLI to continue.
       contextFileNames,
       errorCount,
       availableTerminalHeight,
+      stableControlsHeight,
       mainAreaWidth,
       staticAreaMaxItemHeight,
       staticExtraHeight,

packages/cli/src/ui/__snapshots__/App.test.tsx.snap

@@ -34,12 +34,11 @@ Tips for getting started:
 
 
 
-
-
 
 
 
 Notifications
+
 Composer
 "
 `;
@@ -100,12 +99,11 @@ exports[`App > Snapshots > renders with dialogs visible 1`] = `
 
 
 
-
-
 
 
 
 Notifications
+
 DialogManager
 "
 `;
@@ -147,9 +145,8 @@ HistoryItemDisplay
 
 
 
-
-
 Notifications
+
 Composer
 "
 `;

packages/cli/src/ui/__snapshots__/ToolConfirmationFullFrame-Full-Terminal-Tool-Confirmation-Snapshot-renders-tool-confirmation-box-in-the-frame-of-the-entire-terminal.snap.svg

@@ -1,271 +1,266 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="920" height="700" viewBox="0 0 920 700">
+<svg xmlns="http://www.w3.org/2000/svg" width="920" height="666" viewBox="0 0 920 666">
   <style>
     text { font-family: Consolas, "Courier New", monospace; font-size: 14px; dominant-baseline: text-before-edge; white-space: pre; }
   </style>
-  <rect width="920" height="700" fill="#000000" />
+  <rect width="920" height="666" fill="#000000" />
   <g transform="translate(10, 10)">
-    <text x="0" y="2" fill="#ffffff" textLength="450" lengthAdjust="spacingAndGlyphs">3. Ask coding questions, edit code or run commands</text>
-    <text x="0" y="19" fill="#ffffff" textLength="315" lengthAdjust="spacingAndGlyphs">4. Be specific for the best results</text>
+    <rect x="0" y="0" width="900" height="17" fill="#141414" />
+    <text x="0" y="2" fill="#000000" textLength="900" lengthAdjust="spacingAndGlyphs">▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀</text>
+    <rect x="0" y="17" width="9" height="17" fill="#141414" />
+    <rect x="9" y="17" width="18" height="17" fill="#141414" />
+    <text x="9" y="19" fill="#d7afff" textLength="18" lengthAdjust="spacingAndGlyphs">&gt; </text>
+    <rect x="27" y="17" width="324" height="17" fill="#141414" />
+    <text x="27" y="19" fill="#ffffff" textLength="324" lengthAdjust="spacingAndGlyphs">Can you edit InputPrompt.tsx for me?</text>
+    <rect x="351" y="17" width="549" height="17" fill="#141414" />
     <rect x="0" y="34" width="900" height="17" fill="#141414" />
-    <text x="0" y="36" fill="#000000" textLength="900" lengthAdjust="spacingAndGlyphs">▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀</text>
-    <rect x="0" y="51" width="9" height="17" fill="#141414" />
-    <rect x="9" y="51" width="18" height="17" fill="#141414" />
-    <text x="9" y="53" fill="#d7afff" textLength="18" lengthAdjust="spacingAndGlyphs">&gt; </text>
-    <rect x="27" y="51" width="324" height="17" fill="#141414" />
-    <text x="27" y="53" fill="#ffffff" textLength="324" lengthAdjust="spacingAndGlyphs">Can you edit InputPrompt.tsx for me?</text>
-    <rect x="351" y="51" width="549" height="17" fill="#141414" />
-    <rect x="0" y="68" width="900" height="17" fill="#141414" />
-    <text x="0" y="70" fill="#000000" textLength="900" lengthAdjust="spacingAndGlyphs">▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄</text>
-    <text x="0" y="87" fill="#ffffaf" textLength="891" lengthAdjust="spacingAndGlyphs">╭─────────────────────────────────────────────────────────────────────────────────────────────────╮</text>
+    <text x="0" y="36" fill="#000000" textLength="900" lengthAdjust="spacingAndGlyphs">▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄</text>
+    <text x="0" y="53" fill="#ffffaf" textLength="891" lengthAdjust="spacingAndGlyphs">╭─────────────────────────────────────────────────────────────────────────────────────────────────╮</text>
+    <text x="0" y="70" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
+    <text x="18" y="70" fill="#ffffaf" textLength="135" lengthAdjust="spacingAndGlyphs" font-weight="bold">Action Required</text>
+    <text x="882" y="70" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
+    <text x="0" y="87" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
+    <text x="882" y="87" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="0" y="104" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="104" fill="#ffffaf" textLength="135" lengthAdjust="spacingAndGlyphs" font-weight="bold">Action Required</text>
+    <text x="18" y="104" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">?</text>
+    <text x="45" y="104" fill="#ffffff" textLength="36" lengthAdjust="spacingAndGlyphs" font-weight="bold">Edit</text>
+    <text x="90" y="104" fill="#afafaf" textLength="774" lengthAdjust="spacingAndGlyphs">packages/.../InputPrompt.tsx:   return kittyProtocolSupporte... =&gt;   return kittyProto</text>
+    <text x="864" y="104" fill="#ffffff" textLength="18" lengthAdjust="spacingAndGlyphs">… </text>
     <text x="882" y="104" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="0" y="121" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="882" y="121" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="0" y="138" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="138" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">?</text>
-    <text x="45" y="138" fill="#ffffff" textLength="36" lengthAdjust="spacingAndGlyphs" font-weight="bold">Edit</text>
-    <text x="90" y="138" fill="#afafaf" textLength="774" lengthAdjust="spacingAndGlyphs">packages/.../InputPrompt.tsx:   return kittyProtocolSupporte... =&gt;   return kittyProto</text>
-    <text x="864" y="138" fill="#ffffff" textLength="18" lengthAdjust="spacingAndGlyphs">… </text>
+    <text x="18" y="138" fill="#afafaf" textLength="414" lengthAdjust="spacingAndGlyphs">... first 44 lines hidden (Ctrl+O to show) ...</text>
     <text x="882" y="138" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="0" y="155" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
+    <text x="18" y="155" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">45</text>
+    <text x="63" y="155" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
+    <text x="117" y="155" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line45</text>
+    <text x="171" y="155" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
+    <text x="198" y="155" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
+    <text x="234" y="155" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="155" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="0" y="172" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="172" fill="#afafaf" textLength="414" lengthAdjust="spacingAndGlyphs">... first 44 lines hidden (Ctrl+O to show) ...</text>
+    <text x="18" y="172" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">46</text>
+    <text x="63" y="172" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
+    <text x="117" y="172" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line46</text>
+    <text x="171" y="172" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
+    <text x="198" y="172" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
+    <text x="234" y="172" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="172" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="891" y="172" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="189" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="189" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">45</text>
+    <text x="18" y="189" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">47</text>
     <text x="63" y="189" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="189" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line45</text>
+    <text x="117" y="189" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line47</text>
     <text x="171" y="189" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
     <text x="198" y="189" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
     <text x="234" y="189" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="189" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="189" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="206" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="206" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">46</text>
+    <text x="18" y="206" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">48</text>
     <text x="63" y="206" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="206" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line46</text>
+    <text x="117" y="206" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line48</text>
     <text x="171" y="206" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
     <text x="198" y="206" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
     <text x="234" y="206" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="206" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="206" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="223" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="223" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">47</text>
+    <text x="18" y="223" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">49</text>
     <text x="63" y="223" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="223" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line47</text>
+    <text x="117" y="223" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line49</text>
     <text x="171" y="223" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
     <text x="198" y="223" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
     <text x="234" y="223" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="223" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="223" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="240" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="240" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">48</text>
+    <text x="18" y="240" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">50</text>
     <text x="63" y="240" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="240" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line48</text>
+    <text x="117" y="240" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line50</text>
     <text x="171" y="240" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
     <text x="198" y="240" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
     <text x="234" y="240" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="240" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="240" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="257" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="257" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">49</text>
+    <text x="18" y="257" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">51</text>
     <text x="63" y="257" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="257" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line49</text>
+    <text x="117" y="257" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line51</text>
     <text x="171" y="257" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
     <text x="198" y="257" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
     <text x="234" y="257" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="257" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="257" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="274" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="274" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">50</text>
+    <text x="18" y="274" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">52</text>
     <text x="63" y="274" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="274" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line50</text>
+    <text x="117" y="274" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line52</text>
     <text x="171" y="274" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
     <text x="198" y="274" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
     <text x="234" y="274" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="274" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="274" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="291" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="291" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">51</text>
+    <text x="18" y="291" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">53</text>
     <text x="63" y="291" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="291" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line51</text>
+    <text x="117" y="291" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line53</text>
     <text x="171" y="291" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
     <text x="198" y="291" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
     <text x="234" y="291" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="291" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="291" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="308" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="308" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">52</text>
+    <text x="18" y="308" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">54</text>
     <text x="63" y="308" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="308" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line52</text>
+    <text x="117" y="308" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line54</text>
     <text x="171" y="308" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
     <text x="198" y="308" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
     <text x="234" y="308" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="308" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="308" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="325" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="325" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">53</text>
+    <text x="18" y="325" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">55</text>
     <text x="63" y="325" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="325" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line53</text>
+    <text x="117" y="325" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line55</text>
     <text x="171" y="325" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
     <text x="198" y="325" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
     <text x="234" y="325" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="325" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="325" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="342" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="342" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">54</text>
+    <text x="18" y="342" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">56</text>
     <text x="63" y="342" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="342" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line54</text>
+    <text x="117" y="342" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line56</text>
     <text x="171" y="342" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
     <text x="198" y="342" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
     <text x="234" y="342" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="342" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="342" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="359" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="359" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">55</text>
+    <text x="18" y="359" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">57</text>
     <text x="63" y="359" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="359" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line55</text>
+    <text x="117" y="359" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line57</text>
     <text x="171" y="359" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
     <text x="198" y="359" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
     <text x="234" y="359" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="359" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="359" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="376" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="376" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">56</text>
+    <text x="18" y="376" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">58</text>
     <text x="63" y="376" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="376" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line56</text>
+    <text x="117" y="376" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line58</text>
     <text x="171" y="376" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
     <text x="198" y="376" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
     <text x="234" y="376" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="376" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="376" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="393" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="393" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">57</text>
+    <text x="18" y="393" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">59</text>
     <text x="63" y="393" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="393" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line57</text>
+    <text x="117" y="393" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line59</text>
     <text x="171" y="393" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
     <text x="198" y="393" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
     <text x="234" y="393" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="393" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="393" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="410" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="410" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">58</text>
+    <text x="18" y="410" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">60</text>
     <text x="63" y="410" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="410" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line58</text>
+    <text x="117" y="410" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line60</text>
     <text x="171" y="410" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
     <text x="198" y="410" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
     <text x="234" y="410" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="410" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="410" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="427" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="427" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">59</text>
-    <text x="63" y="427" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="427" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line59</text>
-    <text x="171" y="427" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
-    <text x="198" y="427" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
-    <text x="234" y="427" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
+    <rect x="18" y="425" width="18" height="17" fill="#5f0000" />
+    <text x="18" y="427" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">61</text>
+    <rect x="36" y="425" width="9" height="17" fill="#5f0000" />
+    <rect x="45" y="425" width="9" height="17" fill="#5f0000" />
+    <text x="45" y="427" fill="#ff87af" textLength="9" lengthAdjust="spacingAndGlyphs">-</text>
+    <rect x="54" y="425" width="9" height="17" fill="#5f0000" />
+    <rect x="63" y="425" width="9" height="17" fill="#5f0000" />
+    <rect x="72" y="425" width="54" height="17" fill="#5f0000" />
+    <text x="72" y="427" fill="#0000ee" textLength="54" lengthAdjust="spacingAndGlyphs">return</text>
+    <rect x="126" y="425" width="234" height="17" fill="#5f0000" />
+    <text x="126" y="427" fill="#e5e5e5" textLength="234" lengthAdjust="spacingAndGlyphs"> kittyProtocolSupporte...;</text>
     <text x="882" y="427" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="427" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="444" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="444" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">60</text>
-    <text x="63" y="444" fill="#e5e5e5" textLength="54" lengthAdjust="spacingAndGlyphs">const </text>
-    <text x="117" y="444" fill="#ffffff" textLength="54" lengthAdjust="spacingAndGlyphs">line60</text>
-    <text x="171" y="444" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs"> = </text>
-    <text x="198" y="444" fill="#0000ee" textLength="36" lengthAdjust="spacingAndGlyphs">true</text>
-    <text x="234" y="444" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
+    <rect x="18" y="442" width="18" height="17" fill="#005f00" />
+    <text x="18" y="444" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">61</text>
+    <rect x="36" y="442" width="9" height="17" fill="#005f00" />
+    <rect x="45" y="442" width="9" height="17" fill="#005f00" />
+    <text x="45" y="444" fill="#d7ffd7" textLength="9" lengthAdjust="spacingAndGlyphs">+</text>
+    <rect x="54" y="442" width="9" height="17" fill="#005f00" />
+    <rect x="63" y="442" width="9" height="17" fill="#005f00" />
+    <rect x="72" y="442" width="54" height="17" fill="#005f00" />
+    <text x="72" y="444" fill="#0000ee" textLength="54" lengthAdjust="spacingAndGlyphs">return</text>
+    <rect x="126" y="442" width="234" height="17" fill="#005f00" />
+    <text x="126" y="444" fill="#e5e5e5" textLength="234" lengthAdjust="spacingAndGlyphs"> kittyProtocolSupporte...;</text>
     <text x="882" y="444" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="444" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="461" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <rect x="18" y="459" width="18" height="17" fill="#5f0000" />
-    <text x="18" y="461" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">61</text>
-    <rect x="36" y="459" width="9" height="17" fill="#5f0000" />
-    <rect x="45" y="459" width="9" height="17" fill="#5f0000" />
-    <text x="45" y="461" fill="#ff87af" textLength="9" lengthAdjust="spacingAndGlyphs">-</text>
-    <rect x="54" y="459" width="9" height="17" fill="#5f0000" />
-    <rect x="63" y="459" width="9" height="17" fill="#5f0000" />
-    <rect x="72" y="459" width="54" height="17" fill="#5f0000" />
-    <text x="72" y="461" fill="#0000ee" textLength="54" lengthAdjust="spacingAndGlyphs">return</text>
-    <rect x="126" y="459" width="234" height="17" fill="#5f0000" />
-    <text x="126" y="461" fill="#e5e5e5" textLength="234" lengthAdjust="spacingAndGlyphs"> kittyProtocolSupporte...;</text>
+    <text x="18" y="461" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">62</text>
+    <text x="63" y="461" fill="#e5e5e5" textLength="180" lengthAdjust="spacingAndGlyphs"> buffer: TextBuffer;</text>
     <text x="882" y="461" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="461" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="478" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <rect x="18" y="476" width="18" height="17" fill="#005f00" />
-    <text x="18" y="478" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">61</text>
-    <rect x="36" y="476" width="9" height="17" fill="#005f00" />
-    <rect x="45" y="476" width="9" height="17" fill="#005f00" />
-    <text x="45" y="478" fill="#d7ffd7" textLength="9" lengthAdjust="spacingAndGlyphs">+</text>
-    <rect x="54" y="476" width="9" height="17" fill="#005f00" />
-    <rect x="63" y="476" width="9" height="17" fill="#005f00" />
-    <rect x="72" y="476" width="54" height="17" fill="#005f00" />
-    <text x="72" y="478" fill="#0000ee" textLength="54" lengthAdjust="spacingAndGlyphs">return</text>
-    <rect x="126" y="476" width="234" height="17" fill="#005f00" />
-    <text x="126" y="478" fill="#e5e5e5" textLength="234" lengthAdjust="spacingAndGlyphs"> kittyProtocolSupporte...;</text>
+    <text x="18" y="478" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">63</text>
+    <text x="72" y="478" fill="#ffffff" textLength="72" lengthAdjust="spacingAndGlyphs">onSubmit</text>
+    <text x="144" y="478" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs">: (</text>
+    <text x="171" y="478" fill="#ffffff" textLength="45" lengthAdjust="spacingAndGlyphs">value</text>
+    <text x="216" y="478" fill="#e5e5e5" textLength="18" lengthAdjust="spacingAndGlyphs">: </text>
+    <text x="234" y="478" fill="#00cdcd" textLength="54" lengthAdjust="spacingAndGlyphs">string</text>
+    <text x="288" y="478" fill="#e5e5e5" textLength="45" lengthAdjust="spacingAndGlyphs">) =&gt; </text>
+    <text x="333" y="478" fill="#00cdcd" textLength="36" lengthAdjust="spacingAndGlyphs">void</text>
+    <text x="369" y="478" fill="#e5e5e5" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="478" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="478" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="495" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="495" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">62</text>
-    <text x="63" y="495" fill="#e5e5e5" textLength="180" lengthAdjust="spacingAndGlyphs"> buffer: TextBuffer;</text>
+    <text x="18" y="495" fill="#ffffff" textLength="162" lengthAdjust="spacingAndGlyphs">Apply this change?</text>
     <text x="882" y="495" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="495" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="512" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="512" fill="#afafaf" textLength="18" lengthAdjust="spacingAndGlyphs">63</text>
-    <text x="72" y="512" fill="#ffffff" textLength="72" lengthAdjust="spacingAndGlyphs">onSubmit</text>
-    <text x="144" y="512" fill="#e5e5e5" textLength="27" lengthAdjust="spacingAndGlyphs">: (</text>
-    <text x="171" y="512" fill="#ffffff" textLength="45" lengthAdjust="spacingAndGlyphs">value</text>
-    <text x="216" y="512" fill="#e5e5e5" textLength="18" lengthAdjust="spacingAndGlyphs">: </text>
-    <text x="234" y="512" fill="#00cdcd" textLength="54" lengthAdjust="spacingAndGlyphs">string</text>
-    <text x="288" y="512" fill="#e5e5e5" textLength="45" lengthAdjust="spacingAndGlyphs">) =&gt; </text>
-    <text x="333" y="512" fill="#00cdcd" textLength="36" lengthAdjust="spacingAndGlyphs">void</text>
-    <text x="369" y="512" fill="#e5e5e5" textLength="9" lengthAdjust="spacingAndGlyphs">;</text>
     <text x="882" y="512" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="512" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="529" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="18" y="529" fill="#ffffff" textLength="162" lengthAdjust="spacingAndGlyphs">Apply this change?</text>
+    <rect x="18" y="527" width="9" height="17" fill="#001a00" />
+    <text x="18" y="529" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">●</text>
+    <rect x="27" y="527" width="9" height="17" fill="#001a00" />
+    <rect x="36" y="527" width="18" height="17" fill="#001a00" />
+    <text x="36" y="529" fill="#00cd00" textLength="18" lengthAdjust="spacingAndGlyphs">1.</text>
+    <rect x="54" y="527" width="9" height="17" fill="#001a00" />
+    <rect x="63" y="527" width="90" height="17" fill="#001a00" />
+    <text x="63" y="529" fill="#00cd00" textLength="90" lengthAdjust="spacingAndGlyphs">Allow once</text>
+    <rect x="153" y="527" width="288" height="17" fill="#001a00" />
     <text x="882" y="529" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="529" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="546" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
+    <text x="36" y="546" fill="#ffffff" textLength="18" lengthAdjust="spacingAndGlyphs">2.</text>
+    <text x="63" y="546" fill="#ffffff" textLength="198" lengthAdjust="spacingAndGlyphs">Allow for this session</text>
     <text x="882" y="546" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="546" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="563" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <rect x="18" y="561" width="9" height="17" fill="#001a00" />
-    <text x="18" y="563" fill="#00cd00" textLength="9" lengthAdjust="spacingAndGlyphs">●</text>
-    <rect x="27" y="561" width="9" height="17" fill="#001a00" />
-    <rect x="36" y="561" width="18" height="17" fill="#001a00" />
-    <text x="36" y="563" fill="#00cd00" textLength="18" lengthAdjust="spacingAndGlyphs">1.</text>
-    <rect x="54" y="561" width="9" height="17" fill="#001a00" />
-    <rect x="63" y="561" width="90" height="17" fill="#001a00" />
-    <text x="63" y="563" fill="#00cd00" textLength="90" lengthAdjust="spacingAndGlyphs">Allow once</text>
-    <rect x="153" y="561" width="288" height="17" fill="#001a00" />
+    <text x="36" y="563" fill="#ffffff" textLength="18" lengthAdjust="spacingAndGlyphs">3.</text>
+    <text x="63" y="563" fill="#ffffff" textLength="378" lengthAdjust="spacingAndGlyphs">Allow for this file in all future sessions</text>
     <text x="882" y="563" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="563" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="580" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="36" y="580" fill="#ffffff" textLength="18" lengthAdjust="spacingAndGlyphs">2.</text>
-    <text x="63" y="580" fill="#ffffff" textLength="198" lengthAdjust="spacingAndGlyphs">Allow for this session</text>
+    <text x="36" y="580" fill="#ffffff" textLength="18" lengthAdjust="spacingAndGlyphs">4.</text>
+    <text x="63" y="580" fill="#ffffff" textLength="243" lengthAdjust="spacingAndGlyphs">Modify with external editor</text>
     <text x="882" y="580" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="580" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="597" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="36" y="597" fill="#ffffff" textLength="18" lengthAdjust="spacingAndGlyphs">3.</text>
-    <text x="63" y="597" fill="#ffffff" textLength="378" lengthAdjust="spacingAndGlyphs">Allow for this file in all future sessions</text>
+    <text x="36" y="597" fill="#ffffff" textLength="18" lengthAdjust="spacingAndGlyphs">5.</text>
+    <text x="63" y="597" fill="#ffffff" textLength="225" lengthAdjust="spacingAndGlyphs">No, suggest changes (esc)</text>
     <text x="882" y="597" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="597" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
     <text x="0" y="614" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="36" y="614" fill="#ffffff" textLength="18" lengthAdjust="spacingAndGlyphs">4.</text>
-    <text x="63" y="614" fill="#ffffff" textLength="243" lengthAdjust="spacingAndGlyphs">Modify with external editor</text>
     <text x="882" y="614" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
     <text x="891" y="614" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
-    <text x="0" y="631" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="36" y="631" fill="#ffffff" textLength="18" lengthAdjust="spacingAndGlyphs">5.</text>
-    <text x="63" y="631" fill="#ffffff" textLength="225" lengthAdjust="spacingAndGlyphs">No, suggest changes (esc)</text>
-    <text x="882" y="631" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
+    <text x="0" y="631" fill="#ffffaf" textLength="891" lengthAdjust="spacingAndGlyphs">╰─────────────────────────────────────────────────────────────────────────────────────────────────╯</text>
     <text x="891" y="631" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
-    <text x="0" y="648" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="882" y="648" fill="#ffffaf" textLength="9" lengthAdjust="spacingAndGlyphs">│</text>
-    <text x="891" y="648" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
-    <text x="0" y="665" fill="#ffffaf" textLength="891" lengthAdjust="spacingAndGlyphs">╰─────────────────────────────────────────────────────────────────────────────────────────────────╯</text>
-    <text x="891" y="665" fill="#333333" textLength="9" lengthAdjust="spacingAndGlyphs">█</text>
   </g>
 </svg>

packages/cli/src/ui/__snapshots__/ToolConfirmationFullFrame.test.tsx.snap

@@ -1,9 +1,7 @@
 // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
 exports[`Full Terminal Tool Confirmation Snapshot > renders tool confirmation box in the frame of the entire terminal 1`] = `
-"3. Ask coding questions, edit code or run commands
-4. Be specific for the best results
-▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
+"▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
  > Can you edit InputPrompt.tsx for me?                                                             
 ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
 ╭─────────────────────────────────────────────────────────────────────────────────────────────────╮
@@ -11,9 +9,9 @@ exports[`Full Terminal Tool Confirmation Snapshot > renders tool confirmation bo
 │                                                                                                 │
 │ ?  Edit packages/.../InputPrompt.tsx:   return kittyProtocolSupporte... =>   return kittyProto… │
 │                                                                                                 │
-│ ... first 44 lines hidden (Ctrl+O to show) ...                                                  │█
-│ 45   const line45 = true;                                                                       │█
-│ 46   const line46 = true;                                                                       │█
+│ ... first 44 lines hidden (Ctrl+O to show) ...                                                  │
+│ 45   const line45 = true;                                                                       │
+│ 46   const line46 = true;                                                                       │
 │ 47   const line47 = true;                                                                       │█
 │ 48   const line48 = true;                                                                       │█
 │ 49   const line49 = true;                                                                       │█

packages/cli/src/ui/commands/teleportCommand.test.ts

@@ -0,0 +1,192 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { teleportCommand } from './teleportCommand.js';
+import { type CommandContext } from './types.js';
+import { createMockCommandContext } from '../../test-utils/mockCommandContext.js';
+import { type Config } from '@google/gemini-cli-core';
+import { existsSync } from 'node:fs';
+import * as fs from 'node:fs';
+
+const mockExportSession = vi.fn();
+const mockImportSession = vi.fn();
+
+vi.mock('prompts', () => ({
+  default: vi.fn().mockResolvedValue({ secret: 'prompted-secret' }),
+}));
+
+vi.mock('node:fs', async (importOriginal) => {
+  const original = await importOriginal<typeof import('node:fs')>();
+  return {
+    ...original,
+    default: {
+      ...original,
+      existsSync: vi.fn(),
+      readFileSync: vi.fn(),
+    },
+    existsSync: vi.fn(),
+    readFileSync: vi.fn(),
+    writeFileSync: vi.fn(),
+    rmSync: vi.fn(),
+  };
+});
+
+vi.mock('@google/gemini-cli-core', async (importOriginal) => {
+  const original =
+    await importOriginal<typeof import('@google/gemini-cli-core')>();
+  return {
+    ...original,
+    TeleportService: class {
+      exportSession = mockExportSession;
+      importSession = mockImportSession;
+    },
+    getAdminErrorMessage: vi.fn().mockReturnValue('Admin Error'),
+    debugLogger: {
+      log: vi.fn(),
+      error: vi.fn(),
+      warn: vi.fn(),
+    },
+  };
+});
+
+describe('teleportCommand', () => {
+  let mockContext: CommandContext;
+  let mockConfig: Config;
+
+  beforeEach(() => {
+    mockExportSession.mockResolvedValue({
+      packagePath: 'any.tar.gz',
+      sessionId: 'current-session-id',
+      filesIncluded: ['file1'],
+    });
+
+    mockImportSession.mockResolvedValue({
+      sessionId: 'imported-id',
+      projectIdentifier: 'imported-project',
+    });
+
+    mockConfig = {
+      getSessionId: vi.fn().mockReturnValue('current-session-id'),
+      storage: {
+        getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
+      },
+    } as unknown as Config;
+
+    mockContext = createMockCommandContext({
+      services: {
+        config: mockConfig,
+      },
+    });
+
+    vi.stubEnv('GEMINI_TELEPORT_SECRET', '');
+    mockExportSession.mockClear();
+    mockImportSession.mockClear();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    vi.unstubAllEnvs();
+  });
+
+  it('should have the correct metadata', () => {
+    expect(teleportCommand.name).toBe('teleport');
+    expect(teleportCommand.subCommands).toHaveLength(2);
+  });
+
+  describe('export', () => {
+    it('should export the current session when no args provided', async () => {
+      const exportSubCommand = teleportCommand.subCommands?.find(
+        (c) => c.name === 'export',
+      );
+      await exportSubCommand?.action?.(mockContext, '');
+
+      expect(mockExportSession).toHaveBeenCalledWith(
+        'current-session-id',
+        expect.stringContaining('gemini-session-current-'),
+        undefined,
+        undefined,
+      );
+    });
+
+    it('should use environment variable for secret', async () => {
+      vi.stubEnv('GEMINI_TELEPORT_SECRET', 'env-secret');
+      const exportSubCommand = teleportCommand.subCommands?.find(
+        (c) => c.name === 'export',
+      );
+      await exportSubCommand?.action?.(mockContext, '--secret');
+
+      expect(mockExportSession).toHaveBeenCalledWith(
+        'current-session-id',
+        expect.any(String),
+        'env-secret',
+        undefined,
+      );
+    });
+
+    it('should use key file for secret', async () => {
+      const exportSubCommand = teleportCommand.subCommands?.find(
+        (c) => c.name === 'export',
+      );
+      vi.mocked(existsSync).mockReturnValue(true);
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+      vi.mocked(fs.readFileSync as any).mockReturnValue('file-secret');
+
+      await exportSubCommand?.action?.(mockContext, '--key-file /path/to/key');
+
+      expect(mockExportSession).toHaveBeenCalledWith(
+        'current-session-id',
+        expect.any(String),
+        'file-secret',
+        undefined,
+      );
+    });
+  });
+
+  describe('import', () => {
+    it('should import successfully if file exists', async () => {
+      const importSubCommand = teleportCommand.subCommands?.find(
+        (c) => c.name === 'import',
+      );
+      vi.mocked(existsSync).mockReturnValue(true);
+
+      const result = await importSubCommand?.action?.(
+        mockContext,
+        'my-session.tar.gz',
+      );
+
+      expect(mockImportSession).toHaveBeenCalledWith(
+        'my-session.tar.gz',
+        undefined,
+      );
+      expect(result).toEqual(
+        expect.objectContaining({
+          type: 'message',
+          messageType: 'info',
+          content: expect.stringContaining('imported successfully'),
+        }),
+      );
+    });
+
+    it('should handle environment secret during import', async () => {
+      vi.stubEnv('GEMINI_TELEPORT_SECRET', 'env-secret');
+      const importSubCommand = teleportCommand.subCommands?.find(
+        (c) => c.name === 'import',
+      );
+      vi.mocked(existsSync).mockReturnValue(true);
+
+      await importSubCommand?.action?.(
+        mockContext,
+        'my-session.tar.gz --secret',
+      );
+
+      expect(mockImportSession).toHaveBeenCalledWith(
+        'my-session.tar.gz',
+        'env-secret',
+      );
+    });
+  });
+});

packages/cli/src/ui/commands/teleportCommand.ts

@@ -0,0 +1,264 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { TeleportService, getAdminErrorMessage } from '@google/gemini-cli-core';
+import {
+  CommandKind,
+  type SlashCommand,
+  type CommandContext,
+  type SlashCommandActionReturn,
+} from './types.js';
+import * as path from 'node:path';
+import * as fs from 'node:fs';
+import prompts from 'prompts';
+
+async function getSecret(keyFilePath?: string): Promise<string | undefined> {
+  // 1. Check environment variable
+  if (process.env['GEMINI_TELEPORT_SECRET']) {
+    return process.env['GEMINI_TELEPORT_SECRET'];
+  }
+
+  // 2. Check key file
+  if (keyFilePath) {
+    if (fs.existsSync(keyFilePath)) {
+      return fs.readFileSync(keyFilePath, 'utf8').trim();
+    }
+    throw new Error(`Key file not found: ${keyFilePath}`);
+  }
+
+  // 3. Interactive prompt
+  const response = await prompts({
+    type: 'password',
+    name: 'secret',
+    message: 'Enter teleport secret:',
+  });
+
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+  return response.secret as string | undefined;
+}
+
+export const teleportCommand: SlashCommand = {
+  name: 'teleport',
+  description:
+    'Export or import sessions to make them portable across machines',
+  kind: CommandKind.BUILT_IN,
+  subCommands: [
+    {
+      name: 'export',
+      description: 'Export a session to a portable tarball or blob storage',
+      kind: CommandKind.BUILT_IN,
+      action: async (
+        context: CommandContext,
+        args: string,
+      ): Promise<SlashCommandActionReturn> => {
+        if (!context.services.config) {
+          return {
+            type: 'message',
+            messageType: 'error',
+            content: getAdminErrorMessage('Teleport', undefined),
+          };
+        }
+
+        const parts = args
+          .trim()
+          .split(/\s+/)
+          .filter((p) => p !== '');
+        let sessionId = '';
+        let outputPath = '';
+        let useSecret = false;
+        let keyFilePath: string | undefined;
+        let blobUri: string | undefined;
+
+        for (let i = 0; i < parts.length; i++) {
+          if (parts[i] === '--secret') {
+            useSecret = true;
+          } else if (parts[i] === '--key-file') {
+            useSecret = true;
+            keyFilePath = parts[i + 1];
+            i++;
+          } else if (parts[i] === '--blob') {
+            blobUri = parts[i + 1];
+            if (!blobUri || blobUri.startsWith('--')) {
+              return {
+                type: 'message',
+                messageType: 'error',
+                content:
+                  'Please provide a blob URI after --blob flag (e.g. gs://bucket/path).',
+              };
+            }
+            i++;
+          } else if (!sessionId && !parts[i].startsWith('--')) {
+            sessionId = parts[i];
+          } else if (!outputPath && !parts[i].startsWith('--')) {
+            outputPath = parts[i];
+          }
+        }
+
+        if (!sessionId || sessionId === 'current' || sessionId === '') {
+          sessionId = context.services.config.getSessionId();
+        }
+
+        if (!outputPath) {
+          outputPath = `gemini-session-${sessionId.slice(0, 8)}.tar.gz`;
+        }
+
+        let secret: string | undefined;
+        if (useSecret) {
+          try {
+            secret = await getSecret(keyFilePath);
+            if (!secret) {
+              return {
+                type: 'message',
+                messageType: 'error',
+                content: 'Export cancelled: secret is required.',
+              };
+            }
+          } catch (e) {
+            return {
+              type: 'message',
+              messageType: 'error',
+              content: String(e),
+            };
+          }
+        }
+
+        const teleportService = new TeleportService(context.services.config);
+        try {
+          const result = await teleportService.exportSession(
+            sessionId,
+            outputPath,
+            secret,
+            blobUri,
+          );
+          let message = `Session ${sessionId} exported successfully to ${path.resolve(outputPath)}.\nIncluded ${result.filesIncluded.length} files/directories.${secret ? ' (Encrypted)' : ''}`;
+          if (blobUri) {
+            message += `\nAlso uploaded to: ${blobUri}`;
+          }
+          return {
+            type: 'message',
+            messageType: 'info',
+            content: message,
+          };
+        } catch (error) {
+          return {
+            type: 'message',
+            messageType: 'error',
+            content: `Failed to export session: ${error instanceof Error ? error.message : String(error)}`,
+          };
+        }
+      },
+    },
+    {
+      name: 'import',
+      description: 'Import a session from a portable tarball or blob storage',
+      kind: CommandKind.BUILT_IN,
+      action: async (
+        context: CommandContext,
+        args: string,
+      ): Promise<SlashCommandActionReturn> => {
+        if (!context.services.config) {
+          return {
+            type: 'message',
+            messageType: 'error',
+            content: getAdminErrorMessage('Teleport', undefined),
+          };
+        }
+
+        const parts = args
+          .trim()
+          .split(/\s+/)
+          .filter((p) => p !== '');
+        let packagePathOrUri = '';
+        let useSecret = false;
+        let keyFilePath: string | undefined;
+
+        for (let i = 0; i < parts.length; i++) {
+          if (parts[i] === '--secret') {
+            useSecret = true;
+          } else if (parts[i] === '--key-file') {
+            useSecret = true;
+            keyFilePath = parts[i + 1];
+            i++;
+          } else if (!packagePathOrUri && !parts[i].startsWith('--')) {
+            packagePathOrUri = parts[i];
+          }
+        }
+
+        if (!packagePathOrUri) {
+          return {
+            type: 'message',
+            messageType: 'error',
+            content:
+              'Please provide the path or URI to the session tarball to import.',
+          };
+        }
+
+        // Only check local file if it doesn't look like a URI
+        if (
+          !packagePathOrUri.startsWith('gs://') &&
+          !packagePathOrUri.startsWith('s3://') &&
+          !fs.existsSync(packagePathOrUri)
+        ) {
+          return {
+            type: 'message',
+            messageType: 'error',
+            content: `File not found: ${packagePathOrUri}`,
+          };
+        }
+
+        let secret: string | undefined;
+        if (useSecret) {
+          try {
+            secret = await getSecret(keyFilePath);
+            if (!secret) {
+              return {
+                type: 'message',
+                messageType: 'error',
+                content: 'Import cancelled: secret is required.',
+              };
+            }
+          } catch (e) {
+            return {
+              type: 'message',
+              messageType: 'error',
+              content: String(e),
+            };
+          }
+        }
+
+        const teleportService = new TeleportService(context.services.config);
+        try {
+          const result = await teleportService.importSession(
+            packagePathOrUri,
+            secret,
+          );
+          return {
+            type: 'message',
+            messageType: 'info',
+            content: `Session imported successfully.\nSession ID: ${result.sessionId}\nProject: ${result.projectIdentifier}\n\nYou can now resume this session using: /resume ${result.sessionId}`,
+          };
+        } catch (error) {
+          return {
+            type: 'message',
+            messageType: 'error',
+            content: `Failed to import session: ${error instanceof Error ? error.message : String(error)}`,
+          };
+        }
+      },
+    },
+  ],
+  action: async (
+    _context: CommandContext,
+    _args: string,
+  ): Promise<SlashCommandActionReturn> => {
+    return {
+      type: 'message',
+      messageType: 'info',
+      content:
+        'Use `/teleport export [session-id] [output-path] [--secret] [--key-file <path>] [--blob <uri>]` to export a session.\nUse `/teleport import <package-path-or-uri> [--secret] [--key-file <path>]` to import a session.',
+    };
+  },
+};

packages/cli/src/ui/components/AppHeader.tsx

@@ -108,7 +108,7 @@ export const AppHeader = ({ version, showDetails = true }: AppHeaderProps) => {
           Gemini CLI
         </Text>
         <Text color={theme.text.secondary}> v{version}</Text>
-        {updateInfo && (
+        {updateInfo?.isUpdating && (
           <Box marginLeft={2}>
             <Text color={theme.text.secondary}>
               <CliSpinner /> Updating

packages/cli/src/ui/components/Composer.tsx

@@ -518,12 +518,8 @@ export const Composer = ({ isFocused = true }: { isFocused?: boolean }) => {
       flexGrow={0}
       flexShrink={0}
     >
-      {(!uiState.slashCommands ||
-        !uiState.isConfigInitialized ||
-        uiState.isResuming) && (
-        <ConfigInitDisplay
-          message={uiState.isResuming ? 'Resuming session...' : undefined}
-        />
+      {uiState.isResuming && (
+        <ConfigInitDisplay message="Resuming session..." />
       )}
 
       {showUiDetails && (
@@ -592,12 +588,15 @@ export const Composer = ({ isFocused = true }: { isFocused?: boolean }) => {
           streamingState={uiState.streamingState}
           suggestionsPosition={suggestionsPosition}
           onSuggestionsVisibilityChange={setSuggestionsVisible}
+          copyModeEnabled={uiState.copyModeEnabled}
         />
       )}
 
       {showUiDetails &&
         !settings.merged.ui.hideFooter &&
-        !isScreenReaderEnabled && <Footer />}
+        !isScreenReaderEnabled && (
+          <Footer copyModeEnabled={uiState.copyModeEnabled} />
+        )}
     </Box>
   );
 };

packages/cli/src/ui/components/CopyModeWarning.tsx

@@ -12,16 +12,14 @@ import { theme } from '../semantic-colors.js';
 export const CopyModeWarning: React.FC = () => {
   const { copyModeEnabled } = useUIState();
 
-  if (!copyModeEnabled) {
-    return null;
-  }
-
   return (
-    <Box>
-      <Text color={theme.status.warning}>
-        In Copy Mode. Use Page Up/Down to scroll. Press Ctrl+S or any other key
-        to exit.
-      </Text>
+    <Box height={1}>
+      {copyModeEnabled && (
+        <Text color={theme.status.warning}>
+          In Copy Mode. Use Page Up/Down to scroll. Press Ctrl+S or any other
+          key to exit.
+        </Text>
+      )}
     </Box>
   );
 };

packages/cli/src/ui/components/ExitPlanModeDialog.tsx

@@ -80,7 +80,6 @@ function usePlanContent(planPath: string, config: Config): PlanContentState {
         const pathError = await validatePlanPath(
           planPath,
           config.storage.getPlansDir(),
-          config.getTargetDir(),
         );
         if (ignore) return;
         if (pathError) {

packages/cli/src/ui/components/Footer.tsx

@@ -175,12 +175,18 @@ interface FooterColumn {
   isHighPriority: boolean;
 }
 
-export const Footer: React.FC = () => {
+export const Footer: React.FC<{ copyModeEnabled?: boolean }> = ({
+  copyModeEnabled = false,
+}) => {
   const uiState = useUIState();
   const config = useConfig();
   const settings = useSettings();
   const { vimEnabled, vimMode } = useVimMode();
 
+  if (copyModeEnabled) {
+    return <Box height={1} />;
+  }
+
   const {
     model,
     targetDir,
@@ -353,7 +359,17 @@ export const Footer: React.FC = () => {
         break;
       }
       case 'memory-usage': {
-        addCol(id, header, () => <MemoryUsageDisplay color={itemColor} />, 10);
+        addCol(
+          id,
+          header,
+          () => (
+            <MemoryUsageDisplay
+              color={itemColor}
+              isActive={!uiState.copyModeEnabled}
+            />
+          ),
+          10,
+        );
         break;
       }
       case 'session-id': {

packages/cli/src/ui/components/InputPrompt.tsx

@@ -119,6 +119,7 @@ export interface InputPromptProps {
   popAllMessages?: () => string | undefined;
   suggestionsPosition?: 'above' | 'below';
   setBannerVisible: (visible: boolean) => void;
+  copyModeEnabled?: boolean;
 }
 
 // The input content, input container, and input suggestions list may have different widths
@@ -212,6 +213,7 @@ export const InputPrompt: React.FC<InputPromptProps> = ({
   popAllMessages,
   suggestionsPosition = 'below',
   setBannerVisible,
+  copyModeEnabled = false,
 }) => {
   const isHelpDismissKey = useIsHelpDismissKey();
   const keyMatchers = useKeyMatchers();
@@ -331,7 +333,8 @@ export const InputPrompt: React.FC<InputPromptProps> = ({
     isShellSuggestionsVisible,
   } = completion;
 
-  const showCursor = focus && isShellFocused && !isEmbeddedShellFocused;
+  const showCursor =
+    focus && isShellFocused && !isEmbeddedShellFocused && !copyModeEnabled;
 
   // Notify parent component about escape prompt state changes
   useEffect(() => {

packages/cli/src/ui/components/MemoryUsageDisplay.tsx

@@ -11,13 +11,18 @@ import { theme } from '../semantic-colors.js';
 import process from 'node:process';
 import { formatBytes } from '../utils/formatters.js';
 
-export const MemoryUsageDisplay: React.FC<{ color?: string }> = ({
-  color = theme.text.primary,
-}) => {
+export const MemoryUsageDisplay: React.FC<{
+  color?: string;
+  isActive?: boolean;
+}> = ({ color = theme.text.primary, isActive = true }) => {
   const [memoryUsage, setMemoryUsage] = useState<string>('');
   const [memoryUsageColor, setMemoryUsageColor] = useState<string>(color);
 
   useEffect(() => {
+    if (!isActive) {
+      return;
+    }
+
     const updateMemory = () => {
       const usage = process.memoryUsage().rss;
       setMemoryUsage(formatBytes(usage));
@@ -25,10 +30,11 @@ export const MemoryUsageDisplay: React.FC<{ color?: string }> = ({
         usage >= 2 * 1024 * 1024 * 1024 ? theme.status.error : color,
       );
     };
+
     const intervalId = setInterval(updateMemory, 2000);
     updateMemory(); // Initial update
     return () => clearInterval(intervalId);
-  }, [color]);
+  }, [color, isActive]);
 
   return (
     <Box>

packages/cli/src/ui/components/ToolConfirmationQueue.test.tsx

@@ -47,6 +47,7 @@ describe('ToolConfirmationQueue', () => {
   const mockConfig = {
     isTrustedFolder: () => true,
     getIdeMode: () => false,
+    getApprovalMode: () => 'default',
     getDisableAlwaysAllow: () => false,
     getModel: () => 'gemini-pro',
     getDebugMode: () => false,

packages/cli/src/ui/components/messages/RedirectionConfirmation.test.tsx

@@ -22,6 +22,7 @@ describe('ToolConfirmationMessage Redirection', () => {
     isTrustedFolder: () => true,
     getIdeMode: () => false,
     getDisableAlwaysAllow: () => false,
+    getApprovalMode: () => 'default',
   } as unknown as Config;
 
   it('should display redirection warning and tip for redirected commands', async () => {

packages/cli/src/ui/components/messages/SubagentProgressDisplay.tsx

@@ -153,7 +153,7 @@ export const SubagentProgressDisplay: React.FC<
         })}
       </Box>
 
-      {progress.state === 'completed' && progress.result && (
+      {progress.result && (
         <Box flexDirection="column" marginTop={1}>
           {progress.terminateReason && progress.terminateReason !== 'GOAL' && (
             <Box marginBottom={1}>
@@ -164,7 +164,7 @@ export const SubagentProgressDisplay: React.FC<
           )}
           <MarkdownDisplay
             text={safeJsonToMarkdown(progress.result)}
-            isPending={false}
+            isPending={progress.state !== 'completed'}
             terminalWidth={terminalWidth}
           />
         </Box>

packages/cli/src/ui/components/messages/ToolConfirmationMessage.test.tsx

@@ -40,6 +40,7 @@ describe('ToolConfirmationMessage', () => {
     isTrustedFolder: () => true,
     getIdeMode: () => false,
     getDisableAlwaysAllow: () => false,
+    getApprovalMode: () => 'default',
   } as unknown as Config;
 
   it('should not display urls if prompt and url are the same', async () => {
@@ -324,6 +325,7 @@ describe('ToolConfirmationMessage', () => {
           isTrustedFolder: () => true,
           getIdeMode: () => false,
           getDisableAlwaysAllow: () => false,
+          getApprovalMode: () => 'default',
         } as unknown as Config;
         const { lastFrame, unmount } = await renderWithProviders(
           <ToolConfirmationMessage
@@ -345,6 +347,7 @@ describe('ToolConfirmationMessage', () => {
           isTrustedFolder: () => false,
           getIdeMode: () => false,
           getDisableAlwaysAllow: () => false,
+          getApprovalMode: () => 'default',
         } as unknown as Config;
 
         const { lastFrame, unmount } = await renderWithProviders(
@@ -380,6 +383,7 @@ describe('ToolConfirmationMessage', () => {
         isTrustedFolder: () => true,
         getIdeMode: () => false,
         getDisableAlwaysAllow: () => false,
+        getApprovalMode: () => 'default',
       } as unknown as Config;
       const { lastFrame, unmount } = await renderWithProviders(
         <ToolConfirmationMessage
@@ -406,6 +410,7 @@ describe('ToolConfirmationMessage', () => {
         isTrustedFolder: () => true,
         getIdeMode: () => false,
         getDisableAlwaysAllow: () => false,
+        getApprovalMode: () => 'default',
       } as unknown as Config;
       const { lastFrame, unmount } = await renderWithProviders(
         <ToolConfirmationMessage
@@ -447,6 +452,7 @@ describe('ToolConfirmationMessage', () => {
         isTrustedFolder: () => true,
         getIdeMode: () => false,
         getDisableAlwaysAllow: () => false,
+        getApprovalMode: () => 'default',
       } as unknown as Config;
       vi.mocked(useToolActions).mockReturnValue({
         confirm: vi.fn(),
@@ -473,6 +479,7 @@ describe('ToolConfirmationMessage', () => {
         isTrustedFolder: () => true,
         getIdeMode: () => true,
         getDisableAlwaysAllow: () => false,
+        getApprovalMode: () => 'default',
       } as unknown as Config;
       vi.mocked(useToolActions).mockReturnValue({
         confirm: vi.fn(),
@@ -499,6 +506,7 @@ describe('ToolConfirmationMessage', () => {
         isTrustedFolder: () => true,
         getIdeMode: () => true,
         getDisableAlwaysAllow: () => false,
+        getApprovalMode: () => 'default',
       } as unknown as Config;
       vi.mocked(useToolActions).mockReturnValue({
         confirm: vi.fn(),

packages/cli/src/ui/components/messages/ToolConfirmationMessage.tsx

@@ -15,6 +15,7 @@ import {
   type ToolConfirmationPayload,
   ToolConfirmationOutcome,
   type EditorType,
+  ApprovalMode,
   hasRedirection,
   debugLogger,
 } from '@google/gemini-cli-core';
@@ -314,6 +315,31 @@ export const ToolConfirmationMessage: React.FC<
           key: 'No, suggest changes (esc)',
         });
       }
+    } else if (confirmationDetails.type === 'sandbox_expansion') {
+      options.push({
+        label: 'Allow once',
+        value: ToolConfirmationOutcome.ProceedOnce,
+        key: 'Allow once',
+      });
+      if (isTrustedFolder) {
+        options.push({
+          label: 'Allow for this session',
+          value: ToolConfirmationOutcome.ProceedAlways,
+          key: 'Allow for this session',
+        });
+        if (allowPermanentApproval) {
+          options.push({
+            label: 'Allow for all future sessions',
+            value: ToolConfirmationOutcome.ProceedAlwaysAndSave,
+            key: 'Allow for all future sessions',
+          });
+        }
+      }
+      options.push({
+        label: 'No, suggest changes (esc)',
+        value: ToolConfirmationOutcome.Cancel,
+        key: 'No, suggest changes (esc)',
+      });
     } else if (confirmationDetails.type === 'exec') {
       options.push({
         label: 'Allow once',
@@ -546,6 +572,8 @@ export const ToolConfirmationMessage: React.FC<
         if (!confirmationDetails.isModifying) {
           question = `Apply this change?`;
         }
+      } else if (confirmationDetails.type === 'sandbox_expansion') {
+        question = `Allow sandbox expansion for: '${sanitizeForDisplay(confirmationDetails.rootCommand)}'?`;
       } else if (confirmationDetails.type === 'exec') {
         const executionProps = confirmationDetails;
 
@@ -573,6 +601,52 @@ export const ToolConfirmationMessage: React.FC<
             />
           );
         }
+      } else if (confirmationDetails.type === 'sandbox_expansion') {
+        const { additionalPermissions } = confirmationDetails;
+        const readPaths = additionalPermissions?.fileSystem?.read || [];
+        const writePaths = additionalPermissions?.fileSystem?.write || [];
+        const network = additionalPermissions?.network;
+
+        bodyContent = (
+          <Box flexDirection="column" padding={1}>
+            <Text color={theme.text.secondary} italic>
+              The agent is requesting additional sandbox permissions to execute
+              this command:
+            </Text>
+            <Box paddingY={1}>
+              <Text color={theme.text.secondary}>
+                {sanitizeForDisplay(confirmationDetails.command)}
+              </Text>
+            </Box>
+            {network && (
+              <Box>
+                <Text color={theme.status.warning}>• Network Access</Text>
+              </Box>
+            )}
+            {readPaths.length > 0 && (
+              <Box flexDirection="column">
+                <Text color={theme.status.success}>• Read Access:</Text>
+                {readPaths.map((p, i) => (
+                  <Text key={i} color={theme.text.secondary}>
+                    {' '}
+                    {sanitizeForDisplay(p)}
+                  </Text>
+                ))}
+              </Box>
+            )}
+            {writePaths.length > 0 && (
+              <Box flexDirection="column">
+                <Text color={theme.status.error}>• Write Access:</Text>
+                {writePaths.map((p, i) => (
+                  <Text key={i} color={theme.text.secondary}>
+                    {' '}
+                    {sanitizeForDisplay(p)}
+                  </Text>
+                ))}
+              </Box>
+            )}
+          </Box>
+        );
       } else if (confirmationDetails.type === 'exec') {
         const executionProps = confirmationDetails;
 
@@ -587,7 +661,8 @@ export const ToolConfirmationMessage: React.FC<
         let bodyContentHeight = availableBodyContentHeight();
         let warnings: React.ReactNode = null;
 
-        if (containsRedirection) {
+        const isAutoEdit = config.getApprovalMode() === ApprovalMode.AUTO_EDIT;
+        if (containsRedirection && !isAutoEdit) {
           // Calculate lines needed for Note and Tip
           const safeWidth = Math.max(terminalWidth, 1);
           const noteLength =
@@ -737,6 +812,7 @@ export const ToolConfirmationMessage: React.FC<
       isTrustedFolder,
       allowPermanentApproval,
       settings,
+      config,
     ]);
 
   const bodyOverflowDirection: 'top' | 'bottom' =

packages/cli/src/ui/contexts/UIStateContext.tsx

@@ -180,6 +180,7 @@ export interface UIState {
   contextFileNames: string[];
   errorCount: number;
   availableTerminalHeight: number | undefined;
+  stableControlsHeight: number;
   mainAreaWidth: number;
   staticAreaMaxItemHeight: number;
   staticExtraHeight: number;

packages/cli/src/ui/layouts/DefaultAppLayout.tsx

@@ -31,6 +31,7 @@ export const DefaultAppLayout: React.FC = () => {
       flexDirection="column"
       width={uiState.terminalWidth}
       height={isAlternateBuffer ? terminalHeight : undefined}
+      paddingBottom={isAlternateBuffer ? 1 : undefined}
       flexShrink={0}
       flexGrow={0}
       overflow="hidden"
@@ -62,6 +63,9 @@ export const DefaultAppLayout: React.FC = () => {
         flexShrink={0}
         flexGrow={0}
         width={uiState.terminalWidth}
+        height={
+          uiState.copyModeEnabled ? uiState.stableControlsHeight : undefined
+        }
       >
         <Notifications />
         <CopyModeWarning />

packages/cli/src/ui/utils/updateCheck.ts

@@ -27,6 +27,7 @@ export interface UpdateInfo {
 export interface UpdateObject {
   message: string;
   update: UpdateInfo;
+  isUpdating?: boolean;
 }
 
 /**

packages/cli/src/utils/handleAutoUpdate.test.ts

@@ -197,7 +197,9 @@ describe('handleAutoUpdate', () => {
 
     expect(updateEventEmitter.emit).toHaveBeenCalledTimes(1);
     expect(updateEventEmitter.emit).toHaveBeenCalledWith('update-received', {
+      ...mockUpdateInfo,
       message: 'An update is available!\nPlease update manually.',
+      isUpdating: false,
     });
     expect(mockSpawn).not.toHaveBeenCalled();
   });
@@ -236,7 +238,9 @@ describe('handleAutoUpdate', () => {
 
     expect(updateEventEmitter.emit).toHaveBeenCalledTimes(1);
     expect(updateEventEmitter.emit).toHaveBeenCalledWith('update-received', {
+      ...mockUpdateInfo,
       message: 'An update is available!\nCannot determine update command.',
+      isUpdating: false,
     });
     expect(mockSpawn).not.toHaveBeenCalled();
   });
@@ -253,7 +257,9 @@ describe('handleAutoUpdate', () => {
 
     expect(updateEventEmitter.emit).toHaveBeenCalledTimes(1);
     expect(updateEventEmitter.emit).toHaveBeenCalledWith('update-received', {
+      ...mockUpdateInfo,
       message: 'An update is available!\nThis is an additional message.',
+      isUpdating: false,
     });
   });
 

packages/cli/src/utils/handleAutoUpdate.ts

@@ -102,17 +102,22 @@ export function handleAutoUpdate(
     combinedMessage += `\n${installationInfo.updateMessage}`;
   }
 
-  updateEventEmitter.emit('update-received', {
-    message: combinedMessage,
-  });
-
   if (
     !installationInfo.updateCommand ||
     !settings.merged.general.enableAutoUpdate
   ) {
+    updateEventEmitter.emit('update-received', {
+      ...info,
+      message: combinedMessage,
+      isUpdating: false,
+    });
     return;
   }
-
+  updateEventEmitter.emit('update-received', {
+    ...info,
+    message: combinedMessage,
+    isUpdating: true,
+  });
   if (_updateInProgress) {
     return;
   }

packages/cli/test-setup.ts

@@ -66,7 +66,10 @@ beforeEach(() => {
           ? stackLines.slice(lastReactFrameIndex + 1).join('\n')
           : stackLines.slice(1).join('\n');
 
-      if (relevantStack.includes('OverflowContext.tsx')) {
+      if (
+        relevantStack.includes('OverflowContext.tsx') ||
+        relevantStack.includes('useTimedMessage.ts')
+      ) {
         return;
       }
 

packages/core/scripts/compile-windows-sandbox.js

@@ -26,15 +26,15 @@ function compileWindowsSandbox() {
 
   const srcHelperPath = path.resolve(
     __dirname,
-    '../src/services/scripts/GeminiSandbox.exe',
+    '../src/sandbox/windows/GeminiSandbox.exe',
   );
   const distHelperPath = path.resolve(
     __dirname,
-    '../dist/src/services/scripts/GeminiSandbox.exe',
+    '../dist/src/sandbox/windows/GeminiSandbox.exe',
   );
   const sourcePath = path.resolve(
     __dirname,
-    '../src/services/scripts/GeminiSandbox.cs',
+    '../src/sandbox/windows/GeminiSandbox.cs',
   );
 
   if (!fs.existsSync(sourcePath)) {

packages/core/src/agents/a2aUtils.test.ts

@@ -403,7 +403,7 @@ describe('a2aUtils', () => {
 
       const output = reassembler.toString();
       expect(output).toBe(
-        'Analyzing...\n\nProcessing...\n\nArtifact (Code):\nprint("Done")',
+        'Analyzing...Processing...\n\nArtifact (Code):\nprint("Done")',
       );
     });
 

packages/core/src/agents/a2aUtils.ts

@@ -16,6 +16,7 @@ import type {
   AgentInterface,
 } from '@a2a-js/sdk';
 import type { SendMessageResult } from './a2a-client-manager.js';
+import type { SubagentActivityItem } from './types.js';
 
 export const AUTH_REQUIRED_MSG = `[Authorization Required] The agent has indicated it requires authorization to proceed. Please follow the agent's instructions.`;
 
@@ -123,17 +124,39 @@ export class A2AResultReassembler {
 
   private pushMessage(message: Message | undefined) {
     if (!message) return;
-    const text = extractPartsText(message.parts, '\n');
+    const text = extractPartsText(message.parts, '');
     if (text && this.messageLog[this.messageLog.length - 1] !== text) {
       this.messageLog.push(text);
     }
   }
 
+  /**
+   * Returns an array of activity items representing the current reassembled state.
+   */
+  toActivityItems(): SubagentActivityItem[] {
+    const isAuthRequired = this.messageLog.includes(AUTH_REQUIRED_MSG);
+    return [
+      isAuthRequired
+        ? {
+            id: 'auth-required',
+            type: 'thought',
+            content: AUTH_REQUIRED_MSG,
+            status: 'running',
+          }
+        : {
+            id: 'pending',
+            type: 'thought',
+            content: 'Working...',
+            status: 'running',
+          },
+    ];
+  }
+
   /**
    * Returns a human-readable string representation of the current reassembled state.
    */
   toString(): string {
-    const joinedMessages = this.messageLog.join('\n\n');
+    const joinedMessages = this.messageLog.join('');
 
     const artifactsOutput = Array.from(this.artifacts.keys())
       .map((id) => {

packages/core/src/agents/agentLoader.test.ts

@@ -242,6 +242,99 @@ Body`);
         /Name must be a valid slug/,
       );
     });
+
+    describe('error formatting and kind inference', () => {
+      it('should only show local agent errors when kind is inferred as local (via kind field)', async () => {
+        const filePath = await writeAgentMarkdown(`---
+kind: local
+name: invalid-local
+# missing description
+---
+Body`);
+        const error = await parseAgentMarkdown(filePath).catch((e) => e);
+        expect(error).toBeInstanceOf(AgentLoadError);
+        expect(error.message).toContain('Validation failed');
+        expect(error.message).toContain('description: Required');
+        expect(error.message).not.toContain('Remote Agent');
+      });
+
+      it('should only show local agent errors when kind is inferred as local (via local-specific keys)', async () => {
+        const filePath = await writeAgentMarkdown(`---
+name: invalid-local
+# missing description
+tools:
+  - run_shell_command
+---
+Body`);
+        const error = await parseAgentMarkdown(filePath).catch((e) => e);
+        expect(error).toBeInstanceOf(AgentLoadError);
+        expect(error.message).toContain('Validation failed');
+        expect(error.message).toContain('description: Required');
+        expect(error.message).not.toContain('Remote Agent');
+      });
+
+      it('should only show remote agent errors when kind is inferred as remote (via kind field)', async () => {
+        const filePath = await writeAgentMarkdown(`---
+kind: remote
+name: invalid-remote
+# missing agent_card_url
+---
+Body`);
+        const error = await parseAgentMarkdown(filePath).catch((e) => e);
+        expect(error).toBeInstanceOf(AgentLoadError);
+        expect(error.message).toContain('Validation failed');
+        expect(error.message).toContain('agent_card_url: Required');
+        expect(error.message).not.toContain('Local Agent');
+      });
+
+      it('should only show remote agent errors when kind is inferred as remote (via remote-specific keys)', async () => {
+        const filePath = await writeAgentMarkdown(`---
+name: invalid-remote
+auth:
+  type: apiKey
+  key: my_key
+# missing agent_card_url
+---
+Body`);
+        const error = await parseAgentMarkdown(filePath).catch((e) => e);
+        expect(error).toBeInstanceOf(AgentLoadError);
+        expect(error.message).toContain('Validation failed');
+        expect(error.message).toContain('agent_card_url: Required');
+        expect(error.message).not.toContain('Local Agent');
+      });
+
+      it('should show errors for both types when kind cannot be inferred', async () => {
+        const filePath = await writeAgentMarkdown(`---
+name: invalid-unknown
+# missing description and missing agent_card_url, no specific keys
+---
+Body`);
+        const error = await parseAgentMarkdown(filePath).catch((e) => e);
+        expect(error).toBeInstanceOf(AgentLoadError);
+        expect(error.message).toContain('Validation failed');
+        expect(error.message).toContain('(Local Agent)');
+        expect(error.message).toContain('(Remote Agent)');
+        expect(error.message).toContain('description: Required');
+        expect(error.message).toContain('agent_card_url: Required');
+      });
+
+      it('should format errors without a stray colon when the path is empty (e.g. strict object with unknown keys)', async () => {
+        const filePath = await writeAgentMarkdown(`---
+kind: local
+name: my-agent
+description: test
+unknown_field: true
+---
+Body`);
+        const error = await parseAgentMarkdown(filePath).catch((e) => e);
+        expect(error).toBeInstanceOf(AgentLoadError);
+        expect(error.message).toContain(
+          "Unrecognized key(s) in object: 'unknown_field'",
+        );
+        expect(error.message).not.toContain(': Unrecognized key(s)');
+        expect(error.message).not.toContain('Required');
+      });
+    });
   });
 
   describe('markdownToAgentDefinition', () => {
@@ -617,7 +710,7 @@ kind: remote
 name: oauth2-agent
 agent_card_url: https://example.com/card
 auth:
-  type: oauth2
+  type: oauth
   client_id: $MY_OAUTH_CLIENT_ID
   scopes:
     - read
@@ -630,7 +723,7 @@ auth:
         kind: 'remote',
         name: 'oauth2-agent',
         auth: {
-          type: 'oauth2',
+          type: 'oauth',
           client_id: '$MY_OAUTH_CLIENT_ID',
           scopes: ['read', 'write'],
         },
@@ -643,7 +736,7 @@ kind: remote
 name: oauth2-full-agent
 agent_card_url: https://example.com/card
 auth:
-  type: oauth2
+  type: oauth
   client_id: my-client-id
   client_secret: my-client-secret
   scopes:
@@ -659,7 +752,7 @@ auth:
         kind: 'remote',
         name: 'oauth2-full-agent',
         auth: {
-          type: 'oauth2',
+          type: 'oauth',
           client_id: 'my-client-id',
           client_secret: 'my-client-secret',
           scopes: ['openid', 'profile'],
@@ -675,7 +768,7 @@ kind: remote
 name: oauth2-minimal-agent
 agent_card_url: https://example.com/card
 auth:
-  type: oauth2
+  type: oauth
 ---
 `);
       const result = await parseAgentMarkdown(filePath);
@@ -684,7 +777,7 @@ auth:
         kind: 'remote',
         name: 'oauth2-minimal-agent',
         auth: {
-          type: 'oauth2',
+          type: 'oauth',
         },
       });
     });
@@ -695,7 +788,7 @@ kind: remote
 name: invalid-oauth2-agent
 agent_card_url: https://example.com/card
 auth:
-  type: oauth2
+  type: oauth
   client_id: my-client
   authorization_url: not-a-valid-url
 ---
@@ -709,7 +802,7 @@ kind: remote
 name: invalid-oauth2-agent
 agent_card_url: https://example.com/card
 auth:
-  type: oauth2
+  type: oauth
   client_id: my-client
   token_url: not-a-valid-url
 ---
@@ -723,7 +816,7 @@ auth:
         name: 'oauth2-convert-agent',
         agent_card_url: 'https://example.com/card',
         auth: {
-          type: 'oauth2' as const,
+          type: 'oauth' as const,
           client_id: '$MY_CLIENT_ID',
           scopes: ['read'],
           authorization_url: 'https://auth.example.com/authorize',
@@ -744,5 +837,24 @@ auth:
         },
       });
     });
+
+    it('should throw an error for an unknown auth type in markdownToAgentDefinition', () => {
+      const markdown = {
+        kind: 'remote' as const,
+        name: 'unknown-auth-agent',
+        agent_card_url: 'https://example.com/card',
+        auth: {
+          type: 'apiKey' as const,
+          key: 'some-key',
+        },
+      };
+
+      // Mutate the object at runtime to bypass TypeScript compile-time checks cleanly
+      Object.assign(markdown.auth, { type: 'some-unknown-type' });
+
+      expect(() => markdownToAgentDefinition(markdown)).toThrow(
+        /Unknown auth type: some-unknown-type/,
+      );
+    });
   });
 });

packages/core/src/agents/agentLoader.ts

@@ -21,79 +21,6 @@ import { isValidToolName } from '../tools/tool-names.js';
 import { FRONTMATTER_REGEX } from '../skills/skillLoader.js';
 import { getErrorMessage } from '../utils/errors.js';
 
-/**
- * DTO for Markdown parsing - represents the structure from frontmatter.
- */
-interface FrontmatterBaseAgentDefinition {
-  name: string;
-  display_name?: string;
-}
-
-interface FrontmatterMCPServerConfig {
-  command?: string;
-  args?: string[];
-  env?: Record<string, string>;
-  cwd?: string;
-  url?: string;
-  http_url?: string;
-  headers?: Record<string, string>;
-  tcp?: string;
-  type?: 'sse' | 'http';
-  timeout?: number;
-  trust?: boolean;
-  description?: string;
-  include_tools?: string[];
-  exclude_tools?: string[];
-}
-
-interface FrontmatterLocalAgentDefinition
-  extends FrontmatterBaseAgentDefinition {
-  kind: 'local';
-  description: string;
-  tools?: string[];
-  mcp_servers?: Record<string, FrontmatterMCPServerConfig>;
-  system_prompt: string;
-  model?: string;
-  temperature?: number;
-  max_turns?: number;
-  timeout_mins?: number;
-}
-
-/**
- * Authentication configuration for remote agents in frontmatter format.
- */
-interface FrontmatterAuthConfig {
-  type: 'apiKey' | 'http' | 'google-credentials' | 'oauth2';
-  // API Key
-  key?: string;
-  name?: string;
-  // HTTP
-  scheme?: string;
-  token?: string;
-  username?: string;
-  password?: string;
-  value?: string;
-  // Google Credentials
-  scopes?: string[];
-  // OAuth2
-  client_id?: string;
-  client_secret?: string;
-  authorization_url?: string;
-  token_url?: string;
-}
-
-interface FrontmatterRemoteAgentDefinition
-  extends FrontmatterBaseAgentDefinition {
-  kind: 'remote';
-  description?: string;
-  agent_card_url: string;
-  auth?: FrontmatterAuthConfig;
-}
-
-type FrontmatterAgentDefinition =
-  | FrontmatterLocalAgentDefinition
-  | FrontmatterRemoteAgentDefinition;
-
 /**
  * Error thrown when an agent definition is invalid or cannot be loaded.
  */
@@ -159,15 +86,13 @@ const localAgentSchema = z
   })
   .strict();
 
-/**
- * Base fields shared by all auth configs.
- */
+type FrontmatterLocalAgentDefinition = z.infer<typeof localAgentSchema> & {
+  system_prompt: string;
+};
+
+// Base fields shared by all auth configs.
 const baseAuthFields = {};
 
-/**
- * API Key auth schema.
- * Supports sending key in header, query parameter, or cookie.
- */
 const apiKeyAuthSchema = z.object({
   ...baseAuthFields,
   type: z.literal('apiKey'),
@@ -175,11 +100,6 @@ const apiKeyAuthSchema = z.object({
   name: z.string().optional(),
 });
 
-/**
- * HTTP auth schema (Bearer or Basic).
- * Note: Validation for scheme-specific fields is applied in authConfigSchema
- * since discriminatedUnion doesn't support refined schemas directly.
- */
 const httpAuthSchema = z.object({
   ...baseAuthFields,
   type: z.literal('http'),
@@ -190,22 +110,15 @@ const httpAuthSchema = z.object({
   value: z.string().min(1).optional(),
 });
 
-/**
- * Google Credentials auth schema.
- */
 const googleCredentialsAuthSchema = z.object({
   ...baseAuthFields,
   type: z.literal('google-credentials'),
   scopes: z.array(z.string()).optional(),
 });
 
-/**
- * OAuth2 auth schema.
- * authorization_url and token_url can be discovered from the agent card if omitted.
- */
 const oauth2AuthSchema = z.object({
   ...baseAuthFields,
-  type: z.literal('oauth2'),
+  type: z.literal('oauth'),
   client_id: z.string().optional(),
   client_secret: z.string().optional(),
   scopes: z.array(z.string()).optional(),
@@ -222,18 +135,16 @@ const authConfigSchema = z
   ])
   .superRefine((data, ctx) => {
     if (data.type === 'http') {
-      if (data.value) {
-        // Raw mode - only scheme and value are needed
-        return;
-      }
-      if (data.scheme === 'Bearer' && !data.token) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: 'Bearer scheme requires "token"',
-          path: ['token'],
-        });
-      }
-      if (data.scheme === 'Basic') {
+      if (data.value) return;
+      if (data.scheme === 'Bearer') {
+        if (!data.token) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'Bearer scheme requires "token"',
+            path: ['token'],
+          });
+        }
+      } else if (data.scheme === 'Basic') {
         if (!data.username) {
           ctx.addIssue({
             code: z.ZodIssueCode.custom,
@@ -248,10 +159,18 @@ const authConfigSchema = z
             path: ['password'],
           });
         }
+      } else {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: `HTTP scheme "${data.scheme}" requires "value"`,
+          path: ['value'],
+        });
       }
     }
   });
 
+type FrontmatterAuthConfig = z.infer<typeof authConfigSchema>;
+
 const remoteAgentSchema = z
   .object({
     kind: z.literal('remote').optional().default('remote'),
@@ -263,8 +182,12 @@ const remoteAgentSchema = z
   })
   .strict();
 
-// Use a Zod union to automatically discriminate between local and remote
-// agent types.
+type FrontmatterRemoteAgentDefinition = z.infer<typeof remoteAgentSchema>;
+
+type FrontmatterAgentDefinition =
+  | FrontmatterLocalAgentDefinition
+  | FrontmatterRemoteAgentDefinition;
+
 const agentUnionOptions = [
   { schema: localAgentSchema, label: 'Local Agent' },
   { schema: remoteAgentSchema, label: 'Remote Agent' },
@@ -277,23 +200,62 @@ const markdownFrontmatterSchema = z.union([
   agentUnionOptions[1].schema,
 ]);
 
-function formatZodError(error: z.ZodError, context: string): string {
+function guessIntendedKind(rawInput: unknown): 'local' | 'remote' | undefined {
+  if (typeof rawInput !== 'object' || rawInput === null) return undefined;
+  const input = rawInput as Partial<FrontmatterLocalAgentDefinition> &
+    Partial<FrontmatterRemoteAgentDefinition>;
+
+  if (input.kind === 'local') return 'local';
+  if (input.kind === 'remote') return 'remote';
+
+  const hasLocalKeys =
+    'tools' in input ||
+    'mcp_servers' in input ||
+    'model' in input ||
+    'temperature' in input ||
+    'max_turns' in input ||
+    'timeout_mins' in input;
+  const hasRemoteKeys = 'agent_card_url' in input || 'auth' in input;
+
+  if (hasLocalKeys && !hasRemoteKeys) return 'local';
+  if (hasRemoteKeys && !hasLocalKeys) return 'remote';
+
+  return undefined;
+}
+
+function formatZodError(
+  error: z.ZodError,
+  context: string,
+  rawInput?: unknown,
+): string {
+  const intendedKind = rawInput ? guessIntendedKind(rawInput) : undefined;
+
   const issues = error.issues
     .map((i) => {
-      // Handle union errors specifically to give better context
       if (i.code === z.ZodIssueCode.invalid_union) {
         return i.unionErrors
           .map((unionError, index) => {
             const label =
               agentUnionOptions[index]?.label ?? `Agent type #${index + 1}`;
+
+            if (intendedKind === 'local' && label === 'Remote Agent')
+              return null;
+            if (intendedKind === 'remote' && label === 'Local Agent')
+              return null;
+
             const unionIssues = unionError.issues
-              .map((u) => `${u.path.join('.')}: ${u.message}`)
+              .map((u) => {
+                const pathStr = u.path.join('.');
+                return pathStr ? `${pathStr}: ${u.message}` : u.message;
+              })
               .join(', ');
             return `(${label}) ${unionIssues}`;
           })
+          .filter(Boolean)
           .join('\n');
       }
-      return `${i.path.join('.')}: ${i.message}`;
+      const pathStr = i.path.join('.');
+      return pathStr ? `${pathStr}: ${i.message}` : i.message;
     })
     .join('\n');
   return `${context}:\n${issues}`;
@@ -343,8 +305,7 @@ export async function parseAgentMarkdown(
   } catch (error) {
     throw new AgentLoadError(
       filePath,
-      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
-      `YAML frontmatter parsing failed: ${(error as Error).message}`,
+      `YAML frontmatter parsing failed: ${getErrorMessage(error)}`,
     );
   }
 
@@ -368,7 +329,7 @@ export async function parseAgentMarkdown(
   if (!result.success) {
     throw new AgentLoadError(
       filePath,
-      `Validation failed: ${formatZodError(result.error, 'Agent Definition')}`,
+      `Validation failed: ${formatZodError(result.error, 'Agent Definition', rawFrontmatter)}`,
     );
   }
 
@@ -383,17 +344,14 @@ export async function parseAgentMarkdown(
     ];
   }
 
-  // Local agent validation
-  // Validate tools
-
   // Construct the local agent definition
-  const agentDef: FrontmatterLocalAgentDefinition = {
-    ...frontmatter,
-    kind: 'local',
-    system_prompt: body.trim(),
-  };
-
-  return [agentDef];
+  return [
+    {
+      ...frontmatter,
+      kind: 'local',
+      system_prompt: body.trim(),
+    },
+  ];
 }
 
 /**
@@ -403,15 +361,9 @@ export async function parseAgentMarkdown(
 function convertFrontmatterAuthToConfig(
   frontmatter: FrontmatterAuthConfig,
 ): A2AAuthConfig {
-  const base = {};
-
   switch (frontmatter.type) {
     case 'apiKey':
-      if (!frontmatter.key) {
-        throw new Error('Internal error: API key missing after validation.');
-      }
       return {
-        ...base,
         type: 'apiKey',
         key: frontmatter.key,
         name: frontmatter.name,
@@ -419,20 +371,13 @@ function convertFrontmatterAuthToConfig(
 
     case 'google-credentials':
       return {
-        ...base,
         type: 'google-credentials',
         scopes: frontmatter.scopes,
       };
 
-    case 'http': {
-      if (!frontmatter.scheme) {
-        throw new Error(
-          'Internal error: HTTP scheme missing after validation.',
-        );
-      }
+    case 'http':
       if (frontmatter.value) {
         return {
-          ...base,
           type: 'http',
           scheme: frontmatter.scheme,
           value: frontmatter.value,
@@ -440,40 +385,29 @@ function convertFrontmatterAuthToConfig(
       }
       switch (frontmatter.scheme) {
         case 'Bearer':
-          if (!frontmatter.token) {
-            throw new Error(
-              'Internal error: Bearer token missing after validation.',
-            );
-          }
+          // Token is required by schema validation
           return {
-            ...base,
             type: 'http',
             scheme: 'Bearer',
-            token: frontmatter.token,
+
+            token: frontmatter.token!,
           };
         case 'Basic':
-          if (!frontmatter.username || !frontmatter.password) {
-            throw new Error(
-              'Internal error: Basic auth credentials missing after validation.',
-            );
-          }
+          // Username/password are required by schema validation
           return {
-            ...base,
             type: 'http',
             scheme: 'Basic',
-            username: frontmatter.username,
-            password: frontmatter.password,
-          };
-        default: {
-          // Other IANA schemes without a value should not reach here after validation
-          throw new Error(`Unknown HTTP scheme: ${frontmatter.scheme}`);
-        }
-      }
-    }
 
-    case 'oauth2':
+            username: frontmatter.username!,
+
+            password: frontmatter.password!,
+          };
+        default:
+          throw new Error(`Unknown HTTP scheme: ${frontmatter.scheme}`);
+      }
+
+    case 'oauth':
       return {
-        ...base,
         type: 'oauth2',
         client_id: frontmatter.client_id,
         client_secret: frontmatter.client_secret,
@@ -483,8 +417,12 @@ function convertFrontmatterAuthToConfig(
       };
 
     default: {
-      const exhaustive: never = frontmatter.type;
-      throw new Error(`Unknown auth type: ${exhaustive}`);
+      const exhaustive: never = frontmatter;
+      const raw: unknown = exhaustive;
+      if (typeof raw === 'object' && raw !== null && 'type' in raw) {
+        throw new Error(`Unknown auth type: ${String(raw['type'])}`);
+      }
+      throw new Error('Unknown auth type');
     }
   }
 }
@@ -533,7 +471,7 @@ export function markdownToAgentDefinition(
   const modelName = markdown.model || 'inherit';
 
   const mcpServers: Record<string, MCPServerConfig> = {};
-  if (markdown.kind === 'local' && markdown.mcp_servers) {
+  if (markdown.mcp_servers) {
     for (const [name, config] of Object.entries(markdown.mcp_servers)) {
       mcpServers[name] = new MCPServerConfig(
         config.command,
@@ -606,15 +544,13 @@ export async function loadAgentsFromDirectory(
     dirEntries = await fs.readdir(dir, { withFileTypes: true });
   } catch (error) {
     // If directory doesn't exist, just return empty
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
       return result;
     }
     result.errors.push(
       new AgentLoadError(
         dir,
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
-        `Could not list directory: ${(error as Error).message}`,
+        `Could not list directory: ${getErrorMessage(error)}`,
       ),
     );
     return result;
@@ -644,8 +580,7 @@ export async function loadAgentsFromDirectory(
         result.errors.push(
           new AgentLoadError(
             filePath,
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
-            `Unexpected error: ${(error as Error).message}`,
+            `Unexpected error: ${getErrorMessage(error)}`,
           ),
         );
       }

packages/core/src/agents/browser/browserAgentDefinition.ts

@@ -112,6 +112,7 @@ Some errors are unrecoverable and retrying will never help. When you see ANY of
 - "Could not connect to Chrome" or "Failed to connect to Chrome" or "Timed out connecting to Chrome" — Include the full error message with its remediation steps in your summary verbatim. Do NOT paraphrase or omit instructions.
 - "Browser closed" or "Target closed" or "Session closed" — The browser process has terminated. Include the error and tell the user to try again.
 - "net::ERR_" network errors on the SAME URL after 2 retries — the site is unreachable. Report the URL and error.
+- "reached maximum action limit" — You have performed too many actions in this task. Stop immediately and report this limit to the user.
 - Any error that appears IDENTICALLY 3+ times in a row — it will not resolve by retrying.
 Do NOT keep retrying terminal errors. Report them with actionable remediation steps and exit immediately.
 

packages/core/src/agents/browser/browserManager.test.ts

@@ -697,4 +697,28 @@ describe('BrowserManager', () => {
       expect(injectAutomationOverlay).not.toHaveBeenCalled();
     });
   });
+
+  describe('Rate limiting', () => {
+    it('should terminate task when maxActionsPerTask is reached', async () => {
+      const limitedConfig = makeFakeConfig({
+        agents: {
+          browser: {
+            maxActionsPerTask: 3,
+          },
+        },
+      });
+      const manager = new BrowserManager(limitedConfig);
+
+      // First 3 calls should succeed
+      await manager.callTool('take_snapshot', {});
+      await manager.callTool('take_snapshot', { some: 'args' });
+      await manager.callTool('take_snapshot', { other: 'args' });
+      await manager.callTool('take_snapshot', { other: 'new args' });
+
+      // 4th call should throw
+      await expect(manager.callTool('take_snapshot', {})).rejects.toThrow(
+        /maximum action limit \(3\)/,
+      );
+    });
+  });
 });

packages/core/src/agents/browser/browserManager.ts

@@ -97,6 +97,10 @@ export class BrowserManager {
   private mcpTransport: StdioClientTransport | undefined;
   private discoveredTools: McpTool[] = [];
 
+  /** State for action rate limiting */
+  private actionCounter = 0;
+  private readonly maxActionsPerTask: number;
+
   /**
    * Whether to inject the automation overlay.
    * Always false in headless mode (no visible window to decorate).
@@ -108,6 +112,8 @@ export class BrowserManager {
     const browserConfig = config.getBrowserAgentConfig();
     this.shouldInjectOverlay = !browserConfig?.customConfig?.headless;
     this.shouldDisableInput = config.shouldDisableBrowserUserInput();
+    this.maxActionsPerTask =
+      browserConfig?.customConfig.maxActionsPerTask ?? 100;
   }
 
   /**
@@ -151,6 +157,16 @@ export class BrowserManager {
       throw signal.reason ?? new Error('Operation cancelled');
     }
 
+    // Hard enforcement of per-action rate limit
+    if (this.actionCounter > this.maxActionsPerTask) {
+      const error = new Error(
+        `Browser agent reached maximum action limit (${this.maxActionsPerTask}). ` +
+          `Task terminated to prevent runaway execution. To config the limit, use maxActionsPerTask in the settings.`,
+      );
+      throw error;
+    }
+    this.actionCounter++;
+
     const errorMessage = this.checkNavigationRestrictions(toolName, args);
     if (errorMessage) {
       return {

packages/core/src/agents/remote-invocation.test.ts

@@ -20,7 +20,7 @@ import {
   type A2AClientManager,
 } from './a2a-client-manager.js';
 
-import type { RemoteAgentDefinition } from './types.js';
+import type { RemoteAgentDefinition, SubagentProgress } from './types.js';
 import { createMockMessageBus } from '../test-utils/mock-message-bus.js';
 import { A2AAuthProviderFactory } from './auth-provider/factory.js';
 import type { A2AAuthProvider } from './auth-provider/types.js';
@@ -266,9 +266,11 @@ describe('RemoteAgentInvocation', () => {
       );
       const result = await invocation.execute(new AbortController().signal);
 
-      expect(result.error?.message).toContain(
-        "Failed to create auth provider for agent 'test-agent'",
-      );
+      expect(result.returnDisplay).toMatchObject({
+        result: expect.stringContaining(
+          "Failed to create auth provider for agent 'test-agent'",
+        ),
+      });
     });
 
     it('should not load the agent if already present', async () => {
@@ -325,7 +327,9 @@ describe('RemoteAgentInvocation', () => {
 
       // Execute first time
       const result1 = await invocation1.execute(new AbortController().signal);
-      expect(result1.returnDisplay).toBe('Response 1');
+      expect(result1.returnDisplay).toMatchObject({
+        result: 'Response 1',
+      });
       expect(mockClientManager.sendMessageStream).toHaveBeenLastCalledWith(
         'test-agent',
         'first',
@@ -355,7 +359,9 @@ describe('RemoteAgentInvocation', () => {
         mockMessageBus,
       );
       const result2 = await invocation2.execute(new AbortController().signal);
-      expect(result2.returnDisplay).toBe('Response 2');
+      expect((result2.returnDisplay as SubagentProgress).result).toBe(
+        'Response 2',
+      );
 
       expect(mockClientManager.sendMessageStream).toHaveBeenLastCalledWith(
         'test-agent',
@@ -444,8 +450,22 @@ describe('RemoteAgentInvocation', () => {
       );
       await invocation.execute(new AbortController().signal, updateOutput);
 
-      expect(updateOutput).toHaveBeenCalledWith('Hello');
-      expect(updateOutput).toHaveBeenCalledWith('Hello\n\nHello World');
+      expect(updateOutput).toHaveBeenCalledWith(
+        expect.objectContaining({
+          isSubagentProgress: true,
+          state: 'running',
+          recentActivity: expect.arrayContaining([
+            expect.objectContaining({ content: 'Working...' }),
+          ]),
+        }),
+      );
+      expect(updateOutput).toHaveBeenCalledWith(
+        expect.objectContaining({
+          isSubagentProgress: true,
+          state: 'completed',
+          result: 'HelloHello World',
+        }),
+      );
     });
 
     it('should abort when signal is aborted during streaming', async () => {
@@ -478,8 +498,7 @@ describe('RemoteAgentInvocation', () => {
       );
       const result = await invocation.execute(controller.signal);
 
-      expect(result.error).toBeDefined();
-      expect(result.error?.message).toContain('Operation aborted');
+      expect(result.returnDisplay).toMatchObject({ state: 'error' });
     });
 
     it('should handle errors gracefully', async () => {
@@ -501,9 +520,10 @@ describe('RemoteAgentInvocation', () => {
       );
       const result = await invocation.execute(new AbortController().signal);
 
-      expect(result.error).toBeDefined();
-      expect(result.error?.message).toContain('Network error');
-      expect(result.returnDisplay).toContain('Network error');
+      expect(result.returnDisplay).toMatchObject({
+        state: 'error',
+        result: expect.stringContaining('Network error'),
+      });
     });
 
     it('should use a2a helpers for extracting text', async () => {
@@ -534,7 +554,9 @@ describe('RemoteAgentInvocation', () => {
       const result = await invocation.execute(new AbortController().signal);
 
       // Just check that text is present, exact formatting depends on helper
-      expect(result.returnDisplay).toContain('Extracted text');
+      expect((result.returnDisplay as SubagentProgress).result).toContain(
+        'Extracted text',
+      );
     });
 
     it('should handle mixed response types during streaming (TaskStatusUpdateEvent + Message)', async () => {
@@ -577,9 +599,25 @@ describe('RemoteAgentInvocation', () => {
         updateOutput,
       );
 
-      expect(updateOutput).toHaveBeenCalledWith('Thinking...');
-      expect(updateOutput).toHaveBeenCalledWith('Thinking...\n\nFinal Answer');
-      expect(result.returnDisplay).toBe('Thinking...\n\nFinal Answer');
+      expect(updateOutput).toHaveBeenCalledWith(
+        expect.objectContaining({
+          isSubagentProgress: true,
+          state: 'running',
+          recentActivity: expect.arrayContaining([
+            expect.objectContaining({ content: 'Working...' }),
+          ]),
+        }),
+      );
+      expect(updateOutput).toHaveBeenCalledWith(
+        expect.objectContaining({
+          isSubagentProgress: true,
+          state: 'completed',
+          result: 'Thinking...Final Answer',
+        }),
+      );
+      expect(result.returnDisplay).toMatchObject({
+        result: 'Thinking...Final Answer',
+      });
     });
 
     it('should handle artifact reassembly with append: true', async () => {
@@ -635,12 +673,21 @@ describe('RemoteAgentInvocation', () => {
       );
       await invocation.execute(new AbortController().signal, updateOutput);
 
-      expect(updateOutput).toHaveBeenCalledWith('Generating...');
       expect(updateOutput).toHaveBeenCalledWith(
-        'Generating...\n\nArtifact (Result):\nPart 1',
+        expect.objectContaining({
+          isSubagentProgress: true,
+          state: 'running',
+          recentActivity: expect.arrayContaining([
+            expect.objectContaining({ content: 'Working...' }),
+          ]),
+        }),
       );
       expect(updateOutput).toHaveBeenCalledWith(
-        'Generating...\n\nArtifact (Result):\nPart 1 Part 2',
+        expect.objectContaining({
+          isSubagentProgress: true,
+          state: 'completed',
+          result: 'Generating...\n\nArtifact (Result):\nPart 1 Part 2',
+        }),
       );
     });
   });
@@ -694,8 +741,10 @@ describe('RemoteAgentInvocation', () => {
       );
       const result = await invocation.execute(new AbortController().signal);
 
-      expect(result.error).toBeDefined();
-      expect(result.returnDisplay).toContain(a2aError.userMessage);
+      expect(result.returnDisplay).toMatchObject({ state: 'error' });
+      expect((result.returnDisplay as SubagentProgress).result).toContain(
+        a2aError.userMessage,
+      );
     });
 
     it('should use generic message for non-A2AAgentError errors', async () => {
@@ -712,8 +761,8 @@ describe('RemoteAgentInvocation', () => {
       );
       const result = await invocation.execute(new AbortController().signal);
 
-      expect(result.error).toBeDefined();
-      expect(result.returnDisplay).toContain(
+      expect(result.returnDisplay).toMatchObject({ state: 'error' });
+      expect((result.returnDisplay as SubagentProgress).result).toContain(
         'Error calling remote agent: something unexpected',
       );
     });
@@ -741,10 +790,14 @@ describe('RemoteAgentInvocation', () => {
       );
       const result = await invocation.execute(new AbortController().signal);
 
-      expect(result.error).toBeDefined();
+      expect(result.returnDisplay).toMatchObject({ state: 'error' });
       // Should contain both the partial output and the error message
-      expect(result.returnDisplay).toContain('Partial response');
-      expect(result.returnDisplay).toContain('connection reset');
+      expect(result.returnDisplay).toMatchObject({
+        result: expect.stringContaining('Partial response'),
+      });
+      expect(result.returnDisplay).toMatchObject({
+        result: expect.stringContaining('connection reset'),
+      });
     });
   });
 });

packages/core/src/agents/remote-invocation.ts

@@ -15,6 +15,7 @@ import {
   type RemoteAgentInputs,
   type RemoteAgentDefinition,
   type AgentInputs,
+  type SubagentProgress,
 } from './types.js';
 import { type AgentLoopContext } from '../config/agent-loop-context.js';
 import type { MessageBus } from '../confirmation-bus/message-bus.js';
@@ -25,7 +26,6 @@ import type {
 import { extractIdsFromResponse, A2AResultReassembler } from './a2aUtils.js';
 import type { AuthenticationHandler } from '@a2a-js/sdk/client';
 import { debugLogger } from '../utils/debugLogger.js';
-import { safeJsonToMarkdown } from '../utils/markdownUtils.js';
 import type { AnsiOutput } from '../utils/terminalSerializer.js';
 import { A2AAuthProviderFactory } from './auth-provider/factory.js';
 import { A2AAgentError } from './a2a-errors.js';
@@ -125,13 +125,30 @@ export class RemoteAgentInvocation extends BaseToolInvocation<
 
   async execute(
     _signal: AbortSignal,
-    updateOutput?: (output: string | AnsiOutput) => void,
+    updateOutput?: (output: string | AnsiOutput | SubagentProgress) => void,
   ): Promise<ToolResult> {
     // 1. Ensure the agent is loaded (cached by manager)
     // We assume the user has provided an access token via some mechanism (TODO),
     // or we rely on ADC.
     const reassembler = new A2AResultReassembler();
+    const agentName = this.definition.displayName ?? this.definition.name;
     try {
+      if (updateOutput) {
+        updateOutput({
+          isSubagentProgress: true,
+          agentName,
+          state: 'running',
+          recentActivity: [
+            {
+              id: 'pending',
+              type: 'thought',
+              content: 'Working...',
+              status: 'running',
+            },
+          ],
+        });
+      }
+
       const priorState = RemoteAgentInvocation.sessionState.get(
         this.definition.name,
       );
@@ -172,7 +189,13 @@ export class RemoteAgentInvocation extends BaseToolInvocation<
         reassembler.update(chunk);
 
         if (updateOutput) {
-          updateOutput(reassembler.toString());
+          updateOutput({
+            isSubagentProgress: true,
+            agentName,
+            state: 'running',
+            recentActivity: reassembler.toActivityItems(),
+            result: reassembler.toString(),
+          });
         }
 
         const {
@@ -198,9 +221,21 @@ export class RemoteAgentInvocation extends BaseToolInvocation<
         `[RemoteAgent] Final response from ${this.definition.name}:\n${JSON.stringify(finalResponse, null, 2)}`,
       );
 
+      const finalProgress: SubagentProgress = {
+        isSubagentProgress: true,
+        agentName,
+        state: 'completed',
+        result: finalOutput,
+        recentActivity: reassembler.toActivityItems(),
+      };
+
+      if (updateOutput) {
+        updateOutput(finalProgress);
+      }
+
       return {
         llmContent: [{ text: finalOutput }],
-        returnDisplay: safeJsonToMarkdown(finalOutput),
+        returnDisplay: finalProgress,
       };
     } catch (error: unknown) {
       const partialOutput = reassembler.toString();
@@ -209,10 +244,22 @@ export class RemoteAgentInvocation extends BaseToolInvocation<
       const fullDisplay = partialOutput
         ? `${partialOutput}\n\n${errorMessage}`
         : errorMessage;
+
+      const errorProgress: SubagentProgress = {
+        isSubagentProgress: true,
+        agentName,
+        state: 'error',
+        result: fullDisplay,
+        recentActivity: reassembler.toActivityItems(),
+      };
+
+      if (updateOutput) {
+        updateOutput(errorProgress);
+      }
+
       return {
         llmContent: [{ text: fullDisplay }],
-        returnDisplay: fullDisplay,
-        error: { message: errorMessage },
+        returnDisplay: errorProgress,
       };
     } finally {
       // Persist state even on partial failures or aborts to maintain conversational continuity.

packages/core/src/code_assist/setup.test.ts

@@ -15,8 +15,20 @@ import { CodeAssistServer } from '../code_assist/server.js';
 import type { OAuth2Client } from 'google-auth-library';
 import { UserTierId, type GeminiUserTier } from './types.js';
 import type { Config } from '../config/config.js';
+import {
+  logOnboardingSuccess,
+  OnboardingSuccessEvent,
+} from '../telemetry/index.js';
 
 vi.mock('../code_assist/server.js');
+vi.mock('../telemetry/index.js', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../telemetry/index.js')>();
+  return {
+    ...actual,
+    logOnboardingStart: vi.fn(),
+    logOnboardingSuccess: vi.fn(),
+  };
+});
 
 const mockPaidTier: GeminiUserTier = {
   id: UserTierId.STANDARD,
@@ -214,7 +226,20 @@ describe('setupUser', () => {
       mockLoad.mockResolvedValue({
         allowedTiers: [mockPaidTier],
       });
-      const userData = await setupUser({} as OAuth2Client, mockConfig);
+      mockOnboardUser.mockImplementation(async () => {
+        await new Promise((resolve) => setTimeout(resolve, 1500));
+        return {
+          done: true,
+          response: {
+            cloudaicompanionProject: {
+              id: 'server-project',
+            },
+          },
+        };
+      });
+      const userDataPromise = setupUser({} as OAuth2Client, mockConfig);
+      await vi.advanceTimersByTimeAsync(1500);
+      const userData = await userDataPromise;
       expect(mockOnboardUser).toHaveBeenCalledWith(
         expect.objectContaining({
           tierId: UserTierId.STANDARD,
@@ -227,6 +252,13 @@ describe('setupUser', () => {
         userTierName: 'paid',
         hasOnboardedPreviously: false,
       });
+      expect(logOnboardingSuccess).toHaveBeenCalledWith(
+        mockConfig,
+        expect.any(OnboardingSuccessEvent),
+      );
+      const event = vi.mocked(logOnboardingSuccess).mock.calls[0][1];
+      expect(event.userTier).toBe('paid');
+      expect(event.duration_ms).toBeGreaterThanOrEqual(1500);
     });
 
     it('should onboard a new free user when project ID is not set', async () => {

packages/core/src/code_assist/setup.ts

@@ -251,6 +251,7 @@ async function _doSetupUser(
   }
 
   logOnboardingStart(config, new OnboardingStartEvent());
+  const onboardingStartTime = Date.now();
 
   let lroRes = await caServer.onboardUser(onboardReq);
   if (!lroRes.done && lroRes.name) {
@@ -261,8 +262,10 @@ async function _doSetupUser(
     }
   }
 
-  const userTier = tier.id ?? UserTierId.STANDARD;
-  logOnboardingSuccess(config, new OnboardingSuccessEvent(userTier));
+  logOnboardingSuccess(
+    config,
+    new OnboardingSuccessEvent(tier.name, Date.now() - onboardingStartTime),
+  );
 
   if (!lroRes.response?.cloudaicompanionProject?.id) {
     if (projectId) {

packages/core/src/config/config.test.ts

@@ -1474,6 +1474,22 @@ describe('Server Config (config.ts)', () => {
       expect(browserConfig.customConfig.visualModel).toBe(
         'custom-visual-model',
       );
+      expect(browserConfig.customConfig.maxActionsPerTask).toBe(100); // default
+    });
+
+    it('should return custom maxActionsPerTask', () => {
+      const params: ConfigParameters = {
+        ...baseParams,
+        agents: {
+          browser: {
+            maxActionsPerTask: 50,
+          },
+        },
+      };
+      const config = new Config(params);
+      const browserConfig = config.getBrowserAgentConfig();
+
+      expect(browserConfig.customConfig.maxActionsPerTask).toBe(50);
     });
 
     it('should apply defaults for partial custom config', () => {

packages/core/src/config/config.ts

@@ -6,6 +6,7 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { SandboxPolicyManager } from '../policy/sandboxPolicyManager.js';
 import { inspect } from 'node:util';
 import process from 'node:process';
 import { z } from 'zod';
@@ -330,6 +331,8 @@ export interface BrowserAgentCustomConfig {
   allowedDomains?: string[];
   /** Disable user input on the browser window during automation. Default: true in non-headless mode */
   disableUserInput?: boolean;
+  /** Maximum number of actions (tool calls) allowed per task. Default: 100 */
+  maxActionsPerTask?: number;
   /** Whether to confirm sensitive actions (e.g., fill_form, evaluate_script). */
   confirmSensitiveActions?: boolean;
   /** Whether to block file uploads. */
@@ -730,7 +733,8 @@ export class Config implements McpContext, AgentLoopContext {
   private readonly telemetrySettings: TelemetrySettings;
   private readonly usageStatisticsEnabled: boolean;
   private _geminiClient!: GeminiClient;
-  private readonly _sandboxManager: SandboxManager;
+  private _sandboxManager: SandboxManager;
+  private readonly _sandboxPolicyManager: SandboxPolicyManager;
   private baseLlmClient!: BaseLlmClient;
   private localLiteRtLmClient?: LocalLiteRtLmClient;
   private modelRouterService: ModelRouterService;
@@ -905,14 +909,14 @@ export class Config implements McpContext, AgentLoopContext {
       params.embeddingModel ?? DEFAULT_GEMINI_EMBEDDING_MODEL;
     this.sandbox = params.sandbox
       ? {
-          enabled: params.sandbox.enabled ?? false,
+          enabled: params.sandbox.enabled || params.toolSandboxing || false,
           allowedPaths: params.sandbox.allowedPaths ?? [],
           networkAccess: params.sandbox.networkAccess ?? false,
           command: params.sandbox.command,
           image: params.sandbox.image,
         }
       : {
-          enabled: false,
+          enabled: params.toolSandboxing || false,
           allowedPaths: [],
           networkAccess: false,
         };
@@ -931,6 +935,30 @@ export class Config implements McpContext, AgentLoopContext {
       this.fileSystemService = new StandardFileSystemService();
     }
 
+    this._sandboxPolicyManager = new SandboxPolicyManager();
+    const initialApprovalMode =
+      params.approvalMode ??
+      params.policyEngineConfig?.approvalMode ??
+      'default';
+    this._sandboxManager = createSandboxManager(
+      this.sandbox,
+      params.targetDir,
+      this._sandboxPolicyManager,
+      initialApprovalMode,
+    );
+
+    if (
+      !(this._sandboxManager instanceof NoopSandboxManager) &&
+      this.sandbox?.enabled
+    ) {
+      this.fileSystemService = new SandboxedFileSystemService(
+        this._sandboxManager,
+        params.targetDir,
+      );
+    } else {
+      this.fileSystemService = new StandardFileSystemService();
+    }
+
     this.targetDir = path.resolve(params.targetDir);
     this.folderTrust = params.folderTrust ?? false;
     this.workspaceContext = new WorkspaceContext(this.targetDir, []);
@@ -1001,7 +1029,7 @@ export class Config implements McpContext, AgentLoopContext {
     this.model = params.model;
     this.disableLoopDetection = params.disableLoopDetection ?? false;
     this._activeModel = params.model;
-    this.enableAgents = params.enableAgents ?? false;
+    this.enableAgents = params.enableAgents ?? true;
     this.agents = params.agents ?? {};
     this.disableLLMCorrection = params.disableLLMCorrection ?? true;
     this.planEnabled = params.plan ?? true;
@@ -1160,12 +1188,19 @@ export class Config implements McpContext, AgentLoopContext {
       params.policyUpdateConfirmationRequest;
 
     this.disableAlwaysAllow = params.disableAlwaysAllow ?? false;
+    const engineApprovalMode =
+      params.approvalMode ??
+      params.policyEngineConfig?.approvalMode ??
+      ApprovalMode.DEFAULT;
     this.policyEngine = new PolicyEngine(
       {
         ...params.policyEngineConfig,
-        approvalMode:
-          params.approvalMode ?? params.policyEngineConfig?.approvalMode,
+        approvalMode: engineApprovalMode,
         disableAlwaysAllow: this.disableAlwaysAllow,
+        toolSandboxEnabled: this.getSandboxEnabled(),
+        sandboxApprovedTools:
+          this.sandboxPolicyManager?.getModeConfig(engineApprovalMode)
+            ?.approvedTools ?? [],
       },
       checkerRunner,
     );
@@ -1560,6 +1595,20 @@ export class Config implements McpContext, AgentLoopContext {
     return this._geminiClient;
   }
 
+  private refreshSandboxManager(): void {
+    this._sandboxManager = createSandboxManager(
+      this.sandbox,
+      this.targetDir,
+      this._sandboxPolicyManager,
+      this.getApprovalMode(),
+    );
+    this.shellExecutionConfig.sandboxManager = this._sandboxManager;
+  }
+
+  get sandboxPolicyManager() {
+    return this._sandboxPolicyManager;
+  }
+
   get sandboxManager(): SandboxManager {
     return this._sandboxManager;
   }
@@ -2288,6 +2337,10 @@ export class Config implements McpContext, AgentLoopContext {
     return this.policyEngine.getApprovalMode();
   }
 
+  isPlanMode(): boolean {
+    return this.getApprovalMode() === ApprovalMode.PLAN;
+  }
+
   getPolicyUpdateConfirmationRequest():
     | PolicyUpdateConfirmationRequest
     | undefined {
@@ -2339,7 +2392,11 @@ export class Config implements McpContext, AgentLoopContext {
       );
     }
 
-    this.policyEngine.setApprovalMode(mode);
+    this.policyEngine.setApprovalMode(
+      mode,
+      this.sandboxPolicyManager?.getModeConfig(mode)?.approvedTools ?? [],
+    );
+    this.refreshSandboxManager();
 
     const isPlanModeTransition =
       currentMode !== mode &&
@@ -3139,6 +3196,7 @@ export class Config implements McpContext, AgentLoopContext {
         visualModel: customConfig.visualModel,
         allowedDomains: customConfig.allowedDomains,
         disableUserInput: customConfig.disableUserInput,
+        maxActionsPerTask: customConfig.maxActionsPerTask ?? 100,
         confirmSensitiveActions: customConfig.confirmSensitiveActions,
         blockFileUploads: customConfig.blockFileUploads,
       },

packages/core/src/config/sandbox-integration.test.ts

@@ -22,6 +22,7 @@ vi.mock('../confirmation-bus/message-bus.js', () => ({
 vi.mock('../policy/policy-engine.js', () => ({
   PolicyEngine: vi.fn().mockImplementation(() => ({
     getExcludedTools: vi.fn().mockReturnValue(new Set()),
+    getApprovalMode: vi.fn().mockReturnValue('yolo'),
   })),
 }));
 vi.mock('../skills/skillManager.js', () => ({

packages/core/src/confirmation-bus/types.ts

@@ -11,6 +11,7 @@ import type {
   DiffStat,
 } from '../tools/tools.js';
 import type { ToolCall } from '../scheduler/types.js';
+import type { SandboxPermissions } from '../services/sandboxManager.js';
 
 export enum MessageBusType {
   TOOL_CONFIRMATION_REQUEST = 'tool-confirmation-request',
@@ -78,6 +79,14 @@ export interface ToolConfirmationResponse {
  * Data-only versions of ToolCallConfirmationDetails for bus transmission.
  */
 export type SerializableConfirmationDetails =
+  | {
+      type: 'sandbox_expansion';
+      title: string;
+      command: string;
+      rootCommand: string;
+      additionalPermissions: SandboxPermissions;
+      systemMessage?: string;
+    }
   | {
       type: 'info';
       title: string;

packages/core/src/core/__snapshots__/prompts.test.ts.snap

@@ -42,6 +42,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -213,6 +214,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -503,6 +505,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -674,6 +677,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -845,6 +849,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, you must work autonomously as no further user input is available. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -968,6 +973,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, you must work autonomously as no further user input is available. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -1564,6 +1570,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -1731,6 +1738,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -1889,6 +1897,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -2047,6 +2056,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -2201,6 +2211,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -2355,6 +2366,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -2503,6 +2515,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -2656,6 +2669,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -2934,6 +2948,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -3340,6 +3355,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -3494,6 +3510,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -3760,6 +3777,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -3914,6 +3932,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in \`GEMINI.md\` files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. For Directives, only clarify if critically underspecified; otherwise, work autonomously. You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.

packages/core/src/core/prompts.test.ts

@@ -89,6 +89,7 @@ describe('Core System Prompt (prompts.ts)', () => {
     mockConfig = {
       getToolRegistry: vi.fn().mockReturnValue(mockRegistry),
       getEnableShellOutputEfficiency: vi.fn().mockReturnValue(true),
+      getSandboxEnabled: vi.fn().mockReturnValue(false),
       storage: {
         getProjectTempDir: vi.fn().mockReturnValue('/tmp/project-temp'),
         getPlansDir: vi.fn().mockReturnValue('/tmp/project-temp/plans'),
@@ -418,6 +419,7 @@ describe('Core System Prompt (prompts.ts)', () => {
       const testConfig = {
         getToolRegistry: vi.fn().mockReturnValue(mockToolRegistry),
         getEnableShellOutputEfficiency: vi.fn().mockReturnValue(true),
+        getSandboxEnabled: vi.fn().mockReturnValue(false),
         storage: {
           getProjectTempDir: vi.fn().mockReturnValue('/tmp/project-temp'),
         },

packages/core/src/index.ts

@@ -88,7 +88,11 @@ export * from './utils/approvalModeUtils.js';
 export * from './utils/fileDiffUtils.js';
 export * from './utils/retry.js';
 export * from './utils/shell-utils.js';
-export { PolicyDecision, ApprovalMode } from './policy/types.js';
+export {
+  PolicyDecision,
+  ApprovalMode,
+  PRIORITY_YOLO_ALLOW_ALL,
+} from './policy/types.js';
 export * from './utils/tool-utils.js';
 export * from './utils/terminalSerializer.js';
 export * from './utils/systemEncoding.js';
@@ -126,8 +130,9 @@ export * from './services/FolderTrustDiscoveryService.js';
 export * from './services/chatRecordingService.js';
 export * from './services/fileSystemService.js';
 export * from './services/sandboxedFileSystemService.js';
-export * from './services/windowsSandboxManager.js';
+export * from './sandbox/windows/WindowsSandboxManager.js';
 export * from './services/sessionSummaryUtils.js';
+export * from './services/teleportService.js';
 export * from './services/contextManager.js';
 export * from './services/trackerService.js';
 export * from './services/trackerTypes.js';

packages/core/src/policy/policies/sandbox-default.toml

@@ -0,0 +1,19 @@
+[modes.plan]
+network = false
+readonly = true
+approvedTools = []
+allowOverrides = false
+
+[modes.default]
+network = false
+readonly = true
+approvedTools = []
+allowOverrides = true
+
+[modes.accepting_edits]
+network = false
+readonly = false
+approvedTools = ['sed', 'grep', 'awk', 'perl', 'cat', 'echo']
+allowOverrides = true
+
+[commands]

packages/core/src/policy/policy-engine.test.ts

@@ -329,7 +329,11 @@ describe('PolicyEngine', () => {
       );
 
       // Switch to autoEdit mode
-      engine.setApprovalMode(ApprovalMode.AUTO_EDIT);
+      engine = new PolicyEngine({
+        rules,
+        approvalMode: ApprovalMode.AUTO_EDIT,
+        toolSandboxEnabled: true,
+      });
       expect((await engine.check({ name: 'edit' }, undefined)).decision).toBe(
         PolicyDecision.ALLOW,
       );
@@ -1427,14 +1431,14 @@ describe('PolicyEngine', () => {
 
       engine = new PolicyEngine({ rules });
 
-      // Atomic command "whoami" matches the wildcard rule (ASK_USER).
+      // Atomic command "unknown_command" matches the wildcard rule (ASK_USER).
       // It should NOT be upgraded to ALLOW.
       expect(
         (
           await engine.check(
             {
               name: 'run_shell_command',
-              args: { command: 'whoami' },
+              args: { command: 'unknown_command' },
             },
             undefined,
           )
@@ -1572,7 +1576,7 @@ describe('PolicyEngine', () => {
         },
       ];
 
-      engine = new PolicyEngine({ rules });
+      engine = new PolicyEngine({ rules, toolSandboxEnabled: true });
       engine.setApprovalMode(ApprovalMode.AUTO_EDIT);
 
       const result = await engine.check(

packages/core/src/policy/policy-engine.ts

@@ -5,6 +5,11 @@
  */
 
 import { type FunctionCall } from '@google/genai';
+import {
+  isDangerousCommand,
+  isKnownSafeCommand,
+} from '../sandbox/macos/commandSafety.js';
+import { parse as shellParse } from 'shell-quote';
 import {
   PolicyDecision,
   type PolicyEngineConfig,
@@ -192,6 +197,8 @@ export class PolicyEngine {
   private readonly disableAlwaysAllow: boolean;
   private readonly checkerRunner?: CheckerRunner;
   private approvalMode: ApprovalMode;
+  private toolSandboxEnabled: boolean;
+  private sandboxApprovedTools: string[];
 
   constructor(config: PolicyEngineConfig = {}, checkerRunner?: CheckerRunner) {
     this.rules = (config.rules ?? []).sort(
@@ -242,13 +249,18 @@ export class PolicyEngine {
     this.disableAlwaysAllow = config.disableAlwaysAllow ?? false;
     this.checkerRunner = checkerRunner;
     this.approvalMode = config.approvalMode ?? ApprovalMode.DEFAULT;
+    this.toolSandboxEnabled = config.toolSandboxEnabled ?? false;
+    this.sandboxApprovedTools = config.sandboxApprovedTools ?? [];
   }
 
   /**
    * Update the current approval mode.
    */
-  setApprovalMode(mode: ApprovalMode): void {
+  setApprovalMode(mode: ApprovalMode, sandboxApprovedTools?: string[]): void {
     this.approvalMode = mode;
+    if (sandboxApprovedTools !== undefined) {
+      this.sandboxApprovedTools = sandboxApprovedTools;
+    }
   }
 
   /**
@@ -269,17 +281,58 @@ export class PolicyEngine {
     command: string,
     allowRedirection?: boolean,
   ): boolean {
-    return (
-      !allowRedirection &&
-      hasRedirection(command) &&
-      this.approvalMode !== ApprovalMode.AUTO_EDIT &&
-      this.approvalMode !== ApprovalMode.YOLO
-    );
+    if (allowRedirection) return false;
+    if (!hasRedirection(command)) return false;
+
+    // Do not downgrade (do not ask user) if sandboxing is enabled and in AUTO_EDIT or YOLO
+    if (
+      this.toolSandboxEnabled &&
+      (this.approvalMode === ApprovalMode.AUTO_EDIT ||
+        this.approvalMode === ApprovalMode.YOLO)
+    ) {
+      return false;
+    }
+
+    return true;
   }
 
   /**
    * Check if a shell command is allowed.
    */
+
+  private async applyShellHeuristics(
+    command: string,
+    decision: PolicyDecision,
+  ): Promise<PolicyDecision> {
+    await initializeShellParsers();
+    try {
+      const parsedObjArgs = shellParse(command);
+      if (parsedObjArgs.some((arg) => typeof arg === 'object')) return decision;
+      const parsedArgs = parsedObjArgs.map(String);
+      if (isDangerousCommand(parsedArgs)) {
+        debugLogger.debug(
+          `[PolicyEngine.check] Command evaluated as dangerous, forcing ASK_USER: ${command}`,
+        );
+        return PolicyDecision.ASK_USER;
+      }
+      const isApprovedBySandbox =
+        this.toolSandboxEnabled &&
+        this.sandboxApprovedTools.includes(parsedArgs[0]);
+      if (
+        (isKnownSafeCommand(parsedArgs) || isApprovedBySandbox) &&
+        decision === PolicyDecision.ASK_USER
+      ) {
+        debugLogger.debug(
+          `[PolicyEngine.check] Command evaluated as known safe, overriding ASK_USER to ALLOW: ${command}`,
+        );
+        return PolicyDecision.ALLOW;
+      }
+    } catch {
+      // Ignore parsing errors
+    }
+    return decision;
+  }
+
   private async checkShellCommand(
     toolName: string,
     command: string | undefined,
@@ -522,11 +575,21 @@ export class PolicyEngine {
           `[PolicyEngine.check] MATCHED rule: toolName=${rule.toolName}, decision=${rule.decision}, priority=${rule.priority}, argsPattern=${rule.argsPattern?.source || 'none'}`,
         );
 
+        let ruleDecision = rule.decision;
+        if (
+          isShellCommand &&
+          command &&
+          !('commandPrefix' in rule) &&
+          !rule.argsPattern
+        ) {
+          ruleDecision = await this.applyShellHeuristics(command, ruleDecision);
+        }
+
         if (isShellCommand && toolName) {
           const shellResult = await this.checkShellCommand(
             toolName,
             command,
-            rule.decision,
+            ruleDecision,
             serverName,
             shellDirPath,
             rule.allowRedirection,
@@ -562,10 +625,18 @@ export class PolicyEngine {
         `[PolicyEngine.check] NO MATCH - using default decision: ${this.defaultDecision}`,
       );
       if (toolName && SHELL_TOOL_NAMES.includes(toolName)) {
+        let heuristicDecision = this.defaultDecision;
+        if (command) {
+          heuristicDecision = await this.applyShellHeuristics(
+            command,
+            heuristicDecision,
+          );
+        }
+
         const shellResult = await this.checkShellCommand(
           toolName,
           command,
-          this.defaultDecision,
+          heuristicDecision,
           serverName,
           shellDirPath,
           false,
@@ -631,6 +702,15 @@ export class PolicyEngine {
       }
     }
 
+    // Sandbox Expansion requests MUST always be confirmed by the user,
+    // even if the base command is otherwise ALLOWED by the policy engine.
+    if (
+      decision === PolicyDecision.ALLOW &&
+      toolCall.args?.['additional_permissions']
+    ) {
+      decision = PolicyDecision.ASK_USER;
+    }
+
     return {
       decision: this.applyNonInteractiveMode(decision),
       rule: matchedRule,

packages/core/src/policy/sandboxPolicyManager.ts

@@ -0,0 +1,216 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import toml from '@iarna/toml';
+import { z } from 'zod';
+import { fileURLToPath } from 'node:url';
+import { debugLogger } from '../utils/debugLogger.js';
+import { type SandboxPermissions } from '../services/sandboxManager.js';
+import { sanitizePaths } from '../services/sandboxManager.js';
+
+export const SandboxModeConfigSchema = z.object({
+  network: z.boolean(),
+  readonly: z.boolean(),
+  approvedTools: z.array(z.string()),
+  allowOverrides: z.boolean().optional(),
+});
+
+export const PersistentCommandConfigSchema = z.object({
+  allowed_paths: z.array(z.string()).optional(),
+  allow_network: z.boolean().optional(),
+});
+
+export const SandboxTomlSchema = z.object({
+  modes: z.object({
+    plan: SandboxModeConfigSchema,
+    default: SandboxModeConfigSchema,
+    accepting_edits: SandboxModeConfigSchema,
+  }),
+  commands: z.record(z.string(), PersistentCommandConfigSchema).default({}),
+});
+
+export type SandboxModeConfig = z.infer<typeof SandboxModeConfigSchema>;
+export type PersistentCommandConfig = z.infer<
+  typeof PersistentCommandConfigSchema
+>;
+export type SandboxTomlSchemaType = z.infer<typeof SandboxTomlSchema>;
+
+export class SandboxPolicyManager {
+  private static _DEFAULT_CONFIG: SandboxTomlSchemaType | null = null;
+
+  private static get DEFAULT_CONFIG(): SandboxTomlSchemaType {
+    if (!SandboxPolicyManager._DEFAULT_CONFIG) {
+      const __filename = fileURLToPath(import.meta.url);
+      const __dirname = path.dirname(__filename);
+      const defaultPath = path.join(
+        __dirname,
+        'policies',
+        'sandbox-default.toml',
+      );
+      try {
+        const content = fs.readFileSync(defaultPath, 'utf8');
+        if (typeof content !== 'string') {
+          SandboxPolicyManager._DEFAULT_CONFIG = {
+            modes: {
+              plan: {
+                network: false,
+                readonly: true,
+                approvedTools: [],
+                allowOverrides: false,
+              },
+              default: {
+                network: false,
+                readonly: true,
+                approvedTools: [],
+                allowOverrides: true,
+              },
+              accepting_edits: {
+                network: false,
+                readonly: false,
+                approvedTools: ['sed', 'grep', 'awk', 'perl', 'cat', 'echo'],
+                allowOverrides: true,
+              },
+            },
+            commands: {},
+          };
+          return SandboxPolicyManager._DEFAULT_CONFIG;
+        }
+        SandboxPolicyManager._DEFAULT_CONFIG = SandboxTomlSchema.parse(
+          toml.parse(content),
+        );
+      } catch (e) {
+        debugLogger.error(`Failed to parse default sandbox policy: ${e}`);
+        throw new Error(`Failed to parse default sandbox policy: ${e}`);
+      }
+    }
+    return SandboxPolicyManager._DEFAULT_CONFIG;
+  }
+
+  private config: SandboxTomlSchemaType;
+  private readonly configPath: string;
+  private sessionApprovals: Record<string, SandboxPermissions> = {};
+
+  constructor(customConfigPath?: string) {
+    this.configPath =
+      customConfigPath ??
+      path.join(os.homedir(), '.gemini', 'policies', 'sandbox.toml');
+    this.config = this.loadConfig();
+  }
+
+  private loadConfig(): SandboxTomlSchemaType {
+    if (!fs.existsSync(this.configPath)) {
+      return SandboxPolicyManager.DEFAULT_CONFIG;
+    }
+
+    try {
+      const content = fs.readFileSync(this.configPath, 'utf8');
+      return SandboxTomlSchema.parse(toml.parse(content));
+    } catch (e) {
+      debugLogger.error(`Failed to parse sandbox.toml: ${e}`);
+      return SandboxPolicyManager.DEFAULT_CONFIG;
+    }
+  }
+
+  private saveConfig(): void {
+    try {
+      const dir = path.dirname(this.configPath);
+      if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+      }
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+      const content = toml.stringify(this.config as unknown as toml.JsonMap);
+      fs.writeFileSync(this.configPath, content);
+    } catch (e) {
+      debugLogger.error(`Failed to save sandbox.toml: ${e}`);
+    }
+  }
+
+  getModeConfig(
+    mode: 'plan' | 'accepting_edits' | 'default' | string,
+  ): SandboxModeConfig {
+    if (mode === 'plan') return this.config.modes.plan;
+    if (mode === 'accepting_edits' || mode === 'autoEdit')
+      return this.config.modes.accepting_edits;
+    if (mode === 'default') return this.config.modes.default;
+
+    // Default fallback
+    return this.config.modes.default ?? this.config.modes.plan;
+  }
+
+  getCommandPermissions(commandName: string): SandboxPermissions {
+    const persistent = this.config.commands[commandName];
+    const session = this.sessionApprovals[commandName];
+
+    return {
+      fileSystem: {
+        read: [
+          ...(persistent?.allowed_paths ?? []),
+          ...(session?.fileSystem?.read ?? []),
+        ],
+        write: [
+          ...(persistent?.allowed_paths ?? []),
+          ...(session?.fileSystem?.write ?? []),
+        ],
+      },
+      network: persistent?.allow_network || session?.network || false,
+    };
+  }
+
+  addSessionApproval(
+    commandName: string,
+    permissions: SandboxPermissions,
+  ): void {
+    const existing = this.sessionApprovals[commandName] || {
+      fileSystem: { read: [], write: [] },
+      network: false,
+    };
+
+    this.sessionApprovals[commandName] = {
+      fileSystem: {
+        read: Array.from(
+          new Set([
+            ...(existing.fileSystem?.read ?? []),
+            ...(permissions.fileSystem?.read ?? []),
+          ]),
+        ),
+        write: Array.from(
+          new Set([
+            ...(existing.fileSystem?.write ?? []),
+            ...(permissions.fileSystem?.write ?? []),
+          ]),
+        ),
+      },
+      network: existing.network || permissions.network || false,
+    };
+  }
+
+  addPersistentApproval(
+    commandName: string,
+    permissions: SandboxPermissions,
+  ): void {
+    const existing = this.config.commands[commandName] || {
+      allowed_paths: [],
+      allow_network: false,
+    };
+
+    const newPathsArray: string[] = [
+      ...(existing.allowed_paths ?? []),
+      ...(permissions.fileSystem?.read ?? []),
+      ...(permissions.fileSystem?.write ?? []),
+    ];
+    const newPaths = new Set(sanitizePaths(newPathsArray));
+
+    this.config.commands[commandName] = {
+      allowed_paths: Array.from(newPaths),
+      allow_network: existing.allow_network || permissions.network || false,
+    };
+
+    this.saveConfig();
+  }
+}

packages/core/src/policy/types.ts

@@ -309,6 +309,15 @@ export interface PolicyEngineConfig {
    * Used to filter rules that have specific 'modes' defined.
    */
   approvalMode?: ApprovalMode;
+
+  /**
+   * Whether tool sandboxing is enabled.
+   */
+  toolSandboxEnabled?: boolean;
+  /**
+   * List of tools approved by the sandbox policy for the current mode.
+   */
+  sandboxApprovedTools?: string[];
 }
 
 export interface PolicySettings {

packages/core/src/prompts/promptProvider.test.ts

@@ -54,6 +54,7 @@ describe('PromptProvider', () => {
       },
       getToolRegistry: vi.fn().mockReturnValue(mockToolRegistry),
       getEnableShellOutputEfficiency: vi.fn().mockReturnValue(true),
+      getSandboxEnabled: vi.fn().mockReturnValue(false),
       storage: {
         getProjectTempDir: vi.fn().mockReturnValue('/tmp/project-temp'),
         getPlansDir: vi.fn().mockReturnValue('/tmp/project-temp/plans'),

packages/core/src/prompts/promptProvider.ts

@@ -195,7 +195,10 @@ export class PromptProvider {
             memoryManagerEnabled: context.config.isMemoryManagerEnabled(),
           }),
         ),
-        sandbox: this.withSection('sandbox', () => getSandboxMode()),
+        sandbox: this.withSection('sandbox', () => ({
+          mode: getSandboxMode(),
+          toolSandboxingEnabled: context.config.getSandboxEnabled(),
+        })),
         interactiveYoloMode: this.withSection(
           'interactiveYoloMode',
           () => true,

packages/core/src/prompts/snippets.legacy.ts

@@ -36,7 +36,7 @@ export interface SystemPromptOptions {
   planningWorkflow?: PlanningWorkflowOptions;
   taskTracker?: boolean;
   operationalGuidelines?: OperationalGuidelinesOptions;
-  sandbox?: SandboxMode;
+  sandbox?: SandboxOptions;
   interactiveYoloMode?: boolean;
   gitRepo?: GitRepoOptions;
   finalReminder?: FinalReminderOptions;
@@ -72,6 +72,11 @@ export interface OperationalGuidelinesOptions {
 
 export type SandboxMode = 'macos-seatbelt' | 'generic' | 'outside';
 
+export interface SandboxOptions {
+  mode: SandboxMode;
+  toolSandboxingEnabled: boolean;
+}
+
 export interface GitRepoOptions {
   interactive: boolean;
 }
@@ -290,8 +295,9 @@ ${shellEfficiencyGuidelines(options.enableShellEfficiency)}
 `.trim();
 }
 
-export function renderSandbox(mode?: SandboxMode): string {
-  if (!mode) return '';
+export function renderSandbox(options?: SandboxOptions): string {
+  if (!options || !options.mode) return '';
+  const mode = options.mode;
   if (mode === 'macos-seatbelt') {
     return `
 # macOS Seatbelt
@@ -300,11 +306,12 @@ You are running under macos seatbelt with limited access to files outside the pr
     return `
 # Sandbox
 You are running in a sandbox container with limited access to files outside the project directory or system temp directory, and with limited access to host system resources such as ports. If you encounter failures that could be due to sandboxing (e.g. if a command fails with 'Operation not permitted' or similar error), when you report the error to the user, also explain why you think it could be due to sandboxing, and how the user may need to adjust their sandbox configuration.`.trim();
-  } else {
+  } else if (mode === 'outside') {
     return `
 # Outside of Sandbox
 You are running outside of a sandbox container, directly on the user's system. For critical commands that are particularly likely to modify the user's system outside of the project directory or system temp directory, as you explain the command to the user (per the Explain Critical Commands rule above), also remind the user to consider enabling sandboxing.`.trim();
   }
+  return '';
 }
 
 export function renderInteractiveYoloMode(enabled?: boolean): string {

packages/core/src/prompts/snippets.ts

@@ -46,7 +46,7 @@ export interface SystemPromptOptions {
   planningWorkflow?: PlanningWorkflowOptions;
   taskTracker?: boolean;
   operationalGuidelines?: OperationalGuidelinesOptions;
-  sandbox?: SandboxMode;
+  sandbox?: SandboxOptions;
   interactiveYoloMode?: boolean;
   gitRepo?: GitRepoOptions;
 }
@@ -84,6 +84,11 @@ export interface OperationalGuidelinesOptions {
 
 export type SandboxMode = 'macos-seatbelt' | 'generic' | 'outside';
 
+export interface SandboxOptions {
+  mode: SandboxMode;
+  toolSandboxingEnabled: boolean;
+}
+
 export interface GitRepoOptions {
   interactive: boolean;
 }
@@ -222,6 +227,7 @@ Use the following guidelines to optimize your search and read patterns.
 ## Engineering Standards
 - **Contextual Precedence:** Instructions found in ${formattedFilenames} files are foundational mandates. They take absolute precedence over the general workflows and tool defaults described in this system prompt.
 - **Conventions & Style:** Rigorously adhere to existing workspace conventions, architectural patterns, and style (naming, formatting, typing, commenting). During the research phase, analyze surrounding files, tests, and configuration to ensure your changes are seamless, idiomatic, and consistent with the local context. Never compromise idiomatic quality or completeness (e.g., proper declarations, type safety, documentation) to minimize tool calls; all supporting changes required by local conventions are part of a surgical update.
+- **Types, warnings and linters:** NEVER use hacks like disabling or suppressing warnings or bypassing the type system (i.e.: casts in TypeScript) unless explicitly instructed to by the user. Instead, use idiomatic language features (e.g.: type guard functions).
 - **Libraries/Frameworks:** NEVER assume a library/framework is available. Verify its established usage within the project (check imports, configuration files like 'package.json', 'Cargo.toml', 'requirements.txt', etc.) before employing it.
 - **Technical Integrity:** You are responsible for the entire lifecycle: implementation, testing, and validation. Within the scope of your changes, prioritize readability and long-term maintainability by consolidating logic into clean abstractions rather than threading state across unrelated layers. Align strictly with the requested architectural direction, ensuring the final implementation is focused and free of redundant "just-in-case" alternatives. Validation is not merely running tests; it is the exhaustive process of ensuring that every aspect of your change—behavioral, structural, and stylistic—is correct and fully compatible with the broader project. For bug fixes, you must empirically reproduce the failure with a new test case or reproduction script before applying the fix.
 - **Expertise & Intent Alignment:** Provide proactive technical opinions grounded in research while strictly adhering to the user's intended workflow. Distinguish between **Directives** (unambiguous requests for action or implementation) and **Inquiries** (requests for analysis, advice, or observations). Assume all requests are Inquiries unless they contain an explicit instruction to perform a task. For Inquiries, your scope is strictly limited to research and analysis; you may propose a solution or strategy, but you MUST NOT modify files until a corresponding Directive is issued. Do not initiate implementation based on observations of bugs or statements of fact. Once an Inquiry is resolved, or while waiting for a Directive, stop and wait for the next user instruction. ${options.interactive ? 'For Directives, only clarify if critically underspecified; otherwise, work autonomously.' : 'For Directives, you must work autonomously as no further user input is available.'} You should only seek user intervention if you have exhausted all possible routes or if a proposed solution would take the workspace in a significantly different architectural direction.
@@ -389,18 +395,44 @@ export function renderOperationalGuidelines(
 `.trim();
 }
 
-export function renderSandbox(mode?: SandboxMode): string {
-  if (!mode) return '';
+export function renderSandbox(options?: SandboxOptions): string {
+  if (!options || !options.mode) return '';
+  const { mode, toolSandboxingEnabled } = options;
   if (mode === 'macos-seatbelt') {
-    return `
+    if (toolSandboxingEnabled) {
+      return `
+    # macOS Seatbelt
+    
+    You are running under macos seatbelt with limited access to files outside the project directory or system temp directory, and with limited access to host system resources such as ports. 
+    **Sandbox Failure Recovery:**
+    If an interactive command (like nvim, nano, git) fails to load plugins, crashes, or hangs waiting for user input (e.g. at a '-- More --' prompt) with errors indicating missing files or 'Operation not permitted', it is likely blocked by the sandbox.
+    If you see these errors (e.g. Vim:E303, 'should be read/write') in the command output (even if the command timed out or was cancelled by the user):
+    1.  IMMEDIATELY analyze the output to identify the required filesystem paths or network access.
+    2.  WITHOUT asking the user or explaining the failure first, AUTOMATICALLY retry the command using the 'run_shell_command' tool, explicitly providing the missing permissions in the 'additional_permissions' parameter.
+    3.  This will immediately present the user with a modal to approve the expansion for the command so they don't have to reprompt you.`.trim();
+    } else {
+      return `
     # macOS Seatbelt
     
     You are running under macos seatbelt with limited access to files outside the project directory or system temp directory, and with limited access to host system resources such as ports. If you encounter failures that could be due to macOS Seatbelt (e.g. if a command fails with 'Operation not permitted' or similar error), as you report the error to the user, also explain why you think it could be due to macOS Seatbelt, and how the user may need to adjust their Seatbelt profile.`.trim();
+    }
   } else if (mode === 'generic') {
-    return `
+    if (toolSandboxingEnabled) {
+      return `
+      # Sandbox
+      
+      You are running in a sandbox container with limited access to files outside the project directory or system temp directory, and with limited access to host system resources such as ports. 
+    **Sandbox Failure Recovery:**
+    If a command fails with 'Operation not permitted' or similar sandbox errors, do NOT ask the user to adjust settings manually. Instead:
+    1.  Analyze the command and error to identify the required filesystem paths or network access.
+    2.  Retry the command using the 'run_shell_command' tool, providing the missing permissions in the 'additional_permissions' parameter.
+    3.  The user will be presented with a modal to approve this expansion for the current command.`.trim();
+    } else {
+      return `
       # Sandbox
       
       You are running in a sandbox container with limited access to files outside the project directory or system temp directory, and with limited access to host system resources such as ports. If you encounter failures that could be due to sandboxing (e.g. if a command fails with 'Operation not permitted' or similar error), when you report the error to the user, also explain why you think it could be due to sandboxing, and how the user may need to adjust their sandbox configuration.`.trim();
+    }
   }
   return '';
 }

packages/core/src/sandbox/linux/LinuxSandboxManager.test.ts

@@ -4,15 +4,42 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { describe, it, expect, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { LinuxSandboxManager } from './LinuxSandboxManager.js';
 import type { SandboxRequest } from '../../services/sandboxManager.js';
+import fs from 'node:fs';
+
+vi.mock('node:fs', async () => {
+  const actual = await vi.importActual<typeof import('node:fs')>('node:fs');
+  return {
+    ...actual,
+    default: {
+      // @ts-expect-error - Property 'default' does not exist on type 'typeof import("node:fs")'
+      ...actual.default,
+      existsSync: vi.fn(() => true),
+      realpathSync: vi.fn((p: string | Buffer) => p.toString()),
+      mkdirSync: vi.fn(),
+      openSync: vi.fn(),
+      closeSync: vi.fn(),
+      writeFileSync: vi.fn(),
+    },
+    existsSync: vi.fn(() => true),
+    realpathSync: vi.fn((p: string | Buffer) => p.toString()),
+    mkdirSync: vi.fn(),
+    openSync: vi.fn(),
+    closeSync: vi.fn(),
+    writeFileSync: vi.fn(),
+  };
+});
 
 describe('LinuxSandboxManager', () => {
   const workspace = '/home/user/workspace';
   let manager: LinuxSandboxManager;
 
   beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.realpathSync).mockImplementation((p) => p.toString());
     manager = new LinuxSandboxManager({ workspace });
   });
 
@@ -52,6 +79,15 @@ describe('LinuxSandboxManager', () => {
       '--bind',
       workspace,
       workspace,
+      '--ro-bind',
+      `${workspace}/.gitignore`,
+      `${workspace}/.gitignore`,
+      '--ro-bind',
+      `${workspace}/.geminiignore`,
+      `${workspace}/.geminiignore`,
+      '--ro-bind',
+      `${workspace}/.git`,
+      `${workspace}/.git`,
       '--seccomp',
       '9',
       '--',
@@ -79,6 +115,15 @@ describe('LinuxSandboxManager', () => {
       '--bind',
       workspace,
       workspace,
+      '--ro-bind',
+      `${workspace}/.gitignore`,
+      `${workspace}/.gitignore`,
+      '--ro-bind',
+      `${workspace}/.geminiignore`,
+      `${workspace}/.geminiignore`,
+      '--ro-bind',
+      `${workspace}/.git`,
+      `${workspace}/.git`,
       '--bind-try',
       '/tmp/cache',
       '/tmp/cache',
@@ -88,6 +133,48 @@ describe('LinuxSandboxManager', () => {
     ]);
   });
 
+  it('protects real paths of governance files if they are symlinks', async () => {
+    vi.mocked(fs.realpathSync).mockImplementation((p) => {
+      if (p.toString() === `${workspace}/.gitignore`)
+        return '/shared/global.gitignore';
+      return p.toString();
+    });
+
+    const bwrapArgs = await getBwrapArgs({
+      command: 'ls',
+      args: [],
+      cwd: workspace,
+      env: {},
+    });
+
+    expect(bwrapArgs).toContain('--ro-bind');
+    expect(bwrapArgs).toContain(`${workspace}/.gitignore`);
+    expect(bwrapArgs).toContain('/shared/global.gitignore');
+
+    // Check that both are bound
+    const gitignoreIndex = bwrapArgs.indexOf(`${workspace}/.gitignore`);
+    expect(bwrapArgs[gitignoreIndex - 1]).toBe('--ro-bind');
+    expect(bwrapArgs[gitignoreIndex + 1]).toBe(`${workspace}/.gitignore`);
+
+    const realGitignoreIndex = bwrapArgs.indexOf('/shared/global.gitignore');
+    expect(bwrapArgs[realGitignoreIndex - 1]).toBe('--ro-bind');
+    expect(bwrapArgs[realGitignoreIndex + 1]).toBe('/shared/global.gitignore');
+  });
+
+  it('touches governance files if they do not exist', async () => {
+    vi.mocked(fs.existsSync).mockReturnValue(false);
+
+    await getBwrapArgs({
+      command: 'ls',
+      args: [],
+      cwd: workspace,
+      env: {},
+    });
+
+    expect(fs.mkdirSync).toHaveBeenCalled();
+    expect(fs.openSync).toHaveBeenCalled();
+  });
+
   it('should not bind the workspace twice even if it has a trailing slash in allowedPaths', async () => {
     const bwrapArgs = await getBwrapArgs({
       command: 'ls',
@@ -102,7 +189,20 @@ describe('LinuxSandboxManager', () => {
     const bindsIndex = bwrapArgs.indexOf('--seccomp');
     const binds = bwrapArgs.slice(bwrapArgs.indexOf('--bind'), bindsIndex);
 
-    // Should only contain the primary workspace bind, not the second one with a trailing slash
-    expect(binds).toEqual(['--bind', workspace, workspace]);
+    // Should only contain the primary workspace bind and governance files, not the second workspace bind with a trailing slash
+    expect(binds).toEqual([
+      '--bind',
+      workspace,
+      workspace,
+      '--ro-bind',
+      `${workspace}/.gitignore`,
+      `${workspace}/.gitignore`,
+      '--ro-bind',
+      `${workspace}/.geminiignore`,
+      `${workspace}/.geminiignore`,
+      '--ro-bind',
+      `${workspace}/.git`,
+      `${workspace}/.git`,
+    ]);
   });
 });

packages/core/src/sandbox/linux/LinuxSandboxManager.ts

@@ -4,14 +4,15 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { join, normalize } from 'node:path';
-import { writeFileSync } from 'node:fs';
+import fs from 'node:fs';
+import { join, dirname, normalize } from 'node:path';
 import os from 'node:os';
 import {
   type SandboxManager,
   type GlobalSandboxOptions,
   type SandboxRequest,
   type SandboxedCommand,
+  GOVERNANCE_FILES,
   sanitizePaths,
 } from '../../services/sandboxManager.js';
 import {
@@ -72,11 +73,30 @@ function getSeccompBpfPath(): string {
   }
 
   const bpfPath = join(os.tmpdir(), `gemini-cli-seccomp-${process.pid}.bpf`);
-  writeFileSync(bpfPath, buf);
+  fs.writeFileSync(bpfPath, buf);
   cachedBpfPath = bpfPath;
   return bpfPath;
 }
 
+/**
+ * Ensures a file or directory exists.
+ */
+function touch(filePath: string, isDirectory: boolean) {
+  try {
+    // If it exists (even as a broken symlink), do nothing
+    if (fs.lstatSync(filePath)) return;
+  } catch {
+    // Ignore ENOENT
+  }
+
+  if (isDirectory) {
+    fs.mkdirSync(filePath, { recursive: true });
+  } else {
+    fs.mkdirSync(dirname(filePath), { recursive: true });
+    fs.closeSync(fs.openSync(filePath, 'a'));
+  }
+}
+
 /**
  * A SandboxManager implementation for Linux that uses Bubblewrap (bwrap).
  */
@@ -109,6 +129,21 @@ export class LinuxSandboxManager implements SandboxManager {
       this.options.workspace,
     ];
 
+    // Protected governance files are bind-mounted as read-only, even if the workspace is RW.
+    // We ensure they exist on the host and resolve real paths to prevent symlink bypasses.
+    // In bwrap, later binds override earlier ones for the same path.
+    for (const file of GOVERNANCE_FILES) {
+      const filePath = join(this.options.workspace, file.path);
+      touch(filePath, file.isDirectory);
+
+      const realPath = fs.realpathSync(filePath);
+
+      bwrapArgs.push('--ro-bind', filePath, filePath);
+      if (realPath !== filePath) {
+        bwrapArgs.push('--ro-bind', realPath, realPath);
+      }
+    }
+
     const allowedPaths = sanitizePaths(req.policy?.allowedPaths) || [];
     const normalizedWorkspace = normalize(this.options.workspace).replace(
       /\/$/,

packages/core/src/sandbox/macos/MacOsSandboxManager.test.ts

@@ -8,20 +8,32 @@ import { MacOsSandboxManager } from './MacOsSandboxManager.js';
 import type { ExecutionPolicy } from '../../services/sandboxManager.js';
 import fs from 'node:fs';
 import os from 'node:os';
+import path from 'node:path';
 
 describe('MacOsSandboxManager', () => {
-  const mockWorkspace = '/test/workspace';
-  const mockAllowedPaths = ['/test/allowed'];
+  let mockWorkspace: string;
+  let mockAllowedPaths: string[];
   const mockNetworkAccess = true;
 
-  const mockPolicy: ExecutionPolicy = {
-    allowedPaths: mockAllowedPaths,
-    networkAccess: mockNetworkAccess,
-  };
-
+  let mockPolicy: ExecutionPolicy;
   let manager: MacOsSandboxManager;
 
   beforeEach(() => {
+    mockWorkspace = fs.mkdtempSync(
+      path.join(os.tmpdir(), 'gemini-cli-macos-test-'),
+    );
+    mockAllowedPaths = [
+      path.join(os.tmpdir(), 'gemini-cli-macos-test-allowed'),
+    ];
+    if (!fs.existsSync(mockAllowedPaths[0])) {
+      fs.mkdirSync(mockAllowedPaths[0]);
+    }
+
+    mockPolicy = {
+      allowedPaths: mockAllowedPaths,
+      networkAccess: mockNetworkAccess,
+    };
+
     manager = new MacOsSandboxManager({ workspace: mockWorkspace });
     // Mock realpathSync to just return the path for testing
     vi.spyOn(fs, 'realpathSync').mockImplementation((p) => p as string);
@@ -29,6 +41,10 @@ describe('MacOsSandboxManager', () => {
 
   afterEach(() => {
     vi.restoreAllMocks();
+    fs.rmSync(mockWorkspace, { recursive: true, force: true });
+    if (mockAllowedPaths && mockAllowedPaths[0]) {
+      fs.rmSync(mockAllowedPaths[0], { recursive: true, force: true });
+    }
   });
 
   describe('prepareCommand', () => {
@@ -47,11 +63,22 @@ describe('MacOsSandboxManager', () => {
       expect(profile).toContain('(deny default)');
       expect(profile).toContain('(allow process-exec)');
       expect(profile).toContain('(subpath (param "WORKSPACE"))');
-      expect(profile).not.toContain('(allow network*)');
+      expect(profile).not.toContain('(allow network-outbound)');
 
       expect(result.args).toContain('-D');
-      expect(result.args).toContain('WORKSPACE=/test/workspace');
+      expect(result.args).toContain(`WORKSPACE=${mockWorkspace}`);
       expect(result.args).toContain(`TMPDIR=${os.tmpdir()}`);
+
+      // Governance files should be protected
+      expect(profile).toContain(
+        '(deny file-write* (literal (param "GOVERNANCE_FILE_0")))',
+      ); // .gitignore
+      expect(profile).toContain(
+        '(deny file-write* (literal (param "GOVERNANCE_FILE_1")))',
+      ); // .geminiignore
+      expect(profile).toContain(
+        '(deny file-write* (subpath (param "GOVERNANCE_FILE_2")))',
+      ); // .git
     });
 
     it('should allow network when networkAccess is true in policy', async () => {
@@ -64,7 +91,7 @@ describe('MacOsSandboxManager', () => {
       });
 
       const profile = result.args[1];
-      expect(profile).toContain('(allow network*)');
+      expect(profile).toContain('(allow network-outbound)');
     });
 
     it('should parameterize allowed paths and normalize them', async () => {
@@ -134,31 +161,41 @@ describe('MacOsSandboxManager', () => {
     });
 
     it('should resolve parent directories if a file does not exist', async () => {
+      const baseTmpDir = fs.mkdtempSync(
+        path.join(os.tmpdir(), 'gemini-cli-macos-realpath-test-'),
+      );
+      const realPath = path.join(baseTmpDir, 'real_path');
+      const nonexistentFile = path.join(realPath, 'nonexistent.txt');
+
       vi.spyOn(fs, 'realpathSync').mockImplementation((p) => {
-        if (p === '/test/symlink/nonexistent.txt') {
+        if (p === nonexistentFile) {
           const error = new Error('ENOENT');
           Object.assign(error, { code: 'ENOENT' });
           throw error;
         }
-        if (p === '/test/symlink') {
-          return '/test/real_path';
+        if (p === realPath) {
+          return path.join(baseTmpDir, 'resolved_path');
         }
         return p as string;
       });
 
-      const dynamicManager = new MacOsSandboxManager({
-        workspace: '/test/symlink/nonexistent.txt',
-      });
-      const dynamicResult = await dynamicManager.prepareCommand({
-        command: 'echo',
-        args: ['hello'],
-        cwd: '/test/symlink/nonexistent.txt',
-        env: {},
-      });
+      try {
+        const dynamicManager = new MacOsSandboxManager({
+          workspace: nonexistentFile,
+        });
+        const dynamicResult = await dynamicManager.prepareCommand({
+          command: 'echo',
+          args: ['hello'],
+          cwd: nonexistentFile,
+          env: {},
+        });
 
-      expect(dynamicResult.args).toContain(
-        'WORKSPACE=/test/real_path/nonexistent.txt',
-      );
+        expect(dynamicResult.args).toContain(
+          `WORKSPACE=${path.join(baseTmpDir, 'resolved_path', 'nonexistent.txt')}`,
+        );
+      } finally {
+        fs.rmSync(baseTmpDir, { recursive: true, force: true });
+      }
     });
 
     it('should throw if realpathSync throws a non-ENOENT error', async () => {
@@ -169,7 +206,7 @@ describe('MacOsSandboxManager', () => {
       });
 
       const errorManager = new MacOsSandboxManager({
-        workspace: '/test/workspace',
+        workspace: mockWorkspace,
       });
       await expect(
         errorManager.prepareCommand({

packages/core/src/sandbox/macos/MacOsSandboxManager.ts

@@ -4,40 +4,164 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
 import {
   type SandboxManager,
-  type GlobalSandboxOptions,
   type SandboxRequest,
   type SandboxedCommand,
-  type ExecutionPolicy,
-  sanitizePaths,
+  type SandboxPermissions,
+  type GlobalSandboxOptions,
 } from '../../services/sandboxManager.js';
 import {
   sanitizeEnvironment,
   getSecureSanitizationConfig,
+  type EnvironmentSanitizationConfig,
 } from '../../services/environmentSanitization.js';
+import { buildSeatbeltArgs } from './seatbeltArgsBuilder.js';
 import {
-  BASE_SEATBELT_PROFILE,
-  NETWORK_SEATBELT_PROFILE,
-} from './baseProfile.js';
+  getCommandRoots,
+  initializeShellParsers,
+  splitCommands,
+  stripShellWrapper,
+} from '../../utils/shell-utils.js';
+import { isKnownSafeCommand } from './commandSafety.js';
+import { parse as shellParse } from 'shell-quote';
+import { type SandboxPolicyManager } from '../../policy/sandboxPolicyManager.js';
+import path from 'node:path';
+
+export interface MacOsSandboxOptions extends GlobalSandboxOptions {
+  /** Optional base sanitization config. */
+  sanitizationConfig?: EnvironmentSanitizationConfig;
+  /** The current sandbox mode behavior from config. */
+  modeConfig?: {
+    readonly?: boolean;
+    network?: boolean;
+    approvedTools?: string[];
+    allowOverrides?: boolean;
+  };
+  /** The policy manager for persistent approvals. */
+  policyManager?: SandboxPolicyManager;
+}
 
 /**
  * A SandboxManager implementation for macOS that uses Seatbelt.
  */
 export class MacOsSandboxManager implements SandboxManager {
-  constructor(private readonly options: GlobalSandboxOptions) {}
+  constructor(private readonly options: MacOsSandboxOptions) {}
+
+  private async isStrictlyApproved(req: SandboxRequest): Promise<boolean> {
+    const approvedTools = this.options.modeConfig?.approvedTools;
+    if (!approvedTools || approvedTools.length === 0) {
+      return false;
+    }
+
+    await initializeShellParsers();
+
+    const fullCmd = [req.command, ...req.args].join(' ');
+    const stripped = stripShellWrapper(fullCmd);
+
+    const roots = getCommandRoots(stripped);
+    if (roots.length === 0) return false;
+
+    const allRootsApproved = roots.every((root) =>
+      approvedTools.includes(root),
+    );
+    if (allRootsApproved) {
+      return true;
+    }
+
+    const pipelineCommands = splitCommands(stripped);
+    if (pipelineCommands.length === 0) return false;
+
+    // For safety, every command in the pipeline must be considered safe.
+    for (const cmdString of pipelineCommands) {
+      const parsedArgs = shellParse(cmdString).map(String);
+      if (!isKnownSafeCommand(parsedArgs)) {
+        return false;
+      }
+    }
+
+    return true;
+  }
+
+  private async getCommandName(req: SandboxRequest): Promise<string> {
+    await initializeShellParsers();
+    const fullCmd = [req.command, ...req.args].join(' ');
+    const stripped = stripShellWrapper(fullCmd);
+    const roots = getCommandRoots(stripped).filter(
+      (r) => r !== 'shopt' && r !== 'set',
+    );
+    if (roots.length > 0) {
+      return roots[0];
+    }
+    return path.basename(req.command);
+  }
 
   async prepareCommand(req: SandboxRequest): Promise<SandboxedCommand> {
+    await initializeShellParsers();
     const sanitizationConfig = getSecureSanitizationConfig(
       req.policy?.sanitizationConfig,
     );
 
     const sanitizedEnv = sanitizeEnvironment(req.env, sanitizationConfig);
 
-    const sandboxArgs = this.buildSeatbeltArgs(this.options, req.policy);
+    const isReadonlyMode = this.options.modeConfig?.readonly ?? true;
+    const allowOverrides = this.options.modeConfig?.allowOverrides ?? true;
+
+    // Reject override attempts in plan mode
+    if (!allowOverrides && req.policy?.additionalPermissions) {
+      const perms = req.policy.additionalPermissions;
+      if (
+        perms.network ||
+        (perms.fileSystem?.write && perms.fileSystem.write.length > 0)
+      ) {
+        throw new Error(
+          'Sandbox request rejected: Cannot override readonly/network restrictions in Plan mode.',
+        );
+      }
+    }
+
+    // If not in readonly mode OR it's a strictly approved pipeline, allow workspace writes
+    const isApproved = allowOverrides
+      ? await this.isStrictlyApproved(req)
+      : false;
+
+    const workspaceWrite = !isReadonlyMode || isApproved;
+    const networkAccess =
+      this.options.modeConfig?.network ?? req.policy?.networkAccess ?? false;
+
+    // Fetch persistent approvals for this command
+    const commandName = await this.getCommandName(req);
+    const persistentPermissions = allowOverrides
+      ? this.options.policyManager?.getCommandPermissions(commandName)
+      : undefined;
+
+    // Merge all permissions
+    const mergedAdditional: SandboxPermissions = {
+      fileSystem: {
+        read: [
+          ...(persistentPermissions?.fileSystem?.read ?? []),
+          ...(req.policy?.additionalPermissions?.fileSystem?.read ?? []),
+        ],
+        write: [
+          ...(persistentPermissions?.fileSystem?.write ?? []),
+          ...(req.policy?.additionalPermissions?.fileSystem?.write ?? []),
+        ],
+      },
+      network:
+        networkAccess ||
+        persistentPermissions?.network ||
+        req.policy?.additionalPermissions?.network ||
+        false,
+    };
+
+    const sandboxArgs = buildSeatbeltArgs({
+      workspace: this.options.workspace,
+      allowedPaths: [...(req.policy?.allowedPaths || [])],
+      forbiddenPaths: req.policy?.forbiddenPaths,
+      networkAccess: mergedAdditional.network,
+      workspaceWrite,
+      additionalPermissions: mergedAdditional,
+    });
 
     return {
       program: '/usr/bin/sandbox-exec',
@@ -46,65 +170,4 @@ export class MacOsSandboxManager implements SandboxManager {
       cwd: req.cwd,
     };
   }
-
-  /**
-   * Builds the arguments array for sandbox-exec using a strict allowlist profile.
-   * It relies on parameters passed to sandbox-exec via the -D flag to avoid
-   * string interpolation vulnerabilities, and normalizes paths against symlink escapes.
-   *
-   * Returns arguments up to the end of sandbox-exec configuration (e.g. ['-p', '<profile>', '-D', ...])
-   * Does not include the final '--' separator or the command to run.
-   */
-  private buildSeatbeltArgs(
-    options: GlobalSandboxOptions,
-    policy?: ExecutionPolicy,
-  ): string[] {
-    const profileLines = [BASE_SEATBELT_PROFILE];
-    const args: string[] = [];
-
-    const workspacePath = this.tryRealpath(options.workspace);
-    args.push('-D', `WORKSPACE=${workspacePath}`);
-
-    const tmpPath = this.tryRealpath(os.tmpdir());
-    args.push('-D', `TMPDIR=${tmpPath}`);
-
-    const allowedPaths = sanitizePaths(policy?.allowedPaths) || [];
-    for (let i = 0; i < allowedPaths.length; i++) {
-      const allowedPath = this.tryRealpath(allowedPaths[i]);
-      args.push('-D', `ALLOWED_PATH_${i}=${allowedPath}`);
-      profileLines.push(
-        `(allow file-read* file-write* (subpath (param "ALLOWED_PATH_${i}")))`,
-      );
-    }
-
-    // TODO: handle forbidden paths
-
-    if (policy?.networkAccess) {
-      profileLines.push(NETWORK_SEATBELT_PROFILE);
-    }
-
-    args.unshift('-p', profileLines.join('\n'));
-
-    return args;
-  }
-
-  /**
-   * Resolves symlinks for a given path to prevent sandbox escapes.
-   * If a file does not exist (ENOENT), it recursively resolves the parent directory.
-   * Other errors (e.g. EACCES) are re-thrown.
-   */
-  private tryRealpath(p: string): string {
-    try {
-      return fs.realpathSync(p);
-    } catch (e) {
-      if (e instanceof Error && 'code' in e && e.code === 'ENOENT') {
-        const parentDir = path.dirname(p);
-        if (parentDir === p) {
-          return p;
-        }
-        return path.join(this.tryRealpath(parentDir), path.basename(p));
-      }
-      throw e;
-    }
-  }
 }

packages/core/src/sandbox/macos/baseProfile.ts

@@ -16,11 +16,101 @@ export const BASE_SEATBELT_PROFILE = `(version 1)
 
 (import "system.sb")
 
+
 ; Core execution requirements
 (allow process-exec)
 (allow process-fork)
 (allow signal (target same-sandbox))
-(allow process-info* (target same-sandbox))
+(allow process-info*)
+
+(allow file-write-data
+  (require-all
+    (path "/dev/null")
+    (vnode-type CHARACTER-DEVICE)))
+
+; sysctls permitted.
+(allow sysctl-read
+  (sysctl-name "hw.activecpu")
+  (sysctl-name "hw.busfrequency_compat")
+  (sysctl-name "hw.byteorder")
+  (sysctl-name "hw.cacheconfig")
+  (sysctl-name "hw.cachelinesize_compat")
+  (sysctl-name "hw.cpufamily")
+  (sysctl-name "hw.cpufrequency_compat")
+  (sysctl-name "hw.cputype")
+  (sysctl-name "hw.l1dcachesize_compat")
+  (sysctl-name "hw.l1icachesize_compat")
+  (sysctl-name "hw.l2cachesize_compat")
+  (sysctl-name "hw.l3cachesize_compat")
+  (sysctl-name "hw.logicalcpu_max")
+  (sysctl-name "hw.machine")
+  (sysctl-name "hw.model")
+  (sysctl-name "hw.memsize")
+  (sysctl-name "hw.ncpu")
+  (sysctl-name "hw.nperflevels")
+  (sysctl-name-prefix "hw.optional.arm.")
+  (sysctl-name-prefix "hw.optional.armv8_")
+  (sysctl-name "hw.packages")
+  (sysctl-name "hw.pagesize_compat")
+  (sysctl-name "hw.pagesize")
+  (sysctl-name "hw.physicalcpu")
+  (sysctl-name "hw.physicalcpu_max")
+  (sysctl-name "hw.logicalcpu")
+  (sysctl-name "hw.cpufrequency")
+  (sysctl-name "hw.tbfrequency_compat")
+  (sysctl-name "hw.vectorunit")
+  (sysctl-name "machdep.cpu.brand_string")
+  (sysctl-name "kern.argmax")
+  (sysctl-name "kern.hostname")
+  (sysctl-name "kern.maxfilesperproc")
+  (sysctl-name "kern.maxproc")
+  (sysctl-name "kern.osproductversion")
+  (sysctl-name "kern.osrelease")
+  (sysctl-name "kern.ostype")
+  (sysctl-name "kern.osvariant_status")
+  (sysctl-name "kern.osversion")
+  (sysctl-name "kern.secure_kernel")
+  (sysctl-name "kern.usrstack64")
+  (sysctl-name "kern.version")
+  (sysctl-name "sysctl.proc_cputype")
+  (sysctl-name "vm.loadavg")
+  (sysctl-name-prefix "hw.perflevel")
+  (sysctl-name-prefix "kern.proc.pgrp.")
+  (sysctl-name-prefix "kern.proc.pid.")
+  (sysctl-name-prefix "net.routetable.")
+)
+
+(allow sysctl-write
+  (sysctl-name "kern.grade_cputype"))
+
+
+(allow mach-lookup
+  (global-name "com.apple.sysmond")
+)
+\n; IOKit
+(allow iokit-open
+  (iokit-registry-entry-class "RootDomainUserClient")
+)
+
+(allow mach-lookup
+  (global-name "com.apple.system.opendirectoryd.libinfo")
+)
+
+; Needed for python multiprocessing on MacOS for the SemLock
+(allow ipc-posix-sem)
+
+(allow mach-lookup
+  (global-name "com.apple.PowerManagement.control")
+)
+
+; PTY and Terminal support
+(allow pseudo-tty)
+(allow file-read* file-write* file-ioctl (literal "/dev/ptmx"))
+(allow file-read* file-write*
+  (require-all
+    (regex #"^/dev/ttys[0-9]+")
+    (extension "com.apple.sandbox.pty")))
+(allow file-ioctl (regex #"^/dev/ttys[0-9]+"))
 
 ; Allow basic read access to system frameworks and libraries required to run
 (allow file-read*
@@ -38,11 +128,6 @@ export const BASE_SEATBELT_PROFILE = `(version 1)
   (subpath "/private/etc")
 )
 
-; PTY and Terminal support
-(allow pseudo-tty)
-(allow file-read* file-write* file-ioctl (literal "/dev/ptmx"))
-(allow file-read* file-write* file-ioctl (regex #"^/dev/ttys[0-9]+"))
-
 ; Allow read/write access to temporary directories and common device nodes
 (allow file-read* file-write*
   (literal "/dev/null")
@@ -53,9 +138,10 @@ export const BASE_SEATBELT_PROFILE = `(version 1)
 )
 
 ; Workspace access using parameterized paths
-(allow file-read* file-write*
+(allow file-read*
   (subpath (param "WORKSPACE"))
 )
+
 `;
 
 /**
@@ -66,7 +152,9 @@ export const BASE_SEATBELT_PROFILE = `(version 1)
  */
 export const NETWORK_SEATBELT_PROFILE = `
 ; Network Access
-(allow network*)
+(allow network-outbound)
+(allow network-inbound)
+(allow network-bind)
 
 (allow system-socket
   (require-all

packages/core/src/sandbox/macos/commandSafety.ts

@@ -0,0 +1,469 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { parse as shellParse } from 'shell-quote';
+
+/**
+ * Checks if a command with its arguments is known to be safe to execute
+ * without requiring user confirmation. This is primarily used to allow
+ * harmless, read-only commands to run silently in the macOS sandbox.
+ *
+ * It handles raw command execution as well as wrapped commands like `bash -c "..."` or `bash -lc "..."`.
+ * For wrapped commands, it parses the script and ensures all individual
+ * sub-commands are in the known-safe list and no dangerous shell operators
+ * (like subshells or redirection) are used.
+ *
+ * @param args - The command and its arguments (e.g., ['ls', '-la'])
+ * @returns true if the command is considered safe, false otherwise.
+ */
+export function isKnownSafeCommand(args: string[]): boolean {
+  if (!args || args.length === 0) {
+    return false;
+  }
+
+  // Normalize zsh to bash
+  const normalizedArgs = args.map((a) => (a === 'zsh' ? 'bash' : a));
+
+  if (isSafeToCallWithExec(normalizedArgs)) {
+    return true;
+  }
+
+  // Support `bash -lc "..."`
+  if (
+    normalizedArgs.length === 3 &&
+    normalizedArgs[0] === 'bash' &&
+    (normalizedArgs[1] === '-lc' || normalizedArgs[1] === '-c')
+  ) {
+    try {
+      const script = normalizedArgs[2];
+
+      // Basic check for dangerous operators that could spawn subshells or redirect output
+      // We allow &&, ||, |, ; but explicitly block subshells () and redirection >, >>, <
+      if (/[()<>]/g.test(script)) {
+        return false;
+      }
+
+      const commands = script.split(/&&|\|\||\||;/);
+
+      let allSafe = true;
+      for (const cmd of commands) {
+        const trimmed = cmd.trim();
+        if (!trimmed) continue;
+
+        const parsed = shellParse(trimmed).map(String);
+        if (parsed.length === 0) continue;
+
+        if (!isSafeToCallWithExec(parsed)) {
+          allSafe = false;
+          break;
+        }
+      }
+
+      if (allSafe && commands.length > 0) {
+        return true;
+      }
+    } catch {
+      return false;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Core validation logic that checks a single command and its arguments
+ * against an allowlist of known safe operations. It performs deep validation
+ * for specific tools like `base64`, `find`, `rg`, `git`, and `sed` to ensure
+ * unsafe flags (like `--output`, `-exec`, or mutating options) are not used.
+ *
+ * @param args - The command and its arguments.
+ * @returns true if the command is strictly read-only and safe.
+ */
+function isSafeToCallWithExec(args: string[]): boolean {
+  if (!args || args.length === 0) return false;
+  const cmd = args[0];
+
+  const safeCommands = new Set([
+    'cat',
+    'cd',
+    'cut',
+    'echo',
+    'expr',
+    'false',
+    'grep',
+    'head',
+    'id',
+    'ls',
+    'nl',
+    'paste',
+    'pwd',
+    'rev',
+    'seq',
+    'stat',
+    'tail',
+    'tr',
+    'true',
+    'uname',
+    'uniq',
+    'wc',
+    'which',
+    'whoami',
+    'numfmt',
+    'tac',
+  ]);
+
+  if (safeCommands.has(cmd)) {
+    return true;
+  }
+
+  if (cmd === 'base64') {
+    const unsafeOptions = new Set(['-o', '--output']);
+    return !args
+      .slice(1)
+      .some(
+        (arg) =>
+          unsafeOptions.has(arg) ||
+          arg.startsWith('--output=') ||
+          (arg.startsWith('-o') && arg !== '-o'),
+      );
+  }
+
+  if (cmd === 'find') {
+    const unsafeOptions = new Set([
+      '-exec',
+      '-execdir',
+      '-ok',
+      '-okdir',
+      '-delete',
+      '-fls',
+      '-fprint',
+      '-fprint0',
+      '-fprintf',
+    ]);
+    return !args.some((arg) => unsafeOptions.has(arg));
+  }
+
+  if (cmd === 'rg') {
+    const unsafeWithArgs = new Set(['--pre', '--hostname-bin']);
+    const unsafeWithoutArgs = new Set(['--search-zip', '-z']);
+
+    return !args.some((arg) => {
+      if (unsafeWithoutArgs.has(arg)) return true;
+      for (const opt of unsafeWithArgs) {
+        if (arg === opt || arg.startsWith(opt + '=')) return true;
+      }
+      return false;
+    });
+  }
+
+  if (cmd === 'git') {
+    if (gitHasConfigOverrideGlobalOption(args)) {
+      return false;
+    }
+
+    const { idx, subcommand } = findGitSubcommand(args, [
+      'status',
+      'log',
+      'diff',
+      'show',
+      'branch',
+    ]);
+    if (!subcommand) {
+      return false;
+    }
+
+    const subcommandArgs = args.slice(idx + 1);
+
+    if (['status', 'log', 'diff', 'show'].includes(subcommand)) {
+      return gitSubcommandArgsAreReadOnly(subcommandArgs);
+    }
+
+    if (subcommand === 'branch') {
+      return (
+        gitSubcommandArgsAreReadOnly(subcommandArgs) &&
+        gitBranchIsReadOnly(subcommandArgs)
+      );
+    }
+
+    return false;
+  }
+
+  if (cmd === 'sed') {
+    // Special-case sed -n {N|M,N}p
+    if (args.length <= 4 && args[1] === '-n' && isValidSedNArg(args[2])) {
+      return true;
+    }
+    return false;
+  }
+
+  return false;
+}
+
+/**
+ * Helper to identify which git subcommand is being executed, skipping over
+ * global git options like `-c` or `--git-dir`.
+ *
+ * @param args - The full git command arguments.
+ * @param subcommands - A list of subcommands to look for.
+ * @returns An object containing the index of the subcommand and its name.
+ */
+function findGitSubcommand(
+  args: string[],
+  subcommands: string[],
+): { idx: number; subcommand: string | null } {
+  let skipNext = false;
+
+  for (let idx = 1; idx < args.length; idx++) {
+    if (skipNext) {
+      skipNext = false;
+      continue;
+    }
+
+    const arg = args[idx];
+
+    if (
+      arg.startsWith('--config-env=') ||
+      arg.startsWith('--exec-path=') ||
+      arg.startsWith('--git-dir=') ||
+      arg.startsWith('--namespace=') ||
+      arg.startsWith('--super-prefix=') ||
+      arg.startsWith('--work-tree=') ||
+      ((arg.startsWith('-C') || arg.startsWith('-c')) && arg.length > 2)
+    ) {
+      continue;
+    }
+
+    if (
+      arg === '-C' ||
+      arg === '-c' ||
+      arg === '--config-env' ||
+      arg === '--exec-path' ||
+      arg === '--git-dir' ||
+      arg === '--namespace' ||
+      arg === '--super-prefix' ||
+      arg === '--work-tree'
+    ) {
+      skipNext = true;
+      continue;
+    }
+
+    if (arg === '--' || arg.startsWith('-')) {
+      continue;
+    }
+
+    if (subcommands.includes(arg)) {
+      return { idx, subcommand: arg };
+    }
+
+    return { idx: -1, subcommand: null };
+  }
+
+  return { idx: -1, subcommand: null };
+}
+
+/**
+ * Checks if a git command contains global configuration override flags
+ * (e.g., `-c` or `--config-env`) which could be used maliciously to
+ * execute arbitrary code via git config.
+ *
+ * @param args - The git command arguments.
+ * @returns true if config overrides are present.
+ */
+function gitHasConfigOverrideGlobalOption(args: string[]): boolean {
+  return args.some(
+    (arg) =>
+      arg === '-c' ||
+      arg === '--config-env' ||
+      (arg.startsWith('-c') && arg.length > 2) ||
+      arg.startsWith('--config-env='),
+  );
+}
+
+/**
+ * Validates that the arguments for safe git subcommands (like `status`, `log`,
+ * `diff`, `show`) do not contain flags that could cause mutations or execute
+ * arbitrary commands (e.g., `--output`, `--exec`).
+ *
+ * @param args - Arguments passed to the git subcommand.
+ * @returns true if the arguments only represent read-only operations.
+ */
+function gitSubcommandArgsAreReadOnly(args: string[]): boolean {
+  const unsafeFlags = new Set([
+    '--output',
+    '--ext-diff',
+    '--textconv',
+    '--exec',
+    '--paginate',
+  ]);
+
+  return !args.some(
+    (arg) =>
+      unsafeFlags.has(arg) ||
+      arg.startsWith('--output=') ||
+      arg.startsWith('--exec='),
+  );
+}
+
+/**
+ * Validates that `git branch` is only used for read operations
+ * (e.g., listing branches) rather than creating, deleting, or renaming branches.
+ *
+ * @param args - Arguments passed to `git branch`.
+ * @returns true if it's purely a listing/read-only branch command.
+ */
+function gitBranchIsReadOnly(args: string[]): boolean {
+  if (args.length === 0) return true;
+
+  let sawReadOnlyFlag = false;
+  for (const arg of args) {
+    if (
+      [
+        '--list',
+        '-l',
+        '--show-current',
+        '-a',
+        '--all',
+        '-r',
+        '--remotes',
+        '-v',
+        '-vv',
+        '--verbose',
+      ].includes(arg)
+    ) {
+      sawReadOnlyFlag = true;
+    } else if (arg.startsWith('--format=')) {
+      sawReadOnlyFlag = true;
+    } else {
+      return false;
+    }
+  }
+  return sawReadOnlyFlag;
+}
+
+/**
+ * Ensures that a `sed` command argument is a valid line-printing instruction
+ * (e.g., `10p` or `5,10p`), preventing unsafe script execution in `sed`.
+ *
+ * @param arg - The script argument passed to `sed -n`.
+ * @returns true if it's a valid, safe print command.
+ */
+function isValidSedNArg(arg: string | undefined): boolean {
+  if (!arg) return false;
+
+  if (!arg.endsWith('p')) return false;
+  const core = arg.slice(0, -1);
+
+  const parts = core.split(',');
+  if (parts.length === 1) {
+    const num = parts[0];
+    return num.length > 0 && /^\d+$/.test(num);
+  } else if (parts.length === 2) {
+    const a = parts[0];
+    const b = parts[1];
+    return a.length > 0 && b.length > 0 && /^\d+$/.test(a) && /^\d+$/.test(b);
+  }
+
+  return false;
+}
+
+/**
+ * Checks if a command with its arguments is explicitly known to be dangerous
+ * and should be blocked or require strict user confirmation. This catches
+ * destructive commands like `rm -rf`, `sudo`, and commands with execution
+ * flags like `find -exec`.
+ *
+ * @param args - The command and its arguments.
+ * @returns true if the command is identified as dangerous, false otherwise.
+ */
+export function isDangerousCommand(args: string[]): boolean {
+  if (!args || args.length === 0) {
+    return false;
+  }
+
+  const cmd = args[0];
+
+  if (cmd === 'rm') {
+    return args[1] === '-f' || args[1] === '-rf' || args[1] === '-fr';
+  }
+
+  if (cmd === 'sudo') {
+    return isDangerousCommand(args.slice(1));
+  }
+
+  if (cmd === 'find') {
+    const unsafeOptions = new Set([
+      '-exec',
+      '-execdir',
+      '-ok',
+      '-okdir',
+      '-delete',
+      '-fls',
+      '-fprint',
+      '-fprint0',
+      '-fprintf',
+    ]);
+    return args.some((arg) => unsafeOptions.has(arg));
+  }
+
+  if (cmd === 'rg') {
+    const unsafeWithArgs = new Set(['--pre', '--hostname-bin']);
+    const unsafeWithoutArgs = new Set(['--search-zip', '-z']);
+
+    return args.some((arg) => {
+      if (unsafeWithoutArgs.has(arg)) return true;
+      for (const opt of unsafeWithArgs) {
+        if (arg === opt || arg.startsWith(opt + '=')) return true;
+      }
+      return false;
+    });
+  }
+
+  if (cmd === 'git') {
+    if (gitHasConfigOverrideGlobalOption(args)) {
+      return true;
+    }
+
+    const { idx, subcommand } = findGitSubcommand(args, [
+      'status',
+      'log',
+      'diff',
+      'show',
+      'branch',
+    ]);
+    if (!subcommand) {
+      // It's a git command we don't recognize as explicitly safe.
+      return false;
+    }
+
+    const subcommandArgs = args.slice(idx + 1);
+
+    if (['status', 'log', 'diff', 'show'].includes(subcommand)) {
+      return !gitSubcommandArgsAreReadOnly(subcommandArgs);
+    }
+
+    if (subcommand === 'branch') {
+      return !(
+        gitSubcommandArgsAreReadOnly(subcommandArgs) &&
+        gitBranchIsReadOnly(subcommandArgs)
+      );
+    }
+
+    return false;
+  }
+
+  if (cmd === 'base64') {
+    const unsafeOptions = new Set(['-o', '--output']);
+    return args
+      .slice(1)
+      .some(
+        (arg) =>
+          unsafeOptions.has(arg) ||
+          arg.startsWith('--output=') ||
+          (arg.startsWith('-o') && arg !== '-o'),
+      );
+  }
+
+  return false;
+}

packages/core/src/sandbox/macos/seatbeltArgsBuilder.test.ts

@@ -0,0 +1,160 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi } from 'vitest';
+import { buildSeatbeltArgs } from './seatbeltArgsBuilder.js';
+import fs from 'node:fs';
+import os from 'node:os';
+
+describe('seatbeltArgsBuilder', () => {
+  it('should build a strict allowlist profile allowing the workspace via param', () => {
+    // Mock realpathSync to just return the path for testing
+    vi.spyOn(fs, 'realpathSync').mockImplementation((p) => p as string);
+
+    const args = buildSeatbeltArgs({ workspace: '/Users/test/workspace' });
+
+    expect(args[0]).toBe('-p');
+    const profile = args[1];
+    expect(profile).toContain('(version 1)');
+    expect(profile).toContain('(deny default)');
+    expect(profile).toContain('(allow process-exec)');
+    expect(profile).toContain('(subpath (param "WORKSPACE"))');
+    expect(profile).not.toContain('(allow network*)');
+
+    expect(args).toContain('-D');
+    expect(args).toContain('WORKSPACE=/Users/test/workspace');
+    expect(args).toContain(`TMPDIR=${os.tmpdir()}`);
+
+    vi.restoreAllMocks();
+  });
+
+  it('should allow network when networkAccess is true', () => {
+    const args = buildSeatbeltArgs({ workspace: '/test', networkAccess: true });
+    const profile = args[1];
+    expect(profile).toContain('(allow network-outbound)');
+  });
+
+  it('should parameterize allowed paths and normalize them', () => {
+    vi.spyOn(fs, 'realpathSync').mockImplementation((p) => {
+      if (p === '/test/symlink') return '/test/real_path';
+      return p as string;
+    });
+
+    const args = buildSeatbeltArgs({
+      workspace: '/test',
+      allowedPaths: ['/custom/path1', '/test/symlink'],
+    });
+
+    const profile = args[1];
+    expect(profile).toContain('(subpath (param "ALLOWED_PATH_0"))');
+    expect(profile).toContain('(subpath (param "ALLOWED_PATH_1"))');
+
+    expect(args).toContain('-D');
+    expect(args).toContain('ALLOWED_PATH_0=/custom/path1');
+    expect(args).toContain('ALLOWED_PATH_1=/test/real_path');
+
+    vi.restoreAllMocks();
+  });
+
+  it('should resolve parent directories if a file does not exist', () => {
+    vi.spyOn(fs, 'realpathSync').mockImplementation((p) => {
+      if (p === '/test/symlink/nonexistent.txt') {
+        const error = new Error('ENOENT');
+        Object.assign(error, { code: 'ENOENT' });
+        throw error;
+      }
+      if (p === '/test/symlink') {
+        return '/test/real_path';
+      }
+      return p as string;
+    });
+
+    const args = buildSeatbeltArgs({
+      workspace: '/test/symlink/nonexistent.txt',
+    });
+
+    expect(args).toContain('WORKSPACE=/test/real_path/nonexistent.txt');
+    vi.restoreAllMocks();
+  });
+
+  it('should throw if realpathSync throws a non-ENOENT error', () => {
+    vi.spyOn(fs, 'realpathSync').mockImplementation(() => {
+      const error = new Error('Permission denied');
+      Object.assign(error, { code: 'EACCES' });
+      throw error;
+    });
+
+    expect(() =>
+      buildSeatbeltArgs({
+        workspace: '/test/workspace',
+      }),
+    ).toThrow('Permission denied');
+
+    vi.restoreAllMocks();
+  });
+
+  describe('governance files', () => {
+    it('should inject explicit deny rules for governance files', () => {
+      vi.spyOn(fs, 'realpathSync').mockImplementation((p) => p.toString());
+      vi.spyOn(fs, 'existsSync').mockReturnValue(true);
+      vi.spyOn(fs, 'lstatSync').mockImplementation(
+        (p) =>
+          ({
+            isDirectory: () => p.toString().endsWith('.git'),
+            isFile: () => !p.toString().endsWith('.git'),
+          }) as unknown as fs.Stats,
+      );
+
+      const args = buildSeatbeltArgs({ workspace: '/Users/test/workspace' });
+      const profile = args[1];
+
+      // .gitignore should be a literal deny
+      expect(args).toContain('-D');
+      expect(args).toContain(
+        'GOVERNANCE_FILE_0=/Users/test/workspace/.gitignore',
+      );
+      expect(profile).toContain(
+        '(deny file-write* (literal (param "GOVERNANCE_FILE_0")))',
+      );
+
+      // .git should be a subpath deny
+      expect(args).toContain('GOVERNANCE_FILE_2=/Users/test/workspace/.git');
+      expect(profile).toContain(
+        '(deny file-write* (subpath (param "GOVERNANCE_FILE_2")))',
+      );
+
+      vi.restoreAllMocks();
+    });
+
+    it('should protect both the symlink and the real path if they differ', () => {
+      vi.spyOn(fs, 'realpathSync').mockImplementation((p) => {
+        if (p === '/test/workspace/.gitignore') return '/test/real/.gitignore';
+        return p.toString();
+      });
+      vi.spyOn(fs, 'existsSync').mockReturnValue(true);
+      vi.spyOn(fs, 'lstatSync').mockImplementation(
+        () =>
+          ({
+            isDirectory: () => false,
+            isFile: () => true,
+          }) as unknown as fs.Stats,
+      );
+
+      const args = buildSeatbeltArgs({ workspace: '/test/workspace' });
+      const profile = args[1];
+
+      expect(args).toContain('GOVERNANCE_FILE_0=/test/workspace/.gitignore');
+      expect(args).toContain('REAL_GOVERNANCE_FILE_0=/test/real/.gitignore');
+      expect(profile).toContain(
+        '(deny file-write* (literal (param "GOVERNANCE_FILE_0")))',
+      );
+      expect(profile).toContain(
+        '(deny file-write* (literal (param "REAL_GOVERNANCE_FILE_0")))',
+      );
+
+      vi.restoreAllMocks();
+    });
+  });
+});

packages/core/src/sandbox/macos/seatbeltArgsBuilder.ts

@@ -0,0 +1,247 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import {
+  BASE_SEATBELT_PROFILE,
+  NETWORK_SEATBELT_PROFILE,
+} from './baseProfile.js';
+import {
+  type SandboxPermissions,
+  sanitizePaths,
+  GOVERNANCE_FILES,
+} from '../../services/sandboxManager.js';
+
+/**
+ * Options for building macOS Seatbelt arguments.
+ */
+export interface SeatbeltArgsOptions {
+  /** The primary workspace path to allow access to. */
+  workspace: string;
+  /** Additional paths to allow access to. */
+  allowedPaths?: string[];
+  /** Absolute paths to explicitly deny read/write access to (overrides allowlists). */
+  forbiddenPaths?: string[];
+  /** Whether to allow network access. */
+  networkAccess?: boolean;
+  /** Granular additional permissions. */
+  additionalPermissions?: SandboxPermissions;
+  /** Whether to allow write access to the workspace. */
+  workspaceWrite?: boolean;
+}
+
+/**
+ * Resolves symlinks for a given path to prevent sandbox escapes.
+ * If a file does not exist (ENOENT), it recursively resolves the parent directory.
+ * Other errors (e.g. EACCES) are re-thrown.
+ */
+function tryRealpath(p: string): string {
+  try {
+    return fs.realpathSync(p);
+  } catch (e) {
+    if (e instanceof Error && 'code' in e && e.code === 'ENOENT') {
+      const parentDir = path.dirname(p);
+      if (parentDir === p) {
+        return p;
+      }
+      return path.join(tryRealpath(parentDir), path.basename(p));
+    }
+    throw e;
+  }
+}
+
+/**
+ * Builds the arguments array for sandbox-exec using a strict allowlist profile.
+ * It relies on parameters passed to sandbox-exec via the -D flag to avoid
+ * string interpolation vulnerabilities, and normalizes paths against symlink escapes.
+ *
+ * Returns arguments up to the end of sandbox-exec configuration (e.g. ['-p', '<profile>', '-D', ...])
+ * Does not include the final '--' separator or the command to run.
+ */
+export function buildSeatbeltArgs(options: SeatbeltArgsOptions): string[] {
+  let profile = BASE_SEATBELT_PROFILE + '\n';
+  const args: string[] = [];
+
+  const workspacePath = tryRealpath(options.workspace);
+  args.push('-D', `WORKSPACE=${workspacePath}`);
+  args.push('-D', `WORKSPACE_RAW=${options.workspace}`);
+  profile += `(allow file-read* (subpath (param "WORKSPACE_RAW")))\n`;
+  if (options.workspaceWrite) {
+    profile += `(allow file-write* (subpath (param "WORKSPACE_RAW")))\n`;
+  }
+
+  if (options.workspaceWrite) {
+    profile += `(allow file-write* (subpath (param "WORKSPACE")))\n`;
+  }
+
+  // Add explicit deny rules for governance files in the workspace.
+  // These are added after the workspace allow rule to ensure they take precedence
+  // (Seatbelt evaluates rules in order, later rules win for same path).
+  for (let i = 0; i < GOVERNANCE_FILES.length; i++) {
+    const governanceFile = path.join(workspacePath, GOVERNANCE_FILES[i].path);
+    const realGovernanceFile = tryRealpath(governanceFile);
+
+    // Determine if it should be treated as a directory (subpath) or a file (literal).
+    // .git is generally a directory, while ignore files are literals.
+    let isDirectory = GOVERNANCE_FILES[i].isDirectory;
+    try {
+      if (fs.existsSync(realGovernanceFile)) {
+        isDirectory = fs.lstatSync(realGovernanceFile).isDirectory();
+      }
+    } catch {
+      // Ignore errors, use default guess
+    }
+
+    const ruleType = isDirectory ? 'subpath' : 'literal';
+
+    args.push('-D', `GOVERNANCE_FILE_${i}=${governanceFile}`);
+    profile += `(deny file-write* (${ruleType} (param "GOVERNANCE_FILE_${i}")))\n`;
+
+    if (realGovernanceFile !== governanceFile) {
+      args.push('-D', `REAL_GOVERNANCE_FILE_${i}=${realGovernanceFile}`);
+      profile += `(deny file-write* (${ruleType} (param "REAL_GOVERNANCE_FILE_${i}")))\n`;
+    }
+  }
+
+  // Auto-detect and support git worktrees by granting read and write access to the underlying git directory
+  try {
+    const gitPath = path.join(workspacePath, '.git');
+    const gitStat = fs.lstatSync(gitPath);
+    if (gitStat.isFile()) {
+      const gitContent = fs.readFileSync(gitPath, 'utf8');
+      const match = gitContent.match(/^gitdir:\s*(.+)$/m);
+      if (match && match[1]) {
+        let worktreeGitDir = match[1].trim();
+        if (!path.isAbsolute(worktreeGitDir)) {
+          worktreeGitDir = path.resolve(workspacePath, worktreeGitDir);
+        }
+        const resolvedWorktreeGitDir = tryRealpath(worktreeGitDir);
+
+        // Grant write access to the worktree's specific .git directory
+        args.push('-D', `WORKTREE_GIT_DIR=${resolvedWorktreeGitDir}`);
+        profile += `(allow file-read* file-write* (subpath (param "WORKTREE_GIT_DIR")))\n`;
+
+        // Grant write access to the main repository's .git directory (objects, refs, etc. are shared)
+        // resolvedWorktreeGitDir is usually like: /path/to/main-repo/.git/worktrees/worktree-name
+        const mainGitDir = tryRealpath(
+          path.dirname(path.dirname(resolvedWorktreeGitDir)),
+        );
+        if (mainGitDir && mainGitDir.endsWith('.git')) {
+          args.push('-D', `MAIN_GIT_DIR=${mainGitDir}`);
+          profile += `(allow file-read* file-write* (subpath (param "MAIN_GIT_DIR")))\n`;
+        }
+      }
+    }
+  } catch (_e) {
+    // Ignore if .git doesn't exist, isn't readable, etc.
+  }
+
+  const tmpPath = tryRealpath(os.tmpdir());
+  args.push('-D', `TMPDIR=${tmpPath}`);
+
+  const nodeRootPath = tryRealpath(
+    path.dirname(path.dirname(process.execPath)),
+  );
+  args.push('-D', `NODE_ROOT=${nodeRootPath}`);
+  profile += `(allow file-read* (subpath (param "NODE_ROOT")))\n`;
+
+  // Add PATH directories as read-only to support nvm, homebrew, etc.
+  if (process.env['PATH']) {
+    const paths = process.env['PATH'].split(':');
+    let pathIndex = 0;
+    const addedPaths = new Set();
+
+    for (const p of paths) {
+      if (!p.trim()) continue;
+      try {
+        let resolved = tryRealpath(p);
+
+        // If this is a 'bin' directory (like /usr/local/bin or homebrew/bin),
+        // also grant read access to its parent directory so that symlinked
+        // assets (like Cellar or libexec) can be read.
+        if (resolved.endsWith('/bin')) {
+          resolved = path.dirname(resolved);
+        }
+
+        if (!addedPaths.has(resolved)) {
+          addedPaths.add(resolved);
+          args.push('-D', `SYS_PATH_${pathIndex}=${resolved}`);
+          profile += `(allow file-read* (subpath (param "SYS_PATH_${pathIndex}")))\n`;
+          pathIndex++;
+        }
+      } catch (_e) {
+        // Ignore paths that do not exist or are inaccessible
+      }
+    }
+  }
+
+  // Handle allowedPaths
+  const allowedPaths = sanitizePaths(options.allowedPaths) || [];
+  for (let i = 0; i < allowedPaths.length; i++) {
+    const allowedPath = tryRealpath(allowedPaths[i]);
+    args.push('-D', `ALLOWED_PATH_${i}=${allowedPath}`);
+    profile += `(allow file-read* file-write* (subpath (param "ALLOWED_PATH_${i}")))\n`;
+  }
+
+  // Handle granular additional permissions
+  if (options.additionalPermissions?.fileSystem) {
+    const { read, write } = options.additionalPermissions.fileSystem;
+    if (read) {
+      read.forEach((p, i) => {
+        const resolved = tryRealpath(p);
+        const paramName = `ADDITIONAL_READ_${i}`;
+        args.push('-D', `${paramName}=${resolved}`);
+        let isFile = false;
+        try {
+          isFile = fs.statSync(resolved).isFile();
+        } catch {
+          // Ignore error
+        }
+        if (isFile) {
+          profile += `(allow file-read* (literal (param "${paramName}")))\n`;
+        } else {
+          profile += `(allow file-read* (subpath (param "${paramName}")))\n`;
+        }
+      });
+    }
+    if (write) {
+      write.forEach((p, i) => {
+        const resolved = tryRealpath(p);
+        const paramName = `ADDITIONAL_WRITE_${i}`;
+        args.push('-D', `${paramName}=${resolved}`);
+        let isFile = false;
+        try {
+          isFile = fs.statSync(resolved).isFile();
+        } catch {
+          // Ignore error
+        }
+        if (isFile) {
+          profile += `(allow file-read* file-write* (literal (param "${paramName}")))\n`;
+        } else {
+          profile += `(allow file-read* file-write* (subpath (param "${paramName}")))\n`;
+        }
+      });
+    }
+  }
+
+  // Handle forbiddenPaths
+  const forbiddenPaths = sanitizePaths(options.forbiddenPaths) || [];
+  for (let i = 0; i < forbiddenPaths.length; i++) {
+    const forbiddenPath = tryRealpath(forbiddenPaths[i]);
+    args.push('-D', `FORBIDDEN_PATH_${i}=${forbiddenPath}`);
+    profile += `(deny file-read* file-write* (subpath (param "FORBIDDEN_PATH_${i}")))\n`;
+  }
+
+  if (options.networkAccess || options.additionalPermissions?.network) {
+    profile += NETWORK_SEATBELT_PROFILE;
+  }
+
+  args.unshift('-p', profile);
+
+  return args;
+}

packages/core/src/sandbox/windows/WindowsSandboxManager.test.ts

@@ -5,33 +5,37 @@
  */
 
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { WindowsSandboxManager } from './windowsSandboxManager.js';
-import type { SandboxRequest } from './sandboxManager.js';
-import { spawnAsync } from '../utils/shell-utils.js';
+import { WindowsSandboxManager } from './WindowsSandboxManager.js';
+import type { SandboxRequest } from '../../services/sandboxManager.js';
+import { spawnAsync } from '../../utils/shell-utils.js';
 
-vi.mock('../utils/shell-utils.js', () => ({
+vi.mock('../../utils/shell-utils.js', () => ({
   spawnAsync: vi.fn(),
 }));
 
 describe('WindowsSandboxManager', () => {
   let manager: WindowsSandboxManager;
+  let testCwd: string;
 
   beforeEach(() => {
     vi.spyOn(os, 'platform').mockReturnValue('win32');
-    manager = new WindowsSandboxManager({ workspace: '/test/workspace' });
+    testCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'gemini-cli-test-'));
+    manager = new WindowsSandboxManager({ workspace: testCwd });
   });
 
   afterEach(() => {
     vi.restoreAllMocks();
+    fs.rmSync(testCwd, { recursive: true, force: true });
   });
 
   it('should prepare a GeminiSandbox.exe command', async () => {
     const req: SandboxRequest = {
       command: 'whoami',
       args: ['/groups'],
-      cwd: '/test/cwd',
+      cwd: testCwd,
       env: { TEST_VAR: 'test_value' },
       policy: {
         networkAccess: false,
@@ -41,14 +45,14 @@ describe('WindowsSandboxManager', () => {
     const result = await manager.prepareCommand(req);
 
     expect(result.program).toContain('GeminiSandbox.exe');
-    expect(result.args).toEqual(['0', '/test/cwd', 'whoami', '/groups']);
+    expect(result.args).toEqual(['0', testCwd, 'whoami', '/groups']);
   });
 
   it('should handle networkAccess from config', async () => {
     const req: SandboxRequest = {
       command: 'whoami',
       args: [],
-      cwd: '/test/cwd',
+      cwd: testCwd,
       env: {},
       policy: {
         networkAccess: true,
@@ -63,7 +67,7 @@ describe('WindowsSandboxManager', () => {
     const req: SandboxRequest = {
       command: 'test',
       args: [],
-      cwd: '/test/cwd',
+      cwd: testCwd,
       env: {
         API_KEY: 'secret',
         PATH: '/usr/bin',
@@ -82,29 +86,53 @@ describe('WindowsSandboxManager', () => {
     expect(result.env['API_KEY']).toBeUndefined();
   });
 
-  it('should grant Low Integrity access to the workspace and allowed paths', async () => {
+  it('should ensure governance files exist', async () => {
     const req: SandboxRequest = {
       command: 'test',
       args: [],
-      cwd: '/test/cwd',
+      cwd: testCwd,
       env: {},
-      policy: {
-        allowedPaths: ['/test/allowed1'],
-      },
     };
 
     await manager.prepareCommand(req);
 
-    expect(spawnAsync).toHaveBeenCalledWith('icacls', [
-      path.resolve('/test/workspace'),
-      '/setintegritylevel',
-      'Low',
-    ]);
+    expect(fs.existsSync(path.join(testCwd, '.gitignore'))).toBe(true);
+    expect(fs.existsSync(path.join(testCwd, '.geminiignore'))).toBe(true);
+    expect(fs.existsSync(path.join(testCwd, '.git'))).toBe(true);
+    expect(fs.lstatSync(path.join(testCwd, '.git')).isDirectory()).toBe(true);
+  });
 
-    expect(spawnAsync).toHaveBeenCalledWith('icacls', [
-      path.resolve('/test/allowed1'),
-      '/setintegritylevel',
-      'Low',
-    ]);
+  it('should grant Low Integrity access to the workspace and allowed paths', async () => {
+    const allowedPath = path.join(os.tmpdir(), 'gemini-cli-test-allowed');
+    if (!fs.existsSync(allowedPath)) {
+      fs.mkdirSync(allowedPath);
+    }
+    try {
+      const req: SandboxRequest = {
+        command: 'test',
+        args: [],
+        cwd: testCwd,
+        env: {},
+        policy: {
+          allowedPaths: [allowedPath],
+        },
+      };
+
+      await manager.prepareCommand(req);
+
+      expect(spawnAsync).toHaveBeenCalledWith('icacls', [
+        path.resolve(testCwd),
+        '/setintegritylevel',
+        'Low',
+      ]);
+
+      expect(spawnAsync).toHaveBeenCalledWith('icacls', [
+        path.resolve(allowedPath),
+        '/setintegritylevel',
+        'Low',
+      ]);
+    } finally {
+      fs.rmSync(allowedPath, { recursive: true, force: true });
+    }
   });
 });

packages/core/src/sandbox/windows/WindowsSandboxManager.ts

@@ -12,15 +12,16 @@ import {
   type SandboxManager,
   type SandboxRequest,
   type SandboxedCommand,
+  GOVERNANCE_FILES,
   type GlobalSandboxOptions,
   sanitizePaths,
-} from './sandboxManager.js';
+} from '../../services/sandboxManager.js';
 import {
   sanitizeEnvironment,
   getSecureSanitizationConfig,
-} from './environmentSanitization.js';
-import { debugLogger } from '../utils/debugLogger.js';
-import { spawnAsync } from '../utils/shell-utils.js';
+} from '../../services/environmentSanitization.js';
+import { debugLogger } from '../../utils/debugLogger.js';
+import { spawnAsync } from '../../utils/shell-utils.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -36,7 +37,29 @@ export class WindowsSandboxManager implements SandboxManager {
   private readonly lowIntegrityCache = new Set<string>();
 
   constructor(private readonly options: GlobalSandboxOptions) {
-    this.helperPath = path.resolve(__dirname, 'scripts', 'GeminiSandbox.exe');
+    this.helperPath = path.resolve(__dirname, 'GeminiSandbox.exe');
+  }
+
+  /**
+   * Ensures a file or directory exists.
+   */
+  private touch(filePath: string, isDirectory: boolean): void {
+    try {
+      // If it exists (even as a broken symlink), do nothing
+      if (fs.lstatSync(filePath)) return;
+    } catch {
+      // Ignore ENOENT
+    }
+
+    if (isDirectory) {
+      fs.mkdirSync(filePath, { recursive: true });
+    } else {
+      const dir = path.dirname(filePath);
+      if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+      }
+      fs.closeSync(fs.openSync(filePath, 'a'));
+    }
   }
 
   private async ensureInitialized(): Promise<void> {
@@ -164,7 +187,28 @@ export class WindowsSandboxManager implements SandboxManager {
 
     // TODO: handle forbidden paths
 
-    // 2. Construct the helper command
+    // 2. Protected governance files
+    // These must exist on the host before running the sandbox to prevent
+    // the sandboxed process from creating them with Low integrity.
+    // By being created as Medium integrity, they are write-protected from Low processes.
+    for (const file of GOVERNANCE_FILES) {
+      const filePath = path.join(this.options.workspace, file.path);
+      this.touch(filePath, file.isDirectory);
+
+      // We resolve real paths to ensure protection for both the symlink and its target.
+      try {
+        const realPath = fs.realpathSync(filePath);
+        if (realPath !== filePath) {
+          // If it's a symlink, the target is already implicitly protected
+          // if it's outside the Low integrity workspace (likely Medium).
+          // If it's inside, we ensure it's not accidentally Low.
+        }
+      } catch {
+        // Ignore realpath errors
+      }
+    }
+
+    // 3. Construct the helper command
     // GeminiSandbox.exe <network:0|1> <cwd> <command> [args...]
     const program = this.helperPath;
 

packages/core/src/scheduler/policy.ts

@@ -77,7 +77,8 @@ export async function checkPolicy(
   // confirmation prompt if the policy engine's decision is 'ASK_USER'.
   if (
     decision === PolicyDecision.ASK_USER &&
-    toolCall.request.isClientInitiated
+    toolCall.request.isClientInitiated &&
+    !toolCall.request.args?.['additional_permissions']
   ) {
     return {
       decision: PolicyDecision.ALLOW,

packages/core/src/scheduler/scheduler.ts

@@ -792,6 +792,110 @@ export class Scheduler {
       return true;
     }
 
+    let isSandboxError = false;
+    let sandboxDetailsStr = '';
+
+    if (
+      result.status === CoreToolCallStatus.Error &&
+      result.response.errorType === 'sandbox_expansion_required'
+    ) {
+      isSandboxError = true;
+      sandboxDetailsStr = result.response.error?.message || '';
+    }
+
+    if (isSandboxError) {
+      try {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+        const parsedError = JSON.parse(sandboxDetailsStr) as {
+          rootCommand: string;
+          additionalPermissions: import('../services/sandboxManager.js').SandboxPermissions;
+        };
+
+        const confirmationDetails: SerializableConfirmationDetails = {
+          type: 'sandbox_expansion',
+          title: 'Sandbox Expansion Request',
+          command: String(
+            activeCall.request.args['command'] ?? parsedError.rootCommand,
+          ),
+          rootCommand: parsedError.rootCommand,
+          additionalPermissions: parsedError.additionalPermissions,
+        };
+
+        const correlationId = crypto.randomUUID();
+
+        // Mutate the active call so resolveConfirmation generates the correct Sandbox Expansion details
+        activeCall.request.args['additional_permissions'] =
+          parsedError.additionalPermissions;
+        activeCall.invocation = activeCall.tool.build(activeCall.request.args);
+
+        // CRITICAL: We must push the new args and invocation into the state manager
+        // before calling resolveConfirmation, because resolveConfirmation fetches
+        // the tool call directly from the state manager!
+        this.state.updateArgs(
+          callId,
+          activeCall.request.args,
+          activeCall.invocation,
+        );
+
+        this.state.updateStatus(callId, CoreToolCallStatus.AwaitingApproval, {
+          confirmationDetails,
+          correlationId,
+        });
+
+        const validatingCall = {
+          ...activeCall,
+          status: CoreToolCallStatus.Validating,
+        } as ValidatingToolCall;
+
+        const confResult = await resolveConfirmation(validatingCall, signal, {
+          config: this.config,
+          messageBus: this.messageBus,
+          state: this.state,
+          modifier: this.modifier,
+          getPreferredEditor: this.getPreferredEditor,
+          schedulerId: this.schedulerId,
+          onWaitingForConfirmation: this.onWaitingForConfirmation,
+        });
+
+        if (confResult.outcome === ToolConfirmationOutcome.Cancel) {
+          type LegacyHack = ToolCallResponseInfo & {
+            llmContent?: string;
+            returnDisplay?: string;
+          };
+          const errorResponse = { ...result.response } as LegacyHack;
+          errorResponse.llmContent =
+            'User cancelled sandbox expansion. The command failed with a sandbox denial. Shell output:\n' +
+            String(errorResponse.returnDisplay);
+
+          this.state.updateStatus(
+            callId,
+            CoreToolCallStatus.Error,
+            errorResponse,
+          );
+          return false;
+        }
+
+        activeCall.request.args['additional_permissions'] =
+          parsedError.additionalPermissions;
+
+        // Reset the output stream visual so it replaces the error text
+        this.state.updateStatus(callId, CoreToolCallStatus.Executing, {
+          liveOutput: undefined,
+        });
+
+        // Call _execute synchronously and properly return its promise to loop internally!
+        return await this._execute(
+          {
+            ...activeCall,
+            status: CoreToolCallStatus.Scheduled,
+          } as ScheduledToolCall,
+          signal,
+        );
+      } catch (_e) {
+        // Fallback to normal error handling if parsing/looping fails
+      }
+    }
+
     if (result.status === CoreToolCallStatus.Success) {
       this.state.updateStatus(
         callId,

packages/core/src/services/sandboxManager.test.ts

@@ -10,7 +10,7 @@ import { NoopSandboxManager, sanitizePaths } from './sandboxManager.js';
 import { createSandboxManager } from './sandboxManagerFactory.js';
 import { LinuxSandboxManager } from '../sandbox/linux/LinuxSandboxManager.js';
 import { MacOsSandboxManager } from '../sandbox/macos/MacOsSandboxManager.js';
-import { WindowsSandboxManager } from './windowsSandboxManager.js';
+import { WindowsSandboxManager } from '../sandbox/windows/WindowsSandboxManager.js';
 
 describe('sanitizePaths', () => {
   it('should return undefined if no paths are provided', () => {

packages/core/src/services/sandboxManager.ts

@@ -11,6 +11,18 @@ import {
   getSecureSanitizationConfig,
   type EnvironmentSanitizationConfig,
 } from './environmentSanitization.js';
+export interface SandboxPermissions {
+  /** Filesystem permissions. */
+  fileSystem?: {
+    /** Paths that should be readable by the command. */
+    read?: string[];
+    /** Paths that should be writable by the command. */
+    write?: string[];
+  };
+  /** Whether the command should have network access. */
+  network?: boolean;
+}
+
 /**
  * Security boundaries and permissions applied to a specific sandboxed execution.
  */
@@ -23,6 +35,8 @@ export interface ExecutionPolicy {
   networkAccess?: boolean;
   /** Rules for scrubbing sensitive environment variables. */
   sanitizationConfig?: Partial<EnvironmentSanitizationConfig>;
+  /** Additional granular permissions to grant to this command. */
+  additionalPermissions?: SandboxPermissions;
 }
 
 /**
@@ -76,6 +90,16 @@ export interface SandboxManager {
   prepareCommand(req: SandboxRequest): Promise<SandboxedCommand>;
 }
 
+/**
+ * Files that represent the governance or "constitution" of the repository
+ * and should be write-protected in any sandbox.
+ */
+export const GOVERNANCE_FILES = [
+  { path: '.gitignore', isDirectory: false },
+  { path: '.geminiignore', isDirectory: false },
+  { path: '.git', isDirectory: true },
+] as const;
+
 /**
  * A no-op implementation of SandboxManager that silently passes commands
  * through while applying environment sanitization.

packages/core/src/services/sandboxManagerFactory.ts

@@ -12,8 +12,9 @@ import {
 } from './sandboxManager.js';
 import { LinuxSandboxManager } from '../sandbox/linux/LinuxSandboxManager.js';
 import { MacOsSandboxManager } from '../sandbox/macos/MacOsSandboxManager.js';
-import { WindowsSandboxManager } from './windowsSandboxManager.js';
+import { WindowsSandboxManager } from '../sandbox/windows/WindowsSandboxManager.js';
 import type { SandboxConfig } from '../config/config.js';
+import { type SandboxPolicyManager } from '../policy/sandboxPolicyManager.js';
 
 /**
  * Creates a sandbox manager based on the provided settings.
@@ -21,7 +22,13 @@ import type { SandboxConfig } from '../config/config.js';
 export function createSandboxManager(
   sandbox: SandboxConfig | undefined,
   workspace: string,
+  policyManager?: SandboxPolicyManager,
+  approvalMode?: string,
 ): SandboxManager {
+  if (approvalMode === 'yolo') {
+    return new NoopSandboxManager();
+  }
+
   const isWindows = os.platform() === 'win32';
 
   if (
@@ -36,7 +43,15 @@ export function createSandboxManager(
       return new LinuxSandboxManager({ workspace });
     }
     if (os.platform() === 'darwin') {
-      return new MacOsSandboxManager({ workspace });
+      const modeConfig =
+        policyManager && approvalMode
+          ? policyManager.getModeConfig(approvalMode)
+          : undefined;
+      return new MacOsSandboxManager({
+        workspace,
+        modeConfig,
+        policyManager,
+      });
     }
     return new LocalSandboxManager();
   }

packages/core/src/services/shellExecutionService.ts

@@ -31,7 +31,11 @@ import {
   sanitizeEnvironment,
   type EnvironmentSanitizationConfig,
 } from './environmentSanitization.js';
-import { NoopSandboxManager, type SandboxManager } from './sandboxManager.js';
+import {
+  NoopSandboxManager,
+  type SandboxManager,
+  type SandboxPermissions,
+} from './sandboxManager.js';
 import type { SandboxConfig } from '../config/config.js';
 import { killProcessGroup } from '../utils/process-utils.js';
 import {
@@ -84,6 +88,7 @@ export type ShellExecutionResult = ExecutionResult;
 export type ShellExecutionHandle = ExecutionHandle;
 
 export interface ShellExecutionConfig {
+  additionalPermissions?: SandboxPermissions;
   terminalWidth?: number;
   terminalHeight?: number;
   pager?: string;
@@ -441,6 +446,7 @@ export class ShellExecutionService {
         ...shellExecutionConfig,
         ...(shellExecutionConfig.sandboxConfig || {}),
         sanitizationConfig,
+        additionalPermissions: shellExecutionConfig.additionalPermissions,
       },
     });
 

packages/core/src/services/teleportService.test.ts

@@ -0,0 +1,272 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import * as path from 'node:path';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import { TeleportService } from './teleportService.js';
+import { type Config } from '../config/config.js';
+import { spawnSync, type SpawnSyncOptions } from 'node:child_process';
+
+const actualSpawnSync = (
+  await vi.importActual<typeof import('node:child_process')>(
+    'node:child_process',
+  )
+).spawnSync;
+
+vi.mock('node:child_process', async (importOriginal) => {
+  const original = await importOriginal<typeof import('node:child_process')>();
+  return {
+    ...original,
+    spawnSync: vi
+      .fn()
+      .mockImplementation(
+        (cmd: string, args: string[], options: SpawnSyncOptions) => {
+          return original.spawnSync(cmd, args, options);
+        },
+      ),
+  };
+});
+
+describe('TeleportService', () => {
+  let tempDir: string;
+  let config: Config;
+  let teleportService: TeleportService;
+  const sessionId = 'test-session-id-12345678';
+
+  beforeEach(() => {
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gemini-teleport-test-'));
+
+    fs.mkdirSync(path.join(tempDir, 'chats'), { recursive: true });
+    fs.mkdirSync(path.join(tempDir, 'logs'), { recursive: true });
+    fs.mkdirSync(path.join(tempDir, sessionId), { recursive: true });
+    fs.mkdirSync(path.join(tempDir, 'tool-outputs', `session-${sessionId}`), {
+      recursive: true,
+    });
+
+    const chatFileName = `session-2026-03-14-test-ses.json`;
+    fs.writeFileSync(
+      path.join(tempDir, 'chats', chatFileName),
+      JSON.stringify({ sessionId, messages: [] }),
+    );
+
+    fs.writeFileSync(
+      path.join(tempDir, 'logs', `session-${sessionId}.jsonl`),
+      'log content',
+    );
+
+    config = {
+      storage: {
+        getProjectTempDir: () => tempDir,
+      },
+      getSessionId: () => sessionId,
+    } as unknown as Config;
+
+    teleportService = new TeleportService(config);
+
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion, @typescript-eslint/no-explicit-any
+    vi.mocked(spawnSync).mockImplementation(actualSpawnSync as any);
+  });
+
+  afterEach(() => {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+    vi.clearAllMocks();
+  });
+
+  it('should export a session successfully', async () => {
+    const outputPath = path.join(tempDir, 'export.tar.gz');
+    const result = await teleportService.exportSession(sessionId, outputPath);
+
+    expect(result.sessionId).toBe(sessionId);
+    expect(fs.existsSync(outputPath)).toBe(true);
+    expect(result.filesIncluded.some((f) => f.includes('chats'))).toBe(true);
+    expect(result.filesIncluded.some((f) => f.includes('logs'))).toBe(true);
+  });
+
+  it('should import a session successfully', async () => {
+    const exportPath = path.join(tempDir, 'export.tar.gz');
+    await teleportService.exportSession(sessionId, exportPath);
+
+    const importTempDir = fs.mkdtempSync(
+      path.join(os.tmpdir(), 'gemini-import-test-'),
+    );
+    const importConfig = {
+      storage: {
+        getProjectTempDir: () => importTempDir,
+      },
+    } as unknown as Config;
+    const importService = new TeleportService(importConfig);
+
+    const result = await importService.importSession(exportPath);
+
+    expect(result.sessionId).toBe(sessionId);
+    expect(fs.existsSync(path.join(importTempDir, 'chats'))).toBe(true);
+
+    const chatFiles = fs.readdirSync(path.join(importTempDir, 'chats'));
+    expect(chatFiles.length).toBe(1);
+    const importedChatContent = JSON.parse(
+      fs.readFileSync(path.join(importTempDir, 'chats', chatFiles[0]), 'utf8'),
+    );
+    expect(importedChatContent.sessionId).toBe(sessionId);
+
+    fs.rmSync(importTempDir, { recursive: true, force: true });
+  });
+
+  it('should export and import an encrypted session', async () => {
+    const secret = 'super-secret';
+    const exportPath = path.join(tempDir, 'encrypted.tar.gz');
+    await teleportService.exportSession(sessionId, exportPath, secret);
+
+    expect(fs.existsSync(exportPath)).toBe(true);
+    const content = fs.readFileSync(exportPath);
+    expect(content.subarray(0, 2).toString('hex')).not.toBe('1f8b'); // Gzip header
+
+    const importTempDir = fs.mkdtempSync(
+      path.join(os.tmpdir(), 'gemini-encrypted-import-test-'),
+    );
+    const importConfig = {
+      storage: {
+        getProjectTempDir: () => importTempDir,
+      },
+    } as unknown as Config;
+    const importService = new TeleportService(importConfig);
+
+    const result = await importService.importSession(exportPath, secret);
+    expect(result.sessionId).toBe(sessionId);
+    expect(fs.existsSync(path.join(importTempDir, 'chats'))).toBe(true);
+
+    fs.rmSync(importTempDir, { recursive: true, force: true });
+  });
+
+  it('should throw error on incorrect secret', async () => {
+    const secret = 'super-secret';
+    const exportPath = path.join(tempDir, 'encrypted-fail.tar.gz');
+    await teleportService.exportSession(sessionId, exportPath, secret);
+
+    const importTempDir = fs.mkdtempSync(
+      path.join(os.tmpdir(), 'gemini-encrypted-fail-test-'),
+    );
+    const importConfig = {
+      storage: {
+        getProjectTempDir: () => importTempDir,
+      },
+    } as unknown as Config;
+    const importService = new TeleportService(importConfig);
+
+    await expect(
+      importService.importSession(exportPath, 'wrong-secret'),
+    ).rejects.toThrow('Failed to decrypt');
+
+    fs.rmSync(importTempDir, { recursive: true, force: true });
+  });
+
+  it('should throw security error on path traversal in tarball', async () => {
+    vi.mocked(spawnSync).mockImplementation((cmd, args) => {
+      if (
+        cmd === 'tar' &&
+        args &&
+        Array.isArray(args) &&
+        args.includes('-tf')
+      ) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        return {
+          status: 0,
+          stdout: Buffer.from('../../etc/passwd\nchats/file.json'),
+          stderr: Buffer.from(''),
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        } as any;
+      }
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion, @typescript-eslint/no-explicit-any
+      return actualSpawnSync(cmd as any, args as any);
+    });
+
+    const exportPath = path.join(tempDir, 'malicious.tar.gz');
+    fs.writeFileSync(exportPath, 'dummy');
+
+    await expect(teleportService.importSession(exportPath)).rejects.toThrow(
+      'Security violation: Malicious path detected',
+    );
+  });
+
+  it('should export to blob storage', async () => {
+    const outputPath = path.join(tempDir, 'export-blob.tar.gz');
+    const blobUri = 'gs://my-bucket/session.tar.gz';
+
+    vi.mocked(spawnSync).mockImplementation((cmd, args, options) => {
+      if (cmd === 'gcloud' || cmd === 'gsutil' || cmd === 'aws') {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        return {
+          status: 0,
+          stdout: Buffer.from(''),
+          stderr: Buffer.from(''),
+        } as any;
+      }
+      return actualSpawnSync(
+        cmd,
+        args as string[],
+        options as SpawnSyncOptions,
+      );
+    });
+
+    await teleportService.exportSession(
+      sessionId,
+      outputPath,
+      undefined,
+      blobUri,
+    );
+
+    expect(spawnSync).toHaveBeenCalledWith(
+      expect.stringMatching(/gcloud|gsutil|aws/),
+      expect.arrayContaining(['cp', outputPath, blobUri]),
+    );
+  });
+
+  it('should import from blob storage', async () => {
+    const blobUri = 'gs://my-bucket/session.tar.gz';
+
+    vi.mocked(spawnSync).mockImplementation((cmd, args, options) => {
+      if (cmd === 'gcloud' || cmd === 'gsutil' || cmd === 'aws') {
+        if (args && Array.isArray(args)) {
+          const dest = args[args.length - 1];
+          const chatFileName = path.join(
+            tempDir,
+            'chats',
+            `session-2026-03-14-test-ses.json`,
+          );
+          if (!fs.existsSync(path.join(tempDir, 'chats'))) {
+            fs.mkdirSync(path.join(tempDir, 'chats'), { recursive: true });
+          }
+          if (!fs.existsSync(chatFileName)) {
+            fs.writeFileSync(
+              chatFileName,
+              JSON.stringify({ sessionId, messages: [] }),
+            );
+          }
+          actualSpawnSync('tar', ['-czf', dest, '-C', tempDir, 'chats']);
+        }
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        return {
+          status: 0,
+          stdout: Buffer.from(''),
+          stderr: Buffer.from(''),
+        } as any;
+      }
+      return actualSpawnSync(
+        cmd,
+        args as string[],
+        options as SpawnSyncOptions,
+      );
+    });
+
+    const result = await teleportService.importSession(blobUri);
+    expect(result.sessionId).toBe(sessionId);
+    expect(spawnSync).toHaveBeenCalledWith(
+      expect.stringMatching(/gcloud|gsutil|aws/),
+      expect.arrayContaining(['cp', blobUri, expect.any(String)]),
+    );
+  });
+});

packages/core/src/services/teleportService.ts

@@ -0,0 +1,334 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import * as path from 'node:path';
+import * as fs from 'node:fs';
+import * as crypto from 'node:crypto';
+import { type Config } from '../config/config.js';
+import { SESSION_FILE_PREFIX } from './chatRecordingService.js';
+import { spawnSync } from 'node:child_process';
+
+export interface TeleportExportResult {
+  packagePath: string;
+  sessionId: string;
+  filesIncluded: string[];
+  blobUri?: string;
+}
+
+export interface TeleportImportResult {
+  sessionId: string;
+  projectIdentifier: string;
+}
+
+/**
+ * Service for exporting and importing sessions to make them portable.
+ */
+export class TeleportService {
+  constructor(private config: Config) {}
+
+  /**
+   * Exports a session to a tarball, optionally uploading to blob storage.
+   */
+  async exportSession(
+    sessionId: string,
+    outputPath: string,
+    secret?: string,
+    blobUri?: string,
+  ): Promise<TeleportExportResult> {
+    const storage = this.config.storage;
+    const tempDir = storage.getProjectTempDir();
+    const chatsDir = path.join(tempDir, 'chats');
+
+    const chatFiles = await fs.promises.readdir(chatsDir);
+    const chatFile = chatFiles.find(
+      (f) =>
+        f.startsWith(SESSION_FILE_PREFIX) &&
+        f.includes(sessionId.slice(0, 8)) &&
+        f.endsWith('.json'),
+    );
+
+    if (!chatFile) {
+      throw new Error(`Chat file for session ${sessionId} not found.`);
+    }
+
+    const filesToInclude: string[] = [];
+
+    const metadataFile = 'teleport-metadata.json';
+    const metadataPath = path.join(tempDir, metadataFile);
+    fs.writeFileSync(
+      metadataPath,
+      JSON.stringify({
+        sessionId,
+        exportedAt: new Date().toISOString(),
+        isEncrypted: !!secret,
+      }),
+    );
+    filesToInclude.push(metadataFile);
+    filesToInclude.push(path.join('chats', chatFile));
+
+    const logFile = `session-${sessionId}.jsonl`;
+    const logPath = path.join(tempDir, 'logs', logFile);
+    if (fs.existsSync(logPath)) {
+      filesToInclude.push(path.join('logs', logFile));
+    }
+
+    const sessionDir = path.join(tempDir, sessionId);
+    if (fs.existsSync(sessionDir)) {
+      filesToInclude.push(sessionId);
+    }
+
+    const toolOutputDir = path.join(
+      tempDir,
+      'tool-outputs',
+      `session-${sessionId}`,
+    );
+    if (fs.existsSync(toolOutputDir)) {
+      filesToInclude.push(path.join('tool-outputs', `session-${sessionId}`));
+    }
+
+    const tarPath = secret ? `${outputPath}.tmp` : outputPath;
+    const result = spawnSync('tar', [
+      '-czf',
+      tarPath,
+      '-C',
+      tempDir,
+      ...filesToInclude,
+    ]);
+
+    if (fs.existsSync(metadataPath)) {
+      fs.unlinkSync(metadataPath);
+    }
+
+    if (result.status !== 0) {
+      throw new Error(`Failed to create tarball: ${result.stderr.toString()}`);
+    }
+
+    if (secret) {
+      try {
+        this.encryptFile(tarPath, outputPath, secret);
+        fs.unlinkSync(tarPath);
+      } catch (e) {
+        if (fs.existsSync(tarPath)) fs.unlinkSync(tarPath);
+        throw e;
+      }
+    }
+
+    if (blobUri) {
+      this.uploadToBlob(outputPath, blobUri);
+    }
+
+    return {
+      packagePath: outputPath,
+      sessionId,
+      filesIncluded: filesToInclude,
+      blobUri,
+    };
+  }
+
+  /**
+   * Imports a session from a tarball or blob storage.
+   */
+  async importSession(
+    packagePathOrUri: string,
+    secret?: string,
+  ): Promise<TeleportImportResult> {
+    const storage = this.config.storage;
+    const tempDir = storage.getProjectTempDir();
+    let packagePath = packagePathOrUri;
+    let isTempBlobFile = false;
+
+    if (
+      packagePathOrUri.startsWith('gs://') ||
+      packagePathOrUri.startsWith('s3://')
+    ) {
+      const fileName = path.basename(packagePathOrUri);
+      packagePath = path.join(tempDir, `downloaded-${fileName}`);
+      this.downloadFromBlob(packagePathOrUri, packagePath);
+      isTempBlobFile = true;
+    }
+
+    let extractionPath = packagePath;
+    let isTempExtractionFile = false;
+
+    if (secret) {
+      extractionPath = `${packagePath}.decrypted.tmp`;
+      try {
+        this.decryptFile(packagePath, extractionPath, secret);
+        isTempExtractionFile = true;
+      } finally {
+        if (isTempBlobFile && fs.existsSync(packagePath)) {
+          fs.unlinkSync(packagePath);
+          isTempBlobFile = false;
+        }
+      }
+    }
+
+    try {
+      fs.mkdirSync(tempDir, { recursive: true });
+
+      const listResult = spawnSync('tar', ['-tf', extractionPath]);
+      if (listResult.status === 0) {
+        const files = listResult.stdout.toString().split('\n');
+        for (const file of files) {
+          if (!file) continue;
+          if (path.isAbsolute(file) || file.includes('..')) {
+            throw new Error(
+              `Security violation: Malicious path detected in archive: ${file}`,
+            );
+          }
+        }
+      }
+
+      const result = spawnSync('tar', ['-xzf', extractionPath, '-C', tempDir]);
+
+      if (result.status !== 0) {
+        throw new Error(
+          `Failed to extract tarball: ${result.stderr.toString()}`,
+        );
+      }
+    } finally {
+      if (isTempExtractionFile && fs.existsSync(extractionPath)) {
+        fs.unlinkSync(extractionPath);
+      }
+      if (isTempBlobFile && fs.existsSync(packagePath)) {
+        fs.unlinkSync(packagePath);
+      }
+    }
+
+    let sessionId: string | undefined;
+
+    const metadataPath = path.join(tempDir, 'teleport-metadata.json');
+    if (fs.existsSync(metadataPath)) {
+      try {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+        const metadata = JSON.parse(fs.readFileSync(metadataPath, 'utf8'));
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-type-assertion
+        sessionId = metadata.sessionId as string;
+        fs.unlinkSync(metadataPath);
+      } catch {
+        // Fallback to heuristic
+      }
+    }
+
+    if (!sessionId) {
+      const chatsDir = path.join(tempDir, 'chats');
+      const chatFiles = await fs.promises.readdir(chatsDir);
+
+      const chatFilesWithStats = await Promise.all(
+        chatFiles.map(async (f) => {
+          const stats = await fs.promises.stat(path.join(chatsDir, f));
+          return { file: f, mtime: stats.mtimeMs };
+        }),
+      );
+
+      const latestChat = chatFilesWithStats.sort(
+        (a, b) => b.mtime - a.mtime,
+      )[0];
+      if (!latestChat) {
+        throw new Error('No chat files found after import.');
+      }
+
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+      const chatContent = JSON.parse(
+        await fs.promises.readFile(
+          path.join(chatsDir, latestChat.file),
+          'utf8',
+        ),
+      );
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-type-assertion
+      sessionId = chatContent.sessionId as string;
+    }
+
+    if (!sessionId) {
+      throw new Error('Could not determine session ID after import.');
+    }
+
+    return {
+      sessionId,
+      projectIdentifier: path.basename(tempDir),
+    };
+  }
+
+  private encryptFile(inputPath: string, outputPath: string, secret: string) {
+    const salt = crypto.randomBytes(16);
+    const key = crypto.scryptSync(secret, salt, 32, { N: 16384, r: 8, p: 1 });
+    const iv = crypto.randomBytes(16);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+
+    const input = fs.readFileSync(inputPath);
+    const encrypted = Buffer.concat([cipher.update(input), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+
+    const output = Buffer.concat([salt, iv, authTag, encrypted]);
+    fs.writeFileSync(outputPath, output);
+  }
+
+  private decryptFile(inputPath: string, outputPath: string, secret: string) {
+    const input = fs.readFileSync(inputPath);
+    if (input.length < 48) {
+      throw new Error('Invalid or corrupted encrypted file.');
+    }
+
+    const salt = input.subarray(0, 16);
+    const iv = input.subarray(16, 32);
+    const authTag = input.subarray(32, 48);
+    const encrypted = input.subarray(48);
+
+    const key = crypto.scryptSync(secret, salt, 32, { N: 16384, r: 8, p: 1 });
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(authTag);
+
+    try {
+      const decrypted = Buffer.concat([
+        decipher.update(encrypted),
+        decipher.final(),
+      ]);
+      fs.writeFileSync(outputPath, decrypted);
+    } catch {
+      throw new Error('Failed to decrypt. Incorrect secret or corrupted data.');
+    }
+  }
+
+  private uploadToBlob(localPath: string, blobUri: string) {
+    let result;
+    if (blobUri.startsWith('gs://')) {
+      result = spawnSync('gcloud', ['storage', 'cp', localPath, blobUri]);
+      if (result.status !== 0) {
+        result = spawnSync('gsutil', ['cp', localPath, blobUri]);
+      }
+    } else if (blobUri.startsWith('s3://')) {
+      result = spawnSync('aws', ['s3', 'cp', localPath, blobUri]);
+    } else {
+      throw new Error(`Unsupported blob storage URI scheme: ${blobUri}`);
+    }
+
+    if (result.status !== 0) {
+      throw new Error(
+        `Failed to upload to blob storage: ${result.stderr.toString()}`,
+      );
+    }
+  }
+
+  private downloadFromBlob(blobUri: string, localPath: string) {
+    let result;
+    if (blobUri.startsWith('gs://')) {
+      result = spawnSync('gcloud', ['storage', 'cp', blobUri, localPath]);
+      if (result.status !== 0) {
+        result = spawnSync('gsutil', ['cp', blobUri, localPath]);
+      }
+    } else if (blobUri.startsWith('s3://')) {
+      result = spawnSync('aws', ['s3', 'cp', blobUri, localPath]);
+    } else {
+      throw new Error(`Unsupported blob storage URI scheme: ${blobUri}`);
+    }
+
+    if (result.status !== 0) {
+      throw new Error(
+        `Failed to download from blob storage: ${result.stderr.toString()}`,
+      );
+    }
+  }
+}