fix(shell): address rcFile security issues

- Only source rcFile if the workspace is a trusted folder

- Properly escape the rcFile path to prevent command injection

.dockerignore

@@ -1,17 +0,0 @@
-# Git history - not needed in build context
-.git
-
-# Root node_modules - reinstalled inside container via npm ci
-node_modules
-
-# Package-level node_modules - reinstalled inside container
-packages/*/node_modules
-
-# Development and IDE files
-.github
-.vscode
-npm-debug.log*
-
-# Misc
-.DS_Store
-*.tmp

.gemini/commands/strict-development-rules.md

@@ -53,27 +53,11 @@ Gemini CLI project.
   overriding values. Refer to `text-buffer.ts` for a canonical example.
 - **Logging**: Do not leave `console.log`, `console.warn`, or `console.error` in
   the code.
-- **State**: Ensure state initialization is explicit (e.g., use `undefined`
-  rather than `true` as a default if the state is truly unknown). Prefer a
-  reducer whenever practical. NEVER disable `react-hooks/exhaustive-deps`; fix
-  the code to correctly declare dependencies instead. Evaluate all the React
-  states in a component and ensure that the `useState` calls are necessary and
-  not cases where values could be derived on render. Ensure there are no stale
-  closures that are relying on a value from a previous render. React Components
-  that modify Settings should effectively use the `useSettingsStore` pattern.
-  Components that configure application Settings (e.g settings.json) are the
-  only reasonable case for unsaved changes to drive UX; in these cases, the
-  Settings store should only be written to on save. If the user experience does
-  not utilize unsaved changes because there is no option to exit without saving
-  or reverting the unsaved changes, then the component should directly read from
-  and write to the Settings store without holding pending changes in component
-  level UI state.
-- **Effect**: `useEffect` should not be used to synchronize React states, it
-  should only be used for genuine side effects that occur outside of React.
-  Contributors should be able to strongly justify the need for an effect.
-  Consider whether the effect should instead be inside an event handler, or
-  whether it is better off being computed on render. Carefully manage
-  `useEffect` dependencies.
+- **State & Effects**: Ensure state initialization is explicit (e.g., use
+  `undefined` rather than `true` as a default if the state is truly unknown).
+  Carefully manage `useEffect` dependencies. Prefer a reducer whenever
+  practical. NEVER disable `react-hooks/exhaustive-deps`; fix the code to
+  correctly declare dependencies instead.
 - **Context & Props**: Avoid excessive property drilling. Leverage existing
   providers, extend them, or propose a new one if necessary. Only use providers
   for properties that are consistent across the entire application.

.gemini/settings.json

@@ -2,12 +2,7 @@
   "experimental": {
     "extensionReloading": true,
     "modelSteering": true,
-    "autoMemory": true,
-    "topicUpdateNarration": true,
-    "voiceMode": true,
-    "adk": {
-      "agentSessionNoninteractiveEnabled": true
-    }
+    "memoryManager": true
   },
   "general": {
     "devtools": true

.github/actions/download-mac-binaries/action.yml

@@ -1,23 +0,0 @@
-name: 'Download Mac Binaries'
-description: 'Downloads the unsigned macOS binaries (x64 and arm64)'
-inputs:
-  path:
-    description: 'The base path to download the binaries to'
-    required: true
-    default: 'dist'
-runs:
-  using: 'composite'
-  steps:
-    - name: 'Download macOS arm64 binary'
-      uses: 'actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806' # ratchet:actions/download-artifact@v4
-      continue-on-error: true
-      with:
-        name: 'gemini-darwin-arm64-unsigned'
-        path: '${{ inputs.path }}/darwin-arm64'
-
-    - name: 'Download macOS x64 binary'
-      uses: 'actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806' # ratchet:actions/download-artifact@v4
-      continue-on-error: true
-      with:
-        name: 'gemini-darwin-x64-unsigned'
-        path: '${{ inputs.path }}/darwin-x64'

.github/actions/publish-release/action.yml

@@ -114,14 +114,13 @@ runs:
         BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
         DRY_RUN: '${{ inputs.dry-run }}'
         RELEASE_TAG: '${{ inputs.release-tag }}'
-        GIT_PUSH_TOKEN: '${{ inputs.github-release-token || inputs.github-token }}'
       run: |-
         set -e
         git add package.json package-lock.json packages/*/package.json
         git commit -m "chore(release): ${RELEASE_TAG}"
         if [[ "${DRY_RUN}" == "false" ]]; then
           echo "Pushing release branch to remote..."
-          git push "https://x-access-token:${GIT_PUSH_TOKEN}@github.com/${{ github.repository }}.git" "HEAD:${BRANCH_NAME}" --follow-tags
+          git push --set-upstream origin "${BRANCH_NAME}" --follow-tags
         else
           echo "Dry run enabled. Skipping push."
         fi
@@ -175,9 +174,9 @@ runs:
         npm publish \
           --dry-run="${INPUTS_DRY_RUN}" \
           --workspace="${INPUTS_CORE_PACKAGE_NAME}" \
-          --tag staging-tmp
+          --no-tag
         if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
-          npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} staging-tmp
+          npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} false
         fi
 
     - name: '🔗 Install latest core package'
@@ -223,9 +222,9 @@ runs:
         npm publish \
           --dry-run="${INPUTS_DRY_RUN}" \
           --workspace="${INPUTS_CLI_PACKAGE_NAME}" \
-          --tag staging-tmp
+          --no-tag
         if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
-          npm dist-tag rm ${INPUTS_CLI_PACKAGE_NAME} staging-tmp
+          npm dist-tag rm ${INPUTS_CLI_PACKAGE_NAME} false
         fi
 
     - name: 'Get a2a-server Token'
@@ -250,9 +249,9 @@ runs:
         npm publish \
           --dry-run="${INPUTS_DRY_RUN}" \
           --workspace="${INPUTS_A2A_PACKAGE_NAME}" \
-          --tag staging-tmp
+          --no-tag
           if [[ "${INPUTS_DRY_RUN}" == "false" ]]; then
-            npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} staging-tmp
+            npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} false
           fi
 
     - name: '🔬 Verify NPM release by version'
@@ -309,21 +308,8 @@ runs:
         fi
         rm -rf test-bundle
 
-        RELEASE_ASSETS=("gemini-cli-bundle.zip")
-
-        # Check for and prepare macOS binaries if they exist
-        for arch in arm64 x64; do
-          BINARY_PATH="dist/darwin-${arch}/gemini"
-          if [[ -f "$BINARY_PATH" ]]; then
-            chmod +x "$BINARY_PATH"
-            ZIP_NAME="gemini-darwin-${arch}-unsigned.zip"
-            zip -j "$ZIP_NAME" "$BINARY_PATH"
-            RELEASE_ASSETS+=("$ZIP_NAME")
-          fi
-        done
-
         gh release create "${INPUTS_RELEASE_TAG}" \
-          "${RELEASE_ASSETS[@]}" \
+          gemini-cli-bundle.zip \
           --target "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}" \
           --title "Release ${INPUTS_RELEASE_TAG}" \
           --notes-start-tag "${INPUTS_PREVIOUS_TAG}" \
@@ -337,8 +323,7 @@ runs:
       shell: 'bash'
       run: |
         echo "Cleaning up release branch ${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}..."
-        git push "https://x-access-token:${GIT_PUSH_TOKEN}@github.com/${{ github.repository }}.git" --delete "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}"
+        git push origin --delete "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}"
 
       env:
-        GIT_PUSH_TOKEN: '${{ inputs.github-release-token || inputs.github-token }}'
         STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'

.github/actions/run-tests/action.yml

@@ -28,7 +28,6 @@ runs:
     - name: 'Run Tests'
       env:
         GEMINI_API_KEY: '${{ inputs.gemini_api_key }}'
-        GEMINI_CLI_TRUST_WORKSPACE: true
       working-directory: '${{ inputs.working-directory }}'
       run: |-
         echo "::group::Build"

.github/actions/verify-release/action.yml

@@ -98,7 +98,6 @@ runs:
       working-directory: '${{ inputs.working-directory }}'
       env:
         GEMINI_API_KEY: '${{ inputs.gemini_api_key }}'
-        GEMINI_CLI_TRUST_WORKSPACE: true
         INTEGRATION_TEST_USE_INSTALLED_GEMINI: 'true'
         # We must diable CI mode here because it interferes with interactive tests.
         # See https://github.com/google-gemini/gemini-cli/issues/10517

.github/scripts/apply-issue-labels.cjs

@@ -1,244 +0,0 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-module.exports = async ({ github, context, core }) => {
-  const rawLabels = process.env.LABELS_OUTPUT;
-  core.info(`Raw labels JSON: ${rawLabels}`);
-  let parsedLabels;
-  try {
-    // First, try to parse the raw output as JSON.
-    parsedLabels = JSON.parse(rawLabels);
-  } catch (jsonError) {
-    // If that fails, check for a markdown code block.
-    core.warning(
-      `Direct JSON parsing failed: ${jsonError.message}. Trying to extract from a markdown block.`,
-    );
-    const jsonMatch = rawLabels.match(/```json\s*([\s\S]*?)\s*```/);
-    if (jsonMatch && jsonMatch[1]) {
-      try {
-        parsedLabels = JSON.parse(jsonMatch[1].trim());
-      } catch (markdownError) {
-        core.setFailed(
-          `Failed to parse JSON even after extracting from markdown block: ${markdownError.message}\nRaw output: ${rawLabels}`,
-        );
-        return;
-      }
-    } else {
-      // If no markdown block, try to find a raw JSON array in the output.
-      // The CLI may include debug/log lines (e.g. telemetry init, YOLO mode)
-      // before the actual JSON response.
-      const jsonArrayMatch = rawLabels.match(
-        /\[\s*\{\s*"issue_number"[\s\S]*\}\s*\]/,
-      );
-      if (jsonArrayMatch) {
-        try {
-          parsedLabels = JSON.parse(jsonArrayMatch[0]);
-        } catch (extractError) {
-          // It's possible the regex matched from a `[STARTUP]` log all the way to the end
-          // of the JSON array. We need to be more aggressive and find the FIRST `[ { "issue_number"`
-          core.warning(
-            `Strict array match failed: ${extractError.message}. Attempting to clean leading noisy brackets.`,
-          );
-          const fallbackMatch = rawLabels.match(
-            /(\[\s*\{\s*"issue_number"[\s\S]*)/,
-          );
-          if (fallbackMatch) {
-            try {
-              // We might have grabbed trailing noise too, so we find the last closing bracket
-              const cleaned = fallbackMatch[0].substring(
-                0,
-                fallbackMatch[0].lastIndexOf(']') + 1,
-              );
-              parsedLabels = JSON.parse(cleaned);
-            } catch (fallbackError) {
-              core.setFailed(
-                `Found JSON-like content but failed to parse: ${fallbackError.message}\nRaw output: ${rawLabels}`,
-              );
-              return;
-            }
-          } else {
-            core.setFailed(
-              `Found JSON-like content but failed to parse: ${extractError.message}\nRaw output: ${rawLabels}`,
-            );
-            return;
-          }
-        }
-      } else {
-        core.setFailed(
-          `Output is not valid JSON and does not contain extractable JSON.\nRaw output: ${rawLabels}`,
-        );
-        return;
-      }
-    }
-  }
-  core.info(`Parsed labels JSON: ${JSON.stringify(parsedLabels)}`);
-
-  for (const entry of parsedLabels) {
-    const issueNumber = entry.issue_number;
-    if (!issueNumber) {
-      core.info(
-        `Skipping entry with no issue number: ${JSON.stringify(entry)}`,
-      );
-      continue;
-    }
-
-    let labelsToAdd = entry.labels_to_add || [];
-    let labelsToRemove = entry.labels_to_remove || [];
-
-    labelsToRemove.push('status/need-triage');
-
-    if (labelsToAdd.includes('status/manual-triage')) {
-      // If the AI flagged it for manual triage, remove bot-triaged if it exists
-      labelsToRemove.push('status/bot-triaged');
-      // Ensure we don't accidentally try to add bot-triaged if the AI returned it
-      labelsToAdd = labelsToAdd.filter((l) => l !== 'status/bot-triaged');
-    } else {
-      // Standard successful bot triage
-      labelsToAdd.push('status/bot-triaged');
-    }
-
-    // Deduplicate arrays
-    labelsToAdd = [...new Set(labelsToAdd)];
-    labelsToRemove = [...new Set(labelsToRemove)];
-
-    // Fetch existing labels to auto-resolve conflicts
-    try {
-      const { data: issueData } = await github.rest.issues.get({
-        owner: context.repo.owner,
-        repo: context.repo.repo,
-        issue_number: issueNumber,
-      });
-      const existingLabels = issueData.labels.map((l) =>
-        typeof l === 'string' ? l : l.name,
-      );
-
-      const hasNewArea = labelsToAdd.some((l) => l.startsWith('area/'));
-      if (hasNewArea) {
-        const existingAreas = existingLabels.filter((l) =>
-          l.startsWith('area/'),
-        );
-        labelsToRemove.push(...existingAreas);
-      }
-
-      const hasNewPriority = labelsToAdd.some((l) => l.startsWith('priority/'));
-      if (hasNewPriority) {
-        const existingPriorities = existingLabels.filter((l) =>
-          l.startsWith('priority/'),
-        );
-        labelsToRemove.push(...existingPriorities);
-      }
-
-      const hasNewKind = labelsToAdd.some((l) => l.startsWith('kind/'));
-      if (hasNewKind) {
-        const existingKinds = existingLabels.filter((l) =>
-          l.startsWith('kind/'),
-        );
-        labelsToRemove.push(...existingKinds);
-      }
-
-      // Re-deduplicate and filter out labels we are trying to add
-      labelsToRemove = [...new Set(labelsToRemove)].filter(
-        (l) => !labelsToAdd.includes(l),
-      );
-    } catch (e) {
-      core.warning(
-        `Failed to fetch existing labels for #${issueNumber}: ${e.message}`,
-      );
-    }
-
-    // Enforce mutually exclusive area labels
-    const areaLabelsToAdd = labelsToAdd.filter((l) => l.startsWith('area/'));
-    if (areaLabelsToAdd.length > 1) {
-      core.warning(
-        `Issue #${issueNumber} has multiple area labels to add: ${areaLabelsToAdd.join(', ')}. Keeping only the first one.`,
-      );
-      const firstArea = areaLabelsToAdd[0];
-      labelsToAdd = labelsToAdd.filter(
-        (l) => !l.startsWith('area/') || l === firstArea,
-      );
-    }
-
-    // Enforce mutually exclusive priority labels
-    const priorityLabelsToAdd = labelsToAdd.filter((l) =>
-      l.startsWith('priority/'),
-    );
-    if (priorityLabelsToAdd.length > 1) {
-      core.warning(
-        `Issue #${issueNumber} has multiple priority labels to add: ${priorityLabelsToAdd.join(', ')}. Keeping only the first one.`,
-      );
-      const firstPriority = priorityLabelsToAdd[0];
-      labelsToAdd = labelsToAdd.filter(
-        (l) => !l.startsWith('priority/') || l === firstPriority,
-      );
-    }
-
-    if (labelsToAdd.length > 0) {
-      await github.rest.issues.addLabels({
-        owner: context.repo.owner,
-        repo: context.repo.repo,
-        issue_number: issueNumber,
-        labels: labelsToAdd,
-      });
-
-      const explanation = entry.explanation ? ` - ${entry.explanation}` : '';
-      core.info(
-        `Successfully added labels for #${issueNumber}: ${labelsToAdd.join(', ')}${explanation}`,
-      );
-    }
-
-    if (labelsToRemove.length > 0) {
-      for (const label of labelsToRemove) {
-        try {
-          await github.rest.issues.removeLabel({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            issue_number: issueNumber,
-            name: label,
-          });
-        } catch (e) {
-          if (e.status !== 404) {
-            core.warning(
-              `Failed to remove label ${label} from #${issueNumber}: ${e.message}`,
-            );
-          }
-        }
-      }
-      core.info(
-        `Successfully removed labels for #${issueNumber}: ${labelsToRemove.join(', ')}`,
-      );
-    }
-
-    if (
-      (entry.explanation && process.env.SUPPRESS_COMMENT !== 'true') ||
-      entry.effort_analysis
-    ) {
-      let commentBody = '';
-      if (entry.explanation && process.env.SUPPRESS_COMMENT !== 'true') {
-        commentBody += entry.explanation;
-      }
-      if (entry.effort_analysis) {
-        if (commentBody) commentBody += '\n\n';
-        commentBody += `**Effort Analysis:**\n${entry.effort_analysis}`;
-      }
-
-      await github.rest.issues.createComment({
-        owner: context.repo.owner,
-        repo: context.repo.repo,
-        issue_number: issueNumber,
-        body: commentBody,
-      });
-    }
-
-    if (
-      (!entry.labels_to_add || entry.labels_to_add.length === 0) &&
-      (!entry.labels_to_remove || entry.labels_to_remove.length === 0)
-    ) {
-      core.info(
-        `No labels to add or remove for #${issueNumber}, leaving as is`,
-      );
-    }
-  }
-};

.github/scripts/cleanup-triage-labels.cjs

@@ -1,50 +0,0 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-const fs = require('node:fs');
-
-module.exports = async ({ github, context, core }) => {
-  let issuesToCleanup = [];
-  try {
-    const fileContent = fs.readFileSync('issues_to_cleanup.json', 'utf8');
-    issuesToCleanup = JSON.parse(fileContent);
-  } catch (error) {
-    if (error.code === 'ENOENT') {
-      core.info('No issues found to clean up.');
-      return;
-    }
-    core.setFailed(`Failed to read issues_to_cleanup.json: ${error.message}`);
-    return;
-  }
-
-  for (const issue of issuesToCleanup) {
-    try {
-      await github.rest.issues.removeLabel({
-        owner: context.repo.owner,
-        repo: context.repo.repo,
-        issue_number: issue.number,
-        name: 'status/need-triage',
-      });
-      core.info(
-        `Successfully removed status/need-triage from #${issue.number}`,
-      );
-    } catch (error) {
-      if (error.status === 404) {
-        core.info(
-          `Label status/need-triage not found on #${issue.number}, skipping.`,
-        );
-      } else {
-        core.warning(
-          `Failed to remove label from #${issue.number}: ${error.message}`,
-        );
-      }
-    }
-  }
-
-  core.info(
-    `Cleaned up status/need-triage from ${issuesToCleanup.length} issues.`,
-  );
-};

.github/scripts/find-conflicting-labels.cjs

@@ -1,60 +0,0 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-const fs = require('node:fs');
-
-module.exports = async ({ github, context, core }) => {
-  core.info('Fetching open issues to check for conflicting labels...');
-
-  const issues = await github.paginate(github.rest.issues.listForRepo, {
-    owner: context.repo.owner,
-    repo: context.repo.repo,
-    state: 'open',
-    per_page: 100,
-  });
-
-  const conflictingLabelIssues = [];
-
-  for (const issue of issues) {
-    if (issue.pull_request) continue;
-
-    const areaLabels = issue.labels
-      .filter((l) => l.name && l.name.startsWith('area/'))
-      .map((l) => l.name);
-
-    const priorityLabels = issue.labels
-      .filter((l) => l.name && l.name.startsWith('priority/'))
-      .map((l) => l.name);
-
-    if (areaLabels.length > 1 || priorityLabels.length > 1) {
-      let message = `Issue #${issue.number} has conflicting labels:`;
-      if (areaLabels.length > 1)
-        message += ` multiple areas (${areaLabels.join(', ')}).`;
-      if (priorityLabels.length > 1)
-        message += ` multiple priorities (${priorityLabels.join(', ')}).`;
-
-      core.info(message);
-
-      conflictingLabelIssues.push({
-        number: issue.number,
-        title: issue.title,
-        body: issue.body || '',
-      });
-    }
-  }
-
-  // Limit to 50 to avoid overwhelming the AI in a single run
-  const issuesToProcess = conflictingLabelIssues.slice(0, 50);
-
-  fs.writeFileSync(
-    'conflicting_labels_issues.json',
-    JSON.stringify(issuesToProcess, null, 2),
-  );
-
-  core.info(
-    `Found ${conflictingLabelIssues.length} issues with conflicting labels. Wrote ${issuesToProcess.length} to conflicting_labels_issues.json`,
-  );
-};

.github/scripts/gemini-lifecycle-manager.cjs

@@ -1,268 +0,0 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-/**
- * Gemini Scheduled Lifecycle Manager Script
- * @param {object} param0
- * @param {import('@octokit/rest').Octokit} param0.github
- * @param {import('@actions/github/lib/context').Context} param0.context
- * @param {import('@actions/core')} param0.core
- */
-module.exports = async ({ github, context, core }) => {
-  const dryRun = process.env.DRY_RUN === 'true';
-  const owner = context.repo.owner;
-  const repo = context.repo.repo;
-
-  const STALE_LABEL = 'stale';
-  const NEED_INFO_LABEL = 'status/need-information';
-  const EXEMPT_LABELS = [
-    'pinned',
-    'security',
-    '🔒 maintainer only',
-    'help wanted',
-    '🗓️ Public Roadmap',
-  ];
-
-  const STALE_DAYS = 60;
-  const CLOSE_DAYS = 14;
-  const NO_RESPONSE_DAYS = 14;
-
-  const now = new Date();
-  const staleThreshold = new Date(
-    now.getTime() - STALE_DAYS * 24 * 60 * 60 * 1000,
-  );
-  const closeThreshold = new Date(
-    now.getTime() - CLOSE_DAYS * 24 * 60 * 60 * 1000,
-  );
-  const noResponseThreshold = new Date(
-    now.getTime() - NO_RESPONSE_DAYS * 24 * 60 * 60 * 1000,
-  );
-
-  const maintainerCache = new Map();
-  async function isMaintainer(user, association) {
-    if (user?.type === 'Bot') return true;
-    if (['OWNER', 'MEMBER', 'COLLABORATOR'].includes(association)) return true;
-
-    const username = user?.login;
-    if (!username) return false;
-
-    if (maintainerCache.has(username)) {
-      return maintainerCache.get(username);
-    }
-
-    try {
-      const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
-        owner,
-        repo,
-        username,
-      });
-      // Permission can be admin, write, read, none.
-      // Roles like 'maintain' or 'triage' often map to 'write' or 'read' in the top-level field.
-      const isM =
-        ['admin', 'write'].includes(data.permission) ||
-        ['admin', 'maintain', 'write'].includes(data.role_name);
-
-      maintainerCache.set(username, isM);
-      return isM;
-    } catch (err) {
-      core.warning(
-        `Could not check permissions for ${username}: ${err.message}`,
-      );
-      maintainerCache.set(username, false);
-      return false;
-    }
-  }
-
-  async function processItems(query, callback) {
-    core.info(`Searching: ${query}`);
-    try {
-      const response = await github.rest.search.issuesAndPullRequests({
-        q: query,
-        per_page: 100,
-        sort: 'updated',
-        order: 'asc',
-      });
-      const items = response.data.items;
-      core.info(`Found ${items.length} items (batch limited).`);
-      for (const item of items) {
-        try {
-          await callback(item);
-        } catch (err) {
-          core.error(`Error processing #${item.number}: ${err.message}`);
-        }
-      }
-    } catch (err) {
-      core.error(`Search failed: ${err.message}`);
-    }
-  }
-
-  // 1. Handle No-Response (status/need-information)
-  // Removal: Check issues updated in the last 48h that have the label
-  const twoDaysAgo = new Date(now.getTime() - 2 * 24 * 60 * 60 * 1000);
-  await processItems(
-    `repo:${owner}/${repo} is:open label:"${NEED_INFO_LABEL}" updated:>${twoDaysAgo.toISOString()}`,
-    async (item) => {
-      const { data: comments } = await github.rest.issues.listComments({
-        owner,
-        repo,
-        issue_number: item.number,
-        sort: 'created',
-        direction: 'desc',
-        per_page: 5,
-      });
-
-      // Check if the last comment is from a non-maintainer
-      const lastComment = comments[0];
-      if (
-        lastComment &&
-        !(await isMaintainer(lastComment.user, lastComment.author_association))
-      ) {
-        core.info(
-          `Removing ${NEED_INFO_LABEL} from #${item.number} due to contributor response.`,
-        );
-        if (!dryRun) {
-          await github.rest.issues
-            .removeLabel({
-              owner,
-              repo,
-              issue_number: item.number,
-              name: NEED_INFO_LABEL,
-            })
-            .catch(() => {});
-        }
-      }
-    },
-  );
-
-  // Closure: Check issues with the label that haven't been updated in 14 days
-  await processItems(
-    `repo:${owner}/${repo} is:open label:"${NEED_INFO_LABEL}" updated:<${noResponseThreshold.toISOString()}`,
-    async (item) => {
-      core.info(
-        `Closing #${item.number} due to no response for ${NO_RESPONSE_DAYS} days.`,
-      );
-      if (!dryRun) {
-        await github.rest.issues.createComment({
-          owner,
-          repo,
-          issue_number: item.number,
-          body: `This item was marked as needing more information and has not received a response in ${NO_RESPONSE_DAYS} days. Closing it for now. If you still face this problem, feel free to reopen with more details. Thank you!`,
-        });
-        await github.rest.issues.update({
-          owner,
-          repo,
-          issue_number: item.number,
-          state: 'closed',
-        });
-      }
-    },
-  );
-
-  // 2. Handle Stale Mark (60 days inactivity, no stale label)
-  const exemptQuery = EXEMPT_LABELS.map((l) => `-label:"${l}"`).join(' ');
-  await processItems(
-    `repo:${owner}/${repo} is:open -label:"${STALE_LABEL}" ${exemptQuery} updated:<${staleThreshold.toISOString()}`,
-    async (item) => {
-      core.info(`Marking #${item.number} as stale.`);
-      if (!dryRun) {
-        await github.rest.issues.addLabels({
-          owner,
-          repo,
-          issue_number: item.number,
-          labels: [STALE_LABEL],
-        });
-        await github.rest.issues.createComment({
-          owner,
-          repo,
-          issue_number: item.number,
-          body: `This item has been automatically marked as stale due to ${STALE_DAYS} days of inactivity. It will be closed in ${CLOSE_DAYS} days if no further activity occurs. Thank you!`,
-        });
-      }
-    },
-  );
-
-  // 3. Handle Stale Close (14 days with stale label)
-  await processItems(
-    `repo:${owner}/${repo} is:open label:"${STALE_LABEL}" ${exemptQuery} updated:<${closeThreshold.toISOString()}`,
-    async (item) => {
-      core.info(`Closing stale item #${item.number}.`);
-      if (!dryRun) {
-        await github.rest.issues.createComment({
-          owner,
-          repo,
-          issue_number: item.number,
-          body: `This item has been closed due to ${CLOSE_DAYS} additional days of inactivity after being marked as stale. If you believe this is still relevant, feel free to comment or reopen. Thank you!`,
-        });
-        await github.rest.issues.update({
-          owner,
-          repo,
-          issue_number: item.number,
-          state: 'closed',
-        });
-      }
-    },
-  );
-
-  // 4. Handle PR Contribution Policy (Nudge at 7d, Close at 14d)
-  const PR_NUDGE_DAYS = 7;
-  const PR_CLOSE_DAYS = 14;
-  const nudgeThreshold = new Date(
-    now.getTime() - PR_NUDGE_DAYS * 24 * 60 * 60 * 1000,
-  );
-  const prCloseThreshold = new Date(
-    now.getTime() - PR_CLOSE_DAYS * 24 * 60 * 60 * 1000,
-  );
-
-  // Nudge
-  await processItems(
-    `repo:${owner}/${repo} is:open is:pr -label:"help wanted" -label:"🔒 maintainer only" -label:"status/pr-nudge-sent" created:${prCloseThreshold.toISOString()}..${nudgeThreshold.toISOString()}`,
-    async (pr) => {
-      if (await isMaintainer(pr.user, pr.author_association)) return;
-
-      core.info(`Nudging PR #${pr.number} for contribution policy.`);
-      if (!dryRun) {
-        await github.rest.issues.addLabels({
-          owner,
-          repo,
-          issue_number: pr.number,
-          labels: ['status/pr-nudge-sent'],
-        });
-        await github.rest.issues.createComment({
-          owner,
-          repo,
-          issue_number: pr.number,
-          body: "Hi there! Thank you for your interest in contributing to Gemini CLI. \n\nTo ensure we maintain high code quality and focus on our prioritized roadmap, we only guarantee review and consideration of pull requests for issues that are explicitly labeled as 'help wanted'. \n\nThis PR will be closed in 7 days if it remains without that designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding.",
-        });
-      }
-    },
-  );
-
-  // Close
-  await processItems(
-    `repo:${owner}/${repo} is:open is:pr -label:"help wanted" -label:"🔒 maintainer only" created:<${prCloseThreshold.toISOString()}`,
-    async (pr) => {
-      if (await isMaintainer(pr.user, pr.author_association)) return;
-
-      core.info(
-        `Closing PR #${pr.number} per contribution policy (no 'help wanted').`,
-      );
-      if (!dryRun) {
-        await github.rest.issues.createComment({
-          owner,
-          repo,
-          issue_number: pr.number,
-          body: "This pull request is being closed as it has been open for 14 days without a 'help wanted' designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding.",
-        });
-        await github.rest.pulls.update({
-          owner,
-          repo,
-          pull_number: pr.number,
-          state: 'closed',
-        });
-      }
-    },
-  );
-};

.github/scripts/sync-issue-types.cjs

@@ -1,99 +0,0 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-const fs = require('node:fs');
-
-module.exports = async ({ github, context, core }) => {
-  const query = `
-    query($owner: String!, $repo: String!) {
-      repository(owner: $owner, name: $repo) {
-        issues(first: 50, states: OPEN, orderBy: {field: UPDATED_AT, direction: DESC}) {
-          nodes {
-            id
-            number
-            title
-            body
-            issueType {
-              name
-            }
-            labels(first: 20) {
-              nodes {
-                name
-              }
-            }
-          }
-        }
-      }
-    }
-  `;
-
-  try {
-    const result = await github.graphql(query, {
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-    });
-
-    const issues = result.repository.issues.nodes;
-    const issuesNeedingAnalysis = [];
-    let syncedCount = 0;
-
-    for (const issue of issues) {
-      if (issue.issueType === null) {
-        const labelNames = issue.labels.nodes.map((l) => l.name);
-        const hasBug = labelNames.includes('kind/bug');
-        const hasFeature =
-          labelNames.includes('kind/feature') ||
-          labelNames.includes('kind/enhancement');
-
-        let issueTypeId = null;
-        if (hasBug) {
-          issueTypeId = 'IT_kwDOCaSVvs4BR7vP'; // Bug
-        } else if (hasFeature) {
-          issueTypeId = 'IT_kwDOCaSVvs4BR7vQ'; // Feature
-        }
-
-        if (issueTypeId) {
-          await github.graphql(
-            `
-            mutation($issueId: ID!, $issueTypeId: ID!) {
-              updateIssue(input: {id: $issueId, issueTypeId: $issueTypeId}) {
-                issue {
-                  id
-                }
-              }
-            }
-          `,
-            {
-              issueId: issue.id,
-              issueTypeId: issueTypeId,
-            },
-          );
-          core.info(`Successfully synced Issue Type for #${issue.number}`);
-          syncedCount++;
-        } else {
-          // Needs analysis to determine kind/type
-          issuesNeedingAnalysis.push({
-            number: issue.number,
-            title: issue.title,
-            body: issue.body,
-          });
-        }
-      }
-    }
-
-    // Write issues needing analysis to a file so the AI can process them
-    fs.writeFileSync(
-      'no_type_issues.json',
-      JSON.stringify(issuesNeedingAnalysis),
-    );
-    core.info(`Synced ${syncedCount} issues from labels.`);
-    core.info(
-      `Found ${issuesNeedingAnalysis.length} issues missing both type and kind label to be analyzed.`,
-    );
-  } catch (error) {
-    core.setFailed(`Failed to sync issue types: ${error.message}`);
-  }
-};

.github/workflows/build-unsigned-mac-binaries.yml

@@ -1,65 +0,0 @@
-name: 'Build Unsigned Mac Binaries'
-
-on:
-  workflow_dispatch:
-  workflow_call:
-    inputs:
-      ref:
-        description: 'The branch, tag, or SHA to build from.'
-        required: true
-        type: 'string'
-
-permissions:
-  contents: 'read'
-
-defaults:
-  run:
-    shell: 'bash'
-
-jobs:
-  build-mac:
-    name: 'Build Unsigned (${{ matrix.arch }})'
-    runs-on: 'macos-latest'
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: ['x64', 'arm64']
-
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
-        with:
-          ref: '${{ inputs.ref || github.ref }}'
-          persist-credentials: false
-
-      - name: 'Set up Node.js'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
-        with:
-          node-version-file: '.nvmrc'
-          architecture: '${{ matrix.arch }}'
-          cache: 'npm'
-
-      - name: 'Install dependencies'
-        run: 'npm ci'
-
-      - name: 'Build Binary'
-        env:
-          SKIP_SIGNING: 'true'
-        run: 'npm run build:binary'
-
-      - name: 'Verify Output Exists'
-        run: |
-          if [ -f "dist/darwin-${{ matrix.arch }}/gemini" ]; then
-            echo "Binary found at dist/darwin-${{ matrix.arch }}/gemini"
-          else
-            echo "Error: Binary not found in dist/darwin-${{ matrix.arch }}/"
-            ls -R dist/
-            exit 1
-          fi
-
-      - name: 'Upload Artifact'
-        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
-        with:
-          name: 'gemini-darwin-${{ matrix.arch }}-unsigned'
-          path: 'dist/darwin-${{ matrix.arch }}/gemini'
-          retention-days: 14

.github/workflows/chained_e2e.yml

@@ -148,7 +148,6 @@ jobs:
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
-          persist-credentials: false
 
       - name: 'Set up Node.js ${{ matrix.node-version }}'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -168,7 +167,6 @@ jobs:
       - name: 'Run E2E tests'
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           VERBOSE: 'true'
           BUILD_SANDBOX_FLAGS: '--cache-from type=gha --cache-to type=gha,mode=max'
@@ -194,7 +192,6 @@ jobs:
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
-          persist-credentials: false
 
       - name: 'Set up Node.js 20.x'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -215,7 +212,6 @@ jobs:
         if: "${{runner.os != 'Windows'}}"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           SANDBOX: 'sandbox:none'
           VERBOSE: 'true'
@@ -235,7 +231,6 @@ jobs:
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
-          persist-credentials: false
 
       - name: 'Set up Node.js 20.x'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -293,7 +288,6 @@ jobs:
       - name: 'Run E2E tests'
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           SANDBOX: 'sandbox:none'
           VERBOSE: 'true'
@@ -317,7 +311,6 @@ jobs:
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
-          persist-credentials: false
           fetch-depth: 0
 
       - name: 'Set up Node.js 20.x'
@@ -341,7 +334,6 @@ jobs:
         if: "${{ steps.check_evals.outputs.should_run == 'true' }}"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-          GEMINI_CLI_TRUST_WORKSPACE: true
           GEMINI_MODEL: 'gemini-3-pro-preview'
           # Only run always passes behavioral tests.
           EVAL_SUITE_TYPE: 'behavioral'

.github/workflows/ci.yml

@@ -57,7 +57,6 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
-          persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
           fetch-depth: 0
 
@@ -131,8 +130,6 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
       - name: 'Link Checker'
         uses: 'lycheeverse/lychee-action@885c65f3dc543b57c898c8099f4e08c8afd178a2' # ratchet: lycheeverse/lychee-action@v2.6.1
         with:
@@ -160,8 +157,6 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
 
       - name: 'Set up Node.js ${{ matrix.node-version }}'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
@@ -184,7 +179,6 @@ jobs:
       - name: 'Run tests and generate reports'
         env:
           NO_COLOR: true
-          GEMINI_CLI_TRUST_WORKSPACE: true
         run: |
           if [[ "${{ matrix.shard }}" == "cli" ]]; then
             npm run test:ci --workspace "@google/gemini-cli"
@@ -257,8 +251,6 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
 
       - name: 'Set up Node.js ${{ matrix.node-version }}'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
@@ -275,7 +267,6 @@ jobs:
       - name: 'Run tests and generate reports'
         env:
           NO_COLOR: true
-          GEMINI_CLI_TRUST_WORKSPACE: true
         run: |
           if [[ "${{ matrix.shard }}" == "cli" ]]; then
             npm run test:ci --workspace "@google/gemini-cli" -- --coverage.enabled=false
@@ -346,7 +337,6 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
-          persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
 
       - name: 'Initialize CodeQL'
@@ -371,7 +361,6 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
-          persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
           fetch-depth: 1
 
@@ -399,7 +388,6 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
-          persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
 
       - name: 'Set up Node.js 20.x'
@@ -442,7 +430,6 @@ jobs:
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
           NO_COLOR: true
-          GEMINI_CLI_TRUST_WORKSPACE: true
           NODE_OPTIONS: '--max-old-space-size=32768 --max-semi-space-size=256'
           UV_THREADPOOL_SIZE: '32'
           NODE_ENV: 'test'

.github/workflows/deflake.yml

@@ -43,7 +43,6 @@ jobs:
         with:
           ref: '${{ github.event.pull_request.head.sha }}'
           repository: '${{ github.repository }}'
-          persist-credentials: false
 
       - name: 'Set up Node.js ${{ matrix.node-version }}'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -63,7 +62,6 @@ jobs:
       - name: 'Run E2E tests'
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-          GEMINI_CLI_TRUST_WORKSPACE: true
           IS_DOCKER: "${{ matrix.sandbox == 'sandbox:docker' }}"
           KEEP_OUTPUT: 'true'
           RUNS: '${{ github.event.inputs.runs }}'
@@ -87,7 +85,6 @@ jobs:
         with:
           ref: '${{ github.event.pull_request.head.sha }}'
           repository: '${{ github.repository }}'
-          persist-credentials: false
 
       - name: 'Set up Node.js 20.x'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -108,7 +105,6 @@ jobs:
         if: "runner.os != 'Windows'"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           RUNS: '${{ github.event.inputs.runs }}'
           SANDBOX: 'sandbox:none'
@@ -127,7 +123,6 @@ jobs:
         with:
           ref: '${{ github.event.pull_request.head.sha }}'
           repository: '${{ github.repository }}'
-          persist-credentials: false
 
       - name: 'Set up Node.js 20.x'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions-node@v4
@@ -164,7 +159,6 @@ jobs:
       - name: 'Run E2E tests'
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-          GEMINI_CLI_TRUST_WORKSPACE: true
           KEEP_OUTPUT: 'true'
           SANDBOX: 'sandbox:none'
           VERBOSE: 'true'

.github/workflows/docs-audit.yml

@@ -19,7 +19,6 @@ jobs:
         with:
           fetch-depth: 0
           ref: 'main'
-          persist-credentials: false
 
       - name: 'Set up Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
@@ -29,8 +28,6 @@ jobs:
       - name: 'Run Docs Audit with Gemini'
         id: 'run_gemini'
         uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31'
-        env:
-          GEMINI_CLI_TRUST_WORKSPACE: true
         with:
           gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
           prompt: |

.github/workflows/docs-page-action.yml

@@ -24,8 +24,6 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
 
       - name: 'Setup Pages'
         uses: 'actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b' # ratchet:actions/configure-pages@v5

.github/workflows/eval-pr.yml

@@ -38,7 +38,6 @@ jobs:
         with:
           # Check out the trusted code from main for detection
           fetch-depth: 0
-          persist-credentials: false
 
       - name: 'Detect Steering Changes'
         id: 'detect'
@@ -103,7 +102,6 @@ jobs:
           # This only runs AFTER manual approval
           ref: '${{ github.event.pull_request.head.sha }}'
           fetch-depth: 0
-          persist-credentials: false
 
       - name: 'Remove Approval Notification'
         # Run even if other steps fail, to ensure we clean up the "Action Required" message

.github/workflows/evals-nightly.yml

@@ -46,8 +46,6 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
 
       - name: 'Set up Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
@@ -68,7 +66,6 @@ jobs:
         continue-on-error: true
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-          GEMINI_CLI_TRUST_WORKSPACE: true
           GEMINI_MODEL: '${{ matrix.model }}'
           RUN_EVALS: 'true'
           EVAL_SUITE_TYPE: "${{ github.event.inputs.suite_type || 'behavioral' }}"
@@ -107,8 +104,6 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
 
       - name: 'Download Logs'
         uses: 'actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806' # ratchet:actions/download-artifact@v4

.github/workflows/gemini-automated-issue-dedup.yml

@@ -48,8 +48,6 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
 
       - name: 'Log in to GitHub Container Registry'
         uses: 'docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1' # ratchet:docker/login-action@v3

.github/workflows/gemini-automated-issue-triage.yml

@@ -90,8 +90,6 @@ jobs:
 
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
 
       - name: 'Generate GitHub App Token'
         id: 'generate_token'
@@ -131,29 +129,19 @@ jobs:
             core.info(`Found ${labelNames.length} labels: ${labelNames.join(', ')}`);
             return labelNames;
 
-      - name: 'Prepare Issue Data'
-        id: 'prepare_issue_data'
-        env:
-          ISSUE_TITLE: >-
-            ${{ github.event_name == 'workflow_dispatch' && steps.get_issue_data.outputs.title || github.event.issue.title }}
-          ISSUE_BODY: >-
-            ${{ github.event_name == 'workflow_dispatch' && steps.get_issue_data.outputs.body || github.event.issue.body }}
-        run: |
-          set -euo pipefail
-          echo "Title: ${ISSUE_TITLE}" > issue_context.md
-          echo "Body:" >> issue_context.md
-          echo "${ISSUE_BODY}" >> issue_context.md
-
       - name: 'Run Gemini Issue Analysis'
         uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31' # ratchet:google-github-actions/run-gemini-cli@v0
         id: 'gemini_issue_analysis'
         env:
           GITHUB_TOKEN: '' # Do not pass any auth token here since this runs on untrusted inputs
+          ISSUE_TITLE: >-
+            ${{ github.event_name == 'workflow_dispatch' && steps.get_issue_data.outputs.title || github.event.issue.title }}
+          ISSUE_BODY: >-
+            ${{ github.event_name == 'workflow_dispatch' && steps.get_issue_data.outputs.body || github.event.issue.body }}
           ISSUE_NUMBER: >-
             ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.issue_number || inputs.issue_number) || github.event.issue.number }}
           REPOSITORY: '${{ github.repository }}'
           AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
-          GEMINI_CLI_TRUST_WORKSPACE: 'true'
         with:
           gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
           gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
@@ -170,8 +158,7 @@ jobs:
                 "target": "gcp"
               },
               "coreTools": [
-                "run_shell_command(echo)",
-                "read_file"
+                "run_shell_command(echo)"
               ]
             }
           prompt: |-
@@ -180,7 +167,7 @@ jobs:
             You are an issue triage assistant. Your role is to analyze a GitHub issue and determine the single most appropriate area/ label based on the definitions provided.
 
             ## Steps
-            1. Use the read_file tool to read the file "issue_context.md" which contains the issue title and body.
+            1. Review the issue title and body: ${{ env.ISSUE_TITLE }} and ${{ env.ISSUE_BODY }}.
             2. Review the available labels: ${{ env.AVAILABLE_LABELS }}.
             3. Select exactly one area/ label that best matches the issue based on Reference 1: Area Definitions.
             4. Fallback Logic:

.github/workflows/gemini-cli-bot-brain.yml

@@ -1,350 +0,0 @@
-name: '🧠 Gemini CLI Bot: Brain'
-
-on:
-  schedule:
-    - cron: '0 0 * * *' # Every 24 hours
-  issue_comment:
-    types: ['created']
-  workflow_dispatch:
-    inputs:
-      run_interactive:
-        description: 'Run interactive flow (requires issue_number)'
-        type: 'boolean'
-        default: false
-      issue_number:
-        description: 'Issue/PR number to simulate context from'
-        type: 'string'
-        required: false
-      comment_id:
-        description: 'Specific comment ID to simulate'
-        type: 'string'
-        required: false
-      clear_memory:
-        description: 'Clear memory (drops learnings from previous runs)'
-        type: 'boolean'
-        default: false
-      enable_prs:
-        description: 'Enable PRs (automatically promote changes to PRs)'
-        type: 'boolean'
-        default: false
-
-concurrency:
-  group: '${{ github.workflow }}-${{ github.event.issue.number || github.event.inputs.issue_number || github.ref }}'
-  cancel-in-progress: true
-
-jobs:
-  reasoning:
-    name: 'Brain (Reasoning Layer)'
-    runs-on: 'ubuntu-latest'
-    if: |
-      github.repository == 'google-gemini/gemini-cli' && (
-        github.event_name == 'schedule' ||
-        (github.event_name == 'workflow_dispatch' && github.event.inputs.run_interactive != 'true') ||
-        (github.event_name == 'workflow_dispatch' && github.event.inputs.run_interactive == 'true') ||
-        (github.event_name == 'issue_comment' && github.event.comment.user.login != 'gemini-cli[bot]' && contains(github.event.comment.body, '@gemini-cli') && contains(fromJSON('["COLLABORATOR", "MEMBER", "OWNER"]'), github.event.comment.author_association))
-      )
-    # The reasoning phase is strictly readonly.
-    permissions:
-      contents: 'read'
-      issues: 'read'
-      actions: 'read'
-    env:
-      GEMINI_CLI_TRUST_WORKSPACE: 'true'
-    steps:
-      - name: 'Determine Checkout Ref'
-        id: 'determine_ref'
-        env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          ISSUE_NUMBER: '${{ github.event.issue.number || github.event.inputs.issue_number }}'
-        run: |
-          REF="${{ github.ref }}"
-          if [ -n "$ISSUE_NUMBER" ]; then
-            PR_HEAD=$(gh pr view "$ISSUE_NUMBER" --repo "${{ github.repository }}" --json headRefName --jq .headRefName 2>/dev/null || echo "")
-            if [ -n "$PR_HEAD" ]; then
-              REF="$PR_HEAD"
-            fi
-          fi
-          echo "ref=$REF" >> "$GITHUB_OUTPUT"
-
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          ref: '${{ steps.determine_ref.outputs.ref }}'
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: 'Setup Node.js'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'npm'
-
-      - name: 'Install dependencies'
-        run: 'npm ci'
-
-      - name: 'Build Gemini CLI'
-        run: 'npm run bundle'
-
-      - name: 'Download Previous State'
-        env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-        run: |
-          if [ "${{ github.event.inputs.clear_memory }}" = "true" ]; then
-            echo "Memory clear requested. Skipping previous state download."
-            exit 0
-          fi
-
-          # Find the last successful run of this workflow
-          LAST_RUN_ID=$(gh run list --workflow "${{ github.workflow }}" --status success --limit 1 --json databaseId --jq '.[0].databaseId')
-
-          if [ -n "$LAST_RUN_ID" ]; then
-            echo "Found previous successful run: $LAST_RUN_ID"
-
-            # Download brain memory to a temp dir so we can selectively restore only persistent state
-            mkdir -p .temp_brain_data
-            gh run download "$LAST_RUN_ID" -n brain-data -D .temp_brain_data || echo "brain-data not found"
-
-            # Restore only persistent memory files
-            cp .temp_brain_data/tools/gemini-cli-bot/lessons-learned.md tools/gemini-cli-bot/lessons-learned.md 2>/dev/null || true
-            mkdir -p tools/gemini-cli-bot/history/
-            cp .temp_brain_data/tools/gemini-cli-bot/history/*.csv tools/gemini-cli-bot/history/ 2>/dev/null || true
-            rm -rf .temp_brain_data
-          else
-            echo "No previous successful run found."
-          fi
-
-      - name: 'Collect Current Metrics'
-        env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-        run: 'npx tsx tools/gemini-cli-bot/metrics/index.ts'
-
-      - name: 'Run Brain Phases'
-        env:
-          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          GEMINI_MODEL: 'gemini-3-flash-preview'
-          GEMINI_CLI_HOME: 'tools/gemini-cli-bot'
-          ENABLE_PRS: "${{ github.event.inputs.enable_prs || 'false' }}"
-          TRIGGER_ISSUE_NUMBER: '${{ github.event.issue.number || github.event.inputs.issue_number }}'
-          TRIGGER_COMMENT_ID: '${{ github.event.comment.id || github.event.inputs.comment_id }}'
-        run: |
-          PROMPT_PATH="tools/gemini-cli-bot/brain/scheduled.md"
-          if [ "${{ github.event_name }}" = "issue_comment" ] || [ "${{ github.event.inputs.run_interactive }}" = "true" ]; then
-            PROMPT_PATH="tools/gemini-cli-bot/brain/interactive.md"
-            export ENABLE_PRS="true"
-          fi
-
-          touch trigger_context.md
-          if [ -n "$TRIGGER_ISSUE_NUMBER" ]; then
-            echo "<untrusted_context>" > trigger_context.md
-            echo "# Interactive Trigger Context" >> trigger_context.md
-            echo "You were invoked by a user in issue/PR #$TRIGGER_ISSUE_NUMBER." >> trigger_context.md
-
-            if [ -n "$TRIGGER_COMMENT_ID" ]; then
-              echo "## User Comment" >> trigger_context.md
-              gh api "repos/${{ github.repository }}/issues/comments/$TRIGGER_COMMENT_ID" -q '.body' >> trigger_context.md 2>/dev/null || gh api "repos/${{ github.repository }}/pulls/comments/$TRIGGER_COMMENT_ID" -q '.body' >> trigger_context.md
-              echo "" >> trigger_context.md
-            fi
-
-            echo "## Issue/PR Context" >> trigger_context.md
-            gh issue view "$TRIGGER_ISSUE_NUMBER" >> trigger_context.md 2>/dev/null || gh pr view "$TRIGGER_ISSUE_NUMBER" >> trigger_context.md
-            echo "</untrusted_context>" >> trigger_context.md
-          fi
-
-          if [ "$ENABLE_PRS" = "true" ]; then
-            echo "**System Directive**: PR creation is ENABLED for this run. You MUST activate the **'prs' skill** to stage your changes and generate a \`pr-description.md\` file if you are proposing fixes." >> trigger_context.md
-            echo "**CRITICAL System Directive**: You MUST ONLY propose and implement a **SINGLE** improvement or fix per run. Bundling unrelated changes (e.g., a documentation update and a script fix, or a metrics update and a logic fix) into a single PR is STRICTLY FORBIDDEN and will result in immediate rejection during the critique phase. If you identify multiple issues, pick the most impactful one and ignore the others for now." >> trigger_context.md
-          else
-            echo "**System Directive**: PR creation is DISABLED for this run. You MUST NOT stage files or attempt to create a PR description." >> trigger_context.md
-          fi
-          echo "" >> trigger_context.md
-
-          cat trigger_context.md "$PROMPT_PATH" > combined_prompt.md
-          node bundle/gemini.js --policy tools/gemini-cli-bot/ci-policy.toml --prompt="$(cat combined_prompt.md)"
-
-          if [ -n "$TRIGGER_ISSUE_NUMBER" ] && [ ! -s "issue-comment.md" ] && [ ! -s "pr-comment.md" ]; then
-            echo "Agent failed to respond. Generating fallback error message."
-            echo "⚠️ **Gemini CLI Bot failed to generate a response.**" > "issue-comment.md"
-            echo "" >> "issue-comment.md"
-            echo "I encountered an error or failed to generate a complete response to your request. You can check the [GitHub Actions Run Log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details on what went wrong." >> "issue-comment.md"
-          fi
-
-      - name: 'Run Critique Phase'
-        if: "${{ github.event.inputs.enable_prs == 'true' || github.event_name == 'issue_comment' || github.event.inputs.run_interactive == 'true' }}"
-        env:
-          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          GEMINI_MODEL: 'gemini-3-flash-preview'
-          GEMINI_CLI_HOME: 'tools/gemini-cli-bot'
-        run: |
-          if git diff --staged --quiet; then
-             echo "No changes staged. Skipping critique."
-             echo "[APPROVED]" > critique_result.txt
-          else
-             node bundle/gemini.js --policy tools/gemini-cli-bot/ci-policy.toml --prompt="$(cat tools/gemini-cli-bot/.gemini/skills/critique/SKILL.md)" 2>&1 | tee critique_output.log
-
-             if [ "${PIPESTATUS[0]}" -eq 0 ] && grep -q "\[APPROVED\]" critique_output.log && ! grep -q "\[REJECTED\]" critique_output.log; then
-               echo "[APPROVED]" > critique_result.txt
-             else
-               echo "Critique failed, rejected, or did not explicitly approve changes. Skipping PR creation."
-               echo "[REJECTED]" > critique_result.txt
-             fi
-          fi
-
-      - name: 'Generate Patch'
-        if: "${{ github.event.inputs.enable_prs == 'true' || github.event_name == 'issue_comment' || github.event.inputs.run_interactive == 'true' }}"
-        run: |
-          touch bot-changes.patch
-          touch pr-description.md
-          if [ -f critique_result.txt ] && grep -q "\[APPROVED\]" critique_result.txt && ! grep -q "\[REJECTED\]" critique_result.txt; then
-             git diff --staged > bot-changes.patch
-          else
-             echo "Critique did not approve. Skipping patch generation."
-          fi
-
-      - name: 'Archive Brain Data'
-        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4
-        with:
-          name: 'brain-data'
-          path: |
-            tools/gemini-cli-bot/lessons-learned.md
-            tools/gemini-cli-bot/history/*.csv
-            bot-changes.patch
-            pr-description.md
-            branch-name.txt
-            pr-comment.md
-            pr-number.txt
-            issue-comment.md
-          retention-days: 90
-
-  publish:
-    name: 'Publish Artifacts (Archive Layer)'
-    needs: 'reasoning'
-    runs-on: 'ubuntu-latest'
-    if: "github.repository == 'google-gemini/gemini-cli'"
-    # The publish phase is for archiving artifacts and optionally creating PRs.
-    permissions:
-      contents: 'write'
-      pull-requests: 'write'
-      actions: 'write'
-    steps:
-      - name: 'Generate GitHub App Token 🔑'
-        id: 'generate_token'
-        if: "${{ github.event.inputs.enable_prs == 'true' || github.event_name == 'issue_comment' || github.event.inputs.run_interactive == 'true' }}"
-        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b' # ratchet:actions/create-github-app-token@v2
-        with:
-          app-id: '${{ secrets.APP_ID }}'
-          private-key: '${{ secrets.PRIVATE_KEY }}'
-          owner: '${{ github.repository_owner }}'
-          repositories: '${{ github.event.repository.name }}'
-          permission-contents: 'write'
-          permission-pull-requests: 'write'
-          permission-issues: 'write'
-
-      - name: 'Determine Checkout Ref'
-        id: 'determine_ref'
-        env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          ISSUE_NUMBER: '${{ github.event.issue.number || github.event.inputs.issue_number }}'
-        run: |
-          REF="main"
-          if [ -n "$ISSUE_NUMBER" ]; then
-            PR_HEAD=$(gh pr view "$ISSUE_NUMBER" --repo "${{ github.repository }}" --json headRefName --jq .headRefName 2>/dev/null || echo "")
-            if [ -n "$PR_HEAD" ]; then
-              REF="$PR_HEAD"
-            fi
-          fi
-          echo "ref=$REF" >> "$GITHUB_OUTPUT"
-
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          ref: '${{ steps.determine_ref.outputs.ref }}'
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: 'Download Brain Data'
-        uses: 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093' # ratchet:actions/download-artifact@v4
-        with:
-          name: 'brain-data'
-          path: '${{ runner.temp }}/brain-data/'
-
-      - name: 'Create or Update PR'
-        if: "${{ github.event.inputs.enable_prs == 'true' || github.event_name == 'issue_comment' || github.event.inputs.run_interactive == 'true' }}"
-        env:
-          GH_TOKEN: '${{ steps.generate_token.outputs.token }}'
-          FALLBACK_PAT: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
-        run: |
-          if [ -s "${{ runner.temp }}/brain-data/bot-changes.patch" ]; then
-            git config user.name "gemini-cli[bot]"
-            git config user.email "gemini-cli[bot]@users.noreply.github.com"
-            git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
-
-            BRANCH_NAME="bot/productivity-updates-$(date +'%Y%m%d%H%M%S')-${{ github.run_id }}"
-            if [ -f "${{ runner.temp }}/brain-data/branch-name.txt" ]; then
-              BRANCH_NAME=$(cat "${{ runner.temp }}/brain-data/branch-name.txt")
-            fi
-
-            if [[ ! "$BRANCH_NAME" =~ ^bot/ ]]; then
-              echo "Error: Branch name '$BRANCH_NAME' does not start with 'bot/'. Safety abort."
-              exit 1
-            fi
-
-            git checkout -B "$BRANCH_NAME"
-            git apply "${{ runner.temp }}/brain-data/bot-changes.patch"
-            git add .
-
-            if [ -s "${{ runner.temp }}/brain-data/pr-description.md" ]; then
-              git commit -F "${{ runner.temp }}/brain-data/pr-description.md"
-            else
-              git commit -m "🤖 Gemini Bot Productivity Optimizations"
-            fi
-
-            PR_TITLE="🤖 Gemini Bot Productivity Optimizations"
-            if [ -s "${{ runner.temp }}/brain-data/pr-description.md" ]; then
-              PR_TITLE=$(head -n 1 "${{ runner.temp }}/brain-data/pr-description.md")
-            fi
-
-            if ! git push origin "$BRANCH_NAME" --force; then
-              echo "Push failed. Retrying with FALLBACK_PAT..."
-              export GH_TOKEN="$FALLBACK_PAT"
-              git remote set-url origin "https://x-access-token:${FALLBACK_PAT}@github.com/${{ github.repository }}.git"
-              git push origin "$BRANCH_NAME" --force
-            fi
-
-            if ! gh pr view "$BRANCH_NAME" > /dev/null 2>&1; then
-              gh pr create --draft --title "$PR_TITLE" --body-file "${{ runner.temp }}/brain-data/pr-description.md" --head "$BRANCH_NAME" --base main || \
-              gh pr create --draft --title "🤖 Gemini Bot Productivity Optimizations" --body "Automated changes generated by Gemini CLI Bot." --head "$BRANCH_NAME" --base main
-            else
-              PR_STATE=$(gh pr view "$BRANCH_NAME" --json state --jq .state)
-              if [ "$PR_STATE" = "CLOSED" ]; then
-                NEW_BRANCH_NAME="${BRANCH_NAME}-retry-${{ github.run_id }}"
-                git checkout -b "$NEW_BRANCH_NAME"
-                git push origin "$NEW_BRANCH_NAME" --force
-                gh pr create --draft --title "$PR_TITLE" --body-file "${{ runner.temp }}/brain-data/pr-description.md" --head "$NEW_BRANCH_NAME" --base main || \
-                gh pr create --draft --title "🤖 Gemini Bot Productivity Optimizations" --body "Automated changes generated by Gemini CLI Bot." --head "$NEW_BRANCH_NAME" --base main
-              fi
-            fi
-          fi
-
-      - name: 'Post PR/Issue Comment'
-        env:
-          GH_TOKEN: '${{ steps.generate_token.outputs.token }}'
-          TRIGGER_ISSUE_NUMBER: '${{ github.event.issue.number || github.event.inputs.issue_number }}'
-        run: |
-          if [ -s "${{ runner.temp }}/brain-data/issue-comment.md" ] && [ -n "$TRIGGER_ISSUE_NUMBER" ]; then
-            echo "Posting comment to triggering issue #$TRIGGER_ISSUE_NUMBER"
-            # Use REST API (gh api) instead of GraphQL (gh issue comment) to ensure robot identity
-            # while avoiding potential GraphQL-specific authorization hurdles with PATs.
-            gh api "repos/${{ github.repository }}/issues/$TRIGGER_ISSUE_NUMBER/comments" -F body=@"${{ runner.temp }}/brain-data/issue-comment.md"
-          fi
-
-          if [ -s "${{ runner.temp }}/brain-data/pr-comment.md" ] && [ -f "${{ runner.temp }}/brain-data/pr-number.txt" ]; then
-            PR_NUM=$(cat "${{ runner.temp }}/brain-data/pr-number.txt")
-
-            # Using GitHub App, so author check is no longer valid against gemini-cli-robot
-            # Skipping author validation here to let the app post.
-
-            # Use REST API (gh api) for consistency and robot identity
-            gh api "repos/${{ github.repository }}/issues/$PR_NUM/comments" -F body=@"${{ runner.temp }}/brain-data/pr-comment.md"
-          fi

.github/workflows/gemini-cli-bot-pulse.yml

@@ -1,49 +0,0 @@
-name: '🔄 Gemini CLI Bot: Pulse'
-
-on:
-  schedule:
-    - cron: '*/30 * * * *' # Every 30 minutes
-  workflow_dispatch:
-
-concurrency:
-  group: '${{ github.workflow }}-${{ github.ref }}'
-  cancel-in-progress: true
-
-permissions:
-  contents: 'write'
-  issues: 'write'
-  pull-requests: 'write'
-
-jobs:
-  pulse:
-    name: 'Pulse (Reflex Layer)'
-    runs-on: 'ubuntu-latest'
-    if: "github.repository == 'google-gemini/gemini-cli'"
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-
-      - name: 'Setup Node.js'
-        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'npm'
-
-      - name: 'Install dependencies'
-        run: 'npm ci'
-
-      - name: 'Run Reflex Processes'
-        env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-        run: |
-          if [ -d "tools/gemini-cli-bot/reflexes/scripts" ] && [ "$(ls -A tools/gemini-cli-bot/reflexes/scripts)" ]; then
-            for script in tools/gemini-cli-bot/reflexes/scripts/*.ts; do
-              echo "Running reflex script: $script"
-              npx tsx "$script"
-            done
-          else
-            echo "No reflex scripts found."
-          fi

.github/workflows/gemini-lifecycle-manager.yml

@@ -1,47 +0,0 @@
-name: '🔄 Gemini Scheduled Lifecycle Manager'
-
-on:
-  schedule:
-    - cron: '30 1 * * *' # Once a day
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Run in dry-run mode (no changes applied)'
-        required: false
-        default: false
-        type: 'boolean'
-
-concurrency:
-  group: '${{ github.workflow }}'
-  cancel-in-progress: true
-
-permissions:
-  issues: 'write'
-  pull-requests: 'write'
-
-jobs:
-  manage-lifecycle:
-    if: "github.repository == 'google-gemini/gemini-cli'"
-    runs-on: 'ubuntu-latest'
-    steps:
-      - name: 'Generate GitHub App Token'
-        id: 'generate_token'
-        uses: 'actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349' # ratchet:actions/create-github-app-token@v2
-        with:
-          app-id: '${{ secrets.APP_ID }}'
-          private-key: '${{ secrets.PRIVATE_KEY }}'
-
-      - name: 'Checkout repository'
-        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: 'Lifecycle Management'
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
-        env:
-          DRY_RUN: '${{ inputs.dry_run }}'
-        with:
-          github-token: '${{ steps.generate_token.outputs.token }}'
-          script: |
-            const script = require('./.github/scripts/gemini-lifecycle-manager.cjs');
-            await script({github, context, core});

.github/workflows/gemini-scheduled-issue-dedup.yml

@@ -28,8 +28,6 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
 
       - name: 'Log in to GitHub Container Registry'
         uses: 'docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1' # ratchet:docker/login-action@v3

.github/workflows/gemini-scheduled-issue-triage.yml

@@ -1,6 +1,10 @@
 name: '📋 Gemini Scheduled Issue Triage'
 
 on:
+  issues:
+    types:
+      - 'opened'
+      - 'reopened'
   schedule:
     - cron: '0 * * * *' # Runs every hour
   workflow_dispatch:
@@ -19,15 +23,13 @@ permissions:
 
 jobs:
   triage-issues:
-    timeout-minutes: 60
+    timeout-minutes: 10
     if: |-
       ${{ github.repository == 'google-gemini/gemini-cli' }}
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
 
       - name: 'Generate GitHub App Token'
         id: 'generate_token'
@@ -45,30 +47,10 @@ jobs:
           ISSUE_EVENT: '${{ toJSON(github.event.issue) }}'
         run: |
           set -euo pipefail
-          echo "$ISSUE_EVENT" | jq -c '[{number: .number, title: .title, body: .body}]' > issues_to_triage.json
-          echo "has_issues=true" >> "${GITHUB_OUTPUT}"
+          ISSUE_JSON=$(echo "$ISSUE_EVENT" | jq -c '[{number: .number, title: .title, body: .body}]')
+          echo "issues_to_triage=${ISSUE_JSON}" >> "${GITHUB_OUTPUT}"
           echo "✅ Found issue #${{ github.event.issue.number }} from event to triage! 🎯"
 
-      - name: 'Sync Issue Types'
-        if: |-
-          ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
-        with:
-          github-token: '${{ steps.generate_token.outputs.token }}'
-          script: |-
-            const syncIssueTypes = require('./.github/scripts/sync-issue-types.cjs');
-            await syncIssueTypes({ github, context, core });
-
-      - name: 'Find Issues with Conflicting Labels'
-        if: |-
-          ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
-        with:
-          github-token: '${{ steps.generate_token.outputs.token }}'
-          script: |-
-            const findConflictingLabels = require('./.github/scripts/find-conflicting-labels.cjs');
-            await findConflictingLabels({ github, context, core });
-
       - name: 'Find untriaged issues'
         if: |-
           ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
@@ -80,56 +62,25 @@ jobs:
           set -euo pipefail
 
           echo '🔍 Finding issues missing area labels...'
-          gh issue list --repo "${GITHUB_REPOSITORY}" \
-            --search 'is:open is:issue -label:status/bot-triaged -label:area/core -label:area/agent -label:area/enterprise -label:area/non-interactive -label:area/security -label:area/platform -label:area/extensions -label:area/documentation -label:area/unknown' --limit 50 --json number,title,body > no_area_issues.json
+          NO_AREA_ISSUES="$(gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue -label:area/core -label:area/agent -label:area/enterprise -label:area/non-interactive -label:area/security -label:area/platform -label:area/extensions -label:area/documentation -label:area/unknown' --limit 100 --json number,title,body)"
 
           echo '🔍 Finding issues missing kind labels...'
-          gh issue list --repo "${GITHUB_REPOSITORY}" \
-            --search 'is:open is:issue -label:status/bot-triaged -label:kind/bug -label:kind/enhancement -label:kind/customer-issue -label:kind/question' --limit 50 --json number,title,body > no_kind_issues.json
+          NO_KIND_ISSUES="$(gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue -label:kind/bug -label:kind/enhancement -label:kind/customer-issue -label:kind/question' --limit 100 --json number,title,body)"
 
           echo '🏷️ Finding issues missing priority labels...'
-          gh issue list --repo "${GITHUB_REPOSITORY}" \
-            --search 'is:open is:issue -label:priority/p0 -label:priority/p1 -label:priority/p2 -label:priority/p3 -label:priority/unknown' --limit 50 --json number,title,body > no_priority_issues.json
+          NO_PRIORITY_ISSUES="$(gh issue list --repo "${GITHUB_REPOSITORY}" \
+            --search 'is:open is:issue -label:priority/p0 -label:priority/p1 -label:priority/p2 -label:priority/p3 -label:priority/unknown' --limit 100 --json number,title,body)"
 
-          echo '📏 Finding issues missing effort labels...'
-          gh issue list --repo "${GITHUB_REPOSITORY}" \
-            --search 'is:open is:issue -label:effort/small -label:effort/medium -label:effort/large label:area/core,area/extensions,area/site,area/non-interactive' --limit 5 --json number,title,body > no_effort_issues.json
+          echo '🔄 Merging and deduplicating issues...'
+          ISSUES="$(echo "${NO_AREA_ISSUES}" "${NO_KIND_ISSUES}" "${NO_PRIORITY_ISSUES}" | jq -c -s 'add | unique_by(.number)')"
 
-          echo '🔄 Merging and deduplicating standard triage issues...'
-          if [ ! -f conflicting_labels_issues.json ]; then echo "[]" > conflicting_labels_issues.json; fi
-          jq -c -s 'add | unique_by(.number)' no_area_issues.json no_kind_issues.json no_priority_issues.json conflicting_labels_issues.json > standard_issues_to_triage.json
+          echo '📝 Setting output for GitHub Actions...'
+          echo "issues_to_triage=${ISSUES}" >> "${GITHUB_OUTPUT}"
 
-          echo '📏 Deduplicating effort issues...'
-          jq -c -s 'add | unique_by(.number)' no_effort_issues.json > effort_issues_to_triage.json
-
-          STANDARD_COUNT="$(jq 'length' standard_issues_to_triage.json)"
-          EFFORT_COUNT="$(jq 'length' effort_issues_to_triage.json)"
-          if [ "$STANDARD_COUNT" -gt 0 ] || [ "$EFFORT_COUNT" -gt 0 ]; then
-            echo "has_issues=true" >> "${GITHUB_OUTPUT}"
-            echo "has_standard_issues=$([ "$STANDARD_COUNT" -gt 0 ] && echo 'true' || echo 'false')" >> "${GITHUB_OUTPUT}"
-            echo "has_effort_issues=$([ "$EFFORT_COUNT" -gt 0 ] && echo 'true' || echo 'false')" >> "${GITHUB_OUTPUT}"
-          else
-            echo "has_issues=false" >> "${GITHUB_OUTPUT}"
-            echo "has_standard_issues=false" >> "${GITHUB_OUTPUT}"
-            echo "has_effort_issues=false" >> "${GITHUB_OUTPUT}"
-          fi
-          echo "✅ Found ${STANDARD_COUNT} standard issues and ${EFFORT_COUNT} effort issues to triage! 🎯"
-
-      - name: 'Create Gemini CLI Experiments Override'
-        if: |-
-          steps.get_issue_from_event.outputs.has_issues == 'true' || steps.find_issues.outputs.has_issues == 'true'
-        run: |
-          cat << 'EOF' > gemini_exp.json
-          {
-            "flags": [
-              {
-                "flagId": 45750526,
-                "boolValue": false
-              }
-            ],
-            "experimentIds": []
-          }
-          EOF
+          ISSUE_COUNT="$(echo "${ISSUES}" | jq 'length')"
+          echo "✅ Found ${ISSUE_COUNT} unique issues to triage! 🎯"
 
       - name: 'Get Repository Labels'
         id: 'get_labels'
@@ -146,18 +97,17 @@ jobs:
             core.info(`Found ${labelNames.length} labels: ${labelNames.join(', ')}`);
             return labelNames;
 
-      - name: 'Run Standard Triage Analysis'
+      - name: 'Run Gemini Issue Analysis'
         if: |-
-          steps.get_issue_from_event.outputs.has_issues == 'true' || steps.find_issues.outputs.has_standard_issues == 'true'
+          (steps.get_issue_from_event.outputs.issues_to_triage != '' && steps.get_issue_from_event.outputs.issues_to_triage != '[]') ||
+          (steps.find_issues.outputs.issues_to_triage != '' && steps.find_issues.outputs.issues_to_triage != '[]')
         uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31' # ratchet:google-github-actions/run-gemini-cli@v0
-        id: 'gemini_standard_issue_analysis'
+        id: 'gemini_issue_analysis'
         env:
           GITHUB_TOKEN: '' # Do not pass any auth token here since this runs on untrusted inputs
+          ISSUES_TO_TRIAGE: '${{ steps.get_issue_from_event.outputs.issues_to_triage || steps.find_issues.outputs.issues_to_triage }}'
           REPOSITORY: '${{ github.repository }}'
           AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
-          GEMINI_CLI_TRUST_WORKSPACE: 'true'
-          GEMINI_EXP: 'gemini_exp.json'
-          GEMINI_STRICT_TELEMETRY_LIMITS: 'true'
         with:
           gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
           gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
@@ -170,8 +120,7 @@ jobs:
             {
               "maxSessionTurns": 25,
               "coreTools": [
-                "run_shell_command(echo)",
-                "read_file"
+                "run_shell_command(echo)"
               ],
               "telemetry": {
                 "enabled": true,
@@ -187,16 +136,14 @@ jobs:
 
             ## Steps
 
-            1. You are only able to use the echo and read_file commands. Review the available labels in the environment variable: "${AVAILABLE_LABELS}".
-            2. Use the read_file tool to read the file "standard_issues_to_triage.json" which contains the JSON array of issues to triage.
-            3. Review the issue title, body and any comments provided in the JSON file.
-            4. Identify the most relevant labels from the existing labels, specifically focusing on area/*, kind/*, and priority/*.
+            1. You are only able to use the echo command. Review the available labels in the environment variable: "${AVAILABLE_LABELS}".
+            2. Check environment variable for issues to triage: $ISSUES_TO_TRIAGE (JSON array of issues)
+            3. Review the issue title, body and any comments provided in the environment variables.
+            4. Identify the most relevant labels from the existing labels, specifically focusing on area/*, kind/* and priority/*.
             5. Label Policy:
                - If the issue already has a kind/ label, do not change it.
-               - If the issue has exactly ONE priority/ label, do not change it.
-               - If the issue is missing a priority/ label, OR if the issue currently has MULTIPLE priority/ labels, you must evaluate the issue's impact to determine exactly ONE priority level (priority/p0, priority/p1, priority/p2, priority/p3, or priority/unknown) based the guidelines. If you are fixing an issue with multiple priority/ labels, put the correct one in `labels_to_add` and put all the incorrect ones in `labels_to_remove`.
-               - If the issue has exactly ONE area/ label, do not change it.
-               - If the issue is missing an area/ label, OR if the issue currently has MULTIPLE area/ labels, select exactly ONE area/ label that best fits the issue. Issues MUST NOT have multiple area/ labels. If you are fixing an issue with multiple area/ labels, put the correct one in `labels_to_add` and put all the incorrect ones in `labels_to_remove`.
+               - If the issue already has a priority/ label, do not change it.
+               - If the issue already has an area/ label, do not change it.
                - If any of these are missing, select exactly ONE appropriate label for the missing category.
             6. Identify other applicable labels based on the issue content, such as status/*, help wanted, good first issue, etc.
             7. Give me a single short explanation about why you are selecting each label in the process.
@@ -227,121 +174,11 @@ jobs:
               - Do not add comments or modify the issue content.
               - Do not remove the following labels maintainer, help wanted or good first issue.
               - Triage only the current issue.
-              - Identify exactly ONE area/ label. Do NOT assign multiple area/ labels to a single issue.
+              - Identify only one area/ label.
               - Identify only one kind/ label (Do not apply kind/duplicate or kind/parent-issue)
-              - Identify exactly ONE priority/ label. Do NOT assign multiple priority/ labels to a single issue.
+              - Identify only one priority/ label.
               - Once you categorize the issue if it needs information bump down the priority by 1 eg.. a p0 would become a p1 a p1 would become a p2. P2 and P3 can stay as is in this scenario.
 
-            Categorization Guidelines (Priority):
-            P0 - Urgent Blocking Issues:
-              - Definition: Critical failures breaking core functionality for a large portion of users. Examples: CLI fails to launch globally, core commands (gemini run) crash on valid input, unhandled promise rejections on boot, critical security vulnerability.
-              - Note: You must apply status/manual-triage instead of priority/p0.
-            P1 - Critical but Workable:
-              - Definition: Severe issues without a reasonable workaround, significantly degrading the developer experience but not globally blocking. Examples: Specific tools failing consistently (e.g., `web_search` returns 500s), persistent PTY streaming hangs, memory leaks leading to OOM after short use.
-            P2 - Significant Issues:
-              - Definition: Affect some workflows but a clear workaround exists, or non-critical bugs. Examples: Theme flickering, confusing error messages, minor UI misalignment, failing to read deeply nested config files correctly.
-            P3 - Minor/Enhancements:
-              - Definition: Trivial bugs, typos, documentation requests, or feature requests.
-
-            Categorization Guidelines (Kind):
-            kind/bug: The issue is describing an unexpected behavior or failure in the application.
-            kind/enhancement: The issue is describing a feature request or an improvement to an existing feature.
-            kind/question: The issue is asking a question about how to use the CLI or about a specific feature.
-
-            Categorization Guidelines (Area):
-            area/agent: The "brain" of the CLI. Core agent logic, model quality, tool/function calling, memory, web search, generated code quality, sub-agents.
-            area/core: The fundamental CLI app. UI/UX, installation, OS compatibility, performance, command parsing, theming, flickering.
-            area/documentation: Website docs, READMEs, inline help text.
-            area/enterprise: Telemetry, Policy, Quota / Licensing
-            area/extensions: Gemini CLI extensions capability
-            area/non-interactive: GitHub Actions, SDK, 3P Integrations, Shell Scripting, Command line automation
-            area/platform: Platform specific behavior
-            area/security: Authentication, authorization, privacy, data leaks, credential storage.
-
-      - name: 'Stop Telemetry Collector'
-        if: |-
-          steps.find_issues.outputs.has_effort_issues == 'true'
-        run: 'docker rm -f gemini-telemetry-collector || true'
-
-      - name: 'Run Effort Triage Analysis'
-        if: |-
-          steps.find_issues.outputs.has_effort_issues == 'true'
-        uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31' # ratchet:google-github-actions/run-gemini-cli@v0
-        id: 'gemini_effort_issue_analysis'
-        env:
-          GITHUB_TOKEN: '' # Do not pass any auth token here since this runs on untrusted inputs
-          REPOSITORY: '${{ github.repository }}'
-          AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
-          GEMINI_CLI_TRUST_WORKSPACE: 'true'
-          GEMINI_EXP: 'gemini_exp.json'
-          GEMINI_STRICT_TELEMETRY_LIMITS: 'true'
-        with:
-          gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
-          gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
-          gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
-          gcp_service_account: '${{ vars.SERVICE_ACCOUNT_EMAIL }}'
-          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
-          use_vertex_ai: '${{ vars.GOOGLE_GENAI_USE_VERTEXAI }}'
-          use_gemini_code_assist: '${{ vars.GOOGLE_GENAI_USE_GCA }}'
-          settings: |-
-            {
-              "maxSessionTurns": 25,
-              "coreTools": [
-                "run_shell_command(echo)",
-                "grep_search",
-                "glob",
-                "read_file"
-              ],
-              "telemetry": {
-                "enabled": true,
-                "target": "gcp"
-              }
-            }
-          prompt: |-
-            ## Role
-
-            You are an expert software architect. Analyze the provided GitHub issues and assign the correct `effort/*` label based on the codebase complexity.
-
-            ## Steps
-
-            1. Use the read_file tool to read "effort_issues_to_triage.json".
-            2. For each issue in the array:
-               - You must evaluate the architectural complexity to determine the effort level. You MUST NOT guess the root cause. You MUST actively use your codebase search tools (grep_search and glob) to search for keywords from the issue and explore the codebase. You must identify the specific files and components involved before deciding the effort.
-            3. Output a JSON array of objects, each containing the issue number and the effort label to add, along with an explanation and an effort_analysis field. This effort_analysis must be highly detailed, technical, and empirical. It MUST NOT contain vague guesses (e.g., avoid words like "likely points to" or "possibly"). You must explicitly cite the specific file paths and architectural mechanisms you discovered using your search tools, explain the root cause, and then explicitly state how that complexity maps to the chosen effort level guidelines. For example:
-               ```
-               [
-                 {
-                   "issue_number": 123,
-                   "labels_to_add": ["effort/small"],
-                   "explanation": "This is a simple logic fix.",
-                   "effort_analysis": "The `vscode-ide-companion` extension indiscriminately tracks active text editors via `vscode.window.onDidChangeActiveTextEditor` in `open-files-manager.ts`. When a user opens `.vscode/settings.json`, its content is sent to the CLI's context. The fix is highly localized to the VS Code companion extension's event listener. It involves adding a simple conditional check to exclude specific configuration files from the active editor tracking logic, which is a trivial logic adjustment with a clear root cause."
-                 }
-               ]
-               ```
-
-            ## Guidelines
-
-            - Output only valid JSON format
-            - Do not include any explanation or additional text, just the JSON
-            - Triage only the current issue.
-
-            Categorization Guidelines (Effort):
-            effort/small (1 day or less):
-              - Trivial Logic & Config: Schema updates (Zod), feature flag toggles, adding missing fields to package.json or settings.json.
-              - UI/Aesthetic Adjustments: Fixing minor layout bugs in Ink components (e.g., adding flexShrink, correcting padding in a single Box), text color changes.
-              - Documentation & Strings: Typos, log message updates, CLI argument descriptions.
-              - Localized Bug Fixes: Single-file logic errors, straightforward promise rejections (e.g., wrapping a known failure in a try/catch), simple regex or string parsing fixes.
-            effort/medium (2-3 days):
-              - React/Ink State Management: Debugging useState/useEffect/useReducer bugs, component lifecycle issues (memory leaks in the UI), terminal redraw flickering, or state synchronization between the CLI's internal input buffer and the interactive React components.
-              - Asynchronous Flow & Integration: Resolving complex Promise chains, ERR_STREAM_PREMATURE_CLOSE, debugging IDE companion extensions (VS Code, Android Studio) or resolving hanging HTTP requests/IPC between the CLI and external plugins, timeouts in non-interactive/ACP modes.
-              - Tooling & Output Parsers: Modifying how tools parse streaming stdout/stderr buffers, adding new built-in tools that don't require native bindings.
-              - Cross-Component Refactors: Changes that span across packages/cli and packages/core to pass new data models or telemetry state.
-            effort/large (3+ days):
-              - Platform-Specific Complexities (PTY/Signals): Any issue involving node-pty, child_process.spawn, OS-level shell behavior (Windows vs Linux vs macOS), pseudo-terminal exhaustion (ENXIO), raw mode terminal desyncs, or POSIX signal forwarding (SIGINT/SIGTERM).
-              - Core Architecture & Protocols: Refactoring the Scheduler, Agent-to-Agent (A2A) protocol implementation, low-level MCP (Model Context Protocol) transport mechanisms.
-              - Performance & Memory: Diagnosing massive disk/memory leaks, severe boot time regressions, high-throughput streaming optimizations (e.g., voice streaming pipelines).
-            Note: Any bug that is described as intermittent, flickering, difficult to reproduce, platform-specific, or requiring cross-environment setups (e.g., involving the VS Code IDE companion, GCA plugin, or Android Studio) MUST NOT be rated as effort/small because of the increased overhead of testing and reproducing.
-
             Categorization Guidelines (Priority):
             P0 - Urgent Blocking Issues:
               - DO NOT APPLY THIS LABEL AUTOMATICALLY. Use status/manual-triage instead.
@@ -379,65 +216,64 @@ jobs:
             - This product is designed to use different models eg.. using pro, downgrading to flash etc.
             - When users report that they dont expect the model to change those would be categorized as feature requests.
 
-      - name: 'Apply Standard Labels to Issues'
+      - name: 'Apply Labels to Issues'
         if: |-
-          ${{ steps.gemini_standard_issue_analysis.outcome == 'success' &&
-              steps.gemini_standard_issue_analysis.outputs.summary != '[]' &&
-              steps.gemini_standard_issue_analysis.outputs.summary != '' }}
+          ${{ steps.gemini_issue_analysis.outcome == 'success' &&
+              steps.gemini_issue_analysis.outputs.summary != '[]' }}
         env:
           REPOSITORY: '${{ github.repository }}'
-          LABELS_OUTPUT: '${{ steps.gemini_standard_issue_analysis.outputs.summary }}'
-          SUPPRESS_COMMENT: 'true'
+          LABELS_OUTPUT: '${{ steps.gemini_issue_analysis.outputs.summary }}'
         uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
         with:
           github-token: '${{ steps.generate_token.outputs.token }}'
           script: |-
-            const applyLabels = require('./.github/scripts/apply-issue-labels.cjs');
-            await applyLabels({ github, context, core });
+            const rawLabels = process.env.LABELS_OUTPUT;
+            core.info(`Raw labels JSON: ${rawLabels}`);
+            let parsedLabels;
+            try {
+              const jsonMatch = rawLabels.match(/```json\s*([\s\S]*?)\s*```/);
+              if (!jsonMatch || !jsonMatch[1]) {
+                throw new Error("Could not find a ```json ... ``` block in the output.");
+              }
+              const jsonString = jsonMatch[1].trim();
+              parsedLabels = JSON.parse(jsonString);
+              core.info(`Parsed labels JSON: ${JSON.stringify(parsedLabels)}`);
+            } catch (err) {
+              core.setFailed(`Failed to parse labels JSON from Gemini output: ${err.message}\nRaw output: ${rawLabels}`);
+              return;
+            }
 
-      - name: 'Apply Effort Labels to Issues'
-        if: |-
-          ${{ steps.gemini_effort_issue_analysis.outcome == 'success' &&
-              steps.gemini_effort_issue_analysis.outputs.summary != '[]' &&
-              steps.gemini_effort_issue_analysis.outputs.summary != '' }}
-        env:
-          REPOSITORY: '${{ github.repository }}'
-          LABELS_OUTPUT: '${{ steps.gemini_effort_issue_analysis.outputs.summary }}'
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
-        with:
-          github-token: '${{ steps.generate_token.outputs.token }}'
-          script: |-
-            const applyLabels = require('./.github/scripts/apply-issue-labels.cjs');
-            await applyLabels({ github, context, core });
+            for (const entry of parsedLabels) {
+              const issueNumber = entry.issue_number;
+              if (!issueNumber) {
+                core.info(`Skipping entry with no issue number: ${JSON.stringify(entry)}`);
+                continue;
+              }
 
-      - name: 'Sync Issue Types (Post-Analysis)'
-        if: |-
-          always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
-        with:
-          github-token: '${{ steps.generate_token.outputs.token }}'
-          script: |-
-            const syncIssueTypes = require('./.github/scripts/sync-issue-types.cjs');
-            await syncIssueTypes({ github, context, core });
+              const labelsToAdd = entry.labels_to_add || [];
+              labelsToAdd.push('status/bot-triaged');
 
-      - name: 'Find Triaged Issues to Clean Up'
-        if: |-
-          always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
-        env:
-          GITHUB_TOKEN: '${{ steps.generate_token.outputs.token }}'
-          GITHUB_REPOSITORY: '${{ github.repository }}'
-        run: |-
-          set -euo pipefail
-          echo '🧹 Finding issues that have both bot-triaged and need-triage labels...'
-          gh issue list --repo "${GITHUB_REPOSITORY}" \
-            --search 'is:open is:issue label:status/bot-triaged label:status/need-triage' --limit 50 --json number > issues_to_cleanup.json
+              if (labelsToAdd.length > 0) {
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issueNumber,
+                  labels: labelsToAdd
+                });
+                const explanation = entry.explanation ? ` - ${entry.explanation}` : '';
+                core.info(`Successfully added labels for #${issueNumber}: ${labelsToAdd.join(', ')}${explanation}`);
+              }
 
-      - name: 'Clean Up Triage Labels'
-        if: |-
-          always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
-        with:
-          github-token: '${{ steps.generate_token.outputs.token }}'
-          script: |-
-            const cleanupLabels = require('./.github/scripts/cleanup-triage-labels.cjs');
-            await cleanupLabels({ github, context, core });
+              if (entry.explanation) {
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issueNumber,
+                  body: entry.explanation,
+                });
+              }
+
+              if ((!entry.labels_to_add || entry.labels_to_add.length === 0) && (!entry.labels_to_remove || entry.labels_to_remove.length === 0)) {
+                core.info(`No labels to add or remove for #${issueNumber}, leaving as is`);
+              }
+            }

.github/workflows/gemini-scheduled-pr-triage.yml

@@ -21,8 +21,6 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
 
       - name: 'Generate GitHub App Token'
         id: 'generate_token'

.github/workflows/gemini-scheduled-stale-issue-closer.yml

@@ -0,0 +1,159 @@
+name: '🔒 Gemini Scheduled Stale Issue Closer'
+
+on:
+  schedule:
+    - cron: '0 0 * * 0' # Every Sunday at midnight UTC
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run in dry-run mode (no changes applied)'
+        required: false
+        default: false
+        type: 'boolean'
+
+concurrency:
+  group: '${{ github.workflow }}'
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: 'bash'
+
+jobs:
+  close-stale-issues:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'ubuntu-latest'
+    permissions:
+      issues: 'write'
+    steps:
+      - name: 'Generate GitHub App Token'
+        id: 'generate_token'
+        uses: 'actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349' # ratchet:actions/create-github-app-token@v2
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+          permission-issues: 'write'
+
+      - name: 'Process Stale Issues'
+        uses: 'actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b' # ratchet:actions/github-script@v7
+        env:
+          DRY_RUN: '${{ inputs.dry_run }}'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token }}'
+          script: |
+            const dryRun = process.env.DRY_RUN === 'true';
+            if (dryRun) {
+              core.info('DRY RUN MODE ENABLED: No changes will be applied.');
+            }
+            const batchLabel = 'Stale';
+
+            const threeMonthsAgo = new Date();
+            threeMonthsAgo.setMonth(threeMonthsAgo.getMonth() - 3);
+
+            const tenDaysAgo = new Date();
+            tenDaysAgo.setDate(tenDaysAgo.getDate() - 10);
+
+            core.info(`Cutoff date for creation: ${threeMonthsAgo.toISOString()}`);
+            core.info(`Cutoff date for updates: ${tenDaysAgo.toISOString()}`);
+
+            const query = `repo:${context.repo.owner}/${context.repo.repo} is:issue is:open created:<${threeMonthsAgo.toISOString()}`;
+            core.info(`Searching with query: ${query}`);
+
+            const itemsToCheck = await github.paginate(github.rest.search.issuesAndPullRequests, {
+              q: query,
+              sort: 'created',
+              order: 'asc',
+              per_page: 100
+            });
+
+            core.info(`Found ${itemsToCheck.length} open issues to check.`);
+
+            let processedCount = 0;
+
+            for (const issue of itemsToCheck) {
+              const createdAt = new Date(issue.created_at);
+              const updatedAt = new Date(issue.updated_at);
+              const reactionCount = issue.reactions.total_count;
+
+              // Basic thresholds
+              if (reactionCount >= 5) {
+                continue;
+              }
+
+              // Skip if it has a maintainer, help wanted, or Public Roadmap label
+              const rawLabels = issue.labels.map((l) => l.name);
+              const lowercaseLabels = rawLabels.map((l) => l.toLowerCase());
+              if (
+                lowercaseLabels.some((l) => l.includes('maintainer')) ||
+                lowercaseLabels.includes('help wanted') ||
+                rawLabels.includes('🗓️ Public Roadmap')
+              ) {
+                continue;
+              }
+
+              let isStale = updatedAt < tenDaysAgo;
+
+              // If apparently active, check if it's only bot activity
+              if (!isStale) {
+                try {
+                  const comments = await github.rest.issues.listComments({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    per_page: 100,
+                    sort: 'created',
+                    direction: 'desc'
+                  });
+
+                  const lastHumanComment = comments.data.find(comment => comment.user.type !== 'Bot');
+                  if (lastHumanComment) {
+                    isStale = new Date(lastHumanComment.created_at) < tenDaysAgo;
+                  } else {
+                    // No human comments. Check if creator is human.
+                    if (issue.user.type !== 'Bot') {
+                       isStale = createdAt < tenDaysAgo;
+                    } else {
+                       isStale = true; // Bot created, only bot comments
+                    }
+                  }
+                } catch (error) {
+                  core.warning(`Failed to fetch comments for issue #${issue.number}: ${error.message}`);
+                  continue;
+                }
+              }
+
+              if (isStale) {
+                processedCount++;
+                const message = `Closing stale issue #${issue.number}: "${issue.title}" (${issue.html_url})`;
+                core.info(message);
+
+                if (!dryRun) {
+                  // Add label
+                  await github.rest.issues.addLabels({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    labels: [batchLabel]
+                  });
+
+                  // Add comment
+                  await github.rest.issues.createComment({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    body: 'Hello! As part of our effort to keep our backlog manageable and focus on the most active issues, we are tidying up older reports.\n\nIt looks like this issue hasn\'t been active for a while, so we are closing it for now. However, if you are still experiencing this bug on the latest stable build, please feel free to comment on this issue or create a new one with updated details.\n\nThank you for your contribution!'
+                  });
+
+                  // Close issue
+                  await github.rest.issues.update({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    state: 'closed',
+                    state_reason: 'not_planned'
+                  });
+                }
+              }
+            }
+
+            core.info(`\nTotal issues processed: ${processedCount}`);

.github/workflows/gemini-scheduled-stale-pr-closer.yml

@@ -0,0 +1,254 @@
+name: 'Gemini Scheduled Stale PR Closer'
+
+on:
+  schedule:
+    - cron: '0 2 * * *' # Every day at 2 AM UTC
+  pull_request:
+    types: ['opened', 'edited']
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run in dry-run mode'
+        required: false
+        default: false
+        type: 'boolean'
+
+jobs:
+  close-stale-prs:
+    if: "github.repository == 'google-gemini/gemini-cli'"
+    runs-on: 'ubuntu-latest'
+    permissions:
+      pull-requests: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Generate GitHub App Token'
+        id: 'generate_token'
+        env:
+          APP_ID: '${{ secrets.APP_ID }}'
+        if: |-
+          ${{ env.APP_ID != '' }}
+        uses: 'actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349' # ratchet:actions/create-github-app-token@v2
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+
+      - name: 'Process Stale PRs'
+        uses: 'actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b' # ratchet:actions/github-script@v7
+        env:
+          DRY_RUN: '${{ inputs.dry_run }}'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
+          script: |
+            const dryRun = process.env.DRY_RUN === 'true';
+            const fourteenDaysAgo = new Date();
+            fourteenDaysAgo.setDate(fourteenDaysAgo.getDate() - 14);
+            const thirtyDaysAgo = new Date();
+            thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+
+            // 1. Fetch maintainers for verification
+            let maintainerLogins = new Set();
+            const teams = ['gemini-cli-maintainers', 'gemini-cli-askmode-approvers', 'gemini-cli-docs'];
+
+            for (const team_slug of teams) {
+              try {
+                const members = await github.paginate(github.rest.teams.listMembersInOrg, {
+                  org: context.repo.owner,
+                  team_slug: team_slug
+                });
+                for (const m of members) maintainerLogins.add(m.login.toLowerCase());
+                core.info(`Successfully fetched ${members.length} team members from ${team_slug}`);
+              } catch (e) {
+                // Silently skip if permissions are insufficient; we will rely on author_association
+                core.debug(`Skipped team fetch for ${team_slug}: ${e.message}`);
+              }
+            }
+
+            const isMaintainer = async (login, assoc) => {
+              // Reliably identify maintainers using authorAssociation (provided by GitHub)
+              // and organization membership (if available).
+              const isTeamMember = maintainerLogins.has(login.toLowerCase());
+              const isRepoMaintainer = ['OWNER', 'MEMBER', 'COLLABORATOR'].includes(assoc);
+
+              if (isTeamMember || isRepoMaintainer) return true;
+
+              // Fallback: Check if user belongs to the 'google' or 'googlers' orgs (requires permission)
+              try {
+                const orgs = ['googlers', 'google'];
+                for (const org of orgs) {
+                  try {
+                    await github.rest.orgs.checkMembershipForUser({ org: org, username: login });
+                    return true;
+                  } catch (e) {
+                    if (e.status !== 404) throw e;
+                  }
+                }
+              } catch (e) {
+                // Gracefully ignore failures here
+              }
+
+              return false;
+            };
+
+            // 2. Fetch all open PRs
+            let prs = [];
+            if (context.eventName === 'pull_request') {
+              const { data: pr } = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: context.payload.pull_request.number
+              });
+              prs = [pr];
+            } else {
+              prs = await github.paginate(github.rest.pulls.list, {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                state: 'open',
+                per_page: 100
+              });
+            }
+
+            for (const pr of prs) {
+              const maintainerPr = await isMaintainer(pr.user.login, pr.author_association);
+              const isBot = pr.user.type === 'Bot' || pr.user.login.endsWith('[bot]');
+              if (maintainerPr || isBot) continue;
+
+              // Helper: Fetch labels and linked issues via GraphQL
+              const prDetailsQuery = `query($owner:String!, $repo:String!, $number:Int!) {
+                repository(owner:$owner, name:$repo) {
+                  pullRequest(number:$number) {
+                    closingIssuesReferences(first: 10) {
+                      nodes {
+                        number
+                        labels(first: 20) {
+                          nodes { name }
+                        }
+                      }
+                    }
+                  }
+                }
+              }`;
+
+              let linkedIssues = [];
+              try {
+                const res = await github.graphql(prDetailsQuery, {
+                  owner: context.repo.owner, repo: context.repo.repo, number: pr.number
+                });
+                linkedIssues = res.repository.pullRequest.closingIssuesReferences.nodes;
+              } catch (e) {
+                core.warning(`GraphQL fetch failed for PR #${pr.number}: ${e.message}`);
+              }
+
+              // Check for mentions in body as fallback (regex)
+              const body = pr.body || '';
+              const mentionRegex = /(?:#|https:\/\/github\.com\/[^\/]+\/[^\/]+\/issues\/)(\d+)/i;
+              const matches = body.match(mentionRegex);
+              if (matches && linkedIssues.length === 0) {
+                const issueNumber = parseInt(matches[1]);
+                try {
+                  const { data: issue } = await github.rest.issues.get({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issueNumber
+                  });
+                  linkedIssues = [{ number: issueNumber, labels: { nodes: issue.labels.map(l => ({ name: l.name })) } }];
+                } catch (e) {}
+              }
+
+              // 3. Enforcement Logic
+              const prLabels = pr.labels.map(l => l.name.toLowerCase());
+              const hasHelpWanted = prLabels.includes('help wanted') ||
+                                    linkedIssues.some(issue => issue.labels.nodes.some(l => l.name.toLowerCase() === 'help wanted'));
+
+              const hasMaintainerOnly = prLabels.includes('🔒 maintainer only') ||
+                                        linkedIssues.some(issue => issue.labels.nodes.some(l => l.name.toLowerCase() === '🔒 maintainer only'));
+
+              const hasLinkedIssue = linkedIssues.length > 0;
+
+              // Closure Policy: No help-wanted label = Close after 14 days
+              if (pr.state === 'open' && !hasHelpWanted && !hasMaintainerOnly) {
+                const prCreatedAt = new Date(pr.created_at);
+
+                // We give a 14-day grace period for non-help-wanted PRs to be manually reviewed/labeled by an EM
+                if (prCreatedAt > fourteenDaysAgo) {
+                  core.info(`PR #${pr.number} is new and lacks 'help wanted'. Giving 14-day grace period for EM review.`);
+                  continue;
+                }
+
+                core.info(`PR #${pr.number} is older than 14 days and lacks 'help wanted' association. Closing.`);
+                if (!dryRun) {
+                  await github.rest.issues.createComment({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: pr.number,
+                    body: "Hi there! Thank you for your interest in contributing to Gemini CLI. \n\nTo ensure we maintain high code quality and focus on our prioritized roadmap, we have updated our contribution policy (see [Discussion #17383](https://github.com/google-gemini/gemini-cli/discussions/17383)). \n\n**We only *guarantee* review and consideration of pull requests for issues that are explicitly labeled as 'help wanted'.** All other community pull requests are subject to closure after 14 days if they do not align with our current focus areas. For this reason, we strongly recommend that contributors only submit pull requests against issues explicitly labeled as **'help-wanted'**. \n\nThis pull request is being closed as it has been open for 14 days without a 'help wanted' designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding and for being part of our community!"
+                  });
+                  await github.rest.pulls.update({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    pull_number: pr.number,
+                    state: 'closed'
+                  });
+                }
+                continue;
+              }
+
+              // Also check for linked issue even if it has help wanted (redundant but safe)
+              if (pr.state === 'open' && !hasLinkedIssue) {
+                 // Already covered by hasHelpWanted check above, but good for future-proofing
+                 continue;
+              }
+
+              // 4. Staleness Check (Scheduled only)
+              if (pr.state === 'open' && context.eventName !== 'pull_request') {
+                // Skip PRs that were created less than 30 days ago - they cannot be stale yet
+                const prCreatedAt = new Date(pr.created_at);
+                if (prCreatedAt > thirtyDaysAgo) continue;
+
+                let lastActivity = new Date(pr.created_at);
+                try {
+                  const reviews = await github.paginate(github.rest.pulls.listReviews, {
+                    owner: context.repo.owner, repo: context.repo.repo, pull_number: pr.number
+                  });
+                  for (const r of reviews) {
+                    if (await isMaintainer(r.user.login, r.author_association)) {
+                      const d = new Date(r.submitted_at || r.updated_at);
+                      if (d > lastActivity) lastActivity = d;
+                    }
+                  }
+                  const comments = await github.paginate(github.rest.issues.listComments, {
+                    owner: context.repo.owner, repo: context.repo.repo, issue_number: pr.number
+                  });
+                  for (const c of comments) {
+                    if (await isMaintainer(c.user.login, c.author_association)) {
+                      const d = new Date(c.updated_at);
+                      if (d > lastActivity) lastActivity = d;
+                    }
+                  }
+                } catch (e) {}
+
+                if (lastActivity < thirtyDaysAgo) {
+                  const labels = pr.labels.map(l => l.name.toLowerCase());
+                  const isProtected = labels.includes('help wanted') || labels.includes('🔒 maintainer only');
+                  if (isProtected) {
+                    core.info(`PR #${pr.number} is stale but has a protected label. Skipping closure.`);
+                    continue;
+                  }
+
+                  core.info(`PR #${pr.number} is stale (no maintainer activity for 30+ days). Closing.`);
+                  if (!dryRun) {
+                    await github.rest.issues.createComment({
+                      owner: context.repo.owner,
+                      repo: context.repo.repo,
+                      issue_number: pr.number,
+                      body: "Hi there! Thank you for your contribution. To keep our backlog manageable, we are closing pull requests that haven't seen maintainer activity for 30 days. If you're still working on this, please let us know!"
+                    });
+                    await github.rest.pulls.update({
+                      owner: context.repo.owner,
+                      repo: context.repo.repo,
+                      pull_number: pr.number,
+                      state: 'closed'
+                    });
+                  }
+                }
+              }
+            }

.github/workflows/label-backlog-child-issues.yml

@@ -19,8 +19,6 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
-        with:
-          persist-credentials: false
 
       - name: 'Setup Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
@@ -43,8 +41,6 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
-        with:
-          persist-credentials: false
 
       - name: 'Setup Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4

.github/workflows/links.yml

@@ -17,8 +17,6 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
 
       - name: 'Link Checker'
         id: 'lychee'

.github/workflows/memory-nightly.yml

@@ -16,8 +16,6 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
 
       - name: 'Set up Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4

.github/workflows/no-response.yml

@@ -0,0 +1,33 @@
+name: 'No Response'
+
+# Run as a daily cron at 1:45 AM
+on:
+  schedule:
+    - cron: '45 1 * * *'
+  workflow_dispatch:
+
+jobs:
+  no-response:
+    runs-on: 'ubuntu-latest'
+    if: |-
+      ${{ github.repository == 'google-gemini/gemini-cli' }}
+    permissions:
+      issues: 'write'
+      pull-requests: 'write'
+    concurrency:
+      group: '${{ github.workflow }}-no-response'
+      cancel-in-progress: true
+    steps:
+      - uses: 'actions/stale@5bef64f19d7facfb25b37b414482c7164d639639' # ratchet:actions/stale@v9
+        with:
+          repo-token: '${{ secrets.GITHUB_TOKEN }}'
+          days-before-stale: -1
+          days-before-close: 14
+          stale-issue-label: 'status/need-information'
+          close-issue-message: >-
+            This issue was marked as needing more information and has not received a response in 14 days.
+            Closing it for now. If you still face this problem, feel free to reopen with more details. Thank you!
+          stale-pr-label: 'status/need-information'
+          close-pr-message: >-
+            This pull request was marked as needing more information and has had no updates in 14 days.
+            Closing it for now. You are welcome to reopen with the required info. Thanks for contributing!

.github/workflows/perf-nightly.yml

@@ -16,8 +16,6 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-        with:
-          persist-credentials: false
 
       - name: 'Set up Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4

.github/workflows/pr-contribution-guidelines-notifier.yml

@@ -0,0 +1,133 @@
+name: '🏷️ PR Contribution Guidelines Notifier'
+
+on:
+  pull_request:
+    types:
+      - 'opened'
+
+jobs:
+  notify-process-change:
+    runs-on: 'ubuntu-latest'
+    if: |-
+      github.repository == 'google-gemini/gemini-cli' || github.repository == 'google-gemini/maintainers-gemini-cli'
+    permissions:
+      pull-requests: 'write'
+    steps:
+      - name: 'Generate GitHub App Token'
+        id: 'generate_token'
+        env:
+          APP_ID: '${{ secrets.APP_ID }}'
+        if: |-
+          ${{ env.APP_ID != '' }}
+        uses: 'actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349' # ratchet:actions/create-github-app-token@v2
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+
+      - name: 'Check membership and post comment'
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        with:
+          github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
+          script: |-
+            const org = context.repo.owner;
+            const repo = context.repo.repo;
+            const username = context.payload.pull_request.user.login;
+            const pr_number = context.payload.pull_request.number;
+
+            // 1. Check if the PR author is a maintainer
+            // Check team membership (most reliable for private org members)
+            let isTeamMember = false;
+            const teams = ['gemini-cli-maintainers', 'gemini-cli-askmode-approvers', 'gemini-cli-docs'];
+            for (const team_slug of teams) {
+              try {
+                const members = await github.paginate(github.rest.teams.listMembersInOrg, {
+                  org: org,
+                  team_slug: team_slug
+                });
+                if (members.some(m => m.login.toLowerCase() === username.toLowerCase())) {
+                  isTeamMember = true;
+                  core.info(`${username} is a member of ${team_slug}. No notification needed.`);
+                  break;
+                }
+              } catch (e) {
+                core.warning(`Failed to fetch team members from ${team_slug}: ${e.message}`);
+              }
+            }
+
+            if (isTeamMember) return;
+
+            // Check author_association from webhook payload
+            const authorAssociation = context.payload.pull_request.author_association;
+            const isRepoMaintainer = ['OWNER', 'MEMBER', 'COLLABORATOR'].includes(authorAssociation);
+
+            if (isRepoMaintainer) {
+              core.info(`${username} is a maintainer (author_association: ${authorAssociation}). No notification needed.`);
+              return;
+            }
+
+            // Check if author is a Googler
+            const isGoogler = async (login) => {
+              try {
+                const orgs = ['googlers', 'google'];
+                for (const org of orgs) {
+                  try {
+                    await github.rest.orgs.checkMembershipForUser({
+                      org: org,
+                      username: login
+                    });
+                    return true;
+                  } catch (e) {
+                    if (e.status !== 404) throw e;
+                  }
+                }
+              } catch (e) {
+                core.warning(`Failed to check org membership for ${login}: ${e.message}`);
+              }
+              return false;
+            };
+
+            if (await isGoogler(username)) {
+              core.info(`${username} is a Googler. No notification needed.`);
+              return;
+            }
+
+            // 2. Check if the PR is already associated with an issue
+            const query = `
+              query($owner:String!, $repo:String!, $number:Int!) {
+                repository(owner:$owner, name:$repo) {
+                  pullRequest(number:$number) {
+                    closingIssuesReferences(first: 1) {
+                      totalCount
+                    }
+                  }
+                }
+              }
+            `;
+            const variables = { owner: org, repo: repo, number: pr_number };
+            const result = await github.graphql(query, variables);
+            const issueCount = result.repository.pullRequest.closingIssuesReferences.totalCount;
+
+            if (issueCount > 0) {
+              core.info(`PR #${pr_number} is already associated with an issue. No notification needed.`);
+              return;
+            }
+
+            // 3. Post the notification comment
+            core.info(`${username} is not a maintainer and PR #${pr_number} has no linked issue. Posting notification.`);
+
+            const comment = `
+            Hi @${username}, thank you so much for your contribution to Gemini CLI! We really appreciate the time and effort you've put into this.
+
+            We're making some updates to our contribution process to improve how we track and review changes. Please take a moment to review our recent discussion post: [Improving Our Contribution Process & Introducing New Guidelines](https://github.com/google-gemini/gemini-cli/discussions/16706).
+
+            Key Update: Starting **January 26, 2026**, the Gemini CLI project will require all pull requests to be associated with an existing issue. Any pull requests not linked to an issue by that date will be automatically closed.
+
+            Thank you for your understanding and for being a part of our community!
+            `.trim().replace(/^[ ]+/gm, '');
+
+            await github.rest.issues.createComment({
+              owner: org,
+              repo: repo,
+              issue_number: pr_number,
+              body: comment
+            });

.github/workflows/release-change-tags.yml

@@ -44,7 +44,6 @@ jobs:
         with:
           ref: '${{ github.ref }}'
           fetch-depth: 0
-          persist-credentials: false
 
       - name: 'Setup Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'

.github/workflows/release-manual.yml

@@ -46,15 +46,8 @@ on:
         default: 'prod'
 
 jobs:
-  build-mac:
-    if: "github.repository == 'google-gemini/gemini-cli'"
-    uses: './.github/workflows/build-unsigned-mac-binaries.yml'
-    with:
-      ref: '${{ github.event.inputs.ref }}'
-
   release:
     if: "github.repository == 'google-gemini/gemini-cli'"
-    needs: ['build-mac']
     runs-on: 'ubuntu-latest'
     environment: "${{ github.event.inputs.environment || 'prod' }}"
     permissions:
@@ -65,13 +58,11 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           fetch-depth: 0
 
       - name: 'Checkout Release Code'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
           path: 'release'
           fetch-depth: 0
@@ -92,11 +83,6 @@ jobs:
         working-directory: './release'
         run: 'npm ci'
 
-      - name: 'Download macOS Binaries'
-        uses: './.github/actions/download-mac-binaries'
-        with:
-          path: 'release/dist'
-
       - name: 'Prepare Release Info'
         id: 'release_info'
         working-directory: './release'

.github/workflows/release-nightly.yml

@@ -30,15 +30,8 @@ on:
         default: 'prod'
 
 jobs:
-  build-mac:
-    if: "github.repository == 'google-gemini/gemini-cli'"
-    uses: './.github/workflows/build-unsigned-mac-binaries.yml'
-    with:
-      ref: '${{ github.event.inputs.ref }}'
-
   release:
     if: "github.repository == 'google-gemini/gemini-cli'"
-    needs: ['build-mac']
     environment: "${{ github.event.inputs.environment || 'prod' }}"
     runs-on: 'ubuntu-latest'
     permissions:
@@ -50,13 +43,11 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           fetch-depth: 0
 
       - name: 'Checkout Release Code'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
           path: 'release'
           fetch-depth: 0
@@ -71,11 +62,6 @@ jobs:
         working-directory: './release'
         run: 'npm ci'
 
-      - name: 'Download macOS Binaries'
-        uses: './.github/actions/download-mac-binaries'
-        with:
-          path: 'release/dist'
-
       - name: 'Print Inputs'
         shell: 'bash'
         env:

.github/workflows/release-notes.yml

@@ -31,7 +31,6 @@ jobs:
       - name: 'Checkout repository'
         uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
         with:
-          persist-credentials: false
           # The user-level skills need to be available to the workflow
           fetch-depth: 0
           ref: 'main'
@@ -71,8 +70,6 @@ jobs:
       - name: 'Generate Changelog with Gemini'
         if: "steps.validate_version.outputs.CONTINUE == 'true'"
         uses: 'google-github-actions/run-gemini-cli@a3bf79042542528e91937b3a3a6fbc4967ee3c31' # ratchet:google-github-actions/run-gemini-cli@v0
-        env:
-          GEMINI_CLI_TRUST_WORKSPACE: true
         with:
           gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
           prompt: |

.github/workflows/release-patch-0-from-comment.yml

@@ -17,7 +17,6 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           fetch-depth: 1
 
       - name: 'Slash Command Dispatch'

.github/workflows/release-patch-1-create-pr.yml

@@ -54,7 +54,6 @@ jobs:
         with:
           ref: '${{ github.event.inputs.ref }}'
           fetch-depth: 0
-          persist-credentials: false
 
       - name: 'Setup Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4

.github/workflows/release-patch-2-trigger.yml

@@ -64,7 +64,6 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           ref: "${{ github.event.inputs.workflow_ref || 'main' }}"
           fetch-depth: 1
 

.github/workflows/release-patch-3-release.yml

@@ -53,14 +53,12 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
 
       - name: 'Checkout Release Code'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           ref: '${{ github.event.inputs.release_ref }}'
           path: 'release'
           fetch-depth: 0

.github/workflows/release-promote.yml

@@ -55,7 +55,6 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
 
@@ -172,13 +171,11 @@ jobs:
       - name: 'Checkout Ref'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Checkout correct SHA'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           ref: '${{ matrix.sha }}'
           path: 'release'
           fetch-depth: 0
@@ -200,15 +197,9 @@ jobs:
           gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
           working-directory: './release'
 
-  build-mac:
-    if: "github.repository == 'google-gemini/gemini-cli'"
-    uses: './.github/workflows/build-unsigned-mac-binaries.yml'
-    with:
-      ref: '${{ github.event.inputs.ref }}'
-
   publish-preview:
     name: 'Publish preview'
-    needs: ['calculate-versions', 'test', 'build-mac']
+    needs: ['calculate-versions', 'test']
     runs-on: 'ubuntu-latest'
     environment: "${{ github.event.inputs.environment || 'prod' }}"
     permissions:
@@ -219,13 +210,11 @@ jobs:
       - name: 'Checkout Ref'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Checkout correct SHA'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           ref: '${{ needs.calculate-versions.outputs.PREVIEW_SHA }}'
           path: 'release'
           fetch-depth: 0
@@ -240,11 +229,6 @@ jobs:
         working-directory: './release'
         run: 'npm ci'
 
-      - name: 'Download macOS Binaries'
-        uses: './.github/actions/download-mac-binaries'
-        with:
-          path: 'release/dist'
-
       - name: 'Publish Release'
         uses: './.github/actions/publish-release'
         with:
@@ -282,7 +266,7 @@ jobs:
 
   publish-stable:
     name: 'Publish stable'
-    needs: ['calculate-versions', 'test', 'publish-preview', 'build-mac']
+    needs: ['calculate-versions', 'test', 'publish-preview']
     runs-on: 'ubuntu-latest'
     environment: "${{ github.event.inputs.environment || 'prod' }}"
     permissions:
@@ -293,13 +277,11 @@ jobs:
       - name: 'Checkout Ref'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Checkout correct SHA'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           ref: '${{ needs.calculate-versions.outputs.STABLE_SHA }}'
           path: 'release'
           fetch-depth: 0
@@ -314,11 +296,6 @@ jobs:
         working-directory: './release'
         run: 'npm ci'
 
-      - name: 'Download macOS Binaries'
-        uses: './.github/actions/download-mac-binaries'
-        with:
-          path: 'release/dist'
-
       - name: 'Publish Release'
         uses: './.github/actions/publish-release'
         with:
@@ -367,7 +344,6 @@ jobs:
       - name: 'Checkout Ref'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Setup Node.js'
@@ -403,7 +379,6 @@ jobs:
           BRANCH_NAME: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
           DRY_RUN: '${{ github.event.inputs.dry_run }}'
           NEEDS_CALCULATE_VERSIONS_OUTPUTS_NEXT_NIGHTLY_VERSION: '${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}'
-          GIT_PUSH_TOKEN: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
         run: |-
           git add package.json packages/*/package.json
           if [ -f package-lock.json ]; then
@@ -412,7 +387,7 @@ jobs:
           git commit -m "chore(release): bump version to ${NEEDS_CALCULATE_VERSIONS_OUTPUTS_NEXT_NIGHTLY_VERSION}"
           if [[ "${DRY_RUN}" == "false" ]]; then
             echo "Pushing release branch to remote..."
-            git push "https://x-access-token:${GIT_PUSH_TOKEN}@github.com/${{ github.repository }}.git" "HEAD:${BRANCH_NAME}" --follow-tags
+            git push --set-upstream origin "${BRANCH_NAME}"
           else
             echo "Dry run enabled. Skipping push."
           fi

.github/workflows/release-rollback.yml

@@ -52,7 +52,6 @@ jobs:
       - name: 'Checkout repository'
         uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
         with:
-          persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
           fetch-depth: 0
 
@@ -193,7 +192,7 @@ jobs:
         run: |
           echo "ROLLBACK_TAG=$ROLLBACK_TAG_NAME" >> "$GITHUB_OUTPUT"
           git tag "$ROLLBACK_TAG_NAME" "${ORIGIN_HASH}"
-          git push "https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}.git" --tags
+          git push origin --tags
 
       - name: 'Verify Rollback Tag Added'
         if: "${{ github.event.inputs.dry-run == 'false' }}"

.github/workflows/release-sandbox.yml

@@ -26,7 +26,6 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
-          persist-credentials: false
           ref: '${{ github.event.inputs.ref || github.sha }}'
           fetch-depth: 0
       - name: 'Push'

.github/workflows/smoke-test.yml

@@ -32,7 +32,6 @@ jobs:
         with:
           ref: '${{ github.event.inputs.ref || github.sha }}'
           fetch-depth: 0
-          persist-credentials: false
       - name: 'Install Dependencies'
         run: 'npm ci'
       - name: 'Build bundle'

.github/workflows/stale.yml

@@ -0,0 +1,44 @@
+name: 'Mark stale issues and pull requests'
+
+# Run as a daily cron at 1:30 AM
+on:
+  schedule:
+    - cron: '30 1 * * *'
+  workflow_dispatch:
+
+jobs:
+  stale:
+    strategy:
+      fail-fast: false
+      matrix:
+        runner:
+          - 'ubuntu-latest' # GitHub-hosted
+    runs-on: '${{ matrix.runner }}'
+    if: |-
+      ${{ github.repository == 'google-gemini/gemini-cli' }}
+    permissions:
+      issues: 'write'
+      pull-requests: 'write'
+    concurrency:
+      group: '${{ github.workflow }}-stale'
+      cancel-in-progress: true
+    steps:
+      - uses: 'actions/stale@5bef64f19d7facfb25b37b414482c7164d639639' # ratchet:actions/stale@v9
+        with:
+          repo-token: '${{ secrets.GITHUB_TOKEN }}'
+          stale-issue-message: >-
+            This issue has been automatically marked as stale due to 60 days of inactivity.
+            It will be closed in 14 days if no further activity occurs.
+          stale-pr-message: >-
+            This pull request has been automatically marked as stale due to 60 days of inactivity.
+            It will be closed in 14 days if no further activity occurs.
+          close-issue-message: >-
+            This issue has been closed due to 14 additional days of inactivity after being marked as stale.
+            If you believe this is still relevant, feel free to comment or reopen the issue. Thank you!
+          close-pr-message: >-
+            This pull request has been closed due to 14 additional days of inactivity after being marked as stale.
+            If this is still relevant, you are welcome to reopen or leave a comment. Thanks for contributing!
+          days-before-stale: 60
+          days-before-close: 14
+          exempt-issue-labels: 'pinned,security,🔒 maintainer only,help wanted,🗓️ Public Roadmap'
+          exempt-pr-labels: 'pinned,security,🔒 maintainer only,help wanted,🗓️ Public Roadmap'

.github/workflows/test-build-binary.yml

@@ -34,8 +34,6 @@ jobs:
     steps:
       - name: 'Checkout'
         uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
-        with:
-          persist-credentials: false
 
       - name: 'Optimize Windows Performance'
         if: "matrix.os == 'windows-latest'"
@@ -143,7 +141,6 @@ jobs:
         if: "github.event_name != 'pull_request'"
         env:
           GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
-          GEMINI_CLI_TRUST_WORKSPACE: true
         run: |
           echo "Running integration tests with binary..."
           if [[ "${{ matrix.os }}" == 'windows-latest' ]]; then

.github/workflows/verify-release.yml

@@ -44,8 +44,6 @@ jobs:
         shell: 'bash'
         run: 'echo "${{ toJSON(vars) }}"'
       - uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
-        with:
-          persist-credentials: false
       - name: 'Verify release'
         uses: './.github/actions/verify-release'
         with:

.vscode/launch.json

@@ -43,13 +43,9 @@
     {
       "type": "node",
       "request": "launch",
-      "name": "CLI: Run Current File",
-      "runtimeExecutable": "node",
-      "runtimeArgs": ["--import", "tsx"],
+      "name": "Launch Program",
       "skipFiles": ["<node_internals>/**"],
       "program": "${file}",
-      "cwd": "${workspaceFolder}",
-      "console": "integratedTerminal",
       "outFiles": ["${workspaceFolder}/**/*.js"]
     },
     {

Dockerfile

@@ -1,44 +1,3 @@
-# ---- Stage 1: Builder ----
-FROM docker.io/library/node:20-slim AS builder
-
-# Install git (needed by generate-git-commit-info.js script)
-RUN apt-get update && apt-get install -y --no-install-recommends git \
-  && apt-get clean && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /build
-
-# Copy only package.json files first for better layer caching
-# Dependencies only re-install when package files change, not source files
-COPY package*.json ./
-COPY packages/cli/package*.json ./packages/cli/
-COPY packages/core/package*.json ./packages/core/
-COPY packages/vscode-ide-companion/package*.json ./packages/vscode-ide-companion/
-COPY packages/vscode-ide-companion/scripts/ ./packages/vscode-ide-companion/scripts/
-COPY packages/devtools/package*.json ./packages/devtools/
-COPY packages/sdk/package*.json ./packages/sdk/
-COPY packages/test-utils/package*.json ./packages/test-utils/
-COPY packages/a2a-server/package*.json ./packages/a2a-server/
-
-# Use npm ci for consistent, reliable builds (respects package-lock.json)
-RUN HUSKY=0 npm ci --ignore-scripts
-
-# Now copy the rest of the source (after install for better caching)
-COPY packages/ ./packages/
-COPY tsconfig*.json ./
-COPY eslint.config.js ./
-COPY scripts/ ./scripts/
-COPY esbuild.config.js ./
-
-# Pass git commit hash as build arg instead of copying entire .git directory
-ARG GIT_COMMIT=unknown
-ENV GIT_COMMIT=$GIT_COMMIT
-
-# Build and pack artifacts
-RUN HUSKY=0 npm run build && \
-    npm pack -w packages/core --pack-destination packages/core/dist/ && \
-    npm pack -w packages/cli --pack-destination packages/cli/dist/
-
-# ---- Stage 2: Runtime ----
 FROM docker.io/library/node:20-slim
 
 ARG SANDBOX_NAME="gemini-cli-sandbox"
@@ -81,8 +40,8 @@ ENV PATH=$PATH:/usr/local/share/npm-global/bin
 USER node
 
 # install gemini-cli and clean up
-COPY --chown=node:node packages/cli/dist/google-gemini-cli-*.tgz /tmp/gemini-cli.tgz
-COPY --chown=node:node packages/core/dist/google-gemini-cli-core-*.tgz /tmp/gemini-core.tgz
+COPY packages/cli/dist/google-gemini-cli-*.tgz /tmp/gemini-cli.tgz
+COPY packages/core/dist/google-gemini-cli-core-*.tgz /tmp/gemini-core.tgz
 RUN npm install -g /tmp/gemini-core.tgz \
   && npm install -g /tmp/gemini-cli.tgz \
   && node -e "const fs=require('node:fs'); JSON.parse(fs.readFileSync('/usr/local/share/npm-global/lib/node_modules/@google/gemini-cli/package.json','utf8')); JSON.parse(fs.readFileSync('/usr/local/share/npm-global/lib/node_modules/@google/gemini-cli-core/package.json','utf8'));" \
@@ -91,4 +50,4 @@ RUN npm install -g /tmp/gemini-core.tgz \
   && rm -f /tmp/gemini-{cli,core}.tgz
 
 # default entrypoint when none specified
-ENTRYPOINT ["/usr/local/share/npm-global/bin/gemini"]
+CMD ["gemini"]

README.md

@@ -371,8 +371,6 @@ for planned features and priorities.
 
 ## 📖 Resources
 
-- **[Free Course](https://learn.deeplearning.ai/courses/gemini-cli-code-and-create-with-an-open-source-agent/information)** -
-  Learn the basics.
 - **[Official Roadmap](./ROADMAP.md)** - See what's coming next.
 - **[Changelog](https://www.geminicli.com/docs/changelogs)** - See recent
   notable updates.
@@ -395,16 +393,6 @@ for removal instructions.
   [Terms & Privacy](https://www.geminicli.com/docs/resources/tos-privacy)
 - **Security**: [Security Policy](SECURITY.md)
 
-<p align="left">
- <a href="https://www.star-history.com/google-gemini/gemini-cli">
-  <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/badge?repo=google-gemini/gemini-cli&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/badge?repo=google-gemini/gemini-cli" />
-   <img alt="Star History Rank" src="https://api.star-history.com/badge?repo=google-gemini/gemini-cli" />
-  </picture>
- </a>
-</p>
-
 ---
 
 <p align="center">

docs/changelogs/index.md

@@ -18,72 +18,6 @@ on GitHub.
 | [Preview](preview.md) | Experimental features ready for early feedback. |
 | [Stable](latest.md)   | Stable, recommended for general use.            |
 
-## Announcements: v0.42.0 - 2026-05-12
-
-- **Auto Memory Inbox:** Introduced a new inbox flow for Auto Memory with a
-  canonical-patch contract for seamless skill management
-  ([#26338](https://github.com/google-gemini/gemini-cli/pull/26338) by
-  @SandyTao520).
-- **Gemma 4 by Default:** Enabled Gemma 4 models by default via the Gemini API
-  for all users
-  ([#26307](https://github.com/google-gemini/gemini-cli/pull/26307) by
-  @Abhijit-2592).
-- **Voice Mode Enhancements:** Added wave animations and privacy/compliance UX
-  warnings for the Gemini Live backend
-  ([#26284](https://github.com/google-gemini/gemini-cli/pull/26284) by
-  @devr0306, [#26454](https://github.com/google-gemini/gemini-cli/pull/26454) by
-  @cocosheng-g).
-
-## Announcements: v0.41.0 - 2026-05-05
-
-- **Real-time Voice Mode:** Implemented real-time voice mode with cloud and
-  local backends
-  ([#24174](https://github.com/google-gemini/gemini-cli/pull/24174) by
-  @Abhijit-2592).
-- **Secure Environment Loading:** Enforced workspace trust and secured .env
-  loading in headless mode
-  ([#25814](https://github.com/google-gemini/gemini-cli/pull/25814) by
-  @ehedlund).
-- **Advanced Shell Validation:** Enhanced shell command validation and added
-  core tools allowlist for improved security
-  ([#25720](https://github.com/google-gemini/gemini-cli/pull/25720) by @galz10).
-
-## Announcements: v0.40.0 - 2026-04-28
-
-- **Offline Search and Themes:** Bundled ripgrep for offline search support and
-  added GitHub-style colorblind themes
-  ([#25342](https://github.com/google-gemini/gemini-cli/pull/25342) by
-  @scidomino, [#15504](https://github.com/google-gemini/gemini-cli/pull/15504)
-  by @Z1xus).
-- **Advanced Resource and Memory Management:** Introduced MCP resource tools and
-  transitioned to a prompt-driven, four-tier memory management system
-  ([#25395](https://github.com/google-gemini/gemini-cli/pull/25395) by
-  @ruomengz, [#25716](https://github.com/google-gemini/gemini-cli/pull/25716) by
-  @SandyTao520).
-- **UX and Local Models:** Enabled topic update narrations by default and
-  streamlined Gemma local model setup with `gemini gemma`
-  ([#25586](https://github.com/google-gemini/gemini-cli/pull/25586) by
-  @gundermanc, [#25498](https://github.com/google-gemini/gemini-cli/pull/25498)
-  by @Samee24).
-
-## Announcements: v0.39.0 - 2026-04-23
-
-- **Skill Management:** Added a new `/memory` inbox command for reviewing and
-  patching skills extracted during sessions
-  ([#24544](https://github.com/google-gemini/gemini-cli/pull/24544) by
-  @SandyTao520, [#25148](https://github.com/google-gemini/gemini-cli/pull/25148)
-  by @SandyTao520).
-- **Improved Transparency:** Plan Mode now requires confirmation for skill
-  activation and allows plan inspection
-  ([#24946](https://github.com/google-gemini/gemini-cli/pull/24946),
-  [#25058](https://github.com/google-gemini/gemini-cli/pull/25058) by
-  @ruomengz).
-- **Architecture & Reliability:** Introduced a decoupled `ContextManager`
-  architecture and resolved several critical memory leaks and PTY exhaustion
-  issues ([#24752](https://github.com/google-gemini/gemini-cli/pull/24752) by
-  @joshualitt, [#25079](https://github.com/google-gemini/gemini-cli/pull/25079)
-  by @spencer426).
-
 ## Announcements: v0.38.0 - 2026-04-14
 
 - **Chapters Narrative Flow:** Group agent interactions into "Chapters" based on

docs/changelogs/latest.md

@@ -1,6 +1,6 @@
-# Latest stable release: v0.42.0
+# Latest stable release: v0.38.2
 
-Released: May 12, 2026
+Released: April 17, 2026
 
 For most users, our latest stable release is the recommended release. Install
 the latest stable version with:
@@ -11,272 +11,264 @@ npm install -g @google/gemini-cli
 
 ## Highlights
 
-- **Auto Memory Inbox:** Introduced a new inbox flow for Auto Memory using a
-  canonical-patch contract, enabling more robust and manageable skill
-  extraction.
-- **Gemma 4 Default:** Gemma 4 models are now enabled by default via the Gemini
-  API, providing improved performance and capabilities out of the box.
-- **Voice Mode Polish:** Added wave animations for visual feedback and
-  privacy/compliance UX warnings specifically for the Gemini Live backend.
-- **Session Management:** Added a `--delete` flag to the `/exit` command for
-  instant session deletion and introduced `/bug-memory` for easier heap
-  diagnostics.
-- **Improved Reliability:** Reduced default API timeouts to 60s and implemented
-  retries for undici and premature stream closure errors.
+- **Chapters Narrative Flow:** Introduced tool-based topic grouping ("Chapters")
+  to provide better session structure and narrative continuity in long-running
+  tasks.
+- **Context Compression Service:** Implemented a dedicated service for advanced
+  context management, efficiently distilling conversation history to preserve
+  focus and tokens.
+- **Enhanced UI Stability & UX:** Introduced a new "Terminal Buffer" mode to
+  solve rendering flicker, along with selective topic expansion and improved
+  tool confirmation layouts.
+- **Context-Aware Policy Approvals:** Users can now grant persistent,
+  context-aware approvals for tools, significantly reducing manual confirmation
+  overhead for trusted workflows.
+- **Background Process Monitoring:** New tools for monitoring and inspecting
+  background shell processes, providing better visibility into asynchronous
+  tasks.
 
 ## What's Changed
 
-- fix(cli): prevent automatic updates from switching to less stable channels by
-  @Adib234 in [#26132](https://github.com/google-gemini/gemini-cli/pull/26132)
-- chore(release): bump version to 0.42.0-nightly.20260428.g59b2dea0e by
-  @gemini-cli-robot in
-  [#26142](https://github.com/google-gemini/gemini-cli/pull/26142)
-- fix(cli): pass node arguments via NODE_OPTIONS during relaunch to support SEA
-  by @cocosheng-g in
-  [#26130](https://github.com/google-gemini/gemini-cli/pull/26130)
-- fix(cli): handle DECKPAM keypad Enter sequences in terminal by @Gitanaskhan26
-  in [#26092](https://github.com/google-gemini/gemini-cli/pull/26092)
-- docs(cli): point plan-mode session retention to actual /settings labels by
-  @ifitisit in [#25978](https://github.com/google-gemini/gemini-cli/pull/25978)
-- fix(core): add missing oauth fields support in subagent parsing by
+- fix(patch): cherry-pick 14b2f35 to release/v0.38.1-pr-24974 to patch version
+  v0.38.1 and create version 0.38.2 by @gemini-cli-robot in
+  [#25585](https://github.com/google-gemini/gemini-cli/pull/25585)
+- fix(patch): cherry-pick 050c303 to release/v0.38.0-pr-25317 to patch version
+  v0.38.0 and create version 0.38.1 by @gemini-cli-robot in
+  [#25466](https://github.com/google-gemini/gemini-cli/pull/25466)
+- fix(cli): refresh slash command list after /skills reload by @NTaylorMullen in
+  [#24454](https://github.com/google-gemini/gemini-cli/pull/24454)
+- Update README.md for links. by @g-samroberts in
+  [#22759](https://github.com/google-gemini/gemini-cli/pull/22759)
+- fix(core): ensure complete_task tool calls are recorded in chat history by
   @abhipatel12 in
-  [#26141](https://github.com/google-gemini/gemini-cli/pull/26141)
-- fix(core): disconnect extension-backed MCP clients in stopExtension by
-  @cocosheng-g in
-  [#26136](https://github.com/google-gemini/gemini-cli/pull/26136)
-- Update documentation workflows with workspace trust by @g-samroberts in
-  [#26150](https://github.com/google-gemini/gemini-cli/pull/26150)
-- refactor(acp): modularize monolithic acpClient into specialized files by
-  @sripasg in [#26143](https://github.com/google-gemini/gemini-cli/pull/26143)
-- test: fix failures due to antigravity environment leakage by @adamfweidman in
-  [#26162](https://github.com/google-gemini/gemini-cli/pull/26162)
-- fix(core): add explicit empty log guard in A2A pushMessage by @adamfweidman in
-  [#26198](https://github.com/google-gemini/gemini-cli/pull/26198)
-- feat(cli): add --delete flag to /exit command for session deletion by
-  @AbdulTawabJuly in
-  [#19332](https://github.com/google-gemini/gemini-cli/pull/19332)
-- test(core): add regression test for issue for ToolConfirmationResponse by
-  @Adib234 in [#26194](https://github.com/google-gemini/gemini-cli/pull/26194)
-- Add the ability to @ mention the gemini robot. by @gundermanc in
-  [#26207](https://github.com/google-gemini/gemini-cli/pull/26207)
-- test(evals): add EvalMetadata JSDoc annotations to older tests by @akh64bit in
-  [#26147](https://github.com/google-gemini/gemini-cli/pull/26147)
-- fix(core): reduce default API timeout to 60s and enable retries for undici
-  timeouts by @Adib234 in
-  [#26191](https://github.com/google-gemini/gemini-cli/pull/26191)
-- fix(core): distinguish fallback chains and fix maxAttempts for auto vs
-  explicit model selection by @adamfweidman in
-  [#26163](https://github.com/google-gemini/gemini-cli/pull/26163)
-- fix(cli): handle InvalidStream event gracefully without throwing by
-  @adamfweidman in
-  [#26218](https://github.com/google-gemini/gemini-cli/pull/26218)
-- ci(github-actions): switch to github app token and fix bot self-trigger by
-  @gundermanc in
-  [#26223](https://github.com/google-gemini/gemini-cli/pull/26223)
-- Respect logPrompts flag for logging sensitive fields by @lp-peg in
-  [#26153](https://github.com/google-gemini/gemini-cli/pull/26153)
-- fix: correct API key validation logic in handleApiKeySubmit by
-  @martin-hsu-test in
-  [#25453](https://github.com/google-gemini/gemini-cli/pull/25453)
-- fix(agent): prevent exit_plan_mode from being called via shell by
-  @Abhijit-2592 in
-  [#26230](https://github.com/google-gemini/gemini-cli/pull/26230)
-- # Fix: Inconsistent Case-Sensitivity in GrepTool by @.github/workflows/gemini-cli-bot-pulse.yml[bot] in [#26235](https://github.com/google-gemini/gemini-cli/pull/26235)
-- docs(core): add automated gemma setup guide by @Samee24 in
-  [#26233](https://github.com/google-gemini/gemini-cli/pull/26233)
-- Allow non-https proxy urls to support container environments by @stevemk14ebr
-  in [#26234](https://github.com/google-gemini/gemini-cli/pull/26234)
-- fix(bot): productivity and backlog optimizations by @gundermanc in
-  [#26236](https://github.com/google-gemini/gemini-cli/pull/26236)
-- refactor(acp): delegate prompt turn processing logic to GeminiClient by
-  @sripasg in [#26222](https://github.com/google-gemini/gemini-cli/pull/26222)
-- fix(cli): refine platform-specific undo/redo and smart bubbling for WSL by
-  @cocosheng-g in
-  [#26202](https://github.com/google-gemini/gemini-cli/pull/26202)
-- fix: suppress duplicate extension warnings during startup by @cocosheng-g in
-  [#26208](https://github.com/google-gemini/gemini-cli/pull/26208)
-- fix(cli): use byte length instead of string length for readStdin size limits
-  by @Adib234 in
-  [#26224](https://github.com/google-gemini/gemini-cli/pull/26224)
-- fix(ui): made shell tool header wrap on Ctrl+O by @devr0306 in
-  [#26229](https://github.com/google-gemini/gemini-cli/pull/26229)
-- Changelog for v0.41.0-preview.0 by @gemini-cli-robot in
-  [#26244](https://github.com/google-gemini/gemini-cli/pull/26244)
-- Skip binary CLI relaunch by @ruomengz in
-  [#26261](https://github.com/google-gemini/gemini-cli/pull/26261)
-- fix(cli): do not override GOOGLE_CLOUD_PROJECT in Cloud Shell when using
-  Vertex AI by @jackwotherspoon in
-  [#24455](https://github.com/google-gemini/gemini-cli/pull/24455)
-- docs(cli): add skill discovery troubleshooting checklist to tutorial by
-  @pmenic in [#26018](https://github.com/google-gemini/gemini-cli/pull/26018)
-- docs(policy-engine): link to tools reference for tool names and args by
-  @Aaxhirrr in [#22081](https://github.com/google-gemini/gemini-cli/pull/22081)
-- Fix posting invalid response to a comment by @gundermanc in
-  [#26266](https://github.com/google-gemini/gemini-cli/pull/26266)
-- fix(cli): prevent informational logs from polluting json output by
-  @cocosheng-g in
-  [#26264](https://github.com/google-gemini/gemini-cli/pull/26264)
-- feat(ui): added microphone and updated placeholder for voice mode by @devr0306
-  in [#26270](https://github.com/google-gemini/gemini-cli/pull/26270)
-- feat(cli): Add 'list' subcommand to '/commands' by @Jwhyee in
-  [#22324](https://github.com/google-gemini/gemini-cli/pull/22324)
-- fix(core): ensure tool output cleanup on session deletion for legacy files by
-  @cocosheng-g in
-  [#26263](https://github.com/google-gemini/gemini-cli/pull/26263)
-- Docs: Update Agent Skills documentation by @jkcinouye in
-  [#22388](https://github.com/google-gemini/gemini-cli/pull/22388)
-- test(acp): add missing coverage for extensions command error paths by
-  @sahilkirad in
-  [#25313](https://github.com/google-gemini/gemini-cli/pull/25313)
-- Changelog for v0.40.0 by @gemini-cli-robot in
-  [#26245](https://github.com/google-gemini/gemini-cli/pull/26245)
-- fix: report AgentExecutionBlocked in non-interactive programmatic modes by
-  @cocosheng-g in
-  [#26262](https://github.com/google-gemini/gemini-cli/pull/26262)
-- feat(extensions): add 'delete' as an alias for /extensions uninstall by
-  @martin-hsu-test in
-  [#25660](https://github.com/google-gemini/gemini-cli/pull/25660)
-- fix(core): silently skip GEMINI.md paths that are directories (EISDIR) by
-  @martin-hsu-test in
-  [#25662](https://github.com/google-gemini/gemini-cli/pull/25662)
-- fix(ci): checkout PR branch instead of main in bot workflow by @gundermanc in
-  [#26289](https://github.com/google-gemini/gemini-cli/pull/26289)
-- fix(cli): use resolved sandbox state for auto-update check by @Adib234 in
-  [#26285](https://github.com/google-gemini/gemini-cli/pull/26285)
-- # Metrics Integrity & Standardized Reporting (BT-01) by @.github/workflows/gemini-cli-bot-pulse.yml[bot] in [#26240](https://github.com/google-gemini/gemini-cli/pull/26240)
-- Add Star History section to README by @bdmorgan in
-  [#26290](https://github.com/google-gemini/gemini-cli/pull/26290)
-- Add Star History section to README by @bdmorgan in
-  [#26308](https://github.com/google-gemini/gemini-cli/pull/26308)
-- Remove Star History section from README by @bdmorgan in
-  [#26309](https://github.com/google-gemini/gemini-cli/pull/26309)
-- test(evals): add behavioral eval for file creation and write_file tool
-  selection by @akh64bit in
-  [#26292](https://github.com/google-gemini/gemini-cli/pull/26292)
-- feat(config): enable Gemma 4 models by default via Gemini API by @Abhijit-2592
-  in [#26307](https://github.com/google-gemini/gemini-cli/pull/26307)
-- fix(cli): insert voice transcription at cursor position instead of ap… by
-  @Zheyuan-Lin in
-  [#26287](https://github.com/google-gemini/gemini-cli/pull/26287)
-- fix(ui): fix issue with box edges by @gundermanc in
-  [#26148](https://github.com/google-gemini/gemini-cli/pull/26148)
-- fix(cli): respect .env override for GOOGLE_CLOUD_PROJECT by @DavidAPierce in
-  [#26288](https://github.com/google-gemini/gemini-cli/pull/26288)
-- fix(ci): robust version checking in release verification by @scidomino in
-  [#26337](https://github.com/google-gemini/gemini-cli/pull/26337)
-- fix(cli): enable daemon relaunch in binary and bundle keytar by @ruomengz in
-  [#26333](https://github.com/google-gemini/gemini-cli/pull/26333)
-- fix(core): discourage unprompted git add . in prompt snippets by @akh64bit in
-  [#26220](https://github.com/google-gemini/gemini-cli/pull/26220)
-- feat(ui): added wave animation for voice mode by @devr0306 in
-  [#26284](https://github.com/google-gemini/gemini-cli/pull/26284)
-- fix(cli): prevent Escape from clearing input buffer (#17083) by @cocosheng-g
-  in [#26339](https://github.com/google-gemini/gemini-cli/pull/26339)
-- fix(cli): undeprecate --prompt and correct positional query docs by @Adib234
-  in [#26329](https://github.com/google-gemini/gemini-cli/pull/26329)
-- Metrics updates by @.github/workflows/gemini-cli-bot-pulse.yml[bot] in
-  [#26348](https://github.com/google-gemini/gemini-cli/pull/26348)
-- fix(core): remove "System: Please continue." injection on InvalidStream events
-  by @SandyTao520 in
-  [#26340](https://github.com/google-gemini/gemini-cli/pull/26340)
-- docs(policy-engine): add tool argument keys reference and shell policy
-  cross-links by @harshpujari in
-  [#25292](https://github.com/google-gemini/gemini-cli/pull/25292)
-- fix(cli): resolve Ghostty/raw-mode False Cancellation in oauth flow by
-  @Aarchi-07 in [#25026](https://github.com/google-gemini/gemini-cli/pull/25026)
-- fix(core): reset session-scoped state on resumption by @cocosheng-g in
-  [#26342](https://github.com/google-gemini/gemini-cli/pull/26342)
-- Fix bulk of remaining issues with generalist profile by @joshualitt in
-  [#26073](https://github.com/google-gemini/gemini-cli/pull/26073)
-- fix(core): make subagents aware of active approval modes by @akh64bit in
-  [#23608](https://github.com/google-gemini/gemini-cli/pull/23608)
-- fix(acp): resolve agent mode disconnect and improve mode awareness by @sripasg
-  in [#26332](https://github.com/google-gemini/gemini-cli/pull/26332)
-- docs(sdk): add JSDoc to exported interfaces in packages/sdk/src/types.ts by
-  @cocosheng-g in
-  [#26441](https://github.com/google-gemini/gemini-cli/pull/26441)
-- perf: skip redundant GEMINI.md loading in partialConfig by @cocosheng-g in
-  [#26443](https://github.com/google-gemini/gemini-cli/pull/26443)
-- Enhance React guidelines by @psinha40898 in
-  [#22667](https://github.com/google-gemini/gemini-cli/pull/22667)
-- feat(core): reinforce Inquiry constraints to prevent unauthorized changes by
-  @akh64bit in [#26310](https://github.com/google-gemini/gemini-cli/pull/26310)
-- revert: fix(ci): robust version checking in release verification (#26337) by
-  @scidomino in [#26450](https://github.com/google-gemini/gemini-cli/pull/26450)
-- refactor(UI): created constants file for ThemeDialog by @devr0306 in
-  [#26446](https://github.com/google-gemini/gemini-cli/pull/26446)
-- docs: fix GitHub capitalization in releases guide by @haosenwang1018 in
-  [#26379](https://github.com/google-gemini/gemini-cli/pull/26379)
-- fix(cli): ensure branch indicator updates in sub-directories and worktrees by
-  @Adib234 in [#26330](https://github.com/google-gemini/gemini-cli/pull/26330)
-- feat: add minimal V8 heap snapshot utility for memory diagnostics by
-  @cocosheng-g in
-  [#26440](https://github.com/google-gemini/gemini-cli/pull/26440)
-- fix(hooks): preserve non-text parts in fromHookLLMRequest by @SandyTao520 in
-  [#26275](https://github.com/google-gemini/gemini-cli/pull/26275)
-- fix(cli): allow early stdout when config is undefined by @cocosheng-g in
-  [#26453](https://github.com/google-gemini/gemini-cli/pull/26453)
-- fix(cli)#21297: clear skills consent dialog before reload by @manavmax in
-  [#26431](https://github.com/google-gemini/gemini-cli/pull/26431)
-- fix(cli): render LaTeX-style output as Unicode in the TUI by @dimssu in
-  [#25802](https://github.com/google-gemini/gemini-cli/pull/25802)
-- fix(core): use close event instead of exit in child_process fallback by
-  @tusaryan in [#25695](https://github.com/google-gemini/gemini-cli/pull/25695)
-- feat(voice): add privacy and compliance UX warning for Gemini Live backend by
-  @cocosheng-g in
-  [#26454](https://github.com/google-gemini/gemini-cli/pull/26454)
-- feat(memory): add Auto Memory inbox flow with canonical-patch contract by
+  [#24437](https://github.com/google-gemini/gemini-cli/pull/24437)
+- feat(policy): explicitly allow web_fetch in plan mode with ask_user by
+  @Adib234 in [#24456](https://github.com/google-gemini/gemini-cli/pull/24456)
+- fix(core): refactor linux sandbox to fix ARG_MAX crashes by @ehedlund in
+  [#24286](https://github.com/google-gemini/gemini-cli/pull/24286)
+- feat(config): add experimental.adk.agentSessionNoninteractiveEnabled setting
+  by @adamfweidman in
+  [#24439](https://github.com/google-gemini/gemini-cli/pull/24439)
+- Changelog for v0.36.0-preview.8 by @gemini-cli-robot in
+  [#24453](https://github.com/google-gemini/gemini-cli/pull/24453)
+- feat(cli): change default loadingPhrases to 'off' to hide tips by @keithguerin
+  in [#24342](https://github.com/google-gemini/gemini-cli/pull/24342)
+- fix(cli): ensure agent stops when all declinable tools are cancelled by
+  @NTaylorMullen in
+  [#24479](https://github.com/google-gemini/gemini-cli/pull/24479)
+- fix(core): enhance sandbox usability and fix build error by @galz10 in
+  [#24460](https://github.com/google-gemini/gemini-cli/pull/24460)
+- Terminal Serializer Optimization by @jacob314 in
+  [#24485](https://github.com/google-gemini/gemini-cli/pull/24485)
+- Auto configure memory. by @jacob314 in
+  [#24474](https://github.com/google-gemini/gemini-cli/pull/24474)
+- Unused error variables in catch block are not allowed by @alisa-alisa in
+  [#24487](https://github.com/google-gemini/gemini-cli/pull/24487)
+- feat(core): add background memory service for skill extraction by @SandyTao520
+  in [#24274](https://github.com/google-gemini/gemini-cli/pull/24274)
+- feat: implement high-signal PR regression check for evaluations by
+  @alisa-alisa in
+  [#23937](https://github.com/google-gemini/gemini-cli/pull/23937)
+- Fix shell output display by @jacob314 in
+  [#24490](https://github.com/google-gemini/gemini-cli/pull/24490)
+- fix(ui): resolve unwanted vertical spacing around various tool output
+  treatments by @jwhelangoog in
+  [#24449](https://github.com/google-gemini/gemini-cli/pull/24449)
+- revert(cli): bring back input box and footer visibility in copy mode by
+  @sehoon38 in [#24504](https://github.com/google-gemini/gemini-cli/pull/24504)
+- fix(cli): prevent crash in AnsiOutputText when handling non-array data by
+  @sehoon38 in [#24498](https://github.com/google-gemini/gemini-cli/pull/24498)
+- feat(cli): support default values for environment variables by @ruomengz in
+  [#24469](https://github.com/google-gemini/gemini-cli/pull/24469)
+- Implement background process monitoring and inspection tools by @cocosheng-g
+  in [#23799](https://github.com/google-gemini/gemini-cli/pull/23799)
+- docs(browser-agent): update stale browser agent documentation by @gsquared94
+  in [#24463](https://github.com/google-gemini/gemini-cli/pull/24463)
+- fix: enable browser_agent in integration tests and add localhost fixture tests
+  by @gsquared94 in
+  [#24523](https://github.com/google-gemini/gemini-cli/pull/24523)
+- fix(browser): handle computer-use model detection for analyze_screenshot by
+  @gsquared94 in
+  [#24502](https://github.com/google-gemini/gemini-cli/pull/24502)
+- feat(core): Land ContextCompressionService by @joshualitt in
+  [#24483](https://github.com/google-gemini/gemini-cli/pull/24483)
+- feat(core): scope subagent workspace directories via AsyncLocalStorage by
   @SandyTao520 in
-  [#26338](https://github.com/google-gemini/gemini-cli/pull/26338)
-- test(cleanup): fix temporary directory leaks in test suites by @Adib234 in
-  [#26217](https://github.com/google-gemini/gemini-cli/pull/26217)
-- feat: add ignoreLocalEnv setting and --ignore-env flag (#2493) by @cocosheng-g
-  in [#26445](https://github.com/google-gemini/gemini-cli/pull/26445)
-- docs(sdk): add JSDoc to all exported interfaces and types by @fauzan171 in
-  [#26277](https://github.com/google-gemini/gemini-cli/pull/26277)
-- feat(cli): improve /agents refresh logging by @cocosheng-g in
-  [#26442](https://github.com/google-gemini/gemini-cli/pull/26442)
-- Fix: make Dockerfile self-contained with multi-stage build by @Famous077 in
-  [#24277](https://github.com/google-gemini/gemini-cli/pull/24277)
-- fix(core): filter unsupported multimodal types from tool responses by
-  @aishaneeshah in
-  [#26352](https://github.com/google-gemini/gemini-cli/pull/26352)
-- fix(core): properly format markdown in AskUser tool by unescaping newlines by
-  @Adib234 in [#26349](https://github.com/google-gemini/gemini-cli/pull/26349)
-- feat(bot): add actions spend metric script by @gundermanc in
-  [#26463](https://github.com/google-gemini/gemini-cli/pull/26463)
-- feat(cli): add /bug-memory command and auto-capture heap snapshot in /bug by
-  @Anjaligarhwal in
-  [#25639](https://github.com/google-gemini/gemini-cli/pull/25639)
-- fix(cli): make SkillInboxDialog fit and scroll in alternate buffer by
-  @SandyTao520 in
-  [#26455](https://github.com/google-gemini/gemini-cli/pull/26455)
-- Robust Scale-Safe Lifecycle Consolidation by @gemini-cli-robot in
-  [#26355](https://github.com/google-gemini/gemini-cli/pull/26355)
-- fix(ci): respect exempt labels when closing stale items by @gundermanc in
-  [#26475](https://github.com/google-gemini/gemini-cli/pull/26475)
-- fix(cli): use os.homedir() for home directory warning check by @TirthNaik-99
-  in [#25890](https://github.com/google-gemini/gemini-cli/pull/25890)
-- fix(a2a-server): resolve tool approval race condition and improve status
-  reporting by @kschaab in
-  [#26479](https://github.com/google-gemini/gemini-cli/pull/26479)
-- fix(cli): prevent settings dialog border clipping using maxHeight by
+  [#24445](https://github.com/google-gemini/gemini-cli/pull/24445)
+- Update ink version to 6.6.7 by @jacob314 in
+  [#24514](https://github.com/google-gemini/gemini-cli/pull/24514)
+- fix(acp): handle all InvalidStreamError types gracefully in prompt by @sripasg
+  in [#24540](https://github.com/google-gemini/gemini-cli/pull/24540)
+- Fix crash when vim editor is not found in PATH on Windows by
+  @Nagajyothi-tammisetti in
+  [#22423](https://github.com/google-gemini/gemini-cli/pull/22423)
+- fix(core): move project memory dir under tmp directory by @SandyTao520 in
+  [#24542](https://github.com/google-gemini/gemini-cli/pull/24542)
+- Enable 'Other' option for yesno question type by @ruomengz in
+  [#24545](https://github.com/google-gemini/gemini-cli/pull/24545)
+- fix(cli): clear stale retry/loading state after cancellation (#21096) by
+  @Aaxhirrr in [#21960](https://github.com/google-gemini/gemini-cli/pull/21960)
+- Changelog for v0.37.0-preview.0 by @gemini-cli-robot in
+  [#24464](https://github.com/google-gemini/gemini-cli/pull/24464)
+- feat(core): implement context-aware persistent policy approvals by @jerop in
+  [#23257](https://github.com/google-gemini/gemini-cli/pull/23257)
+- docs: move agent disabling instructions and update remote agent status by
   @jackwotherspoon in
-  [#26507](https://github.com/google-gemini/gemini-cli/pull/26507)
-- feat: allow queuing messages during compression (#24071) by @cocosheng-g in
-  [#26506](https://github.com/google-gemini/gemini-cli/pull/26506)
-- fix(core): retry on ERR_STREAM_PREMATURE_CLOSE errors by @cocosheng-g in
-  [#26519](https://github.com/google-gemini/gemini-cli/pull/26519)
-- fix(core): Minor fixes for generalist profile. by @joshualitt in
-  [#26357](https://github.com/google-gemini/gemini-cli/pull/26357)
-- fix(patch): cherry-pick 3627f47 to release/v0.42.0-preview.0-pr-26542 to patch
-  version v0.42.0-preview.0 and create version 0.42.0-preview.1 by
-  @gemini-cli-robot in
-  [#26544](https://github.com/google-gemini/gemini-cli/pull/26544)
-- fix(patch): cherry-pick 02995ba to release/v0.42.0-preview.1-pr-26568 to patch
-  version v0.42.0-preview.1 and create version 0.42.0-preview.2 by
-  @gemini-cli-robot in
-  [#26590](https://github.com/google-gemini/gemini-cli/pull/26590)
+  [#24559](https://github.com/google-gemini/gemini-cli/pull/24559)
+- feat(cli): migrate nonInteractiveCli to LegacyAgentSession by @adamfweidman in
+  [#22987](https://github.com/google-gemini/gemini-cli/pull/22987)
+- fix(core): unsafe type assertions in Core File System #19712 by
+  @aniketsaurav18 in
+  [#19739](https://github.com/google-gemini/gemini-cli/pull/19739)
+- fix(ui): hide model quota in /stats and refactor quota display by @danzaharia1
+  in [#24206](https://github.com/google-gemini/gemini-cli/pull/24206)
+- Changelog for v0.36.0 by @gemini-cli-robot in
+  [#24558](https://github.com/google-gemini/gemini-cli/pull/24558)
+- Changelog for v0.37.0-preview.1 by @gemini-cli-robot in
+  [#24568](https://github.com/google-gemini/gemini-cli/pull/24568)
+- docs: add missing .md extensions to internal doc links by @ishaan-arora-1 in
+  [#24145](https://github.com/google-gemini/gemini-cli/pull/24145)
+- fix(ui): fixed table styling by @devr0306 in
+  [#24565](https://github.com/google-gemini/gemini-cli/pull/24565)
+- fix(core): pass includeDirectories to sandbox configuration by @galz10 in
+  [#24573](https://github.com/google-gemini/gemini-cli/pull/24573)
+- feat(ui): enable "TerminalBuffer" mode to solve flicker by @jacob314 in
+  [#24512](https://github.com/google-gemini/gemini-cli/pull/24512)
+- docs: clarify release coordination by @scidomino in
+  [#24575](https://github.com/google-gemini/gemini-cli/pull/24575)
+- fix(core): remove broken PowerShell translation and fix native \_\_write in
+  Windows sandbox by @scidomino in
+  [#24571](https://github.com/google-gemini/gemini-cli/pull/24571)
+- Add instructions for how to start react in prod and force react to prod mode
+  by @jacob314 in
+  [#24590](https://github.com/google-gemini/gemini-cli/pull/24590)
+- feat(cli): minimalist sandbox status labels by @galz10 in
+  [#24582](https://github.com/google-gemini/gemini-cli/pull/24582)
+- Feat/browser agent metrics by @kunal-10-cloud in
+  [#24210](https://github.com/google-gemini/gemini-cli/pull/24210)
+- test: fix Windows CI execution and resolve exposed platform failures by
+  @ehedlund in [#24476](https://github.com/google-gemini/gemini-cli/pull/24476)
+- feat(core,cli): prioritize summary for topics (#24608) by @Abhijit-2592 in
+  [#24609](https://github.com/google-gemini/gemini-cli/pull/24609)
+- show color by @jacob314 in
+  [#24613](https://github.com/google-gemini/gemini-cli/pull/24613)
+- feat(cli): enable compact tool output by default (#24509) by @jwhelangoog in
+  [#24510](https://github.com/google-gemini/gemini-cli/pull/24510)
+- fix(core): inject skill system instructions into subagent prompts if activated
+  by @abhipatel12 in
+  [#24620](https://github.com/google-gemini/gemini-cli/pull/24620)
+- fix(core): improve windows sandbox reliability and fix integration tests by
+  @ehedlund in [#24480](https://github.com/google-gemini/gemini-cli/pull/24480)
+- fix(core): ensure sandbox approvals are correctly persisted and matched for
+  proactive expansions by @galz10 in
+  [#24577](https://github.com/google-gemini/gemini-cli/pull/24577)
+- feat(cli) Scrollbar for input prompt by @jacob314 in
+  [#21992](https://github.com/google-gemini/gemini-cli/pull/21992)
+- Do not run pr-eval workflow when no steering changes detected by @alisa-alisa
+  in [#24621](https://github.com/google-gemini/gemini-cli/pull/24621)
+- Fix restoration of topic headers. by @gundermanc in
+  [#24650](https://github.com/google-gemini/gemini-cli/pull/24650)
+- feat(core): discourage update topic tool for simple tasks by @Samee24 in
+  [#24640](https://github.com/google-gemini/gemini-cli/pull/24640)
+- fix(core): ensure global temp directory is always in sandbox allowed paths by
+  @galz10 in [#24638](https://github.com/google-gemini/gemini-cli/pull/24638)
+- fix(core): detect uninitialized lines by @jacob314 in
+  [#24646](https://github.com/google-gemini/gemini-cli/pull/24646)
+- docs: update sandboxing documentation and toolSandboxing settings by @galz10
+  in [#24655](https://github.com/google-gemini/gemini-cli/pull/24655)
+- feat(cli): enhance tool confirmation UI and selection layout by @galz10 in
+  [#24376](https://github.com/google-gemini/gemini-cli/pull/24376)
+- feat(acp): add support for `/about` command by @sripasg in
+  [#24649](https://github.com/google-gemini/gemini-cli/pull/24649)
+- feat(cli): add role specific metrics to /stats by @cynthialong0-0 in
+  [#24659](https://github.com/google-gemini/gemini-cli/pull/24659)
+- split context by @jacob314 in
+  [#24623](https://github.com/google-gemini/gemini-cli/pull/24623)
+- fix(cli): remove -S from shebang to fix Windows and BSD execution by
+  @scidomino in [#24756](https://github.com/google-gemini/gemini-cli/pull/24756)
+- Fix issue where topic headers can be posted back to back by @gundermanc in
+  [#24759](https://github.com/google-gemini/gemini-cli/pull/24759)
+- fix(core): handle partial llm_request in BeforeModel hook override by
+  @krishdef7 in [#22326](https://github.com/google-gemini/gemini-cli/pull/22326)
+- fix(ui): improve narration suppression and reduce flicker by @gundermanc in
+  [#24635](https://github.com/google-gemini/gemini-cli/pull/24635)
+- fix(ui): fixed auth race condition causing logo to flicker by @devr0306 in
+  [#24652](https://github.com/google-gemini/gemini-cli/pull/24652)
+- fix(browser): remove premature browser cleanup after subagent invocation by
+  @gsquared94 in
+  [#24753](https://github.com/google-gemini/gemini-cli/pull/24753)
+- Revert "feat(core,cli): prioritize summary for topics (#24608)" by
+  @Abhijit-2592 in
+  [#24777](https://github.com/google-gemini/gemini-cli/pull/24777)
+- relax tool sandboxing overrides for plan mode to match defaults. by
+  @DavidAPierce in
+  [#24762](https://github.com/google-gemini/gemini-cli/pull/24762)
+- fix(cli): respect global environment variable allowlist by @scidomino in
+  [#24767](https://github.com/google-gemini/gemini-cli/pull/24767)
+- fix(cli): ensure skills list outputs to stdout in non-interactive environments
+  by @spencer426 in
+  [#24566](https://github.com/google-gemini/gemini-cli/pull/24566)
+- Add an eval for and fix unsafe cloning behavior. by @gundermanc in
+  [#24457](https://github.com/google-gemini/gemini-cli/pull/24457)
+- fix(policy): allow complete_task in plan mode by @abhipatel12 in
+  [#24771](https://github.com/google-gemini/gemini-cli/pull/24771)
+- feat(telemetry): add browser agent clearcut metrics by @gsquared94 in
+  [#24688](https://github.com/google-gemini/gemini-cli/pull/24688)
+- feat(cli): support selective topic expansion and click-to-expand by
+  @Abhijit-2592 in
+  [#24793](https://github.com/google-gemini/gemini-cli/pull/24793)
+- temporarily disable sandbox integration test on windows by @ehedlund in
+  [#24786](https://github.com/google-gemini/gemini-cli/pull/24786)
+- Remove flakey test by @scidomino in
+  [#24837](https://github.com/google-gemini/gemini-cli/pull/24837)
+- Alisa/approve button by @alisa-alisa in
+  [#24645](https://github.com/google-gemini/gemini-cli/pull/24645)
+- feat(hooks): display hook system messages in UI by @mbleigh in
+  [#24616](https://github.com/google-gemini/gemini-cli/pull/24616)
+- fix(core): propagate BeforeModel hook model override end-to-end by @krishdef7
+  in [#24784](https://github.com/google-gemini/gemini-cli/pull/24784)
+- chore: fix formatting for behavioral eval skill reference file by @abhipatel12
+  in [#24846](https://github.com/google-gemini/gemini-cli/pull/24846)
+- fix: use directory junctions on Windows for skill linking by @enjoykumawat in
+  [#24823](https://github.com/google-gemini/gemini-cli/pull/24823)
+- fix(cli): prevent multiple banner increments on remount by @sehoon38 in
+  [#24843](https://github.com/google-gemini/gemini-cli/pull/24843)
+- feat(acp): add /help command by @sripasg in
+  [#24839](https://github.com/google-gemini/gemini-cli/pull/24839)
+- fix(core): remove tmux alternate buffer warning by @jackwotherspoon in
+  [#24852](https://github.com/google-gemini/gemini-cli/pull/24852)
+- Improve sandbox error matching and caching by @DavidAPierce in
+  [#24550](https://github.com/google-gemini/gemini-cli/pull/24550)
+- feat(core): add agent protocol UI types and experimental flag by @mbleigh in
+  [#24275](https://github.com/google-gemini/gemini-cli/pull/24275)
+- feat(core): use experiment flags for default fetch timeouts by @yunaseoul in
+  [#24261](https://github.com/google-gemini/gemini-cli/pull/24261)
+- Revert "fix(ui): improve narration suppression and reduce flicker (#2… by
+  @gundermanc in
+  [#24857](https://github.com/google-gemini/gemini-cli/pull/24857)
+- refactor(cli): remove duplication in interactive shell awaiting input hint by
+  @JayadityaGit in
+  [#24801](https://github.com/google-gemini/gemini-cli/pull/24801)
+- refactor(core): make LegacyAgentSession dependencies optional by @mbleigh in
+  [#24287](https://github.com/google-gemini/gemini-cli/pull/24287)
+- Changelog for v0.37.0-preview.2 by @gemini-cli-robot in
+  [#24848](https://github.com/google-gemini/gemini-cli/pull/24848)
+- fix(cli): always show shell command description or actual command by @jacob314
+  in [#24774](https://github.com/google-gemini/gemini-cli/pull/24774)
+- Added flag for ept size and increased default size by @devr0306 in
+  [#24859](https://github.com/google-gemini/gemini-cli/pull/24859)
+- fix(core): dispose Scheduler to prevent McpProgress listener leak by
+  @Anjaligarhwal in
+  [#24870](https://github.com/google-gemini/gemini-cli/pull/24870)
+- fix(cli): switch default back to terminalBuffer=false and fix regressions
+  introduced for that mode by @jacob314 in
+  [#24873](https://github.com/google-gemini/gemini-cli/pull/24873)
+- feat(cli): switch to ctrl+g from ctrl-x by @jacob314 in
+  [#24861](https://github.com/google-gemini/gemini-cli/pull/24861)
+- fix: isolate concurrent browser agent instances by @gsquared94 in
+  [#24794](https://github.com/google-gemini/gemini-cli/pull/24794)
+- docs: update MCP server OAuth redirect port documentation by @adamfweidman in
+  [#24844](https://github.com/google-gemini/gemini-cli/pull/24844)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.41.2...v0.42.0
+https://github.com/google-gemini/gemini-cli/compare/v0.38.0...v0.38.2

docs/changelogs/preview.md

@@ -1,6 +1,6 @@
-# Preview release: v0.43.0-preview.0
+# Preview release: v0.39.0-preview.0
 
-Released: May 12, 2026
+Released: April 14, 2026
 
 Our preview release includes the latest, new, and experimental features. This
 release may not be as stable as our [latest weekly release](latest.md).
@@ -13,184 +13,245 @@ npm install -g @google/gemini-cli@preview
 
 ## Highlights
 
-- **Surgical Code Edits:** Steer models to use the `edit` tool for precise code
-  modifications, improving accuracy and reducing context usage.
-- **Session Portability:** Added ability to export chat sessions to files and
-  import them via a new CLI flag, enabling session persistence and sharing.
-- **Enhanced Security:** Introduced comprehensive shell command safety
-  evaluations and strengthened model steering to prevent unauthorized changes.
-- **Context Management:** Implemented a new adaptive token calculator for more
-  accurate content size estimations and optimized context pipelines.
-- **UX Improvements:** Enhanced tool call visibility with prefixed IDs and
-  improved the UI for session resumption and MCP list management.
+- **Refactored Subagents and Unified Tooling:** Consolidate subagent tools into
+  a single `invoke_subagent` tool, removed legacy wrapping tools, and improved
+  turn limits for codebase investigator.
+- **Advanced Memory and Skill Management:** Introduced `/memory` inbox for
+  reviewing extracted skills and added skill patching support, enhancing agent
+  learning and persistence.
+- **Expanded Test and Evaluation Infrastructure:** Added memory and CPU
+  performance integration test harnesses and generalized evaluation
+  infrastructure for better suite organization.
+- **Sandbox and Security Hardening:** Centralized sandbox paths for Linux and
+  macOS, enforced read-only security for async git worktree resolution, and
+  optimized Windows sandbox initialization.
+- **Enhanced CLI UX and UI Stability:** Improved scroll momentum, added a
+  `debugRainbow` setting, and resolved various memory leaks and PTY exhaustion
+  issues for a smoother terminal experience.
 
 ## What's Changed
 
-- feat(core): steer model to use edit tool for surgical edits, fix a typo in
-  [#26480](https://github.com/google-gemini/gemini-cli/pull/26480)
-- docs: clarify Auto Memory proposes memory updates and skills in
-  [#26527](https://github.com/google-gemini/gemini-cli/pull/26527)
-- fix(core): reject numeric project IDs in GOOGLE_CLOUD_PROJECT (#24695) in
-  [#26532](https://github.com/google-gemini/gemini-cli/pull/26532)
-- fix(core): remove unsafe type assertion suppressions in error utils in
-  [#19881](https://github.com/google-gemini/gemini-cli/pull/19881)
-- fix(core): allow redirection in YOLO and AUTO_EDIT modes without sandboxing in
-  [#26542](https://github.com/google-gemini/gemini-cli/pull/26542)
-- ci(release): build and attach unsigned macOS binaries to releases in
-  [#26462](https://github.com/google-gemini/gemini-cli/pull/26462)
-- fix(core): Fix chat corruption bug in context manager. in
-  [#26534](https://github.com/google-gemini/gemini-cli/pull/26534)
-- fix(cli): provide JSON output for AgentExecutionStopped in non-interactive
-  mode in [#26504](https://github.com/google-gemini/gemini-cli/pull/26504)
-- feat(evals): add shell command safety evals in
-  [#26528](https://github.com/google-gemini/gemini-cli/pull/26528)
-- fix(core): handle invalid custom plans directory gracefully in
-  [#26560](https://github.com/google-gemini/gemini-cli/pull/26560)
-- fix(acp): move tool explanation from thought stream to tool call content in
-  [#26554](https://github.com/google-gemini/gemini-cli/pull/26554)
-- fix(a2a-server): Resolve race condition in tool completion waiting in
-  [#26568](https://github.com/google-gemini/gemini-cli/pull/26568)
-- fix(cli): randomize sandbox container names in
-  [#26014](https://github.com/google-gemini/gemini-cli/pull/26014)
-- fix(core): Fix hysteresis in async context management pipelines. in
-  [#26452](https://github.com/google-gemini/gemini-cli/pull/26452)
-- Tighten private Auto Memory patch allowlist in
-  [#26535](https://github.com/google-gemini/gemini-cli/pull/26535)
-- fix(cli): hide read-only settings scopes in
-  [#26249](https://github.com/google-gemini/gemini-cli/pull/26249)
-- fix(ci): preserve executable bit for mac binaries in
-  [#26600](https://github.com/google-gemini/gemini-cli/pull/26600)
-- fix(cli): improve mcp list UX in untrusted folders in
-  [#26457](https://github.com/google-gemini/gemini-cli/pull/26457)
-- fix(core): prevent silent hang during OAuth auth on headless Linux in
-  [#26571](https://github.com/google-gemini/gemini-cli/pull/26571)
-- Changelog for v0.42.0-preview.0 in
-  [#26537](https://github.com/google-gemini/gemini-cli/pull/26537)
-- ci: fix Argument list too long in triage workflows in
-  [#26603](https://github.com/google-gemini/gemini-cli/pull/26603)
-- refactor(cli): migrate core tools to native ToolDisplay property and fix UI
-  rendering in [#25186](https://github.com/google-gemini/gemini-cli/pull/25186)
-- don't wrap args unnecessarily in
-  [#26599](https://github.com/google-gemini/gemini-cli/pull/26599)
-- fix(core): preserve system PATH in Git environment to fix ENOENT (#25034) in
-  [#26587](https://github.com/google-gemini/gemini-cli/pull/26587)
-- fix(routing): fix resolveClassifierModel argument mismatch in
-  ApprovalModeStrategy in
-  [#26658](https://github.com/google-gemini/gemini-cli/pull/26658)
-- docs: add vi mode shortcuts and clarify MCP/custom sandbox setup in
-  [#23853](https://github.com/google-gemini/gemini-cli/pull/23853)
-- fix(ux): fixed issue with transcribed text not showing after releasing space
-  in [#26609](https://github.com/google-gemini/gemini-cli/pull/26609)
-- ci: fix json parsing in scheduled triage workflow in
-  [#26656](https://github.com/google-gemini/gemini-cli/pull/26656)
-- fix(cli): hide /memory add subcommand when memoryV2 is enabled in
-  [#26605](https://github.com/google-gemini/gemini-cli/pull/26605)
-- fix: prevent false command conflicts when launching from home directory in
-  [#23069](https://github.com/google-gemini/gemini-cli/pull/23069)
-- fix(core): cache model routing decision in LocalAgentExecutor in
-  [#26548](https://github.com/google-gemini/gemini-cli/pull/26548)
-- Changelog for v0.42.0-preview.2 in
-  [#26597](https://github.com/google-gemini/gemini-cli/pull/26597)
-- skip broken test in
-  [#26705](https://github.com/google-gemini/gemini-cli/pull/26705)
-- feat: export session to file and import via flag in
-  [#26514](https://github.com/google-gemini/gemini-cli/pull/26514)
-- Feat: Add Machine Hostname to CLI interface in
-  [#25637](https://github.com/google-gemini/gemini-cli/pull/25637)
-- docs(extensions): refactor releasing guide and add update mechanisms in
-  [#26595](https://github.com/google-gemini/gemini-cli/pull/26595)
-- fix(ci): fix maintainer identification in lifecycle manager in
-  [#26706](https://github.com/google-gemini/gemini-cli/pull/26706)
-- fix(ui): added quotes around session id in resume tip in
-  [#26669](https://github.com/google-gemini/gemini-cli/pull/26669)
-- Changelog for v0.41.0 in
-  [#26670](https://github.com/google-gemini/gemini-cli/pull/26670)
-- refactor(core): agent session protocol changes in
-  [#26661](https://github.com/google-gemini/gemini-cli/pull/26661)
-- fix(context): implement loose boundary policy for gc backstop. in
-  [#26594](https://github.com/google-gemini/gemini-cli/pull/26594)
-- fix(core): throw explicit error on dropped tool responses in
-  [#26668](https://github.com/google-gemini/gemini-cli/pull/26668)
-- fix: resolve "function response turn must come immediately after function
-  call" error in
-  [#26691](https://github.com/google-gemini/gemini-cli/pull/26691)
-- fix(core): resolve parallel tool call streaming ID collision in
-  [#26646](https://github.com/google-gemini/gemini-cli/pull/26646)
-- feat(core): add LocalSubagentProtocol behind AgentProtocol in
-  [#25302](https://github.com/google-gemini/gemini-cli/pull/25302)
-- fix(cli): remove noisy theme registration logs from terminal in
-  [#25858](https://github.com/google-gemini/gemini-cli/pull/25858)
-- ci: implement codebase-aware effort level triage in
-  [#26666](https://github.com/google-gemini/gemini-cli/pull/26666)
-- feat(acp/core): prefix tool call IDs with tool names to support tool rendering
-  in ACP compliant IDEs. in
-  [#26676](https://github.com/google-gemini/gemini-cli/pull/26676)
-- fix(mcp): treat GET 404 as 405 in StreamableHTTPClientTransport in
-  [#24847](https://github.com/google-gemini/gemini-cli/pull/24847)
-- feat(core): add RemoteSubagentProtocol behind AgentProtocol in
-  [#25303](https://github.com/google-gemini/gemini-cli/pull/25303)
-- feat(context): Improvements to the snapshotter. in
-  [#26655](https://github.com/google-gemini/gemini-cli/pull/26655)
-- fix(context): Change snapshotter model config. in
-  [#26745](https://github.com/google-gemini/gemini-cli/pull/26745)
-- fix(cli): allow installing extensions from ssh repo in
-  [#26274](https://github.com/google-gemini/gemini-cli/pull/26274)
-- fix(cli): prevent duplicate SessionStart systemMessage render in
-  [#25827](https://github.com/google-gemini/gemini-cli/pull/25827)
-- fix(cli/acp): prevent infinite thought loop in ACP mode by disablig
-  nextSpeakerCheck in
-  [#26874](https://github.com/google-gemini/gemini-cli/pull/26874)
-- fix(cli): use static tool name in confirmation prompt to avoid parsing errors
-  in [#26866](https://github.com/google-gemini/gemini-cli/pull/26866)
-- fix(routing): Refactor tool turn handling for the conversation history in
-  NumericalClassifierStrategy to prevent 400 Bad Request in
-  [#26761](https://github.com/google-gemini/gemini-cli/pull/26761)
-- fix(core): handle malformed projects.json in ProjectRegistry in
-  [#26885](https://github.com/google-gemini/gemini-cli/pull/26885)
-- fix(ui): added a gutter width to the input prompt width calculation in
-  [#26882](https://github.com/google-gemini/gemini-cli/pull/26882)
-- fix: prevent EISDIR crash when customIgnoreFilePaths contains directories
-  (#19868) in [#19898](https://github.com/google-gemini/gemini-cli/pull/19898)
-- revert 6b9b778d821728427eea07b1b97ba07378137d0b in
-  [#26893](https://github.com/google-gemini/gemini-cli/pull/26893)
-- Fix/vscode run current file ts in
-  [#22894](https://github.com/google-gemini/gemini-cli/pull/22894)
-- Allow Enter to select session while in search mode in /resume in
-  [#21523](https://github.com/google-gemini/gemini-cli/pull/21523)
-- fix(core): ignore .pak and .rpa game archive formats by default in
-  [#26884](https://github.com/google-gemini/gemini-cli/pull/26884)
-- fix(cli): enable adk non-interactive session in
-  [#26895](https://github.com/google-gemini/gemini-cli/pull/26895)
-- fix(cli): restore resume for legacy sessions in
-  [#26577](https://github.com/google-gemini/gemini-cli/pull/26577)
-- fix: respect explicit model selection after Flash quota exhaustion (#26759) in
-  [#26872](https://github.com/google-gemini/gemini-cli/pull/26872)
-- feat(context): Introduce adaptive token calculator to more accurately
-  calculate content sizes. in
-  [#26888](https://github.com/google-gemini/gemini-cli/pull/26888)
-- chore: update checkout action configuration in workflows in
-  [#26897](https://github.com/google-gemini/gemini-cli/pull/26897)
-- fix (telemetry): inject quota_project_id to prevent fallback to default oauth
-  client in [#26698](https://github.com/google-gemini/gemini-cli/pull/26698)
-- Exclude extension context from skill extraction agent in
-  [#26879](https://github.com/google-gemini/gemini-cli/pull/26879)
-- Enable NumericalRouter when using dynamic model configs in
-  [#26929](https://github.com/google-gemini/gemini-cli/pull/26929)
-- ci: actively triage missing priority labels and intelligently clean up
-  conflicting labels in
-  [#26865](https://github.com/google-gemini/gemini-cli/pull/26865)
-- refactor(core): introduce SubagentState enum for progress in
-  [#26934](https://github.com/google-gemini/gemini-cli/pull/26934)
-- fix(ci): replace brittle --no-tag with explicit staging-tmp tag in
-  [#26940](https://github.com/google-gemini/gemini-cli/pull/26940)
-- Incremental refactor repo agent towards skills-based composition in
-  [#26717](https://github.com/google-gemini/gemini-cli/pull/26717)
-- fix(ui): fixed line wrap padding for selection lists in
-  [#26944](https://github.com/google-gemini/gemini-cli/pull/26944)
-- fix(core): update read_file schema for v1 compatibility (#22183) in
-  [#26922](https://github.com/google-gemini/gemini-cli/pull/26922)
-- fix(ci): configure git remote with token for authentication in
-  [#26949](https://github.com/google-gemini/gemini-cli/pull/26949)
+- refactor(plan): simplify policy priorities and consolidate read-only rules by
+  @ruomengz in [#24849](https://github.com/google-gemini/gemini-cli/pull/24849)
+- feat(test-utils): add memory usage integration test harness by @sripasg in
+  [#24876](https://github.com/google-gemini/gemini-cli/pull/24876)
+- feat(memory): add /memory inbox command for reviewing extracted skills by
+  @SandyTao520 in
+  [#24544](https://github.com/google-gemini/gemini-cli/pull/24544)
+- chore(release): bump version to 0.39.0-nightly.20260408.e77b22e63 by
+  @gemini-cli-robot in
+  [#24939](https://github.com/google-gemini/gemini-cli/pull/24939)
+- fix(core): ensure robust sandbox cleanup in all process execution paths by
+  @ehedlund in [#24763](https://github.com/google-gemini/gemini-cli/pull/24763)
+- chore: update ink version to 6.6.8 by @jacob314 in
+  [#24934](https://github.com/google-gemini/gemini-cli/pull/24934)
+- Changelog for v0.38.0-preview.0 by @gemini-cli-robot in
+  [#24938](https://github.com/google-gemini/gemini-cli/pull/24938)
+- chore: ignore conductor directory by @JayadityaGit in
+  [#22128](https://github.com/google-gemini/gemini-cli/pull/22128)
+- Changelog for v0.37.0 by @gemini-cli-robot in
+  [#24940](https://github.com/google-gemini/gemini-cli/pull/24940)
+- feat(plan): require user confirmation for activate_skill in Plan Mode by
+  @ruomengz in [#24946](https://github.com/google-gemini/gemini-cli/pull/24946)
+- feat(test-utils): add CPU performance integration test harness by @sripasg in
+  [#24951](https://github.com/google-gemini/gemini-cli/pull/24951)
+- fix(cli-ui): enable Ctrl+Backspace for word deletion in Windows Terminal by
+  @dogukanozen in
+  [#21447](https://github.com/google-gemini/gemini-cli/pull/21447)
+- test(sdk): add unit tests for GeminiCliSession by @AdamyaSingh7 in
+  [#21897](https://github.com/google-gemini/gemini-cli/pull/21897)
+- fix(core): resolve windows symlink bypass and stabilize sandbox integration
+  tests by @ehedlund in
+  [#24834](https://github.com/google-gemini/gemini-cli/pull/24834)
+- fix(cli): restore file path display in edit and write tool confirmations by
+  @jwhelangoog in
+  [#24974](https://github.com/google-gemini/gemini-cli/pull/24974)
+- feat(core): refine shell tool description display logic by @jwhelangoog in
+  [#24903](https://github.com/google-gemini/gemini-cli/pull/24903)
+- fix(core): dynamic session ID injection to resolve resume bugs by @scidomino
+  in [#24972](https://github.com/google-gemini/gemini-cli/pull/24972)
+- Update ink version to 6.6.9 by @jacob314 in
+  [#24980](https://github.com/google-gemini/gemini-cli/pull/24980)
+- Generalize evals infra to support more types of evals, organization and
+  queuing of named suites by @gundermanc in
+  [#24941](https://github.com/google-gemini/gemini-cli/pull/24941)
+- fix(cli): optimize startup with lightweight parent process by @sehoon38 in
+  [#24667](https://github.com/google-gemini/gemini-cli/pull/24667)
+- refactor(sandbox): use centralized sandbox paths in macOS Seatbelt
+  implementation by @ehedlund in
+  [#24984](https://github.com/google-gemini/gemini-cli/pull/24984)
+- feat(cli): refine tool output formatting for compact mode by @jwhelangoog in
+  [#24677](https://github.com/google-gemini/gemini-cli/pull/24677)
+- fix(sdk): skip broken sendStream tests to unblock nightly by @SandyTao520 in
+  [#25000](https://github.com/google-gemini/gemini-cli/pull/25000)
+- refactor(core): use centralized path resolution for Linux sandbox by @ehedlund
+  in [#24985](https://github.com/google-gemini/gemini-cli/pull/24985)
+- Support ctrl+shift+g by @jacob314 in
+  [#25035](https://github.com/google-gemini/gemini-cli/pull/25035)
+- feat(core): refactor subagent tool to unified invoke_subagent tool by
+  @abhipatel12 in
+  [#24489](https://github.com/google-gemini/gemini-cli/pull/24489)
+- fix(core): add explicit git identity env vars to prevent sandbox checkpointing
+  error by @mrpmohiburrahman in
+  [#19775](https://github.com/google-gemini/gemini-cli/pull/19775)
+- fix: respect hideContextPercentage when FooterConfigDialog is closed without
+  changes by @chernistry in
+  [#24773](https://github.com/google-gemini/gemini-cli/pull/24773)
+- fix(cli): suppress unhandled AbortError logs during request cancellation by
+  @euxaristia in
+  [#22621](https://github.com/google-gemini/gemini-cli/pull/22621)
+- Automated documentation audit by @g-samroberts in
+  [#24567](https://github.com/google-gemini/gemini-cli/pull/24567)
+- feat(cli): implement useAgentStream hook by @mbleigh in
+  [#24292](https://github.com/google-gemini/gemini-cli/pull/24292)
+- refactor(plan) Clean default plan toml by @ruomengz in
+  [#25037](https://github.com/google-gemini/gemini-cli/pull/25037)
+- refactor(core): remove legacy subagent wrapping tools by @abhipatel12 in
+  [#25053](https://github.com/google-gemini/gemini-cli/pull/25053)
+- fix(core): honor retryDelay in RetryInfo for 503 errors by @yunaseoul in
+  [#25057](https://github.com/google-gemini/gemini-cli/pull/25057)
+- fix(core): remediate subagent memory leaks using AbortSignal in MessageBus by
+  @abhipatel12 in
+  [#25048](https://github.com/google-gemini/gemini-cli/pull/25048)
+- feat(cli): wire up useAgentStream in AppContainer by @mbleigh in
+  [#24297](https://github.com/google-gemini/gemini-cli/pull/24297)
+- feat(core): migrate chat recording to JSONL streaming by @spencer426 in
+  [#23749](https://github.com/google-gemini/gemini-cli/pull/23749)
+- fix(core): clear 5-minute timeouts in oauth flow to prevent memory leaks by
+  @spencer426 in
+  [#24968](https://github.com/google-gemini/gemini-cli/pull/24968)
+- fix(sandbox): centralize async git worktree resolution and enforce read-only
+  security by @ehedlund in
+  [#25040](https://github.com/google-gemini/gemini-cli/pull/25040)
+- feat(test): add high-volume shell test and refine perf harness by @sripasg in
+  [#24983](https://github.com/google-gemini/gemini-cli/pull/24983)
+- fix(core): silently handle EPERM when listing dir structure by @scidomino in
+  [#25066](https://github.com/google-gemini/gemini-cli/pull/25066)
+- Changelog for v0.37.1 by @gemini-cli-robot in
+  [#25055](https://github.com/google-gemini/gemini-cli/pull/25055)
+- fix: decode Uint8Array and multi-byte UTF-8 in API error messages by
+  @kimjune01 in [#23341](https://github.com/google-gemini/gemini-cli/pull/23341)
+- Automated documentation audit results by @g-samroberts in
+  [#22755](https://github.com/google-gemini/gemini-cli/pull/22755)
+- debugging(ui): add optional debugRainbow setting by @jacob314 in
+  [#25088](https://github.com/google-gemini/gemini-cli/pull/25088)
+- fix: resolve lifecycle memory leaks by cleaning up listeners and root closures
+  by @spencer426 in
+  [#25049](https://github.com/google-gemini/gemini-cli/pull/25049)
+- docs(cli): updates f12 description to be more precise by @JayadityaGit in
+  [#15816](https://github.com/google-gemini/gemini-cli/pull/15816)
+- fix(cli): mark /settings as unsafe to run concurrently by @jacob314 in
+  [#25061](https://github.com/google-gemini/gemini-cli/pull/25061)
+- fix(core): remove buffer slice to prevent OOM on large output streams by
+  @spencer426 in
+  [#25094](https://github.com/google-gemini/gemini-cli/pull/25094)
+- feat(core): persist subagent agentId in tool call records by @abhipatel12 in
+  [#25092](https://github.com/google-gemini/gemini-cli/pull/25092)
+- chore(core): increase codebase investigator turn limits to 50 by @abhipatel12
+  in [#25125](https://github.com/google-gemini/gemini-cli/pull/25125)
+- refactor(core): consolidate execute() arguments into ExecuteOptions by
+  @mbleigh in [#25101](https://github.com/google-gemini/gemini-cli/pull/25101)
+- feat(core): add Strategic Re-evaluation guidance to system prompt by
+  @aishaneeshah in
+  [#25062](https://github.com/google-gemini/gemini-cli/pull/25062)
+- fix(core): preserve shell execution config fields on update by
+  @jasonmatthewsuhari in
+  [#25113](https://github.com/google-gemini/gemini-cli/pull/25113)
+- docs: add vi shortcuts and clarify MCP sandbox setup by @chrisjcthomas in
+  [#21679](https://github.com/google-gemini/gemini-cli/pull/21679)
+- fix(cli): pass session id to interactive shell executions by
+  @jasonmatthewsuhari in
+  [#25114](https://github.com/google-gemini/gemini-cli/pull/25114)
+- fix(cli): resolve text sanitization data loss due to C1 control characters by
+  @euxaristia in
+  [#22624](https://github.com/google-gemini/gemini-cli/pull/22624)
+- feat(core): add large memory regression test by @cynthialong0-0 in
+  [#25059](https://github.com/google-gemini/gemini-cli/pull/25059)
+- fix(core): resolve PTY exhaustion and orphan MCP subprocess leaks by
+  @spencer426 in
+  [#25079](https://github.com/google-gemini/gemini-cli/pull/25079)
+- chore(deps): update vulnerable dependencies via npm audit fix by @scidomino in
+  [#25140](https://github.com/google-gemini/gemini-cli/pull/25140)
+- perf(sandbox): optimize Windows sandbox initialization via native ACL
+  application by @ehedlund in
+  [#25077](https://github.com/google-gemini/gemini-cli/pull/25077)
+- chore: switch from keytar to @github/keytar by @cocosheng-g in
+  [#25143](https://github.com/google-gemini/gemini-cli/pull/25143)
+- fix: improve audio MIME normalization and validation in file reads by
+  @junaiddshaukat in
+  [#21636](https://github.com/google-gemini/gemini-cli/pull/21636)
+- docs: Update docs-audit to include changes in PR body by @g-samroberts in
+  [#25153](https://github.com/google-gemini/gemini-cli/pull/25153)
+- docs: correct documentation for enforced authentication type by @cocosheng-g
+  in [#25142](https://github.com/google-gemini/gemini-cli/pull/25142)
+- fix(cli): exclude update_topic from confirmation queue count by @Abhijit-2592
+  in [#24945](https://github.com/google-gemini/gemini-cli/pull/24945)
+- Memory fix for trace's streamWrapper. by @anthraxmilkshake in
+  [#25089](https://github.com/google-gemini/gemini-cli/pull/25089)
+- fix(core): fix quota footer for non-auto models and improve display by
+  @jackwotherspoon in
+  [#25121](https://github.com/google-gemini/gemini-cli/pull/25121)
+- docs(contributing): clarify self-assignment policy for issues by @jmr in
+  [#23087](https://github.com/google-gemini/gemini-cli/pull/23087)
+- feat(core): add skill patching support with /memory inbox integration by
+  @SandyTao520 in
+  [#25148](https://github.com/google-gemini/gemini-cli/pull/25148)
+- Stop suppressing thoughts and text in model response by @gundermanc in
+  [#25073](https://github.com/google-gemini/gemini-cli/pull/25073)
+- fix(release): prefix git hash in nightly versions to prevent semver
+  normalization by @SandyTao520 in
+  [#25304](https://github.com/google-gemini/gemini-cli/pull/25304)
+- feat(cli): extract QuotaContext and resolve infinite render loop by @Adib234
+  in [#24959](https://github.com/google-gemini/gemini-cli/pull/24959)
+- refactor(core): extract and centralize sandbox path utilities by @ehedlund in
+  [#25305](https://github.com/google-gemini/gemini-cli/pull/25305)
+- feat(ui): added enhancements to scroll momentum by @devr0306 in
+  [#24447](https://github.com/google-gemini/gemini-cli/pull/24447)
+- fix(core): replace custom binary detection with isbinaryfile to correctly
+  handle UTF-8 (U+FFFD) by @Anjaligarhwal in
+  [#25297](https://github.com/google-gemini/gemini-cli/pull/25297)
+- feat(agent): implement tool-controlled display protocol (Steps 2-3) by
+  @mbleigh in [#25134](https://github.com/google-gemini/gemini-cli/pull/25134)
+- Stop showing scrollbar unless we are in terminalBuffer mode by @jacob314 in
+  [#25320](https://github.com/google-gemini/gemini-cli/pull/25320)
+- feat: support auth block in MCP servers config in agents by @TanmayVartak in
+  [#24770](https://github.com/google-gemini/gemini-cli/pull/24770)
+- fix(core): expose GEMINI_PLANS_DIR to hook environment by @Adib234 in
+  [#25296](https://github.com/google-gemini/gemini-cli/pull/25296)
+- feat(core): implement silent fallback for Plan Mode model routing by @jerop in
+  [#25317](https://github.com/google-gemini/gemini-cli/pull/25317)
+- fix: correct redirect count increment in fetchJson by @KevinZhao in
+  [#24896](https://github.com/google-gemini/gemini-cli/pull/24896)
+- fix(core): prevent secondary crash in ModelRouterService finally block by
+  @gundermanc in
+  [#25333](https://github.com/google-gemini/gemini-cli/pull/25333)
+- feat(core): introduce decoupled ContextManager and Sidecar architecture by
+  @joshualitt in
+  [#24752](https://github.com/google-gemini/gemini-cli/pull/24752)
+- docs(core): update generalist agent documentation by @abhipatel12 in
+  [#25325](https://github.com/google-gemini/gemini-cli/pull/25325)
+- chore(mcp): check MCP error code over brittle string match by @jackwotherspoon
+  in [#25381](https://github.com/google-gemini/gemini-cli/pull/25381)
+- feat(plan): update plan mode prompt to allow showing plan content by @ruomengz
+  in [#25058](https://github.com/google-gemini/gemini-cli/pull/25058)
+- test(core): improve sandbox integration test coverage and fix OS-specific
+  failures by @ehedlund in
+  [#25307](https://github.com/google-gemini/gemini-cli/pull/25307)
+- fix(core): use debug level for keychain fallback logging by @ehedlund in
+  [#25398](https://github.com/google-gemini/gemini-cli/pull/25398)
+- feat(test): add a performance test in asian language by @cynthialong0-0 in
+  [#25392](https://github.com/google-gemini/gemini-cli/pull/25392)
+- feat(cli): enable mouse clicking for cursor positioning in AskUser multi-line
+  answers by @Adib234 in
+  [#24630](https://github.com/google-gemini/gemini-cli/pull/24630)
+- fix(core): detect kmscon terminal as supporting true color by @claygeo in
+  [#25282](https://github.com/google-gemini/gemini-cli/pull/25282)
+- ci: add agent session drift check workflow by @adamfweidman in
+  [#25389](https://github.com/google-gemini/gemini-cli/pull/25389)
+- use macos-latest-large runner where applicable. by @scidomino in
+  [#25413](https://github.com/google-gemini/gemini-cli/pull/25413)
+- Changelog for v0.37.2 by @gemini-cli-robot in
+  [#25336](https://github.com/google-gemini/gemini-cli/pull/25336)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.42.0-preview.2...v0.43.0-preview.0
+https://github.com/google-gemini/gemini-cli/compare/v0.38.0-preview.0...v0.39.0-preview.0

docs/cli/auto-memory.md

@@ -1,10 +1,9 @@
 # Auto Memory
 
 Auto Memory is an experimental feature that mines your past Gemini CLI sessions
-in the background and proposes durable memory updates and reusable
-[Agent Skills](./skills.md). You review each candidate before it becomes
-available to future sessions: apply memory updates, promote skills, or discard
-anything you do not want.
+in the background and turns recurring workflows into reusable
+[Agent Skills](./skills.md). You review, accept, or discard each extracted skill
+before it becomes available to future sessions.
 
 <!-- prettier-ignore -->
 > [!NOTE]
@@ -13,32 +12,28 @@ anything you do not want.
 ## Overview
 
 Every session you run with Gemini CLI is recorded locally as a transcript. Auto
-Memory scans those transcripts for durable facts, preferences, workflow
-constraints, and procedural patterns that recur across sessions. It can draft
-memory updates as unified diff `.patch` files and draft reusable procedures as
-`SKILL.md` files. All candidates are held in a project-local inbox until you
-approve or discard them.
+Memory scans those transcripts for procedural patterns that recur across
+sessions, then drafts each pattern as a `SKILL.md` file in a project-local
+inbox. You inspect the draft, decide whether it captures real expertise, and
+promote it to your global or workspace skills directory if you want it.
 
 You'll use Auto Memory when you want to:
 
 - **Capture team workflows** that you find yourself walking the agent through
   more than once.
-- **Preserve durable project context** such as repeated verification commands,
-  local constraints, or personal project notes.
 - **Codify hard-won fixes** for project-specific landmines so future sessions
   avoid them.
 - **Bootstrap a skills library** without writing every `SKILL.md` by hand.
 
-Auto Memory complements direct memory-file editing. The agent can still persist
-explicit user instructions by editing the appropriate Markdown memory file; Auto
-Memory infers candidates from past sessions, writes reviewable patches or skill
-drafts, and never applies them without your approval.
+Auto Memory complements—but does not replace—the
+[`save_memory` tool](../tools/memory.md), which captures single facts into
+`GEMINI.md`. Auto Memory captures multi-step procedures into skills.
 
 ## Prerequisites
 
 - Gemini CLI installed and authenticated.
-- At least one idle project session with 10 or more user messages. Auto Memory
-  ignores active, trivial, and sub-agent sessions.
+- At least 10 user messages across recent, idle sessions in the project. Auto
+  Memory ignores active or trivial sessions.
 
 ## How to enable Auto Memory
 
@@ -71,45 +66,36 @@ UI, consume your interactive turns, or surface tool prompts.
     been idle for at least three hours and contain at least 10 user messages.
 2.  **Lock acquisition.** A lock file in the project's memory directory
     coordinates across multiple CLI instances so extraction runs at most once at
-    a time. A state file records processed session versions, and extraction is
-    throttled so short back-to-back CLI launches do not repeatedly scan history.
-3.  **Candidate extraction.** A background extraction agent reviews the session
-    index, reads any sessions that look like they contain durable memory or
-    repeated procedural workflows, and drafts candidates. It defaults to
-    creating no artifacts unless the evidence is strong, so many runs produce no
-    inbox items.
-4.  **Safety boundaries.** Auto Memory writes candidates to a review inbox. It
-    cannot directly edit active memory files, settings, credentials, or project
-    `GEMINI.md` files.
-5.  **Patch validation.** Skill update patches are parsed and dry-run before
-    they are surfaced. Memory patches are parsed, target-allowlisted, and
-    applied atomically only when you approve them from the inbox.
-6.  **Notification.** When a run produces new candidates, Gemini CLI surfaces an
-    inline message telling you how many items are waiting.
+    a time.
+3.  **Sub-agent extraction.** A specialized sub-agent (named `confucius`)
+    reviews the session index, reads any sessions that look like they contain
+    repeated procedural workflows, and drafts new `SKILL.md` files. Its
+    instructions tell it to default to creating zero skills unless the evidence
+    is strong, so most runs produce no inbox items.
+4.  **Patch validation.** If the sub-agent proposes edits to skills outside the
+    inbox (for example, an existing global skill), it writes a unified diff
+    `.patch` file. Auto Memory dry-runs each patch and discards any that do not
+    apply cleanly.
+5.  **Notification.** When a run produces new skills or patches, Gemini CLI
+    surfaces an inline message telling you how many items are waiting.
 
-## How to review extracted items
+## How to review extracted skills
 
 Use the `/memory inbox` slash command to open the inbox dialog at any time:
 
 **Command:** `/memory inbox`
 
-The dialog groups pending items into new skills, skill updates, and memory
-updates. From there you can:
+The dialog lists each draft skill with its name, description, and source
+sessions. From there you can:
 
 - **Read** the full `SKILL.md` body before deciding.
 - **Promote** a skill to your user (`~/.gemini/skills/`) or workspace
   (`.gemini/skills/`) directory.
 - **Discard** a skill you do not want.
 - **Apply** or reject a `.patch` proposal against an existing skill.
-- **Review** memory diffs before they touch active files.
-- **Apply** or dismiss private and global memory patches. Private patches target
-  the project memory directory; global patches target only your personal
-  `~/.gemini/GEMINI.md` file.
 
 Promoted skills become discoverable in the next session and follow the standard
-[skill discovery precedence](./skills.md#skill-discovery-tiers). Applied memory
-patches update the underlying memory files and reload memory for the current
-session.
+[skill discovery precedence](./skills.md#skill-discovery-tiers).
 
 ## How to disable Auto Memory
 
@@ -131,26 +117,19 @@ start. Existing inbox items remain on disk; you can either drain them with
 ## Data and privacy
 
 - Auto Memory only reads session files that already exist locally on your
-  machine.
-- Auto Memory uses model calls to analyze selected local transcript content
-  during extraction. No candidates are applied automatically, but transcript
-  excerpts may be sent to the configured model as part of those calls.
-- The extraction agent is instructed to redact secrets, tokens, and credentials
-  it encounters and to never copy large tool outputs verbatim.
-- Drafted skills and memory patches live in your project's memory directory
-  until you promote, apply, dismiss, or discard them. They are not automatically
-  loaded into any session.
+  machine. Nothing is uploaded to Gemini outside the normal API calls the
+  extraction sub-agent makes during its run.
+- The sub-agent is instructed to redact secrets, tokens, and credentials it
+  encounters and to never copy large tool outputs verbatim.
+- Drafted skills live in your project's memory directory until you promote or
+  discard them. They are not automatically loaded into any session.
 
 ## Limitations
 
-- The extraction agent runs on a preview Gemini Flash model. Extraction quality
-  depends on the model's ability to recognize durable patterns versus one-off
-  incidents.
-- Auto Memory does not extract memory or skills from the current session. It
-  only considers sessions that have been idle for three hours or more.
-- Project or workspace shared instructions in project `GEMINI.md` files are not
-  auto-extractable. Auto Memory can propose private project memory, global
-  personal memory, and skills.
+- The sub-agent runs on a preview Gemini Flash model. Extraction quality depends
+  on the model's ability to recognize durable patterns versus one-off incidents.
+- Auto Memory does not extract skills from the current session. It only
+  considers sessions that have been idle for three hours or more.
 - Inbox items are stored per project. Skills extracted in one workspace are not
   visible from another until you promote them to the user-scope skills
   directory.
@@ -159,6 +138,6 @@ start. Existing inbox items remain on disk; you can either drain them with
 
 - Learn how skills are discovered and activated in [Agent Skills](./skills.md).
 - Explore the [memory management tutorial](./tutorials/memory-management.md) for
-  the complementary explicit-memory and `GEMINI.md` workflows.
+  the complementary `save_memory` and `GEMINI.md` workflows.
 - Review the experimental settings catalog in
   [Settings](./settings.md#experimental).

docs/cli/cli-reference.md

@@ -9,7 +9,7 @@ and parameters.
 | ---------------------------------- | ---------------------------------- | ------------------------------------------------------------ |
 | `gemini`                           | Start interactive REPL             | `gemini`                                                     |
 | `gemini -p "query"`                | Query non-interactively            | `gemini -p "summarize README.md"`                            |
-| gemini "query"                     | Query and continue interactively   | gemini "explain this project"                                |
+| `gemini "query"`                   | Query and continue interactively   | `gemini "explain this project"`                              |
 | `cat file \| gemini`               | Process piped content              | `cat logs.txt \| gemini`<br>`Get-Content logs.txt \| gemini` |
 | `gemini -i "query"`                | Execute and continue interactively | `gemini -i "What is the purpose of this project?"`           |
 | `gemini -r "latest"`               | Continue most recent session       | `gemini -r "latest"`                                         |
@@ -33,7 +33,6 @@ These commands are available within the interactive REPL.
 | -------------------- | ----------------------------------------------- |
 | `/skills reload`     | Reload discovered skills from disk              |
 | `/agents reload`     | Reload the agent registry                       |
-| `/commands list`     | List available custom slash commands            |
 | `/commands reload`   | Reload custom slash commands                    |
 | `/memory reload`     | Reload context files (for example, `GEMINI.md`) |
 | `/mcp reload`        | Restart and reload MCP servers                  |
@@ -53,7 +52,6 @@ These commands are available within the interactive REPL.
 | `--prompt-interactive`           | `-i`  | string  | -         | Execute prompt and continue in interactive mode                                                                                                                        |
 | `--worktree`                     | `-w`  | string  | -         | Start Gemini in a new git worktree. If no name is provided, one is generated automatically. Requires `experimental.worktrees: true` in settings.                       |
 | `--sandbox`                      | `-s`  | boolean | `false`   | Run in a sandboxed environment for safer execution                                                                                                                     |
-| `--skip-trust`                   | -     | boolean | `false`   | Trust the current workspace for this session, skipping the folder trust check.                                                                                         |
 | `--approval-mode`                | -     | string  | `default` | Approval mode for tool execution. Choices: `default`, `auto_edit`, `yolo`, `plan`                                                                                      |
 | `--yolo`                         | `-y`  | boolean | `false`   | **Deprecated.** Auto-approve all actions. Use `--approval-mode=yolo` instead.                                                                                          |
 | `--experimental-acp`             | -     | boolean | -         | Start in ACP (Agent Code Pilot) mode. **Experimental feature.**                                                                                                        |

docs/cli/creating-skills.md

@@ -1,21 +1,18 @@
 # Creating Agent Skills
 
-Agent Skills let you extend Gemini CLI with specialized expertise, procedural
-workflows, and task-specific resources. This guide walks you through both
-automated and manual methods for creating and organizing your skills.
+This guide provides an overview of how to create your own Agent Skills to extend
+the capabilities of Gemini CLI.
 
-## Quickstart: Create a skill with a prompt
+## Getting started: The `skill-creator` skill
 
-The fastest way to create a new skill is to use the built-in `skill-creator`.
-This meta-skill guides you through designing, scaffolding, and validating your
-expertise.
+The recommended way to create a new skill is to use the built-in `skill-creator`
+skill. To use it, ask Gemini CLI to create a new skill for you.
 
-Simply ask Gemini CLI to create a skill for you:
+**Example prompt:**
 
-> "Create a new skill called 'code-reviewer' that analyzes local files for
-> common errors and style violations."
+> "create a new skill called 'code-reviewer'"
 
-Gemini will then:
+Gemini CLI will then use the `skill-creator` to generate the skill:
 
 1.  Generate a new directory for your skill (for example, `my-new-skill/`).
 2.  Create a `SKILL.md` file with the necessary YAML frontmatter (`name` and
@@ -23,116 +20,24 @@ Gemini will then:
 3.  Create the standard resource directories: `scripts/`, `references/`, and
     `assets/`.
 
-Once created, you can find your new skill in `.gemini/skills/code-reviewer/`.
+## Manual skill creation
 
-## Manual creation
+If you prefer to create skills manually:
 
 1.  **Create a directory** for your skill (for example, `my-new-skill/`).
 2.  **Create a `SKILL.md` file** inside the new directory.
 
-### 1. Create the directory structure
+To add additional resources that support the skill, refer to the skill
+structure.
 
-The first step is to create the necessary folders for your skill and its
-scripts.
+## Skill structure
 
-**macOS/Linux**
+A skill is a directory containing a `SKILL.md` file at its root.
 
-```bash
-mkdir -p .gemini/skills/code-reviewer/scripts
-```
-
-**Windows (PowerShell)**
-
-```powershell
-New-Item -ItemType Directory -Force -Path ".gemini\skills\code-reviewer\scripts"
-```
-
-### 2. Define the skill (`SKILL.md`)
-
-The `SKILL.md` file defines the skill's purpose and instructions for the agent.
-Create a file at `.gemini/skills/code-reviewer/SKILL.md`.
-
-```markdown
----
-name: code-reviewer
-description:
-  Expertise in reviewing code changes for correctness, security, and style. Use
-  when the user asks to "review" their code or a PR.
----
-
-# Code Reviewer Instructions
-
-You act as a senior software engineer specialized in code quality. When this
-skill is active, you MUST:
-
-1.  **Analyze**: Review the provided code for logical errors, security
-    vulnerabilities, and style violations.
-2.  **Review**: Use the bundled `scripts/review.js` utility to perform an
-    automated check.
-3.  **Feedback**: Provide constructive feedback, clearly distinguishing between
-    critical issues and minor improvements.
-```
-
-### 3. Add the tool logic
-
-Skills can bundle resources like scripts to perform deterministic tasks. Create
-a file at `.gemini/skills/code-reviewer/scripts/review.js`.
-
-```javascript
-// .gemini/skills/code-reviewer/scripts/review.js
-const file = process.argv[2];
-
-if (!file) {
-  console.error('Usage: node review.js <file>');
-  process.exit(1);
-}
-
-console.log(`Reviewing ${file}...`);
-// Simple mock review logic
-setTimeout(() => {
-  console.log(`Result: Success (No major issues found in ${file})`);
-}, 500);
-```
-
-### 4. Test the skill
-
-Gemini CLI automatically discovers skills in the `.gemini/skills` directory.
-
-1.  Start a new session and ask a question that triggers the skill's
-    description: "Can you review index.js"
-2.  Gemini identifies the request matches the `code-reviewer` description and
-    asks for permission to activate it.
-3.  Once you approve, Gemini executes the bundled script:
-    `node .gemini/skills/code-reviewer/scripts/review.js index.js`
-
-To determine whether your skill has been correctly loaded, run the command:
-
-```bash
-/skills
-```
-
-### 5. Optional: Share your skill
-
-You can share your skills in several ways depending on your target audience.
-
-- **Workspace skills**: Commit your skill to a `.gemini/skills/` directory in
-  your project repository.
-- **Extensions**: Bundle your skill within a
-  [Gemini CLI extension](../extensions/writing-extensions.md).
-- **Git repositories**: Share the skill directory as a standalone Git repo and
-  install it using `gemini skills install <url>`.
-
----
-
-## Core concepts
-
-Now that you've built your first skill, let's explore the core components and
-workflows for developing more complex expertise.
-
-### Skill structure
+### Folder structure
 
 While a `SKILL.md` file is the only required component, we recommend the
-following structure for organizing your skill's resources.
+following structure for organizing your skill's resources:
 
 ```text
 my-skill/
@@ -142,66 +47,34 @@ my-skill/
 └── assets/        (Optional) Templates and other resources
 ```
 
-When a skill is activated, the model is granted access to this entire directory.
-You can instruct the model to use the tools and files found within these
-folders.
+### `SKILL.md` file
 
-### Metadata and triggers
+The `SKILL.md` file is the core of your skill. This file uses YAML frontmatter
+for metadata and Markdown for instructions. For example:
 
-The `SKILL.md` file uses YAML frontmatter for metadata.
+```markdown
+---
+name: code-reviewer
+description:
+  Use this skill to review code. It supports both local changes and remote Pull
+  Requests.
+---
+
+# Code Reviewer
+
+This skill guides the agent in conducting thorough code reviews.
+
+## Workflow
+
+### 1. Determine Review Target
+
+- **Remote PR**: If the user gives a PR number or URL, target that remote PR.
+- **Local Changes**: If changes are local... ...
+```
 
 - **`name`**: A unique identifier for the skill. This should match the directory
   name.
-- **`description`**: **CRITICAL.** This is how Gemini decides when to use the
-  skill. Be specific about the tasks it handles and the keywords that should
-  trigger it.
-
-### Discovery tiers
-
-Gemini CLI discovers skills from several locations, following a specific order
-of precedence (lowest to highest):
-
-1.  **Built-in Skills**: Included with Gemini CLI (pre-approved).
-2.  **Extension Skills**: Bundled within [extensions](../extensions/).
-3.  **User Skills**: `~/.gemini/skills/` or the `~/.agents/skills/` alias.
-4.  **Workspace Skills**: `.gemini/skills/` or the `.agents/skills/` alias.
-
-### Discovery aliases
-
-You can use `.agents/skills` as an alternative to `.gemini/skills`. This alias
-is compatible with other AI agent tools following the
-[Agent Skills](https://agentskills.io) standard.
-
-## Advanced development
-
-Once you've built a basic skill, you can use specialized scripts and workflows
-to streamline your development process.
-
-### Creation scripts
-
-If you are developing a skill and want to use the same scripts the built-in
-tools use, you can find them in the core package. These scripts help automate
-the initialization, validation, and packaging of skills.
-
-- **Initialize**: `node scripts/init_skill.cjs <name> --path <dir>`
-- **Validate**: `node scripts/validate_skill.cjs <path/to/skill>`
-- **Package**: `node scripts/package_skill.cjs <path/to/skill>` (Creates a
-  `.skill` zip file)
-
-### Linking for local development
-
-If you are developing a skill in a separate directory, you can link it to your
-user skills directory for testing:
-
-```bash
-gemini skills link .
-```
-
-## Next steps
-
-- [Skill best practices](./skills-best-practices.md): Learn strategies for
-  building reliable and effective skills.
-- [Agent Skills overview](./skills.md): Deep dive into discovery tiers and the
-  skill lifecycle.
-- [Get started with Agent Skills](./tutorials/skills-getting-started.md): A
-  quick walkthrough of triggering and using skills.
+- **`description`**: A description of what the skill does and when Gemini should
+  use it.
+- **Body**: The Markdown body of the file contains the instructions that guide
+  the agent's behavior when the skill is active.

docs/cli/custom-commands.md

@@ -34,7 +34,6 @@ separator (`/` or `\`) being converted to a colon (`:`).
 > [!TIP]
 > After creating or modifying `.toml` command files, run
 > `/commands reload` to pick up your changes without restarting the CLI.
-> To see all available command files, run `/commands list`.
 
 ## TOML file format (v1)
 

docs/cli/gemini-md.md

@@ -65,6 +65,8 @@ You can interact with the loaded context files by using the `/memory` command.
   being provided to the model.
 - **`/memory reload`**: Forces a re-scan and reload of all `GEMINI.md` files
   from all configured locations.
+- **`/memory add <text>`**: Appends your text to your global
+  `~/.gemini/GEMINI.md` file. This lets you add persistent memories on the fly.
 
 ## Modularize context with imports
 

docs/cli/model-routing.md

@@ -34,11 +34,11 @@ Gemini CLI will use a locally-running **Gemma** model to make routing decisions
 reduce costs associated with hosted model usage while offering similar routing
 decision latency and quality.
 
-The easiest way to set this up is using the automated `gemini gemma setup`
-command.
+In order to use this feature, the local Gemma model **must** be served behind a
+Gemini API and accessible via HTTP at an endpoint configured in `settings.json`.
 
 For more details on how to configure local model routing, see
-[`gemini gemma` — Local Model Routing Setup](../core/gemma-setup.md).
+[Local Model Routing](../core/local-model-routing.md).
 
 ### Model selection precedence
 

docs/cli/plan-mode.md

@@ -138,6 +138,7 @@ These are the only allowed tools:
   [`replace`](../tools/file-system.md#6-replace-edit) only allowed for `.md`
   files in the `~/.gemini/tmp/<project>/<session-id>/plans/` directory or your
   [custom plans directory](#custom-plan-directory-and-policies).
+- **Memory:** [`save_memory`](../tools/memory.md)
 - **Skills:** [`activate_skill`](../cli/skills.md) (allows loading specialized
   instructions and resources in a read-only manner)
 
@@ -469,8 +470,7 @@ associated plan files and task trackers.
 
 - **Default behavior:** Sessions (and their plans) are retained for **30 days**.
 - **Configuration:** You can customize this behavior via the `/settings` command
-  (search for **Enable Session Cleanup** or **Keep chat history**) or in your
-  `settings.json` file. See
+  (search for **Session Retention**) or in your `settings.json` file. See
   [session retention](../cli/session-management.md#session-retention) for more
   details.
 

docs/cli/sandbox.md

@@ -31,53 +31,6 @@ The benefits of sandboxing include:
 - **Safety**: Reduce risk when working with untrusted code or experimental
   commands.
 
-## Quickstart
-
-You can enable sandboxing using a command flag, environment variable, or
-configuration file.
-
-### Using the command flag
-
-```bash
-gemini -s -p "analyze the code structure"
-```
-
-### Using an environment variable
-
-**macOS/Linux**
-
-```bash
-export GEMINI_SANDBOX=true
-gemini -p "run the test suite"
-```
-
-**Windows (PowerShell)**
-
-```powershell
-$env:GEMINI_SANDBOX="true"
-gemini -p "run the test suite"
-```
-
-### Configuring via settings.json
-
-```json
-{
-  "tools": {
-    "sandbox": "docker"
-  }
-}
-```
-
-## Configuration
-
-Enable sandboxing using one of the following methods (in order of precedence):
-
-1. **Command flag**: `-s` or `--sandbox`
-2. **Environment variable**:
-   `GEMINI_SANDBOX=true|docker|podman|sandbox-exec|runsc|lxc`
-3. **Settings file**: `"sandbox": true` in the `tools` object of your
-   `settings.json` file (for example, `{"tools": {"sandbox": true}}`).
-
 ## Sandboxing methods
 
 Your ideal method of sandboxing may differ depending on your platform and your
@@ -90,92 +43,12 @@ Lightweight, built-in sandboxing using `sandbox-exec`.
 **Default profile**: `permissive-open` - restricts writes outside project
 directory but allows most other operations.
 
-Built-in profiles (set via `SEATBELT_PROFILE` env var):
-
-- `permissive-open` (default): Write restrictions, network allowed
-- `permissive-proxied`: Write restrictions, network via proxy
-- `restrictive-open`: Strict restrictions, network allowed
-- `restrictive-proxied`: Strict restrictions, network via proxy
-- `strict-open`: Read and write restrictions, network allowed
-- `strict-proxied`: Read and write restrictions, network via proxy
-
 ### 2. Container-based (Docker/Podman)
 
-Cross-platform sandboxing with complete process isolation using container
-technology. By default, it uses the `ghcr.io/google/gemini-cli:latest` image.
+Cross-platform sandboxing with complete process isolation.
 
-**Prerequisites:**
-
-- Docker or Podman must be installed and running on your system.
-
-**How it works (Workspace directory):**
-
-Inside the sandbox container, your current working directory is mounted at the
-**exact same absolute path** as it is on your host machine. For example, if you
-run the CLI from `/Users/you/project` on your host machine, the sandbox will
-mount your local project folder and operate within `/Users/you/project` inside
-the container. This allows the AI to seamlessly read and modify your project
-files while remaining isolated from the rest of your system.
-
-**Quick setup:**
-
-To enable Docker sandboxing, run Gemini CLI with the sandbox flag and specify
-Docker as the provider:
-
-```bash
-# Using the environment variable (Recommended)
-export GEMINI_SANDBOX=docker
-gemini -p "build the project"
-
-# Or configure it permanently in your settings.json
-# {"tools": {"sandbox": "docker"}}
-```
-
-**Customizing the Sandbox Image:**
-
-If your project requires specific dependencies, you can specify a custom image
-name or have Gemini CLI build one for you automatically. You can use any Docker
-or Podman image as your sandbox, provided it has standard shell utilities (like
-`bash`) available.
-
-**Option A: Using an existing custom image (e.g., Artifact Registry)**
-
-To configure a custom image that is hosted on a registry (or built locally),
-update your `settings.json` to use an object for the sandbox configuration, or
-set the `GEMINI_SANDBOX_IMAGE` environment variable.
-
-_Example: Configuring via `settings.json`_
-
-```json
-{
-  "tools": {
-    "sandbox": {
-      "command": "docker",
-      "image": "us-central1-docker.pkg.dev/my-project/my-repo/my-custom-sandbox:latest"
-    }
-  }
-}
-```
-
-_Example: Configuring via environment variable_
-
-```bash
-export GEMINI_SANDBOX_IMAGE="us-central1-docker.pkg.dev/my-project/my-repo/my-custom-sandbox:latest"
-```
-
-**Option B: Building a local custom image automatically**
-
-If you prefer to define your environment as code, you can provide a Dockerfile
-and Gemini CLI will build the image automatically.
-
-1.  Create a `.gemini/sandbox.Dockerfile` in your project root.
-2.  Ensure you have the `gh` CLI installed and authenticated (if you are using
-    the default `ghcr.io/google/gemini-cli` image as a base).
-3.  Run your command with the `BUILD_SANDBOX` environment variable set:
-
-```bash
-BUILD_SANDBOX=1 GEMINI_SANDBOX=docker gemini -p "run my custom build"
-```
+**Note**: Requires building the sandbox image locally or using a published image
+from your organization's registry.
 
 ### 3. Windows Native Sandbox (Windows only)
 
@@ -315,49 +188,59 @@ This mechanism ensures you don't have to manually re-run commands with more
 permissive sandbox settings, while still maintaining control over what the AI
 can access.
 
-### Including files outside the workspace
-
-By default, the sandbox only has access to the current project workspace. If you
-need the sandbox to have permission to operate on certain files or directories
-from the local file system outside of the project workspace, you can mount them
-using the `SANDBOX_MOUNTS` environment variable.
-
-Provide a comma-separated list of mount definitions in the format
-`from:to:opts`. If `to` is omitted, it defaults to the same path as `from`. If
-`opts` is omitted, it defaults to `ro` (read-only). Note that the `from` path
-must be an absolute path.
-
-**Example**:
+## Quickstart
 
 ```bash
-export SANDBOX_MOUNTS="/path/on/host:/path/in/container:rw,/another/path:ro"
+# Enable sandboxing with command flag
+gemini -s -p "analyze the code structure"
 ```
 
-## Running inside a Docker container
+**Use environment variable**
 
-If you are running Gemini CLI itself from within an official or custom Docker
-container and want to enable sandboxing, you must share the host's Docker socket
-and ensure your workspace paths align.
-
-1.  **Mount the Docker socket**: Map `/var/run/docker.sock` so the CLI can spawn
-    sibling sandbox containers via the host's Docker daemon.
-2.  **Align workspace paths**: The path to your workspace inside the container
-    must exactly match the absolute path on the host. Because the sandbox
-    container is spawned by the host's Docker daemon, it resolves volume mounts
-    against the host file system.
-
-**Example**:
+**macOS/Linux**
 
 ```bash
-docker run -it \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v /absolute/path/on/host/project:/absolute/path/on/host/project \
-  -w /absolute/path/on/host/project \
-  -e GEMINI_SANDBOX=docker \
-  ghcr.io/google/gemini-cli:latest
+export GEMINI_SANDBOX=true
+gemini -p "run the test suite"
 ```
 
-## Advanced settings
+**Windows (PowerShell)**
+
+```powershell
+$env:GEMINI_SANDBOX="true"
+gemini -p "run the test suite"
+```
+
+**Configure in settings.json**
+
+```json
+{
+  "tools": {
+    "sandbox": "docker"
+  }
+}
+```
+
+## Configuration
+
+### Enable sandboxing (in order of precedence)
+
+1. **Command flag**: `-s` or `--sandbox`
+2. **Environment variable**:
+   `GEMINI_SANDBOX=true|docker|podman|sandbox-exec|runsc|lxc`
+3. **Settings file**: `"sandbox": true` in the `tools` object of your
+   `settings.json` file (for example, `{"tools": {"sandbox": true}}`).
+
+### macOS Seatbelt profiles
+
+Built-in profiles (set via `SEATBELT_PROFILE` env var):
+
+- `permissive-open` (default): Write restrictions, network allowed
+- `permissive-proxied`: Write restrictions, network via proxy
+- `restrictive-open`: Strict restrictions, network allowed
+- `restrictive-proxied`: Strict restrictions, network via proxy
+- `strict-open`: Read and write restrictions, network allowed
+- `strict-proxied`: Read and write restrictions, network via proxy
 
 ### Custom sandbox flags
 
@@ -396,7 +279,7 @@ export SANDBOX_FLAGS="--flag1 --flag2=value"
 $env:SANDBOX_FLAGS="--flag1 --flag2=value"
 ```
 
-### Linux UID/GID handling
+## Linux UID/GID handling
 
 The sandbox automatically handles user permissions on Linux. Override these
 permissions with:

docs/cli/settings.md

@@ -40,7 +40,6 @@ they appear in the UI.
 | Enable Session Cleanup        | `general.sessionRetention.enabled` | Enable automatic session cleanup                                                                                                                                                                                                                              | `true`      |
 | Keep chat history             | `general.sessionRetention.maxAge`  | Automatically delete chats older than this time period (e.g., "30d", "7d", "24h", "1w")                                                                                                                                                                       | `"30d"`     |
 | Topic & Update Narration      | `general.topicUpdateNarration`     | Enable the Topic & Update communication model for reduced chattiness and structured progress reporting.                                                                                                                                                       | `true`      |
-| Log RAG Snippets              | `general.logRagSnippets`           | Log full Code Customization (RAG) retrieved snippets to a local file for debugging.                                                                                                                                                                           | `false`     |
 
 ### Output
 
@@ -159,28 +158,22 @@ they appear in the UI.
 | UI Label                          | Setting                        | Description                                                                                                                                                                                                           | Default |
 | --------------------------------- | ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
 | Auto Configure Max Old Space Size | `advanced.autoConfigureMemory` | Automatically configure Node.js memory limits. Note: Because memory is allocated during the initial process boot, this setting is only read from the global user settings file and ignores workspace-level overrides. | `true`  |
-| Ignore Local .env                 | `advanced.ignoreLocalEnv`      | Whether to ignore generic .env files in the project directory.                                                                                                                                                        | `false` |
 
 ### Experimental
 
-| UI Label                                             | Setting                                         | Description                                                                                                                                                                                                                                                            | Default              |
-| ---------------------------------------------------- | ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
-| Gemma Models                                         | `experimental.gemma`                            | Enable access to Gemma 4 models via Gemini API.                                                                                                                                                                                                                        | `true`               |
-| Voice Mode                                           | `experimental.voiceMode`                        | Enable experimental voice dictation and commands (/voice, /voice model).                                                                                                                                                                                               | `false`              |
-| Voice Activation Mode                                | `experimental.voice.activationMode`             | How to trigger voice recording with the Space key.                                                                                                                                                                                                                     | `"push-to-talk"`     |
-| Voice Transcription Backend                          | `experimental.voice.backend`                    | The backend to use for voice transcription. Note: When using the Gemini Live backend, voice recordings are sent to Google Cloud for transcription.                                                                                                                     | `"gemini-live"`      |
-| Whisper Model                                        | `experimental.voice.whisperModel`               | The Whisper model to use for local transcription.                                                                                                                                                                                                                      | `"ggml-base.en.bin"` |
-| Voice Stop Grace Period (ms)                         | `experimental.voice.stopGracePeriodMs`          | How long to wait for final transcription after stopping recording.                                                                                                                                                                                                     | `4000`               |
-| Enable Git Worktrees                                 | `experimental.worktrees`                        | Enable automated Git worktree management for parallel work.                                                                                                                                                                                                            | `false`              |
-| Use OSC 52 Paste                                     | `experimental.useOSC52Paste`                    | Use OSC 52 for pasting. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it).                                                                                                              | `false`              |
-| Use OSC 52 Copy                                      | `experimental.useOSC52Copy`                     | Use OSC 52 for copying. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it).                                                                                                              | `false`              |
-| Model Steering                                       | `experimental.modelSteering`                    | Enable model steering (user hints) to guide the model during tool execution.                                                                                                                                                                                           | `false`              |
-| Direct Web Fetch                                     | `experimental.directWebFetch`                   | Enable web fetch behavior that bypasses LLM summarization.                                                                                                                                                                                                             | `false`              |
-| Enable Gemma Model Router                            | `experimental.gemmaModelRouter.enabled`         | Enable the Gemma Model Router (experimental). Requires a local endpoint serving Gemma via the Gemini API using LiteRT-LM shim.                                                                                                                                         | `false`              |
-| Auto-start LiteRT Server                             | `experimental.gemmaModelRouter.autoStartServer` | Automatically start the LiteRT-LM server when Gemini CLI starts and the Gemma router is enabled.                                                                                                                                                                       | `false`              |
-| Auto Memory                                          | `experimental.autoMemory`                       | Automatically extract memory patches and skills from past sessions in the background. Every change is written as a unified diff `.patch` file under `<projectMemoryDir>/.inbox/<kind>/` and held for review in /memory inbox; nothing is applied until you approve it. | `false`              |
-| Use the generalist profile to manage agent contexts. | `experimental.generalistProfile`                | Suitable for general coding and software development tasks.                                                                                                                                                                                                            | `false`              |
-| Enable Context Management                            | `experimental.contextManagement`                | Enable logic for context management.                                                                                                                                                                                                                                   | `false`              |
+| UI Label                                             | Setting                                         | Description                                                                                                                                               | Default |
+| ---------------------------------------------------- | ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| Enable Git Worktrees                                 | `experimental.worktrees`                        | Enable automated Git worktree management for parallel work.                                                                                               | `false` |
+| Use OSC 52 Paste                                     | `experimental.useOSC52Paste`                    | Use OSC 52 for pasting. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it). | `false` |
+| Use OSC 52 Copy                                      | `experimental.useOSC52Copy`                     | Use OSC 52 for copying. This may be more robust than the default system when using remote terminal sessions (if your terminal is configured to allow it). | `false` |
+| Model Steering                                       | `experimental.modelSteering`                    | Enable model steering (user hints) to guide the model during tool execution.                                                                              | `false` |
+| Direct Web Fetch                                     | `experimental.directWebFetch`                   | Enable web fetch behavior that bypasses LLM summarization.                                                                                                | `false` |
+| Enable Gemma Model Router                            | `experimental.gemmaModelRouter.enabled`         | Enable the Gemma Model Router (experimental). Requires a local endpoint serving Gemma via the Gemini API using LiteRT-LM shim.                            | `false` |
+| Auto-start LiteRT Server                             | `experimental.gemmaModelRouter.autoStartServer` | Automatically start the LiteRT-LM server when Gemini CLI starts and the Gemma router is enabled.                                                          | `false` |
+| Memory Manager Agent                                 | `experimental.memoryManager`                    | Replace the built-in save_memory tool with a memory manager subagent that supports adding, removing, de-duplicating, and organizing memories.             | `false` |
+| Auto Memory                                          | `experimental.autoMemory`                       | Automatically extract reusable skills from past sessions in the background. Review results with /memory inbox.                                            | `false` |
+| Use the generalist profile to manage agent contexts. | `experimental.generalistProfile`                | Suitable for general coding and software development tasks.                                                                                               | `false` |
+| Enable Context Management                            | `experimental.contextManagement`                | Enable logic for context management.                                                                                                                      | `false` |
 
 ### Skills
 

docs/cli/skills-best-practices.md

@@ -1,78 +0,0 @@
-# Agent Skill best practices
-
-Create high-quality, reliable Agent Skills by following these established design
-principles and patterns.
-
-## Design for discovery
-
-The most important part of a skill is its `description`. This is the only
-information the model has before activation.
-
-- **Be specific**: Use keywords that are likely to appear in user prompts (for
-  example, "audit," "security," "refactor," "migration").
-- **Define the trigger**: Clearly state _when_ the skill should be used (for
-  example, "Use this skill when the user asks to review a PR for performance
-  regressions").
-- **Avoid overlap**: Ensure your skill descriptions are distinct from one
-  another and from the general capabilities of the model.
-
-## Progressive disclosure
-
-The "context window" is a shared resource. Use a three-level loading system to
-manage context efficiently.
-
-1.  **Metadata (name + description)**: Always in context (~100 words).
-2.  **`SKILL.md` body**: Loaded only after the skill triggers (<5k words).
-3.  **Bundled resources**: Loaded only as needed by the model.
-
-**Best practice**: Keep the `SKILL.md` body focused on core procedural
-instructions. Move detailed reference material, schemas, and examples into
-separate files in a `references/` directory.
-
-## Degrees of freedom
-
-Match the level of instruction specificity to the task's fragility.
-
-- **High freedom (text-based instructions)**: Use when multiple approaches are
-  valid or decisions depend heavily on context.
-- **Medium freedom (pseudocode or scripts with parameters)**: Use when a
-  preferred pattern exists but some variation is acceptable.
-- **Low freedom (specific scripts, few parameters)**: Use when operations are
-  fragile and error-prone, or a specific sequence MUST be followed.
-
-## Bundle resources effectively
-
-Leverage the skill's ability to include scripts and assets to extend the agent's
-capabilities.
-
-- **Use scripts for deterministic tasks**: If a task can be automated with a
-  script (for example, running a linter, fetching data from an API), bundle it
-  in the `scripts/` folder.
-- **Agentic ergonomics**: Ensure scripts output LLM-friendly stdout. Suppress
-  verbose tracebacks and provide clear, concise success/failure messages.
-- **Provide templates**: Include common file headers or boilerplate code in the
-  `assets/` folder to ensure the agent produces consistent output.
-
-## Anatomy of a great skill
-
-A well-structured skill directory organizes its resources into specialized
-sub-folders.
-
-```text
-my-skill/
-├── SKILL.md       (Required) Core instructions and metadata
-├── scripts/       (Optional) Executable logic (Node.js, Python, etc.)
-├── references/    (Optional) Documentation to be loaded as needed
-└── assets/        (Optional) Templates and non-executable resources
-```
-
-## Security and privacy
-
-Design your skills with security in mind to protect your workspace and data.
-
-- **Avoid hardcoded secrets**: Never include API keys or passwords in your
-  skill's scripts or documentation.
-- **Review third-party skills**: Inspect the `SKILL.md` and scripts of any skill
-  before installing it from an untrusted source.
-- **Limit scope**: Design skills to be as focused as possible to minimize the
-  potential impact of errors.

docs/cli/skills.md

@@ -1,21 +1,112 @@
 # Agent Skills
 
-Agent Skills let you extend Gemini CLI with specialized expertise, procedural
-workflows, and task-specific resources. Based on the
+Agent Skills allow you to extend Gemini CLI with specialized expertise,
+procedural workflows, and task-specific resources. Based on the
 [Agent Skills](https://agentskills.io) open standard, a "skill" is a
 self-contained directory that packages instructions and assets into a
 discoverable capability.
 
-Unlike general context files ([GEMINI.md](./gemini-md.md)), which provide
+## Overview
+
+Unlike general context files ([`GEMINI.md`](./gemini-md.md)), which provide
 persistent workspace-wide background, Skills represent **on-demand expertise**.
-This lets Gemini CLI maintain a vast library of specialized capabilities—such as
-security auditing, cloud deployments, or codebase migrations—without cluttering
-the model's immediate context window.
+This allows Gemini to maintain a vast library of specialized capabilities—such
+as security auditing, cloud deployments, or codebase migrations—without
+cluttering the model's immediate context window.
 
-## How it works
+Gemini autonomously decides when to employ a skill based on your request and the
+skill's description. When a relevant skill is identified, the model "pulls in"
+the full instructions and resources required to complete the task using the
+`activate_skill` tool.
 
-The lifecycle of an Agent Skill involves discovery, activation, and conditional
-resource access.
+## Key Benefits
+
+- **Shared Expertise:** Package complex workflows (like a specific team's PR
+  review process) into a folder that anyone can use.
+- **Repeatable Workflows:** Ensure complex multi-step tasks are performed
+  consistently by providing a procedural framework.
+- **Resource Bundling:** Include scripts, templates, or example data alongside
+  instructions so the agent has everything it needs.
+- **Progressive Disclosure:** Only skill metadata (name and description) is
+  loaded initially. Detailed instructions and resources are only disclosed when
+  the model explicitly activates the skill, saving context tokens.
+
+## Skill Discovery Tiers
+
+Gemini CLI discovers skills from three primary locations:
+
+1.  **Workspace Skills**: Located in `.gemini/skills/` or the `.agents/skills/`
+    alias. Workspace skills are typically committed to version control and
+    shared with the team.
+2.  **User Skills**: Located in `~/.gemini/skills/` or the `~/.agents/skills/`
+    alias. These are personal skills available across all your workspaces.
+3.  **Extension Skills**: Skills bundled within installed
+    [extensions](../extensions/index.md).
+
+**Precedence:** If multiple skills share the same name, higher-precedence
+locations override lower ones: **Workspace > User > Extension**.
+
+Within the same tier (user or workspace), the `.agents/skills/` alias takes
+precedence over the `.gemini/skills/` directory. This generic alias provides an
+intuitive path for managing agent-specific expertise that remains compatible
+across different AI agent tools.
+
+## Managing Skills
+
+### In an Interactive Session
+
+Use the `/skills` slash command to view and manage available expertise:
+
+- `/skills list` (default): Shows all discovered skills and their status.
+- `/skills link <path>`: Links agent skills from a local directory via symlink.
+- `/skills disable <name>`: Prevents a specific skill from being used.
+- `/skills enable <name>`: Re-enables a disabled skill.
+- `/skills reload`: Refreshes the list of discovered skills from all tiers.
+
+<!-- prettier-ignore -->
+> [!NOTE]
+> `/skills disable` and `/skills enable` default to the `user` scope. Use
+> `--scope workspace` to manage workspace-specific settings.
+
+### From the Terminal
+
+The `gemini skills` command provides management utilities:
+
+```bash
+# List all discovered skills
+gemini skills list
+
+# Link agent skills from a local directory via symlink
+# Discovers skills (SKILL.md or */SKILL.md) and creates symlinks in ~/.gemini/skills
+# (or ~/.agents/skills)
+gemini skills link /path/to/my-skills-repo
+
+# Link to the workspace scope (.gemini/skills or .agents/skills)
+gemini skills link /path/to/my-skills-repo --scope workspace
+
+# Install a skill from a Git repository, local directory, or zipped skill file (.skill)
+# Uses the user scope by default (~/.gemini/skills or ~/.agents/skills)
+gemini skills install https://github.com/user/repo.git
+gemini skills install /path/to/local/skill
+gemini skills install /path/to/local/my-expertise.skill
+
+# Install a specific skill from a monorepo or subdirectory using --path
+gemini skills install https://github.com/my-org/my-skills.git --path skills/frontend-design
+
+# Install to the workspace scope (.gemini/skills or .agents/skills)
+gemini skills install /path/to/skill --scope workspace
+
+# Uninstall a skill by name
+gemini skills uninstall my-expertise --scope workspace
+
+# Enable a skill (globally)
+gemini skills enable my-expertise
+
+# Disable a skill. Can use --scope to specify workspace or user (defaults to workspace)
+gemini skills disable my-expertise --scope workspace
+```
+
+## How it Works
 
 1.  **Discovery**: At the start of a session, Gemini CLI scans the discovery
     tiers and injects the name and description of all enabled skills into the
@@ -32,110 +123,14 @@ resource access.
 5.  **Execution**: The model proceeds with the specialized expertise active. It
     is instructed to prioritize the skill's procedural guidance within reason.
 
-## Discovery tiers
+### Skill activation
 
-Gemini CLI discovers skills from several locations, following a specific order
-of precedence (lowest to highest):
+Once a skill is activated (typically by Gemini identifying a task that matches
+the skill's description and your approval), its specialized instructions and
+resources are loaded into the agent's context. A skill remains active and its
+guidance is prioritized for the duration of the session.
 
-1.  **Built-in skills**: Standard skills included with Gemini CLI that provide
-    foundational capabilities.
-2.  **Extension skills**: Skills bundled within installed
-    [extensions](../extensions/index.md).
-3.  **User skills**: Located in `~/.gemini/skills/` or the `~/.agents/skills/`
-    alias.
-4.  **Workspace skills**: Located in `.gemini/skills/` or the `.agents/skills/`
-    alias. Workspace skills are shared with your team via version control.
+## Creating your own skills
 
-### Precedence and aliases
-
-If multiple skills share the same name, the version from the higher-precedence
-location is used. Within the same tier (user or workspace), the
-`.agents/skills/` alias takes precedence over the `.gemini/skills/` directory.
-
-The `.agents/skills/` alias provides an interoperable path for managing
-agent-specific expertise that remains compatible across different AI tools.
-
-## Key benefits
-
-Agent Skills provide several advantages for managing specialized knowledge and
-complex workflows.
-
-- **Shared expertise**: Package complex workflows (like a specific team's PR
-  review process) into a folder that anyone can use.
-- **Repeatable workflows**: Ensure complex multi-step tasks are performed
-  consistently by providing a procedural framework.
-- **Resource bundling**: Include scripts, templates, or example data alongside
-  instructions so the agent has everything it needs.
-- **Progressive disclosure**: Only skill metadata (name and description) is
-  loaded initially. Detailed instructions and resources are only disclosed when
-  the model explicitly activates the skill, saving context tokens.
-
-<!-- prettier-ignore -->
-> [!NOTE]
-> `/skills disable` and `/skills enable` default to the `user` scope. Use
-> `--scope workspace` to manage workspace-specific settings.
-
-To see all available skills in your current session, use the `/skills list`
-command.
-
-## Managing skills
-
-You can manage Agent Skills through interactive session commands or directly
-from your terminal.
-
-### In an interactive session
-
-Use the `/skills` slash command to view and manage available expertise:
-
-- `/skills list [all] [nodesc]`: Shows discovered skills. Use `all` to include
-  built-in skills and `nodesc` to hide descriptions.
-- `/skills link <path> [--scope user|workspace]`: Links skills from a local
-  directory.
-- `/skills disable <name>`: Prevents a specific skill from being used.
-- `/skills enable <name>`: Re-enables a disabled skill.
-- `/skills reload` (or `/skills refresh`): Refreshes the list of discovered
-  skills from all tiers.
-
-### From the terminal
-
-The `gemini skills` command provides management utilities:
-
-```bash
-# List all discovered skills. Use --all to include built-in skills.
-gemini skills list --all
-
-# Install a skill from a Git repository or local directory.
-# Use --consent to skip the security confirmation prompt.
-gemini skills install https://github.com/user/repo.git --consent
-
-# Uninstall a skill.
-gemini skills uninstall my-skill --scope workspace
-```
-
-#### Command options
-
-The skill management commands support several global and command-specific
-options.
-
-- `--scope`: Either `user` (global, default) or `workspace` (local to the
-  project).
-- `--path`: The sub-directory within a Git repository containing the skill.
-- `--consent`: Acknowledge security risks and skip the interactive confirmation
-  during installation.
-
-For more details on CLI commands, see the
-[CLI reference](./cli-reference.md#skills-management).
-
-## Next steps
-
-Explore these resources to refine your skills and understand the framework
-better.
-
-- [Get started with Agent Skills](./tutorials/skills-getting-started.md): A
-  quick walkthrough of triggering and using skills.
-- [Creating Agent Skills](./creating-skills.md): Create your first skill and
-  bundle custom logic.
-- [Using Agent Skills](./using-agent-skills.md): Learn how to leverage built-in
-  and custom skills.
-- [Best practices](./skills-best-practices.md): Learn strategies for building
-  effective skills.
+To create your own skills, see the [Create Agent Skills](./creating-skills.md)
+guide.

docs/cli/trusted-folders.md

@@ -100,34 +100,6 @@ protect you. In this mode, the following features are disabled:
 Granting trust to a folder unlocks the full functionality of Gemini CLI for that
 workspace.
 
-## Headless and automated environments
-
-When running Gemini CLI in a headless environment (for example, a CI/CD
-pipeline) where interactive prompts are not possible, the trust dialog cannot be
-displayed. If the folder is untrusted and the Folder Trust feature is enabled,
-the CLI will throw a `FatalUntrustedWorkspaceError` and exit.
-
-To proceed in these environments, you can bypass the trust check using one of
-the following methods:
-
-- **Command-line flag:** Run the CLI with the `--skip-trust` flag.
-- **Environment variable:** Set the `GEMINI_CLI_TRUST_WORKSPACE=true`
-  environment variable.
-
-These methods will trust the current workspace for the duration of the session
-without prompting.
-
-For detailed instructions on managing folder trust within CI/CD workflows,
-review the
-[Gemini CLI trust guidance for GitHub Actions](https://github.com/google-github-actions/run-gemini-cli/blob/main/docs/trust-guidance.md).
-
-## Overriding the trust file location
-
-By default, trust settings are saved to `~/.gemini/trustedFolders.json`. If you
-need to store this file in a different location, you can set the
-`GEMINI_CLI_TRUSTED_FOLDERS_PATH` environment variable to the desired absolute
-file path.
-
 ## Managing your trust settings
 
 If you need to change a decision or see all your settings, you have a couple of

docs/cli/tutorials/memory-management.md

@@ -71,8 +71,8 @@ Just tell the agent to remember something.
 
 **Prompt:** `Remember that I prefer using 'const' over 'let' wherever possible.`
 
-The agent will edit the appropriate memory Markdown file, so the fact is loaded
-in future sessions.
+The agent will use the `save_memory` tool to store this fact in your global
+memory file.
 
 **Prompt:** `Save the fact that the staging server IP is 10.0.0.5.`
 
@@ -125,4 +125,4 @@ immediately. Force a reload with:
   `/memory` options.
 - Read the technical spec for [Project context](../../cli/gemini-md.md).
 - Try the experimental [Auto Memory](../auto-memory.md) feature to extract
-  memory updates and reusable skills from your past sessions automatically.
+  reusable skills from your past sessions automatically.

docs/cli/tutorials/session-management.md

@@ -61,19 +61,6 @@ gemini --list-sessions
 gemini --delete-session 1
 ```
 
-### Scenario: Delete session on exit
-
-If you're doing a one-off task and don't want to leave any session history
-behind, use the `--delete` flag when exiting:
-
-```
-/exit --delete
-```
-
-This removes the current session's conversation history and tool output files
-before exiting. It's useful for privacy-sensitive tasks or quick one-off
-interactions.
-
 ## How to rewind time (Undo mistakes)
 
 Gemini CLI's **Rewind** feature is like `Ctrl+Z` for your workflow.

docs/cli/tutorials/skills-getting-started.md

@@ -1,158 +1,110 @@
 # Get started with Agent Skills
 
-Agent Skills extend Gemini CLI with specialized expertise. In this tutorial,
-you'll learn how to create your first skill, bundle custom logic, and activate
-it during a session.
+Agent Skills extend Gemini CLI with specialized expertise. In this guide, you'll
+learn how to create your first skill, bundle custom scripts, and activate them
+during a session.
 
-## Create your first skill
+## How to create a skill
 
-A skill is defined by a directory containing a `SKILL.md` file and
-subdirectories containing reference materials or scripts used by the skill.
-Let's create an **API Auditor** skill that runs a script to help you verify if
-local or remote endpoints are responding correctly.
+A skill is defined by a directory containing a `SKILL.md` file. Let's create an
+**API Auditor** skill that helps you verify if local or remote endpoints are
+responding correctly.
 
-### 1. Create the directory structure
+### Create the directory structure
 
-The first step is to create the necessary folders for your skill and its
-scripts.
+1.  Run the following command to create the folders:
 
-**macOS/Linux**
+    **macOS/Linux**
 
-```bash
-mkdir -p .gemini/skills/api-auditor/scripts
-```
+    ```bash
+    mkdir -p .gemini/skills/api-auditor/scripts
+    ```
 
-**Windows (PowerShell)**
+    **Windows (PowerShell)**
 
-```powershell
-New-Item -ItemType Directory -Force -Path ".gemini\skills\api-auditor\scripts"
-```
+    ```powershell
+    New-Item -ItemType Directory -Force -Path ".gemini\skills\api-auditor\scripts"
+    ```
 
-### 2. Create the definition (`SKILL.md`)
+### Create the definition
 
-The `SKILL.md` file defines the skill's purpose and instructions for the agent.
-Create a file at `.gemini/skills/api-auditor/SKILL.md`. This tells the agent
-_when_ to use the skill and _how_ to behave.
+1.  Create a file at `.gemini/skills/api-auditor/SKILL.md`. This tells the agent
+    _when_ to use the skill and _how_ to behave.
 
-```markdown
----
-name: api-auditor
-description:
-  Expertise in auditing and testing API endpoints. Use when the user asks to
-  "check", "test", or "audit" a URL or API.
----
+    ```markdown
+    ---
+    name: api-auditor
+    description:
+      Expertise in auditing and testing API endpoints. Use when the user asks to
+      "check", "test", or "audit" a URL or API.
+    ---
 
-# API Auditor Instructions
+    # API Auditor Instructions
 
-You act as a QA engineer specialized in API reliability. When this skill is
-active, you MUST:
+    You act as a QA engineer specialized in API reliability. When this skill is
+    active, you MUST:
 
-1.  **Audit**: Use the bundled `scripts/audit.js` utility to check the status of
-    the provided URL.
-2.  **Report**: Analyze the output (status codes, latency) and explain any
-    failures in plain English.
-3.  **Secure**: Remind the user if they are testing a sensitive endpoint without
-    an `https://` protocol.
-```
+    1.  **Audit**: Use the bundled `scripts/audit.js` utility to check the
+        status of the provided URL.
+    2.  **Report**: Analyze the output (status codes, latency) and explain any
+        failures in plain English.
+    3.  **Secure**: Remind the user if they are testing a sensitive endpoint
+        without an `https://` protocol.
+    ```
 
-### 3. Add the tool logic
+### Add the tool logic
 
-Skills can bundle resources like scripts to perform deterministic tasks. Create
-a file at `.gemini/skills/api-auditor/scripts/audit.js`. This is the code the
-agent will run.
+Skills can bundle resources like scripts.
 
-```javascript
-// .gemini/skills/api-auditor/scripts/audit.js
-const url = process.argv[2];
+1.  Create a file at `.gemini/skills/api-auditor/scripts/audit.js`. This is the
+    code the agent will run.
 
-if (!url) {
-  console.error('Usage: node audit.js <url>');
-  process.exit(1);
-}
+    ```javascript
+    // .gemini/skills/api-auditor/scripts/audit.js
+    const url = process.argv[2];
 
-console.log(`Auditing ${url}...`);
-fetch(url, { method: 'HEAD' })
-  .then((r) => console.log(`Result: Success (Status ${r.status})`))
-  .catch((e) => console.error(`Result: Failed (${e.message})`));
-```
+    if (!url) {
+      console.error('Usage: node audit.js <url>');
+      process.exit(1);
+    }
 
-## Verify discovery
+    console.log(`Auditing ${url}...`);
+    fetch(url, { method: 'HEAD' })
+      .then((r) => console.log(`Result: Success (Status ${r.status})`))
+      .catch((e) => console.error(`Result: Failed (${e.message})`));
+    ```
 
-Gemini CLI automatically discovers skills in the `.gemini/skills` directory (as
-well as the `.agents/skills` alias).
+## How to verify discovery
 
-To check if Gemini CLI found your new skill, use the `/skills list` command
-within an interactive session:
+Gemini CLI automatically discovers skills in the `.gemini/skills` directory. You
+can also use `.agents/skills` as a more generic alternative. Check that it found
+your new skill.
 
-```bash
-/skills list
-```
+**Command:** `/skills list`
 
-You should see `api-auditor` in the list of available skills. If you just added
-the files, you can run `/skills reload` to refresh the list without restarting
-the session.
-
-### If your skill doesn't appear
-
-If `/skills list` doesn't show your skill, check the following:
-
-1.  **The folder must be trusted (workspace skills only).** Skills under
-    `<workspace>/.gemini/skills/` are only loaded when the workspace folder is
-    marked as trusted. Run `/trust` and restart the session if needed. Skills
-    under `~/.gemini/skills/` (user scope) are not affected by trust.
-2.  **Check the path layout.** `SKILL.md` is discovered either at the root of
-    the skills directory (`.gemini/skills/SKILL.md`) or one directory deep
-    (`.gemini/skills/<skill-name>/SKILL.md`). The recommended layout uses a
-    subdirectory per skill so you can bundle scripts and other resources
-    alongside it. Files nested more than one directory deep are not discovered.
-3.  **The filename must be exactly `SKILL.md`.** Capitalization matters on
-    case-sensitive filesystems (Linux, and macOS when configured as such):
-    `skill.md` or `Skill.md` will be ignored.
-4.  **Frontmatter must include both `name:` and `description:`, and must be the
-    first thing in the file.** A `SKILL.md` is silently skipped if either field
-    is missing, if the delimiters (`---` on their own lines) are absent, or if
-    any text (an H1 title, a comment, even a blank line) appears before the
-    opening `---`.
-5.  **The skill name comes from the `name:` field, not the directory name.** If
-    your frontmatter says `name: foo`, the skill appears as `foo` in
-    `/skills list` regardless of what its parent directory is called. The
-    characters `: \ / < > * ? " |` in the name are replaced with `-`.
+You should see `api-auditor` in the list of available skills.
 
 ## How to use the skill
 
-Now that the skill is discovered, you can trigger its activation by asking a
-relevant question.
+Now, try it out. Start a new session and ask a question that triggers the
+skill's description.
 
-1.  **Trigger**: Start a new session and ask: "Can you audit https://google.com"
-2.  **Activation**: Gemini identifies that the request matches the `api-auditor`
-    description and calls the `activate_skill` tool.
-3.  **Consent**: You will see a confirmation prompt. Type **y** to approve.
-4.  **Execution**: Once activated, Gemini uses the `run_shell_command` tool to
-    execute your bundled script:
-    `node .gemini/skills/api-auditor/scripts/audit.js https://google.com`
+**User:** "Can you audit http://geminicli.com"
 
-## Pro tip: Use the skill-creator
+Gemini recognizes the request matches the `api-auditor` description and asks for
+permission to activate it.
 
-If you don't want to create the files manually, you can use the built-in
-`skill-creator` skill. Simply ask Gemini:
+**Model:** (After calling `activate_skill`) "I've activated the **api-auditor**
+skill. I'll run the audit script now..."
 
-> "Create a new skill called 'api-auditor' that tests if URLs are responding."
+Gemini then uses the `run_shell_command` tool to execute your bundled Node
+script:
 
-The `skill-creator` will handle the directory structure and boilerplate for you.
-
-## Manage skills
-
-You can also manage skills using the `gemini skills` command from your terminal:
-
-- **Install**: `gemini skills install <url-or-path>`
-- **Link**: `gemini skills link <path>` (useful for local development)
-- **Uninstall**: `gemini skills uninstall <name>`
+`node .gemini/skills/api-auditor/scripts/audit.js http://geminili.com`
 
 ## Next steps
 
-- [Creating Agent Skills](../creating-skills.md): Detailed guide on advanced
-  skill features and metadata.
-- [Using Agent Skills](../using-agent-skills.md): More ways to discover and
-  manage your skill library.
-- [Skill best practices](../skills-best-practices.md): Learn how to design
-  reliable and effective expertise.
+- Explore the
+  [Agent Skills Authoring Guide](../../cli/skills.md#creating-a-skill) to learn
+  about more advanced features.
+- Learn how to share skills via [Extensions](../../extensions/index.md).

docs/cli/using-agent-skills.md

@@ -1,89 +0,0 @@
-# Managing Agent Skills
-
-Agent Skills provide Gemini CLI with specialized expertise on demand. This guide
-covers advanced management techniques, including using slash commands, terminal
-utilities, and understanding discovery tiers.
-
-## Discovery tiers
-
-Gemini CLI discovers skills from several locations, following a specific order
-of precedence (lowest to highest):
-
-1.  **Built-in Skills**: Included with Gemini CLI and always available.
-2.  **Extension Skills**: Bundled within [extensions](../extensions/index.md).
-3.  **User Skills**: Located in `~/.gemini/skills/` or the `~/.agents/skills/`
-    alias. These are available across all your projects.
-4.  **Workspace Skills**: Located in `.gemini/skills/` or the `.agents/skills/`
-    alias within your current directory. These are project-specific.
-
-> **Tip:** If multiple skills share the same name, the version from the
-> higher-precedence location is used.
-
-## In-session management
-
-Use the `/skills` slash command during an interactive session to manage your
-available expertise.
-
-- **List skills**: `/skills list` (shows discovered skills).
-  - Use `/skills list all` to include internal built-in skills.
-  - Use `/skills list nodesc` to hide descriptions.
-- **Reload skills**: `/skills reload` (or `/skills refresh`) to scan for new or
-  modified skills without restarting the CLI.
-- **Toggle status**:
-  - `/skills disable <name>`: Prevents a skill from being triggered.
-  - `/skills enable <name>`: Re-enables a disabled skill.
-- **Link local skills**: `/skills link <path> [--scope user|workspace]` to
-  immediately use a skill you are developing.
-
-## Terminal utilities
-
-The `gemini skills` command provides management utilities directly from your
-system shell.
-
-### Install a skill
-
-To install a skill from a remote repository or a local `.skill` package:
-
-```bash
-gemini skills install https://github.com/user/my-awesome-skill
-```
-
-By default, this installs to your **user profile**. Use `--scope workspace` to
-install it only for the current project.
-
-### Link for development
-
-If you are developing a skill, use the `link` command to create a reference to
-your local directory:
-
-```bash
-gemini skills link ./path/to/my-skill
-```
-
-### Uninstall a skill
-
-To completely remove an installed or linked skill:
-
-```bash
-gemini skills uninstall <name>
-```
-
-## Security and consent
-
-Agent Skills can execute scripts and access your files. To protect your
-environment:
-
-1.  **Installation consent**: When installing from a remote URL, you will be
-    asked to confirm the source.
-2.  **Activation consent**: Every time a skill is triggered during a session,
-    the agent must ask for permission to activate it and gain access to its
-    resources.
-
-## Next steps
-
-- [Get started with Agent Skills](./tutorials/skills-getting-started.md): A
-  walkthrough for creating your first skill.
-- [Creating Agent Skills](./creating-skills.md): Detailed guide on bundling
-  scripts and assets.
-- [Skill best practices](./skills-best-practices.md): Strategies for building
-  reliable expertise.

docs/core/gemma-setup.md

@@ -1,83 +0,0 @@
-# `gemini gemma` — Automated Local Model Routing Setup
-
-Local model routing uses a local Gemma 3 1B model running on your machine to
-classify and route user requests. It routes simple requests (like file reads) to
-Gemini Flash and complex requests (like architecture discussions) to Gemini Pro.
-
-<!-- prettier-ignore -->
-> [!NOTE]
-> This is an experimental feature currently under active development.
-
-## What is this?
-
-This feature saves cloud API costs by using local inference for task
-classification instead of a cloud-based classifier. It adds a few milliseconds
-of local latency but can significantly reduce the overall token usage for hosted
-models.
-
-## Quick start
-
-```bash
-# One command does everything: downloads runtime, pulls model, configures settings, starts server
-gemini gemma setup
-```
-
-You'll be prompted to accept the Gemma Terms of Use. The model is ~1 GB.
-
-After setup, **just use the CLI normally** — routing happens automatically on
-every request.
-
-## Commands
-
-| Command               | What it does                                                   |
-| --------------------- | -------------------------------------------------------------- |
-| `gemini gemma setup`  | Full install (binary + model + settings + server start)        |
-| `gemini gemma status` | Health check — shows what's installed and running              |
-| `gemini gemma start`  | Start the LiteRT server (auto-starts on CLI launch by default) |
-| `gemini gemma stop`   | Stop the LiteRT server                                         |
-| `gemini gemma logs`   | Tail the server logs to see routing requests live              |
-| `/gemma`              | In-session status check (type it inside the CLI)               |
-
-## Verifying it works
-
-1. Run `gemini gemma status` — all checks should show green
-2. Open two terminals:
-   - Terminal 1: `gemini gemma logs` (watch for incoming requests)
-   - Terminal 2: use the CLI normally
-3. You should see classification requests appear in the logs as you interact
-   with the CLI
-4. The `/gemma` slash command inside a session shows a quick status panel
-
-## Setup flags
-
-```bash
-gemini gemma setup --port 8080      # custom port
-gemini gemma setup --no-start       # don't start server after install
-gemini gemma setup --force           # re-download everything
-gemini gemma setup --skip-model     # binary only, skip the 1GB model download
-```
-
-## How it works under the hood
-
-- Local Gemma classifies each request as "simple" or "complex" (~100ms)
-- Simple → Flash, Complex → Pro
-- If the local server is down, the CLI silently falls back to the cloud
-  classifier — no errors, no disruption
-
-## Disabling
-
-Set `enabled: false` in settings or just run `gemini gemma stop` to turn off the
-server:
-
-```json
-{ "experimental": { "gemmaModelRouter": { "enabled": false } } }
-```
-
-## Advanced setup
-
-If you are in an environment where the `gemini gemma setup` command cannot
-automatically download binaries (for example, behind a strict corporate
-firewall), you can perform the setup manually.
-
-For more information, see the
-[Manual Local Model Routing Setup guide](./local-model-routing.md).

docs/core/index.md

@@ -15,9 +15,8 @@ requests sent from `packages/cli`. For a general overview of Gemini CLI, see the
   modular GEMINI.md import feature using @file.md syntax.
 - **[Policy Engine](../reference/policy-engine.md):** Use the Policy Engine for
   fine-grained control over tool execution.
-- **[Local Model Routing (experimental)](./gemma-setup.md):** Learn how to
-  enable use of a local Gemma model for model routing decisions using the
-  automated setup command.
+- **[Local Model Routing (experimental)](./local-model-routing.md):** Learn how
+  to enable use of a local Gemma model for model routing decisions.
 
 ## Role of the core
 

docs/core/local-model-routing.md

@@ -1,29 +1,22 @@
-# Manual Local Model Routing Setup (experimental)
+# Local Model Routing (experimental)
 
 Gemini CLI supports using a local model for
 [routing decisions](../cli/model-routing.md). When configured, Gemini CLI will
 use a locally-running **Gemma** model to make routing decisions (instead of
 sending routing decisions to a hosted model).
 
-<!-- prettier-ignore -->
-> [!NOTE]
-> This is an experimental feature currently under active development.
-
-<!-- prettier-ignore -->
-> [!IMPORTANT]
-> **Recommended:** We now provide a fully automated setup command. We recommend
-> using the [`gemini gemma` Setup Guide](./gemma-setup.md) instead of following
-> these manual steps.
-
 This feature can help reduce costs associated with hosted model usage while
 offering similar routing decision latency and quality.
 
-## Manual Setup
+> **Note: Local model routing is currently an experimental feature.**
+
+## Setup
 
 Using a Gemma model for routing decisions requires that an implementation of a
 Gemma model be running locally on your machine, served behind an HTTP endpoint
-and accessed via the Gemini API. If you cannot use the `gemini gemma setup`
-command, follow these manual steps:
+and accessed via the Gemini API.
+
+To serve the Gemma model, follow these steps:
 
 ### Download the LiteRT-LM runtime
 

docs/extensions/reference.md

@@ -210,22 +210,6 @@ To update an extension's settings:
 gemini extensions config <name> [setting] [--scope <scope>]
 ```
 
-#### Environment variable sanitization
-
-For security reasons, sensitive environment variables are filtered out and not
-passed to extensions or MCP servers by default.
-
-Extensions **will not** inherit the user's full shell environment variables.
-They will only have access to:
-
-1. Standard safe variables (e.g., `HOME`, `PATH`, `TMPDIR`).
-2. Variables explicitly declared and requested in the `gemini-extension.json`
-   manifest via the `settings` array (using the `envVar` property).
-
-If your extension requires specific environment variables (like an API key,
-custom host, or config path), you **must** declare them in the `settings` array
-so the CLI can allowlist them for use within the extension.
-
 ### Custom commands
 
 Provide [custom commands](../cli/custom-commands.md) by placing TOML files in a

docs/extensions/releasing.md

@@ -1,8 +1,7 @@
 # Release extensions
 
 Release Gemini CLI extensions to your users through a Git repository or GitHub
-Releases. This guide explains how to share your work, list it in the gallery,
-and manage updates.
+Releases.
 
 Git repository releases are the simplest approach and offer the most flexibility
 for managing development branches. GitHub Releases are more efficient for
@@ -154,62 +153,29 @@ jobs:
             release/win32.arm64.my-tool.zip
 ```
 
-## Migrate an extension repository
+## Migrating an Extension Repository
 
-If you move your extension to a new repository or rename it, use the
-`migratedTo` property in `gemini-extension.json` to seamlessly transition your
+If you need to move your extension to a new repository (for example, from a
+personal account to an organization) or rename it, you can use the `migratedTo`
+property in your `gemini-extension.json` file to seamlessly transition your
 users.
 
-1.  **Create the new repository:** Set up your extension in its new location.
-2.  **Update the old repository:** In your original repository, update the
-    `gemini-extension.json` file to include the `migratedTo` property pointing
-    to the new repository URL, and increment the version number.
-    ```json
-    {
-      "name": "my-extension",
-      "version": "1.1.0",
-      "migratedTo": "https://github.com/new-owner/new-extension-repo"
-    }
-    ```
-3.  **Release the update:** Publish this new version in your old repository.
+1. **Create the new repository**: Setup your extension in its new location.
+2. **Update the old repository**: In your original repository, update the
+   `gemini-extension.json` file to include the `migratedTo` property, pointing
+   to the new repository URL, and bump the version number. You can optionally
+   change the `name` of your extension at this time in the new repository.
+   ```json
+   {
+     "name": "my-extension",
+     "version": "1.1.0",
+     "migratedTo": "https://github.com/new-owner/new-extension-repo"
+   }
+   ```
+3. **Release the update**: Publish this new version in your old repository.
 
-When users check for updates, Gemini CLI detects the `migratedTo` field,
-verifies the new repository, and automatically updates their local installation
-to track the new source. All settings migrate automatically.
-
-## How updates work
-
-Gemini CLI automatically checks for extension updates based on the installation
-method. Understanding these mechanisms helps you ensure your users always have
-the latest version.
-
-### Sync manifest and tags
-
-For GitHub releases, always ensure the `version` in `gemini-extension.json`
-matches your GitHub release tag. While the CLI uses tags for update detection,
-it displays the manifest version in the UI. Keeping them in sync prevents
-confusion.
-
-### Update mechanisms
-
-<details>
-<summary>Technical update details</summary>
-
-The CLI uses different strategies depending on the installation type:
-
-- **GitHub releases:** The CLI queries the GitHub API for the latest release
-  tag. It ignores the `version` field in the manifest for detection.
-- **Git clones:** The CLI runs `git ls-remote` to compare the latest remote
-  commit hash with your local `HEAD`.
-- **Local extensions:** The CLI compares the `version` field in the source
-  directory's manifest with the installed version.
-
-To verify an extension's installation type, inspect the `type` field in the
-metadata file at `~/.gemini/extensions/<name>/.gemini-extension-install.json`.
-
-</details>
-
-<!-- prettier-ignore -->
-> [!IMPORTANT]
-> The `migratedTo` flow requires at least one release on the new repository for
-> the CLI to recognize it as a valid update source.
+When users check for updates, Gemini CLI will detect the `migratedTo` field,
+verify that the new repository contains a valid extension update, and
+automatically update their local installation to track the new source and name
+moving forward. All extension settings will automatically migrate to the new
+installation.

docs/extensions/writing-extensions.md

@@ -159,13 +159,6 @@ When a user installs this extension, Gemini CLI will prompt them to enter the
 `sensitive` is true) and injected into the MCP server's process as the
 `MY_SERVICE_API_KEY` environment variable.
 
-> **Important (Environment Variable Sanitization):** For security reasons,
-> sensitive environment variables are filtered out and not passed to extensions
-> or MCP servers by default. Extensions will _only_ have access to environment
-> variables that are explicitly declared in the `settings` array using the
-> `envVar` property, plus a few standard safe variables. Do not expect host
-> environment variables to be available otherwise.
-
 ## Step 4: Link your extension
 
 Link your extension to your Gemini CLI installation for local development.

docs/get-started/installation.mdx

@@ -111,8 +111,8 @@ You can also run Gemini CLI using one of the following advanced methods:
     directly. This is useful for environments where you only have Docker and want
     to run the CLI.
     ```bash
-    # Run the published sandbox image for a specified CLI version
-    docker run --rm -it us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.42.0-nightly.20260428.g59b2dea0e
+    # Run the published sandbox image
+    docker run --rm -it us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.1.1
     ```
   - **Using the `--sandbox` flag:** If you have Gemini CLI installed locally
     (using the standard installation described above), you can instruct it to run

docs/reference/commands.md

@@ -111,11 +111,6 @@ Slash commands provide meta-level control over the CLI itself.
 
 - **Description:** Manage custom slash commands loaded from `.toml` files.
 - **Sub-commands:**
-  - **`list`**:
-    - **Description:** List available custom command `.toml` files from all
-      sources (user-level `~/.gemini/commands/`, project-level
-      `<project>/.gemini/commands/`, and active extensions).
-    - **Usage:** `/commands list`
   - **`reload`**:
     - **Description:** Reload custom command definitions from all sources
       (user-level `~/.gemini/commands/`, project-level
@@ -265,6 +260,9 @@ Slash commands provide meta-level control over the CLI itself.
 - **Description:** Manage the AI's instructional context (hierarchical memory
   loaded from `GEMINI.md` files).
 - **Sub-commands:**
+  - **`add`**:
+    - **Description:** Adds the following text to the AI's memory. Usage:
+      `/memory add <text to remember>`
   - **`list`**:
     - **Description:** Lists the paths of the GEMINI.md files in use for
       hierarchical memory.
@@ -325,11 +323,6 @@ Slash commands provide meta-level control over the CLI itself.
 ### `/quit` (or `/exit`)
 
 - **Description:** Exit Gemini CLI.
-- **Flags:**
-  - **`--delete`** _(optional)_: Exit and permanently delete the current
-    session's history and temporary files (chat recording, tool outputs). Useful
-    for privacy or one-off tasks where you don't want to leave any traces.
-  - **Usage:** `/quit --delete` or `/exit --delete`
 
 ### `/restore`
 
@@ -506,12 +499,12 @@ the dedicated [Custom Commands documentation](../cli/custom-commands.md).
 These shortcuts apply directly to the input prompt for text manipulation.
 
 - **Undo:**
-  - **Keyboard shortcut:** Press **Ctrl+z** (Windows), **Cmd+z** (macOS), or
-    **Alt+z** (Linux/WSL) to undo the last action in the input prompt.
+  - **Keyboard shortcut:** Press **Alt+z** or **Cmd+z** to undo the last action
+    in the input prompt.
 
 - **Redo:**
-  - **Keyboard shortcut:** Press **Shift+Cmd+Z** (macOS), or **Shift+Alt+Z**
-    (Linux/WSL) to redo the last undone action in the input prompt.
+  - **Keyboard shortcut:** Press **Shift+Alt+Z** or **Shift+Cmd+Z** to redo the
+    last undone action in the input prompt.
 
 ## At commands (`@`)
 

docs/reference/configuration.md

@@ -203,11 +203,6 @@ their corresponding top-level category object in your `settings.json` file.
     chattiness and structured progress reporting.
   - **Default:** `true`
 
-- **`general.logRagSnippets`** (boolean):
-  - **Description:** Log full Code Customization (RAG) retrieved snippets to a
-    local file for debugging.
-  - **Default:** `false`
-
 #### `output`
 
 - **`output.format`** (enum):
@@ -550,24 +545,6 @@ their corresponding top-level category object in your `settings.json` file.
           "model": "gemini-3-flash-preview"
         }
       },
-      "gemini-3.1-pro-preview": {
-        "extends": "chat-base-3",
-        "modelConfig": {
-          "model": "gemini-3.1-pro-preview"
-        }
-      },
-      "gemini-3.1-pro-preview-customtools": {
-        "extends": "chat-base-3",
-        "modelConfig": {
-          "model": "gemini-3.1-pro-preview-customtools"
-        }
-      },
-      "gemini-3.1-flash-lite-preview": {
-        "extends": "chat-base-3",
-        "modelConfig": {
-          "model": "gemini-3.1-flash-lite-preview"
-        }
-      },
       "gemini-2.5-pro": {
         "extends": "chat-base-2.5",
         "modelConfig": {
@@ -586,18 +563,6 @@ their corresponding top-level category object in your `settings.json` file.
           "model": "gemini-2.5-flash-lite"
         }
       },
-      "gemma-4-31b-it": {
-        "extends": "chat-base-3",
-        "modelConfig": {
-          "model": "gemma-4-31b-it"
-        }
-      },
-      "gemma-4-26b-a4b-it": {
-        "extends": "chat-base-3",
-        "modelConfig": {
-          "model": "gemma-4-26b-a4b-it"
-        }
-      },
       "gemini-2.5-flash-base": {
         "extends": "base",
         "modelConfig": {
@@ -723,19 +688,6 @@ their corresponding top-level category object in your `settings.json` file.
         "extends": "gemini-3-flash-base",
         "modelConfig": {}
       },
-      "context-snapshotter": {
-        "extends": "gemini-3-flash-base",
-        "modelConfig": {
-          "generateContentConfig": {
-            "thinkingConfig": {
-              "thinkingLevel": "HIGH"
-            },
-            "temperature": 1,
-            "topP": 0.95,
-            "topK": 64
-          }
-        }
-      },
       "chat-compression-3-pro": {
         "modelConfig": {
           "model": "gemini-3-pro-preview"
@@ -882,33 +834,10 @@ their corresponding top-level category object in your `settings.json` file.
           "multimodalToolUse": false
         }
       },
-      "gemma-4-31b-it": {
-        "displayName": "gemma-4-31b-it",
-        "tier": "custom",
-        "family": "gemma-4",
-        "isPreview": false,
-        "isVisible": true,
-        "features": {
-          "thinking": true,
-          "multimodalToolUse": false
-        }
-      },
-      "gemma-4-26b-a4b-it": {
-        "displayName": "gemma-4-26b-a4b-it",
-        "tier": "custom",
-        "family": "gemma-4",
-        "isPreview": false,
-        "isVisible": true,
-        "features": {
-          "thinking": true,
-          "multimodalToolUse": false
-        }
-      },
       "auto": {
-        "displayName": "Auto",
         "tier": "auto",
         "isPreview": true,
-        "isVisible": true,
+        "isVisible": false,
         "features": {
           "thinking": true,
           "multimodalToolUse": false
@@ -942,16 +871,26 @@ their corresponding top-level category object in your `settings.json` file.
         }
       },
       "auto-gemini-3": {
+        "displayName": "Auto (Gemini 3)",
         "tier": "auto",
-        "family": "gemini-3",
         "isPreview": true,
-        "isVisible": false
+        "isVisible": true,
+        "dialogDescription": "Let Gemini CLI decide the best model for the task: gemini-3-pro, gemini-3-flash",
+        "features": {
+          "thinking": true,
+          "multimodalToolUse": false
+        }
       },
       "auto-gemini-2.5": {
+        "displayName": "Auto (Gemini 2.5)",
         "tier": "auto",
-        "family": "gemini-2.5",
         "isPreview": false,
-        "isVisible": false
+        "isVisible": true,
+        "dialogDescription": "Let Gemini CLI decide the best model for the task: gemini-2.5-pro, gemini-2.5-flash",
+        "features": {
+          "thinking": false,
+          "multimodalToolUse": false
+        }
       }
     }
     ```
@@ -965,12 +904,6 @@ their corresponding top-level category object in your `settings.json` file.
 
     ```json
     {
-      "gemma-4-31b-it": {
-        "default": "gemma-4-31b-it"
-      },
-      "gemma-4-26b-a4b-it": {
-        "default": "gemma-4-26b-a4b-it"
-      },
       "gemini-3.1-pro-preview": {
         "default": "gemini-3.1-pro-preview",
         "contexts": [
@@ -1034,15 +967,33 @@ their corresponding top-level category object in your `settings.json` file.
           }
         ]
       },
-      "auto": {
+      "auto-gemini-3": {
         "default": "gemini-3-pro-preview",
         "contexts": [
           {
             "condition": {
-              "releaseChannel": "stable"
+              "hasAccessToPreview": false
             },
             "target": "gemini-2.5-pro"
           },
+          {
+            "condition": {
+              "useGemini3_1": true,
+              "useCustomTools": true
+            },
+            "target": "gemini-3.1-pro-preview-customtools"
+          },
+          {
+            "condition": {
+              "useGemini3_1": true
+            },
+            "target": "gemini-3.1-pro-preview"
+          }
+        ]
+      },
+      "auto": {
+        "default": "gemini-3-pro-preview",
+        "contexts": [
           {
             "condition": {
               "hasAccessToPreview": false
@@ -1088,6 +1039,9 @@ their corresponding top-level category object in your `settings.json` file.
           }
         ]
       },
+      "auto-gemini-2.5": {
+        "default": "gemini-2.5-pro"
+      },
       "gemini-3.1-flash-lite-preview": {
         "default": "gemini-3.1-flash-lite-preview",
         "contexts": [
@@ -1120,33 +1074,6 @@ their corresponding top-level category object in your `settings.json` file.
             "target": "gemini-3.1-flash-lite-preview"
           }
         ]
-      },
-      "auto-gemini-3": {
-        "default": "gemini-3-pro-preview",
-        "contexts": [
-          {
-            "condition": {
-              "hasAccessToPreview": false
-            },
-            "target": "gemini-2.5-pro"
-          },
-          {
-            "condition": {
-              "useGemini3_1": true,
-              "useCustomTools": true
-            },
-            "target": "gemini-3.1-pro-preview-customtools"
-          },
-          {
-            "condition": {
-              "useGemini3_1": true
-            },
-            "target": "gemini-3.1-pro-preview"
-          }
-        ]
-      },
-      "auto-gemini-2.5": {
-        "default": "gemini-2.5-pro"
       }
     }
     ```
@@ -1165,15 +1092,15 @@ their corresponding top-level category object in your `settings.json` file.
         "contexts": [
           {
             "condition": {
-              "hasAccessToPreview": false
+              "requestedModels": ["auto-gemini-2.5", "gemini-2.5-pro"]
             },
             "target": "gemini-2.5-flash"
           },
           {
             "condition": {
-              "requestedModels": ["gemini-2.5-pro", "auto-gemini-2.5"]
+              "requestedModels": ["auto-gemini-3", "gemini-3-pro-preview"]
             },
-            "target": "gemini-2.5-flash"
+            "target": "gemini-3-flash-preview"
           }
         ]
       },
@@ -1182,20 +1109,7 @@ their corresponding top-level category object in your `settings.json` file.
         "contexts": [
           {
             "condition": {
-              "hasAccessToPreview": false
-            },
-            "target": "gemini-2.5-pro"
-          },
-          {
-            "condition": {
-              "releaseChannel": "stable",
-              "requestedModels": ["auto"]
-            },
-            "target": "gemini-2.5-pro"
-          },
-          {
-            "condition": {
-              "requestedModels": ["gemini-2.5-pro", "auto-gemini-2.5"]
+              "requestedModels": ["auto-gemini-2.5", "gemini-2.5-pro"]
             },
             "target": "gemini-2.5-pro"
           },
@@ -1245,42 +1159,6 @@ their corresponding top-level category object in your `settings.json` file.
         {
           "model": "gemini-3-flash-preview",
           "isLastResort": true,
-          "maxAttempts": 10,
-          "actions": {
-            "terminal": "prompt",
-            "transient": "prompt",
-            "not_found": "prompt",
-            "unknown": "prompt"
-          },
-          "stateTransitions": {
-            "terminal": "terminal",
-            "transient": "terminal",
-            "not_found": "terminal",
-            "unknown": "terminal"
-          }
-        }
-      ],
-      "auto-preview": [
-        {
-          "model": "gemini-3-pro-preview",
-          "maxAttempts": 3,
-          "actions": {
-            "terminal": "prompt",
-            "transient": "silent",
-            "not_found": "prompt",
-            "unknown": "prompt"
-          },
-          "stateTransitions": {
-            "terminal": "terminal",
-            "transient": "sticky_retry",
-            "not_found": "terminal",
-            "unknown": "terminal"
-          }
-        },
-        {
-          "model": "gemini-3-flash-preview",
-          "isLastResort": true,
-          "maxAttempts": 10,
           "actions": {
             "terminal": "prompt",
             "transient": "prompt",
@@ -1304,52 +1182,16 @@ their corresponding top-level category object in your `settings.json` file.
             "not_found": "prompt",
             "unknown": "prompt"
           },
-          "stateTransitions": {
-            "terminal": "terminal",
-            "transient": "sticky_retry",
-            "not_found": "terminal",
-            "unknown": "terminal"
-          }
-        },
-        {
-          "model": "gemini-2.5-flash",
-          "isLastResort": true,
-          "maxAttempts": 10,
-          "actions": {
-            "terminal": "prompt",
-            "transient": "prompt",
-            "not_found": "prompt",
-            "unknown": "prompt"
-          },
           "stateTransitions": {
             "terminal": "terminal",
             "transient": "terminal",
             "not_found": "terminal",
             "unknown": "terminal"
           }
-        }
-      ],
-      "auto-default": [
-        {
-          "model": "gemini-2.5-pro",
-          "maxAttempts": 3,
-          "actions": {
-            "terminal": "prompt",
-            "transient": "silent",
-            "not_found": "prompt",
-            "unknown": "prompt"
-          },
-          "stateTransitions": {
-            "terminal": "terminal",
-            "transient": "sticky_retry",
-            "not_found": "terminal",
-            "unknown": "terminal"
-          }
         },
         {
           "model": "gemini-2.5-flash",
           "isLastResort": true,
-          "maxAttempts": 10,
           "actions": {
             "terminal": "prompt",
             "transient": "prompt",
@@ -1610,6 +1452,11 @@ their corresponding top-level category object in your `settings.json` file.
     performance.
   - **Default:** `true`
 
+- **`tools.shell.rcFile`** (string):
+  - **Description:** The path to a bash file (e.g., .bashrc) to source before
+    executing shell commands.
+  - **Default:** `undefined`
+
 - **`tools.core`** (array):
   - **Description:** Restrict the set of built-in tools with an allowlist. Match
     semantics mirror tools.allowed; see the built-in tools documentation for
@@ -1625,12 +1472,6 @@ their corresponding top-level category object in your `settings.json` file.
   - **Default:** `undefined`
   - **Requires restart:** Yes
 
-- **`tools.confirmationRequired`** (array):
-  - **Description:** Tool names that always require user confirmation. Takes
-    precedence over allowed tools and core tool allowlists.
-  - **Default:** `undefined`
-  - **Requires restart:** Yes
-
 - **`tools.exclude`** (array):
   - **Description:** Tool names to exclude from discovery.
   - **Default:** `undefined`
@@ -1798,51 +1639,12 @@ their corresponding top-level category object in your `settings.json` file.
     ["DEBUG", "DEBUG_MODE"]
     ```
 
-- **`advanced.ignoreLocalEnv`** (boolean):
-  - **Description:** Whether to ignore generic .env files in the project
-    directory.
-  - **Default:** `false`
-  - **Requires restart:** Yes
-
 - **`advanced.bugCommand`** (object):
   - **Description:** Configuration for the bug report command.
   - **Default:** `undefined`
 
 #### `experimental`
 
-- **`experimental.gemma`** (boolean):
-  - **Description:** Enable access to Gemma 4 models via Gemini API.
-  - **Default:** `true`
-  - **Requires restart:** Yes
-
-- **`experimental.voiceMode`** (boolean):
-  - **Description:** Enable experimental voice dictation and commands (/voice,
-    /voice model).
-  - **Default:** `false`
-
-- **`experimental.voice.activationMode`** (enum):
-  - **Description:** How to trigger voice recording with the Space key.
-  - **Default:** `"push-to-talk"`
-  - **Values:** `"push-to-talk"`, `"toggle"`
-
-- **`experimental.voice.backend`** (enum):
-  - **Description:** The backend to use for voice transcription. Note: When
-    using the Gemini Live backend, voice recordings are sent to Google Cloud for
-    transcription.
-  - **Default:** `"gemini-live"`
-  - **Values:** `"gemini-live"`, `"whisper"`
-
-- **`experimental.voice.whisperModel`** (enum):
-  - **Description:** The Whisper model to use for local transcription.
-  - **Default:** `"ggml-base.en.bin"`
-  - **Values:** `"ggml-tiny.en.bin"`, `"ggml-base.en.bin"`,
-    `"ggml-large-v3-turbo-q5_0.bin"`, `"ggml-large-v3-turbo-q8_0.bin"`
-
-- **`experimental.voice.stopGracePeriodMs`** (number):
-  - **Description:** How long to wait for final transcription after stopping
-    recording.
-  - **Default:** `4000`
-
 - **`experimental.adk.agentSessionNoninteractiveEnabled`** (boolean):
   - **Description:** Enable non-interactive agent sessions.
   - **Default:** `false`
@@ -1890,6 +1692,11 @@ their corresponding top-level category object in your `settings.json` file.
   - **Default:** `false`
   - **Requires restart:** Yes
 
+- **`experimental.jitContext`** (boolean):
+  - **Description:** Enable Just-In-Time (JIT) context loading.
+  - **Default:** `false`
+  - **Requires restart:** Yes
+
 - **`experimental.useOSC52Paste`** (boolean):
   - **Description:** Use OSC 52 for pasting. This may be more robust than the
     default system when using remote terminal sessions (if your terminal is
@@ -1952,17 +1759,16 @@ their corresponding top-level category object in your `settings.json` file.
   - **Default:** `"gemma3-1b-gpu-custom"`
   - **Requires restart:** Yes
 
-- **`experimental.stressTestProfile`** (boolean):
-  - **Description:** Significantly lowers token limits to force early garbage
-    collection and distillation for testing purposes.
+- **`experimental.memoryManager`** (boolean):
+  - **Description:** Replace the built-in save_memory tool with a memory manager
+    subagent that supports adding, removing, de-duplicating, and organizing
+    memories.
   - **Default:** `false`
   - **Requires restart:** Yes
 
 - **`experimental.autoMemory`** (boolean):
-  - **Description:** Automatically extract memory patches and skills from past
-    sessions in the background. Every change is written as a unified diff
-    `.patch` file under `<projectMemoryDir>/.inbox/<kind>/` and held for review
-    in /memory inbox; nothing is applied until you approve it.
+  - **Description:** Automatically extract reusable skills from past sessions in
+    the background. Review results with /memory inbox.
   - **Default:** `false`
   - **Requires restart:** Yes
 
@@ -2347,14 +2153,6 @@ the `advanced.excludedEnvVars` setting in your `settings.json` file.
   - Overrides the hardcoded default
   - Example: `export GEMINI_MODEL="gemini-3-flash-preview"` (Windows PowerShell:
     `$env:GEMINI_MODEL="gemini-3-flash-preview"`)
-- **`GEMINI_CLI_TRUST_WORKSPACE`**:
-  - If set to `"true"`, trusts the current workspace for the duration of the
-    session, bypassing the folder trust check.
-  - Useful for headless environments (for example, CI/CD pipelines).
-- **`GEMINI_CLI_TRUSTED_FOLDERS_PATH`**:
-  - Overrides the default location for the `trustedFolders.json` file.
-  - Useful if you want to store this configuration in a custom location instead
-    of the default `~/.gemini/`.
 - **`GEMINI_CLI_IDE_PID`**:
   - Manually specifies the PID of the IDE process to use for integration. This
     is useful when running Gemini CLI in a standalone terminal while still
@@ -2616,6 +2414,7 @@ for that specific session.
   - **Note:** For structured output and scripting, use the
     `--output-format json` or `--output-format stream-json` flag.
 - **`--prompt <your_prompt>`** (**`-p <your_prompt>`**):
+  - **Deprecated:** Use positional arguments instead.
   - Used to pass a prompt directly to the command. This invokes Gemini CLI in a
     non-interactive mode.
 - **`--prompt-interactive <your_prompt>`** (**`-i <your_prompt>`**):

docs/reference/keyboard-shortcuts.md

@@ -39,7 +39,7 @@ available combinations.
 | `edit.deleteWordRight` | Delete the next word.                            | `Ctrl+Delete`<br />`Alt+Delete`<br />`Alt+D`             |
 | `edit.deleteLeft`      | Delete the character to the left.                | `Backspace`<br />`Ctrl+H`                                |
 | `edit.deleteRight`     | Delete the character to the right.               | `Delete`<br />`Ctrl+D`                                   |
-| `edit.undo`            | Undo the most recent text edit.                  | `Ctrl+Z`<br />`Alt+Z`<br />`Cmd/Win+Z`                   |
+| `edit.undo`            | Undo the most recent text edit.                  | `Cmd/Win+Z`<br />`Alt+Z`                                 |
 | `edit.redo`            | Redo the most recent undone text edit.           | `Ctrl+Shift+Z`<br />`Shift+Cmd/Win+Z`<br />`Alt+Shift+Z` |
 
 #### Scrolling
@@ -115,7 +115,6 @@ available combinations.
 | `app.restart`                 | Restart the application.                                                                                                                           | `R`<br />`Shift+R` |
 | `app.suspend`                 | Suspend the CLI and move it to the background.                                                                                                     | `Ctrl+Z`           |
 | `app.showShellUnfocusWarning` | Show warning when trying to move focus away from shell input.                                                                                      | `Tab`              |
-| `app.voiceModePTT`            | Hold to speak in Voice Mode.                                                                                                                       | `Space`            |
 
 #### Background Shell Controls
 
@@ -326,29 +325,6 @@ lines and `3w` moves forward three words.
 Counts are also supported for editing commands. For example, `3dd` deletes three
 lines and `2cw` changes two words.
 
-### Find, replace, yank, and paste in NORMAL mode
-
-| Action                                    | Keys        |
-| ----------------------------------------- | ----------- |
-| Find next matching character              | `f{char}`   |
-| Find previous matching character          | `F{char}`   |
-| Move until before next matching character | `t{char}`   |
-| Move until after previous matching char   | `T{char}`   |
-| Repeat latest character find              | `;`         |
-| Repeat latest character find in reverse   | `,`         |
-| Delete character before cursor            | `X`         |
-| Toggle case under cursor                  | `~`         |
-| Replace character under cursor            | `r{char}`   |
-| Yank line                                 | `yy`        |
-| Yank to end of line                       | `Y` or `y$` |
-| Yank word / WORD                          | `yw`, `yW`  |
-| Yank to end of word / WORD                | `ye`, `yE`  |
-| Paste after cursor                        | `p`         |
-| Paste before cursor                       | `P`         |
-
-Delete and change operators also compose with character-find motions, so
-commands such as `dfx`, `dtx`, `cFx`, and `cTx` are supported.
-
 ## Limitations
 
 - On [Windows Terminal](https://en.wikipedia.org/wiki/Windows_Terminal):

docs/reference/policy-engine.md

@@ -71,9 +71,7 @@ primary conditions are the tool's name and its arguments.
 
 #### Tool Name
 
-The `toolName` in the rule must match the name of the tool being called. For a
-complete list of built-in tool names, see the
-[Tools reference](/docs/reference/tools#available-tools).
+The `toolName` in the rule must match the name of the tool being called.
 
 - **Wildcards**: You can use wildcards to match multiple tools.
   - `*`: Matches **any tool** (built-in or MCP).
@@ -89,9 +87,7 @@ complete list of built-in tool names, see the
 
 If `argsPattern` is specified, the tool's arguments are converted to a stable
 JSON string, which is then tested against the provided regular expression. If
-the arguments don't match the pattern, the rule does not apply. For a list of
-argument keys available for each tool, see the **Parameters** in the
-[Tools reference](/docs/reference/tools#available-tools).
+the arguments don't match the pattern, the rule does not apply.
 
 #### Execution environment
 
@@ -283,11 +279,7 @@ directory are **ignored**.
 
 ### TOML rule schema
 
-This section describes the fields available in a TOML policy rule.
-
-For valid built-in `toolName` values and their argument structures (used by
-`argsPattern`), see the
-[Tools reference](/docs/reference/tools#available-tools).
+Here is a breakdown of the fields available in a TOML policy rule:
 
 ```toml
 [[rule]]
@@ -373,9 +365,6 @@ priority = 10
 
 To simplify writing policies for `run_shell_command`, you can use
 `commandPrefix` or `commandRegex` instead of the more complex `argsPattern`.
-These are policy-rule shorthands, not arguments of the `run_shell_command` tool
-itself. For the tool's invocation arguments, see [Shell tool](/docs/tools/shell)
-and [Tools reference](/docs/reference/tools#available-tools).
 
 - `commandPrefix`: Matches if the `command` argument starts with the given
   string.

docs/reference/tools.md

@@ -120,6 +120,7 @@ each tool.
 | :----------------------------------------------- | :------ | :----------------------------------------------------------------------------------- |
 | [`activate_skill`](../tools/activate-skill.md)   | `Other` | Loads specialized procedural expertise from the `.gemini/skills` directory.          |
 | [`get_internal_docs`](../tools/internal-docs.md) | `Think` | Accesses Gemini CLI's own documentation for accurate answers about its capabilities. |
+| [`save_memory`](../tools/memory.md)              | `Think` | Persists specific facts and project details to your `GEMINI.md` file.                |
 
 ### Planning
 
@@ -153,54 +154,6 @@ each tool.
 | [`google_web_search`](../tools/web-search.md) | `Search` | Performs a Google Search to find up-to-date information.                                                                                                                                                                                                                        |
 | [`web_fetch`](../tools/web-fetch.md)          | `Fetch`  | Retrieves and processes content from specific URLs. **Warning:** This tool can access local and private network addresses (for example, localhost), which may pose a security risk if used with untrusted prompts. In Plan Mode, this tool requires explicit user confirmation. |
 
-### Tool argument keys
-
-When writing [`argsPattern`](./policy-engine.md#arguments-pattern) rules for the
-[policy engine](./policy-engine.md), you need to know the JSON argument keys for
-each tool. The following table lists the keys that appear in the JSON
-representation of each tool's arguments.
-
-| Tool                     | JSON argument keys                                                                                                                                                                                   |
-| :----------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `run_shell_command`      | `command`, `description`, `dir_path`, `is_background`                                                                                                                                                |
-| `glob`                   | `pattern`, `dir_path`, `case_sensitive`, `respect_git_ignore`, `respect_gemini_ignore`                                                                                                               |
-| `grep_search`            | `pattern`, `dir_path`, `include_pattern`, `exclude_pattern`, `names_only`, `case_sensitive`, `fixed_strings`, `context`, `after`, `before`, `no_ignore`, `max_matches_per_file`, `total_max_matches` |
-| `list_directory`         | `dir_path`, `ignore`, `file_filtering_options`                                                                                                                                                       |
-| `read_file`              | `file_path`, `start_line`, `end_line`                                                                                                                                                                |
-| `read_many_files`        | `include`, `exclude`, `recursive`, `useDefaultExcludes`                                                                                                                                              |
-| `write_file`             | `file_path`, `content`                                                                                                                                                                               |
-| `replace`                | `file_path`, `old_string`, `new_string`, `instruction`, `allow_multiple`                                                                                                                             |
-| `ask_user`               | `questions` (array of `question`, `header`, `type`, `options`)                                                                                                                                       |
-| `write_todos`            | `todos` (array of `description`, `status`)                                                                                                                                                           |
-| `activate_skill`         | `name`                                                                                                                                                                                               |
-| `get_internal_docs`      | `path`                                                                                                                                                                                               |
-| `enter_plan_mode`        | `reason`                                                                                                                                                                                             |
-| `exit_plan_mode`         | `plan_path`                                                                                                                                                                                          |
-| `tracker_create_task`    | `title`, `description`, `type`                                                                                                                                                                       |
-| `tracker_update_task`    | `id`, `title`, `description`, `status`, `dependencies`                                                                                                                                               |
-| `tracker_get_task`       | `id`                                                                                                                                                                                                 |
-| `tracker_list_tasks`     | `status`, `type`, `parentId`                                                                                                                                                                         |
-| `tracker_add_dependency` | `taskId`, `dependencyId`                                                                                                                                                                             |
-| `tracker_visualize`      | _(none)_                                                                                                                                                                                             |
-| `update_topic`           | `title`, `summary`, `strategic_intent`                                                                                                                                                               |
-| `google_web_search`      | `query`                                                                                                                                                                                              |
-| `web_fetch`              | `prompt`                                                                                                                                                                                             |
-
-For example, to write a policy rule that blocks any `write_file` call targeting
-a `.env` file, you would match against the `file_path` key:
-
-```toml
-[[rule]]
-toolName = "write_file"
-argsPattern = '"file_path":".*\.env"'
-decision = "deny"
-priority = 100
-denyMessage = "Writing to .env files is not allowed."
-```
-
-For full argument descriptions and types, see the individual tool pages linked
-in the [tables above](#available-tools).
-
 ## Under the hood
 
 For developers, the tool system is designed to be extensible and robust. The

docs/releases.md

@@ -8,7 +8,7 @@
 
 Our release flows support both `dev` and `prod` environments.
 
-The `dev` environment pushes to a private GitHub-hosted NPM repository, with the
+The `dev` environment pushes to a private Github-hosted NPM repository, with the
 package names beginning with `@google-gemini/**` instead of `@google/**`.
 
 The `prod` environment pushes to the public global NPM registry via Wombat
@@ -20,7 +20,7 @@ More information can be found about these systems in the
 
 ### Package scopes
 
-| Package    | `prod` (Wombat Dressing Room) | `dev` (GitHub Private NPM Repo)           |
+| Package    | `prod` (Wombat Dressing Room) | `dev` (Github Private NPM Repo)           |
 | ---------- | ----------------------------- | ----------------------------------------- |
 | CLI        | @google/gemini-cli            | @google-gemini/gemini-cli                 |
 | Core       | @google/gemini-cli-core       | @google-gemini/gemini-cli-core A2A Server |

docs/sidebar.json

@@ -27,7 +27,7 @@
             "slug": "docs/cli/tutorials/file-management"
           },
           {
-            "label": "Get started with Agent Skills",
+            "label": "Get started with Agent skills",
             "slug": "docs/cli/tutorials/skills-getting-started"
           },
           {
@@ -95,29 +95,7 @@
               }
             ]
           },
-          {
-            "label": "Agent Skills",
-            "collapsed": true,
-            "items": [
-              { "label": "Overview", "slug": "docs/cli/skills" },
-              {
-                "label": "Get started with Agent Skills",
-                "slug": "docs/cli/tutorials/skills-getting-started"
-              },
-              {
-                "label": "Creating Agent Skills",
-                "slug": "docs/cli/creating-skills"
-              },
-              {
-                "label": "Using Agent Skills",
-                "slug": "docs/cli/using-agent-skills"
-              },
-              {
-                "label": "Developer guide: Best practices",
-                "slug": "docs/cli/skills-best-practices"
-              }
-            ]
-          },
+          { "label": "Agent Skills", "slug": "docs/cli/skills" },
           {
             "label": "Auto Memory",
             "badge": "🔬",

docs/tools/activate-skill.md

@@ -40,4 +40,4 @@ The agent uses this tool to provide professional-grade assistance:
 ## Next steps
 
 - Learn how to [Use Agent Skills](../cli/skills.md).
-- See the [Build agent skills](../cli/creating-skills.md) guide.
+- See the [Creating Agent Skills](../cli/creating-skills.md) guide.

docs/tools/mcp-server.md

@@ -221,10 +221,8 @@ spawning MCP server processes.
 #### Automatic redaction
 
 By default, the CLI redacts sensitive environment variables from the base
-environment (inherited from the host process). This prevents the accidental
-leakage of sensitive host environment variables (like AWS keys or GitHub tokens)
-to arbitrary third-party MCP servers that might execute malicious code or log
-your environment. This includes:
+environment (inherited from the host process) to prevent unintended exposure to
+third-party MCP servers. This includes:
 
 - Core project keys: `GEMINI_API_KEY`, `GOOGLE_API_KEY`, etc.
 - Variables matching sensitive patterns: `*TOKEN*`, `*SECRET*`, `*PASSWORD*`,
@@ -234,8 +232,7 @@ your environment. This includes:
 #### Explicit overrides
 
 If an environment variable must be passed to an MCP server, you must explicitly
-state it in the `env` property of the server configuration in `settings.json`
-(or `mcp_config.json` if configuring standard MCP clients or remote skills).
+state it in the `env` property of the server configuration in `settings.json`.
 Explicitly defined variables (including those from extensions) are trusted and
 are **not** subjected to the automatic redaction process.
 
@@ -250,24 +247,6 @@ specific data with that server.
 > (for example, `"MY_KEY": "$MY_KEY"`) to securely pull the value from your host
 > environment at runtime.
 
-**Example: Passing a GitHub Token securely to the
-[official GitHub MCP server](https://github.com/github/github-mcp-server) via
-`mcp_config.json`**
-
-```json
-{
-  "mcpServers": {
-    "github": {
-      "command": "npx",
-      "args": ["-y", "@github/github-mcp-server"],
-      "env": {
-        "GITHUB_PERSONAL_ACCESS_TOKEN": "$GITHUB_PERSONAL_ACCESS_TOKEN"
-      }
-    }
-  }
-}
-```
-
 ### OAuth support for remote MCP servers
 
 Gemini CLI supports OAuth 2.0 authentication for remote MCP servers using SSE or

docs/tools/memory.md

@@ -1,22 +1,25 @@
-# Memory files
+# Memory tool (`save_memory`)
 
-Gemini CLI persists durable facts, user preferences, and project details by
-editing Markdown memory files directly.
+The `save_memory` tool allows the Gemini agent to persist specific facts, user
+preferences, and project details across sessions.
 
 ## Technical reference
 
-The agent routes memories to the appropriate Markdown file: shared project
-instructions go in repository `GEMINI.md` files, private project notes go in the
-per-project private memory folder, and cross-project personal preferences go in
-the global `~/.gemini/GEMINI.md` file.
+This tool appends information to the `## Gemini Added Memories` section of your
+global `GEMINI.md` file (typically located at `~/.gemini/GEMINI.md`).
+
+### Arguments
+
+- `fact` (string, required): A clear, self-contained statement in natural
+  language.
 
 ## Technical behavior
 
-- **Storage:** Edits Markdown files with `write_file` or `replace`.
+- **Storage:** Appends to the global context file in the user's home directory.
 - **Loading:** The stored facts are automatically included in the hierarchical
   context system for all future sessions.
-- **Format:** Keeps durable instructions concise and avoids duplicating the same
-  fact across multiple memory tiers.
+- **Format:** Saves data as a bulleted list item within a dedicated Markdown
+  section.
 
 ## Use cases
 

docs/tools/shell.md

@@ -19,23 +19,6 @@ platforms, they execute with `bash -c`.
 - `is_background` (boolean, optional): Whether to move the process to the
   background immediately after starting.
 
-### Policy engine shorthands
-
-The [policy engine](../reference/policy-engine.md) provides two convenience
-fields for writing rules that target shell commands:
-
-- `commandPrefix`: Matches if the `command` argument starts with a given string.
-- `commandRegex`: Matches if the `command` argument matches a given regular
-  expression.
-
-These are syntactic sugar for combining `toolName = "run_shell_command"` with an
-`argsPattern` in a policy TOML file. They are **not** arguments of
-`run_shell_command` itself.
-
-For details on writing shell-specific policy rules, see
-[Special syntax for `run_shell_command`](../reference/policy-engine.md#special-syntax-for-run_shell_command)
-in the policy engine reference.
-
 ### Return values
 
 The tool returns a JSON object containing:

eslint.config.js

@@ -54,7 +54,6 @@ export default tseslint.config(
     ignores: [
       '**/node_modules/**',
       'eslint.config.js',
-      '**/coverage/**',
       'packages/**/dist/**',
       'bundle/**',
       'package/bundle/**',

evals/auto_memory_contract.eval.ts

@@ -1,489 +0,0 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-/**
- * Live-LLM evals that pin down the auto-memory inbox contract:
- *   1. Canonical filename — agent uses `.inbox/<kind>/extraction.patch`.
- *   2. Incremental merge — agent rewrites an existing extraction.patch
- *      instead of creating new patch files alongside.
- *   3. Absolute-path pointers — when the agent creates a sibling .md, the
- *      paired MEMORY.md hunk references it by absolute path.
- *   4. Project-root protection — agent never writes to
- *      `<projectRoot>/GEMINI.md` even when content is team-shared.
- *
- * Each test seeds session transcripts with strong, consistent signal so the
- * extraction agent will reasonably produce SOME output (or, in the human-only
- * test, refrain from producing output that targets forbidden paths). Tests
- * are USUALLY_PASSES policy because LLM behavior is stochastic; the harness
- * already retries up to 3 times.
- */
-
-import fsp from 'node:fs/promises';
-import path from 'node:path';
-import { describe, expect } from 'vitest';
-import {
-  type Config,
-  ApprovalMode,
-  SESSION_FILE_PREFIX,
-  getProjectHash,
-  startMemoryService,
-} from '@google/gemini-cli-core';
-import { componentEvalTest } from './component-test-helper.js';
-
-interface SeedSession {
-  sessionId: string;
-  summary: string;
-  userTurns: string[];
-  /** Minutes ago the session ended (must be ≥ 180 to clear the idle gate). */
-  timestampOffsetMinutes: number;
-}
-
-interface MessageRecord {
-  id: string;
-  timestamp: string;
-  type: string;
-  content: Array<{ text: string }>;
-}
-
-const WORKSPACE_FILES = {
-  'package.json': JSON.stringify(
-    {
-      name: 'auto-memory-contract-eval',
-      private: true,
-      scripts: { build: 'echo build', test: 'echo test' },
-    },
-    null,
-    2,
-  ),
-  'README.md': '# Auto Memory Contract Eval\n\nFixture workspace.\n',
-};
-
-const EXTRACTION_CONFIG_OVERRIDES = {
-  experimentalAutoMemory: true,
-  approvalMode: ApprovalMode.YOLO,
-};
-
-function buildMessages(userTurns: string[]): MessageRecord[] {
-  const baseTime = new Date(Date.now() - 6 * 60 * 60 * 1000).toISOString();
-  return userTurns.flatMap((text, index) => [
-    {
-      id: `u${index + 1}`,
-      timestamp: baseTime,
-      type: 'user',
-      content: [{ text }],
-    },
-    {
-      id: `a${index + 1}`,
-      timestamp: baseTime,
-      type: 'gemini',
-      content: [{ text: 'Acknowledged.' }],
-    },
-  ]);
-}
-
-async function seedSessions(
-  config: Config,
-  sessions: SeedSession[],
-): Promise<void> {
-  const chatsDir = path.join(config.storage.getProjectTempDir(), 'chats');
-  await fsp.mkdir(chatsDir, { recursive: true });
-  const projectRoot = config.storage.getProjectRoot();
-
-  for (const session of sessions) {
-    const sessionTimestamp = new Date(
-      Date.now() - session.timestampOffsetMinutes * 60 * 1000,
-    );
-    const timestamp = sessionTimestamp
-      .toISOString()
-      .slice(0, 16)
-      .replace(/:/g, '-');
-    const filename = `${SESSION_FILE_PREFIX}${timestamp}-${session.sessionId.slice(0, 8)}.json`;
-    const conversation = {
-      sessionId: session.sessionId,
-      projectHash: getProjectHash(projectRoot),
-      summary: session.summary,
-      startTime: new Date(Date.now() - 7 * 60 * 60 * 1000).toISOString(),
-      lastUpdated: sessionTimestamp.toISOString(),
-      messages: buildMessages(session.userTurns),
-    };
-    await fsp.writeFile(
-      path.join(chatsDir, filename),
-      JSON.stringify(conversation, null, 2),
-    );
-  }
-}
-
-interface InboxSnapshot {
-  privateFiles: string[];
-  globalFiles: string[];
-  privateContents: Map<string, string>;
-}
-
-async function snapshotInbox(config: Config): Promise<InboxSnapshot> {
-  const memoryDir = config.storage.getProjectMemoryTempDir();
-  const inbox: InboxSnapshot = {
-    privateFiles: [],
-    globalFiles: [],
-    privateContents: new Map(),
-  };
-  for (const kind of ['private', 'global'] as const) {
-    const dir = path.join(memoryDir, '.inbox', kind);
-    let entries: string[];
-    try {
-      entries = await fsp.readdir(dir);
-    } catch {
-      continue;
-    }
-    const patchFiles = entries.filter((f) => f.endsWith('.patch')).sort();
-    if (kind === 'private') {
-      inbox.privateFiles = patchFiles;
-      for (const fileName of patchFiles) {
-        try {
-          inbox.privateContents.set(
-            fileName,
-            await fsp.readFile(path.join(dir, fileName), 'utf-8'),
-          );
-        } catch {
-          // ignore
-        }
-      }
-    } else {
-      inbox.globalFiles = patchFiles;
-    }
-  }
-  return inbox;
-}
-
-describe('Auto Memory Contract', () => {
-  componentEvalTest('USUALLY_PASSES', {
-    suiteName: 'auto-memory-contract',
-    suiteType: 'component-level',
-    name: 'uses canonical extraction.patch filename when writing private memory',
-    files: WORKSPACE_FILES,
-    timeout: 240000,
-    configOverrides: EXTRACTION_CONFIG_OVERRIDES,
-    setup: async (config) => {
-      await seedSessions(config, [
-        {
-          sessionId: 'verify-memory-cmd-1',
-          summary:
-            'Confirm that this project verifies memory edits with `npm run verify:memory`',
-          timestampOffsetMinutes: 420,
-          userTurns: [
-            'For this project, every memory-system change is verified with `npm run verify:memory` before we hand the change back.',
-            'That command is the gate. Without it the change is not considered done.',
-            'It runs typechecks, the related unit tests, and a snapshot diff.',
-            'Future agents working on memory should always run it after editing memoryService or commands/memory.ts.',
-            'This is a durable rule for this project, not a one-off.',
-            'The check is fast, under a minute, and failure means revert.',
-            'Treat it as part of the memory subsystem contract.',
-            'I want this remembered for next time.',
-            'It applies to anything in packages/core/src/services/memoryService.ts and packages/core/src/commands/memory.ts.',
-            'Make sure agents do not skip the verify step.',
-          ],
-        },
-        {
-          sessionId: 'verify-memory-cmd-2',
-          summary: 'Same memory-verify command in another session',
-          timestampOffsetMinutes: 360,
-          userTurns: [
-            'I had to remind the previous agent to run `npm run verify:memory` again.',
-            'It is the durable verification command for memory edits in this repo.',
-            'The agent forgot, even though we agreed last time.',
-            'Please remember it for future memory-related work.',
-            'It is the official verification step for memory changes.',
-            'Run it whenever you touch memoryService.ts or commands/memory.ts.',
-            'No exceptions. The command must finish green.',
-            'This is a recurring rule across multiple sessions now.',
-            'Make this part of your standard workflow for memory work.',
-            'Verified again that the command catches regressions in MEMORY.md handling.',
-          ],
-        },
-      ]);
-    },
-    assert: async (config) => {
-      await startMemoryService(config);
-      const inbox = await snapshotInbox(config);
-
-      // Either the agent extracted nothing (acceptable no-op) OR it extracted
-      // exactly one canonical file per kind. Multiple files per kind violates
-      // the contract.
-      expect(inbox.privateFiles.length).toBeLessThanOrEqual(1);
-      expect(inbox.globalFiles.length).toBeLessThanOrEqual(1);
-
-      // Strong assertion: when the agent DID write a private patch, it must
-      // be the canonical filename.
-      if (inbox.privateFiles.length === 1) {
-        expect(inbox.privateFiles[0]).toBe('extraction.patch');
-      }
-      if (inbox.globalFiles.length === 1) {
-        expect(inbox.globalFiles[0]).toBe('extraction.patch');
-      }
-    },
-  });
-
-  componentEvalTest('USUALLY_PASSES', {
-    suiteName: 'auto-memory-contract',
-    suiteType: 'component-level',
-    name: 'merges new findings into existing extraction.patch instead of creating new files',
-    files: WORKSPACE_FILES,
-    timeout: 240000,
-    configOverrides: EXTRACTION_CONFIG_OVERRIDES,
-    setup: async (config) => {
-      const memoryDir = config.storage.getProjectMemoryTempDir();
-      const inboxPrivate = path.join(memoryDir, '.inbox', 'private');
-      await fsp.mkdir(inboxPrivate, { recursive: true });
-
-      // Pre-existing canonical patch left over from a prior session.
-      const existingMemoryMd = path.join(memoryDir, 'MEMORY.md');
-      const preExistingPatch = [
-        `--- /dev/null`,
-        `+++ ${existingMemoryMd}`,
-        `@@ -0,0 +1,3 @@`,
-        `+# Project Memory`,
-        `+`,
-        `+- This project lints with \`npm run lint\` (recurring rule from session 1).`,
-        ``,
-      ].join('\n');
-      await fsp.writeFile(
-        path.join(inboxPrivate, 'extraction.patch'),
-        preExistingPatch,
-      );
-
-      // New session that surfaces a different durable fact.
-      await seedSessions(config, [
-        {
-          sessionId: 'incremental-typecheck-cmd',
-          summary:
-            'Confirm that typecheck for memory edits uses `npm run typecheck`',
-          timestampOffsetMinutes: 420,
-          userTurns: [
-            'Always run `npm run typecheck` after editing any *.ts file in this repo.',
-            'It is the standard typecheck command for the whole monorepo.',
-            'Future agents should follow this without being reminded.',
-            'It catches type errors before tests, much faster.',
-            'Run it on every TypeScript edit, no exceptions.',
-            'This is durable across the whole project.',
-            'It is the project-wide convention for TS work.',
-            'Make sure to run it after edits to memoryService.ts especially.',
-            'It is fast and catches regressions early.',
-            'Treat it as standard workflow.',
-          ],
-        },
-      ]);
-    },
-    assert: async (config) => {
-      await startMemoryService(config);
-      const inbox = await snapshotInbox(config);
-
-      // Contract: still ONLY ONE file in private inbox, and its name is the
-      // canonical extraction.patch.
-      expect(inbox.privateFiles).toEqual(['extraction.patch']);
-
-      // The single canonical patch must STILL contain the old hunk (the
-      // agent must merge with existing rather than replace blindly), AND
-      // ideally also contain the new typecheck fact.
-      const merged = inbox.privateContents.get('extraction.patch') ?? '';
-      expect(merged).toMatch(/npm run lint/);
-      // Soft assertion: the agent SHOULD have added the new fact too. We
-      // don't fail the test if it didn't (the agent may legitimately decide
-      // the new fact isn't durable enough), but the file must be intact.
-      // The hard assertion (no proliferation + old content preserved) is
-      // what we lock down.
-    },
-  });
-
-  componentEvalTest('USUALLY_PASSES', {
-    suiteName: 'auto-memory-contract',
-    suiteType: 'component-level',
-    name: 'uses absolute paths in MEMORY.md sibling pointer lines',
-    files: WORKSPACE_FILES,
-    timeout: 240000,
-    configOverrides: EXTRACTION_CONFIG_OVERRIDES,
-    setup: async (config) => {
-      // Sessions whose extracted memory has substantial detail — encourages
-      // the agent to spawn a sibling .md file (per prompt guidance).
-      await seedSessions(config, [
-        {
-          sessionId: 'detailed-release-workflow-1',
-          summary: 'Detailed release workflow that runs across multiple steps',
-          timestampOffsetMinutes: 420,
-          userTurns: [
-            'Our release workflow has several distinct phases that future agents need to follow exactly.',
-            'Phase 1 (preflight): run `npm run lint`, `npm run typecheck`, and `npm test` in that order.',
-            'Phase 2 (build): run `npm run build` and verify dist/ outputs against a checksum file.',
-            'Phase 3 (publish): run `npm run publish:dry-run` first, then `npm run publish` if no errors.',
-            'Phase 4 (post): tag the commit with `git tag v$(jq -r .version package.json)` and push.',
-            'There are pitfalls: phase 2 will silently succeed if dist/ is stale, so always check the checksum.',
-            'Phase 3 must NEVER be skipped for hotfixes; the dry-run catches credential issues.',
-            'The checklist is durable across all releases for this repo.',
-            'Future agents should reproduce these phases in order without omitting any.',
-            'This is the canonical release procedure for this project.',
-          ],
-        },
-        {
-          sessionId: 'detailed-release-workflow-2',
-          summary: 'Reusing the same multi-phase release workflow',
-          timestampOffsetMinutes: 360,
-          userTurns: [
-            'I just ran the release workflow again and it caught an issue in phase 2 because the checksum mismatched.',
-            'Confirms the durable rule: always check the dist/ checksum after building.',
-            'The 4-phase release procedure (preflight, build, publish, post) is the recurring workflow.',
-            'I want this captured as durable memory because we use it every release.',
-            'Each phase has multiple sub-steps and pitfalls, so it deserves substantial detail.',
-            'Please remember the phases for future agents.',
-            'The procedure has been the same for the last 6 releases.',
-            'It includes the verify-checksum step that just saved us from a bad publish.',
-            'This is a recurring multi-step workflow, not a one-off.',
-            'Make sure future sessions know about all 4 phases and their pitfalls.',
-          ],
-        },
-      ]);
-    },
-    assert: async (config) => {
-      await startMemoryService(config);
-      const inbox = await snapshotInbox(config);
-      const memoryDir = config.storage.getProjectMemoryTempDir();
-
-      // The agent might choose to add brief facts directly to MEMORY.md
-      // without spawning a sibling. That's a valid outcome; we only enforce
-      // the absolute-path rule WHEN a sibling is created.
-      if (inbox.privateFiles.length === 0) {
-        return; // No-op extraction: nothing to assert.
-      }
-      expect(inbox.privateFiles).toEqual(['extraction.patch']);
-
-      const patch = inbox.privateContents.get('extraction.patch') ?? '';
-
-      // Find any /dev/null sibling-creation hunk that targets <memoryDir>/<x>.md
-      // (where x != MEMORY).
-      const siblingPattern = new RegExp(
-        `\\+\\+\\+ ${memoryDir.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')}/([^\\s/]+)\\.md`,
-        'g',
-      );
-      const siblingTargets: string[] = [];
-      let match: RegExpExecArray | null;
-      while ((match = siblingPattern.exec(patch)) !== null) {
-        const name = match[1];
-        // Skip MEMORY.md updates (those aren't siblings).
-        if (name.toLowerCase() !== 'memory') {
-          siblingTargets.push(`${name}.md`);
-        }
-      }
-
-      if (siblingTargets.length === 0) {
-        return; // No sibling creations; nothing more to check.
-      }
-
-      // For each created sibling, the patch must contain a MEMORY.md
-      // pointer line that uses the ABSOLUTE path. Bare basename references
-      // are the bug we're guarding against.
-      for (const sibling of siblingTargets) {
-        const absolutePath = path.join(memoryDir, sibling);
-        // Look for an added line referencing the sibling.
-        const addedLines = patch
-          .split('\n')
-          .filter((line) => line.startsWith('+'));
-        const referencingLines = addedLines.filter((line) =>
-          line.includes(sibling),
-        );
-        expect(
-          referencingLines.length,
-          `Expected a MEMORY.md pointer for ${sibling} (auto-bundle would also add one).`,
-        ).toBeGreaterThan(0);
-        const allAbsolute = referencingLines.every((line) =>
-          line.includes(absolutePath),
-        );
-        expect(
-          allAbsolute,
-          `Pointer for ${sibling} must use absolute path. Saw: ${referencingLines.join(' | ')}`,
-        ).toBe(true);
-      }
-    },
-  });
-
-  componentEvalTest('USUALLY_PASSES', {
-    suiteName: 'auto-memory-contract',
-    suiteType: 'component-level',
-    name: 'never writes to <projectRoot>/GEMINI.md even for team-shared facts',
-    files: WORKSPACE_FILES,
-    timeout: 240000,
-    configOverrides: EXTRACTION_CONFIG_OVERRIDES,
-    setup: async (config) => {
-      // Sessions that talk about TEAM CONVENTIONS — the kind of content that
-      // would be a perfect fit for <projectRoot>/GEMINI.md, but the prompt
-      // forbids the extraction agent from touching it.
-      await seedSessions(config, [
-        {
-          sessionId: 'team-convention-pnpm-1',
-          summary: 'Team convention: always use pnpm not npm for installs',
-          timestampOffsetMinutes: 420,
-          userTurns: [
-            'Important team-wide convention for this repo: always use pnpm for installs, never npm.',
-            'This is a shared rule across all engineers on the project.',
-            'It applies to every package install, every clean, every dependency add.',
-            'The rationale is workspace hoisting; npm would break the monorepo layout.',
-            'This is a durable team rule, committed to the repo conventions.',
-            'Future agents working in this repo should ALWAYS use pnpm.',
-            'It is the standard team practice, no exceptions.',
-            'Document it as part of the project conventions.',
-            'Treat it as a hard rule for the team.',
-            'I want this captured for future sessions.',
-          ],
-        },
-        {
-          sessionId: 'team-convention-pnpm-2',
-          summary: 'Reaffirming the pnpm-only team rule in another session',
-          timestampOffsetMinutes: 360,
-          userTurns: [
-            'Reminder again: this team uses pnpm exclusively, never npm.',
-            'Another agent tried npm install and broke the lockfile.',
-            'The team rule is clear: pnpm only for any install operation.',
-            'It is part of our shared conventions for this codebase.',
-            'Make sure future agents follow this team-wide rule.',
-            'It applies to all engineers, all CI runs, all dev environments.',
-            'The convention is durable and well-established for this repo.',
-            'Agents should read this rule from project conventions before installing.',
-            'No future agent should ever invoke `npm install` in this repo.',
-            'Always pnpm. Always.',
-          ],
-        },
-      ]);
-    },
-    assert: async (config) => {
-      await startMemoryService(config);
-      const inbox = await snapshotInbox(config);
-      const projectRoot = config.storage.getProjectRoot();
-
-      // No private patch should target <projectRoot>/GEMINI.md or any
-      // subdirectory GEMINI.md.
-      const projectRootRegex = new RegExp(
-        `\\+\\+\\+ ${projectRoot.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')}.*GEMINI\\.md`,
-      );
-      for (const [name, content] of inbox.privateContents) {
-        expect(
-          projectRootRegex.test(content),
-          `Private patch "${name}" must not target a GEMINI.md under <projectRoot>. Content:\n${content}`,
-        ).toBe(false);
-      }
-
-      // Verify on disk: <projectRoot>/GEMINI.md was not created or modified
-      // by the extraction agent (snapshot rollback should also enforce this,
-      // but we double-check from the post-run state).
-      const projectGemini = path.join(projectRoot, 'GEMINI.md');
-      const exists = await fsp
-        .access(projectGemini)
-        .then(() => true)
-        .catch(() => false);
-      // The seeded workspace's WORKSPACE_FILES doesn't include GEMINI.md, so
-      // it must NOT exist after the run.
-      expect(
-        exists,
-        `<projectRoot>/GEMINI.md (${projectGemini}) must not be created by the extraction agent.`,
-      ).toBe(false);
-    },
-  });
-});

evals/auto_memory_modes.eval.ts

@@ -1,447 +0,0 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import os from 'node:os';
-import { afterEach, beforeEach, describe, expect, vi } from 'vitest';
-import { runEval } from './test-helper.js';
-import { SESSION_FILE_PREFIX } from '../packages/core/src/services/chatRecordingService.js';
-
-const evalState = vi.hoisted(() => ({
-  sessionFilePath: '',
-  debugLines: [] as string[],
-}));
-
-const mocks = vi.hoisted(() => ({
-  localAgentCreate: vi.fn(),
-}));
-
-vi.mock('../packages/core/src/agents/local-executor.js', () => ({
-  LocalAgentExecutor: {
-    create: mocks.localAgentCreate,
-  },
-}));
-
-vi.mock('../packages/core/src/agents/local-executor.ts', () => ({
-  LocalAgentExecutor: {
-    create: mocks.localAgentCreate,
-  },
-}));
-
-vi.mock('../packages/core/src/agents/local-executor', () => ({
-  LocalAgentExecutor: {
-    create: mocks.localAgentCreate,
-  },
-}));
-
-vi.mock('../packages/core/src/services/executionLifecycleService.js', () => ({
-  ExecutionLifecycleService: {
-    createExecution: vi.fn().mockReturnValue({ pid: 1001, result: {} }),
-    completeExecution: vi.fn(),
-  },
-}));
-
-vi.mock('../packages/core/src/services/executionLifecycleService.ts', () => ({
-  ExecutionLifecycleService: {
-    createExecution: vi.fn().mockReturnValue({ pid: 1001, result: {} }),
-    completeExecution: vi.fn(),
-  },
-}));
-
-vi.mock('../packages/core/src/services/executionLifecycleService', () => ({
-  ExecutionLifecycleService: {
-    createExecution: vi.fn().mockReturnValue({ pid: 1001, result: {} }),
-    completeExecution: vi.fn(),
-  },
-}));
-
-vi.mock('../packages/core/src/utils/debugLogger.js', () => ({
-  debugLogger: {
-    debug: (...args: unknown[]) =>
-      evalState.debugLines.push(args.map(String).join(' ')),
-    log: (...args: unknown[]) =>
-      evalState.debugLines.push(args.map(String).join(' ')),
-    warn: (...args: unknown[]) =>
-      evalState.debugLines.push(args.map(String).join(' ')),
-    error: (...args: unknown[]) =>
-      evalState.debugLines.push(args.map(String).join(' ')),
-  },
-}));
-
-vi.mock('../packages/core/src/utils/debugLogger.ts', () => ({
-  debugLogger: {
-    debug: (...args: unknown[]) =>
-      evalState.debugLines.push(args.map(String).join(' ')),
-    log: (...args: unknown[]) =>
-      evalState.debugLines.push(args.map(String).join(' ')),
-    warn: (...args: unknown[]) =>
-      evalState.debugLines.push(args.map(String).join(' ')),
-    error: (...args: unknown[]) =>
-      evalState.debugLines.push(args.map(String).join(' ')),
-  },
-}));
-
-vi.mock('../packages/core/src/utils/debugLogger', () => ({
-  debugLogger: {
-    debug: (...args: unknown[]) =>
-      evalState.debugLines.push(args.map(String).join(' ')),
-    log: (...args: unknown[]) =>
-      evalState.debugLines.push(args.map(String).join(' ')),
-    warn: (...args: unknown[]) =>
-      evalState.debugLines.push(args.map(String).join(' ')),
-    error: (...args: unknown[]) =>
-      evalState.debugLines.push(args.map(String).join(' ')),
-  },
-}));
-
-interface MockMemoryConfig {
-  storage: {
-    getProjectMemoryDir: () => string;
-    getProjectMemoryTempDir: () => string;
-    getProjectSkillsMemoryDir: () => string;
-    getProjectTempDir: () => string;
-    getProjectRoot: () => string;
-  };
-  getTargetDir: () => string;
-  getToolRegistry: () => unknown;
-  getGeminiClient: () => unknown;
-  getSkillManager: () => { getSkills: () => unknown[] };
-  isAutoMemoryEnabled: () => boolean;
-  modelConfigService: {
-    registerRuntimeModelConfig: ReturnType<typeof vi.fn>;
-  };
-  sandboxManager: undefined;
-}
-
-interface Fixture {
-  rootDir: string;
-  homeDir: string;
-  targetDir: string;
-  projectTempDir: string;
-  memoryDir: string;
-  skillsDir: string;
-  config: MockMemoryConfig;
-}
-
-interface AutoMemoryRunSnapshot {
-  sessionIds?: string[];
-  memoryCandidatesCreated?: string[];
-  memoryFilesUpdated?: string[];
-  skillsCreated?: string[];
-}
-
-const fixtures: Fixture[] = [];
-
-beforeEach(() => {
-  vi.resetModules();
-  evalState.debugLines = [];
-  evalState.sessionFilePath = '';
-  mocks.localAgentCreate.mockReset();
-  mocks.localAgentCreate.mockImplementation(
-    async (_agent, context, onActivity) => ({
-      run: vi.fn().mockImplementation(async () => {
-        if (evalState.sessionFilePath) {
-          const callId = `read-inbox-routing`;
-          onActivity({
-            isSubagentActivityEvent: true,
-            agentName: 'auto-memory-eval',
-            type: 'TOOL_CALL_START',
-            data: {
-              name: 'read_file',
-              callId,
-              args: { file_path: evalState.sessionFilePath },
-            },
-          });
-          onActivity({
-            isSubagentActivityEvent: true,
-            agentName: 'auto-memory-eval',
-            type: 'TOOL_CALL_END',
-            data: { id: callId, data: { isError: false } },
-          });
-        }
-
-        const config = context.config as MockMemoryConfig;
-        const memoryDir = config.storage.getProjectMemoryTempDir();
-        const inboxDir = path.join(memoryDir, '.inbox');
-
-        const homeDir = process.env['GEMINI_CLI_HOME'] ?? os.homedir();
-        const globalGeminiDir = path.join(homeDir, '.gemini');
-
-        await fs.mkdir(path.join(inboxDir, 'private'), { recursive: true });
-        await fs.mkdir(path.join(inboxDir, 'global'), { recursive: true });
-
-        const privateTarget = path.join(memoryDir, 'verify-memory.md');
-        await fs.writeFile(
-          path.join(inboxDir, 'private', 'verify-memory.patch'),
-          [
-            `--- /dev/null`,
-            `+++ ${privateTarget}`,
-            `@@ -0,0 +1,3 @@`,
-            `+# Project Memory Candidate`,
-            `+`,
-            `+Future agents should remember that this project verifies memory changes with \`npm run verify:memory\`.`,
-            ``,
-          ].join('\n'),
-        );
-
-        const globalTarget = path.join(globalGeminiDir, 'GEMINI.md');
-        await fs.writeFile(
-          path.join(inboxDir, 'global', 'reply-style.patch'),
-          [
-            `--- /dev/null`,
-            `+++ ${globalTarget}`,
-            `@@ -0,0 +1,1 @@`,
-            `+User prefers concise Chinese architecture plans.`,
-            ``,
-          ].join('\n'),
-        );
-
-        return {
-          turn_count: 3,
-          duration_ms: 25,
-          terminate_reason: 'GOAL',
-        };
-      }),
-    }),
-  );
-});
-
-afterEach(async () => {
-  vi.unstubAllEnvs();
-  while (fixtures.length > 0) {
-    const fixture = fixtures.pop();
-    if (fixture) {
-      await fs.rm(fixture.rootDir, { recursive: true, force: true });
-    }
-  }
-});
-
-function autoMemoryEval(name: string, fn: () => Promise<void>): void {
-  runEval(
-    'USUALLY_PASSES',
-    {
-      suiteName: 'auto-memory-modes',
-      suiteType: 'component-level',
-      name,
-      timeout: 30000,
-    },
-    fn,
-    40000,
-  );
-}
-
-async function createFixture(): Promise<Fixture> {
-  const rootDir = await fs.mkdtemp(
-    path.join(os.tmpdir(), 'gemini-auto-memory-eval-'),
-  );
-  const homeDir = path.join(rootDir, 'home');
-  const targetDir = path.join(rootDir, 'workspace');
-  const projectTempDir = path.join(rootDir, 'project-temp');
-  const memoryDir = path.join(projectTempDir, 'memory');
-  const skillsDir = path.join(memoryDir, 'skills');
-
-  await fs.mkdir(homeDir, { recursive: true });
-  await fs.mkdir(targetDir, { recursive: true });
-  await fs.mkdir(path.join(projectTempDir, 'chats'), { recursive: true });
-  vi.stubEnv('GEMINI_CLI_HOME', homeDir);
-
-  const config: MockMemoryConfig = {
-    storage: {
-      getProjectMemoryDir: () => memoryDir,
-      getProjectMemoryTempDir: () => memoryDir,
-      getProjectSkillsMemoryDir: () => skillsDir,
-      getProjectTempDir: () => projectTempDir,
-      getProjectRoot: () => targetDir,
-    },
-    getTargetDir: () => targetDir,
-    getToolRegistry: () => ({}),
-    getGeminiClient: () => ({}),
-    getSkillManager: () => ({ getSkills: () => [] }),
-    isAutoMemoryEnabled: () => true,
-    modelConfigService: {
-      registerRuntimeModelConfig: vi.fn(),
-    },
-    sandboxManager: undefined,
-  };
-
-  const fixture = {
-    rootDir,
-    homeDir,
-    targetDir,
-    projectTempDir,
-    memoryDir,
-    skillsDir,
-    config,
-  };
-  fixtures.push(fixture);
-  return fixture;
-}
-
-async function seedSession(
-  fixture: Fixture,
-  sessionId: string,
-): Promise<string> {
-  const sessionFilePath = path.join(
-    fixture.projectTempDir,
-    'chats',
-    `${SESSION_FILE_PREFIX}2026-04-20T10-00-${sessionId}.json`,
-  );
-  const oldTimestamp = new Date(Date.now() - 4 * 60 * 60 * 1000).toISOString();
-  const messages = Array.from({ length: 20 }, (_, index) => ({
-    id: `m${index + 1}`,
-    timestamp: oldTimestamp,
-    type: index % 2 === 0 ? 'user' : 'gemini',
-    content: [
-      {
-        text:
-          index % 2 === 0
-            ? 'For this project, durable memory changes are verified with `npm run verify:memory`.'
-            : 'Acknowledged.',
-      },
-    ],
-  }));
-
-  await fs.writeFile(
-    sessionFilePath,
-    [
-      {
-        sessionId,
-        projectHash: 'auto-memory-eval',
-        summary: 'Capture durable auto memory routing behavior',
-        startTime: oldTimestamp,
-        lastUpdated: oldTimestamp,
-        kind: 'main',
-      },
-      ...messages,
-    ]
-      .map((record) => JSON.stringify(record))
-      .join('\n') + '\n',
-  );
-
-  return sessionFilePath;
-}
-
-async function expectSeedSessionEligible(
-  fixture: Fixture,
-  sessionId: string,
-): Promise<void> {
-  const { buildSessionIndex } = await import(
-    '../packages/core/src/services/memoryService.js'
-  );
-  const { newSessionIds } = await buildSessionIndex(
-    path.join(fixture.projectTempDir, 'chats'),
-    { runs: [] },
-  );
-  expect(newSessionIds).toContain(sessionId);
-}
-
-async function readRun(fixture: Fixture): Promise<AutoMemoryRunSnapshot> {
-  const statePath = path.join(fixture.memoryDir, '.extraction-state.json');
-  let raw: string;
-  try {
-    raw = await fs.readFile(statePath, 'utf-8');
-  } catch (error) {
-    let memoryEntries = '(memory dir missing)';
-    try {
-      memoryEntries = (await fs.readdir(fixture.memoryDir, { recursive: true }))
-        .map(String)
-        .join('\n');
-    } catch {
-      // Leave default diagnostic.
-    }
-    throw new Error(
-      [
-        `Expected extraction state at ${statePath}.`,
-        `LocalAgentExecutor.create calls: ${mocks.localAgentCreate.mock.calls.length}`,
-        `Memory dir entries:\n${memoryEntries}`,
-        `Debug log:\n${evalState.debugLines.join('\n')}`,
-      ].join('\n'),
-      { cause: error },
-    );
-  }
-  const state = JSON.parse(raw) as {
-    runs?: AutoMemoryRunSnapshot[];
-  };
-  const run = state.runs?.at(-1);
-  if (!run) {
-    throw new Error('Expected an auto memory extraction run to be recorded');
-  }
-  return run;
-}
-
-async function fileExists(filePath: string): Promise<boolean> {
-  try {
-    await fs.access(filePath);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-describe('Auto Memory inbox routing', () => {
-  autoMemoryEval(
-    'every memory patch lands in .inbox/<kind>/ for review and active files stay untouched',
-    async () => {
-      const { startMemoryService } = await import(
-        '../packages/core/src/services/memoryService.js'
-      );
-      const fixture = await createFixture();
-      evalState.sessionFilePath = await seedSession(
-        fixture,
-        'inbox-routing-session',
-      );
-      await expectSeedSessionEligible(fixture, 'inbox-routing-session');
-
-      await startMemoryService(fixture.config as never);
-
-      const privatePatchPath = path.join(
-        fixture.memoryDir,
-        '.inbox',
-        'private',
-        'verify-memory.patch',
-      );
-      const globalPatchPath = path.join(
-        fixture.memoryDir,
-        '.inbox',
-        'global',
-        'reply-style.patch',
-      );
-
-      const activePrivateMemoryPath = path.join(
-        fixture.memoryDir,
-        'verify-memory.md',
-      );
-      const activeGlobalMemoryPath = path.join(
-        fixture.homeDir,
-        '.gemini',
-        'GEMINI.md',
-      );
-      const run = await readRun(fixture);
-
-      // Both patches were written to the inbox.
-      await expect(fs.readFile(privatePatchPath, 'utf-8')).resolves.toContain(
-        'npm run verify:memory',
-      );
-      await expect(fs.readFile(globalPatchPath, 'utf-8')).resolves.toContain(
-        'concise Chinese architecture plans',
-      );
-
-      // No active file was touched — every patch must be reviewed manually.
-      expect(await fileExists(activePrivateMemoryPath)).toBe(false);
-      expect(await fileExists(activeGlobalMemoryPath)).toBe(false);
-
-      // Run state records both patches as candidates and zero applied files.
-      expect(run.memoryFilesUpdated ?? []).toEqual([]);
-      expect(run.memoryCandidatesCreated ?? []).toEqual(
-        expect.arrayContaining([
-          path.relative(fixture.memoryDir, privatePatchPath),
-          path.relative(fixture.memoryDir, globalPatchPath),
-        ]),
-      );
-    },
-  );
-});

evals/file_creation_behavior.eval.ts

@@ -1,132 +0,0 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-import { describe, expect } from 'vitest';
-import { evalTest } from './test-helper.js';
-
-describe('file_creation_behavior', () => {
-  evalTest('USUALLY_PASSES', {
-    suiteName: 'default',
-    suiteType: 'behavioral',
-    name: 'should create a new file in the correct directory when asked',
-    files: {
-      'package.json': JSON.stringify({
-        name: 'test-project',
-        version: '1.0.0',
-        type: 'module',
-      }),
-      'src/index.ts': 'console.log("hello");',
-    },
-    prompt:
-      'Please create a new file called src/logger.ts containing a simple logging class. Do not modify any existing files.',
-    assert: async (rig) => {
-      // 1) Verify write_file tool was called
-      const logs = rig.readToolLogs();
-      const writeFileCalls = logs.filter(
-        (log) => log.toolRequest?.name === 'write_file',
-      );
-      expect(
-        writeFileCalls.length,
-        'Expected a write_file call to create the new file',
-      ).toBeGreaterThanOrEqual(1);
-
-      // 2) Verify existing files were not modified
-      const indexContent = rig.readFile('src/index.ts');
-      expect(indexContent).toBe('console.log("hello");');
-
-      const pkgContent = rig.readFile('package.json');
-      expect(JSON.parse(pkgContent).name).toBe('test-project');
-
-      // 3) Verify new file is created
-      const loggerContent = rig.readFile('src/logger.ts');
-      expect(loggerContent.length).toBeGreaterThan(0);
-    },
-  });
-
-  evalTest('USUALLY_PASSES', {
-    suiteName: 'default',
-    suiteType: 'behavioral',
-    name: 'should not overwrite existing file when creating new file with same name',
-    files: {
-      'package.json': JSON.stringify({
-        name: 'test-project',
-        version: '1.0.0',
-        type: 'module',
-      }),
-      'config.json': JSON.stringify({ port: 3000, env: 'production' }),
-    },
-    prompt:
-      "Please create a new configuration file called config.json in the workspace. Ensure the port is set to 8080. Since there's already a config file there, make sure to check it first before making changes.",
-    assert: async (rig) => {
-      // Verify that read_file was called on config.json before write_file
-      const logs = rig.readToolLogs();
-      const targetReadFileIndex = logs.findIndex((log) => {
-        if (log.toolRequest?.name !== 'read_file') return false;
-        try {
-          const args =
-            typeof log.toolRequest.args === 'string'
-              ? JSON.parse(log.toolRequest.args)
-              : log.toolRequest.args;
-          return args.file_path === 'config.json';
-        } catch {
-          return false;
-        }
-      });
-
-      const targetWriteFileIndex = logs.findIndex((log) => {
-        if (log.toolRequest?.name !== 'write_file') return false;
-        try {
-          const args =
-            typeof log.toolRequest.args === 'string'
-              ? JSON.parse(log.toolRequest.args)
-              : log.toolRequest.args;
-          return args.file_path === 'config.json';
-        } catch {
-          return false;
-        }
-      });
-
-      expect(
-        targetReadFileIndex,
-        'Expected read_file to be called to inspect config.json before overwriting it',
-      ).toBeGreaterThanOrEqual(0);
-
-      if (targetWriteFileIndex !== -1) {
-        expect(
-          targetReadFileIndex,
-          'Expected read_file to be invoked before write_file for safety',
-        ).toBeLessThan(targetWriteFileIndex);
-      }
-
-      // Also check the resulting config.json content
-      const configContent = rig.readFile('config.json');
-      expect(configContent).toContain('8080');
-    },
-  });
-
-  evalTest('USUALLY_PASSES', {
-    suiteName: 'default',
-    suiteType: 'behavioral',
-    name: 'should scaffold multiple related files in correct locations',
-    files: {
-      'package.json': JSON.stringify({
-        name: 'test-project',
-        version: '1.0.0',
-        type: 'module',
-      }),
-    },
-    prompt:
-      'Please scaffold auth validation and types by creating two new files: src/auth/validator.ts and src/auth/types.ts with relevant exports. Do not modify existing files.',
-    assert: async (rig) => {
-      // Verify files are created in right place
-      const validatorContent = rig.readFile('src/auth/validator.ts');
-      const typesContent = rig.readFile('src/auth/types.ts');
-
-      expect(validatorContent.length).toBeGreaterThan(0);
-      expect(typesContent.length).toBeGreaterThan(0);
-    },
-  });
-});

evals/gitRepo.eval.ts

@@ -78,37 +78,4 @@ describe('git repo eval', () => {
       expect(commitCalls.length).toBeGreaterThanOrEqual(1);
     },
   });
-
-  /**
-   * Ensures that when the agent is prompted to commit its changes, it does not
-   * use `git add .` or `git add -A`.
-   */
-  evalTest('USUALLY_PASSES', {
-    suiteName: 'default',
-    suiteType: 'behavioral',
-    name: 'should not stage changes via git add . when prompted to commit',
-    prompt:
-      'Make a targeted fix for the bug in index.ts without building, installing anything, or adding tests. Then, stage and commit your changes.',
-    files: FILES,
-    assert: async (rig, _result) => {
-      const toolLogs = rig.readToolLogs();
-      const gitAddAllCalls = toolLogs.filter((log) => {
-        if (log.toolRequest.name !== 'run_shell_command') return false;
-        try {
-          const args = JSON.parse(log.toolRequest.args);
-          if (!args.command) return false;
-          const cmd = args.command.toLowerCase();
-          return (
-            cmd.includes('git add .') ||
-            cmd.includes('git add -a') ||
-            cmd.includes('git add --all')
-          );
-        } catch {
-          return false;
-        }
-      });
-
-      expect(gitAddAllCalls.length).toBe(0);
-    },
-  });
 });

evals/hierarchical_memory.eval.ts

@@ -17,7 +17,7 @@ describe('Hierarchical Memory', () => {
     params: {
       settings: {
         security: {
-          folderTrust: { enabled: false },
+          folderTrust: { enabled: true },
         },
       },
     },
@@ -55,7 +55,7 @@ What is my favorite fruit? Tell me just the name of the fruit.`,
     params: {
       settings: {
         security: {
-          folderTrust: { enabled: false },
+          folderTrust: { enabled: true },
         },
       },
     },
@@ -96,7 +96,7 @@ Provide the answer as an XML block like this:
     params: {
       settings: {
         security: {
-          folderTrust: { enabled: false },
+          folderTrust: { enabled: true },
         },
       },
     },

evals/llm-judge.ts

@@ -1,94 +0,0 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-import { LlmRole, type BaseLlmClient } from '@google/gemini-cli-core';
-
-export interface JudgeOptions {
-  /**
-   * The number of parallel generations to run for majority voting.
-   * Defaults to 1. Use 3 or 5 for self-consistency.
-   */
-  selfConsistencyRuns?: number;
-  /**
-   * The model to use for judging. Defaults to gemini-3-flash-base.
-   */
-  model?: string;
-}
-
-export interface JudgeResult {
-  verdict: boolean;
-  reasoning: string[];
-  votes: { yes: number; no: number; other: number };
-}
-
-/**
- * A reusable LLM-as-a-judge utility for behavioral evaluations.
- */
-export class LLMJudge {
-  constructor(private readonly llmClient: BaseLlmClient) {}
-
-  /**
-   * Asks the LLM a Yes/No question and returns a boolean verdict.
-   * If selfConsistencyRuns > 1, it runs in parallel and returns the majority vote.
-   */
-  async judgeYesNo(
-    question: string,
-    options: JudgeOptions = {},
-  ): Promise<JudgeResult> {
-    const runs = options.selfConsistencyRuns ?? 1;
-    const model = options.model ?? 'gemini-3-flash-base';
-
-    const systemPrompt = `You are a strict, impartial expert judge. Read the provided evidence and question carefully. You MUST answer the question with ONLY "YES" or "NO". Do not provide any conversational filler or explanation before your answer.`;
-
-    const generateCall = async (): Promise<string> => {
-      try {
-        const response = await this.llmClient.generateContent({
-          modelConfigKey: { model },
-          contents: [{ role: 'user', parts: [{ text: question }] }],
-          systemInstruction: {
-            role: 'system',
-            parts: [{ text: systemPrompt }],
-          },
-          promptId: 'llm-judge-eval',
-          role: LlmRole.UTILITY_TOOL,
-          abortSignal: new AbortController().signal,
-        });
-
-        const text =
-          response.candidates?.[0]?.content?.parts?.[0]?.text
-            ?.trim()
-            ?.toUpperCase() || 'ERROR';
-        return text;
-      } catch (e: any) {
-        return `ERROR: ${e.message}`;
-      }
-    };
-
-    const promises = Array.from({ length: runs }).map(() => generateCall());
-    const rawResults = await Promise.all(promises);
-
-    let yes = 0;
-    let no = 0;
-    let other = 0;
-
-    for (const res of rawResults) {
-      // Remove any punctuation the model might have appended
-      const cleanRes = res.replace(/[^A-Z]/g, '');
-      if (cleanRes.startsWith('YES')) yes++;
-      else if (cleanRes.startsWith('NO')) no++;
-      else other++;
-    }
-
-    // Pass if YES > NO and YES > OTHER (plurality)
-    const pass = yes > no && yes > other;
-
-    return {
-      verdict: pass,
-      reasoning: rawResults,
-      votes: { yes, no, other },
-    };
-  }
-}

evals/memory_persistence.eval.ts

@@ -1,561 +0,0 @@
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-
-import { describe, expect } from 'vitest';
-import fs from 'node:fs';
-import path from 'node:path';
-import {
-  loadConversationRecord,
-  SESSION_FILE_PREFIX,
-} from '@google/gemini-cli-core';
-import { evalTest, assertModelHasOutput } from './test-helper.js';
-
-function findDir(base: string, name: string): string | null {
-  if (!fs.existsSync(base)) return null;
-  const files = fs.readdirSync(base);
-  for (const file of files) {
-    const fullPath = path.join(base, file);
-    if (fs.statSync(fullPath).isDirectory()) {
-      if (file === name) return fullPath;
-      const found = findDir(fullPath, name);
-      if (found) return found;
-    }
-  }
-  return null;
-}
-
-async function loadLatestSessionRecord(homeDir: string, sessionId: string) {
-  const chatsDir = findDir(path.join(homeDir, '.gemini'), 'chats');
-  if (!chatsDir) {
-    throw new Error('Could not find chats directory for eval session logs');
-  }
-
-  const candidates = fs
-    .readdirSync(chatsDir)
-    .filter(
-      (file) =>
-        file.startsWith(SESSION_FILE_PREFIX) &&
-        (file.endsWith('.json') || file.endsWith('.jsonl')),
-    );
-
-  const matchingRecords = [];
-  for (const file of candidates) {
-    const filePath = path.join(chatsDir, file);
-    const record = await loadConversationRecord(filePath);
-    if (record?.sessionId === sessionId) {
-      matchingRecords.push(record);
-    }
-  }
-
-  matchingRecords.sort(
-    (a, b) => Date.parse(b.lastUpdated) - Date.parse(a.lastUpdated),
-  );
-  return matchingRecords[0] ?? null;
-}
-
-async function waitForSessionScratchpad(
-  homeDir: string,
-  sessionId: string,
-  timeoutMs = 30000,
-) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    const record = await loadLatestSessionRecord(homeDir, sessionId);
-    if (record?.memoryScratchpad) {
-      return record;
-    }
-    await new Promise((resolve) => setTimeout(resolve, 1000));
-  }
-
-  return loadLatestSessionRecord(homeDir, sessionId);
-}
-
-describe('memory persistence', () => {
-  const proactiveMemoryFromLongSession =
-    'Agent saves preference from earlier in conversation history';
-  evalTest('USUALLY_PASSES', {
-    suiteName: 'default',
-    suiteType: 'behavioral',
-    name: proactiveMemoryFromLongSession,
-    messages: [
-      {
-        id: 'msg-1',
-        type: 'user',
-        content: [
-          {
-            text: 'By the way, I always prefer Vitest over Jest for testing in all my projects.',
-          },
-        ],
-        timestamp: '2026-01-01T00:00:00Z',
-      },
-      {
-        id: 'msg-2',
-        type: 'gemini',
-        content: [{ text: 'Noted! What are you working on today?' }],
-        timestamp: '2026-01-01T00:00:05Z',
-      },
-      {
-        id: 'msg-3',
-        type: 'user',
-        content: [
-          {
-            text: "I'm debugging a failing API endpoint. The /users route returns a 500 error.",
-          },
-        ],
-        timestamp: '2026-01-01T00:01:00Z',
-      },
-      {
-        id: 'msg-4',
-        type: 'gemini',
-        content: [
-          {
-            text: 'It looks like the database connection might not be initialized before the query runs.',
-          },
-        ],
-        timestamp: '2026-01-01T00:01:10Z',
-      },
-      {
-        id: 'msg-5',
-        type: 'user',
-        content: [
-          { text: 'Good catch — I fixed the import and the route works now.' },
-        ],
-        timestamp: '2026-01-01T00:02:00Z',
-      },
-      {
-        id: 'msg-6',
-        type: 'gemini',
-        content: [{ text: 'Great! Anything else you would like to work on?' }],
-        timestamp: '2026-01-01T00:02:05Z',
-      },
-    ],
-    prompt:
-      'Please save any persistent preferences or facts about me from our conversation to memory.',
-    assert: async (rig, result) => {
-      // The agent persists memories by editing markdown files directly with
-      // write_file or replace. The user said
-      // "I always prefer Vitest over
-      // Jest for testing in all my projects" — that matches the new
-      // cross-project cue phrase ("across all my projects"), so under the
-      // 4-tier model the correct destination is the global personal memory
-      // file (~/.gemini/GEMINI.md). It must NOT land in a committed project
-      // GEMINI.md (that tier is for team conventions) or the per-project
-      // private memory folder (that tier is for project-specific personal
-      // notes). The chat history mixes this durable preference with
-      // transient debugging chatter, so the eval also verifies the agent
-      // picks out the persistent fact among the noise.
-      await rig.waitForToolCall('write_file').catch(() => {});
-      const writeCalls = rig
-        .readToolLogs()
-        .filter((log) =>
-          ['write_file', 'replace'].includes(log.toolRequest.name),
-        );
-
-      const wroteVitestToGlobal = writeCalls.some((log) => {
-        const args = log.toolRequest.args;
-        return (
-          /\.gemini\/GEMINI\.md/i.test(args) &&
-          !/tmp\/[^/]+\/memory/i.test(args) &&
-          /vitest/i.test(args)
-        );
-      });
-      expect(
-        wroteVitestToGlobal,
-        'Expected the cross-project Vitest preference to be written to the global personal memory file (~/.gemini/GEMINI.md) via write_file or replace',
-      ).toBe(true);
-
-      const leakedToCommittedProject = writeCalls.some((log) => {
-        const args = log.toolRequest.args;
-        return (
-          /GEMINI\.md/i.test(args) &&
-          !/\.gemini\//i.test(args) &&
-          /vitest/i.test(args)
-        );
-      });
-      expect(
-        leakedToCommittedProject,
-        'Cross-project Vitest preference must NOT be mirrored into a committed project ./GEMINI.md (that tier is for team-shared conventions only)',
-      ).toBe(false);
-
-      const leakedToPrivateProject = writeCalls.some((log) => {
-        const args = log.toolRequest.args;
-        return (
-          /\.gemini\/tmp\/[^/]+\/memory\//i.test(args) && /vitest/i.test(args)
-        );
-      });
-      expect(
-        leakedToPrivateProject,
-        'Cross-project Vitest preference must NOT be mirrored into the private project memory folder (that tier is for project-specific personal notes only)',
-      ).toBe(false);
-
-      assertModelHasOutput(result);
-    },
-  });
-
-  const memoryRoutesTeamConventionsToProjectGemini =
-    'Agent routes team-shared project conventions to ./GEMINI.md';
-  evalTest('USUALLY_PASSES', {
-    suiteName: 'default',
-    suiteType: 'behavioral',
-    name: memoryRoutesTeamConventionsToProjectGemini,
-    messages: [
-      {
-        id: 'msg-1',
-        type: 'user',
-        content: [
-          {
-            text: 'For this project, the team always runs tests with `npm run test` — please remember that as our project convention.',
-          },
-        ],
-        timestamp: '2026-01-01T00:00:00Z',
-      },
-      {
-        id: 'msg-2',
-        type: 'gemini',
-        content: [
-          { text: 'Got it, I will keep `npm run test` in mind for tests.' },
-        ],
-        timestamp: '2026-01-01T00:00:05Z',
-      },
-      {
-        id: 'msg-3',
-        type: 'user',
-        content: [
-          {
-            text: 'For this project specifically, we use 2-space indentation.',
-          },
-        ],
-        timestamp: '2026-01-01T00:01:00Z',
-      },
-      {
-        id: 'msg-4',
-        type: 'gemini',
-        content: [
-          { text: 'Understood, 2-space indentation for this project.' },
-        ],
-        timestamp: '2026-01-01T00:01:05Z',
-      },
-    ],
-    prompt: 'Please save the preferences I mentioned earlier to memory.',
-    assert: async (rig, result) => {
-      // The prompt enforces an explicit one-tier-per-fact rule: team-shared
-      // project conventions (the team's test command, project-wide
-      // indentation rules) belong in the committed project-root ./GEMINI.md
-      // and must NOT be mirrored or cross-referenced into the private project
-      // memory folder
-      // (~/.gemini/tmp/<hash>/memory/). The global ~/.gemini/GEMINI.md must
-      // never be touched in this mode either.
-      await rig.waitForToolCall('write_file').catch(() => {});
-      const writeCalls = rig
-        .readToolLogs()
-        .filter((log) =>
-          ['write_file', 'replace'].includes(log.toolRequest.name),
-        );
-
-      const wroteToProjectRoot = (factPattern: RegExp) =>
-        writeCalls.some((log) => {
-          const args = log.toolRequest.args;
-          return (
-            /GEMINI\.md/i.test(args) &&
-            !/\.gemini\//i.test(args) &&
-            factPattern.test(args)
-          );
-        });
-
-      expect(
-        wroteToProjectRoot(/npm run test/i),
-        'Expected the team test-command convention to be written to the project-root ./GEMINI.md',
-      ).toBe(true);
-
-      expect(
-        wroteToProjectRoot(/2[- ]space/i),
-        'Expected the project-wide "2-space indentation" convention to be written to the project-root ./GEMINI.md',
-      ).toBe(true);
-
-      const leakedToPrivateMemory = writeCalls.some((log) => {
-        const args = log.toolRequest.args;
-        return (
-          /\.gemini\/tmp\/[^/]+\/memory\//i.test(args) &&
-          (/npm run test/i.test(args) || /2[- ]space/i.test(args))
-        );
-      });
-      expect(
-        leakedToPrivateMemory,
-        'Team-shared project conventions must NOT be mirrored into the private project memory folder (~/.gemini/tmp/<hash>/memory/) — each fact lives in exactly one tier.',
-      ).toBe(false);
-
-      const leakedToGlobal = writeCalls.some((log) => {
-        const args = log.toolRequest.args;
-        return (
-          /\.gemini\/GEMINI\.md/i.test(args) &&
-          !/tmp\/[^/]+\/memory/i.test(args)
-        );
-      });
-      expect(
-        leakedToGlobal,
-        'Project preferences must NOT be written to the global ~/.gemini/GEMINI.md',
-      ).toBe(false);
-
-      assertModelHasOutput(result);
-    },
-  });
-
-  const memorySessionScratchpad =
-    'Session summary persists memory scratchpad for memory-saving sessions';
-  evalTest('USUALLY_PASSES', {
-    suiteName: 'default',
-    suiteType: 'behavioral',
-    name: memorySessionScratchpad,
-    sessionId: 'memory-scratchpad-eval',
-    messages: [
-      {
-        id: 'msg-1',
-        type: 'user',
-        content: [
-          {
-            text: 'Across all my projects, I prefer Vitest over Jest for testing.',
-          },
-        ],
-        timestamp: '2026-01-01T00:00:00Z',
-      },
-      {
-        id: 'msg-2',
-        type: 'gemini',
-        content: [{ text: 'Noted. What else should I keep in mind?' }],
-        timestamp: '2026-01-01T00:00:05Z',
-      },
-      {
-        id: 'msg-3',
-        type: 'user',
-        content: [
-          {
-            text: 'For this repo I was debugging a flaky API test earlier, but that was just transient context.',
-          },
-        ],
-        timestamp: '2026-01-01T00:01:00Z',
-      },
-      {
-        id: 'msg-4',
-        type: 'gemini',
-        content: [
-          { text: 'Understood. I will only save the durable preference.' },
-        ],
-        timestamp: '2026-01-01T00:01:05Z',
-      },
-    ],
-    prompt:
-      'Please save any persistent preferences or facts about me from our conversation to memory.',
-    assert: async (rig, result) => {
-      await rig.waitForToolCall('write_file').catch(() => {});
-      const writeCalls = rig
-        .readToolLogs()
-        .filter((log) =>
-          ['write_file', 'replace'].includes(log.toolRequest.name),
-        );
-
-      expect(
-        writeCalls.length,
-        'Expected memory save flow to edit a markdown memory file',
-      ).toBeGreaterThan(0);
-
-      await rig.run({
-        args: ['--list-sessions'],
-        approvalMode: 'yolo',
-        timeout: 120000,
-      });
-
-      const record = await waitForSessionScratchpad(
-        rig.homeDir!,
-        'memory-scratchpad-eval',
-      );
-      expect(
-        record?.memoryScratchpad,
-        'Expected the resumed session log to contain a memoryScratchpad after session summary generation',
-      ).toBeDefined();
-      expect(record?.memoryScratchpad?.version).toBe(1);
-      expect(
-        record?.memoryScratchpad?.toolSequence?.some((toolName) =>
-          ['write_file', 'replace'].includes(toolName),
-        ),
-        'Expected memoryScratchpad.toolSequence to include the markdown editing tool used for memory persistence',
-      ).toBe(true);
-      expect(
-        record?.memoryScratchpad?.touchedPaths?.length,
-        'Expected memoryScratchpad to capture at least one touched path',
-      ).toBeGreaterThan(0);
-      expect(
-        record?.memoryScratchpad?.workflowSummary,
-        'Expected memoryScratchpad.workflowSummary to be populated',
-      ).toMatch(/write_file|replace/i);
-
-      assertModelHasOutput(result);
-    },
-  });
-
-  const memoryRoutesUserProject =
-    'Agent routes personal-to-user project notes to user-project memory';
-  evalTest('USUALLY_PASSES', {
-    suiteName: 'default',
-    suiteType: 'behavioral',
-    name: memoryRoutesUserProject,
-    prompt: `Please remember my personal local dev setup for THIS project's Postgres database. This is private to my machine — do NOT commit it to the repo.
-
-Connection details:
-- Host: localhost
-- Port: 6543 (non-standard, I run multiple Postgres instances)
-- Database: myproj_dev
-- User: sandy_local
-- Password: read from the SANDY_PG_LOCAL_PASS env var in my shell
-
-How I start it locally:
-1. Run \`brew services start postgresql@15\` to bring the server up.
-2. Run \`./scripts/seed-local-db.sh\` from the repo root to load my personal seed data.
-3. Verify with \`psql -h localhost -p 6543 -U sandy_local myproj_dev -c '\\dt'\`.
-
-Quirks to remember:
-- The migrations runner sometimes hangs on my machine if I forget step 1; kill it with Ctrl+C and rerun.
-- I keep an extra \`scratch\` schema for ad-hoc experiments — never reference it from project code.`,
-    assert: async (rig, result) => {
-      // With the Private Project Memory bullet surfaced in the prompt, a fact
-      // that is project-specific AND personal-to-the-user (must not be
-      // committed) should land in the private project memory folder under
-      // ~/.gemini/tmp/<hash>/memory/. The detailed note should be written to a
-      // sibling markdown file, with
-      // MEMORY.md updated as the index. It must NOT go to committed
-      // ./GEMINI.md or the global ~/.gemini/GEMINI.md.
-      await rig.waitForToolCall('write_file').catch(() => {});
-      const writeCalls = rig
-        .readToolLogs()
-        .filter((log) =>
-          ['write_file', 'replace'].includes(log.toolRequest.name),
-        );
-
-      const wroteUserProjectDetail = writeCalls.some((log) => {
-        const args = log.toolRequest.args;
-        return (
-          /\.gemini\/tmp\/[^/]+\/memory\/(?!MEMORY\.md)[^"]+\.md/i.test(args) &&
-          /6543/.test(args)
-        );
-      });
-      expect(
-        wroteUserProjectDetail,
-        'Expected the personal-to-user project note to be written to a private project memory detail file (~/.gemini/tmp/<hash>/memory/*.md)',
-      ).toBe(true);
-
-      const wroteUserProjectIndex = writeCalls.some((log) => {
-        const args = log.toolRequest.args;
-        return /\.gemini\/tmp\/[^/]+\/memory\/MEMORY\.md/i.test(args);
-      });
-      expect(
-        wroteUserProjectIndex,
-        'Expected the personal-to-user project note to update the private project memory index (~/.gemini/tmp/<hash>/memory/MEMORY.md)',
-      ).toBe(true);
-
-      // Defensive: should NOT have written this private note to the
-      // committed project GEMINI.md or the global GEMINI.md.
-      const leakedToCommittedProject = writeCalls.some((log) => {
-        const args = log.toolRequest.args;
-        return (
-          /\/GEMINI\.md/i.test(args) &&
-          !/\.gemini\//i.test(args) &&
-          /6543/.test(args)
-        );
-      });
-      expect(
-        leakedToCommittedProject,
-        'Personal-to-user note must NOT be written to the committed project GEMINI.md',
-      ).toBe(false);
-
-      const leakedToGlobal = writeCalls.some((log) => {
-        const args = log.toolRequest.args;
-        return (
-          /\.gemini\/GEMINI\.md/i.test(args) &&
-          !/tmp\/[^/]+\/memory/i.test(args) &&
-          /6543/.test(args)
-        );
-      });
-      expect(
-        leakedToGlobal,
-        'Personal-to-user project note must NOT be written to the global ~/.gemini/GEMINI.md',
-      ).toBe(false);
-
-      assertModelHasOutput(result);
-    },
-  });
-
-  const memoryRoutesCrossProjectToGlobal =
-    'Agent routes cross-project personal preferences to ~/.gemini/GEMINI.md';
-  evalTest('USUALLY_PASSES', {
-    suiteName: 'default',
-    suiteType: 'behavioral',
-    name: memoryRoutesCrossProjectToGlobal,
-    prompt:
-      'Please remember this about me in general: across all my projects I always prefer Prettier with single quotes and trailing commas, and I always prefer tabs over spaces for indentation. These are my personal coding-style defaults that follow me into every workspace.',
-    assert: async (rig, result) => {
-      // With the Global Personal Memory tier surfaced in the prompt, a fact
-      // that explicitly applies to the user "across all my projects" / "in
-      // every workspace" must land in the global ~/.gemini/GEMINI.md (the
-      // cross-project tier). It must
-      // NOT be mirrored into a committed project-root ./GEMINI.md (that
-      // tier is for team-shared conventions) or into the per-project
-      // private memory folder (that tier is for project-specific personal
-      // notes). Each fact lives in exactly one tier across all four tiers.
-      await rig.waitForToolCall('write_file').catch(() => {});
-      const writeCalls = rig
-        .readToolLogs()
-        .filter((log) =>
-          ['write_file', 'replace'].includes(log.toolRequest.name),
-        );
-
-      const wroteToGlobal = (factPattern: RegExp) =>
-        writeCalls.some((log) => {
-          const args = log.toolRequest.args;
-          return (
-            /\.gemini\/GEMINI\.md/i.test(args) &&
-            !/tmp\/[^/]+\/memory/i.test(args) &&
-            factPattern.test(args)
-          );
-        });
-
-      expect(
-        wroteToGlobal(/Prettier/i),
-        'Expected the cross-project Prettier preference to be written to the global personal memory file (~/.gemini/GEMINI.md)',
-      ).toBe(true);
-
-      expect(
-        wroteToGlobal(/tabs/i),
-        'Expected the cross-project "tabs over spaces" preference to be written to the global personal memory file (~/.gemini/GEMINI.md)',
-      ).toBe(true);
-
-      const leakedToCommittedProject = writeCalls.some((log) => {
-        const args = log.toolRequest.args;
-        return (
-          /GEMINI\.md/i.test(args) &&
-          !/\.gemini\//i.test(args) &&
-          (/Prettier/i.test(args) || /tabs/i.test(args))
-        );
-      });
-      expect(
-        leakedToCommittedProject,
-        'Cross-project personal preferences must NOT be mirrored into a committed project ./GEMINI.md (that tier is for team-shared conventions only)',
-      ).toBe(false);
-
-      const leakedToPrivateProject = writeCalls.some((log) => {
-        const args = log.toolRequest.args;
-        return (
-          /\.gemini\/tmp\/[^/]+\/memory\//i.test(args) &&
-          (/Prettier/i.test(args) || /tabs/i.test(args))
-        );
-      });
-      expect(
-        leakedToPrivateProject,
-        'Cross-project personal preferences must NOT be mirrored into the private project memory folder (that tier is for project-specific personal notes only)',
-      ).toBe(false);
-
-      assertModelHasOutput(result);
-    },
-  });
-});

evals/plan_mode.eval.ts

@@ -420,54 +420,4 @@ describe('plan_mode', () => {
       assertModelHasOutput(result);
     },
   });
-
-  evalTest('USUALLY_PASSES', {
-    suiteName: 'plan_mode',
-    suiteType: 'behavioral',
-    name: 'should invoke exit_plan_mode as a tool instead of a shell command',
-    approvalMode: ApprovalMode.PLAN,
-    params: {
-      settings: {
-        general: {
-          plan: { enabled: true },
-        },
-      },
-    },
-    files: {
-      'plans/my-plan.md': '# My Plan\n\n1. Step one',
-    },
-    prompt:
-      'I agree with the plan in plans/my-plan.md. Please exit plan mode and then run `echo "Starting implementation"`',
-    assert: async (rig) => {
-      await rig.waitForTelemetryReady();
-      const toolLogs = rig.readToolLogs();
-
-      // Check if exit_plan_mode was called as a tool
-      const exitPlanToolCall = toolLogs.find(
-        (log) => log.toolRequest.name === 'exit_plan_mode',
-      );
-
-      // Check if exit_plan_mode was called via shell
-      const shellCalls = toolLogs.filter(
-        (log) => log.toolRequest.name === 'run_shell_command',
-      );
-      const exitPlanViaShell = shellCalls.find((log) => {
-        try {
-          const args = JSON.parse(log.toolRequest.args);
-          return args.command.includes('exit_plan_mode');
-        } catch {
-          return false;
-        }
-      });
-
-      expect(
-        exitPlanViaShell,
-        'Should NOT call exit_plan_mode via run_shell_command',
-      ).toBeUndefined();
-      expect(
-        exitPlanToolCall,
-        'Should call exit_plan_mode tool directly',
-      ).toBeDefined();
-    },
-  });
 });